Dive Brief:

• About 40,000 Duke Energy customers remained without power Sunday after at least two substations in Moore County, North Carolina, sustained damage attributed to firearms attacks on Saturday night. 
• State investigators and the Federal Bureau of Investigation have been called in, U.S. Rep. Richard Hudson, R, who represents Moore County, said in a Sunday statement.
• Substation vandalism, including by gunshot, is a common occurrence, say security experts. The fact that a widespread outage occurred indicates it was “a planned, targeted attack involving multiple substations,” Kevin Perry, former director of critical infrastructure protection at Southwest Power Pool, said in an email. Perry retired in 2018.

Dive Insight:

Saturday’s North Carolina substation attack is reminiscent of an attack in 2013, when gunmen fired on Pacific Gas & Electric Co.’s Metcalf substation in California. There is at least one major difference, however.

“There was no outage with the Metcalf incident because there was sufficient redundancy with other substations in the area to allow the failed substation to be bypassed,” Perry said. “In last night’s incident, sufficient equipment was damaged in multiple substations to eliminate the redundancy and result in a regional outage that may take several days to recover from.”

No one was arrested in the Metcalf attack, which caused $15 million in damage.

“Sabotage happens all the time at substations, since they're usually in isolated areas and don't have guards; but it doesn't usually cause an outage, and certainly not a widespread one,” security consultant Tom Alrich said in an email. “Unfortunately, it's very hard to stop some yahoo who gets drunk and goes out to shoot up a substation.”

Motive for the attack “remains unknown,” Hudson said.

Online, there has been speculation that the attack was related to opposition to a local drag show. 

Duke Energy did not immediately respond to requests for comment.

The Edison Electric Institute, which represents investor-owned utilities, said the trade group is “closely following this incident given the impact to customers and to electric infrastructure.”

“A coordinated response from industry and government partners and federal and state law enforcement officials is underway,” said Scott Aaronson, EEI’s senior vice president for security and preparedness.

The North American Electric Reliability Corp. has critical infrastructure protection rules, or CIP, in place meant to secure physical infrastructure, but it is not clear that the substations that were attacked fall under those rules, said Alrich.

“CIP-014 was supposed to guard against organized attacks on certain critical substations, but there's no indication at the moment that this was organized, or that this was one of the critical substations,” he said.

Experts say utilities can take some steps to secure remote infrastructure, but the problem is pernicious.

“What can be done?  Without significant funding, not much,” said Perry. 

Line of sight was a “key enabler” in the Metcalf incident, he said.

“The attackers shot the transformers they could readily see and target,” he said. “If you can disrupt line of sight, perhaps by incorporating obscuring materials into the perimeter fencing, you can reduce the risk of catastrophic damage to the substation equipment.”

A downside to installing barriers, however, ”is that you disrupt airflow, which becomes a problem itself,” Perry said. “Additionally, work with local law enforcement to increase random patrols in the area if possible. Transmission substations are not generally built in high population density areas, so county sheriff’s patrols would often be the first responders.

Utilities should also consider deploying live video monitoring at substations, according to Ross Johnson, a Vancouver-based consultant who was part of the NERC committee that drafted CIP-014.

“Advances in image processing and computer networks have made LVM much more economical than in the past,” he said.

In addition, he said, utilities must ensure security measures at substations are functioning, and all utility workers “should be watching for indications of surveillance near substations,” including people loitering, taking photographs, questioning employees or sitting in vehicles “positioned to be able to watch the main gate or critical equipment.”

“Consider deploying mobile patrols to visit substations on an aggressive and random schedule,” he added.