News

Aug 29, 2023

FBI warns of neo

Transmission towers near Eagle Creek, Jan. 5, 2023. Plots by white supremacists

Transmission towers near Eagle Creek, Jan. 5, 2023. Plots by white supremacists to target electrical infrastructure in the U.S. have increased dramatically since 2016, according to a report published by the Program on Extremism.

Kristyna Wentz-Graff / OPB

A white pickup truck with a rack of roof lights blazing pulled up to an electrical substation in the small town of Morton, Washington, about 70 miles south of Seattle on June 16. In the predawn dark next to the city cemetery, a man in a dark hoodie and baseball cap hopped out of the truck. He broke a steel gate apart, likely with a crowbar later found at the scene, and walked inside the fenced facility on his way to sabotage its high-voltage transformers.

Electrical substations transform high-voltage electricity to the lower voltages that keep America's lights on, its food cold, its medical devices operating and its phones charged. Far-flung substations can be difficult to secure. Damaging even a single one can shut off critical services to thousands of people.

Attacks like the one in Morton are on the rise in the Northwest – there have been 15 since June, more than in the previous six years combined. The recent attacks make this region a hotspot for such activity, according to a joint investigation by Oregon Public Broadcasting and KUOW. In most cases, the motives aren't known. But as the FBI and extremism researchers have noted, neo-Nazis have been calling for just such attacks.

Related: Feds order review of power-grid security after attacks

"The individuals of concern believe that an attack on electrical infrastructure will contribute to their ideological goal of causing societal collapse and a subsequent race war in the United States," according to an FBI memo obtained by OPB and KUOW.

The substation in Morton that was attacked in June is connected to transmission lines that deliver hydropower from the Cowlitz Falls Dam. The energy coursing through those lines is more than 500 times the voltage that comes out of your light sockets or power outlets and, experts say, is easily lethal to anyone foolish enough to mess around with it.

Despite the danger, the Morton substation intruder entered the facility and deliberately damaged equipment. (To avoid inspiring copycat crimes, OPB and KUOW are omitting details of techniques used in this attack and others.)

"I saw a white flash through the garage door window," one eyewitness across the street told Morton Police. "The power cut off."

The 4 a.m. incident plunged about 7,500 customers, or most of the eastern half of rural Lewis County, into darkness for several hours, according to police.

A Lewis County Public Utilities District surveillance video shows a Morton, Washington, substation going dark during a break-in about 4 a.m. on June 16, 2022.

The intruder climbed back into the passenger seat of the truck, which sped off to the north, according to another eyewitness.

The incursion kicked off a rash of attacks on the Northwest power grid in 2022, according to public records obtained by OPB and KUOW. It is unclear whether most of the attacks are connected.

As with most of them, no one has been arrested, and no one has claimed responsibility.

Pacific Northwest utilities have reported a surge of attacks to the FBI in recent months. Attacks on substations in Oregon and Washington predate a December attack in Moore County, North Carolina, that left at least 40,000 people without power for days.

In some cases, the attacks appear to follow manuals disseminated online by neo-Nazis and other far-right extremists.

For years, law enforcement and academics have warned about plots on the nation's electrical grid from "accelerationist" groups that advocate, however implausibly, that taking down the grid will hasten the demise of the federal government and start a race war.

Related: String of electrical grid attacks in Pacific Northwest is unsolved

A Nov. 22 alert from FBI headquarters and the agency's Newark field office warned of an increase of "threats to electrical infrastructure" from racially or ethnically motivated violent extremists ("RMVE"). Those would include white supremacists and other so-called accelerationists attempting to sow chaos.

"The FBI has received reports of threats to electrical infrastructure by threat actors who espouse RMVE ideology to create civil disorder and inspire further violence," the FBI warning noted.

Weeks later, a second bulletin sent by the FBI's Portland field office reported specific attacks were carried out in Oregon and Washington. The attacks were carried out using firearms, hand tools, flames and chains "possibly in response to an online call for attacks on critical infrastructure," according to the bulletin dated Dec. 2.

A Bonneville Power Administration substation in Oregon City, Jan. 5, 2023. Recent attacks on substations have been carried out using firearms, hand tools, flames and chains.

Kristyna Wentz-Graff / OPB

"In recent attacks, criminal actors bypassed security fences by cutting the fence links, lighting nearby fires, [and] shooting equipment from a distance," the bulletin stated. "No theft was reported in either case, making it apparent that the intent was likely to disable electrical systems and not for monetary profit."

A spokesperson for the FBI declined to comment on the bulletins obtained by OPB and KUOW but said people should report suspicious activity near substations to law enforcement.

Plots by white supremacists to target electrical infrastructure in the United States have increased dramatically since 2016, according to a report published by the Program on Extremism at George Washington University in September.

"The rise of accelerationist ideology and doctrine during the past decade likely fueled the increased risk of attack plots within white supremacist milieus targeting critical infrastructure, and the energy sector in particular," according to the report.

The U.S. Department of Justice has charged six individuals with a "discernible, tangible connection" to neo-Nazi groups such as Atomwaffen Division and The Base with plots to destroy power lines, even a nuclear reactor, the report states.

Other white supremacist plots have threatened electrical infrastructure in the Pacific Northwest.

In 2020 and 2021, federal prosecutors charged five neo-Nazis in connection with conspiracy to damage an energy facility. According to court documents filed by the government, one of the defendants carried a handwritten list of about a dozen locations in Idaho and surrounding states, each housing "a transformer, substation, or other component of the power grid for the Northwest United States, that if destroyed could cause damage" to the grid.

The goal, federal prosecutors stated, was "to attack the power grid both for the purpose of creating general chaos and to provide cover and ease of escape in those areas in which they planned to undertake assassinations and other desired operations to further their goal of creating a white ethno-state."

Related: Bundyville: An in-depth podcast examines the rise of extremist violence in the Pacific Northwest

Finally, in 2022, three white supremacists from Wisconsin, Ohio and Texas pleaded guilty to conspiring to provide material support to terrorists. According to the Justice Department, each defendant agreed to take down substations in a different area of the country using high-powered rifles. They believed it could bring about unrest, financial ruin and even a race war, according to prosecutors.

Even though the motives behind most of the 2022 attacks are unclear, the history of white supremacists’ focus on the electrical grid has troubled law enforcement and extremist researchers.

"We’re in a real wave of domestic extremist violence right now that's been increasing for several years," said Mary McCord, a former acting attorney general for national security at the Department of Justice and is now a professor at Georgetown Law School.

In many cases it doesn't matter to extremist groups who actually carries out the attacks, McCord said, because just the fact that the attacks are happening contributes to their goal of sowing discord.

"People might not know whether a particular attack on a power station or a power grid was part of an ideologically motivated plot, or was just done for criminal purposes," McCord said. "White supremacists and others who are seeking to advance their own causes for ideological reasons can use that to advance their purported goals of causing chaos, undermining the government, undermining general stability."

Joshua Fisher-Birch, a researcher with the Counter Extremism Project, a nonprofit that tracks extremists groups’ online activities, said the attacks in North Carolina and those in the Northwest have energized some on the far right.

"The recent substation attacks have been spoken about in glowing terms by certain members of the extreme right, particularly by neo-Nazi accelerationists and white supremacist accelerationists who subscribe to this ideology where they want to push chaos," Fisher-Birch said.

Far-right forums online provide instruction manuals for how to attack substations and other critical infrastructure.

The design of the manuals invokes a video game and taps into costume-play subculture, according to Eric Ward, senior advisor at Western States Center, a Portland-based civil rights group that advocates against extremism.

"White nationalists have tapped into gaming and ‘cos-play’ in order to convince individuals that what they’re engaging in is nothing more than play and gaming," Ward said. "It downplays the real consequences."

Screenshot of a neo-Nazi "accelerationist" manual published online June 1, 2022, and obtained by the nonprofit Counter Extremism Project.

Courtesy of the Counter Extremism Project

The manuals plant dangerous ideas that can cause widespread harm and both those engaging in attacks and the websites allowing the manuals to proliferate should be held accountable, Ward said.

"For some people losing power isn't just an inconvenience," Ward said. "If you’re on a breathing machine, if you need to refrigerate your insulin, access to electricity is a matter of life and death."

Ward said by attacking the electrical grid, neo-Nazi groups want to show the "federal government is incapable of protecting itself and the American public." Their goal, he said, is to erode the public's trust in government.

Despite an uptick in grid attacks by unknown actors, most accelerationist activity remains online, according to Ross Johnson, a grid security consultant on Canada's Vancouver Island.

"We have accelerationists in the United States, they’re in Canada, and they’re in Europe," he said. "We don't see them very often. A lot of it is just talk, thankfully."

"I think their logic is very twisted," Johnson said.

Using utility sources, police reports, and a U.S. Department of Energy database of disturbances to the electrical grid, Oregon Public Broadcasting and KUOW confirmed a wave of 15 physical attacks on substations in the Pacific Northwest since June.

A Bonneville Power Administration substation in Wilsonville, Jan. 5, 2023.

Kristyna Wentz-Graff / OPB

The incidents accelerated toward year's end, with 10 of 15 attacks in 2022 taking place in November and December. (The tally for previous years includes incidents listed in the federal database as physical attacks, vandalism, suspicious activity, or sabotage. With local information sources, we confirmed that all 15 incidents in 2022 involved actual physical attacks on substations.)

The federal data also shows the West to be the hotspot for intentional damage to electrical infrastructure.

The western grid, serving 11 western states and the provinces of British Columbia and Alberta, has had more vandalism, sabotage, and physical attacks reported in the first eight months of 2022 than the rest of North America combined.

"Attacks on electric infrastructure are serious crimes and need to be treated as such," Puesh Kumar, head of the U.S. Department of Energy's Office of Cybersecurity, Energy Security and Emergency Response, said in an email. "We are asking the public—if you see something, say something–and encouraging utilities across the country to share information with law enforcement regarding any suspicious activities."

Washington substations suffered a spate of attacks last summer and fall, starting in the southwestern part of the state. Three sites in the Grays Harbor area were targeted in June, August and October, according to local utility officials. A substation in the Washington town of Toledo, 71 miles north of Portland, was hit in August.

This cable, burned in half by an arc of high-voltage electricity, was recovered from a damaged substation in Toledo, Washington, on Aug. 5, 2022.

Courtesy of the Lewis County Sheriff's Office

November brought a flurry of attacks: two in Woodland, Washington, then two more at Puget Sound Energy sites in Pierce and Thurston counties, which the utility has declined to identify more specifically.

Two substations in Clackamas County, just southeast of Portland, were attacked on Nov. 24 and Nov. 28.

Two intruders "cut into the fence and used firearms to shoot up and disable numerous pieces of equipment and cause significant damage," according to an email from a Bonneville Power Administration security official to police departments in the area.

Petty vandalism and attempts to steal copper are nothing new for electric utilities.

"But now we are dealing with quickly escalating incidents of sabotage," the security official wrote.

MAP: An OPB and KUOW investigation has documented 15 physical attacks on electrical substations in Oregon and Washington in 2022. Locations are approximate.

Several of the Northwest attacks incorporated a similar technique for knocking out power documented by police at the Morton substation in June.

At least two of the 15 attacks in the Northwest also involved firearms, though officials have divulged few details.

Federal prosecutors say the four most recent attacks, on Christmas day in Pierce County, Washington, were carried out by two men who demonstrated no ideological motive, only a desire to knock power out so they could commit burglaries at local businesses. According to federal charging documents for Matthew Greenwood and Jeremy Crahan of Puyallup, Washington, Greenwood confessed to the four attacks and told the FBI he and Crahan had gone to an unnamed local business during the blackout, drilled its door lock, and stolen from its cash register.

The Pierce County Sheriff's Office reports several burglaries Christmas morning, with one business in the blackout area, the Thai Bangkok restaurant, having its door lock drilled and about $100 taken from its cash register.

"The recklessness and the lack of judgment that is displayed in order just to commit some burglaries by putting the power out in four separate locations, it's just beyond words," federal judge J. Richard Creatura said at a detention hearing for Greenwood in January in Tacoma. Both defendants remain in custody.

Federal prosecutors said in court they found no evidence the men had motives beyond burglary, though they told the judge they had not yet searched the men's phones for evidence of extremist ties.

"Despite the arrests that occurred in Tacoma, we have not slowed down our efforts to further harden our substations and protect them in a physical manner," Bonneville Power Administration spokesperson Doug Johnson said. "The arrests are encouraging, but we believe that the threat still exists."

Protecting a vast network against intentional attack is, depending who you talk to, costly or impossible. Some 700,000 miles of transmission lines crisscross the continent, with more than 50,000 substations punctuating the grid in urban, suburban, and rural locations.

Power lines cut through a valley, leading away from Bonneville Power Administration's Earl D. Ostrander Substation near Eagle Creek, Jan. 5, 2023.

Kristyna Wentz-Graff / OPB

North America's far-flung power grid is currently fragile enough that it doesn't take a sophisticated plot to quickly knock out power to thousands of people. The Tacoma area's Christmas day attackers, in their apparent quest to rob a Thai restaurant and other businesses, managed to quickly do $3 million in damage to two substations that will take three years to repair, according to federal prosecutors.

The attackers also managed, perhaps by sheer luck, not to kill themselves.

"It really is amazing to me that there hasn't been a fatality for one of these vandals or thieves or whoever attempts to gain entry to a substation without the proper training," said Ian Cope with the Grays Harbor Public Utility District, the target of three substation attacks in 2022. "For someone to seek entry to a substation and attempt to do damage is incredibly dangerous."

The rash of attacks since November has forced conversations about additional security.

"We are making more investments and hardening the measures that we take to secure our substations and power lines," said Johnson, with the Bonneville Power Administration. "There will be further discussions across the board for electric utilities with regard to what we can do to protect electrical service and keep it reliable."

Proposed measures to protect the grid and keep America's lights on range from coats of armor to artificial intelligence.

The Idaho National Laboratory has developed a bulletproof armor that can fit over transformers like a military-grade steel hood.

The Idaho National Laboratory says its "armored transformer barrier system" can protect substations from threats including high-powered rifles and vehicles laden with explosives.

Courtesy of Idaho National Laboratory

Others pitch higher-tech forms of surveillance as a more affordable form of security.

"It used to be that the cost of monitoring was really expensive because you had to get a signal or signals back to the monitoring center, and then you had to pay somebody to sit there and look at them," security consultant Ross Johnson said.

Now, in tandem with ever-cheaper video cameras, artificial intelligence programs can scan many video streams at once for anything unusual — say, a human, ladder, or bolt cutter where it shouldn't be — and alert humans to the potential problem.

"I’m very optimistic about the future of substation security," Johnson said.

Utilities are required to have measures in place on their most critical assets to prevent cascading or uncontrolled power outages. Utility industry officials say the recent grid attacks in the Northwest and North Carolina hit smaller substations that were unlikely to lead to any cascading outages and were not required to have defensive measures in place.

Shortly after the North Carolina attack, the Federal Energy Regulatory Commission, which regulates the interstate transmission of electricity, launched a 4-month study aimed at determining whether physical security measures should be mandated at all power plants, substations, and control centers nationwide.

How much any additional security measures would boost the cost of powering America's lights, appliances and vehicles remain unclear.

Emails obtained by OPB and KUOW show that at least six electric substations in the region have been attacked, at least two with firearms. At least two of the incidents bear similarities to the attacks on substations in North Carolina on Saturday that were also caused by gunfire and left thousands of people without electricity for days.

Tags: Racism, Politics, Electricity, Oregon, Washington