Post # 23 - Smart Meters: "Ripe for a security-economics analysis."

At a paper delivered last week at the Ninth Workshop on the Economics of Information Security at Harvard University, Professor Ross Anderson of the University of Cambridge Computer Laboratory and software engineer Shailendra Fuloria argue that “energy metering is ripe for a security-economics analysis.” For all the current push to install smart meters – driven by stimulus funding in the United States (see Post # 9 and here) and the European Union's directive that member states (to the extent economically feasible) replace all meters with smart meters by 2022 (see Post # 10) – the authors believe that security concerns have not been adequately addressed.

The lack of proper analysis flows largely from conflicting stakeholder interests. For example, Anderson and Fuloria note that the utility wants to cut energy theft, and thus wants the ability to disable any meter remotely. Conversely, however, “a prudent nation state might be wary of a facility that could let an attacker turn off the lights.” Similarly, the authors note, while the utility may want to monitor its customers’ consumption by the half hour (it can price differentiate more effectively), regulatory authorities may find this “abhorrent.” Likewise, other parts of government might find it “convenient” to have access to fine-grained consumption data, but might find themselves up against privacy law.

Anderson and Fuloria state that there are at least half-a-dozen different stakeholders with different views on security, “which can refer to information, to money, or to the supply of electricity.” Further – and significantly – the authors assert, “it’s not even true that more security is always better: some customers may opt for an interruptible supply to save money.” Thus, they argue that thorough security-economics analysis is critical

Anderson and Fuloria note that there are a number of practical consequences for research, both on technical and policy matters:

What sort of incentives will really cause customers to save energy, and what implications does this have for the design of tariffs and indeed meters? How can we design a tariff description language that will enable an energy supplier to download a tariff to a customer’s meter, in such a way that both the customer and the distributor can audit what’s going on?

How can we be confident that features such as a remote off-switch (or for that matter the tariff description language) aren’t abused for service-denial attacks? And perhaps of most interest for the security-economics community, what sort of regulatory structures are likely to work best as the industry moves from being a staid vendor of energy at regulated prices into a complex socio-technical system?

Anderson and Fuloria make five basic recommendations. First, smart meter data should belong to the customer, who should be forced to share it with the utility only to the extent necessary for service provision and billing. Further uses should be a matter for the customer’s discretion. Second, rather than a centralized system for data collection, what’s needed is a framework of standards that allow data to be shared between energy suppliers, distributors and management companies. Third, the distributors should do the “heavy lifting” when it comes to audit, because (Anderson and Fuloria assert) they alone have the incentive to do it vigorously. Fourth, governments should leave active demand management to the energy companies. Fifth, protection from market abuse requires that regulators, rather than setting technical standards, instead limit there role to ensuring security of supply and market competition.

These recommendations in turn, flow from Anderson and Fuloria’s basic vision of Smart Grid: “[T]he ‘smart grid’ of the future will not be a monolithic entity under the control of a single company or ministry, but rather a complex socio-technical system of energy generators, distributors, regulators, market-makers, aggregators, advisers and suppliers, interacting with both industrial and retail customers.”