Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power

Transcription

1 Risk Analysis, Vol. 27, No. 3, 2007 DOI: /j x Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power Jeffrey S. Simonoff, 1 Carlos E. Restrepo, 2 and Rae Zimmerman 2 Incident data abot disrptions to the electric power grid provide sefl information that can be sed as inpts into risk management policies in the energy sector for disrptions from a variety of origins, inclding terrorist attacks. This article ses data from the Distrbance Analysis Working Grop (DAWG) database, which is maintained by the North American Electric Reliability Concil (NERC), to look at incidents over time in the United States and Canada for the period Negative binomial regression, logistic regression, and weighted least sqares regression are sed to gain a better nderstanding of how these distrbances varied over time and by season dring this period, and to analyze how characteristics sch as nmber of cstomers lost and otage dration are related to different characteristics of the otages. The reslts of the models can be sed as inpts to constrct varios scenarios to estimate potential otcomes of electric power otages, encompassing the risks, conseqences, and costs of sch otages. KEY WORDS: Electric power otages; logistic regression; negative binomial regression; prediction interval; weighted least sqares 1. INTRODUCTION Disrptions to the power grid are an ongoing concern for risk management in the energy sector. Althogh there have, to date, not been any terrorist attacks on the power grid in the United States or Canada by a foreign entity, sch attacks are common in other contries. The conseqences of these disrptions inclde effects on the economic and health stats of the contry. It is ths important to try to nderstand the characteristics of disrption to the power grid, so that 1 Leonard N. Stern School of Bsiness, New York University, New York, NY, USA. 2 Robert F. Wagner Gradate School of Pblic Service, New York University, New York, NY, USA. Address correspondence to Rae Zimmerman, Robert F. Wagner Gradate School of Pblic Service, New York University, 295 Lafayette St. 2nd Fl., New York, NY 10012; tel: ; Fax: ; Rae.zimmerman@ny.ed. reasonable assessments of the risks associated with sch disrptions can be qantified. In this article, varios forms of statistical regression analyses are sed to model the characteristics of power otages in the United States and Canada. None of these disrptions are a reslt of terrorist activity, bt nderstanding the effects of typical disrptions wold make it possible to estimate the effects of a terrorist-based disrption, especially since there is enogh of a similarity between the types of components disrpted in both types of events (as described below). The potentially large effects of sch disrptions, as evidenced by the roghly 50 million people affected by the Agst 14, 2003 otage lasting an average of two days in most places in the northeastern United States and sotheastern Canada, and the roghly 100,000 people affected by the one-week Jly 18, 2006 otage in Qeens neighborhoods in New York City (Newsday, 2006), reinforces the importance of nderstanding the potential implications of /07/ $22.00/1 C 2007 Society for Risk Analysis

2 548 Simonoff, Restrepo, and Zimmerman terror-related otages. The resltant regression models allow s to see what characteristics of an event are associated with its dration and how many cstomers are affected. On the basis of these models, predictions (and probability intervals for those predictions) can be made for different disrption scenarios that allow for qantitative assessments of potential risks and conseqences of attacks on the power grid regardless of the sorce of the attack. Of corse, these predictions are also sefl in the context of nonterrorist disrption of the power grid, sch as from the severe weather effects of tornadoes, hrricanes, and winter storms Analogies Between Terrorist and Nonterrorist Disrptions of Electric Power Systems An analysis of selected data from the National Memorial Institte for the Prevention of Terrorism (MIPT) database ( indicates that in a 10-year period between 1994 and 2004, there were more than 300 terrorist attacks arond the world against electricity infrastrctre alone (Zimmerman et al., 2005). The analogy between international terrorist attacks and domestic nonterrorist disrptions of electric power systems is spported by a comparison of the MIPT database of international attacks and the Distrbance Analysis Working Grop (DAWG) database, maintained by the North American Electric Reliability Concil (NERC) for North American disrptions. This comparison indicates similarities between components disrpted by terrorist attacks otside of North America and nonterrorist disrptions within North America. The most common components disrpted in both cases were transmission lines and towers, acconting for abot 90% of North American disrptions and abot two-thirds of international terrorist-related disrptions (Zimmerman et al., 2005, Table 1, p. 19). These similarities, at least at the component or conseqence level between terrorist and nonterrorist electricity disrptions, spport sing nonterrorist databases to estimate the potential conseqences of terrorist attacks on electricity. That research frther explored grid configrations (particlarly at the transmission level) that cold contribte to vlnerability and the degree of the conseqences of a disrption for major cities. In short, certain cities are more vlnerable than others by virte of their reliance on transmission lines that enter the city from jst one or two directions (Zimmerman et al., 2005, pp ). This point informs the choice of application areas later in this article Literatre Review of Event-Based Analyses Modeling of Electric Power Otages The major contribtion of this work is to provide a statistical regression-based approach sing trend data to model the conseqences and severity of otages from the characteristics of otage events. This will serve as a basis for decision tools that enable sers to estimate the probability of certain impacts of otages occrring, and tailor these estimates to specific geographic areas. To or knowledge, this type of approach sing statistical regression models has not been applied to estimating these dimensions of electric power otages. As smmarized by Zimmerman et al. (2005), one body of literatre contains extensive analyses of electric power otage event data (see, for example, Amin, 2004; Carreras et al., 2002; Chen et al., 2001; Liao et al., 2004), bt does not se statistical regression analysis. Another body of literatre has attempted to model otages, bt primarily by bilding scenarios and/or throgh grid network disrption estimates (see, for example, Ezell et al., 2000a, 2000b; Haimes, 1981; Salmeron et al., 2004; Lemon & Apostolakis, 2004; Apostolakis & Lemon, 2005). A third related literatre ses scenario-based or simlation-based modeling of infrastrctre interdependencies in general (see, for example, Garrick et al., 2004; Martz & Johnson, 1987; Masiello et al., 2004; Paté-Cornell & Gikema, 2002). Several stdies have analyzed data from the DAWG database sing methods that are different from those sed in this article and for a different prpose. Chen et al. (2001) analyzed the data for the period and constrcted blackot time series signals. The size of the blackots is represented by the amont of power lost in megawatts, the nmber of cstomers affected, and the dration of the otage or restoration time. The time series inclde data for every day of the period with zero every day except for the days when blackots occrred. The time series is then sed to explore whether the data have a power law distribtion by sing a cmlative distribtion fnction (CDF). In addition, the scaled windowed variance (SWV) method is sed to estimate the Hrst or scaling exponents of the varios time series and its sitability to the data is discssed. Carreras et al. (2002) also analyzed DAWG data for the period to examine whether the complex dynamic of the blackots is governed by selforganized criticality (SOC). The athors constrcted times series with the resoltion of a day for the

3 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 549 nmber of blackots and for three measres of blackot size: energy nserved, amont of power lost in megawatts, and nmber of cstomers affected. The data are sed to explore dependencies in the time domain. They also find a power law tail of the probability distribtion fnctions (PDF). The athors se the rescaled range statistics (R/S statistics) to calclate Hrst exponents for the different measres of blackot size. Similarly, Talkdar et al. (2003) also se DAWG data for the period to show that large blackots, sch as those exceeding 500 megawatts lost, can be described by a power law whereas the smaller blackots follow an exponential crve. These types of analyses of the DAWG data are very different in prpose and methods to the analyses presented in this article and described in the following sections. 2. DATA The analyses presented in this article se data from the Distrbance Analysis Working Grop (DAWG) database, which is maintained by the North American Electric Reliability Concil (NERC). The database has commonly been sed by researchers to analyze power otages and varios attribtes of the grid, while recognizing some of the shortcomings of the database (Apt, 2005; Talkdar et al., 2003; Chen et al., 2001; Carreras et al., 2002; Amin, 2004). Data are collected on a volntary basis, implying the possibility of nknown biases in the otages reported, as well as potential changes in the way the data have been reported over time. The U.S. Department of Energy (2003) also has a database of otages, bt for the sake of temporal consistency and the ability to tap a database spanning a longer time period, the DAWG database was sed throghot. The data sed in this article are for distrbances to the electric power grids in the United States and Canada for the period (in this article the terms distrbances, incidents, events, and otages are sed interchangeably). Information from the entries in the DAWG database was sed to create a data set with a nmber of variables that characterized each event. These inclded otage dration measred in hors, nmber of cstomers lost, and megawatts lost. All three of these variables are extremely long right-tailed. The mean dration of an otage in the United States was more than 40 hors, while the median dration was 8 hors; corresponding nmbers for Canada are noticeably smaller, being 7.3 and 0.8 hors, respectively (bt still long right-tailed). Similarly, mean and median cstomer losses were 175,346 (mean) and 67,765 (median) for the United States and 58,897 (mean) and 1 (median) for Canada, respectively, and mean and median power loss (in MW) were 786 (mean) and 250 (median) for the United States and 513 (mean) and 258 (median) for Canada, respectively. For this reason, all these variables are analyzed in the log scale. The case of the incident is also a potentially important predictor of the magnitde and characteristics of an otage and also the constrction of analogies between nonterrorist and terrorist conseqences. In addition, the relative importance of these cases can change over time and that cold have important implications for policies aimed at minimizing the risk of power otages and for the constrction of scenarios that explore economic costs associated with otages. Table I gives the distribtion of the different cases for the incidents. A proxy for poplation density in the area of the otage was also inclded in the data for the prpose of United States Canada Case Code Freqency Percent Freqency Percent Table I. Distribtion of Primary Cases of Otages in the United States and Canada Capacity shortage C Crime Crime Demand redction D Eqipment failre E Fire F Hman error H Operational error O Natral disaster N System protection S Third party T Unknown U Weather W Total

4 550 Simonoff, Restrepo, and Zimmerman regression modeling. This was approximated by sing poplation density for the state where the otage occrred in the United States and for the province where the otage occrred in Canada. It shold certainly be noted that since most otages cover geographic regions smaller than a state or province and within a given state poplation density can be highly variable, this is only a crde proxy for the local poplation density. An additional measre added to the data was the nmber of cstomers served by the tility or tilities affected by each otage. This information was compiled from the U.S. Department of Energy, Energy Information Administration s Annal Electric Power Indstry Report (U.S. Department of Energy, 2003), individal tility pages on the Internet, and electric power trade associations. 3. METHODS The first set of analyses inclded in this article refers to models of conts of incidents over time. The standard model for cont response data is the Poisson regression model, bt this model imposes the restriction that the mean response and the variance of the response be eqal. For the data examined here, there is clear overdispersion, with the variance larger than the mean. This is a common occrrence when there is nmodeled heterogeneity in the data (that is, the time periods are different from each other in ways that are nknown to the analyst). For this reason, the analyses here are based on negative binomial regression, which acconts for this overdispersion. See Simonoff (2003, ch. 5), for frther discssion of these points. The data for nmber of incidents were aggregated into threeand six-month periods, approximating seasons, to examine whether there are time trends. The second set of analyses refers to event-level data. These event analyses accont for characteristics niqe to the particlar event, sch as its case and location, throgh regression modeling. Two different kinds of models were sed for the event-level analyses. In the case of nmber of cstomers lost, there are two kinds of events: those reslting in zero cstomers lost, and those with nonzero cstomers lost. It is important to distingish these two types of events since they have different characteristics. Hence, the data were modeled in two parts. First, the characteristics related to whether an incident has zero or nonzero cstomers lost are examined. Then, given that the nmber of cstomers lost is not zero, the characteristics that help predict the actal nmber of cstomers lost are determined. The first part of the analysis is based on logistic regression. In a logistic regression, the response variable is binary (in this case, whether or not the event had zero cstomer loss), and a binomial distribtion is sed to represent its random character. The probability of an event having zero cstomer loss, p, is related to predictors throgh the odds, p/(1 p); specifically, the logarithm of the odds is modeled as a linear fnction of the predictors (Simonoff, 2003, ch. 9). For the second part of the analysis, weighted least sqares (WLS) was sed to correct for nonconstant variance in the data. In the WLS analysis, the events from cases with less variability, sch as capacity shortage and fire, are weighted higher, while those from cases with more variability, sch as eqipment failre and system protection, are weighted lower. Weighted least sqares regression was also sed to model logged dration of an otage. Frther details on the U.S. portion of this analysis can be fond in Simonoff et al. (2005). 4. RESULTS 4.1. Incidents Over Time The first part of this analysis consists of looking at the nmber of incidents aggregated over six-month periods for The negative binomial model fits the data well. For the U.S. data the deviance eqals 15.3 on 12 degrees of freedom ( p = 0.23, not rejecting the fit of the model). The estimated annal increase in incidents implies a 7.2% annal increase in incidents. For Canada, the model also fits the data reasonably well (the deviance is 32.3 on 24 degrees of freedom, p = 0.12), and it implies an estimated 8.2% annal increase in incidents. Examining the data at a seasonal (three-month period) level allows for the inclsion of different levels for different seasons. In these analyses, winter is defined as December throgh Febrary, spring as March throgh May, smmer as Jne throgh Agst, and atmn as September throgh November. The reslts for the seasonal analysis are smmarized in Fig. 1 for the United States and in Fig. 2 for Canada. The winter points (labeled w ) and line (dotted line) are in ble, the spring points (labeled p ) and line (dashed line) are in green, the smmer points (labeled ) and line (solid line) are in red, and the atmn points (labeled a ) and line (dotted-and-dashed line) are in orange. The negative binomial models fit the data adeqately. For the U.S. model, the deviance is 66.5 on 53 degrees of freedom ( p = 0.10) and implies an

5 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 551 w Fig. 1. Plot of nmber of incidents in United States verss time by season, with estimated expected conts by season sperimposed on the plot. Incidents by season w p w p p a a aw w a p a a p p awp w w p w aw p a w p w a w a p p p p a w a w a p Date Key: The winter points (w) and dashed line are in ble, the spring points (p) and dotted line are in green, the smmer points () and solid line are in red, and the atmn points (a) and short dashed line are in orange. Calclations by the athors. estimated 9.7% annal increase in incidents given season, which is highly statistically significant ( p < ). For Canada, the model fits the data barely adeqately (the deviance is 60.4 on 46 degrees of freedom, p = 0.08). The model implies an estimated 9.6% annal increase in incidents given season, virtally the same as for the U.S. data. There are several plasible explanations for the observed annal increase in incidents. Electricity de- mand has increased steadily over time (North American Energy Working Grop, 2006), and this increased demand pts more strain on the electricity grid. In addition, Lerner (2003) gave several reasons why the dereglation of the electricity markets in the United States and Canada starting in the 1990s wold be (and was) expected to lead to more blackots. Specifically, while long-distance energy transfers were rare before dereglation, and were sed mainly in Fig. 2. Plot of nmber of incidents in Canada verss time by season, with estimated expected conts by season sperimposed on the plot. Incidents by season w p a p p wp aw w awp a wp w a p aw p p awp w a w p a a w a p a p w w a Date Key: The winter points (w) and dashed line are in ble, the spring points (p) and dotted line are in green, the smmer points () and solid line are in red, and the atmn points (a) and short dashed line are in orange.

6 552 Simonoff, Restrepo, and Zimmerman emergencies, they have now become commonplace. Sch transfers are mch more physically complex, involve more complex interconnections between the large physical sbsections of the power grid, and introdce capacity limits, reslting in greater chances of nanticipated changes in loads on generators and transmission lines, and hence blackots. These problems were componded by energy traders who deliberately blocked competitors access to the power grid, artificially driving p prices while also increasing stress on the system. Utility companies have also ct staff, reslting in overextended workers and redction in basic maintenance. Finally, as a reslt of many of these factors, the grid has become far more interconnected, so that a failre in one part of a system is likely to affect others. Moreover, many more activities are now interconnected with electric power as well, and these interdependencies have the potential for increasing the conseqences of an electric power failre (Zimmerman & Restrepo, 2006; Zimmerman, 2006). While the winter, spring, and atmn estimated rates for the United States are similar to each other (with atmn having a rate that is slightly lower), smmer has a noticeably higher rate of incidents. The similarity in rates across seasons is presmably from different weather effects operating in each season: snow and ice in the winter, thnderstorms in parts of the United States in spring, and, most importantly, thnderstorms and intense heat (with corresponding air conditioner se) in the smmer (and the lack of all of these factors in the atmn; we might have expected evidence of a hrricane effect in atmn, bt only Hrricane Floyd in 1999 and Hrricane Isabel in 2003 show p as noteworthy). The difference between the smmer rate and that of the other seasons is highly statistically significant, bt, more importantly, corresponds to an important effect in practical terms, since the estimated nmber of incidents is 60 80% higher in smmer than in the other seasons, given the year. In the case of Canada there is little evidence of a season effect (presmably becase of the less extreme smmer temperatres in Canada), althogh smmer does again have the highest estimated incident rate. In addition to looking at the total nmber of incidents over time, similar analyses were made for those incidents with nonzero cstomer loss and nonzero megawatts lost. Sch incidents are of particlar importance, since these are the ones that actally affect cstomers. Overdispersion is evident in all of the models, so all analyses are based on the negative binomial model. For the U.S. data the estimated annal increase in incidents with nonzero MW loss is 10.0%, which is highly statistically significant ( p < ), with an estimated % higher rate for smmer than for the other seasons. The smmer effect is stronger than it was in the model for nmber of incidents. While more than 90% of the smmer incidents had nonzero MW loss, roghly one pon for of the incidents in the atmn had zero MW loss. That is, nonzero MW incidents are more likely in the smmer, thereby strengthening the smmer effect. The reslts for the Canada model in terms of incidents with nonzero MW loss are in direct contrast to the sitation sing all of the incidents, and also in contrast to the reslts for the U.S. data. There is no evidence of a time trend in the nonzero MW Canadian incidents. The implication of this is that the rate of zero MW loss incidents in Canada has been increasing in recent years. From 1990 to 1994, the proportion of Canadian incidents with zero MW loss was never more than 25% (among those for which MW loss was recorded), while from 1995 to 2002, in five of the eight years at least 30% of the incidents had zero MW loss. It shold be noted, however, that the estimated increase in incident rate of 3.5%, while smaller than that in the United States (6.0%), is not significantly different from that vale. When season is introdced, the model implies an estimated 1.7% annal increase in incident rate given season, which is not statistically significant, and an estimated 75% higher rate for smmer than for the other seasons, althogh the smmer effect is also not statistically significant. The model for incidents with nonzero cstomers lost in the United States implies an estimated 14.0% annal increase in incident rate ( p < ), and an estimated % higher rate for smmer than for the other seasons. The smmer effect is similar to that for the nonzero MW loss data, bt the pattern is a little more complicated: both smmer and winter have lower rates of incidents with zero cstomer loss compared to spring and atmn, so the estimated relative chances of incidents in those seasons compared to spring and atmn are now higher. Overall, while removing the zero MW loss incidents has relatively little effect on the estimated annal increase in incident rate, removing the zero cstomer loss incidents has a stronger effect on the estimated annal increase of rates, increasing it to 12 14%. The reslts of the model for Canada are different from those of the United States, since there is little evidence of any relationship with either season or time for incidents with nonzero cstomers lost. When focsing on incidents with nonzero cstomer loss, the

7 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 553 rate of incidents in Canada is, if anything, decreasing over time, while that in the United States is increasing. This is in contrast to the sitation when looking at all incidents, where the rate is going p at a similar rate in both contries. As was noted earlier, the reason for this is the difference in the two contries in the likelihood of an otage having zero cstomer loss. The generally less-serios otcomes of Canadian incidents compared to incidents in the United States (sch as shorter typical dration, no increase over time in incidents that reslted in nonzero cstomer loss or nonzero power loss) warrants frther comment. Althogh the electricity grids in the United States and Canada are strongly interconnected, there are differences between the two contries that cold accont for this pattern. The great majority (almost 85%) of the incidents in Canada were in provinces that are net exporters of electricity (North American Energy Working Grop, 2006). Incidents in sch provinces occr in areas of excess spply of electricity, which can be more easily sed to recover from or compensate for local otages. The proportion of incidents in provinces that are net exporters of electricity was higher in recent years than in earlier ones (North American Energy Working Grop, 2006), which cold be a factor in why the nmber of more serios incidents (nonzero MW loss and/or cstomer loss) are if anything slightly decreasing in Canada, rather than increasing (as they are in the United States). The distribtion of types of power plants is very different in the United States and Canada. While roghly half of electricity generation in the United States comes from coal-fired plants, more than half of electricity generation in Canada comes from hydropower (estimated 2005 vales) (North American Energy Working Grop, 2006). Hydroelectric plants have an abndant and readily available local fel spply with the exception of rare periods of droght, while that for coal-fired plants is limited and difficlt to move. This clearly has an effect on recovery time from an otage. As noted by Lerner (2003), hydroelectric power plants in Ontario and Qebec were reglarly involved in long-distance power transfers before the advent of dereglation, so it is reasonable to speclate that they have been better able to handle the stresses that come from sch transfers noted in Section 4.1 than other types of plants. Another explanation for the relatively good performance of the power grid in Canada is an economic one. Electricity demand is growing more slowly in Canada than in the United States, even thogh the economies of the two contries are growing at a similar rate (North American Energy Working Grop, 2006). As noted earlier, increased demand wold be expected to lead to increased stress on the system, and less demand growth wold be expected to correspond to better reslts Event-Level Analyses In this section, we present the reslts of weighted least sqares regression models that se characteristics of each event, sch as case, season, and a proxy for poplation density, to gain a better nderstanding of the factors that affect the nmber of cstomers lost and dration of an otage Nmber of Cstomers Lost Dring an Otage The first analysis refers to nmber of cstomers lost, and the first isse explored is whether an incident has zero or nonzero cstomers lost and the factors that affect this otcome. As mentioned earlier, these analyses sed logistic regression. The U.S. data sggest that there is little difference in the distribtion of logged total cstomers served by a tility for incidents with nonzero cstomer loss verss for incidents with zero cstomer loss. As might be expected of apparently more serios incidents, longer incidents are associated with nonzero cstomer loss. Also, incidents in more densely poplated states are more likely to have nonzero cstomer loss. In addition, there is a strong pattern where incidents earlier in time are more likely to have zero cstomer loss. The other potential predictors for the nmber of cstomers lost dring an otage are season and case of the otage. In the United States, zero loss incidents are more common in the spring (26.3%) and atmn (21.3%), and less common in the smmer (15.3%) and winter (13.9%). These are not, however, very strong effects. Weather-related incidents are very likely to have nonzero cstomer loss, no dobt at least in part becase of the disrption of overhead transmission and distribtion lines by fallen trees (which can occr in either smmer or winter storms), and are not fixed qickly or at least before cstomers are affected. Capacity shortage, system protection, and nknown cases are also strongly associated with nonzero cstomer loss, bt this is based on far fewer incidents. Eqipment failre is noticeably less related to nonzero cstomer loss (while also having a large nmber of incidents). More atypical cases that are less associated with nonzero cstomer loss inclde fire, hman error, natral disaster, and operational error; crime, demand redction, and third-party case

8 554 Simonoff, Restrepo, and Zimmerman have zero cstomer loss rates more than 50% (althogh again, based on few incidents). For the U.S. model, logged dration, logged poplation density, a time trend (days since 1990), and case are significant predictors of whether an event is associated with zero or nonzero cstomer loss, bt season is not. The coefficients prodced by the model have the following interpretations. A 1% increase in the dration of an incident is associated with an estimated 0.3% decrease in the odds that an incident will have zero cstomer loss, holding all else in the model fixed. A 1% increase in the state poplation density is associated with an estimated 0.6% decrease in the odds that an incident will have zero cstomer loss, holding all else in the model fixed. The estimated annal decrease in the odds of an event having zero cstomer loss is 11.3%, holding all else in the model fixed. Finally, given the other predictors, crime, demand redction, and third-party case are strongly associated with zero cstomer loss, while operational error, system protection, and weather are strongly associated with nonzero loss. The analysis of the Canada data is based on fewer observations. Unfortnately, for 17 of the incidents, a cstomer loss vale was not available (and hence it can t be known if the cstomer loss was zero or not). In addition, for 26 other incidents, (logged) dration was not available. Together, this means that the Canada model is based on only 55 data points. For these data, logged total cstomers served by the tility has an inverse relationship with the probability that an otage has zero cstomer loss; a 1% increase in the cstomer base is associated with a 1.1% decrease in the odds that an incident has a zero cstomer loss. In contrast, in the United States logged total cstomers served by the tility did not appear in the corresponding (simplified) logistic regression model. As was tre in the United States, longer otages are associated with smaller likelihood of zero cstomer loss; a 1% increase in dration is associated with a 0.5% decrease in the odds that an otage has zero cstomer loss. In contrast to the United States, otages in denser areas of Canada (provinces rather than states here) are associated with a higher chance of it being a zero cstomer loss incident, as a 1% increase in poplation density is associated with a 1.4% increase in the odds of having zero cstomer loss, holding all else fixed (the relationship was in the opposite direction in the U.S. data). As was noted earlier, in direct contrast to the sitation in the United States, zero cstomer loss incidents are becoming more common in Canada, corresponding to an estimated 31.5% annal increase in the odds that an otage has zero cstomer loss, given the other predictors. Winter and especially smmer incidents are less likely to have zero cstomer loss, althogh this does not appear to be statistically significant. Compared to the other category, given the other predictors, crime and weather are more likely to occr with zero cstomer loss incidents, while eqipment failre and hman error are less likely. These are not very similar to the patterns in the U.S. data. Table II smmarizes the differences between the two contries with respect to the model in terms of the relationship with the probability that an incident has zero cstomer loss. The second aspect of cstomer loss explored is the factors related to the nmber of cstomers lost dring an otage given that one or more cstomers are lost. Weighted least sqares regression was sed to model the (logged) nmber of cstomers lost, given that that nmber is nonzero. Figs. 3 8 describe the observed relationships for the U.S. and Canada data, with loess nonparametric regression crves sperimposed on the plots in Figs. 3 and 4 (Simonoff, 1996, ch. 5). Total cstomers refer to the total nmber of cstomers served by a tility or tilities affected by an otage; note that this is typically mch smaller than the nmber of hoseholds or individals affected by an otage, since it incldes indstrial cstomers and other bsiness establishments, and an entire apartment bilding can be recorded as a single cstomer. The primary important predictors of cstomers lost in the U.S. data are total nmber of cstomers served by a tility and primary case. A 1% increase in total cstomers is associated with a 0.18% estimated increase in cstomers lost, holding all else in the model fixed. In contrast, in Canada, having more cstomers Effect United States Canada Table II. Differences in Relationships in the United States and Canada Data Between Predictors and the Probability that An Incident Has Zero Cstomer Loss Logged total cstomers No relationship Inverse relationship Logged poplation density Inverse relationship Direct relationship Time (days since 1990) Inverse relationship Direct relationship Primary case Weather lower probability than eqipment failre Weather higher probability than eqipment failre

9 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 555 Logged cstomers lost Logged cstomers lost Logged total cstomers Logged dration Logged cstomers lost Days since 1990 Fig. 3. Plots of logged cstomers lost verss event characteristics in the United States with loess lines sperimposed on plots. Logged cstomers lost Logged cstomers lost Logged total cstomers Logged dration Logged cstomers lost Days since 1990 Fig. 4. Plots of logged cstomers lost verss event characteristics in Canada with loess lines sperimposed on plots.

10 556 Simonoff, Restrepo, and Zimmerman Fig. 5. Side-by-side boxplots of logged cstomers lost separated by season, U.S. data. Logged cstomers lost Spring Smmer Atmn Winter Season served is associated with having fewer cstomers lost, althogh the relationship is very weak (and not close to statistical significance). The relationships between cstomers lost and dration are not significantly different in the two data sets, with a joint estimate implying that a 1% increase in dration is associated with a 0.2% increase in cstomer loss. Frther, while there is no evidence of a time trend in cstomer loss in the U.S. data, in the Canada data, given the other predictors, cstomer loss is decreasing at an estimated 29.5% annal rate. Cstomer losses are higher for natral disaster, crime, nknown cases, and third party, and lower for system protection, capacity shortage, and eqipment failre, holding all else in the model fixed. It is interesting to note that the largest cstomer losses are coming from cases that are clearly beyond the control of the tility, while the smallest losses are coming from cases that are internal to the tility, perhaps sggesting that oversight and preparation at the plant level can be effective in redcing the effects of incidents. In the Canada data, there is also a primary case effect with eqipment failre, hman error, and system protection having generally higher cstomer losses, and crime and weather having smaller losses. The boxplots shown in Figs. 5 8 were constrcted so that the width Fig. 6. Side-by-side boxplots of logged cstomers lost separated by season, Canada data. Logged cstomers lost Spring Smmer Atmn Winter Season

11 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 557 Fig. 7. Side-by-side boxplots of logged cstomers lost separated by primary case, U.S. data. Logged cstomers lost C CrimeD E F H N O S T U W Note: See Table I for the definitions for primary case. Primary case of the box is proportional to the sqare root of the sample size for that grop, so the wider the box, the more information there is for that grop. It is evident that most incidents are either weather related or de to eqipment failre, so effects related to these cases have the largest practical effect on the pblic. There is little evidence of a seasonal effect in the U.S. model, whereas in the Canada model a marginally significant season effect is that fewer cstomers are lost dring the smmer. Table III smmarizes the differences between the two contries with respect to the model in terms of the relationship with the nmber of cstomers lost, given that it is nonzero. The incident-level analyses reinforce that the seriosness of the otcomes of incidents in Canada has been decreasing over time, while it has been increasing or staying the same in the United States. The earlier argments abot potential reasons why the nmber of more serios incidents has not been growing in Fig. 8. Side-by-side boxplots of logged cstomers lost separated by primary case, Canada data. Logged cstomers lost Crime E H O S W Note: See Table I for the definitions for primary case. Primary case

12 558 Simonoff, Restrepo, and Zimmerman Effect United States Canada Table III. Differences in Relationships in the United States and Canada Data Between Predictors and the Expected Cstomer Loss, Given that it is Nonzero Logged total cstomers (Weak) direct relationship Inverse relationship Time (days since 1990) No relationship Inverse relationship Season No relationships Cstomer loss lower in spring and smmer Primary case Weak relationship, other than crime having higher vales Eqipment failre and hman error have higher vales Canada apply here as well: the geographic distribtion of the incidents in Canada is changing over time, Canadian hydroelectric power plants have more experience with long-distance power transfers than do U.S. plants, and electricity demand in Canada is growing at a slower rate than in the United States Dration of an Otage The observed relationships for dration of an otage are described in Figs for the U.S. and Canada data. As Figs. 9 and 10 show, there is little evidence of a relationship between logged dration and logged to- tal cstomers served by an affected tility. There is evidence of a positive relationship with logged state poplation density (ignoring the two relatively short events at the very high poplation density level in Fig. 9). There is weak evidence of the time trend on dration in the United States, bt little evidence in Canada. There is some evidence of a season effect, with winter and spring events longer and atmn and smmer events shorter in both contries. There is a clear relationship with primary case of an otage. In the U.S. data, the two most common cases, eqipment failre and weather, are very different, with the former associated with shorter events and the latter associated with longer ones. In the Canada data, crime Logged dration Logged dration Logged total cstomers Logged poplation density Logged dration Days since 1990 Fig. 9. Plots of logged dration verss event characteristics, U.S. data.

13 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 559 Logged dration Logged dration Logged total cstomers Logged poplation density Logged dration Days since 1990 Fig. 10. Plots of logged dration verss event characteristics, Canada data. has noticeably longer incidents than the other cases. Overall, incidents are mch shorter in Canada than they are in the U.S.; the median dration in the U.S. (7.7 hors) is almost ten times that in Canada (0.8 hors). The reslts of the WLS model for the U.S. data imply that a 1% increase in poplation density is associated with a 0.33% increase in dration, holding all else in the model fixed. The season effect is that, holding all else in the model fixed, winter events have Fig. 11. Side-by-side boxplots of logged dration separated by season, U.S. data. Logged dration Spring Smmer Atmn Winter Season

14 560 Simonoff, Restrepo, and Zimmerman Fig. 12. Side-by-side boxplots of logged dration separated by season, Canada data. Logged dration Spring Smmer Atmn Winter Season expected dration that is 2.25 times the dration of smmer events, with atmn and spring in between. Presmably, this has something to do with isses sch as the difficlty in traveling to downed power lines in snow and ice. Holding all else fixed in the U.S. model, incidents cased by hman error, natral disaster, demand redction, and eqipment failre tend to be shorter, while those cased by system protection, third-party, weather, and nknown cases tend to be longer. Considering that more than 3 / 4 th of the events are cased by eqipment failre or weather, the contrast between the two is particlarly important (events cased by weather are expected to last more than five times longer than those cased by eqipment failre, holding all else in the model fixed). The pattern of drations over time in the U.S. model is worth frther comment. A regression of logged dration on time alone implies an estimated 11.6% annal increase in dration. Figre 15 Fig. 13. Side-by-side boxplots of logged dration separated by primary case, U.S. data. Logged dration C Crime D E F H N O S T U W Primary case

15 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power 561 Fig. 14. Side-by-side boxplots of logged dration separated by primary case, Canada data. Logged dration C Crime E H O S T U W Primary case shows a loess crve for the estimated expected dration sing these incident-level data. Up ntil 1994, drations were getting shorter. This trned arond in 1995, and for a few years the average dration went p 15 25% annally. This was followed by a long period ( ) of fairly stable growth of 10 20%. Finally, from 2002 onward, average drations have started increasing again at a high 30 40% rate. Ths, the constant estimate of 11.6% annally obtained from the regression model actally seems to mask some very different periods in average dration change. The time variable is still highly significant even if season, poplation density, and total nmber of cstomers are added as predictors. However, when primary case is added, its significance disappears, which shows that it is the primary case effect that is driving the apparent time trend effect. Recall that more than three-forths of the incidents are either eqipment failre or weather Fig. 15. Loess crve for estimated expected dration over time. Estimated expected dration Year

16 562 Simonoff, Restrepo, and Zimmerman related, and that incidents cased by eqipment failre tend to be shorter, while weather-related ones tend to be longer. In fact, weather-related incidents are becoming more common, while eqipmentfailre-related ones are becoming less common, and this acconts for mch of the overall pattern of increasing average drations by season. Since the mid 1990s, relatively speaking, eqipment failres are going down and weather incidents are going p, while before that the opposite pattern was occrring. This corresponds exactly to the drop in drations p to 1995, and the increase since then noted earlier. Ths, it wold seem that frther stdy of why eqipment failres are becoming less common (relatively speaking) and weather-related events are becoming more common is warranted. At least part of the latter pattern is probably not related to the power grid at all. On the basis of the data from U.S. Department of Homeland Secrity (2006), officially declared federal disasters have been increasing at a rate of roghly 2.8% annally since the 1950s; most of those are weather related (flooding, hrricanes and tropical storms, tornadoes, winter storms), so an increase in weather-related otages is not srprising (althogh this wold not explain why weather-related otages were dropping before the mid 1990s). Unlike the U.S. model, the Canadian model for dration shows little evidence of any relationships at all. The primary case effect is damped down becase while crime apparently has longer incidents, that case also had more variability in drations. A simplified version of the model with only case and season sggests that each effect is only weakly significant. The season effect implies that, holding all else in the model fixed, winter and spring events have an expected dration that is roghly 2.5 times the dration of atmn events. The adjsted means for primary case show that, holding all else fixed, incidents cased by crime tend to be longer. 5. PREDICTING OUTAGE OUTCOMES The models described in the previos section provide sefl information abot the factors related to the seriosness of a power otage. These reslts can also be sed to constrct predictions for otage otcomes based on different scenarios, and thereby provide probabilistic assessments of the risks associated with these events. By examining predicted dration and cstomer loss nder different conditions, it is possible to map ot possible otage otcomes. One application of these reslts is to predict otcomes of potential terrorist attacks on the electric grid. Althogh there are no data on sch attacks for the United States or Canada, expert panels may be able to determine what cases are likely to be similar to those of a terrorist attack. Hence, scenarios that predict the otcome of sch attacks in terms of nmbers of cstomers lost and dration of an otage can be constrcted. These otage characteristics can then be sed to estimate economic costs associated with bsiness losses for a geographical area sch as a city. The models allow the ser to predict otage characteristics for a city sch as New York, for example, by inclding properties sch as state poplation density and the nmber of cstomers served by the local tility. In addition, differences in otcomes based on the season of a potential terrorist attack can also be inclded in a scenario. In this section, we constrct scenarios for cities with characteristics like those of New York and Toronto. These two cities provide an interesting contrast, since they are not only from different contries, bt the strctre of the city power grid is noticeably different: New York has relatively few transmission lines, while Toronto has many. Using the characteristics of the tilities in these cities, the estimated dration of an incident, separated by season and case, is determined for each city sing the weighted least sqares model described in the previos sections. Since (logged) dration is an important predictor for cstomer loss, these estimated drations are then sed as inpts to the logistic regression model discssed to estimate the probability that there is zero cstomer loss. Finally, the estimated (logged) dration vale, along with the characteristics of the tility, are sed to estimate the nmber of cstomers lost, given there is nonzero cstomer loss, sing the weighted least sqares model. In addition to estimated expected vales, these methods allow s to constrct 50% prediction intervals for dration and for cstomer loss (given that the loss is nonzero) for any case and season for the two cities. These intervals give the central range within which there is 50% chance of the dration or cstomer loss falling in an individal incident Dration of an Incident First, consider intervals for dration. Fig. 16 shows 50% prediction intervals for the dration of an incident in New York City in the smmer. The horizontal tick on each line is the estimated expected dration for a smmer New York City otage with that

17 Risk-Management and Risk-Analysis-Based Decision Tools for Attacks on Electric Power % prediction intervals for NYC smmer otages Fig. 16. Prediction intervals for dration of smmer otages in New York City. Dration C Crime D E F H N O S T U W Primary case case, while the vertical line gives the 50% prediction interval. The figre shows that the case of the incident is related to both the level of dration (e.g., hman error and demand redction are associated with shorter incidents and weather and nknown case are associated with longer ones) and the variability in d- ration (e.g., third-party case and system protection have similar expected drations, bt drations of incidents cased by system protection are mch more variable). Figre 17 shows intervals for New York City otages dring the winter separated by case. The pattern 50% prediction intervals for NYC winter otages Fig. 17. Prediction intervals for dration of winter otages in New York City. Dration C Crime D E F H N O S T U W Primary case