Grid · Monday, October 12
Distribution attacks on substations are no longer hypothetical
The last several years have brought a run of physical incidents. Most failed to cascade. The trend is the point.
by: Andrew, Co-Founder at Blackout Briefing

Utilities and the FBI have logged a rise in physical attacks and plots aimed at substations — gunfire, sabotage, sometimes ideology, sometimes something murkier. Most have not produced a Metcalf-scale result. Security planners do not grade attempts only by the ones that succeed.
The trend is the point because a miss still shows that someone treated a fenced yard of grid equipment as a target. Planners count the approach, not only the outage. A run of incidents that stay small is how a threat stops being hypothetical without ever becoming a regional blackout.
The public piece is awareness without paranoia. Fenced yards full of steel are not abstract. If you live beside one, trespassing is not curiosity, and a drone over the buswork is not a hobby the utility finds charming.
You do not need the one-line diagram. You need to know that the yard is not a park, a photography backdrop, or a shortcut. The equipment inside is energized, expensive, and slow to replace. A person with no bad intent can still pull a response the utility would rather spend on an actual intruder.
Report what you actually see. Do not freelance a defense. The people who should arrive are the ones with the keys and the radios.
What you actually see means lights that do not belong, a gate that is open when it is usually shut, people inside the fence, the sound of something being broken. It does not mean a theory about the grid. Use the number posted on the fence, say what you saw, and let them sort it. A neighbor who decides to intervene is a second incident.
Most of these events have stayed local. Local is not the same as minor to the people who lose power, and it is not a reason to invent a cascade every time a substation is in the news. The useful posture is dull: notice the yard, stay out of it, report the concrete thing, go back inside.
Sources
- CIP-014-3 — Physical Security — North American Electric Reliability Corporation · the article this brief was written from
- Evaluation of the Physical Security Reliability Standard and Physical Attacks on the Bulk-Power System — Federal Energy Regulatory Commission
- Electromagnetic Pulse and Geomagnetic Disturbance — Cybersecurity and Infrastructure Security Agency
More in Grid
- Metcalf still explains the grid better than most white papers
by: Andrew, Co-Founder at Blackout Briefing
- San Antonio’s hardening pilot is a template, not a finish line
by: Andrew, Co-Founder at Blackout Briefing
- Inverter-based resources changed where the grid can break
by: Andrew, Co-Founder at Blackout Briefing
Recent news
EMP
The civilian grid is still the soft target in a high-altitude pulseby: Andrew, Co-Founder at Blackout Briefing
CME
A Carrington-class storm is a when, not a science-fiction ifby: Andrew, Co-Founder at Blackout Briefing
Survival
The first seventy-two hours are a sequence, not a vibeby: Andrew, Co-Founder at Blackout Briefing
