Intentional EMI - Experiences from Research, Testing and Vulnerability Assessments in Sweden Dr. Mats Bäckström. Adj. Professor, Royal Institute of Technology (KTH) Extreme Electromagnetics The Triple Threat to Infrastructure. IET, London January 14, 2013
Thanks to the following partners: PAGE 2
Outline Intentional EMI. A brief introduction. The military experience. - IEMI testing within the Swedish defence community. Intentional EMI. Research activities in Sweden. Challenges for future work on Intentional EMI. Conclusions PAGE 3
INTENTIONAL EMI Electromagnetic Terrorism Front-door attack Back-door attack PAGE 4
Our society is today extremely dependent on electrical and electronic systems for its function. Most civilian systems, especially wireless systems, are vulnerable to electromagnetic interference (EMI). Legal EMC-requirements for civil products are in general insufficient for protection against IEMI. Civil aircraft is the only major exception to that rule. This may invite terrorists or criminals to intentionally interfere with, or damage, systems of critical importance, both public and private. PAGE 5
Intentional EMI: Intentional malicious generation of electromagnetic energy introducing noise or signals into electrical and electronic systems, thus disrupting, confusing or damaging these systems for terrorist or criminal purposes from URSI General Assembly, Toronto 1999 PAGE 6
Possible Targets: Power Networks Telecom systems Financial Systems Computer Networks Medical Care Industrial Plants Radio/television Networks Traffic Control Systems Food and Water Supply.. PAGE 7
Intentional EMI. Means. HPM (High Power Microwaves): Pulse injection on signal- or power cables. Jammers (disruption of radio communication). Easy to buy: (Nuclear EMP): PAGE 8
The Military IEMI Experience: Electromagnetic Environment for a Military Aircraft A Mixture of Intentional and Unintentional Threats! Intentional: Nuclear EMP HPM (High Power Microwaves) Unintentional: Lightning Radio- and radar radiation (HIRF) PAGE 9
Example of Aircraft Related Incident due to Unintentional EMI. AJ37 Viggen aircraft (Swedish): Crash. blast of radom due to lightning (1978) AJ37 Viggen aircraft: Release of canopy due to lightning. Pilot was however able to land the aircraft (1978). PAGE 10
HPM Susceptibility Investigations (Swedish Industry, FOI, FMV; 1993 -) Aircraft, Missiles Tactical Radio Link Army Radio Cars Computers Telecom Stations GPS, WLAN, Cameras,. Low Noise amplifiers, Limiters,.. PAGE 11
Back-Door Effects. Narrow Band Susceptibility Tests of Unshielded Electronics. Summary. Effects are much more prominent at low frequencies (1 3 GHz) compared to high frequencies Upset starts to occur (L- and S-band) typically around a few hundred volts per meter (rms peak field strength). Permanent damage usually occurs from 15-25 kv/m and upwards (seen only for L- and S-band) Permanent damage can occur also with the equipment turned off. Ref.: Bäckström, Lövstrand. IEEE Trans. on EMC, Vol. 46, No. 3, August 2004. PAGE 12
Front-Door: HPM Susceptibility of Low Noise Amplifier (LNA) Undamaged. Test object MAALGM0003-DIE from M/A-Com mounted in a fixture. Permanent damage (circle). PAGE 13
Energy Levels for Permanent Damage of LNA Frequency 6 GHz PAGE 14
Swedish research activities on IEMI on civil systems. Quite comprehensive susceptibility tests on cars were carried out in1994 and later. Followed by studies on computers, GPS, WLAN, telecom equipment, railway systems and electric power systems. The first report to Swedish civil authorities was issued in 1997. IEMI was until the turn of the millennium essentially a military business but have since then generated quite a lot of interest in the civil arena. In Sweden this has been reflected by a couple of studies of critical systems: PAGE 15
Example: Nordic Co-operation on IEMI (2004). PAGE 16
Research on Railway Vulnerability Points of entry (cables) for pulse injection to control equipment. Vulnerability för wireless communication (European Rail Traffic Management System, ERTMS) Hidden jammer irradiating antenna on train or GSM R antenna mast. From www.botniabanan.se PAGE 17
Vulnerability of control equipment in power stations. EU-project 2008-2010. PAGE 18
Classification of civilian facilities. The IEMI threat cube Complex and distributed civil systems poses new challenges compared with confined military systems. Three characteristics of a facility; Accessibility, Susceptibility and Consequence are proposed for evaluating vulnerability to IEMI. Bad The intent behind the EMI causes problems to large distributed facilities designed by the rules of the traditional zoning concept. Susceptibility Good Accessibility Ref: Månsson et al., Methodology for Classifying Facilities with Respect to Intentional EMI, IEEE Trans on EMC, Vol. 51, No. 1, February 2009. Consequence PAGE 19
Recent project at Saab: UAV Skeldar as test-bed for HPM. Susceptibility and protection. Lenght 4 m Height 1.2 m Weight 150 kg PAGE 20
Test Objects (Possible subsystems for Skeldar) GPS: f ~ 1575 MHz RALT: Radar Altimeter, f ~ 4 GHz SCU: System Control Unit, f = N\A C2-link: Command & Control link, f ~ 400 MHz Video-link: f ~ 1.2 GHz PAGE 21
Estimated Distance of Action for HPM Sabotage. From HPM Tests of Cars, PC s etc. Unprotected equipment. HPM-SOURCE HPM Van ** (10 MW, 10J) HPM Suitcase ** (100 kw, 0.1 J) In close vicinity Irrelevant Permanent Physical Damage DISTANCE 15 meter 50 meter 500 meter Permanent Physical Damage Upset #) / Damage *) Upset #) / Damage *) Upset #) / Damage *) Upset #) / Damage *) No Effect/ (Interference, in-band FD) # : May cause permanent functional damage! *: Front-door coupling, in-band (interference at much larger distance). **: UWB/HPM gives similar distances, but permanent damage likely requires a very high pulse repetition frequency, PRF. PAGE 22
Estimated Distance of Action for HPM Sabotage. Civil Aircraft Protection Level, i.e. ~ 30 db HPM-SOURCE HPM Van (10 MW, 10 J) HPM Suitcase (100 kw, 0.1 J) In Close Vicinity Irrelevant Upset #) / Damage *) DISTANCE 15 meter 50 meter 500 meter Upset #) / Damage *) No Effect/ (Interference, inband FD) No Effect/ (Interference, inband FD) No Effect/ (Interference, inband FD) No Effect/ (Interference, inband FD) No Effect/ (Interference, inband FD) # : May cause permanent functional damage! *: Front-door coupling, in-band. (Interference, i.e. jamming, at much larger distance than 500 meter). PAGE 23
Challenges for future work on IEMI (I) Vital parts of the society s technical infrastructure consists, in contrast to most military systems, of large complex and distributed system, i.e. system of systems. These are also often easily accessible for a perpetrator. This means that the IEMI research has to widen its focus from vulnerability and protection at the level of components and subsystems to also include consequences for the society at large and strategies for implementation of well-balanced and cost efficient protection measures (also including measures such as access restriction, surveillance, radiation detection, emergency planning etc.) PAGE 24
Challenges for future work on IEMI (II) The main challenge in such a process is presumably to organize and manage working groups containing a vide variety of competences, suitable for making overall security analyses and formulate cost-efficient and wellbalanced measures. These working groups shall include representatives from emergency planning, security police, system owners (e.g. power grid companies), contractors, suppliers of sub systems, IEMI experts etc. PAGE 25
Challenges for future work on IEMI (III) Coordinated attacks. It is of vital importance not only to study the impact of an isolated IEMI attack but also to, or maybe primarily, to consider coordinated IEMI attacks. A coordinated IEMI attack may refer to a case where IEMI is used to obstruct or interfere with measures taken by the authorities to deal with a conventional type of attach, such as a bomb attack. One example could be use of jammers to suppress the radio communication used by the police and rescue services. A coordinated IEMI attack may also refer to a case where several IEM attacks are carried out simultaneously against a number of critical sub systems. PAGE 26
We (KTH) just got an approval for a new IEMI project, in line with the approach above, called: Protection against Electromagnetic Risks. Intentional electromagnetic Interference (IEMI). The budget, for 3 years, is 9 MSEK = 1 MEURO= 840 000 GBP, with possible prolongation for another 3 years. A doctorate student will be recruited ASAP. PAGE 27
Conclusions and Outlook Our technical infrastructure relies heavily on electrical and electronic systems vulnerable to Intentional EMI. This may invite terrorists or criminals to intentionally damage systems of critical importance. On the technical level, the threat can, to a large extent, be mitigated using existing procedures and methods, largely developed for protection of military systems. A shift in research focus is proposed towards consequence analyses and protection strategies for large and complex distributed systems. Special attention should be paid to coordinated IEMI attacks PAGE 28