Report Human-Driven Physical Threats to Energy Infrastructure

Introduction 

Threats to the nation’s energy infrastructure are continuing to grow and range from natural disasters to cyber and physical attacks. Malicious actors can pose a serious threat to the physical security and resilience of our energy system. From simple trespassing and acts of vandalism to more serious attacks on energy infrastructure with destructive devices, states need to be aware of and prepared for physical threats perpetrated by humans. 

The frequency of physical security incidents against U.S. electricity infrastructure has increased over the past few years. According to the U.S. Department of Energy’s annual summary of DOE-417 Electric Emergency Incident and Disturbance Reports, reporting of incidents related to physical security of electricity infrastructure increased 70% in 2022, compared to the prior three years; however, it is important to note that reports are filed for a wide range of incidents, including vandalism, thefts, suspicious activity, threats, and trespassing. 

In 2022, at least 25 reports were filed under the “actual physical attacks” criteria—as opposed to threats or suspicious behavior—compared to only six in 2021, but this can cover a range of activity. Additionally, while it is important to track all physical security incidents, it is important to note that not all incidents filed under the “actual physical attack” criteria resulted in customer impacts. 

The Electricity Information Sharing and Analysis Center (E-ISAC) counted roughly 1,700 total reports of attacks, vandalism or other suspicious activity throughout 2022. Though the targets vary, many of these attacks have been carried out against substations or distribution infrastructure. Though most have not caused power outages, they have exposed the physical vulnerability of our energy infrastructure and the need to bolster energy security and resilience to stay ahead of emerging threats.  

States generally have jurisdiction over the electric distribution systems through their public utilities commissions (PUCs). This jurisdiction most often applies only to investor-owned utilities, but several states have extended PUC authority to certain aspects of municipal and cooperative utilities. State lawmakers can make a significant impact on the physical security of their states’ energy infrastructure through their power to determine PUC authorities and to direct energy security priorities and funding.

The DOE and Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) recommend a layered security strategy. To accomplish this, states and utilities are looking at how to best prioritize their investments. While building physical walls around substations is one solution, the United States has roughly 60,000-75,000 substations and it would not be practical to do this at every location. Technology solutions, remote monitoring and strong collaboration will be needed to ensure efficient investments in physical energy security.  

Recent Physical Attacks on Grid Infrastructure Highlight Vulnerabilities 

Energy is the critical infrastructure sector that enables other critical infrastructure sectors to operate, making it an attractive target to malicious actors. Recent attacks have occurred against a range of grid infrastructure using a variety of destructive means. 

Washington state saw four substations near Tacoma attacked on Christmas Day 2022 in an apparent effort to cut power so the assailants could commit a burglary. In early December, intruders breached the gates and opened fire on two substations in Moore County, N.C., knocking out power to nearly 50,000 people. This attack was described as “fairly sophisticated,” executed by someone with knowledge of the substations. In Oregon on Thanksgiving Day, two intruders cut through the fencing around a substation in Clackamas County, shooting and disabling numerous pieces of equipment and causing significant damage. Utilities reported other recent incidents in the region to the DOE as well, including arson and sabotage. 

There have also been attacks motivated by extremist ideologies. In Maryland in January 2023, authorities foiled an alleged conspiracy to attack multiple substations around Baltimore with the intent to cause chaos and unrest across the city. Another similar plot in Ohio was blocked earlier in 2022. In January 2023, a man detonated explosives at two transformers near San Jose, Calif., destroying both and cutting power to thousands of residents. Upon his arrest, additional explosives were found at the suspect’s home; much more damage could have been done if the local utility and law enforcement had not worked together to identify and arrest the alleged attacker.

How Have State Legislatures Responded? 

To protect the energy system more fully from human-caused physical threats, state legislatures have stepped up to bolster the security of America’s electric grid, harden energy infrastructure and support quick and effective response to incidents. While some of these bills came after specific incidents and appear to address related issues, legislatures across the country are recognizing the increasing threat of physical attacks and intrusions on grid infrastructure and taking action to protect the energy system. 

For example, following the still-unsolved substation attacks in North Carolina, lawmakers have introduced HB 21 (pending 2023) that would require all public utilities that are not owned by municipalities to provide 24-hour security systems for substations to protect from vandalism and physical attacks. SB 58 (pending 2023) meanwhile, would drastically increase penalties for damaging utility infrastructure. In addition to making a first offense a “Class B2 felony” instead of a misdemeanor, it would allow parties injured by infrastructure damage and its impacts to sue the perpetrator for damages and would remove an existing cap on punitive damages. South Carolina has introduced HB 3577 (pending 2023) to require utilities to install security cameras at all substations and establish a $30,000 fine for damaging an electrical substation. These bills aim to protect infrastructure and deter future attacks through physical security measures and increased penalties and liabilities for offenses.  

Other state legislators are taking additional preventive action and specifically planning for human threats to energy infrastructure. Minnesota introduced HB 1253 (pending 2023), which would require the PUC to issue an order requiring utilities to hire an independent analyst to assess grid security and how physical attacks could impact each utility’s substations and affect electricity service. The assessment must evaluate threats and vulnerabilities and recommend a security plan to better detect, deter and respond to physical threats. This bill would allow utilities to request cost recovery related to performing threat and vulnerability assessments, as well as the implementation of the recommended security plan, through customer rates. Connecticut introduced HB 6494 (failed 2023) that would have created a task force to study electric infrastructure security and how protections can be improved. New York AB 2896 (enacted 2023) added assessments under the supervision of state agencies, requiring the homeland security and emergency management agency to work with government and private entities to assess critical infrastructure vulnerability and develop strategies to protect against threats including terror attacks and man-made disasters. Perhaps in recognition of how attackers can exploit knowledge of vulnerabilities, Iowa SB 478 (pending 2023) would exempt certain information from disclosure to the state auditor during government audits if it would jeopardize the security of critical infrastructure, which includes electric, petroleum-based, and biofuel transmission, distribution, and storage infrastructure. 

These bills aim to protect the electric grid, but also help bring focus on physical security to broader critical infrastructure and energy systems. Utah passed HB 370 (enacted 2023), which makes “destruction or tampering with a critical infrastructure facility” a felony, and HB 46 (enacted 2023), which makes interfering with or interrupting critical infrastructure a third-degree felony. These recent actions follow in the path of at least 18 other states that have enacted similar laws enhancing protections or penalties for offenses against critical infrastructure. Legislation specifically relating to oil and natural gas infrastructure has also gained attention. Texas HB 1722 (pending 2023) would establish an oil and gas infrastructure security division within the state’s Railroad Commission to protect oil and gas infrastructure from natural and human-caused threats including acts of terrorism.

Federal Action and Other Support for Energy Security

While the federal government has warned of potential physical threats to the grid for decades, it has increasingly emphasized the threat as attacks increase. The U.S. Department of Homeland Security issued two separate warnings about critical infrastructure threats in 2022. There are several ongoing efforts and new resources available to support states’ energy security efforts. A Congressional Research Service Report from February 2023 further details recent federal actions on the physical security of the grid, such as revisiting North American Electric Reliability Corporation (NERC) standards and Federal Energy Regulatory Commission (FERC) regulations, new grid security measures included in the Infrastructure Investment and Jobs Act (IIJA) and a general look into potential focal areas for the 118th Congress. 

Different sources of federal funds and other assistance are available that state legislatures can leverage. Included in the IIJA, the U.S. Department of Energy’s Preventing Outages and Enhancing the Resilience of the Electric Grid grant program (section 40101) provides formula funds to states and competitive grants to industry to strengthen and modernize grid infrastructure to withstand wildfires, extreme weather and natural disasters. While the program is not focused on human threats, investments through this program such as pole, power line and substation hardening upgrades, undergrounding, and monitoring technologies, may have the auxiliary benefit of strengthening physical security. In addition to helping the state prioritize their disbursement, state legislatures may be able to support some of the cost match for eligible subgrantees including utilities, grid operators, electricity generators and fuel suppliers.  

Section 40109 provides financial assistance to develop, revise, and implement State Energy Security Plans (SESPs) as defined by section 40108 of the legislation. All states and territories have a SESP which provides important information about physical and cybersecurity threats to energy infrastructure, discusses mitigation of the risk of energy supply disruptions and are designed to improve response and recovery coordination between state agencies, tribal nations, and regional partners. The DOE released framework and guidance on how states can address the six Congressionally required elements that must be included in the plan. Among these requirements are a risk assessment and risk mitigation plan. 

Under the Energy Policy Act of 2005 Section 215, the North American Electric Reliability Corporation was required to work with industry and government entities to draft physical security and other security-related standards, which can then be approved and enforced by FERC. In December, the FERC ordered a review of security standards at electric transmission facilities and control centers, which were first established after a California substation attack in 2013. FERC’s findings and recommendations were released in April 2023; a summary can be found here. 

The Federal Energy Regulatory Commission has also established a Joint Federal-State Task Force on Electric Transmission to ensure close cooperation between federal and state regulators on transmission-related issues. This task force has been increasingly focused on human-caused threats to the grid in light of the many recent high-profile attacks and extremist plots.  

Fusion centers are also very helpful resources to coordinate between law enforcement, state energy officials and the private sector. States already support fusion centers, which bring together law enforcement, public safety officials, and private sector partners to quickly share information, respond to threats, and coordinate efforts around energy security and public safety goals. 

The U.S. Department of Justice Bureau of Justice Assistance’s Fusion Center Guidelines identify energy entities as “mission critical” partners in fusion center collaboration efforts. However, many fusion centers still have gaps in information sharing with state energy and emergency officials and private sector partners that own and operate energy infrastructure. In line with the federal guidelines, state legislatures can continue supporting the efforts of fusion centers and help to fully include energy sector partners so information can be efficiently shared and utilized to improve grid security. 

Texas is currently considering legislation (SB 2377) that would establish a new “Homeland Security Fusion Center” to, among other things, improve intelligence sharing with private sector utilities and others operating critical infrastructure such as electric grid or pipeline facilities. Legislation pending in Minnesota (HB 41) would direct the state’s Fusion Center—which is open to private sector partners in federally-designated critical infrastructure sectors—to report annually to the legislature on its activities. These reports must include several elements, such as info on the number suspicious activity reports received and how the Fusion Center responded. If enacted, the bill may help give legislators useful data to better understand the threat landscape and determine if any gaps exist in the fusion center’s coordination with various partners.