FBI warned of neo-Nazi plots as attacks on Northwest grid spiked

As a string of attacks on electrical substations unfolded in Oregon and Washington in 2022, the FBI was warning utilities of white supremacists’ plots to take down the nation’s power grid. A KUOW/OPB investigation reveals the scope of the threat to the Northwest grid.

A

white pickup truck with a rack of roof lights blazing pulled up to an electrical substation in the small town of Morton, Washington, about 70 miles south of Seattle, on June 16. In the predawn dark next to the city cemetery, a man in a dark hoodie and baseball cap hopped out of the truck. He broke a steel gate apart, likely with a crowbar later found at the scene, and walked inside the fenced facility, on his way to sabotaging its high-voltage transformers.

Electrical substations transform high-voltage electricity to the lower voltages that keep America’s lights on, its food cold, its medical devices operating, and its phones charged. Far-flung substations can be difficult to secure. Damaging even a single one can shut off critical services to thousands of people.

Attacks like the one in Morton are on the rise in the Northwest: There have been 15 since June, more than in the previous six years combined. The recent attacks make this region a hotspot for such activity, according to a joint investigation by KUOW and Oregon Public Broadcasting. In most cases, the motives aren’t known. But as the FBI and extremism researchers have noted, neo-Nazis have been calling for just such attacks.

“The individuals of concern believe that an attack on electrical infrastructure will contribute to their ideological goal of causing societal collapse and a subsequent race war in the United States,” according to an FBI memo obtained by KUOW and OPB.

The substation in Morton that was attacked in June is connected to transmission lines that deliver hydropower from the Cowlitz Falls Dam. The energy coursing through those lines is more than 500 times the voltage that comes out of light sockets or power outlets and, experts say, is easily lethal to anyone foolish enough to mess around with it.

Despite the danger, the Morton substation intruder entered the facility and deliberately damaged equipment. (To avoid inspiring copycat crimes, KUOW and OPB are omitting details of techniques used in this attack and others).

“I saw a white flash through the garage door window,” one eyewitness across the street told Morton Police. “The power cut off.”

The 4 a.m. incident plunged about 7,500 customers, or most of the eastern half of rural Lewis County, into darkness for several hours, according to police.

The intruder climbed back into the passenger seat of the truck, which sped off to the north, according to another eyewitness.

A KUOW and OPB investigation has documented 15 physical attacks on electrical substations in Oregon and Washington in 2022. Locations are approximate.

The incursion kicked off a rash of attacks on the Northwest power grid in 2022, according to public records obtained by KUOW and OPB. It is unclear whether most of the attacks are connected.

As with most of them, no one has been arrested in the Morton attack, and no one has claimed responsibility.

A rash of attacks

Pacific Northwest utilities have reported a surge of attacks to the FBI in recent months. Attacks on substations in Oregon and Washington predate a December attack in Moore County, North Carolina, that left at least 40,000 people without power for days.

In some cases, the attacks appear to follow manuals disseminated online by neo-Nazis and other far-right extremists.

LISTEN ON NPR: White supremacists might be to blame for an uptick in power grid attacks in the PNW

For years, law enforcement and academics have warned about plots on the nation’s electrical grid from “accelerationist” groups that advocate, however implausibly, that taking down the grid will hasten the demise of the federal government and start a race war.

A Nov. 22 alert from FBI headquarters and the agency’s Newark field office warned of an increase of “threats to electrical infrastructure” from racially or ethnically motivated violent extremists (“RMVE”). Those would include white supremacists and other so-called accelerationists attempting to sow chaos.

“The FBI has received reports of threats to electrical infrastructure by threat actors who espouse RMVE ideology to create civil disorder and inspire further violence,” the FBI warning noted.

Weeks later, a second bulletin sent by the FBI’s Portland Field Office reported specific attacks in Oregon and Washington. The attacks were carried out using firearms, hand tools, flames, and chains “possibly in response to an online call for attacks on critical infrastructure,” according to the bulletin dated Dec. 2.

“In recent attacks, criminal actors bypassed security fences by cutting the fence links, lighting nearby fires, [and] shooting equipment from a distance,” the bulletin stated. “No theft was reported in either case, making it apparent that the intent was likely to disable electrical systems and not for monetary profit.”

A spokesperson for the FBI declined to comment on the bulletins obtained by OPB and KUOW but said people should report suspicious activity near substations to law enforcement.

Neo-Nazis plot to take down the grid

Plots by white supremacists to target electrical infrastructure in the United States have increased dramatically since 2016, according to a report published by the Program on Extremism at The George Washington University in September.

“The rise of accelerationist ideology and doctrine during the past decade likely fueled the increased risk of attack plots within white supremacist milieus targeting critical infrastructure, and the energy sector in particular,” according to the report.

The U.S. Department of Justice has charged six individuals with a “discernible, tangible connection” to neo-Nazi groups such as Atomwaffen Division and The Base with plots to destroy power lines, even a nuclear reactor, the report states.

Other white-supremacist plots have threatened electrical infrastructure in the Pacific Northwest.

In 2020 and 2021, federal prosecutors charged five neo-Nazis in connection with conspiracy to damage an energy facility. According to court documents filed by the government, one of the defendants carried a handwritten list of about a dozen locations in Idaho and surrounding states, each housing “a transformer, substation, or other component of the power grid for the Northwest United States, that if destroyed could cause damage” to the grid.

The goal, federal prosecutors stated, was “to attack the power grid both for the purpose of creating general chaos and to provide cover and ease of escape in those areas in which they planned to undertake assassinations and other desired operations to further their goal of creating a white ethno-state.”

Finally, in 2022, three white supremacists from Wisconsin, Ohio, and Texas pleaded guilty to conspiring to provide material support to terrorists. According to the Justice Department, each defendant agreed to take down substations in a different area of the country using high-powered rifles. They believed it could bring about unrest, financial ruin and even a race war, according to prosecutors.

Even though the motives behind most of the 2022 attacks are unclear, the history of white supremacists’ focus on the electrical grid has troubled law enforcement and extremist researchers.

“We're in a real wave of domestic extremist violence right now that's been increasing for several years,” said Mary McCord, a former acting attorney general for national security at the Department of Justice and now a professor at Georgetown Law School.

In many cases, it doesn’t matter to extremist groups who actually carries out the attacks, McCord said. Just the fact that the attacks are happening contributes to their goal of sowing discord.

“People might not know whether a particular attack on a power station or a power grid was part of an ideologically motivated plot or was just done for criminal purposes,” McCord said. “White supremacists and others who are seeking to advance their own causes for ideological reasons can use that to advance their purported goals of causing chaos, undermining the government, undermining general stability.”

Joshua Fisher-Birch, a researcher with the Counter Extremism Project, a nonprofit that tracks extremists groups' online activities, said the attacks in North Carolina and those in the Northwest have energized some on the far right.

“The recent substation attacks have been spoken about in glowing terms by certain members of the extreme right, particularly by neo-Nazi accelerationists and white supremacist accelerationists who subscribe to this ideology where they want to push chaos,” Fisher-Birch said.

Far-right forums online provide instruction manuals for how to attack substations and other critical infrastructure.

The design of the manuals invokes a video game and taps into costume-play subculture, according to Eric Ward, senior advisor at Western States Center, a Portland-based civil rights group that advocates against extremism.

“White nationalists have tapped into gaming and ‘cos-play’ in order to convince individuals that what they’re engaging in is nothing more than play and gaming,” Ward said. “It downplays the real consequences.”

The manuals plant dangerous ideas that can cause widespread harm and both those engaging in attacks and the websites allowing the manuals to proliferate should be held accountable, Ward said.

"For some people losing power isn't just an inconvenience," Ward said. "If you're on a breathing machine, if you need to refrigerate your insulin, access to electricity is a matter of life and death.”

Ward said by attacking the electrical grid, neo-Nazi groups want to show the “federal government is incapable of protecting itself and the American public.” Their goal, he said, is to erode the public’s trust in government.

Despite an uptick in grid attacks by unknown actors, most accelerationist activity remains online, according to Ross Johnson, a grid-security consultant on Canada’s Vancouver Island.

“We have accelerationists in the United States, they're in Canada, and they're in Europe,” he said. “We don't see them very often. A lot of it is just talk, thankfully.”

“I think their logic is very twisted,” Johnson said.

A national hotspot

Using utility sources, police reports, and a U.S. Department of Energy database of disturbances to the electrical grid, KUOW and Oregon Public Broadcasting confirmed a wave of 15 physical attacks on substations in the Pacific Northwest since June.

The incidents accelerated toward year’s end, with 10 of 15 attacks in 2022 taking place in November and December. (The tally for previous years includes incidents listed in the federal database as physical attacks, vandalism, suspicious activity, or sabotage. With local information sources, we confirmed that all 15 incidents in 2022 involved actual physical attacks on substations.)

The federal data also shows the West to be the hotspot for intentional damage to electrical infrastructure.

The western grid, serving 11 western states and the provinces of British Columbia and Alberta, has had more vandalism, sabotage, and physical attacks reported in the first eight months of 2022 than the rest of North America combined.

“Attacks on electric infrastructure are serious crimes and need to be treated as such,” Puesh Kumar, head of the U.S. Department of Energy’s Office of Cybersecurity, Energy Security and Emergency Response, said in an email. “We are asking the public—if you see something, say something—and encouraging utilities across the country to share information with law enforcement regarding any suspicious activities.”

Washington substations suffered a spate of attacks last summer and fall, starting in the southwestern part of the state. Three sites in the Grays Harbor area were targeted in June, August, and October, according to local utility officials. A substation in the Lewis County town of Toledo was hit in August.

November brought a flurry of attacks: two in Woodland, Washington, then two more at Puget Sound Energy sites in Pierce and Thurston counties, which the utility has declined to identify more specifically.

Two substations in Clackamas County, just southeast of Portland, were attacked on Nov. 24 and Nov. 28.

Two intruders “cut into the fence and used firearms to shoot up and disable numerous pieces of equipment and cause significant damage,” according to an email from a Bonneville Power Administration security official to police departments in the area.

Petty vandalism and attempts to steal copper are nothing new for electric utilities.

”But now we are dealing with quickly escalating incidents of sabotage,” the security official wrote.

Several of the Northwest attacks incorporated a similar technique for knocking out power documented by police at the Morton substation in June.

At least two of the 15 attacks in the Northwest also involved firearms, though officials have divulged few details.

Christmas attacks

Federal prosecutors say the four most recent attacks, on Christmas day in Pierce County, Washington, were carried out by two men who demonstrated no ideological motive, only a desire to knock power out so they could commit burglaries at local businesses. According to federal charging documents for Matthew Greenwood and Jeremy Crahan of Puyallup, Washington, Greenwood confessed to the four attacks and told the FBI he and Crahan had gone to an unnamed local business during the blackout, drilled its door lock, and stolen from its cash register.

The Pierce County Sheriff’s Office reports several burglaries Christmas morning, with one business in the blackout area, the Thai Bangkok restaurant, having its door lock drilled and about $100 taken from its cash register.

“The recklessness and the lack of judgment that is displayed in order just to commit some burglaries by putting the power out in four separate locations, it's just beyond words,” federal judge J. Richard Creatura said at a detention hearing for Greenwood in January in Tacoma. Both defendants remain in custody.

Federal prosecutors said in court they found no evidence the men had motives beyond burglary, though they told the judge they had not yet searched the men’s phones for evidence of extremist ties.

“Despite the arrests that occurred in Tacoma, we have not slowed down our efforts to further harden our substations and protect them in a physical manner,” Bonneville Power Administration spokesperson Doug Johnson said. “The arrests are encouraging, but we believe that the threat still exists.”

Keeping the lights on

Protecting a vast network against intentional attack is, depending who you talk to, costly or impossible. Some 700,000 miles of transmission lines crisscross the continent, with more than 50,000 substations punctuating the grid in urban, suburban, and rural locations.

North America’s far-flung power grid is currently fragile enough that it doesn’t take a sophisticated plot to quickly knock out power to thousands of people. The Tacoma area’s Christmas day attackers, in their apparent quest to rob a Thai restaurant and other businesses, managed to quickly do $3 million in damage to two substations that will take three years to repair, according to federal prosecutors.

The attackers also managed, perhaps by sheer luck, not to kill themselves.

“It really is amazing to me that there hasn't been a fatality for one of these vandals or thieves or whoever attempts to gain entry to a substation without the proper training,” said Ian Cope with the Grays Harbor Public Utility District, the target of three substation attacks in 2022. “For someone to seek entry to a substation and attempt to do damage is incredibly dangerous.”

The rash of attacks since November has forced conversations about additional security.

“We are making more investments and hardening the measures that we take to secure our substations and power lines,” said Johnson, with the Bonneville Power Administration. “There will be further discussions across the board for electric utilities with regard to what we can do to protect electrical service and keep it reliable.”

Proposed measures to protect the grid and keep America’s lights on range from coats of armor to artificial intelligence.

The Idaho National Laboratory has developed a bulletproof armor that can fit over transformers like a military-grade steel hood.

Others pitch higher-tech forms of surveillance as a more affordable form of security.

“It used to be that the cost of monitoring was really expensive because you had to get a signal or signals back to the monitoring center, and then you had to pay somebody to sit there and look at them,” security consultant Ross Johnson said.

Now, in tandem with ever-cheaper video cameras, artificial-intelligence programs can scan many video streams at once for anything unusual — say, a human, ladder, or bolt cutter where it shouldn’t be — and alert humans to the potential problem.

“I'm very optimistic about the future of substation security,” Johnson said.

Utilities are required to have measures in place on their most critical assets to prevent cascading or uncontrolled power outages. Utility industry officials say the recent grid attacks in the Northwest and North Carolina hit smaller substations that were unlikely to lead to any cascading outages and were not required to have defensive measures in place.

Shortly after the North Carolina attack, the Federal Energy Regulatory Commission, which regulates the interstate transmission of electricity, launched a 4-month study aimed at determining whether physical security measures should be mandated at all power plants, substations, and control centers nationwide.

How much any additional security measures would boost the cost of powering America’s lights, appliances, and vehicles remains unclear.