Any power grid is very vulnerable to attack. Anyone who can cause a sudden surge in demand can take a power grid down.

If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail.

I'm struggling to think of any companies who could do that though... Someone with malicious access to teslas servers couldn't even do that... For example, instruct all plugged in tesla cars to start charging all at once. Assume 400k tesla cars are plugged in overnight, with an average 10kw charge ability. That means tesla could add 4 gigawatts to the grid demand instantly, which is only 0.4% of the USA's ~1TW generation capacity.

I'd assume that the power grid is much more vulnerable than that at least some of the time in some regions. What if due to natural load variations the network already is close to the capacity reserve (which could be measured by tracking AC phase) when somebody mounts an overload attack?

What happens if the attacker generated a (e.g. periodic) pattern of load changes that excites control mechanisms at their resonant frequency?

Maybe the book "Blackout" [1] (which I haven't read myself) has more (fictional) details about what can go wrong.

[1] https://en.wikipedia.org/wiki/Blackout_(Elsberg_novel)

I highly recommend this book. It covers an entirely plausible scenario that could happen in real world, which is very interesting to read, but also - very scary to think about.

> If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail.

Wouldn't that behave identically to a sudden loss of generation? The power grids I know of have schemes to deal with that, by automatically shedding large blocks of load in several stages.

Yes - but IMO, as soon as you've shed any significant amount of load, you've failed.

If just 10% of a nationwide grid is down, there's a good chance the phone network won't work, internet will be down, trains won't run, credit card/payment systems won't work, etc. All those things have primary and backup systems, but somewhere in the chain of dependencies there will be both a primary and backup that have been shed, and the system designers thought "these two data centers are 500 miles apart, so won't fail together".

Fortunately many critical infrastructure system and life safety systems have on-site backup energy generation capability, as long as diesel is available. At least in the USA, our internet, payment, and phone systems have all withstood significant medium-term regional power outages.

A major infrastructure cyberattack seems effective either as an opening salvo in a traditional military war or to multiply the chaos after a terrorist attack. Taking out the power grid would worsen traffic congestion and create increased demand on emergency services in the short term, and have major economic impacts and high visibility in the long term.

American here. Trains already don't run, no real net change.

Trains still very much run in the US.

I think the observation being made was that this is at the scary intersection of consumer IoT non-security and major infrastructure.