Two suspects have been charged in attacks on substations in Washington State that occurred on Dec. 25, 2022.
The four substations that were targeted were the Graham and Elk Plain substations operated by public power utility Tacoma Power and the Kapowsin and Hemlock substations operated by Puget Sound Energy, an investor-owned utility.
The two suspects were scheduled to appear in U.S. District Court in Tacoma, Wash., on Jan. 3 and were charged with conspiracy to damage energy facilities and possession of an unregistered firearm, announced U.S. Attorney Nick Brown.
The two men were arrested Saturday, December 31, 2022, following an investigation by the FBI.
According to the criminal complaint filed with the court late Saturday, December 31, 2022, and unsealed Jan. 3, the two men were identified as possible suspects through the analysis of cell phone records. At one of the substations, Tacoma Power captured images of one suspect and the image of a pick-up truck that appeared to be connected with the attack.
When law enforcement served a search warrant on the home of the suspects, they recovered distinctive clothing pictured in the surveillance photos, according to a Department of Justice news release.
Tacoma Power on Jan. 3 said that it “values its close working relationships with local, state, and federal law enforcement, and we appreciate their quick and diligent work in arresting the suspected perpetrators. We take the safety and security of our substations and all critical infrastructure we operate seriously.”
The utility said that it has committed significant resources to both cyber and physical security over the past several years to increase protection of its assets.
“As noted by federal investigators, those security measures aided in these swift arrests. We also want to thank our customers, who were not only patient and gracious as we worked to restore power during their interrupted holiday, but who also provided important tips to law enforcement to aid in the investigation,” Tacoma Power said.
On the morning of Dec. 25, Tacoma Power was notified that two of its substations were deliberately targeted with physical damage. Over 7,000 customers in Graham and Elk Plain were without power. “There is no danger to public safety, and we are working with federal and local law enforcement,” the utility reported on Dec. 25.
The following day, Dec. 26, Tacoma Power reported that all customers were back online after the intentional damage to its system yesterday. “We appreciate everyone’s patience while our crews worked overnight and into this afternoon on restoration. We were able to deploy a mobile substation to restore power,” the utility said in a tweet.
Earlier in December, Tacoma Power and the broader electric sector was alerted by federal law enforcement of a security alert for the electrical grid. “Tacoma Power follows federal reliability standards, including assessing physical risks to our critical energy infrastructure and applying recommended mitigation measures. In accordance with best practices, we do not share the details of our resiliency and security tactics,” it said.
Tacoma Power said that it was working closely with law enforcement on their investigation into these incidents and have implemented additional increases to security around its infrastructure.
The Pierce County Sheriff’s Department in Washington State on Dec. 25 reported that along with the Tacoma Power incidents, it was notified by Puget Sound Energy that it too had a power outage. Deputies were sent to the facility where the fenced area was broken into and substation equipment vandalized.
In early December, Duke Energy responded to power outages caused by vandalism against utility equipment in North Carolina.
Duke Energy on Dec. 4 said that crews responded to widespread outages in Moore County, N.C. The company experienced multiple equipment failures affecting substations leaving about 45,000 customers without power.
The American Public Power Association continues to closely monitor developments related to the recent substation incidents.
APPA also continues to stress the importance of public power utilities joining the Electricity Information Sharing and Analysis Center for timely and actionable sharing of threats to the electricity subsector. To learn more about the E-ISAC and how to join, visit the E-ISAC website.
