Keeping Time In A Warzone

Keeping Time In A Warzone

Speakers: Joe Marshall

Conference: S4

YouTube: https://www.youtube.com/watch?v=fNri2H9vNkA

Overview

Joe Marshall's talk at S4 delves into a harrowing, eight-month journey sparked by a chance dinner conversation with engineers from Ukrenergo, Ukraine's national transmission grid operator. What began as a routine cybersecurity brief quickly transformed into a profound exploration of the intersection between human resilience, industrial control systems, and the fundamental reliance on the electromagnetic spectrum in a modern warzone. The core revelation from this encounter was the critical and often overlooked vulnerability of essential infrastructure, specifically Ukraine's power grid, to sophisticated electronic warfare jamming.

The talk highlights the "triple threat" faced by Ukrainian critical infrastructure: relentless kinetic strikes, ongoing cyberattacks, and the insidious denial of the electromagnetic spectrum. This unique combination creates an environment where basic functionalities, like precise timing for grid management systems, are severely compromised. Marshall, a self-professed threat researcher and cybersecurity professional, found himself confronting a problem for which even his employer, a major hardware manufacturer, had no immediate solution, underscoring a significant gap in industrial defense strategies against advanced, hybrid warfare tactics.

This presentation is a compelling narrative of discovery, illustrating how the very fabric of modern civilization, from communication to power distribution, hinges on the integrity of technologies like GPS. Marshall's account serves as a stark reminder of how geopolitical conflicts can rapidly transform theoretical vulnerabilities into acute operational crises, forcing an urgent re-evaluation of established resilience paradigms for critical infrastructure worldwide.

Background

▶ Watch: Introduction to a profound journey in Ukraine. (0:00)

Ukraine's power grid, managed by Ukrenergo, presents a unique and particularly challenging operational environment, even before considering the impact of a full-scale invasion. Unlike the federated structure of the United States' grid, Ukraine's is state-owned and operates at a distinct frequency of 50 Hertz, contrasting with the 60 Hertz standard in North America. Furthermore, it incorporates exceptionally high voltage lines, with some reaching 750,000 kilovolts (KV), far exceeding typical European standards like Germany's 400 KV lines. This specialized infrastructure means that replacement components, particularly large transformers, are not readily interchangeable with those from neighboring countries, exacerbating the logistical nightmare of repairs during wartime.

The conflict has subjected Ukraine's grid to an unprecedented "triple threat." Firstly, kinetic strikes have systematically targeted substations, causing millions of dollars in damage by destroying critical components like transformers and arresters. Marshall notes that at the time of his conversation, six substations had been completely destroyed, with no viable replacements for the high-KV equipment, forcing engineers to resort to improvised, "spit bailing wires and duct taping" solutions to maintain functionality. Secondly, the grid has been under persistent cyberattacks, a well-documented aspect of the conflict aimed at disrupting operations and causing outages.

However, the third and perhaps most insidious threat, as highlighted by Marshall, is the widespread use of electronic warfare (EW), specifically the jamming of the Global Positioning System (GPS). Electronic warfare involves the denial of the electromagnetic spectrum, encompassing everything from radars and communications to GPS signals. Its primary objective in a military context is to protect one's own forces while denying the enemy the ability to tactically coordinate, navigate, and deploy precision-guided munitions. Russia, having recognized in the early 1990s that it could not achieve conventional force parity with NATO and the United States, strategically invested heavily in EW capabilities. This long-term investment has resulted in a highly effective and sophisticated EW arsenal, capable of disrupting various electromagnetic signals across a wide area.

The consequence of this advanced EW deployment is not confined to military operations; it has a profound and erratic impact on civilian infrastructure that relies on the electromagnetic spectrum. For Ukrenergo, this meant that their synchrophasers, critical devices for real-time grid management, were losing their essential GPS timing signals. The pervasive jamming effectively crippled their ability to maintain the precise synchronization required for stable and efficient grid operations. This revelation underscored a critical vulnerability: the deep, often invisible, reliance of modern industrial control systems on seemingly ubiquitous technologies like GPS, and the catastrophic implications when that reliance is exploited by advanced adversaries.

Key Findings

▶ Watch: Ukraine's grid: GPS jammed for synchrophasers. (2:00)

The central "finding" articulated in Joe Marshall's talk, rather than a discovery of a new vulnerability, is the stark realization of a profound gap in existing critical infrastructure defense strategies, particularly in the face of modern, hybrid warfare. The primary revelation was Ukrenergo's candid admission: "We can't get our GPS to work for our synchrophasers, for our our grid management because of electronic warfare jamming." This simple statement unveiled a complex, multi-faceted problem with no immediate, off-the-shelf solution.

Marshall, initially approaching the problem from a cybersecurity research perspective, assumed that a major hardware manufacturer like his employer would possess or could rapidly develop a countermeasure for such a critical issue. His discovery that "short answer, no, we didn't" highlights a significant blind spot within the industry. While individual components of the "triple threat" — kinetic attacks and cyberattacks — are actively addressed, the pervasive and sustained denial of the electromagnetic spectrum, specifically GPS jamming on a national scale impacting civilian critical infrastructure, was an unforeseen challenge for which the industrial world was unprepared.

Therefore, the key findings can be summarized as:

1. Critical Reliance on GPS for Grid Stability: The absolute dependence of advanced grid management tools like synchrophasers on precise GPS timing for their fundamental operation.
2. Unpreparedness for Widespread EW Impact: The industrial sector, including major hardware manufacturers, lacked readily available or even conceptualized solutions to mitigate large-scale, persistent GPS jamming affecting critical infrastructure in a warzone.
3. The "Triple Threat" as a Compounding Factor: The combination of kinetic, cyber, and EW attacks creates a synergistic effect, where each threat amplifies the others, making resilience exponentially more challenging. The inability to replace physically destroyed high-KV equipment, coupled with cyber threats and the loss of timing, renders traditional recovery strategies inadequate.
4. EW as a Strategic Adversary Advantage: Russia's long-term investment and proficiency in electronic warfare present a significant and underappreciated threat to civilian infrastructure, demonstrating its effectiveness as a "high return but ultimately low dollar investment" compared to conventional military hardware.
5. The Human Element in Resilience: Marshall's personal journey underscores that resilience in such extreme conditions is not purely technical but deeply intertwined with the human spirit, adaptability, and cross-cultural collaboration, as exemplified by the Ukrainian engineers "making do with what they have."

These findings collectively point to an urgent need for the critical infrastructure community to broaden its threat models beyond traditional cyber and physical attack vectors to fully encompass the pervasive and debilitating effects of electronic warfare, especially in geopolitical conflict zones.

Technical Deep Dive

▶ Watch: Ukraine faces "triple threat" on its infrastructure. (3:50)

The technical crux of the problem lies in the intricate relationship between synchrophasers (Phasor Measurement Units or PMUs) and the precise timing capabilities provided by the Global Positioning System (GPS). Synchrophasers are advanced sensors deployed across power grids to measure electrical waveforms (voltage and current) at high speeds and with extreme accuracy. Their primary function is to provide real-time, synchronized measurements of phasors – vectors that represent the magnitude and phase angle of an alternating current (AC) waveform.

For these measurements to be truly valuable and actionable for grid operators, they must be precisely synchronized across a vast geographical area, often down to the nanosecond level. This synchronization allows grid operators to gain a holistic, real-time "snapshot" of the grid's health, enabling them to detect instabilities, predict potential outages, identify fault locations, and optimize power flow with unprecedented granularity. Without this precise time synchronization, the phase angle measurements from different locations would be meaningless, making it impossible to accurately assess the grid's dynamic behavior.

GPS provides this critical Common Reference Time (CRT). Each PMU typically incorporates a GPS receiver that locks onto satellite signals, deriving an extremely accurate time stamp. This GPS-derived time is then used to tag each phasor measurement, ensuring that all PMUs across the grid are measuring their respective waveforms at the exact same instant. This global synchronization is fundamental to Wide Area Measurement Systems (WAMS), which rely on data from numerous PMUs to provide a comprehensive view of grid dynamics. When GPS signals are unavailable or unreliable, PMUs either cease to function correctly, drift out of synchronization, or output inaccurate data, effectively blinding grid operators to critical real-time conditions.

Electronic warfare (EW) jamming directly targets this reliance. GPS signals, transmitted from satellites orbiting thousands of miles above Earth, are inherently weak upon reaching the ground. A GPS receiver requires a clear, unobstructed signal to calculate its position and time. Jamming involves broadcasting a stronger radio signal on the same frequencies used by GPS (primarily L1 at 1575.42 MHz and L2 at 1227.60 MHz). This stronger, localized signal effectively overpowers the faint satellite signals, preventing the receiver from acquiring or maintaining a lock. In a warzone like Ukraine, sophisticated Russian EW systems, which Marshall noted are a high-priority investment for Russia, are capable of generating powerful jamming signals that can disrupt GPS reception over wide areas, making it impossible for synchrophasers to obtain the necessary timing data.

The problem is compounded by the specific characteristics of the Ukrainian grid. Operating at 750,000 KV, its substations and transformers are massive, custom-built pieces of equipment. As Marshall pointed out, a 400 KV transformer from a neighboring country like Estonia is simply incompatible with a 750 KV substation. This lack of interchangeable parts means that when kinetic strikes destroy these critical components, there are no readily available replacements. The engineers are forced to improvise, which, while testament to their ingenuity, introduces vulnerabilities and operational inefficiencies. The simultaneous loss of precise timing due to EW jamming, combined with physical destruction and cyber threats, creates a synergistic operational nightmare. Grid operators are not only dealing with physically damaged infrastructure but are also deprived of the very tools (synchrophasers) that would help them understand the real-time state of their compromised and reconfigured grid, making informed decision-making virtually impossible.

Marshall's initial search within his "largest hardware manufacturers in the world" for a solution and his subsequent "no, we didn't" answer highlights a critical gap. The industrial control system (ICS) and operational technology (OT) sectors have historically focused on physical security, cyber security, and system reliability, but the widespread, sustained, and deliberate denial of the electromagnetic spectrum as a weaponized attack vector against civilian critical infrastructure was largely unaddressed. This forced the speaker and his team on an "eight-month journey" to explore novel approaches to maintaining time synchronization in an environment where the most common and reliable source—GPS—is actively and effectively denied. The implications extend beyond Ukraine, challenging the fundamental assumptions of resilience in any modern grid heavily reliant on GPS for its operational integrity.

Demo / Proof of Concept

▶ Watch: Understanding electronic warfare: denying the spectrum. (4:10)

The provided transcript focuses primarily on the problem statement, the context of the Ukrainian power grid, and the speaker's initial realization of the challenge. It does not describe any specific demonstration or proof of concept of a solution. The talk is framed as the beginning of an "eight-month journey" of discovery and problem-solving, rather than the presentation of a completed technical solution or its demonstration.

Defensive Implications

▶ Watch: Russia's strategic investment and proficiency in electronic warfare. (5:00)

The challenges faced by Ukrenergo in Ukraine underscore several critical defensive implications for critical infrastructure operators worldwide, particularly those managing power grids and other systems reliant on precise timing. The "triple threat" scenario serves as a stark warning that traditional defense strategies focused solely on cyber or physical security are insufficient against hybrid warfare.

1. Diversification and Hardening of Timing Sources: The absolute reliance on GPS for synchrophasers, and by extension, grid stability, proved to be a single point of failure. Defenders must explore and implement alternative timing solutions. These could include:

• Atomic Clocks: Deploying highly accurate, localized atomic clocks (e.g., Rubidium or Cesium standards) at critical substations to provide independent, stable time references.
• Terrestrial Timing Networks: Establishing secure, resilient terrestrial timing networks (e.g., fiber-optic based White Rabbit or PTP over Ethernet profiles) that are less susceptible to satellite-based jamming.
• Multi-Constellation GNSS Receivers: Utilizing receivers capable of processing signals from multiple Global Navigation Satellite Systems (GNSS) like GLONASS, Galileo, and BeiDou, in addition to GPS. While not immune to jamming, it offers redundancy.
• Inertial Navigation Systems (INS): Though primarily for navigation, INS can provide short-term timing stability when external signals are lost, allowing for a "holdover" capability.
• Hardened GPS/GNSS Receivers: Investing in anti-jamming and anti-spoofing receivers that employ techniques like adaptive nulling antennas, signal processing algorithms, and cryptographic authentication to resist EW attacks.

1. Enhanced Situational Awareness for EW Threats: Critical infrastructure operators need to develop capabilities to detect, characterize, and respond to electromagnetic spectrum interference. This requires:

• Spectrum Monitoring: Deploying sensors to continuously monitor the RF spectrum for anomalies, identifying jamming or spoofing attempts.
• Threat Intelligence Sharing: Fostering closer collaboration with military and intelligence agencies to understand adversary EW capabilities and tactics, techniques, and procedures (TTPs).
• Impact Assessment: Developing methodologies to quickly assess the operational impact of EW events on critical systems and trigger appropriate response protocols.

1. Integrated Resilience Planning: Defense strategies must move beyond siloed approaches. Physical, cyber, and electromagnetic spectrum resilience must be integrated into a holistic plan. For instance, designing substations with redundant communication paths (fiber, microwave, satellite) and diverse timing sources, all while considering the physical hardening against kinetic attacks and the cyber hardening against remote exploitation. The ability to operate in a degraded, disconnected, or denied (D3) environment is paramount.

1. Supply Chain Security and Equipment Sourcing: The inability to replace 750 KV transformers highlights a critical supply chain vulnerability. Nations and utilities must assess their dependence on highly specialized, single-source equipment, especially for critical infrastructure. This could involve strategic stockpiling, fostering domestic manufacturing capabilities, or standardizing designs to allow for greater interchangeability.

1. Cross-Domain Collaboration: The problem of EW impacting civilian infrastructure necessitates unprecedented collaboration between military EW experts and civilian ICS/OT security professionals. Each domain possesses unique expertise that is vital for understanding the threat and developing effective countermeasures. This includes sharing threat intelligence, developing joint training exercises, and collaborating on research and development for resilient technologies.

1. Operational Contingency Planning: Utilities must develop and regularly exercise contingency plans for scenarios where GPS signals are persistently unavailable. This includes manual operating procedures, alternative communication methods, and protocols for managing grid stability without real-time, synchronized phasor data.

Ultimately, the Ukrainian experience serves as a sobering lesson that the battlefield of modern conflict extends beyond traditional military engagements, directly impacting the foundational services of civilian life. Protecting these services requires a proactive, multi-disciplinary approach that anticipates and mitigates threats across the entire spectrum of modern warfare.

Key Takeaways

The S4 talk by Joe Marshall, detailing the challenges faced by Ukraine's power grid, offers crucial insights into the evolving landscape of critical infrastructure security. The experience in Ukraine highlights vulnerabilities that demand immediate attention from asset owners, operators, and security professionals globally.

• The "Triple Threat" is Real and Potent: Critical infrastructure is increasingly targeted by a synergistic combination of kinetic attacks, cyberattacks, and electronic warfare (EW), each amplifying the others' impact and making resilience exceptionally difficult.
• GPS Reliance is a Single Point of Failure: Modern industrial control systems, particularly advanced grid management tools like synchrophasers, are critically dependent on precise GPS timing. The widespread denial of GPS signals through jamming can severely cripple operational capabilities.
• Electronic Warfare is a Formidable Adversary Weapon: Russia's advanced and sustained EW capabilities demonstrate its effectiveness as a strategic tool to disrupt not only military operations but also civilian critical infrastructure, demanding a reassessment of defense priorities.
• Industry is Unprepared for Pervasive EW: The lack of readily available solutions from major hardware manufacturers for large-scale GPS jamming affecting critical infrastructure reveals a significant gap in current industrial defense strategies and product offerings.
• Resilience Requires Diverse Timing Solutions: Moving forward, critical infrastructure must adopt diversified and hardened timing sources, including local atomic clocks, secure terrestrial networks, and anti-jamming GNSS receivers, to reduce reliance on vulnerable single points of failure like GPS.
• Holistic Defense and Cross-Domain Collaboration are Essential: Effective defense against hybrid threats necessitates integrated strategies encompassing physical, cyber, and electromagnetic spectrum resilience, along with unprecedented collaboration between military and civilian security experts.

About the Speaker(s)

Joe Marshall is presented as a threat researcher and cyber security guy with prior experience in the utility sector. His professional journey has led him to work at "one of the largest hardware manufacturers in the world." His personal account in the talk emphasizes his initial lack of expertise in electronic warfare or GPS, highlighting his role as someone who delved deep into an unfamiliar but critical problem out of necessity and a sense of professional duty, driven by a chance encounter with Ukrainian colleagues.