Injecting Electromagnetic Pulses into the Electric Grid and Infrastructure: The Poor Man’s EMP Nuke
By Paul F. Renda
January 20, 2020
The United States has experienced disruptions from electromagnetic pulses (EMP) due to high-altitude hydrogen bomb explosions and also space weather. The first time that this occurred with the hydrogen bomb was the starfish test detonation experiment. This explosion was over 800 miles away from Hawaii, and it still disrupted many electrical devices. Solar storms also create EMP events that upset these devices. These storms come about from solar flares and coronal mass discharges from the sun.
There is a way for a novice or terrorist to generate an EMP that can disrupt a computer.
The United States has underestimated the ability of an amateur or terrorist to launch an EMP attack on the infrastructure or the electric grid. In addition to the phenomena introduced above, a Tesla coil or Marx generator can easily supply the EMP to disable the infrastructure or a part of the electric grid. Another device that can be an EMP source is the camera flash. This device may be an issue if a terrorist connects it to the wiring of a fly-by-wire jet.
What is an EMP?
An EMP is a high energy, very short duration (in the microsecond range) discharge of radiofrequency energy. This event disables electromechanical devices, but it's particularly toxic at lower energy levels to microprocessors and computers. It can be created by a hydrogen bomb explosion at an altitude far above the surface of the Earth. A Marx generator or Tesla coil can also generate it. Other sources of EMP can be naturally occurring phenomena: Lightning, solar flares, and coronal mass discharges from the Sun can also produce EMP.
Natural Phenomena That Produce EMP
When most people think of the naturally occurring event that creates an EMP, they typically think of lightning. The other phenomena that create EMP are solar storms. Space weather can be created by a prominent solar flare or a coronal mass ejection. This is a slow-moving, multi-billion-ton cloud of plasma that contains electrons and protons. In Québec in 1989, a blackout was blamed on a massive solar storm. In July 2012, we had a large solar storm, and it was twice the size as the event that caused the 1989 Québec blackout. The most significant solar storm was the Carrington event of 1859. At the time of this event, we did not have radio or other modern conveniences like cell phones. We did have telegraph stations that used wires on telephone poles and acted as a large antenna. If a storm of this magnitude happened today, we would probably be set back to the Stone Age.
Man-made EMP
Nuclear
The United States first had a man-made EMP event during the starfish hydrogen bomb test. It was starfish prime, a 1.4 megaton nuclear bomb test. This detonation was set off on July 8, 1962, at an altitude of 250 miles above the surface of the earth. The EMP was more substantial than expected, and it even pinned the instrumentation needles off the scale. In Hawaii, about 890 miles away from the detonation point, it knocked out 300 streetlights, the telephone company microwave link, and calls from Hawaii to the Hawaii islands; and set off numerous personal alarms. This high-altitude test was one of several called “Operation Fishbowl”; They created an EMP pulse caused by the Compton Effect. This effect occurs when electrons produced by gamma rays collide with the air. This explosion yielded a far greater pulse than was theorized. The US completed six high-altitude nuclear tests in 1962, but those tests produced many expected results and also raised many questions. In 1962, most electrical systems were electromechanical. Today most systems are run by microprocessors/computers, and these devices are far more sensitive to EMP.
Non-nuclear
Absent nuclear detonations, there are other ways to generate EMP. Currently, several man-made non-nuclear sources are on the market. One particular device on the market can create an EMP that can disrupt a car or a drone. These devices are costly and generally out of reach financially of the amateur or terrorist. However, there is a way for a novice or terrorist to generate an EMP that can disrupt a computer.
The Tesla coil and the Marx generator can generate EMP, and I have experimented with both of them. Irvine Marx created the Marx generator in 1924. The generator charges capacitors in parallel and discharges them in series by using a spark gap. The Marx generator has been used by researchers at the Sandia National Laboratories to pulse materials and computer systems. The Marx generator there is sometimes referred to as the Z Machine.
The picture above shows an amateur Marx generator that can be purchased off the web.
The schematic above shows a Marx generator. The capacitors are charged in parallel and discharged in series, multiplying the voltage by the number of capacitors.
The screen capture above shows a test performed by the author, where a Marx generator is used to disrupt the function of a cable box. Note the affected LCD display.
It is a summation of pulses that disrupts this cable box; in comparison, a hydrogen bomb explosion produces one large pulse. Also, these pulses readily travel through the wire, and by connecting to the ground wire of an electrical system, you are injecting into the entire system. However, the Marx generator does not scale up well; that is, you would have to use costly military-grade components. You could not buy them at RadioShack.
Today, most systems are run by microprocessors/computers, and these devices are far more sensitive to EMP.
However, one device that scales up well for little money is the Tesla coil. A potent coil can be built for about $2000 within the means of any amateur or terrorist. The ground connects the whole electrical system, and there is no remediation if you create impulses into the ground system. When you open a circuit breaker with 3-phase power, it does not disconnect the ground.
In 1891, Tesla invented the Tesla coil; it's a resonance transformer that creates high-voltage, high-frequency power. There are numerous references on how to build a Tesla coil on the Internet. For my experiments, I used six different Tesla coils. The Tesla coils I used have different physical sizes. The largest Tesla coil runs at better than 150 kHz; the smallest Tesla coil runs around 900 kHz. I used a so-called software Tesla coil exciter. This device tunes to the frequency of the coil. In general, I find the high frequencies are more destructive to microprocessor circuits than the low frequencies. There are numerous kits on the market for Tesla coils. To make it particularly damaging to microprocessors or the electric grid, the operator would have to know Fourier analysis, differential equations, and possibly the Laplace transforms. One other fact - about Tesla - when he was in Colorado Springs, he had a very large Tesla coil that ran at low-frequency high voltage (seen above). This coil induced several kilowatts of energy into the windings of the power station generator and burned it out.
Above I have a fundamental schematic of a Tesla coil. The capacitor is charged on the high-voltage side of a Transformer. When it reaches its maximum capacity, it will create a spark in the spark gap which will complete the circuit for the primary. It will then pump energy into the secondary coil. The main difference with my setup is that I do not earth ground the secondary.
The schematic above shows a camera flash system. Notice the similarities between this and the Tesla coil. You charge a capacitor, and it discharges through two primary coils into a secondary coil. The secondary coil discharges into a Xeon tube for the Flash. The main difference between a Tesla coil and a camera flash is that the Tesla coil charges the secondary coil continuously, whereas the camera flash charges the secondary coil only once. However, the camera flash can be modified so that it can charge the secondary coil continuously much like a Tesla coil.
Another schematic of a flash coil system in a camera. On the bottom of the schematic there is a key to identify the components: There are capacitors, transformers, switches, and inductors. Again, the capacitor charges just once to charge the primary coils, and the secondary coil causes the xeon tube to flash. The similarity of components has also been identified by other interested parties. Today the primary method to bring down a jet is to smuggle a bomb aboard. This method may be obsolete.
EMP Effects
An EMP attack can disrupt the electric grid, banking, finance, hospitals, and transportation infrastructure. Manufacturing today is run by microprocessors (SCADA) and this lends it to be very vulnerable to this type of attack. Most, if not all, of civilian infrastructure is not hardened to an EMP attack. Some infrastructure even has a single point of failure.
In order to provide additional detail on the disruption an EMP attack could cause, I have focused on three microprocessor-rich environments: hospitals, fly-by-wire jets, and nuclear power plants. These may be some of the most vulnerable to EMP attack.
Hospitals
Hospitals today are run by many microprocessors. A patient may have anywhere from four to eight microprocessors that deal with their condition. Hospitals also make use of Wi-Fi to transmit information. Over the past ten years, there has been significant automation of hospital systems and the integration of different devices. The automation in hospitals has benefited nurses; they can look over numerous patients at the same time. However, if someone wants to inject pulses into the hospital system to the ground or the other hot leads, they will turn some devices off. Some computers will try to reboot, and some will just be burned out. Again, I am talking about a series of pulses, not a single large pulse. I presented this scenario to a doctor, and his opinion was in the first 24 hours anywhere from 5 to 10% of patients in the ICU will perish. Hospitals do not have a scenario for this type of event; there is no backup or recovery plan. Hospitals would not know what is happening to them and would not be able to identify what's going on. This outage will happen even if they had power conditioners on their electrical lines. The analog landlines probably would still work. The telephone system running voice over IP would fail. There's no disaster recovery from this scenario.
Fly-by-wire Airplanes
What is the difference between Boeing’s and Airbus's idea of automation? Airbus is a much more fly-by-wire plane than Boeing. In the Airbus system, the jet flies in the protected flight envelope, and basically, the software tells pilots what to do. That's the opposite of what the Boeing system does; their software augments the pilot. Therefore, Airbus planes are more susceptible to an EMP attack generated within the airplane. There are already EMP generators onboard jets; any camera that has a flash attachment, and most do, can create an EMP.
In some cases, cell phones also have flash capability, so there are multiple possible EMP generators on board. Airplanes have redundancy or triple redundancy of all avionics, but they are microprocessor controlled. One other factor not in consideration is that today's flight recorders are microprocessors driven. While they record multiple flight parameters, they could fail like all the avionics systems.
Below, I've developed four possible scenarios with a single pulse that can take out a jet.
The single pulse may cause significant structural damage to the airframe. That pulse will cause the airplane to move in a violent manner that will exceed the structural capabilities of its fuselage. Pulse generator floating not grounded.
The single pulse is generated at takeoff, floating not grounded.
The single pulse is generated at landing with the pulse generator floating.
The single pulse causes the fuel tank to explode. In this case, the pulse generator is not floating; it's connected to the neutral and hot lead in the airplane system. On July 17, 1996, Trans World Airlines flight 800 exploded over Long Island Sound. After numerous investigations including considering that a missile could have shot the jet down and possible terrorist activities, the NTSB ultimately came to the conclusion that the center fuel tank exploded because of an arc in the wiring in the center fuel tank. This is proof of the concept that if you inject a pulse into the wiring of an airplane, you can create an explosion. Most cameras flashes can produce enough power to cause an arc. Injecting the pulse into the wiring of the jet you have both conduction and radiation of the wires. There is a good chance the pulse will couple with some of the wiring and cause a major catastrophe.
Below, I have a picture of a black box. This device is a miniaturized computer system that monitors important airplane flight parameters. It is composed of microprocessors and solid state memory that can be disrupted by an EMP pulse.
Nuclear Reactors
I've never been to the control room of a nuclear reactor, but from articles online it has multiple sensors gauges. Some of the sensors will measure neutron flux, gamma rays, water temperature, and pressure in the vessels turbine speed, etc. All the sensors are no doubt controlled by some microprocessor systems or minicomputer systems that are probably networked together.
I have come up with three possible scenarios.
An EMP pulse is injected into the ground during normal operating procedures while the reactor is producing power and transmitting it to the electric grid. The only problem I see is if the pulse causes some erratic movement of the control rods or it could cause a SCRAM of the reactor that is a rapid shutdown of the neutron flux.
EMP get injected into the ground during reactor shutdown.
EMP is injected into the ground during a reactor startup.
The two most critical times for the reactor are when it's shutting down and starting up.
Disruption Prevention
The US Department of Homeland Security (DHS) has published an article that discusses hardening our military and civilian infrastructure so that they can survive an EMP attack. One such hardening measure involves shielding all power and communication cables.
To frame their protection recommendations, DHS discusses different protection levels. The levels are standardized by the amount of time that a process (computer or infrastructure) can have an outage. These levels relate to the military, but I have evaluated them on how they would relate to civilian targets. The levels are listed below come from the DHS publication listed above. I have paraphrased EMP protection from each level. All countermeasures involve the shielding of electronic devices. This consists of putting an electrical conductor around the device, and it will protect them from a hydrogen bomb or a space weather EMP event. However, this shielding will be ineffective against an injected EMP attack into the power system.
Level 1 - Lowest cost outages permitted. Civilian housing. Unplug devices that can be unplugged. Turn off equipment that can't be unplugged. Have EMP protected backup power and power from batteries. Put electrical equipment in foil or build a type of Faraday container. A Faraday container is a type of metal case that conducts electromagnetic pulses, and shields equipment that it contains.
Level 2 - Hours of outages permitted. Gas stations, grocery stores, and other logistic infrastructure. In addition to level 1 protections: Use EMP shielded power cords and other wires connected to systems. Use uninterruptible power supplies that are EMP protected. If possible, use fiber optic cables because they do not conduct EMP.
Level 3 - Minutes of outages permitted. 911 call centers, first responders, and civilian civil defense. In addition to level 2 protections: Use equipment that conforms to the International Electrotechnical Commission standards. Use physical shielding for equipment.
Level 4 - Seconds of outages permitted. Hospitals, dialysis centers, and other facilities that provide real-time care for patients. In addition to level 3 protections: Use double surge protection on all external lines. Use communication systems that meet EMP standards. All double-door entryways should be EMP protected.
Conclusion
I've been studying EMP pulse for the past 12 years. First, with a Marx generator, and then with a Tesla coil. During the past couple of years, there have been numerous kits and devices that have come on the market for the amateur to create an EMP pulse. I believe we are very close to the point that terrorists will start using these devices to disrupt infrastructure and the grid.
The risks of a terrorist EMP attack on the infrastructure and/or grid is very real, and it is very doable.
“The Commission's report found that our infrastructure, such as electrical power, telecommunications, energy, financial systems, transportation, emergency services, water purification and delivery, food refrigeration, all of these things and more were vulnerable to EMP attack. And in the event of such an attack, those infrastructures would be rendered unusable, thus inflicting widespread disruption or failure on a national scale. The death toll from such an attack is almost unthinkable.”
-Congressional hearing on terrorism and the EMP Threat to Homeland Security
The DHS protection guidance assumes that we can only have an EMP attack from a high altitude hydrogen detonation. Their guidance has no concept of someone injecting EMP pulses directly into the wiring of the electric grid or infrastructure. This is much like their lack of knowledge or understanding of someone using a jet airplane as a cruise missile and crashing it into a building.
About the Author
Paul Renda has over 30 years in information security. He has spoken at a number of above ground and below ground hacker conferences. He studied physics and math at Queens College and the University of Houston, and he has worked as a system administrator for IBM Z/OS and Linux systems.