Between October 2022 and February 2023, at least nine substations were attacked in North Carolina, Washington State, and Oregon, resulting in power outages for tens of thousands of people. Damage to two substations in Moore County, North Carolina on December 3, 2022 caused 45,000 people to lose power, some for five days.
Concern about the physical security of substations (and by extension the security of the electrical grids) is not new. In 2013, a sniper attack on a power station in California was described as a “wake-up call” for more attention to the vulnerability of key infrastructure. Following the attack, in Order No. 802, the Federal Energy Regulatory Commission (FERC) approved Physical Security Reliability Standard CIP-014-1.[1]
In response to the recent attacks, FERC approved revised Physical Security Reliability Standard CIP-014-3 and ordered the North American Electric Reliability Corporation (NERC) to conduct a study on the adequacy of that standard, and whether a minimum level of physical security protections should be required for all bulk-power system transmission stations and substations and primary control centers.[2] The NERC report is due by April 14, 2023.
States’ legislators have also responded to the attacks. California, where the 2013 sniper attack occurred, claims to be the first state in the nation to adopt rules to safeguard its electric distribution grid against terrorist attack. Recently, legislators in North Carolina, South Carolina and Arizona have introduced bills that require enhanced security at substations or penalties for damaging them.
Admiral Bobby Inman has described the failure to foresee the 9/11 attack not only as an intelligence failure, but also as a “failure of imagination.” In this case, experts have already imagined what would happen if coordinated attacks targeted substations – for example, a 2014 study by FERC concluded that coordinated attacks on only nine substations on a high-demand day could create a coast-to-coast blackout for weeks, if not months. Although such national coordinated attacks would be difficult to orchestrate, the effectiveness of the tactic is demonstrated by Russia’s attacks on Ukraine that have systematically sought to cripple Ukraine’s electrical grid.
The costs of physical security are substantial and daunting, given that there are approximately 55,000 substations in the United States, but those security costs must be weighed against the incredible costs that can arise from outages.[3] Even if regulations or industry practices commit to increasing physical security despite the cost, the path to such security is not entirely clear. Physical reinforcements and enhanced monitoring, even physical patrols, could mitigate the risk of a successful attack. However, long-range attacks from high-powered rifles remain difficult to secure against.[4]
[1] Physical Sec. Reliability Standard, Order No. 802, 149 FERC ¶ 61,140 at P 1.
[2] N. Am. Elec. Reliability Corp., 179 FERC ¶ 61,187 (2022) (approving Reliability Standard CIP-014-3); and N. Am. Elec. Reliability Corp., 181 FERC ¶ 61,230 (2022) (Order Directing Report).
[3] See, e.g., Texas Department of Insurance, “Insured Losses Resulting from the February 2021 Texas Winter Weather Event”, Dec. 27, 2021, estimating $10.3 billion dollars in insured Texas losses related to the power outages in Texas caused by Hurricane Yuri.
[4] See NPR interview by Ayesha Rascoe with Erroll Southers, professor of national and homeland security at the University of Southern California on December 11, 2022, “How safe are electrical power grids in the U.S.?”.
[View source.]
