The first thing to understand is that a nuclear weapon does not generate the EMP. It is the interaction of the gamma ray flux from the explosion and the upper atmosphere:
A high-altitude nuclear detonation produces an immediate flux of gamma rays from the nuclear reactions within the device. These photons in turn produce high energy free electrons by Compton scattering at altitudes between (roughly) 20 and 40 km. These electrons are then trapped in the Earth’s magnetic field, giving rise to an oscillating electric current. This current is asymmetric in general and gives rise to a rapidly rising radiated electromagnetic field called an electromagnetic pulse (EMP). Because the electrons are trapped essentially simultaneously, a very large electromagnetic source radiates coherently.
The pulse can easily span continent-sized areas, and this radiation can affect systems on land, sea, and air. The first recorded EMP incident accompanied a high-altitude nuclear test over the South Pacific and resulted in power system failures as far away as Hawaii. A large device detonated at 400–500 km over Kansas would affect all of CONUS. The signal from such an event extends to the visual horizon as seen from the burst point.
The problem with the EMP is that it is very inefficient. More than half of the energy of the explosion goes into space in various directions. It is just the component of the gamma ray flux traveling down towards the earth that contributes to the EMP.
That means you need a pretty powerful device to pull it off. On the order of a megaton or so. Anything smaller and the EMP fizzles.
To generate a 1-megaton blast (equivalent to 2 billion pounds of TNT), you need a big bomb. The big boys use fusion devices, but your two-bit terrorist group is likely to only have fission bombs. Fusion bombs are powerful, but complicated.
A fission bomb, in comparison, is simple, but far less blast for the buck. One of the largest fission bombs ever built was Ivy King, exploded in 1952 by the US at Enewetak Atoll. It had a yield of 500 kilotons, half the size of what we think a continent-affecting EMP bomb would have to be.
So now the terrorists are going to go for half the continent, at best.
But that leads to another problem. Ivy King weighed in at 8600 pounds! It was not a deliverable weapon, but was placed on a tower prior to detonation.
To lift that sort of weight (assuming the terrorists could even build such a huge bomb, which required 60 kg of highly enriched uranium), you need a big missile. Remember, the bomb has to go some 500 kilometers into space.
Let's assume the terrorists get their hands on an Iraqi Scud. The original Scud-B in the Iraqi inventory had a range of 300km. Not good enough, even going straight up. The modified al-Husayn had a range of some 650km. That works.
But only straight up. If you want to affect the continental US, you need to explode your device 500 km over Kansas, which is 2000 km from the coast. That means a linear distance of over 2000 km from the launch point to the detonation point. But the missile is not traveling in a straight line. It is following a curved path, meaning the real distance of travel is probably closer to 3000 km, five times the range of the al-Husayn.
And that assumes the launch ship gets right up to the coast without being detected.
So forget about Kansas and affecting the whole US. Stay close to the coast, fire almost straight up, and do the EMP on New York or Washington. So half the EMP is wasted over the ocean. Still a frightening attack.
But you still have the problem of weight. Remember that Ivy King weighed 8600 pounds. The al-Husayn could carry 700 pounds, maximum. Now an EMP weapon doesn't need a re-entry vehicle, so just about all that 700 pounds can be bomb. Still, a 700-pound fission device is a firecracker for the purposes of an EMP attack.
So all in all, I'm not sure the US is really that vulnerable to an EMP. It is unlikely a terrorist group could pull off an EMP attack, even a limited one, with the material they likely have on hand. To get a proper missile, a proper launch system (I didn't even get into that), an efficient nuclear device, etc, etc, would need serious support from North Korea, the kind of support that is hard to hide. I'm not sure that the North Koreans would risk being linked to such an attack, given how deeply involved they would have to be for it to be successful.
And remember, as much havoc as an EMP would have on civilians systems, much of the military infrastructure is hardened against various nuclear-related effects. This is particularly true of the nuclear weapons command, communications and control infrastructure. An EMP over the CONUS would have no effect on the SSBMs prowling the oceans. A flash message from Washington to a boomer in the Pacific, and North Korea would be so much glowing dust.
The same reasoning argues against Iranian help in such an attack.
If the terrorists get a bomb, they'll blow it up in New York harbour. It's simple.