Dec. 5, 2022 Attacks on North Carolina substations leave thousands without power

The loss of electricity has also impacted the water supply to families in Moore County, North Carolina.

“Rural communities rely on electricity a lot more than people realize,” Andrew Wilkins, whose parents own the farm in Whispering Pines told CNN. “Many big cities don’t lose their water when the power goes out, but a lot of rural areas rely on a well for water. My family draws their water from a well so when the power goes out, the well stops and the water pressure drops and we slowly lose water.“ 

The farm fosters rescued animals, said Wilkins, who is visiting his family for the holiday season. 

According to Wilkins, the lack of cellphone service is also making it hard for everyone to stay informed. 

“We didn’t know what happened at first. The cellphone service also went down so there was no way to find out what was happening. We just thought a power line went down and the power would be back in a few hours," Wilkins said.

He said his family considers themselves lucky because they have a generator, but they’re concerned about having to find fuel to keep it running as the local gas station appears to be closed.

For now, the once-quiet farm is surrounded by the sounds of generators operating in nearby homes, Wilkins said.

North Carolina Gov. Roy Cooper stressed that the state needs to learn from the attacks on the power grid, adding, "we cannot tolerate" a power outage like this.

"I'm always concerned about critical infrastructure, and I think we certainly need to learn from this incident," the governor said.

"These kind of things cannot happen," Cooper continued. "I mean we cannot tolerate this type of widespread power outage to so many people."

He continued, "I had a conversation with the CEO of Duke Energy today, Lynn Good, she understands that as well. We know that there may be some things that need to change to make sure our infrastructure is protected."

Jeff Brooks, a spokesperson for Duke Energy, said the company is also taking in information from the attack and using it to further develop its security responses. He said input on what the company learned from this will be applied to near and long-term planning.

Brooks said physical security is an important part of their efforts, but there are “many layers” that are in place.

Moore County schools will remain closed on Tuesday, the district said in a tweet.

“Due to the continuing widespread power outage in Moore County and on Moore County Schools operations, all schools will be closed to all students and staff on Tuesday, December 6,” the tweet said.

“We will announce the status for schools for Wednesday by 4 p.m. tomorrow,” the tweet added.

The district services 22 schools with more than 12,000 students, according to its website. 

Moore County Superintendent Tim Locklair said over the weekend decisions regarding school openings for the remainder of the week will be made on a day-by-day basis. Duke Energy said power for most customers likely won't be restored until Wednesday or Thursday.

Jeff Brooks, Duke Energy spokesperson, said customers could "gradually" see more outages restored soon, but added "we could still see this extend Wednesday into Thursday, somewhere in that time frame."

"For the majority this outage will continue until we get those repairs completed," Brooks said at a news conference with North Carolina Gov. Roy Cooper and other officials Monday.

Brooks said in some cases, the equipment could be repaired in place, but other parts were so damaged, they must be taken out and replaced.

“Understand though that its not as simple as changing a lightbulb,” he said, adding that “some of this equipment does take a significant amount of work, a significant amount of process that goes through putting it in to place safely, getting it in service."

Duke Energy said about 38,000 customers remain without power. That's down from about 45,000 over the weekend.

North Carolina Gov. Roy Cooper noted that he is making sure that vulnerable populations in the state impacted by power outages are taken care of.

He also said that the state is also "deeply concerned" about the impact the widespread outages will have on small businesses and students.

"Now while we are determined to keep people safe, we're also deeply concerned about the small businesses that are losing out on valuable retail time right here before the holidays, as well as our school students who are missing valuable class time because of closure of schools," he said.

The governor added that the response from local and state authorities "has been swift and strong" and that "we'll all keep working until the power is restored."

North Carolina Gov. Roy Cooper called widespread outages in Moore County a "criminal attack" on the county's substations.

The governor said at a news conference Monday he has been briefed regularly on the investigation into the attacks as well as the emergency management efforts to resume power for thousands of people in the community. He said he has also met with local, state and federal law enforcement agencies.

Cooper said he visited one of the substations as crews were working to get them back up and running. Energy workers have been "working around the clock" to restore power, but said it is a "very complex" effort.

Duke Energy said in a statement Monday it could take until Thursday for power to be restored to most customers.

The governor said the priority moving forward is to help people, especially those in adult care home and other vulnerable populations.

The state is "making sure that critical services,” including hospitals and law enforcement, are supported and available in the meantime.

“All of that is crucial," Cooper said.

Officials have not yet announced any motive in the case.

"Regardless of motive, violence and sabotage will not be tolerated," Cooper added.

The Biden administration is “closely” monitoring and offering federal support on an investigation into power outages in Moore County, North Carolina, believed to have been caused by “intentional” and “targeted” attacks on substations that left around 40,000 customers in the dark Saturday night.

President Joe Biden is “staying aware of this,” National Security Council coordinator for strategic communications John Kirby said Monday. 

The FBI joined an investigation into the power outages on Sunday, and Energy Secretary Jennifer Granholm said that she has been in touch with Duke Energy and that the Department of Energy’s Office of Cybersecurity, Energy Security and Emergency Response “is working with federal partners.”

The Biden administration has made cybersecurity of critical infrastructure, much of which is owned and operated by the private sector, a key priority. Biden signed a national security memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems, and the bipartisan infrastructure bill passed last year makes investments in modernizing existing infrastructure. 

Biden, Kirby said Monday, has “made critical infrastructure security and the resilience of that infrastructure, regardless of whether it's from natural threats, or manmade threats, he made it a priority since the very, very beginning.” 

Attacks on the United States’ power grid have been the subject of extremist chatter for some time, notably ticking up in 2020, the same year a 14-page how-to on low tech attacks was released and circulated amongst extremist communication channels.

A Department of Homeland Security Bulletin reported by CNN just days before the attack on a North Carolina substation indicated there was a heightened threat posed by domestic violent extremists in the United States against targets including critical infrastructure.

On Nov. 30, DHS renewed a national bulletin warning that lone offenders and small groups motivated by a range of ideological beliefs and personal grievances pose a lethal threat to the United States.

The advisory said in part “DHS maintained that potential targets include but are not limited to public gatherings, faith-based institutions, the LGBTQIA+ community, schools, racial and religious minorities, government facilities and personnel, US critical infrastructure, the media and perceived ideological opponents."

The electric grid has been described as an “attractive target” for domestic violent extremists in US, CNN reported earlier this year, citing an intelligence report.

In 2020 intelligence analysts saw major uptick in online chatter focused on attacking the Power Grid.

Notably in 2020, a 14-page document released in a Telegram channel favored by accelerationist groups seeking to speed the overthrow of the US government featured a White supremacist instruction guide to low-tech attacks meant to bring chaos, including how to attack a power grid with guns.

The document has been cited by Department of Homeland officials and was obtained by CNN.

“The powergrid would be crippled for a very large area. Armor piercing rounds shot into the transformers would destroy them,” the colorful how-to describes.

The writer goes on to frame how massive blackouts would aide in the toppling of society which is a key accelerationist goal. 

“But with the power off, when the lights don’t come back on… all hell will break lose, making conditions desirable for our race to once again take back what is ours,” the document reads.  

Several unique attempts to attack various grids have been cited by intelligence officials that analyze these specific threats. 

Investigators discovered a four-rotor drone July 16, 2020, in Pennsylvania recovered from the roof of a power station, according to a DHS Bulletin in Oct. 2021.

CNN reported earlier this year that in May 2020, three people claiming to be Boogaloo adherents allegedly conspired to attack an electrical substation in Las Vegas as part of an attempt to incite riots and violence amid demonstrations in the city. 

The suspects were charged with conspiracy to damage and destroy by fire and explosive and with possession of unregistered firearms.

The unsolved case of the attack on the Metcalf Pacific Gas and Electric (PG&E) substation in Coyote, California, on April 16, 2013 set the bar for these types of attacks and has been a case study for intelligence officials

The vulnerabilities of the Power Grid have been closely examined by the Department of Energy, DHS and Congress.

According to the National Research Council, tasked by congress to examine these vulnerabilities, the US grid consists of:

CNN's Geneva Sands, Whitney Wild and Kristina Sgueglia contributed to this report

Thousands of customers are still in the dark Monday after "targeted" attacks on substations knocked out power in Moore County, North Carolina, over the weekend — and it could still be a few more days until most power is restored, according to the energy company.

Duke Energy said it has restored power to around 7,000 customers since the outage, but it believes most customers will not see energy restored until Thursday, the company said in a statement on its website Monday.

Around  38,000 customers remain without power, it said.

Hollifield, in a statement Sunday, said that crews are working 24-hour shifts to make repairs. Once they fix equipment, which could take several days, the company will need to test everything "before beginning the final restoration process."

Duke Energy said it is working with law enforcement and various investigating agencies.