Open up your mind and say, ahh...

Could America’s electrical grid be targeted by terrorists or hostile foreign states? Anything’s possible. Is a catastrophic electrical grid attack likely? The House of Representatives held a hearing this morning on “smart grid” attacks–and it appears that modernization of electrical utilities nationwide has left huge security loopholes that hackers can exploit.

The hearing, held by the Oversight & Investigations Subcommittee of the House Energy & Commerce Committee, featured testimony by officials from the Government Accountability Office (GAO), and the Congressional Research Service (CRS). National Security Agency head Gen. Keith Alexander has previously told the White House about his fears that Anonymous could attack America’s electric grids and cause blackouts.

Rep. Henry Waxman (D–CA) expressed concerns about “unexpected terror attacks or hacking attempts” against America’s energy infrastructure. Another subcommittee member, Rep. Diana DeGette (D–CO) noted that smart grid technology–which connects electrical grid infrastructure to the Internet for cost-savings, ease of use, and added services for consumers–is also uniquely at risk from damage by malicious hackers.

Our Representatives are right about the risk… though, to Gen. Alexander’s detriment, it’s not from Anonymous. Gregory C. Wilshusen of the GAO gave sobering written testimony. While the conversion to a smart grid has modernized America’s electrical infrastructure, neither the government nor utility firms have been acting to close urgent security gaps. No monitoring is taking place of electrical utility providers to guarantee that even minimal cybersecurity standards are being put into place. No trade group or coordinating organization has created metrics to measure cybersecurity for energy suppliers. Information-sharing between utility providers is still the exception to the rule. Most worryingly of all, new smart grids still do not include basic event logging and forensic capabilities.

Anonymous spokespersons have explicitly stated that the hacktivist collective is not interested in smart grid attacks. In a post on the quasi-official AnonOps Communications blog, Anonymous responded, saying “Ridiculous! Why should Anonymous shut off power grid? Makes no sense! They just want to make you feel afraid.”

However, the threat to the electrical grid likely is not from Anonymous–it instead lies with foreign states interested in damaging the USA’s economy. In 2009, it was revealed that Chinese and Russian cyberintruders routinely break into American electrical companies. The bulk of the break-ins were discovered by American intelligence officials, not the victimized utility companies.

For more stories like this, follow @fastcompany on Twitter. Email Neal Ungerleider, the author of this article, here or find him on Twitter and Google+.

Image: Flickr user Lydiashiningbrightly

I am working with a client on a vision for their organization. I find
it interesting that people in leadership positions still have a
difficult time differentiating a vision from a mission–not just in
wording, but in concept.

A mission is a statement of why an organization exists. It should be short and very clear.

Even
big companies have mission and vision issues. Take The Walt Disney
Company. Disney used to have a very clear mission statement: “Make
People Happy.”

It didn’t say make people happy through animation,
or theme parks, or interactive experiences. Those are details. Its
mission was to make people happy.

Now their mission is “to be one
of the world’s leading producers and providers of entertainment and
information. Using our portfolio of brands to differentiate our content,
services and consumer products, we seek to develop the most creative,
innovative and profitable entertainment experiences and related products
in the world.”

Disney obviously hired a strategic planning consultant to help
it shape its mission statement to match the expectations of MBAs on
Wall Street. I don’t think their current statement does anything to
enhance its mission; in fact, I think it detracts because you have to
figure out what words like “differentiate” mean. They may be more
strategic and more business sounding, but do they still make people
happy? Making people happy keeps customers returning, unlike a
profitable, innovative entertainment experience. It is obvious that the
new mission statement drove investments like Disney’s California
Adventure.

And if you look at Disney assets, even ESPN could sign
up for making people happy. I was in Florida for a Patriots game once
with a bunch of people from Boston. ESPN was blaring from speakers and
shining from big screens. And the ESPN Club brought in portable taps so
they could serve people outside. They scaled up the Club, and scaling
up, and serving up Patriots football, meant people were happy.
Somebody’s vision of happy customers drove that experience.

Now to
vision. A vision isn’t a statement. A vision is a set of ideas that
describe a future state. Some organizations like “vision statements” but
I don’t find them overly useful. The future is something that an
organization must grapple with. Visions should provide a sense of
aspiration, they should stretch imagination. They should describe the
state of the organization, across its functions, not rush to summary.
Different parts of an organization may have different visions.

I
coach clients to think about vision attributes, then to think about the
capabilities required to deliver those attributes. Then I ask them to
consider how to measure progress through both metrics and a road map (a
sketch of a pathway that leads from the present to the goal).

At
the broad vision level, organizations should not try to measure their
progress. A vision statement isn’t a transformation into a future
mission.

Let me go back to the simple version of Disney. Making
people happy doesn’t change–ever (unless mergers and acquisitions cause
you to hire a consultant that helps put big words into the board’s
collective mouths). But let’s consider that Disney still wants to make
people happy.

Their vision may include:

• Be the leader in the delivery of entertainment experiences.
• Be the premier channel for sports experiences and information.

Those
aren’t the same, but Disney is a complex company. It is okay to have
vision statements that align with business units. And as the vision
becomes more granular, it should include elements that can be measured.

For
the first item, they would include theme parks, hotel properties, ice
shows, movies, video games, and a number of other things. Each of which
would imply a set of capabilities, and a set or measures to determine
progress (quantitative and qualitative).

The next discussion
sometimes includes a statement like: “That isn’t a vision, we are
already the leader in entertainment experiences, and have been for
years.”

Well yes, you may be the leader, but if you want to stay
one, shouldn’t you restate it as part of your vision? A vision is not
just about growing, but about maintaining. If the vision doesn’t include
“being a leader in the delivery of entertainment experiences,” what does
that mean for those parts of the business? Is there some future state
that is better than being a leader? Are we abandoning those businesses,
or deinvesting so we are just “mediocre in the delivery of entertainment
experiences”?

In fact, there was a time when Disney kind of lost
its collective soul, in the early to mid-1980s when box office share
dwindled to less than 4% and it turned down films like Raiders of the Lost Ark and ET–and was the target of investment raiders. Theme parks became real
estate and their movies uninspired. Poor management was reflected in a
poor understanding of vision and mission. Happy people were no longer
center stage.

The bottom line on vision, then, is to recognize the
complexities of the business and create visions for areas that are
meaningful to internal and external constituencies, and make sure these
visions are consistent with the mission. Grapple with the future. If the
vision is 10 years out, you don’t have to understand how to achieve it
today, but you do need to start prioritizing investments, including
learning investments, that dip toes into the future so you really
understand what the organization will need to achieve the vision. And
the state that eventually arrives in a decade may be very different than
what was documented 10 years prior, but by then, the vision should be
another 10 years ahead. A vision should help inform direction and help
set priorities. It should be not be unchanging. As organizations learn,
they need to adjust and adapt, and reflect that learning in the vision.
That is why scenarios are so important: They help you practice different
futures in which the vision might unfold–each scenario requiring
different tactics and strategies.

Any vision that stays the same
for a decade fails as a vision. Visions should be used every time an
investment or deinvestment decision is made, and if parts prove no
longer valid, or if the world presents new opportunities, then the
vision should be updated. Visioning is a process, not an output. You can
share your vision with people, but it should be shared with the caveat
that it is updated regularly, and with the request: “Please share your
thoughts, because we are always open to new perspectives and better ways
to think about our future.” That approach will not only make the vision
more meaningful and resilient, it will make the organization behave as a
learning organization, and that may just be part of its vision.

Image: Flickr user Joe Penniston