Substation attack is new evidence of grid vulnerability

By Peter Behr | 10/06/2016 08:00 AM EDT

With just a few shots from a high-powered rifle, an unknown gunman knocked out an electric power substation in rural south-central Utah last month, cutting off electricity to 13,000 customers for a day and forcing the utility to wait at least six months until the station’s disabled transformer is repaired or replaced.

The midday attack on Sept. 25 hit the Garkane Energy Cooperative Inc.’s Buckskin substation between Kanab, Utah, and Page, Ariz., serving communities near the Grand Staircase-Escalante National Monument. The gunshots penetrated the oil-cooled radiator unit for the transformer, which then overheated and failed.

Neal Brown, Garkane’s member service and marketing manager, said restoring the transformer will cost up to $1 million. In the meantime, the utility will depend on a portable backup transformer the utility had on hand for emergencies. The company has offered a $50,000 reward for information leading to the attacker’s arrest.


Brown said the company had not been informed of any leads from the investigation. The shooter appeared to be deliberately trying to disable the substation, firing several times from different locations to knock out the transformer cooling system, Brown said.

The substation’s vulnerability, and the long lead time to replace the transformer, is a new demonstration of the susceptibility of power substations, dramatized in the April 2013 attack on Pacific Gas and Electric Co.’s Metcalf substation near San Jose, Calif. (EnergyWire, Feb. 16).

Following the attack, Federal Energy Regulatory Commission officials undertook a confidential analysis of a potential organized terrorist attack on the grid, and when the threat got renewed attention early in 2014, FERC called for new physical security protections for critical nodes of the interstate high-voltage power network. The FERC infrastructure protection regulation, CIP-014, was approved November 2014.

"While the shooting centers on a distribution substation, this event highlights the fact that electric infrastructure continues to be vulnerable to firearms attack," said Brian Harrell, a director in Navigant’s energy practice and former director of the cyberthreat-sharing portal at the North American Electric Reliability Corp.

"Even now, years removed from the PG&E Metcalf shooting, we continue to see minimal physical security mitigations being implemented at substations," he added. "In all likelihood, the utility would have not have been aware of the sabotage had the transformer not failed first. Few substations, outside of those subject to CIP-014 compliance, have cameras, intrusion detection, or robust perimeter security. Situational awareness at most transmission and distribution substations is severely lacking.

"We must assume that at some point in the future a North American utility will suffer from a planned and coordinated attack against electrical infrastructure," he said. "As an industry, we will be judged, and hard questions will be asked about how serious we considered the threats to be and what we did to mitigate future attacks."

A National Academy of Sciences panel spelled out the threat to exposed grid substations in a 2007 report, most of which was classified until 2012.

After several failed attempts to address the issue, Congress tacked on an energy amendment to the Fixing America’s Surface Transportation (FAST) Act funding bill at the end of last year, directing the Department of Energy to submit to Congress a plan for creating a strategic stockpile of spare transformers and mobile substations. This emergency equipment could temporarily restore power service on critical segments of the high-voltage grid after a terrorist attack or natural disaster. The plan is due by the end of this year.