News is just now leaking out about something that happened in the Silicon Valley area of California near a year ago that is raising real fears about potential terrorist threats to a critical part of the nation’s infrastructure, it’s electrical grid:
SAN JOSE, Calif.—The attack began just before 1 a.m. on April 16 last year, when someone slipped into an underground vault not far from a busy freeway and cut telephone cables.
Within half an hour, snipers opened fire on a nearby electrical substation. Shooting for 19 minutes, they surgically knocked out 17 giant transformers that funnel power to Silicon Valley. A minute before a police car arrived, the shooters disappeared into the night.
To avoid a blackout, electric-grid officials rerouted power around the site and asked power plants in Silicon Valley to produce more electricity. But it took utility workers 27 days to make repairs and bring the substation back to life.
Nobody has been arrested or charged in the attack at PG&E Corp.’s Metcalf transmission substation. It is an incident of which few Americans are aware. But one former federal regulator is calling it a terrorist act that, if it were widely replicated across the country, could take down the U.S. electric grid and black out much of the country.
The attack was “the most significant incident of domestic terrorism involving the grid that has ever occurred” in the U.S., said Jon Wellinghoff, who was chairman of the Federal Energy Regulatory Commission at the time.
(…)
The Federal Bureau of Investigation doesn’t think a terrorist organization caused the Metcalf attack, said a spokesman for the FBI in San Francisco. Investigators are “continuing to sift through the evidence,” he said.
Some people in the utility industry share Mr. Wellinghoff’s concerns, including a former official at PG&E, Metcalf’s owner, who told an industry gathering in November he feared the incident could have been a dress rehearsal for a larger event.
“This wasn’t an incident where Billy-Bob and Joe decided, after a few brewskis, to come in and shoot up a substation,” Mark Johnson, retired vice president of transmission for PG&E, told the utility security conference, according to a video of his presentation. “This was an event that was well thought out, well planned and they targeted certain components.” When reached, Mr. Johnson declined to comment further.
A spokesman for PG&E said the company takes all incidents seriously but declined to discuss the Metcalf event in detail for fear of giving information to potential copycats. “We won’t speculate about the motives” of the attackers, added the spokesman, Brian Swanson. He said PG&E has increased security measures.
Whatever the motives might have been, the chronology of the attack gathered by The Wall Street Journal seems to indicate that it was a well-planned operation:
At 12:58 a.m., AT&T fiber-optic telecommunications cables were cut—in a way that made them hard to repair—in an underground vault near the substation, not far from U.S. Highway 101 just outside south San Jose. It would have taken more than one person to lift the metal vault cover, said people who visited the site.
Nine minutes later, some customers of Level 3 Communications, an Internet service provider, lost service. Cables in its vault near the Metcalf substation were also cut.
At 1:31 a.m., a surveillance camera pointed along a chain-link fence around the substation recorded a streak of light that investigators from the Santa Clara County Sheriff’s office think was a signal from a waved flashlight. It was followed by the muzzle flash of rifles and sparks from bullets hitting the fence.
The substation’s cameras weren’t aimed outside its perimeter, where the attackers were. They shooters appear to have aimed at the transformers’ oil-filled cooling systems. These began to bleed oil, but didn’t explode, as the transformers probably would have done if hit in other areas.
About six minutes after the shooting started, PG&E confirms, it got an alarm from motion sensors at the substation, possibly from bullets grazing the fence, which is shown on video.
Four minutes later, at 1:41 a.m., the sheriff’s department received a 911 call about gunfire, sent by an engineer at a nearby power plant that still had phone service.
Riddled with bullet holes, the transformers leaked 52,000 gallons of oil, then overheated. The first bank of them crashed at 1:45 a.m., at which time PG&E’s control center about 90 miles north received an equipment-failure alarm.
Five minutes later, another apparent flashlight signal, caught on film, marked the end of the attack. More than 100 shell casings of the sort ejected by AK-47s were later found at the site.
At 1:51 a.m., law-enforcement officers arrived, but found everything quiet. Unable to get past the locked fence and seeing nothing suspicious, they left.
There is, of course, no evidence to indicate that this attack was connected to either domestic or international terrorism of any kind, but the nature of the attack as described in the chronologies that have come out suggests that it was far more than, as one person quoted above put it, just a couple of drunk guys who went out one night and decided to fire guns at a substation for kicks. Whoever carried this out seems to have some knowledge of exactly what they were doing, including what steps would be necessary to cause at least some level of disruption to the power and communications grids. This could indicate terrorism of some kind, but of course it could also indicate that the attack was carried out by someone who had inside knowledge about the substation and a grievance against PG&E, perhaps a former employee. The fact that the police apparently have no leads at all, though, including apparently not even being able to find partial fingerprints on shell casings, indicates that whoever carried out the attack did so with sufficient pre-planning to prevent easy discovery. That suggests professionalism of some kind, at least to my admittedly amateur guess work. The one mystery, though, is the apparent lack of any claim of responsibility or follow-up attack. Right now, all we know is that sometime about ten months ago a group of people carried out this attack and were able to sneak away without being discovered, and the mystery itself is arguably a cause for concern.
In the end, this one attack at one electrical substation caused only minor disruptions to the electrical grid. In large part that’s because this is one of many substations and PG&E was able to divert resources to non-affected parts of its grid so that there was no disruption to electrical service. What if that April attack was just a dress rehearsal of some kind, though? We really don’t know, and until the mystery is solved it strikes me that we ought be thinking about the vulnerability of the electrical grid a lot more than we are right now.
