Interesting analysis of electric cars and energy use.

 

From your Digest

Ryan Carlyle

BSChE, engineer at an oil companyUpdated May 7, 2014

If all cars in the US suddenly become electric, how much more electricity do we need to produce (in percentage)?

Let's do the math.

The US burned 133 billion gallons gasoline in 2012. I'm going to ignore diesel vehicles because the majority of diesel burned in the US is in heavy vehicles where battery-electric drivetrains are not a practical option.
How much gasoline does the United States consume?

The average thermal energy content in gasoline is 33.41 KWh/gallon.
Gasoline gallon equivalent

This gives 4,443 TWh of thermal power going to gasoline road vehicles in the US per year. If we assume electric vehicles use energy with 4x the efficiency of gasoline vehicles (a reasonable round number) then it would take 1,111 TWh of electrical energy to replace that gasoline energy.

US electricity consumption in 2011 was 3882 TWh.
International Energy Statistics

So the increase in yearly electricity demand would be ~29%.

Now let's look at what this does to CO2 emissions.

Each gallon of gasoline contains 8,887 grams of CO2.
Calculations and References

So the CO2 reduction from avoided gasoline consumption (assuming demand does not rise elsewhere to compensate) would be 1182 million tonnes CO2 per year. But this is the gross figure before increased electricity use is considered.

If we assume the extra electricity comes from the existing mix of non-base-load sources (as nighttime charging likely would), the CO2 emission per KWh of electricity is 689 grams of CO2.
Calculations and References

Electric Vehicles: Myths vs. Reality

So the total increase in CO2 emissions from increased electricity consumption would be 765 million tonnes Co2 per year. Thus the net CO2 emission reduction would be 417 million tonnes.

Total US CO2 emitted in 2012 was 6,526 million tonnes.
U.S. Greenhouse Gas Inventory Report

So the net decrease in national CO2 emissions would be ~6.4%.

[Update: Graham Katz pointed out that I've neglected the CO2 emissions from refining, which is a valid point. Gasoline's share of US refinery emissions is ~130 million tonnes, which increases the CO2 reduction from ~6.4% to ~8.4%. There are many other factors which can be included in the analysis that will increase or decrease both cost and emissions, and for the sake of brevity, I'm ignoring those. A full accounting would take hundreds of pages.]

Now let's look at cost.

The average US car costs $25,000.
Passenger vehicles in the United States

Electric cars -- pre-subsidy -- are running around $40,000. Now, this will come down with scale. But the "average" $25k car price today also includes many heavy vehicles and diesel-burners that skew up the average price. Small gasoline vehicles that are good candidates for replacement with EVs are cheaper -- perhaps $20k average. So at today's costs, EVs cost $20k more than equivalent gasoline vehicles. But let's be conservative and call it $30k for an economy-of-scale electric vehicle. This means $10k marginal cost over gasoline for a good round number.

So there's two cost cases to consider here. Switching all cars instantly, versus merely replacing all old vehicles with electric cars.

• For the extreme "instant" switch, around 150,000,000 vehicles have to be replaced immediately, and gasoline cars lose all value. That would cost $4.5 trillion.
• For the "gradual" switch, where gasoline vehicles are run until the end of their useful life, you only need to consider the marginal increase in cost over a business-as-usual case. So the cost would be $1.5 trillion.

I think these are fairly conservative numbers. Reality would probably be somewhere between the two.

Taking the $1.5 trillion figure, that gives us an effective cost of CO2 reduction of ~$3600 per tonne CO2 per year. Amortized over 30 year vehicle life (which I think is extremely optimistic in the US) that gives $120/tonne CO2 avoided. This is quite expensive.

To be fair, EVs also have long-term savings in fuel cost but the rest of the math is very conservative so I don't feel bad about neglecting this. Decrease the expected vehicle life to a more realistic number (considering battery longevity), or retire gasoline vehicles more aggressively, and the net $/tonne CO2 number will come out about the same.

I'm sticking with $120/tonne -- I think it is a reasonable estimate. You're welcome to disagree in the comments if you have a better number.

Current industry estimates put the cost of coal power plant carbon capture & sequestration (CCS) at ~$80/tonne CO2 captured. Then that CO2 has an economic value of ~$40/tonne for enhanced oil recovery. So the net economic cost of CCS is ~$40/tonne. (These numbers may not scale linearly, but neither do the marginal electricity and CCS costs. It arguably washes out.)
Journal of Petroleum Technology February 2014 Page 46

Which means electric vehicles are a pretty crummy way to reduce CO2 emissions, given the current US power mix. You can do three times as much good per dollar by fitting coal plants with carbon capture systems. Not to mention even better alternatives like replacing coal plants altogether with nuclear, wind, or combined-cycle gas plants. Mass rollout of electric vehicles is only worthwhile in tandem with massive increases in renewables generation. Perhaps in the future we'll get there. But today's generation market trends do not support that assumption for the next several decades.
U.S. Energy Information Administration (EIA)

Review: Cyberspies by Gordon Corera

 One of the most overlooked parts of the Muller report is the detailed information the FBI, et al., collected on Russian interference in the 2016 election. They determined the names and location of the GRU officers and cyberspies who conducted the operation, what they did and how they did it. It was an extraordinary piece of sleuthing. (See Sandworm by Andy Greenberg for more details.)  Cyberspies places all this in historical context.
 
This book has something for everyone: history, spying, and interesting characters. While he argues that "hacking" using technology has a long history dating back millennia, he chose to begin with the cutting of German cables on the ocean floor during WW I. Leaping-frogging rather quickly he then begins with the use of computers (people, those who computed) and especially Flowers and Turing who respectively understood the larger picture and how "valves" (vacuum tubes in American) could be used binarily to process data. Along the way, he tries to answer questions of what cyber spying is, how such developed and its impact in today’s world politically, economically, and in the intelligence communities. An ambitious goal indeed.i.e.
 
There are two key components to the world of spies: attribution, i.e. can you trace back a decision or instruction to its source; and integrity, the accuracy of the data, for getting just one component of a message wrong could mean sending a missile to the wrong target. Scrambling a message so it can't be read by the unauthorized is an inherent part of spycraft and technology has made all of that both easier and more difficult at the same time.   “Few outside the intelligence world understand the extent to which spies in the US and Britain perceive technology as an existential threat to their work,” Corera writes. “An arms race is on between spy services to exploit technology. Only those who adapt will survive.”
 
Spying has more than just military significance. The Russians and others have taken economic espionage to a new level. Collecting information peripherally is important.  The author provides an example of Russian trolling for information about a particular executive whom the intelligence services had determined was gay but not out of the closet. “The hackers then sent him an email from a gay rights organization which they suspected he would open since it looked as if it was sent to him, but in fact held malware,” Corera writes. “They then counted on the fact that, even if the executive did suspect it was malware, he would not be willing to go to his company’s IT department or security team for fear it would reveal his sexuality. This is classic, high level, targeted Russian espionage.”
 
There's intelligence and then there's information.  Spying in common parlance conjures up images of dangerous men with guns in tuxedos in scary situations who can leap tall buildings in a single jump. Or the silent bureaucratic types of Le Carre. The author has a wonderful metaphor for the difference in how spying is done by different countries. Let's say you want to find out what kind of sand is on a particular beach in some foreign country.  The UK would send a submarine with divers in wet suits (bow ties and suits underneath) to surreptitiously retrieve a sample of sand from the beach. The Americans would use technology to and fly satellites, drones, and planes over the area to take lots of pictures.  The Chinese would send tourists to the country to have a good time, visit the beaches, and then shake out their towels when they got home.
It's a comprehensive look at how spying developed, including the misconceptions about what spying is and its development over time into not just  military purposes uses but economic, as well.  Corera includes a detailed history and an examination of how cyber spying was affected by the revelations of the collection of data by government agencies by Snowden, and suggestions on what the future of cyber spying and offensive actions may hold for us. It's organized in a logical chronological way and intricate cyber threats and attacks are explained clearly.

The scale of cyber espionage has evolved way beyond the wildest dreams of a former Stasi officer who noted their maximum capability was to tap forty lines at once. Now, given that almost all of the world’s internet traffic flows at some time or another through the United States, the NSA, with its sweeping authority and collection devices, has access to everything. Worried about public encryption keys, they sweep up and store ALL of the telephone traffic in the U.S. and many other places arguing they don’t listen to the content but merely search the metadata attached to digital traffic. And since even analog conversations get converted to digital at some point, that’s everything. Metadata is easy to search and often more revealing than content.

In their search to build an even larger haystack (you can’t find the needle without the haystack) they even resorted to techniques even aside from the famous clipper chip debacle. In one instance, discovered by Kaspersky Labs, they arranged to have malware hidden into DVDs that were given to participants of hacker and security conferences attended by analysts from all around the world that contained records and presentations of the conference. This gave them worldwide access to computers run by the most sensitive personnel.

Snowden’s revelations of the NSA’s spying capabilities had less affect on national security than it did on business. It’s hard to maintain a global outreach and increase your revenue if it becomes widely known that anything you do using the company’s products will become NSA fodder. Zuckerberg, in particular, was furious after the revelations, complaining to Obama that his business model was being hurt. Screw national security; you’re hurting our business, was the message.

1984 doesn’t even remotely compare to today’s capabilities.
 
Some reviewers have complained that a weakness of the book is its specialization and detail; that's what I liked.  Unfortunately, the world changes so fast that more recent events are obviously not included.  Sandworm by Andy Greenberg fills that gap and should also be read. Overall a fascinating glimpse at the evolution of the new cyber world.

 

N.B. Years ago I read Clifford Stoll's The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage    (1990) (how the author tracked down a spy ring because he wanted to know how and why 75 cents of computer time was unaccounted for.) Stoll is highlighted for his work in this book.  Stoll also wrote (in 1996) a prescient view of the problems inherent in the Internet:  Silicon Snake Oil: Second Thoughts on the Information Highway  .  For a truly prescient view of the problems with interconnectivity written in 1955, see a SF masterpiece by Thomas Ryan, The Adolescence of P-1

 

 

The Success of Terrorism

 

I've been reading a lot lately about cyber-security, its history, and the impact it's had on democracy and policy. One thing is clear. Terrorism in any form, be it IEDs, 9/11s, assassinations, etc., have little to do with gaining military advantage.  They are about creating an environment where people are scared. Getting them to overreact or distrust their government is the goal. The cyberattacks on infrastructure serve a similar purpose. After all, one purpose of government is to protect its citizens.  The occasional cyber hit on, say, the billing department of a pipeline that shuts down gasoline supplies, or messing with the water supply of a Florida city, or shutting off the lights in Ukraine, or manipulating people on social media with disinformation; all these efforts build distrust in the ability of government to protect its citizens.  You can shatter people's support for  government by scaring them, and soon people won't bother to vote, they'll distrust elections, and governments will fall.  

 

The efforts of the Russian GRU and other terrorists have been wildly successful. 9/11 unleashed an enormous overreaction that bogged the U.S. down in multiple wars in the Middle East that have sapped the treasury and military, resulted in spending trillions on theatrical security efforts in airports, and increased surveillance on its citizens, accomplishing nothing except to build distrust of government. Their recent minion in the White House only made things worse by placing his emphasis on personal enrichment rather than defense of the country, downplaying not just cyber threats, but biologic ones as well.

 

None of this is new, but it will take a deft hand at the controls to overcome the mounting distrust in democracy and government.

Suggested Reading:

Anderson, James. "Computer Security Technology Planning Study." UC Davis Computer Security Lab, seclab.cs.ucdavis.edu/projects/history/papers/ande72.pdf.

Corera, Gordon. Cyberspies: The Secret History of Surveillance, Hacking, and Digital Espionage. Pegasus Books, 2017.

Greenberg, Andy. Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. Anchor, 2020.

Perlroth, Nicole. This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. Bloomsbury Publishing, 2021.

"SAGE: Semi-Automatic Ground Environment Air Defense System." MIT Lincoln Laboratory, www.ll.mit.edu/about/history/sage-semi-automatic-ground-environment-air-defense-system.

 

Review: Furious Hours: Murder, Fraud, and the Last Trial of Harper Lee by Casey Cep

 Why would anyone live in Alabama?  The political, cultural, and social history of Alabama during the George ("I will never be out-niggered again") Wallace years is on stark display in this fascinating book by Casey Cep.

Before getting to the actual trial and relating it to the book that Harper Lee wanted  to write, Cep delves into the lives of the three main characters: Maxwell, the serial killing reverend who killed multiple wives and others for their insurance; Maxwell's killer who shot him in front of 300 witnesses; and Tom Radney, as very likeable man who defended  Lee and who had been physically threatened, his family terrorized, and his homes and possessions vandalized because, as state senator, he had supported Ted Kennedy's nomination to run for president the year that George Wallace run as an independent. And Harper Lee's peripheral link to the trial.

The insanity defense has a long history.  It was even written into the Code of Hammurabi more than 3000 years ago. By the early 20th century it had fallen out of favor, seemingly allowing murderers to get away with murder and it had been outlawed in several states, but not Alabama. It was the only defense left to the defense.  Burns had shot Maxwell from three feet away in front of 300 people and had confessed at least twice.

It's not your typical murder mystery or courtroom drama, Lee, a close friend and colleague of Truman Capote, sat in on the trial in Alexander City taking notes.  Lee struggled to write a book about the trial, apparently worried it would never live up to her famous first book.  She had been closely involved with Capote as his friend and research assistant in the writing of In Cold Blood , but she never wanted to be associated with the "new journalism" epitomized by Capote, Mailer, and Talese.

The section on Lee is a letdown. The reader keeps waiting for more on the book that never got written. Not to mention the debacle over <i>Go Tell a Watchman.</i> The writing is very good, if sometimes impenetrable, e.g. "her letters, which had at one time been Pentatuchal in plot and Pauline in syntax...."

Review: Sandworm by Andy Greenberg

Greenberg writes for WIRED magazine and is a specialist in cyber security and privacy issues. This book is an extremely readable account of a Russian hacker group nicknamed Sandworm that succeeded in shutting down a substantial amount of infrastructure throughout the world but was aimed primarily at Ukraine. The attacks targeted every aspect of Ukrainian society: government servers, media organizations, transportation hubs. Ukrainian cyber experts could only watch as systems began to crash all around them. Public web sites, trains, banking systems and  ATMs were disrupted. Finally, the electricity grid collapsed  plunging hundreds of thousands of Ukrainians into darkness.

 

Having read several articles and books on Stuxnet, the successful destruction of Iranian nuclear centrifuges by the U.S. and Israel, I was anxious to read Greenberg's book. "Zero Day" security flaws are software holes that have never been used before so their vulnerability has yet to be discovered or fixed. Knowledge of these is precious to those wishing to penetrate systems. The Sandworm group (the name came from a Frank Herbert novel, Dune) has access to several and used them to great effect. The group went to great lengths to disguise themselves and hide. To Greenberg's credit he is able to explain how experts deciphered what group was responsible and he does it in language free of technical jargon.

 

Just a few months ago, a Netherlands researcher wanted to come to the U.S. to present a paper on the vulnerability of the industrial control system. There are almost 30,000 of these devices (programmable logic controllers) that control everything from wastewater plants to the electrical grid. The researcher, thanks to America's arcane and silly visa system, was not admitted and so unable to present these important findings.  Fortunately he was able to post them to his blog. Whether that resulted in a wider dissemination of the information than had he delivered his talk is academic, perhaps. **

 

Researcher Wojciech,  used standard OSINT techniques (the CIA has identified five main OSINT fields: Internet, media, geolocation, conferences, and online pictures) to analyze the exposed ICS devices. Many of these are used in critical infrastructure that would include dams, electrical grid, reactors, health treatment facilities, etc. Critical infrastructure developed by OSINT can be used not just by espionage agencies, but also criminal elements who may seek to gain monetary advantage by holding these devices hostage.  OSINT techniques are passive, in that the target remains completely unaware it is being surveilled. Access may be gained by open ports, IP addresses, knowledge of details of the specific devices and how they work -- all freely available online and elsewhere -- and even responses from the device itself.

 

Here's an example of device information that's available that even includes the phone number:

There are several programs that permit searching the internet for active ICS devices (https://www.shodan.io for example.) The author lays out precisely how to go about searching.  Many of these devices have open management ports that are convenient for technicians to access the devices remotely for maintenance. That, however, makes them extremely vulnerable to malicious actors.  General contractors with government contracts are particularly vulnerable as they have a history of being more open and thus more vulnerable.

 

That hackers can cause innumerable problems has already been shown in Ukraine, Estonia, and Georgia where the Russians devastated each country's infrastructure.  Andy Greenberg in Sandworm documents what happened in several cases. In Ukraine access to the banking system was eliminated.

 

It took forty-five seconds to bring down the network of a large Ukrainian bank. A portion of one major Ukrainian transit hub…was fully infected in sixteen seconds. Ukrenergo, the energy company…had also been struck yet again…the effect was like a vandal who first puts a library’s card catalog through a shredder, then moves on to methodically pulp its books, stack by stack. 

 

Ukraine became a testing ground for Russian hacking. Disinformation to spread distrust in the election and tampering with the infrastructure were simply test runs for their successful attacks on United States electoral trust in 2016 and 2020. Ukraine had taken the brunt of Russian abuse for centuries and Greenberg's short history of those onslaughts was suitably horrifying.  (See also Anne Applebaum's Red Famine: Stalin's War on Ukraine to understand why Ukraine at first welcomed the Nazis.)

 

US officials, typically heads in the sand, refused to admit something similar could happen in the U.S. yet we now know that Russian hackers infiltrated the U.S. election system and may well have manipulated the outcome in a variety of unorthodox ways. In 2016, Iranian hackers attacked several US banks causing millions in damages and shut down a dam presumably in retaliation for the Stuxnet attack.  The attacks themselves were quite unsophisticated, mostly DDoS attacks that even the most unsophisticated hacker can pull off.

 

There is software (malware, really) that has been designed for specific purposes; Stuxnet is but one example.  Another, discovered by the security firm Dragos, was CrashOverride***, only the fourth example of malware designed to attack and manipulate the controllers in electrical grids.  "The functionality in the CRASHOVERRIDE framework serves no espionage purpose and the only real feature of the malware is for attacks which would lead to electric outages."

 

Greenberg shows that a variety of software is available, even for sale, that permits relatively easy access for anyone, but can also be used to hide the origin of the attacker. To make matters worse, Greenberg wrote in Wired (https://www.wired.com/story/plundervolt-intel-chips-sgx-hack/) of researchers who had managed to access and control Intel processors (a vulnerability that has since been fixed) by manipulating the internal voltage of the processor. You can induce faults by lowering or changing the voltage and once you can do that you can change the output by manipulating the faults. The technique, called Plundervolt, was discovered concurrently by a researcher in Beijing.  (Take from that what you will.)

 

In his book, Greenberg focuses on Sandworm, a group of hackers and software named after the malicious creature in Dune (cyberanalysts had discovered that preference while doing research on the code - don't ask me how.)  They determined there was evidence that Sandworm had been infiltrating critical infrastructure—some of it in the United States—since 2011 and had already developed a weapon that could knock it out. When it was used against Ukraine, it had evolved even further.

 

The hackers had, in other words, created an automated cyberweapon that performed the same task they’d carried out the year before, but now with inhuman speed. Instead of manually clicking through circuit breakers with phantom hands, they’d created a piece of malware that carried out that attack with cruel, machine-quick efficiency.

 

PowerPoint users need take note that the program has become so large and now includes so many useless features that it has almost become its own programming language.  The Sandworm group utilized the ability to place objects and run programs within slides to place malware within  the users computer that would download or run other programs unbeknownst to the user.

 

They managed to fix the system in about an hour, but the point was made. Another group calling themselves ShadowBrokers made off with a whole set of penetration tools developed by the NSA and turned them loose in the wild where virtually anyone with a modicum of knowledge can make use of them. Shadow Brokers caused immense harm when they released EternalBlue, malware that spread faster than anything anyone had seen before. Within minutes it had disabled pharmaceutical companies, and Maersk, the huge shipping company was brought to its knees.

 

 “ 'For days to come, one of the world’s most complex and interconnected distributed machines, underpinning the circulatory system of the global economy itself, would remain broken,” Greenberg writes of the attack on Maersk, calling it “a clusterfuck of clusterfucks.” The company was only able to get its ships and ports back in operation after nearly two weeks and hundreds of millions of dollars in losses, when an office in Ghana was found to have the single computer that hadn’t been connected to the Internet at the time of the attack.' " ****

 

I've been reading a lot of books and articles on the potential for cyberwarfare.  The potential is there for even non-state actors to operate in the shadows and do tremendous harm.  Then again shutting down most of our industry might solve the global warming worst case scenarios.  One apocalypse preventing another.

 

**https://www.icscybersecurityconference.com/intelligence-gathering-on-u-s-critical-infrastructure/

 

***For a review of CrashOverride designed to attack electricity grids, see https://dragos.com/wp-content/uploads/CrashOverride-01.pdf

 

****https://www.i-cio.com/management/insight/item/maersk-springing-back-from-a-catastrophic-cyber-attack Note that this source places the lone saved Domain Controller in Nigeria rather than the more accepted Ghana.