How disinformation can weaken infrastructure systems’ resilience

It is well known that humans are one of the weakest links in the security of complex cyber-physical systems. While vulnerabilities introduced by human system operators have been studied, the possibility of consumers-at-large being manipulated by an adversary has not been examined to date.

Today, new social technologies have allowed the creation and spread of targeted disinformation at a scale like never before. If an adversary could manipulate individual behaviour at a scale and in a manner that reduces the system’s reliability, existing system protection schemes could be circumvented to cause disruption to the system.

In the paper external pageHow weaponizing disinformation can bring down a city’s power gridcall_made published in PLOS ONE, FRS principal investigator external pageDr Jimmy Chih-Hsien Pengcall_made and Gururaghav Raman from the National University of Singapore and co-authors analyse how the security of the power grid could be compromised by manipulating consumers using strategic disinformation attacks. Specifically, they consider a scenario where an adversary spreads false notifications to encourage consumers to shift their demand to the peak-demand period. The collaborators of this study include Bedoor AlShebli, Marcin Waniek, and Talal Rahwan from the New York University Abu Dhabi.

In this study, the authors show how the resultant consumer response can cause overloading of the power grid, and subsequently lead to blackouts. As a result, large sections of the city could lose electricity for lighting, internet, or worse, critical medical life support. They also study how the vulnerability of the grid changes with more flexible demand in instances when plug-in electric vehicles are incorporated into the system.

Based on a survey of over 5,000 participants, they then assess the propensity of real-life electricity consumers to believe, respond to, and forward such disinformation within their social groups. The results are worrying - individual members of the public are likely respond in a manner such that their collective actions could cause a city-wide blackout.

This study has demonstrated that in an era when disinformation can be weaponized, vulnerabilities in critical infrastructure systems may arise not only from the hardware, software, and human operators, but also from the behaviour of the public-at-large.