Karl B De Blaker/AP
NORTH CAROLINA — When Moore County, North Carolina suddenly turned dark last Saturday night, Mayor Carol Haney was puzzled. There had been no thunderstorm, no warning, just darkness on what had been a festive holiday evening. It turns out that a shootout at two electrical substations cut tens of thousands of people off the power grid for much of the week.
“This beautiful part of the world is being sabotaged,” Haney said. “So it could happen to anyone. And that’s probably the scariest thing for everyone – that it could happen to anyone.”
It could. In the United States, some 55,000 electrical substations are currently in operation, mostly transforming high voltage from main power lines to lower voltages for homes and businesses. Many of them are sitting ducks for saboteurs.
“The power grid is America’s Achilles’ heel,” says Mike Mabee, a self-described “grid security gadfly” who pours over power company data to highlight vulnerabilities.
Like many, he worries about Russian or Chinese cyberattacks, but Mabee says the easiest way to hurt Americans is through something much less exotic, by shooting at substations with widely available assault rifles.
“If a terrorist organization, whether domestic or foreign, wants to visit damage to the United States power grid, the easiest way to do so is with a physical attack,” Mabee said.
None of this escapes national extremist groups or the government. The Department of Homeland Security issued a law enforcement bulletin in January warning that domestic terrorists had developed “credible and specific plans to attack electrical infrastructure” and viewed the power grid as a “particularly attractive target.”
Substations are easy targets because their main components, huge voltage transformers, cool with circulating oil. High powered rifle cartridges can easily puncture transformers, spring leaks, cause them to overheat and shut down. The largest transformers are about the size of railroad cars. Mr. Granger Morgan, a professor at Carnegie Mellon University, says they are not easy to replace.
“We don’t make a lot of them in this country, and there are long delays in getting new ones,” says Morgan.
Arrears can stretch for up to 18 months, with prizes running into the millions of dollars. And the cost of replacing equipment pales in comparison to the potential cost of a network failure.
In 2013, gunmen attacked a substation just outside San Jose, California. Initial media reports called it vandalism, but Jon Wellinghoff, chairman of the Federal Energy Regulatory Commission at the time, immediately recognized it as something more sinister.
“So I took a team there the very next day to investigate,” says Wellinghoff. “We actually found shooting positions that they had marked on the ground. Two shooters, maybe more. We don’t know how many people were actually in the team that performed this action. But it was extremely sophisticated.”
Saboteurs cut fiber optic lines to the substation pumped over 100 shots through a chain-link fence protecting the substation. They hit vulnerable parts of the transformers and fled seconds before police arrived. The bullet holes drained more than 50,000 gallons of coolant oil and destroyed 17 of the 21 transformers. Wellinghoff says the attackers nearly took Silicon Valley off the network, in an outage he says could have lasted several weeks.
It was a breathtaking attack. Wellinghoff thought that would force a reckoning on how the government regulates network security. Currently, no agency has this authority because the tasks are shared between federal and state regulators.
“We need someone in charge, and it’s up to Congress to put someone in charge. We went to Congress and asked for additional authority, but we didn’t get it,” Wellinghoff says. “Industry writes the standards, and then they are submitted for approval. And that’s what happened here.”
So about 3,000 power companies and cooperatives across the United States decided for themselves which substations needed protection and what additional security was warranted. They’ve built concrete walls around some substations to stop bullets, but Wellinghoff says the security upgrades haven’t reached many of them.
“And looking at them, most of them don’t look very well protected,” says Wellinghoff. “A lot of them still have chain-link fences, like the one in North Carolina.”
These individual vulnerabilities add up to a huge problem. Wellinghoff says a series of precisely targeted substation attacks could trigger a cascade of blackouts, destroying most of the US power grid.
Power companies say they have the situation under control. A spokesperson for Duke Energy, the company that owns the attacked substations in North Carolina, said the company is constantly working to improve security and address new threats. He says the entire industry will learn from the North Carolina attacks.
The FBI is investigating alongside state and local authorities. They collected dozens of used casings from the site. State police are reportedly asking for search warrants, while the FBI is asking for cellphone records.
The attacks follow one another. On Wednesday, snipers targeted another Duke substation, this one in South Carolina, without triggering a blackout.
In the meantime, some of the people who know America’s power grid best are taking concrete steps to be able to live without it. Both Jon Wellinghoff and Mike Mabee have had solar panels, batteries and generators installed in their homes.