Electric utilities must harden neighborhood substations to withstand the actions of vandals, terrorists, disgruntled employees, and other threat actors. Although it’s been twelve years since transformers at Metcalf Substation (April 2013) were damaged by small arms fire and eleven years since the FAA Control Center in Aurora, Illinois (September 2014) was damaged by a disgruntled contract employee, the physical security of neighborhood substations in the United States is essentially unchanged.
At present, governmental agencies, North American Electric Reliability Corporation (NERC), and state public utility commissions have not required that physical security standards be developed for neighborhood substations.
This article offers insights that electric utilities can use to develop and implement cost effective physical security at neighborhood substations.
Compare Hardening Costs to Monitoring Costs
Adding intrusion detection, bullet resistant fences, walls, and panels can increase the cost of a neighborhood substation by 25%. Hardening neighborhood substations can be accomplished at less than 10% of the cost of installing bullet resistant fences, walls, and panels and eliminate the need for bullet resistant fences, walls, and panels.
How Many Attacks Have Occurred?
In other words, what is the extent of the problem? A quick internet search uncovered 38 incidents in 17 states during 2022, 2023, and 2024. Eleven involved small arms fire and 24 were incursions.
Noteworthy attacks occurred in Metcalf, California; Moore County, North Carolina; Puyallup, Washington; and Scott, Arkansas where transformers were damaged by small arms fire. In Hershey, Pennsylvania, a motivated threat actor flew a drone into a substation. In Maryland, law enforcement arrested motivated threat actors who were planning simultaneous attacks on substations near Baltimore.
The Electricity Information Sharing and Analysis Center (E-ISAC) database most certainly includes many more incidents as internet searches only uncover incidents that were published by the news media.
What are the Benefits of Hardened Substations?
Like automobile insurance, the benefits of hardening only come into play after an incident occurs. Unlike automobile insurance, however, the risks are hidden because very few of the 70,000 neighborhood substations have been damaged by threat actors. A significant observation is that attacks have occurred in clusters in North Carolina, Oregon and Washington.
What are the Threats?
This becomes tedious as the number of variables and the complex interactions between electric utilities, regulators and governmental agencies clouds our vision. In addition, the motivation of many threat actors is unknown as the threat actors were never identified.
Threat actors should be categorized as exploitive (thieves who steal copper wire), malicious (individuals who want to get even), or truculent (individuals who aggressively compromise electric facilities). Each of these threats should be evaluated considering Threat Actor Dwell Time; Component Damage; Recovery Time; Customer Outages; and Security Response Time.
The first step should be to determine the importance of weak link components and the cost to replace them with hardened components. The next steps should be to identify time to failure, to estimate response time of security personnel, and to estimate recovery time.
Tables 1, 2, and 3 are examples of threat evaluations and recommended actions. In practice, specific concerns, such as theft of ground conductors and the basis for threat actor dwell time, would be noted.
What Components are Critical?
Security professionals consider buffer zones, controlled zones, critical zones and secure zones. Figure 1 is an illustration of physical security zones in an open air neighborhood substation. Critical and secure areas occupy less than 20% of the area inside the fence. This is typical as working clearances around energized components occupy a lot of the surface area in open air substations.
Figure 1: Physical Security Zone Map for an Open Air Neighborhood Substation
Motivated Threat Actors
Bullet resistant fences, cameras, and other features that are recommended by security professionals are band aids that provide little protection against the actions of motivated threat actors. A single individual armed with an AR-15 style rifle can damage many of the components in an open air substation in less than 5 minutes. This is sobering when you realize that the firearm industry trade association estimates that there are 20 million AR-15 style rifles in civilian hands in the United States.
Investing in hardened components that remain serviceable when damaged by small arms fire is a far better approach.
Moore County, North Carolina Neighborhood Substation Attacks
The small arms fire attack on two neighborhood substations (December 2022) left 40,000 residential and business customers without electrical power for days. A state of emergency and corresponding curfew were enacted by local government officials in the wake of the incident. This attack should be a wake up call to other electric utilities..
Learn from Others
The National Association of Regulatory Utility Commissioners (NARUC) should be tasked with requiring that the electric utility industry harden substations much like the National Transportation Safety Board (NTSB) requires that airplanes are airworthy and National Highway Traffic Safety Administration (NHTSA) regulates automobile safety.
Rather than waiting for guidance by governmental agencies, we recommend that electric utilities begin implementing the following recommendations:
1: Transformer Hardening
Require that all large, liquid filled, power transformers are equipped with motor operated valves that automatically close on low liquid level. This will prevent transformer failure due to loss of oil via punctured coolers.
This will increase the cost of large, liquid filled, transformers by less than 10% as motor operated valves are low cost components when compared to copper windings and cold-rolled grain-oriented core steel.
2: Transformer Serviceability
Require that all large, liquid filled, power transformers are able to remain in service when load is less than 50% of rating after motor operated valves close. This will most likely require that liquid filled transformers are equipped with pumps and flow diverters that enable oil flow in the core and coils.
This will increase the cost of large, liquid filled, transformers by less than 10% as flow diverters will be welded to the outside of tank walls in the same way that belly bands are welded to tank walls.
3: Control House Hardening
Require that all new substations are equipped with either two control houses, or one control house with a four hour firewall between areas housing redundant protective relays.
Contact Info
To learn more about Prescient Transmission Systems' thoughts on physical security for neighborhood substations, contact me by email: [email protected] or by text 503-718-8905.