Things That Go Bump in the Night

• By Doug Gale
• 12/14/07

Just when I thought we had business continuity and disaster recovery figured out, along comes something new.  Last fall I attended a presentation by Joe St. Sauver, security program manager for Internet2. His topic was "Planning for Certain High Risk Security Incidents."  His focus was not on the more traditional regional threats such as hurricane or wildfire, but on national scale threats.  In particular, he talked about high altitude electromagnetic pulse (EMP) effects and pandemic flu.  His presentation was both timely and important, so this month's column is about EMP; next month's will be about preparing for pandemic flu.

What's an Electromagnetic Pulse?
Many of us have lived through a prolonged power outage.  Perhaps it was a freak ice storm that left a city-sized area without power for a few days.  If it was winter, perhaps we fled to a hotel in an area that still had power.  But imagine if the power went out across the entire continent ... and didn't come back on for six months or a year!  And what if all our modern semiconductor electronics and computers stopped working at the same time?

Black Friday: A Fictional Story
It was early Friday afternoon in mid-December.  I was working at my computer to complete an article that was due that afternoon.  Plans for the weekend included hanging Christmas lights and shopping for gifts.  Even through the curtains in my office I noticed a bright flash on the horizon just as the lights went out.  Where I live in Montana, that's not unusual.  What was unusual was that my computer went dead even though it is attached to a robust battery backup system.  When I tried to report the power outage I found that my phone was dead as well.  When you can't fix it, feature it.  My wife and I built a fire in the fireplace, and had a romantic candlelight dinner that night cooked on our charcoal grill.  

The next day when the power was still out and we found that our car wouldn't start, we knew there was a big problem.  As news slowly trickled into our small community we learned that the continental electric power grid was down and most electronic devices using sophisticated transistors and integrated circuits as well as almost all computers were inoperable.  A small atomic bomb explosion 250 miles above Kansas was the cause.

Winter was hell, and we were among the lucky ones.  We had a small electric generator that we used to power our propane-fueled furnace a couple of hours a day.  There was a free running stream less than a mile away when the village water tanks ran dry because there was no electricity to run the well pumps.  Because our pantry was well stocked we made it through the winter and avoided the famines and food riots common to some urban areas.  

Gradually though things got better.  By summer parts of the power grid were back on line and emergency transportation was being restored for the distribution of food and medical supplies.  Many older vehicles as well as a few newer ones were still operable.  At a staggering human cost we'd learned just how fragile our high tech society really was.

The Story Was Fictional, but Could It Happen?
The short answer is yes.  It sounds like science fiction, but it is based on science fact.  If a small nuclear device were detonated 400 kilometers (250 miles) over Kansas, an electromagnetic pulse of destructive force would blanket the continental United States.  

We know it could happen because it's already been done.  On July 9, 1962 the United States detonated a 1.4 megaton thermonuclear warhead 400 kilometers (250 miles) above Johnston Island in the Pacific Ocean.  That test, called Starfish Prime, caused the failure of electronics systems, knocked out streetlights, and fused power lines in Hawaii 1,500 kilometers (930 miles) away.  The Soviets had similar experiences during their atmospheric test programs.

The common perception of an atomic explosion is one near the surface of the earth, complete with a mushroom cloud, massive blast and thermal damage, and radioactive fallout.  A high-altitude explosion is much different.  Blast and thermal damage as well as radioactive fallout are negligible.  However, a new phenomenon, an electromagnetic pulse, becomes important.  When a nuclear device explodes, it emits a burst of gamma radiation.  As the gamma radiation hits air molecules, electrons are knocked loose.  These electrons are quickly stopped in the dense air found near the surface of the earth.  However, at altitudes between 20 and 40 kilometers  (13 to 25 miles), these electrons become trapped in the earth's magnetic field giving rise to an electromagnetic pulse.  Since the burst of gamma radiation is almost instantaneous and very brief, on the order of nanoseconds, the electromagnetic pulse is similarly very intense and very brief.

An electromagnetic pulse can be compared to lightning, which has a very high voltage and current, but for a very short duration.  The EMP from a high altitude nuclear explosion, however, is more intense and even briefer.  The effect of such an EMP would be much like lightning striking every building and every power pole in the United States at precisely the same time.  The only difference is that the "surge" protectors that we have all installed to protect our computers wouldn't be fast enough to stop the pulse.  Ergo, fried computers.  

As less publicized effect of a high altitude burst would be "pumping" the Van Allen belt with a large number of bomb-induced electrons.  The electrons will remain trapped in the belts for a year or more and destroy any unhardened satellites traversing the belts in low earth orbit. The first commercial communication satellite, Telstar, was a victim of Starfish Prime.

The Devil Is Always in the Details
In the "Black Friday" scenario the burst occurred 400 kilometers over Kansas.  High enough to be above the horizon for almost all of the continental United States, but low enough to ensure that the intensity of gamma rays reaching that critical zone 20 to 40 kilometers above sea level was sufficient to generate a destructive EMP.  But how bad would it really be? Most people, even Hawaiians, have never even heard of "Starfish Prime."

Predicting what would actually happen after a high altitude nuclear burst is complex.  While an advanced degree in physics helps, it still isn't possible to account for all of the variables.  For example, how effective is a car's metal body in shielding its computerized ignition system?  The military has done extensive testing of military vehicles as part of their programs to harden military systems.  But they didn't test my Honda--or if they did, I don't know the results.  

Simulating an EMP without detonating a nuclear device is hard, and the size of objects that can be tested is limited to things like tanks and aircraft.  There is no way other than computer simulation to test large systems.  And unfortunately our cyber society is now based on large, complex, and geographically dispersed systems.  The fact that my radio works doesn't mean that the national communications infrastructure will.  Our only empirical data is from 1962, an era dominated by vacuum tube electronics and other components that were far more resistant to EMP than our modern integrated circuits, computers, and low earth orbit satellites.  Stand-alone devices were the norm; complex networked systems were a rarity.  

The good news is that it isn't easy to launch an EMP attack.  A rogue state trying to execute the black Friday scenario faces some problems. (The assumption here is that a country with ballistic missile nuclear capabilities will refrain from an EMP attack because of their own vulnerability to a retaliatory nuclear strike from the United States.)  First it needs a nuclear bomb.  Unfortunately (for us) a primitive atomic bomb is actually more efficient than a modern hydrogen bomb in generating an EMP.  Equally unfortunate is the fact that the strength of the EMP pulse only increases as the square root of bomb's yield.  Thus a Hiroshima and Nagasaki class bomb might yield almost half the EMP of the 1.4 megaton Starfish Prime test.  Stated in layman's terms that means the rogue state doesn't need a big bomb; a primitive a-bomb might work just fine.  

A second problem faced by a rogue state is getting a bomb 400 kilometers (250) miles over Kansas.  That requires a sophisticated missile capability beyond that of all but a few countries (the ones we have already assumed won't launch such an attack).  A more likely scenario would be a Scud-class missile launched from an offshore ship or submarine.  The Scud-B has a one-ton payload and 300 kilometer (190 mile) range.  A burst at an altitude of 62 miles above Virginia Beach would cause an EMP covering a 1,100 kilometer (700 mile) radius at ground level, just about the entire Eastern time zone.  

Side Note: Non-nuclear Electromagnetic Pulse
It turns out you don't need an atomic bomb to generate a powerful electromagnetic pulse.  Generally these non-nuclear devices have much more limited range and cover relatively small areas and thus don't fit into our description of continental scale disasters.  They are, however, being actively developed for both military and civilian applications.  The military is experimenting with non-nuclear electromagnetic pulse (NNEMP) generators to disrupt enemy communications and computer systems.  On the home front, law enforcement agencies would love to have a way to disable a speeding car.  You can even buy NNEMP "kits" to experiment with in the privacy of your own home.  A 1.8 Gigawatt kit is available for only $1,500.

Why Aren't People Concerned?
Although there are uncertainties, a number of knowledgeable people are concerned, very concerned, that there is a risk of an EMP attack.  According to George W. Ullrich, deputy director, Defense Special Weapons Agency, "While DoD hardens assets it deems vital, no comparable civil program exists. Thus, the detonation of one or a few high-altitude nuclear weapons could result in devastating problems for the entire U.S. commercial infrastructure."

The conclusion of the 2004 Congressional Blue Ribbon EMP Commission was: "The damage level could be sufficient to be catastrophic to the nation, and our current vulnerability invites attack." Unfortunately the report came out on the same day as 9/11 Commission report and received little press coverage.

What Should Higher Ed Be Doing?
In his presentation, St. Sauver urged higher education to begin hardening key campus network support infrastructure and mission-critical systems.  The standards for doing this are well defined if little known.  See for example Engineering and Design - Electromagnetic Pulse (EMP) and Tempest Protection for Facilities, Army Pamphlet EP 1110-3-2 available here.  

It seems to me that Joe's proposal faces two fundamental challenges that will inhibit a response by higher education.  The first is that hardening our facilities will be expensive.  The second and more important problem is that our systems are part of a much larger commercial communications and power infrastructure.  Our telecommunications run over multiple commercial providers.  Our power comes from commercial companies connected to a national power grid.  Until the government articulates a comprehensive strategy to address an EMP threat, it will be difficult to convince higher education administrators to spend money on what they may view as a piecemeal strategy.  Another strategy may be to work through Educause and Internet2 to make sure that our elected representatives are aware of the problem and understand our concern.  

I am reminded of a traditional Scottish prayer:

From ghoulies and ghosties
And long-leggedy beasties
And things that go bump in the night,
Good Lord, deliver us!