9 Investigates: Testing NC power grid security after recent attacks

CHARLOTTE — The security of your power is being called into question amid the rising attacks on the power grid nationwide.

Channel 9 has previously reported physical attacks are up 79% in just a year. In North Carolina alone, there have been three in the past three months. The most recent happened in Randolph County, just south of Greensboro, and followed the Moore County attacks that knocked out power for nearly a week for over 45,000 customers.

Investigative Reporter Madison Carter knows these attacks can cripple cities in an instant. She teamed up with several of Channel 9′s sister stations to visit more than 50 substations across seven states to see what’s being done to protect your power.

RELATED COVERAGE:

• 9 Investigates: Power grid attacks up 79%; discrepancies in reporting incidents
• Feds order review of power-grid security after North Carolina attacks
• 9 Investigates: Duke Energy steps up security after Moore County power grid attack
• FBI investigating if EnergyUnited substation shooting is tied to earlier NC attacks

Visiting the stations

Power companies have been warned about attacks like these for years and have been getting several alerts from federal agencies in the past six months. Critics tell Carter not enough has been done to prevent attacks in light of the warnings.

9 Investigates visited numerous electric substations in the past few months. We are able to locate them by using a crowdsourced map that’s posted online.

The map shows the locations, design, security details, and how power is routed for nearly all of the global electric grid. It’s the same map federal investigators say terror suspects used to plot an attack on substations around Baltimore earlier this month.

Jon Wellinghoff is the former chairman of the Federal Energy Regulatory Commission (FERC).

“You can look at any city in the U.S. and find a number of critical substations that if you, in fact, took those substations down, it would take out the entire city,” Wellinghoff said.

Wellinghoff was at the helm of FERC in 2013 during the largest electric substation attack in U.S. history, which happened at the Metcalf transmission substation in California.

“We’ve seen people have this willingness to actually go after infrastructure in a way that they never would before,” he said.

Wellinghoff said no one was ever arrested for the Metcalf attack, and there were no physical protections in place to stop bullets from hitting the transformers.

Channel 9′s investigation found, a decade later, that’s still the case at many electric substations.

“It’s appalling that they still have chain-link fences,” Wellinghoff said. “Or at least no barriers up to the critical infrastructure within those substations.”

At some substations surrounding Charlotte, Carter and Channel 9 investigative producer Mike Stolp did encounter some more robust physical protections. They saw taller gates, cameras, and some stations that were hidden from plain view.

But 9 Investigates also learned the fencing around a station may not matter.

Universal access

Carter encountered padlocks at several sites that all were labeled “Duke Energy” and looked similar. A contractor who no longer works with Duke told her they look similar because they’re identical.

The contractor claimed there is a universal key that accesses all of those Duke padlocks, and he still has one -- although he hasn’t worked with the company in over three months.

Carter took that information to Duke.

“I can say that even with that key, it wouldn’t give the individual access to all aspects of secure components in that substation or any other equipment,” Jeff Brooks, Duke’s spokesperson, told Carter.

Brooks explained the keys in this way: “Our employees and contractors maintain more than 100,000 miles of power lines and thousands of substations and other facilities across North Carolina and South Carolina. They must access these facilities, some of which are in secure locations, to do their jobs.”

He would not confirm whether the key still works, but said the company will investigate further.

“Any attempt to use that key at this point would be a crime. We thank you for bringing it to our attention.”

>> To read Duke Energy’s full responses to our questions, click here.

Are substations secure enough?

While Carter and her team didn’t share with Duke Energy we’d be at the sites, our teams weren’t hiding. The visits were done during the day and at night, and our crew did not trespass.

Carter used a high-powered flashlight to see at night. Flashlights, 9 Investigates later learned, can render the cameras we found at the sites useless. We learned this after realizing a Duke employee did see our crew and called police. We were able to obtain a recording of that call.

Employee: “They wasn’t doing any mischief or anything, they were just shining their lights and I couldn’t hardly see.”

Employee: “They may be teenagers with spotlights. I just talked to my supervisor and he said to contact you guys. They look like they were just out with spotlights shining all over our back gate, but they have walked at least 25 foot away. So they might be just exploring.”

Dispatcher: “What’s the address?”

Employee: “[Gives address] They’re walking away. But I don’t think I have an issue at all.”

After watching our crews on the cameras, the employee didn’t think there was a problem. But Wellinghoff says cameras are more of a reactive security measure than a proactive one. They can’t prevent anyone from attacking the grid; they can only help identify suspects -- or news crews -- after the fact.

“It’s so ineffective,” he said. “I mean, a physical attack can take 3 minutes.”

Brooks told 9 Investigates that cameras and fences are only a deterrent.

“But those means alone cannot prevent damage from a bad actor, just as a camera in a bank doesn’t prevent a bank robbery,” he said.

He said the company has other security measures in place -- some behind the fences -- to respond in an incident.

“We have a multi-layered risk management strategy that continually evolves. Our proactive strategy has three core components: A physical defense system, a cross-functional team that monitors and responds to threats 24/7/365, and daily information sharing with our industry and government partners.”

Brooks says the priority for the company is grid resiliency – a term used to describe the ability to quickly restore power in the event of a disturbance.

After we completed our visits, we asked Duke whether they knew we were there. Only after we supplied a date -- but not locations -- did we get back photos of our team at two of the four sites we visited.

“Our security measures did work and were able to identify your crew on a couple of occasions around Charlotte,” said Brooks.

Brooks said since we stayed outside of their gate, we didn’t breach their security. However, during the Moore County shootings, the attackers never stepped foot on their property either.

Even after we were identified by the Duke employee on site, he chose not to send police right away.

Dispatcher: “Do you want us to run down there or -- What do you want?”

Employee: “If he’s in the area. But, like I said, it’s no emergency.”

Improvements are coming

In the wake of the Moore County attacks, Duke Energy told Channel 9 it was working on a $75 billion project to improve the power grid across all of its properties.

Carter has been working to learn who will be responsible for those improvements. The utility company has already filed a request for a rate increase to have customers pay for it.

We asked energy experts whether the cost of physical protections over the past decade prevented companies like Duke from making these upgrades sooner.

Wellinghoff said the cost would have been “pennies on their bill” had measures been taken ahead of now.

(WATCH BELOW: FBI offers reward for tips on North Carolina electrical substation shootings)

FBI offers reward for tips on North Carolina electrical substation shootings

©2023 Cox Media Group