Monday, October 19, 2026

Grid · Monday, October 12

Distribution attacks on substations are no longer hypothetical

The last several years have brought a run of physical incidents. Most failed to cascade. The trend is the point.

by: Andrew, Co-Founder at Blackout Briefing

Utilities and the FBI have logged a rise in physical attacks and plots aimed at substations — gunfire, sabotage, sometimes ideology, sometimes something murkier. Most have not produced a Metcalf-scale result. Security planners do not grade attempts only by the ones that succeed.

The trend is the point because a miss still shows that someone treated a fenced yard of grid equipment as a target. Planners count the approach, not only the outage. A run of incidents that stay small is how a threat stops being hypothetical without ever becoming a regional blackout.

The public piece is awareness without paranoia. Fenced yards full of steel are not abstract. If you live beside one, trespassing is not curiosity, and a drone over the buswork is not a hobby the utility finds charming.

You do not need the one-line diagram. You need to know that the yard is not a park, a photography backdrop, or a shortcut. The equipment inside is energized, expensive, and slow to replace. A person with no bad intent can still pull a response the utility would rather spend on an actual intruder.

Report what you actually see. Do not freelance a defense. The people who should arrive are the ones with the keys and the radios.

What you actually see means lights that do not belong, a gate that is open when it is usually shut, people inside the fence, the sound of something being broken. It does not mean a theory about the grid. Use the number posted on the fence, say what you saw, and let them sort it. A neighbor who decides to intervene is a second incident.

Most of these events have stayed local. Local is not the same as minor to the people who lose power, and it is not a reason to invent a cascade every time a substation is in the news. The useful posture is dull: notice the yard, stay out of it, report the concrete thing, go back inside.

Sources

  1. CIP-014-3 — Physical Security — North American Electric Reliability Corporation · the article this brief was written from
  2. Evaluation of the Physical Security Reliability Standard and Physical Attacks on the Bulk-Power System — Federal Energy Regulatory Commission
  3. Electromagnetic Pulse and Geomagnetic Disturbance — Cybersecurity and Infrastructure Security Agency

More in Grid

Recent news