[Note that this article is a transcript of the video embedded above.]

At around 7PM on the balmy evening of Saturday, December 3, 2022, nearly every electric customer in Moore County, North Carolina was simultaneously plunged into darkness. Amid the confusion, the power utility was quick to discover the cause of the outage: someone or someones had assaulted two electrical substations with gunfire, sending a barrage of bullets into the high voltage equipment. Around 45,000 customers were in the dark as Duke Energy began work to repair the damaged facilities, but it wouldn’t be until Wednesday evening, four days after the shooting, that everyone would be back online. That meant schools were shuttered, local businesses were forced to close during the busy holiday shopping season, a curfew was imposed, and the county declared a state of emergency to free up resources for those affected. The attack came as other utilities around the United States were reporting assaults on electrical substations, including strikingly similar instances in Oregon and Washington. Let’s talk about what actually happened and try to answer the question of what should be done. We even have exclusive footage of the substations that I’m excited to show you. I’m Grady and this is Practical Engineering. In today’s episode, we’re talking about the Moore County substation attacks.

Right in the geographic center of North Carolina, Moore County is home to just under 100,000 people. The county is maybe most famous for the Pinehurst Resort, a historic golf course that has hosted the US Open on several occasions. It also sits nearby Fort Bragg, one of the largest Army bases in the world. And here’s an overlay of Moore County’s transmission grid. Taking a look at this layout will help us understand this event a little better. By the way, this information is not secret - it’s publically available, at least for now, in a few locations including the Energy Information Administration website and Open Street Maps, and I’ll discuss the implications of that later in the video.

Two 230 kilovolt (or kV) transmission lines come into Moore County from the southwest and connect to the West End Substation near Pinehurst. One of the lines terminates here while the other continues to the northwest, without making any other connections in Moore County. These two 230 kV lines are the only connection to the rest of the power grid in the area. At the West End Substation, two power transformers drop the voltage to 115kV. From there, two 115kV lines head out in opposite directions to form a loop around Moore County. Distribution substations, the ones with transformers that lower the voltage further to connect to customers, are mostly spread out along this 115kV loop. So, essentially, most of Moore County has two links to the area power grid, and both of them are at a single substation, West End. And you might be able to guess one of the two substations that was attacked that Saturday evening. Interestingly, the other substation attacked was here in Carthage. Just looking at a map of the transmission lines, it would be easy to assume that Carthage provides a second link to the 230 kV transmission grid, but actually, it’s just a distribution substation on the 115 kV loop. The 230 kV line passes right by it.

Duke Energy (the owner of the substations) hasn’t shared many details about the attack. In their initial press release, they simply stated that “several large and vital pieces of equipment were damaged in the event.” Those investigating the attack, including the FBI, are also keeping details close to their chest. Our drone photographer had to have a police escort just to get this footage. But, we can use photos and clips of the substations to hypothesize some details of the event. Just take what I say with a grain of salt, because the folks in charge haven’t confirmed many details. It really looks like the attacker or attackers were specifically targeting the transformers. These are typically the largest and most expensive pieces of equipment (and the hardest to replace) in a substation. They do the job of changing the voltage of electricity as needed to move power across the network. And, even more specifically, it looks like the attackers went after the thin metal radiators of the transformers. Just like the radiator in your car, these are used on transformers to dissipate the heat that builds up within the main tank. But unlike the coolant system in a car, wet-type power transformers are filled with oil. If all that oil drains out of the transformer tank, it can cause the coils to overheat or arc, leading to substantial permanent damage.

Disabling the transformers was presumably the goal of the attack, but obviously, with power transformers being both so important and so difficult to replace, they are almost always equipped with protective devices. We don’t have to do a deep dive into the classic Recommended Practice for the Protection of Transformers Used in Industrial and Commercial Power Systems, but it’s enough to say that utilities put quite a bit of thought into minimizing the chance that something unexpected, whether it’s a short circuit or a bullet, can cause permanent damage to a transformer. Sensors can measure oil pressure, gas buildup, liquid levels, and more to send alarms to the utility when an anomaly like an oil leak occurs. And, some protective devices can even trigger the circuit breakers to automatically disconnect the transformer before it sustains permanent damage.

Whether it happened automatically or manually as a result of an alarm, the two 230 kV transformers in the West End substation were disconnected from the grid as a result of the shooting, and in doing so, the entire 115kV loop that goes around Moore County was de-energized, turning out the lights for the roughly 45,000 connected households and businesses. Aerial footage taken the day after the attacks shows the disconnect switches for the 230kV lines open, an easy visual verification that the transformers are de-energized. You can also see some disassembled radiators on site, presumably to replace the damaged ones on the transformers. It seems that the gunfire only damaged the transformer radiators, which is a good thing because those can usually be replaced and put back into service relatively easily. If the windings within the transformer itself were damaged, it would probably require replacement of the equipment. Transformers of this scale are rarely manufactured without an order, which means we don’t have a lot of spares sitting around, and the lead time can be months or years to get a new one delivered, let alone installed.

With at least three damaged transformers, the utility began working 24-hour shifts on a number of parallel repairs to restore power as quickly as possible. Again, they didn’t share many details of the restoration plans, so we can only talk about what we see in the footage. One of the more interesting parts of restoration involved bringing in this huge mobile substation. It seems that crews temporarily converted the Carthage substation so it could tap into the adjacent 230kv line. The power passes through mobile circuit switches, a truck-mounted transformer, secondary circuit breakers, voltage regulators, and disconnects to feed the 115kv loop. You can also see the cooling system of the mobile transformer is mounted at the back of the trailer to save space. With this temporary fix, and presumably some permanent repairs to the transformer radiators at West End, Duke Energy was able to restore service to all customers by the end of Wednesday, about 4 days after all this started. Knowing the extent of the damage, that’s an impressive feat! But they still have some work ahead of them. In this footage taken two weeks after the attack, you can see that one of the 230 kv transformers is back online while the other is still disconnected with all its radiators dismantled.

The FBI and local law enforcement are still working to find those involved in the incident, and there’s currently a $75,000 reward out for anyone who can help. Officials have stopped short of calling it an act of terrorism, presumably because we don’t know the motive of whoever perpetrated the act. The local sheriff said this person, “knew exactly what they were doing,” and I tend to agree. It doesn’t take a mastermind to take some pot shots at the biggest piece of equipment in a switchyard, but this attack shows some sophistication. They targeted multiple locations, they specifically targeted transformers, and one of the substations they chose was critical to the distribution of power to nearly all of Moore County. It’s fairly safe to say that this person or persons had at least some knowledge about the layout and function of power infrastructure in the area… but that’s not necessarily saying much.

To an unknown but significant extent, power infrastructure gets its security through obscurity. It’s just not widely paid attention to or understood. But, almost all power infrastructure in the US is out in the open, on public display, a fact that is a great joy for people like me who enjoy spotting the various types of equipment. But, it also means that it’s just not that hard for bad actors to be deliberate and calculated about how and where to cause damage. With its sheer size and complexity, it would be impossible to provide physical security to every single element of the grid. But, protecting the most critical components, including power transformers, is prudent. That’s especially true for substations like West End that provide a critical link to the grid for a large number of customers. They already have a new gate up, but that’s probably just a start. I think it’s likely that ballistic resistant barriers will become more common at substations over time, and, of course, those added costs for physical security will be passed down to ratepayers in one way or another.

But it’s important to put this event in context as well. Attacks on the power grid are relatively rare, and they fall pretty low on the list of threats, even behind cybersecurity and supply chain issues. The number one threat to the grid in nearly every place in the US? The weather. If you experience an outage of any length, it's many times more likely to be mother nature than a bad actor with a gun. That’s not to say that there’s not room for improvement though, and this event highlights the need for making critical substations more secure and also making the grid more robust so that someone can’t rob tens of thousands of people of their lights, heat, comfort, and livelihood for four days with just a few well-placed bullets.