Carbon-system risks: what must be protected?

1. The problem this lesson solves

Unit 2 treated carbon numbers as decisions and evidence chains. Unit 3 asks what happens when that chain is a cyber-physical asset: meters, PLCs, historians, factor libraries and cloud platforms can fail — or be changed — without a safety trip. The industrial question is blunt: what must be protected so a carbon claim remains explainable, reproducible and defensible?

Four states must not be collapsed. Operational means the process still runs. Safe means known safety constraints appear satisfied. Compliant means applicable limits appear satisfied. Assurable means evidence can reconstruct and test the result. A plant can be operational and even safe while a reduction claim is no longer assurable.

2. A carbon claim is an evidence claim

GHG Protocol practice and ISO 14064-1 treat inventory quality, methods and transparency as part of the claim. Digital MRV literature repeats the same lesson for software-heavy systems: credibility is end-to-end design, not a dashboard skin. Cybersecurity enters because integrity, authenticity, provenance and authorization failures can produce a fluent but indefensible number.

The correct investigative stance is differential diagnosis. You should not begin by assuming attack or benign error. You should ask what changed, when, under whose authority, which results depended on it, whether evidence was preserved, and which independent observations can discriminate among explanations.

3. Architecture of the carbon evidence chain

Physical activity becomes a digital assertion through measurement, OT acquisition, systems of record, carbon transformation, reported results and assurance decisions. Each layer has different failure modes. Accounting, engineering, trust and temporal boundaries rarely line up: a source can sit inside the accounting boundary while the cloud provider, supplier or maintenance contractor handling the data sits outside direct control.

NIST SP 800-82 Rev. 3 is the OT security baseline for this architecture. Turkish energy-sector plants also sit under competence and critical-infrastructure expectations framed by EPDK materials — cybersecurity of measurement and control is not optional décor around a sustainability slide.

4. Measurement and OT integrity

A secure database can faithfully preserve a false reading. NIST greenhouse-gas metrology and industrial measurement practice insist on calibration, reference standards and stated uncertainty. Teaching model: recorded value ≈ measurand + systematic + random + processing + unauthorized effects. The last term covers configuration, firmware, signal injection, communication, aggregation or record alteration.

Familiar failure families include calibration drift, scaling errors, time misalignment, saturation, dropout, unlabelled substitution and unauthorized configuration. Subtle attacks need not create impossible signals: small gain changes, selected reporting windows, denominator manipulation or preserved correlations among adjacent tags can all understate emissions while looking “normal.” Detection therefore combines cybersecurity telemetry with process and accounting invariants — mass/energy balances, state consistency, rate constraints, production–energy relations, invoice–meter reconciliation and golden-configuration comparison.

Signal path risk runs sensor → transmitter → I/O → PLC → SCADA → historian → aggregation → carbon field. CISA ICS guidance and industrial ransomware/integrity cases underline that OT compromise is a measurement-integrity problem as much as an availability problem. NIST data-integrity practice guides (SP 1800-25/26) show how integrity events destroy trust even when backups exist — if recovery restores already-manipulated state.

5. Historians, databases and lineage

A numeric value without context is weak evidence. Material carbon records should preserve source identity, timestamp, timezone, unit, quality state, acquisition path, transformation, configuration version, substitution status, actor and approval. States matter: raw, validated, adjusted and reported each need different evidence.

Integrity architecture inventories assets and interfaces; uses named identities and least privilege; logs material writes and configuration; protects raw data and audit logs from casual admin alteration; monitors unexpected change; maintains tested backups and golden configurations; preserves chain of custody; and reconciles recovered values against independent evidence before reuse. Threats include silent record updates, ETL rule changes that drop quality flags, API remapping, ransomware, insider baseline edits, compromised update channels and backup contamination.

Turkish OT-security product narratives in the energy press — for example coverage around Senkron Digital’s CyberPact-style offerings — are useful as examples of market attention, not endorsements: the teaching point is that plants are buying monitoring and SOC services because historian and control integrity are now board topics.

6. Calculation and model risk

Simplified emissions E = A × EF × CF and intensity CI = E / P make the attack surface obvious. Activity data, emission factors, boundaries, baselines, allocation, denominators, GWP bases, code/formulas and estimate rules can each misstate results. Factor libraries need source, geography, technology, validity period, unit chain, GHG coverage, approval, version and tests. Spreadsheets and code need protected formulas with reviewability, separated layers, version control, independent review, regression tests and reproducible input snapshots.

7. Threat model for carbon systems

Security objectives map to carbon questions: integrity of values and methods; availability of measurement and evidence; authenticity of users, devices and suppliers; provenance; authorization; confidentiality of production data; non-repudiation of approvals; and safety/environment side effects. Adversaries include external attackers, insiders under incentive pressure, supplier compromise, contractor-account abuse, fraudulent data providers and non-malicious operators.

Attack trees that aim to overstate reduction include understating current emissions, overstating output, inflating base years, excluding sources, replacing factors, altering allocation, suppressing missing-data flags or forging approval. A teaching heuristic for priority is material carbon impact × dependency concentration × detection difficulty × recovery difficulty — not a formal standard, but a prompt IT scoring often underweights.

8. Assurance engineering

An assurance case connects a claim to structured evidence: “June Scope 1 is materially correct” needs subclaims on source completeness, meter fitness, configuration integrity, data completeness, approved factors, correct calculation and authorized review. Evidence classes span physical/measurement, configuration, operational, cybersecurity, data quality, method, governance and recovery. A signed PDF may prove document approval without proving meter correctness; a correct meter may not support a corporate claim with an incomplete boundary.

A claim should be suspended or qualified when a material source cannot be traced, a material parameter changed without authorization evidence, periods or units cannot be reconciled, raw data or quality flags are missing, the calculation cannot be reproduced, independent evidence contradicts the result, or the affected period cannot be bounded.

9. Applied case: LumaWorks investigation

LumaWorks Materials plans to disclose a 14 percent reduction in product carbon intensity. Two days before verification, the gas invoice is about 9 percent higher than the plant dashboard. A contractor identity accessed the historian outside the maintenance window. Two meter-scaling parameters changed. Production continued. No safety alarm fired.

Evidence pack sketch: dashboard gas 900,000 m³ versus invoice 990,000 m³; mismatched reporting periods; unexplained scaling changes; denied authorship; Saturday-night contractor authentication; stale protected historian backup; unchanged accepted production; no process alarm. Competing hypotheses range from benign period misalignment to adversarial scaling. Discriminating evidence includes daily invoice basis, raw pulse counts, work orders, MFA/session logs and configuration timelines.

Recommended posture. The affected claim should be suspended pending investigation. The discrepancy alone does not prove an attack, but unexplained configuration changes, weak identity attribution and incomplete reconciliation remove the present basis for confident assurance. You should preserve the distinction between “claim not currently defensible” and “claim proven false.”

10. References

• NIST. (2023). SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
• NIST NCCoE. SP 1800-25 / 1800-26 data-integrity practice guides. https://www.nccoe.nist.gov/
• NIST. Greenhouse Gas Measurements Program. https://www.nist.gov/greenhouse-gas-measurements
• GHG Protocol. Corporate Standard and related guidance. https://ghgprotocol.org/
• ISO. (2018). ISO 14064-1:2018 Greenhouse gases — Part 1. https://www.iso.org/standard/66453.html
• World Bank materials on digital MRV / climate data systems. https://www.worldbank.org/en/topic/climatechange
• CISA. Industrial control systems topics and advisories. https://www.cisa.gov/topics/industrial-control-systems
• EPDK. Energy-sector cybersecurity resources. https://www.epdk.gov.tr/