Woah - was about to post but the Texas drinking water being radioactive distracted me...
In any case, I wanted to chime in on the topic of what I have learned over the past couple of years regarding potential grid attack scenarios from a cyber-attack...
I do know that many of us receive pamphlets telling us about the amazing upgrades to the "smart grid" and how detailed their reports can be showing us usage and all that jazz. I do have some experience closely working with folks involved with smart meter technology, as the local government I work for also incorporates automated meter reading. In one sense, it is a good thing from the perspective that I would not want to have to walk door to door reading meters, fighting dogs, getting bitten, getting threatened, etc. from customers that do not want to pay their bills. So I think it is easy to see how a corporation would find this an extremely attractive technology, as it means less paychecks to pay, less risk of on the job injury law suits against the company, etc... basically less cost.
I also know that some of the chips in these meters have been reverse-engineered by security researchers. I will leave it up to those wishing to learn more to google something like "smart meter vulnerabilities" or something along those lines if you need substantiation of that. It is not very easy (read "expensive") to put flexible encryption technologies into something that is going to be produced at the levels for which every customer gets one. So, more likely than not, is that there is some level of encryption sort of hard-coded into these meters (God I hope so). Think of it as a password that is stored on a chip, that is used to scramble the data before sending your meter's value up to the company. It also requires that the "password" be used to receive a command, such as "this guy didn't pay his bill, disconnect him." If any of us are on smart meters, at least here, the power can be shut off remotely. However, it seems to take sending someone in a truck to turn it back on. And of course, you get a nice "reconnect fee" for them doing so. So if we are to hypothesize that someone, either through reverse engineering the chip, or some other method (like a disgruntled former employee of the power company disclosing it), gains access to the key, I would believe that there is little to stop them from being able to reproduce the same type of network activity that issues the command to a person's meter to shut down the power. If it takes a person visiting the meter to be able to turn service back on, then I believe we can plausibly envision the possibility that such an attacker would be able to issue the same commands to many meters, and they will be able to turn them off faster than they can be turned on. That is a resource war, the resource being time, and the attacker has a big advantage.
It gets worse from there, however. As I read headlines like SC Magazine's article titled "Report: Army database housing sensitive data on major U.S. dams breached" and the like, I feel safe concluding that there is plenty of interest by other nations to possess the capability to disrupt, if not cripple, our infrastructure. There is a general consensus in this industry that the reality is not whether a given organization has been infiltrated via cyber-espionage, it is a question of who is aware of their presence and who is oblivious to their presence. Additionally, many organizations are full of folks that do not know how to protect their systems, and the day to day operations of utilities and getting things up and running will continue to take precedence over prioritizing the security of these systems.
The first article that I read demonstrating that actual physical damage was performed via a cyber attack was where some non-elite individual guessed a three-letter password to a system controlling water pumps in Springfield, IL was attached to the internet. The person sat there turning the pump on and off until it failed. Then I came across information indicating that South Houston's water system had been compromised as well. We also have the US engaging in such items as Stuxnet to attack Iran's nuclear program, which sort of sets the stage to say "well we're doing it, why can't these other countries do it as well." And then things evolve a little further like the creation of the Shodan search engine, which is like google for hackers but lets you identify many of these systems (which I may at times refer to as "Critical Infrastructure" meaning Water, Power, Oil and Gas equipment - that sort of thing) that are connected to the public internet. I think that is sufficient to establish that the threat exists and our adversaries are actively pursuing this capability if not already possessed.
We also need to examine the thought that many of these meters will become aged, and the manufacturers almost definitely provided a capability to "update" or "upgrade" the firmware on these meters. I can't imagine any company would put themselves in a position of risk that, if there was some big fault in the system that required an update or upgrade to the software running on these meters, that the only way to get it done would be to either replace them all or visit them all to upgrade them. Many printers, home routers, etc. also have this capability, where we can write new code to these devices. This is where I see the potential for some of the most damaging situations with respect to the power grid. If that same person that gains access to the system is able to write firmware to the meter, if just to brick it (doesn't have to be valid firmware, just enough to render it inoperable), that means that this device also loses any of the remote administration that the power company can use, even if they had the capability to turn them back on remotely. There is a lot of active research taking place into compromising devices with custom firmware, such as printers. There is a kid at Columbia university that did a great job demonstrating this with HP printers where they basically turned the printer into a computer under their control (and a platform to scan for other machines to attack from inside a companies firewall), just by enticing someone to print a PDF document containing information that the printer recognizes as a firmware update (think of HR printing up resumes from potential candidates). So, imagine a case where someone issues a sweeping command across the entire power company to disconnect power and brick the meters. The only way to bring them back up would be to visit each one, but the power companies would have gotten rid of much of the field force to do this long ago when they decided to save money on smart grid technology. That is a long-term grid down that I believe is quite plausible without being a tin-foil-hatter.
Now, to help shed light on the likelihood of this scenario, I have to always fall back on the people, as people are always the weakest link in security. While some organizations use things that filter some web traffic so their employees aren't surfing porn all day - there are plenty of ways to get your machines compromised from perfectly legitimate sites, as recent news has shown with sites like NYTimes and such. I don't think it is too far of a stretch for the imagination to suspect that a power company employee might happen to be permitted to visit and would want to visit a site to catch up on news now and then. Or, perhaps around Christmas folks start opening e-mail attachments claiming to be some FedEx shipping notification about a shipment that someone might just think that they have a package they missed. It is easy for these people to get attacked en masse, and even easier for these folks to get compromised when targeted, such as if I look up some background information on LinkedIn and find out who reports to who, what organizations folks affiliate with, etc. and then craft a targeted e-mail to those individuals in the hopes that one might happen to think "Gee! I haven't heard anything from that person in a long time, I wonder what this is about..." Another, possibly more relevant example would be, and I apologize to Jack for using this example, to think about what percentage of folks on this forum would open up an attachment that is spoofed to look like it came from Jack with a special discount on silver/seeds/ammo/batteries... That targeted attack is an example of the term "Spearphishing" for those not familiar with it, and has been and continues to be a very effective means of gaining access to an organization.
So, on the likelihood of a grid down scenario due to cyber-espionage... I think it is and already has been in development. The bad guys are tuned in to the status quo operation of organizations so much to the point where they are executing much more clever stuff like "supply chain attacks" - where some little piece of equipment or code to allow covert access to a device over the internet is being placed in devices as they are being manufactured, and these devices are sold with them built-in. Or another example (look up Barclay's bank) where someone dressed up like an IT guy comes in with a piece of equipment that they hook up to a bank's system and have remote control. I believe that there was a big concern with a supply chain example when someone like Cisco or some big networking company was purchasing another and they were worried about Huwaei's equipment (which had backdoors coded into them) were going to be acquired through the merger. I'd have to look that up so please forgive any inaccuracies as all of this is coming off the top of my head. The same could be true for the smart meters, but even if it isn't a supply chain attack, I believe that the examples given above will show plausible scenarios that can easily demonstrate how the bad guys *could* get into a power company and the capability to execute the attacks I've described above. Also consider the fact that this could also happen to a pressurized LP gas line somewhere, where someone could shut that one valve down, or even just start hitting switches to see what happens. There was a case where a computer operator made an error and accidentally spun up one of the turbines of a hydroelectric dam that was not operational yet. If I recall correctly, the turbine spun up, lifted into the air a good distance, and came down on the others, destroying some of the other turbines. That was just an accident, but there is nothing to say that someone with malicious intent and the ability to compromise an individual like that poor dude could not do at least the same, if not more, damage.