IEEE COMMUNICATIONS SURVEYS & TUTORIALS, VOL. 14, NO. 4, FOURTH QUARTER 2012 981 Cyber Security and Privacy Issues in Smart Grids Jing Liu and Yang Xiao, Senior Member, IEEE, Shuhui Li, Wei Liang, C. L. Philip Chen, Fellow, IEEE, Abstract—Smart grid is a promising power delivery infras- tructure integrated with communication and information tech- nologies. Its bi-directional communication and electricity flow enable both utilities and customers to monitor, predict, and manage energy usage. It also advances energy and environmental sustainability through the integration of vast distributed energy resources. Deploying such a green electric system has enormous and far-reaching economic and social benefits. Nevertheless, increased interconnection and integration also introduce cyber- vulnerabilities into the grid. Failure to address these problems will hinder the modernization of the existing power system. In order to build a reliable smart grid, an overview of relevant cyber security and privacy issues is presented. Based on current literatures, several potential research fields are discussed at the end of this paper. Index Terms—smart grid; SCADA; AMI; security; privacy; accountability I. I NTRODUCTION W HILE technology and innovation continue to mod- ernize industry, our electric power system has been maintained in the same way for decades. The increasing load and consumption demands increase electricity complications, such as voltage sags, black outs, and overloads. Meanwhile, the current electrical network contributes greatly to carbon emissions. The United States’ power system alone takes up 40% of all nationwide carbon dioxide emissions [46]. Consid- ering both economic and environmental interests, substantial changes must be made to such an unstable and inefficient system. Therefore, many nations (e.g., U.S., EU, Canada, China, Australia, South Africa, etc.) are now modernizing their power grids [42]. They believe that they not only require reliability, scalability, manageability, and extensibility, but also that they should be secure, interoperable, and cost-effective. Such an electric infrastructure is called a “smart grid.” Generally speaking, the smart grid is a promising power delivery infrastructure that is integrated with two-way com- munication and electricity flows. Through advanced sensing technologies and control methods, it can capture and analyze Manuscript received 27 October 2010; revised 3 August 2011, 11 November 2011, and 19 November 2011. J. Liu and Y. Xiao are with Department of Computer Science, The Univer- sity of Alabama, Tuscaloosa, AL 35487 USA (e-mail: jliu39@crimson.ua.edu, yangxiao@ieee.org). S. Li is with Department of Electrical and Computer Engineering, The Uni- versity of Alabama, Tuscaloosa, AL 35487, USA (e-mail: sli@eng.ua.edu). W. Liang is Shenyang Institute of Automation, Chinese Academy of Sciences, Shenyang, 110016 China (e-mail: weiliang@sia.ac.cn). C. L. P. Chen is Faculty of Science of Tech., University of Macau (e-mail: Philip.Chen@ieee.org). Y. Xiao is with the Department of Computer Science, The University of Alabama, 101 Houser Hall, Box 870290, Tuscaloosa, AL 35487-0290 USA (e-mail: yangxiao@ieee.org). Corresponding author. Digital Object Identifier 10.1109/SURV.2011.122111.00145 TABLE I DIFFERENCES BETWEEN IT NETWORKS AND SMART GRID Categories IT Networks Smart Grid Security Objectives Confidentiality > Integrity > Availability Availability > Integrity > Confidentiality [3] Architecture 1) flexible and dynamic topology; 2) center server requires more protection than periphery hosts [30]. 1) relatively stable tree- like hierarchy topology; 2) some field devices re- quire the same security level as the central server [30]. Technology 1) diverse operating sys- tems; 2) public networks; 3) IP-based communica- tion protocols 1) proprietary operating systems; 2) private networks; 3) IEC61850- and DNP (Distributed Network Protocol) - based communication protocols. Quality of Service 1) transmission delay and occasional failures are tolerated; 2) allow re- booting [30]. 1) high restrictions on transmission delay and failures; 2) rebooting is not acceptable [30]. data regarding power usage, delivery, and generation in near- real-time [1]. According to the analysis results, the smart grid may provide predictive information and corresponding recommendations to all stakeholders (e.g., utilities, suppliers, and consumers) regarding the optimization of their power utilization [1]. It may also offer services like intelligent appliance control for energy efficiency and better integration of distributed energy resources (DERs) to reduce carbon emis- sions [2]. Apparently, it is not a simple grid in the sense of our current power grid. It can be regarded as a “system of systems” that involves both information technology (IT) and electricity system operations and governance. Such a complex system undoubtedly presents many challenges, especially in cyber security and privacy aspects [3]. Based on experiences gained from developed IT and telecommunication systems, we know that the envisioned grid will be a potential target for malicious, well-equipped, and well-motivated adversaries. Specifically, the grid can be subject to physical attacks by a human being, by malicious software that can harm the control system, or by using up the systems’ resources to perform the attacker’s own tasks. Any of these forms of disruption occurring to the grid can be highly dangerous. Threats such as fiddling with billing information of particular users can cause a major economical disturbance, if they are not monitored carefully. The power grids, on the other hand, are a major resource to the national defense, and any form of attack on these can cause havoc. Furthermore, increased connectivity of the grid will enable personal information collection, which may invade consumers’ privacy. Failure to eliminate these threats 1553-877X/12/$31.00 c  2012 IEEE