Recent substation vandalism added to rising number of attacks on Washington’s power grid

The number of confirmed or suspected attacks affecting the power grid in Washington state had reached a decade-high last year, even before four electrical substations in Pierce County were vandalized on Christmas Day.

There were a dozen such cases in the state reported to the Department of Energy through Aug. 31, according to a McClatchy analysis of the most recently available data.

It was the most the state had seen in a year since 2012, when 23 confirmed or suspected attacks were reported. There were 29 logged in 2011. The vast majority over that two-year period stemmed from Pierce County, the data showed.

Two suspected incidents of sabotage were reported to affect Whatcom County in March 2016.

Until last year, annual cases reported in Washington to the DOE lingered in single digits and climbed no higher than eight, which was reached in 2019 and repeated in two successive years, according to the data.

The rise in confirmed or suspected attacks in the state comes as incidents have increased across the nation amid warnings from federal authorities about threats to power grid security.

Experts interviewed for this story did not want to speculate on what could be behind the uptick, but attacks in Washington, Oregon and North Carolina in recent months have pushed grid security to the forefront of the news cycle.

“I think every one of those incidents is a wake-up call,” said Daniel Kirschen, a University of Washington professor in the Department of Electrical & Computer Engineering.

The DOE collects data from the power industry, including utilities, which must submit an Electric Emergency Incident and Disturbance Report following instances of a physical or cyber attack, suspicious activity or other events to its systems, including those related to weather or malfunctions.

McClatchy reviewed annual reports over the past decade-plus and homed in on event types categorized as “vandalism,” “actual physical attack,” “suspected physical attack,” “suspicious activity” and “sabotage,” among others that indicated human involvement.

The data through eight months of 2022 in Washington showed nine instances of a physical attack or vandalism, two instances of suspicious activity and a “cyber event.”

In three instances, a reported activity spanned multiple western states, including a July 5 physical attack affecting Pierce County. The data indicated that the matter was quickly resolved and no customers were affected.

Hard to keep safe

There were 108 confirmed or suspected attacks logged across the United States last year through Aug. 31, the most for any single year since 123 were reported in 2011, according to the data.

Kirschen, whose expertise includes power system security and the electricity grid, said the massive breadth of the interconnected system across the nation made it difficult to protect. The grid maintains roughly 7,000 power plants, millions of miles of power lines and distribution transformers, and 55,000 transmission substations, according to 2016 and 2017 federal data.

“You can’t build enormous walls around all of those substations,” Kirschen said. “So it’s not an easy problem (to solve).”

Federal data shows that Washington is among states particularly at risk for malicious activities to the grid. More confirmed or suspected attacks have been reported in the western United States than anywhere else in the nation since 2011.

Again, experts were unsure of why.

The Western Electricity Coordinating Council, one of six major regional entities of the nonprofit North American Electric Reliability Corporation, has seen 443 of 952, or 46%, of total reported cases between 2011 and August, according to The News Tribune’s analysis. The WECC region includes Washington, 10 other western states and western Canada.

“I think the threats are continuing to evolve, but we do have robust plans in place for each of those types of events that enable utilities more often than not to respond quickly and effectively,” said Adrienne Lotto, the senior vice president of Grid Security, Technical & Operations Services for the American Public Power Association.

Lotto added that oftentimes, there is no effect on utility customers.

“I think that’s important to note,” she said. “But I also think it’s equally important to note that the utilities do take it seriously.”

Increased security measures

After the attacks in Pierce County, the two targeted companies — Tacoma Public Utilities and Puget Sound Energy — assured that security was of utmost importance. TPU spokesperson Rebekah Anderson said the company had increased security measures amid warnings from federal authorities and, again, following the vandalism at its two substations.

The American Public Power Association, which represents about 1,400 public power utilities, including TPU, pushed out a version of its physical security guide to members last year and will send an updated copy later in 2023, according to Lotto. She said the industry is collaborative on sharing resources to fight risks.

Meanwhile, the Federal Energy Regulatory Commission, an independent agency that regulates electric transmission in the United States, has directed the North American Electric Reliability Corporation to review the current physical security requirements for the grid in the wake of recent attacks, Lotto said.

Michael Mabee is an Army veteran whose research on electric grid disturbances and DOE data since 2011 has been cited on NPR, CBS News and 60 Minutes. Mabee cautioned that the DOE’s data was poorly kept and deficient in updating incident impacts to customers, thus making it difficult to analyze.

He questioned whether there would be any progress in better safeguarding the grid.

“This physical security problem, we’ve known about it for decades,” he said. “We’ve failed to fix it.”

Mabee said the surest path forward was pressuring Congress to ensure that physical security requirements were not lacking for the majority of grid assets, which he claimed was currently the case.

Desperation or an act of terrorism?

The Associated Press reported on a Department of Homeland Security bulletin issued a year ago that warned of domestic terrorists with “a range of ideologies” threatening to attack the grid since at least 2020. Federal authorities also cautioned that extremist groups who seek to engage in mass violence to collapse society could be targeting the grid. The AP noted that white supremacist and anti-government groups have been linked to plotting attacks.

On Jan. 3, the Department of Justice announced that two Puyallup men were arrested for allegedly vandalizing the Pierce County substations, following a “fast-moving investigation by the FBI.” The vandalism caused at least $3 million in damages, authorities said. The two targeted utility companies said the incidents damaged equipment and knocked out power for roughly 30,000 customers, including in Graham and Elk Plain.

Matthew Greenwood, 32, and Jeremy Crahan, 40, were charged with conspiracy to damage energy facilities and possession of an unregistered firearm, according to the DOJ. An unsealed criminal complaint revealed that one suspect reportedly told authorities that the attacks were intended to aid a burglary at a nearby business.

Greenwood and Crahan allegedly broke into a local business affected by the subsequent outage and stole from the cash register, the charging document shows. On Friday, Greenwood’s girlfriend told The News Tribune that the couple were “desperate to get on our feet” and care for their baby.

Assistant U.S. attorney Stephen Hobbs had described the men’s alleged actions as “a crime of terrorism.”

For Mabee, the attack illustrated the susceptibility of the power infrastructure, regardless of the perpetrator’s motives.

“It takes relatively no sophistication to do a coordinated attack against the U.S. electric system,” he said.

Vandalism often cited, but outages rare

Since 2011, there have been at least 112 confirmed or suspected attacks affecting the power grid in Washington, according to federal data, excluding activity during the last four months of 2022. In the majority of instances, there was no reported effect on customers or the impact was unknown.

At least 57 of those incidents have hit Pierce County — a figure buoyed by the large number of cases in 2011 and 2012, federal data showed. Since then, the county has been affected by nine incidents through Aug. 31, including the one in July.

That figure could be higher because the data in some instances associates an incident with “Washington” but does not specify the affected area within the state.

The federal data does not include the vandalism at four substations last month.

Those attacks on Christmas Day, if grouped together, interrupted power for more customers in the state than any other reported attack since at least 2011 in instances where the impact was reported, according to federal data.

“We have seen attacks such as these increase in Western Washington and throughout the country and must treat each incident seriously,” U.S. Attorney Nick Brown said in a statement Jan. 3.

Reported power disruptions from vandalism and theft are uncommon in the state. There were eight such incidents in Washington between 2008 and 2017 that resulted in a power outage, according to a state energy sector risk profile produced by the DOE in 2021.

But vandalism to the power grid has been the most frequently reported type of confirmed or suspected attack affecting the power grid in Washington since 2011.

There have been at least 67 vandalism incidents in the state over the last decade-plus, as well as 24 suspected physical attacks that were unspecified and nine reports of suspicious activity, the data showed. Only two incidents were described as related to cybersecurity.

TPU suffered two other incidents of vandalism last year, according to spokesperson Jessica Wilson. Both were after Aug. 31, and thus would not yet be included in federal data. One instance occurred in the Elk Plain area on Oct. 3 and another in South Tacoma on Nov. 29, according to Wilson.

The utility also saw dozens of unplanned outages attributed to human involvement in 2022 that it did not classify as intentional or unintentional, she said.

They included 61 car crashes that involved a power line, seven cases of tree branches falling on lines, six cases of balloons being caught in lines, two cases of people digging into buried lines, and 14 incidents that covered “other” events, such as brush fires or human error.

Wilson did not have any details on whether any of those incidents led to investigations into potential criminal activity and she deferred to law enforcement.

The federal data also does not provide information about the potential criminal aspects of incidents reported to the DOE, including whether they resulted in arrests or charges. But to experts, each one is alarming.

“If these attacks multiply,” Kirschen said, “this could be really terrible.”