  The electric power grid is a complex cyberphysical energy system (CPES) in
which information and communication technologies (ICT) are integrated into the
operations and services of the power grid infrastructure. The growing number of
Internet-of-things (IoT) high-wattage appliances, such as air conditioners and
electric vehicles, being connected to the power grid, together with the high
dependence of ICT and control interfaces, make CPES vulnerable to high-impact,
low-probability load-changing cyberattacks. Moreover, the side-effects of the
COVID-19 pandemic demonstrate a modification of electricity consumption
patterns with utilities experiencing significant net-load and peak reductions.
These unusual sustained low load demand conditions could be leveraged by
adversaries to cause frequency instabilities in CPES by compromising hundreds
of thousands of IoT-connected high-wattage loads. This paper presents a
feasibility study of the impacts of load-changing attacks on CPES during the
low loading conditions caused by the lockdown measures implemented during the
COVID-19 pandemic. The load demand reductions caused by the lockdown measures
are analyzed using dynamic mode decomposition (DMD), focusing on the
March-to-July 2020 period and the New York region as the most impacted time
period and location in terms of load reduction due to the lockdowns being in
full execution. Our feasibility study evaluates load-changing attack scenarios
using real load consumption data from the New York Independent System Operator
(NYISO) and shows that an attacker with sufficient knowledge and resources
could be capable of producing frequency stability problems, with frequency
excursions going up to 60.5 Hz and 63.4 Hz, when no mitigation measures are
taken.
