Monday, October 19, 2026

Unrest · Monday, October 19

Attacks on substations are now a pattern in the public record

FERC and NERC have spent the years since Metcalf, and especially after 2022, talking about physical incidents as a reliability problem.

by: Andrew, Co-Founder at Blackout Briefing

The Federal Energy Regulatory Commission has put on the record that physical security incidents reported to the industry’s information-sharing center rose into the thousands, and that NERC was sent back to study whether the physical-security standard still fits the threat. That is not a rumor from a forum. It is a regulator describing its own standard.

A count in the thousands is a reporting fact and a volume fact. It covers a wide range of incidents, most of which never become a regional outage. Reading every report as if it were Metcalf misunderstands both the count and Metcalf. The regulator's point is the volume and the fit of the rule, not a claim that an interconnection is already unzipping.

Metcalf is the yard that moved physical damage from an odd crime story into a reliability conversation. This section will not recount a method. The policy effect is the part that belongs here: a standard was written, and after the reported incidents climbed, including in the period the record marks after 2022, the regulator sent that standard back to be looked at again.

Most incidents do not cascade. The trend is still the news. A grid planned for weather and for a single dramatic yard like Metcalf is now being asked how it behaves when harassment of equipment is ordinary.

A background rate is a different planning problem from a season of storms or from one exceptional yard. It asks for crews, for replacements of common equipment, and for a clear eye about fences that were never a national-security program. Those are budget facts. They are less satisfying than a single night with a name.

This section will not describe how those attacks were done. It will describe what the public record says changed: more incidents, a standard written for the worst yards, and a lot of ordinary fences in between.

The ordinary fences are the point. Much of the equipment the public loses is outside the mandatory set aimed at cascading sites. A piece that walked through tactics would be a different paper from the one the record supports. The record supports a plainer line: incidents became numerous enough that the regulator asked whether the rule still matched the threat.

Sources

  1. CIP-014-3 — Physical Security — North American Electric Reliability Corporation · the article this brief was written from
  2. Evaluation of the Physical Security Reliability Standard and Physical Attacks on the Bulk-Power System — Federal Energy Regulatory Commission
  3. Electromagnetic Pulse and Geomagnetic Disturbance — Cybersecurity and Infrastructure Security Agency

More in Unrest

Recent news