Sniper Attack On Power Station In California Raises Terrorism Threat

Ten months ago, a group of people attacked a power substation in California. Who they were and why they did it remains a mystery.

Electric Substation

News is just now leaking out about something that happened in the Silicon Valley area of California near a year ago that is raising real fears about potential terrorist threats to a critical part of the nation’s infrastructure, it’s electrical grid:

SAN JOSE, Calif.—The attack began just before 1 a.m. on April 16 last year, when someone slipped into an underground vault not far from a busy freeway and cut telephone cables.

Within half an hour, snipers opened fire on a nearby electrical substation. Shooting for 19 minutes, they surgically knocked out 17 giant transformers that funnel power to Silicon Valley. A minute before a police car arrived, the shooters disappeared into the night.

To avoid a blackout, electric-grid officials rerouted power around the site and asked power plants in Silicon Valley to produce more electricity. But it took utility workers 27 days to make repairs and bring the substation back to life.

Nobody has been arrested or charged in the attack at PG&E Corp.’s Metcalf transmission substation. It is an incident of which few Americans are aware. But one former federal regulator is calling it a terrorist act that, if it were widely replicated across the country, could take down the U.S. electric grid and black out much of the country.

The attack was “the most significant incident of domestic terrorism involving the grid that has ever occurred” in the U.S., said Jon Wellinghoff, who was chairman of the Federal Energy Regulatory Commission at the time.

(…)

The Federal Bureau of Investigation doesn’t think a terrorist organization caused the Metcalf attack, said a spokesman for the FBI in San Francisco. Investigators are “continuing to sift through the evidence,” he said.

Some people in the utility industry share Mr. Wellinghoff’s concerns, including a former official at PG&E, Metcalf’s owner, who told an industry gathering in November he feared the incident could have been a dress rehearsal for a larger event.

“This wasn’t an incident where Billy-Bob and Joe decided, after a few brewskis, to come in and shoot up a substation,” Mark Johnson, retired vice president of transmission for PG&E, told the utility security conference, according to a video of his presentation. “This was an event that was well thought out, well planned and they targeted certain components.” When reached, Mr. Johnson declined to comment further.

A spokesman for PG&E said the company takes all incidents seriously but declined to discuss the Metcalf event in detail for fear of giving information to potential copycats. “We won’t speculate about the motives” of the attackers, added the spokesman, Brian Swanson. He said PG&E has increased security measures.

Whatever the motives might have been, the chronology of the attack gathered by The Wall Street Journal seems to indicate that it was a well-planned operation:

At 12:58 a.m., AT&T fiber-optic telecommunications cables were cut—in a way that made them hard to repair—in an underground vault near the substation, not far from U.S. Highway 101 just outside south San Jose. It would have taken more than one person to lift the metal vault cover, said people who visited the site.

Nine minutes later, some customers of Level 3 Communications,  an Internet service provider, lost service. Cables in its vault near the Metcalf substation were also cut.

At 1:31 a.m., a surveillance camera pointed along a chain-link fence around the substation recorded a streak of light that investigators from the Santa Clara County Sheriff’s office think was a signal from a waved flashlight. It was followed by the muzzle flash of rifles and sparks from bullets hitting the fence.

The substation’s cameras weren’t aimed outside its perimeter, where the attackers were. They shooters appear to have aimed at the transformers’ oil-filled cooling systems. These began to bleed oil, but didn’t explode, as the transformers probably would have done if hit in other areas.

About six minutes after the shooting started, PG&E confirms, it got an alarm from motion sensors at the substation, possibly from bullets grazing the fence, which is shown on video.

Four minutes later, at 1:41 a.m., the sheriff’s department received a 911 call about gunfire, sent by an engineer at a nearby power plant that still had phone service.

Riddled with bullet holes, the transformers leaked 52,000 gallons of oil, then overheated. The first bank of them crashed at 1:45 a.m., at which time PG&E’s control center about 90 miles north received an equipment-failure alarm.

Five minutes later, another apparent flashlight signal, caught on film, marked the end of the attack. More than 100 shell casings of the sort ejected by AK-47s were later found at the site.

At 1:51 a.m., law-enforcement officers arrived, but found everything quiet. Unable to get past the locked fence and seeing nothing suspicious, they left.

There is, of course, no evidence to indicate that this attack was connected to either domestic or international terrorism of any kind, but the nature of the attack as described in the chronologies that have come out suggests that it was far more than, as one person quoted above put it, just a couple of drunk guys who went out one night and decided to fire guns at a substation for kicks. Whoever carried this out seems to have some knowledge of exactly what they were doing, including what steps would be necessary to cause at least some level of disruption to the power and communications grids. This could indicate terrorism of some kind, but of course it could also indicate that the attack was carried out by someone who had inside knowledge about the substation and a grievance against PG&E, perhaps a former employee. The fact that the police apparently have no leads at all, though, including apparently not even being able to find partial fingerprints on shell casings, indicates that whoever carried out the attack did so with sufficient pre-planning to prevent easy discovery. That suggests professionalism of some kind, at least to my admittedly amateur guess work. The one mystery, though, is the apparent lack of any claim of responsibility or follow-up attack. Right now, all we know is that sometime about ten months ago a group of people carried out this attack and were able to sneak away without being discovered, and the mystery itself is arguably a cause for concern.

In the end, this one attack at one electrical substation caused only minor disruptions to the electrical grid. In large part that’s because this is one of many substations and PG&E was able to divert resources to non-affected parts of its grid so that there was no disruption to electrical service. What if that April attack was just a dress rehearsal of some kind, though? We really don’t know, and until the mystery is solved it strikes me that we ought be thinking about the vulnerability of the electrical grid a lot more than we are right now.

FILED UNDER: Crime, National Security, Policing, Terrorism, , , ,
Doug Mataconis
About Doug Mataconis
Doug Mataconis held a B.A. in Political Science from Rutgers University and J.D. from George Mason University School of Law. He joined the staff of OTB in May 2010 and contributed a staggering 16,483 posts before his retirement in January 2020. He passed far too young in July 2021.

Comments

  1. al-Ameda says:

    News is just now leaking out about something that happened in the Silicon Valley area of California near a year ago that is raising real fears about potential terrorist threats to a critical part of the nation’s infrastructure, it’s electrical grid

    This story is, right now, getting a lot of play out here in the Bay Area. Why it is now (today) a prominent news item rather than 10 months ago, is not clear to me at all.

    Local television news now focuses on crime and accident reporting – fires and homicides seem to be preferred, and they don’t limit themselves to local news – if they have to they’ll show the footage from a fire somewhere else in America.

    I guess a power grid substation station shoot-up in Silicon Valley just isn’t exciting enough?

  2. @al-Ameda:

    Yea that’s the other question.

    Was there an effort by law enforcement to cover it up?

  3. ernieyball says:

    …fiber-optic telecommunications cables were cut—in a way that made them hard to repair…

    Reminds me of a time at least 20 years ago when I was working in the land line telephone industry. The local telephone exchange had hired non union contractors to place new buried copper telephone cable for service upgrades.
    While it is legal in Ilinois to use non union labor it did piss off the union.
    Before the job was completed the newly placed telephone cables were damaged “in a way that made them hard to repair.”
    I know this because I had to repair the vandalism.
    I do not know if there was any investigation into the incident but it was pretty clear that whoever commited this act knew exactly what they were doing.

  4. al-Ameda says:

    @Doug Mataconis:

    Was there an effort by law enforcement to cover it up?

    I suspect that this went from local law enforcement to a higher level of investigation because of the implication of what the crime could have been – terrorism. It is still perplexing that this case went off the radar for 9 months.

  5. ernieyball says:

    When I was still working in the telephone industry, companies like AT+T, Level 3 Communications and PG+E had their own internal security forces that would investigate all kinds of matters.
    As far as I know the results of their queries were not a matter of Public Record.

  6. PJ says:

    Did anyone check where the Enron guys were at at time?

  7. James Pearce says:

    This is an interesting story, but terrorism?

    Terrorism is a tactic of the weak and powerless. It’s more likely to be symbolic and indirect, not strategic, and it’s all for naught if there’s no blood.

    This sounds like something more mundane, like a prank or preparation for a heist of some kind.

  8. ernieyball says:

    @PJ:

    Kenneth Lee Lay-deceased…Jeffrey Keith Skilling-incarcerated…Andrew Stuart Fastow-Criminal penalty Six years, followed by two years of probation Criminal status: Released December 17, 2011

  9. john personna says:

    For what it’s worth, I came across the story some time ago … so it probably has been smoldering without catching fire.

    It is actually (economics) one example disproof of the efficient market hypothesis … that what is new is quickly learned and known by “the market” or “the readers.”

    In fact attention is capricious, and something that was on some minor web page can suddenly become a hot issue much later.

    Vandalism At San Jose PG&E Substation Called ‘Sabotage’

    That story is dated April 16, 2013 11:39 PM

  10. john personna says:

    @James Pearce:

    Right, that old story used the better word “sabotage.”

    Yet another example of how all our war-words tend to be French, even as we denigrate French military prowess.

  11. walt moffett says:

    This almost sounds like a red team went a little too far, however, we’ll never know (except for conspiracy specialists).

  12. Tyrell says:

    Overall this points up the vulnerability of the electrical grid system in this country: at risk of attacks, solar storms, and just breakdown because of age. Both parties have voiced concern about this. It is time to form a study committee to plan to refit, upgrade, modernize, and secure our electrical grid. This would take a major cooperative effort of the government, utilities, industry, business, and the military. It would be a long term project on the scope and size of the interstate highway system, the Panama Canal, and the space exploration. It would provide contracts and jobs for millions of workers. Pushing this on down the road invites a disaster of apocalyptic proportions.

  13. dazedandconfused says:

    @Doug Mataconis:

    Was there an effort by law enforcement to cover it up?

    There was a deliberate effort to suppress the story. The press agreed to do so. There were two articles in the local south bay rag..Mercury Centennial (or something like that) and that was it until now. Those two articles remained available on the web right through this period.

    “Cover up” doesn’t obtain. Robert Litt, the NSA’s advocate and legal beagle, has included this story in his public defense’s of the NSA that he has been giving for months and months. No doubt they wanted more press about this. Perhaps they finally got the cops working on it to admit they were at a dead end and might as well try greater publicity to see if that flushes an informant.

  14. john personna says:

    As I say, I saw the story, and running a Google search with a time filter a see more than 1 or 2 reports last year.

    I think this “suppression” is rather accepted at face value.

  15. ernieyball says:

    Just noticed the cover for this post:

    …a group of people attacked a power substation in California…

    My lying eyes can find a reference to more than one perpetrator.

    It would have taken more than one person to lift the metal vault cover,..

    I guess two can constitute a group.
    This brings back fond memories of the anti-draft, anti-war riots of May 1970 at Sleepytown U.
    Two weeks of anarchy and bedlam that began a day or so after government troops shot dead 4 unarmed students at Kent State.
    It wasn’t enough for the City Council to enforce a dusk to dawn curfew (when does that ever work?)
    An emergency ordinance was passed that declared that more than two people standing together on the sidewalk constituted a mob.
    More than once I witnessed a pedestrian walking past two citizens. This was enough for the State Police, four to a car, to jump out of their cruisers with Billy Clubs swinging and start smashing heads.

    Gotta get down to it
    Soldiers are cutting us down
    Should have been done long ago.
    What if you knew her
    And found her dead on the ground
    How can you run when you know?

    http://www.youtube.com/watch?v=Qs6aaaJBAv0
    RIP Allison Krause, Jeffrey Miller, Sandra Scheuer, William Knox Schroeder

  16. Matt says:

    Snipers don’t fire 150 shots. One shot one kill. Not “stand there and unload at short range”. IT’s a personal pet peeve to see stuff like this called “sniper attack” when it’s not even remotely a sniper attack.

    What’s silly is there’s easier ways to knock these stations out. This is something that I’ve personally wondered about since 9/11 happened. I’ve known since before then that our electrical grid is barely stable at some periods of the year and in certain areas. That problem should of been abundantly clear when the great blackouts occurred thanks to relatively minor problems that snowballed out of control.

  17. dazedandconfused says:

    @ernieyball:

    What would you have the cops say when they believe there was no way one guy could have done something?

  18. Matt says:

    7.62×39 is used by aks but also sks ar-15s and more. It’s even used by various pistols. It’s a fairly common round these days.

    The lack of fingerprints combined with the precision in the cutting of communications and the timing of the attack leads me to believe we’re dealing with a militia style of group. Hardcore libertarian don’t tread on me types or the super “patriotic” xenophobic style groups.

    The 7.62×39 used is either an attempt to make it seem like them muslim terrorist did it or was the result of the ak/sks/ar-15 being liked by militia groups for it’s reliability. There are some super reliable ar-15 designs out there and there are 7.62×39 uppers available for them. The 7.62×39 fmj round is still cheap and plentiful. 7.62 would penetrate metal a lot better then the .223 or 5.56.

  19. Matt says:

    @dazedandconfused: The flashlight signals is one indicator. The fact that 150 something rounds were fire in a short time at multiple targets is another. Probably even had noticeable different angles of impact.

  20. ernieyball says:

    @dazedandconfused: What would you have the cops say…

    Ten months ago, a group of people attacked a power substation in California. Who they were and why they did it remains a mystery.

    This I will attribute to whomever writes the OTB cover page as I call it.

    It would have taken more than one person to lift the metal vault cover, said people who visited the site.

    This I will attribute to “people who visited the site.” Don’t know who they are.

    The only thing I ever heard a cop say that I wanted to hear was “You are free to go.”

  21. dazedandconfused says:

    @ernieyball:

    Would you have liked hearing them say “We got the guys that knocked your power out for a week.” ?

  22. ernieyball says:

    @dazedandconfused: Me? My power did not get knocked out by lame ass goons. I live in Illinois. However I suspect those who know the way to San Jose will appreciate news of any progress leading to the arrest and conviction of the fools who did this.

  23. dazedandconfused says:

    @Matt:

    I am not claiming to know. I think it unlikely the cops would tell the press they are convinced it was more than one unless they were pretty darn sure about it. If it was only one guy, that statement might get used by the guy’s attorney. However, it’s probably a fools game to try to suss that out from press reports. Just as likely that whatever it is that makes them feel confident, it’s one of those details the cops keep to themselves to help in the sorting of credible tips from the inevitable flood of garbage.

    Just suggesting to Eyeball that he’s picked the wrong battle. Not everything that happens is useful for pointing out the abuses of police power.

  24. rudderpedals says:

    @ernieyball: Finally, a decent, pleasant, enjoyable earworm. They’ve been away so long.

  25. ernieyball says:

    @dazedandconfused: Just suggesting to Eyeball that he’s picked the wrong battle.

    Make love, not war!