Substation attacks on the rise, but NERC advises against security rules

May 15, 2023
NERC instead endorsed continuing to allow utility providers to set physical security measures using “a risk-based approach.”

RALEIGH, N.C. — In December, shortly after gunfire disabled two electrical substations in Moore County, triggering multiday power outages for roughly 42,000 residents, the Federal Energy Regulatory Commission ordered an expansive examination of U.S. electric grid security.

The report is out and despite acknowledging concerns over the rise of grid attacks, the North American Electric Reliability Corporation, or NERC, recommended the federal government not set baseline physical security requirements at substations like the ones attacked in North Carolina.

“That does not mean that we are insensitive to the vulnerabilities inherent in the sprawling above ground design of the electric grid,” NERC President and CEO Jim Robb told FERC commissioners during an April 20 meeting.

NERC instead endorsed continuing to allow utility providers to set physical security measures using “a risk-based approach.”

“Physical security hardening of substations can be quite expensive,” Robb said, noting camera installations alone can cost hundreds of thousands of dollars. “So, it is important the risk abated is commensurate with the capital needed.”

NERC sets standards for the United States’ bulk electric systems, which FERC and state agencies like the North Carolina Utilities Commission follow. The organization does have physical and cybersecurity requirements for power plants and transmission lines, which if hindered could cause widespread instability to the power grid. But it does not regulate distribution substations.

There are approximately 55,000 substations across the country, many positioned on street corners and visible behind chain link fences. They are key cogs in the overall electrical grid, reducing voltage on power from transmission lines to a level suitable for home use.

Charlotte-based Duke Energy, the predominant utility provider in North Carolina, owns around 2,100 substations statewide.

Robb said utility providers can “invest in additional protections designed to mitigate the local impact of physical attacks, if deemed warranted.”

Substation attacks on rise

Near the end of his remarks, Robb acknowledged electrical grid security needs to be further evaluated in light of recent sabotage attacks.

In 2022, NERC received close to 1,700 physical security incidents on the overall grid, a 10.5% increase from the previous year. Physical attacks, Robb said, included “vandalism, tampering, arson, and ballistic damage.”

In November, six substations were attacked across Oregon and Washington state. The same month, a substation in Jones County, North Carolina, was briefly disabled.

Then on Dec. 3, transformer radiators and their circuit breakers at a pair of substations in Moore County were shot at and dismantled. The incident forced five unaffected substations to be powered down, Robb said, leaving tens of thousands without power for four days in the area about 60 miles southwest of Raleigh.

No arrests have been made in connection to the Moore shootings.

“These recent high-profile events are deeply concerning for their sophistication and effectiveness, even while noting that customer impacts were localized,” Robb said.

The grid attacks did not end in Moore County. In January, officials said gunshots were fired at a Randolph County substation, which did not result in outages. And in February, law enforcement arrested two people with ties to far-right extremist groups for allegedly conspiring to shut down five substations in Baltimore.

“These are sobering times indeed,” Robb told the FERC commissioners.

Next steps

FERC will next hold a technical conference with NERC and other industry experts to weigh implementing any physical safety rules.

“I think it is a good start,” FERC Chairman Willie Phillips said following Robb’s remarks. “We have talked about this issue of physical security many times. There is no greater priority for me and for this commission than making sure we protect the security of our electric grid.”

The North Carolina Utilities Commission, which oversees public utilities in the state, can also set physical security standards for substations. It currently does not enforce any. Through a spokesperson, the state commission declined to comment on any potential future policy changes.

———

(This story was produced with financial support from a coalition of partners led by Innovate Raleigh as part of an independent journalism fellowship program. The News & Observer maintains full editorial control of the work.)

———

©2023 The News & Observer. Visit at newsobserver.com. Distributed at Tribune Content Agency, LLC.