Facing attacks, feds and states grapple with protecting the grid

By Robert Zullo 

A federal task force wrestled with the costs and benefits of better shielding the nation’s tens of thousands of electric substations from a growing number of attacks, like a neo-Nazi plot the FBI says it foiled earlier this month in Maryland, another that knocked out power to thousands in North Carolina in December and more in the Pacific Northwest.

“These events correspond with an increase in extremism in our country,” Federal Energy Regulatory Commission Chairman Willie Phillips said during a meeting of a federal-state task force on electric transmission earlier this week.

Phillips cited a report released last year by the Program on Extremism at George Washington University that found that between 2016 and 2022, “white supremacist plots targeting energy systems dramatically increased in frequency,” with 13 people arrested and charged in federal court during that span, most of them in the past two years.

In December, FERC ordered a review of security standards at electric transmission facilities and control centers. That review, to be completed by the North American Electric Reliability Corporation, which sets and enforces reliability standards for the bulk power system in the U.S., Canada and part of Mexico, is due in April.

But at the task force meeting, NERC President and CEO James Robb said there are more than 50,0000 high voltage substations dispersed across the country and that regulators will have to make difficult decisions about which ones most need additional security.

“That’s a tremendous amount of infrastructure to protect,” he told the task force, a mix of FERC commissioners and state utility regulators.“It’s not as simple as ‘we should just protect everything.’ Your ratepayers that you’re responsible for probably wouldn’t like that answer.” 

Robb said the vast majority of “physical security events,” including vandalism, theft of copper wires and other components and shooting attacks, don’t result in any impact to the grid. Only about 5% do, though the bad news is the attacks are increasing, with extremist groups posting instructions for disabling critical infrastructure on the “dark web,” he said.

Puesh Kumar, director of the U.S. Department of Energy’s Office of Cybersecurity, Energy Security and Emergency Response, said that, in 2022, there were 163 events categorized as “physical” incidents involving electric infrastructure, including vandalism and sabotage, up from 92 in 2021. 

“The majority of incidents, there isn’t a lot of good information on what caused it,” he told the task force. “When these events do occur they tend to be pretty localized.” 

Existing regulations, which came about after a 2014 sniper attack on a California electric substation, only apply to facilities that, if they were knocked out or damaged, could create hazards for the larger grid, like cascading outages.

Many substations, like the ones targeted in Moore County, North Carolina, don’t meet that threshold, but damaging them can still result in a loss of power for thousands.  

“The consequence we’re protecting against is the cascading event that would (affect) millions of customers, not thousands,” he said. 

As NERC works through its report, he suggested state regulators open dialogues with utilities about security costs. 

“You have to weigh the customer impact of this … relative to your cost to defend against it,” he said. “A substation in a very rural part of the country will have different vulnerabilities than one in downtown Manhattan.” 

Dan Scripps, a task force member and chair of the Michigan Public Service Commission, said he wasn’t “entirely convinced” that there shouldn’t be some baseline security requirements, such as fencing, regardless of where a facility is located.

He added that it’s difficult, “from an optics and public responsiveness position” to have to explain to utility customers that there are no minimum standards in place for many facilities. 

“There’s definitely work to be done,” Robb said. “There could be room here for a minimum threshold of protection.”

Robb added that states are free to impose their own security requirements.

“You can always go further,” he said. 

FERC Commissioner Mark Christie, a former Virginia utility regulator, suggested states should work with utilities to develop a “hierarchy” of the most crucial facilities.

“You can’t harden every substation in the country,” he said. “The costs would be astronomical.”

Kumar noted that beefing up physical security is one approach to the problem, but so is making the power system more resilient by improving electric transmission, exploring more distributed generation and microgrids with battery storage that are less dependent on the larger power system.

“I think we have an opportunity but we need to be balanced,” Phillips said, recalling a conversation with his personal trainer. “You can pay me now or you can pay the doctor later.”