Exercise Black Sky

Exercise Black Sky
Name	Exercise Black Sky
Type	Cyber/Infrastructure Resilience Exercise
Date	21–25 September 2023
Location	Continental United States (distributed)
Participants	Federal, state, local, private sector, academic partners
Organizer	Department of Homeland Security, Cybersecurity and Infrastructure Security Agency
Objective	Test resilience of critical infrastructure, emergency response, public-private coordination

Exercise Black Sky Exercise Black Sky was a large-scale, multi-jurisdictional resilience exercise focused on coordinated response to cascading cyber and physical disruptions affecting critical infrastructure. Designed as an integrated continuity and emergency-management drill, the exercise involved an array of federal agencies, state authorities, private-sector operators, academic centers, and nongovernmental organizations to validate plans, communications, and resource-sharing mechanisms. The exercise emphasized interdependencies among energy, telecommunications, transportation, financial, and public-health sectors and the practicability of mutual-aid and contingency arrangements.

Background and Purpose

Exercise Black Sky was initiated in the context of rising concerns about cyberattacks like the Colonial Pipeline cyberattack, major outages such as the Northeast blackout of 2003, and resilience frameworks like the National Infrastructure Protection Plan. Sponsors included the Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, Federal Emergency Management Agency, and state-level offices similar to the California Governor's Office of Emergency Services. The purpose was to evaluate the readiness of stakeholders including utilities such as Southern Company, Exelon, and Duke Energy; telecommunications providers like AT&T, Verizon, and T-Mobile US; financial institutions comparable to JPMorgan Chase, Bank of America, and Goldman Sachs; and health systems modeled on Mayo Clinic and Kaiser Permanente.

Scenario and Scope

The scenario simulated a coordinated cyber campaign inspired by precedents such as the NotPetya incident and targeting industrial control systems employed by operators like Siemens and Schneider Electric. The simulated impacts mirrored disruptions seen during events like Hurricane Sandy and the 2017 WannaCry outbreak, producing power outages, degraded FirstNet-style communications, transportation delays at hubs akin to Hartsfield–Jackson Atlanta International Airport, and payment-system interruptions reminiscent of outages that affected New York Stock Exchange clearing operations. The scope ranged from localized city outages to multi-state blackout simulations and involved private-sector control rooms, state emergency operations centers like Texas Division of Emergency Management, and federal coordination centers including the National Cybersecurity and Communications Integration Center.

Participating Organizations and Roles

Primary coordinating entities included CISA, FEMA, Federal Communications Commission, and the Department of Energy. State participants included offices analogous to New York State Division of Homeland Security and Emergency Services and Massachusetts Emergency Management Agency. Utility and service partners spanned PJM Interconnection, North American Electric Reliability Corporation, Comcast, Level 3 Communications, and cloud providers such as Amazon Web Services and Microsoft Azure. Financial-sector roles were represented by trade groups like the Financial Services Information Sharing and Analysis Center and institutions similar to Federal Reserve Bank of New York. Academic and research contributors included centers like MIT Lincoln Laboratory, RAND Corporation, and Carnegie Mellon University's CERT Coordination Center.

Exercise Design and Timeline

The exercise comprised pre-play workshops, a five-day main play period, and after-action hot washes. Design elements drew on methodologies from Homeland Security Exercise and Evaluation Program and scenario constructs used in Cyber Storm exercises. Day 1 emphasized detection and initial incident reporting, involving simulated alerts from entities such as E-ISAC and vendor advisories by companies like FireEye. Day 2 focused on escalation and sector coordination with tabletop deliberations among North American Electric Reliability Corporation and regional transmission organizations. Day 3 incorporated public information and crisis communications with press interactions modeled on Department of Justice and state press offices. Day 4 stressed mutual aid and logistics engaging American Red Cross and private logistics firms, while Day 5 culminated in restoration and recovery planning akin to operations after Superstorm Sandy.

Key Objectives and Evaluation Metrics

Objectives included validating continuity-of-operations plans for organizations such as National Aeronautics and Space Administration centers and utilities, testing cross-sector information sharing through entities like the Information Sharing and Analysis Center network, and measuring timeliness of incident-action coordination among federal components including CISA and DOE operations centers. Evaluation metrics quantified detection-to-notification intervals, interagency decision-cycle times, restoration timelines for critical nodes like substations under protocols inspired by NERC CIP standards, message-passage reliability for networks resembling FirstNet, and public-safety response metrics aligned with National Incident Management System principles.

Major Events and Outcomes

Major simulated events included a supply-chain compromise comparable to SolarWinds leading to control-system intrusions, cascading power outages in an PJM Interconnection-like footprint, degraded cellular coverage mirroring historic outages affecting T-Mobile US subscribers, and transactional failures in banking systems akin to incidents that impacted Citigroup. Outcomes highlighted successful activation of state emergency operations centers similar to Florida Division of Emergency Management, improved cross-sector situational awareness through platforms modeled on E-ISAC, and identified bottlenecks in interjurisdictional decision authorities paralleling debates seen during the Hurricane Katrina response. Some private-sector participants simulated conservative shutdowns to contain malware, which produced unintended downstream effects on transportation hubs and health-care facilities like large academic hospitals.

Lessons Learned and Policy Implications

Lessons emphasized the need for clearer pre-established roles among entities such as CISA and FEMA, stronger contractual provisions between utilities and vendors like Siemens for supply-chain transparency, and expanded use of redundant communications systems exemplified by FirstNet-type architectures. Policy implications pointed to accelerating adoption of resilience standards similar to NERC CIP across broader critical-infrastructure sectors, enhancing legal frameworks for information sharing like the measures advocated by the Information Sharing and Analysis Act proposals, and prioritizing investment channels used by institutions such as Department of Energy research programs and National Institute of Standards and Technology initiatives to harden industrial control systems. The exercise informed subsequent planning cycles and legislative discussions about national preparedness and cross-sector dependency management.

Category:United States cybersecurity exercises