The Metcalf Substation incident, 16 April 2013: the 'terrorist' event you never heard of

[Bill Ryan]

.
Hi, All:

I'd never heard of this, either, till I listened to Jeff Rense's 31 March 2016 interview with author Matthew Bracken here: (Strongly recommended, btw)

http://projectavalon.net/Matt_Bracke...e_and_more.mp3

Bracken and Rense both knew about this incident. But it was new to me. Here's one of the few references on the net, an article about the event in the Wall Street Journal, that was published nearly a year later.

http://wsj.com/articles/SB1000142405...59141941621778

Curiously, after listening to the show I was able to view this page and, on instinct, I saved it as a PDF. Today, despite clearing cookies and trying four different browsers, I cannot view the article without creating an account and signing in.

Here's the PDF (also embedded below)

http://projectavalon.net/Metcalf_Sub...5_Feb_2014.pdf

Read with great interest (and maybe astonishment). It's a scene straight out of a Hollywood political /terrorist/ action thriller.

As Bracken and Rense both agreed, this looked exactly like a highly specialized, professional military-style 'proof of concept' attack on the American grid. If this happened again on a large, co-ordinated scale, millions of people would die in the ensuing power-outage chaos.

~~~~~

Assault on California Power Station Raises Alarm on Potential for Terrorism

April Sniper Attack Knocked Out Substation, Raises Concern for Country's Power Grid

By Rebecca Smith, February 5, 2014


SAN JOSE, Calif.—The attack began just before 1 a.m. on April 16 last year, when someone slipped into an underground vault not far from a busy freeway and cut telephone cables.

Within half an hour, snipers opened fire on a nearby electrical substation. Shooting for 19 minutes, they surgically knocked out 17 giant transformers that funnel power to Silicon Valley. A minute before a police car arrived, the shooters disappeared into the night.

To avoid a blackout, electric-grid officials rerouted power around the site and asked power plants in Silicon Valley to produce more electricity. But it took utility workers 27 days to make repairs and bring the substation back to life.

Nobody has been arrested or charged in the attack at PG&E Corp.'s Metcalf transmission substation. It is an incident of which few Americans are aware. But one former federal regulator is calling it a terrorist act that, if it were widely replicated across the country, could take down the U.S. electric grid and black out much of the country.

The attack was "the most significant incident of domestic terrorism involving the grid that has ever occurred" in the U.S., said Jon Wellinghoff, who was chairman of the Federal Energy Regulatory Commission at the time.

The Wall Street Journal assembled a chronology of the Metcalf attack from filings PG&E made to state and federal regulators; from other documents including a video released by the Santa Clara County Sheriff's Department; and from interviews, including with Mr. Wellinghoff.

The 64-year-old Nevadan, who was appointed to FERC in 2006 by President George W. Bush and stepped down in November, said he gave closed-door, high-level briefings to federal agencies, Congress and the White House last year. As months have passed without arrests, he said, he has grown increasingly concerned that an even larger attack could be in the works. He said he was going public about the incident out of concern that national security is at risk and critical electric-grid sites aren't adequately protected.

The Federal Bureau of Investigation doesn't think a terrorist organization caused the Metcalf attack, said a spokesman for the FBI in San Francisco. Investigators are "continuing to sift through the evidence," he said.

Some people in the utility industry share Mr. Wellinghoff's concerns, including a former official at PG&E, Metcalf's owner, who told an industry gathering in November he feared the incident could have been a dress rehearsal for a larger event.

"This wasn't an incident where Billy-Bob and Joe decided, after a few brewskis, to come in and shoot up a substation," Mark Johnson, retired vice president of transmission for PG&E, told the utility security conference, according to a video of his presentation. "This was an event that was well thought out, well planned and they targeted certain components." When reached, Mr. Johnson declined to comment further.

A spokesman for PG&E said the company takes all incidents seriously but declined to discuss the Metcalf event in detail for fear of giving information to potential copycats. "We won't speculate about the motives" of the attackers, added the spokesman, Brian Swanson. He said PG&E has increased security measures.

Utility executives and federal energy officials have long worried that the electric grid is vulnerable to sabotage. That is in part because the grid, which is really three systems serving different areas of the U.S., has failed when small problems such as trees hitting transmission lines created cascading blackouts. One in 2003 knocked out power to 50 million people in the Eastern U.S. and Canada for days.

Many of the system's most important components sit out in the open, often in remote locations, protected by little more than cameras and chain-link fences.

Transmission substations are critical links in the grid. They make it possible for electricity to move long distances, and serve as hubs for intersecting power lines.

Within a substation, transformers raise the voltage of electricity so it can travel hundreds of miles on high-voltage lines, or reduce voltages when electricity approaches its destination. The Metcalf substation functions as an off-ramp from power lines for electricity heading to homes and businesses in Silicon Valley.

The country's roughly 2,000 very large transformers are expensive to build, often costing millions of dollars each, and hard to replace. Each is custom made and weighs up to 500,000 pounds, and "I can only build 10 units a month," said Dennis Blake, general manager of Pennsylvania Transformer in Pittsburgh, one of seven U.S. manufacturers. The utility industry keeps some spares on hand.

A 2009 Energy Department report said that "physical damage of certain system components (e.g. extra-high-voltage transformers) on a large scale...could result in prolonged outages, as procurement cycles for these components range from months to years."

Mr. Wellinghoff said a FERC analysis found that if a surprisingly small number of U.S. substations were knocked out at once, that could destabilize the system enough to cause a blackout that could encompass most of the U.S.

Not everyone is so pessimistic. Gerry Cauley, chief executive of the North America Electric Reliability Corp., a standards-setting group that reports to FERC, said he thinks the grid is more resilient than Mr. Wellinghoff fears.

"I don't want to downplay the scenario he describes," Mr. Cauley said. "I'll agree it's possible from a technical assessment." But he said that even if several substations went down, the vast majority of people would have their power back in a few hours.

The utility industry has been focused on Internet attacks, worrying that hackers could take down the grid by disabling communications and important pieces of equipment. Companies have reported 13 cyber incidents in the past three years, according to a Wall Street Journal analysis of emergency reports utilities file with the federal government. There have been no reports of major outages linked to these events, although companies have generally declined to provide details.

"A lot of people in the electric industry have been distracted by cybersecurity threats," said Stephen Berberich, chief executive of the California Independent System Operator, which runs much of the high-voltage transmission system for the utilities. He said that physical attacks pose a "big, if not bigger" menace.

There were 274 significant instances of vandalism or deliberate damage in the three years, and more than 700 weather-related problems, according to the Journal's analysis.

Until the Metcalf incident, attacks on U.S. utility equipment were mostly linked to metal thieves, disgruntled employees or bored hunters, who sometimes took potshots at small transformers on utility poles to see what happens. (Answer: a small explosion followed by an outage.)

Last year, an Arkansas man was charged with multiple attacks on the power grid, including setting fire to a switching station. He has pleaded not guilty and is undergoing a psychiatric evaluation, according to federal court records.

Overseas, terrorist organizations were linked to 2,500 attacks on transmission lines or towers and at least 500 on substations from 1996 to 2006, according to a January report from the Electric Power Research Institute, an industry-funded research group, which cited State Department data.

To some, the Metcalf incident has lifted the discussion of serious U.S. grid attacks beyond the theoretical. "The breadth and depth of the attack was unprecedented" in the U.S., said Rich Lordan, senior technical executive for the Electric Power Research Institute. The motivation, he said, "appears to be preparation for an act of war."

The attack lasted slightly less than an hour, according to the chronology assembled by the Journal.

At 12:58 a.m., AT&T fiber-optic telecommunications cables were cut—in a way that made them hard to repair—in an underground vault near the substation, not far from U.S. Highway 101 just outside south San Jose. It would have taken more than one person to lift the metal vault cover, said people who visited the site.

Nine minutes later, some customers of Level 3 Communications, an Internet service provider, lost service. Cables in its vault near the Metcalf substation were also cut.

At 1:31 a.m., a surveillance camera pointed along a chain-link fence around the substation recorded a streak of light that investigators from the Santa Clara County Sheriff's office think was a signal from a waved flashlight. It was followed by the muzzle flash of rifles and sparks from bullets hitting the fence.

The substation's cameras weren't aimed outside its perimeter, where the attackers were. They shooters appear to have aimed at the transformers' oil-filled cooling systems. These began to bleed oil, but didn't explode, as the transformers probably would have done if hit in other areas.

About six minutes after the shooting started, PG&E confirms, it got an alarm from motion sensors at the substation, possibly from bullets grazing the fence, which is shown on video.

Four minutes later, at 1:41 a.m., the sheriff's department received a 911 call about gunfire, sent by an engineer at a nearby power plant that still had phone service.

Riddled with bullet holes, the transformers leaked 52,000 gallons of oil, then overheated. The first bank of them crashed at 1:45 a.m., at which time PG&E's control center about 90 miles north received an equipment-failure alarm.

Five minutes later, another apparent flashlight signal, caught on film, marked the end of the attack. More than 100 shell casings of the sort ejected by AK-47s were later found at the site.

At 1:51 a.m., law-enforcement officers arrived, but found everything quiet. Unable to get past the locked fence and seeing nothing suspicious, they left.

A PG&E worker, awakened by the utility's control center at 2:03 a.m., arrived at 3:15 a.m. to survey the damage.

Grid officials routed some power around the substation to keep the system stable and asked customers in Silicon Valley to conserve electricity.

In a news release, PG&E said the substation had been hit by vandals. It has since confirmed 17 transformers were knocked out.

Mr. Wellinghoff, then chairman of FERC, said that after he heard about the scope of the attack, he flew to California, bringing with him experts from the Joint Warfare Analysis Center in Dahlgren, Va. After walking the site with PG&E officials and FBI agents, Mr. Wellinghoff said, the military experts told him it looked like a professional job.

In addition to fingerprint-free shell casings, they pointed out small piles of rocks, which they said could have been left by an advance scout to tell the attackers where to get the best shots.

"They said it was a targeting package just like they would put together for an attack," Mr. Wellinghoff said.

Mr. Wellinghoff, now a law partner at Stoel Rives LLP in San Francisco, said he arranged a series of meetings in the following weeks to let other federal agencies, including the Department of Homeland Security, know what happened and to enlist their help. He held a closed-door meeting with utility executives in San Francisco in June and has distributed lists of things utilities should do to strengthen their defenses.

A spokesman for Homeland Security said it is up to utilities to protect the grid. The department's role in an emergency is to connect federal agencies and local police and facilitate information sharing, the spokesman said.

As word of the attack spread through the utility industry, some companies moved swiftly to review their security efforts. "We're looking at things differently now," said Michelle Campanella, an FBI veteran who is director of security for Consolidated Edison Inc. in New York. For example, she said, Con Ed changed the angles of some of its 1,200 security cameras "so we don't have any blind spots."

Some of the legislators Mr. Wellinghoff briefed are calling for action. Rep. Henry Waxman (D., Calif.) mentioned the incident at a FERC oversight hearing in December, saying he was concerned that no one in government can order utilities to improve grid protections or to take charge in an emergency.

As for Mr. Wellinghoff, he said he has made something of a hobby of visiting big substations to look over defenses and see whether he is questioned by security details or local police. He said he typically finds easy access to fence lines that are often close to important equipment.

"What keeps me awake at night is a physical attack that could take down the grid," he said. "This is a huge problem."

[Carmody]

Joseph P Farrell has dome some reporting and some speculative writing on this specific event and other similar looking events. Here is a lead-in comment that may illustrate some of the potentials in connectivity.

THOSE ATTACKS ON COMPUTER NETWORK INFRASTRUCTURE IN THE BAY AREA ...

As you may have noticed, this past week I've been drawing attention to some peculiar news stories that somehow or other involve computer networks, database management and correlation, and cyber-warfare. In doing so I pointed out the recent claims coming from the Kremlin that there were serious hacking attempts that were being directed against Russia's upcoming elections, and more importantly, serious attacks on the office website of the Office of the President of the Russian Federation. You'll recall that I suggested that the Kremlin hack might somehow be connected to the strange spate of attacks on internet infrastructure and cables in the San Francisco Bay area of the United States, a connection suggested by the Russians themselves, who claim - without having provided any supporting evidence - that they had traced the hacks to an unnamed company in the San Franciso area.

And indeed, there has been a very peculiar and hardly "coincidental" spate of attacks of this nature within the Bay area of California, home, of course, to Silicon Valley and major technical and computer companies, home of Stanford, UCAL at Berkley, and a number of sensitive American research facilities connected with those institutions and the government, such as Lawrence Livermore laboratories. There was, you'll recall, even an attack on an electrical transforming substation at the southern tip of the area a couple of years ago, an attack executed quickly and with professional precision.

All this, in my blog about the Russian hack earlier this week, raised to my mind the distinct possibility that we may be looking at a full scale covert and cyber warfare going on in the world, and that the strange Bay area attacks may be connected to this pattern.

[Carmody]

Complicating the matter is severe under-reporting or even withholding of information, in cyber attacks, done with physical components in parallel occurrence, regarding stock trading, banking and security-technology-information systems.

For example, if a cyber criminal or group with such intent, uses computer based systems with a side order of a physical attack, in order to steal from a major banking or technology player, the technology and/or banking player.... will probably NOT report that they have been "robbed". They could never report that their systems of security or trading of stocks or whatnot, have weakness and holes. They'd lose their clientele and standing, if they reported it.

So they stay dark on how and when they have been robbed. Banks have been bilked out of billions in such manner, and almost no-one knows about such things, except for the fact that they happen --all the time.

Basically, another scenario...trillions could be stolen or recovered(!) in a scheme to prevent..lets say... an AI trading system that is a strong market player...from being able to trade, or interfere in markets. All it takes as a few seconds or minutes of that High frequency trading algorithm and/or AI ..being absent from the market. and that trading AI or algorithm, is probably stealing from everyone else, in the first place.

Find the weakness, the unguarded angle..... and slip the knife in.

Thus, to me, the attack on the substation was a component of an attack, not a primary attack all on it's own. I don't think it was a test of anything. If they know what and how to hit, then doing the substation attack is well enough done on paper, the outcome is already known. No need for the physical attack.

A physical attack would give a move away, a level away, for absolutely zero reason. It would be idiotic. Thus the substation attack was a COMPONENT of a more pointed and valuable attack, for reasons that have not been made public.

[Patrikas]

This is a report written by Jim Stone around 3 years ago it concerns not just substations but how the grid in us is being changed physically giving differences in times from the east to the westcoast as an excuse to isolate circuts which is simply BS I do not know if this has been carried out or completed certainly hope not .....
http://jimstonefreelance.com/grid.html

[Citizen No2]

I remember that report from 2014....... Am pretty sure it was reported by some of the MSM.

I recall watching one of Eric Dollard's videos (just tried looking for it but cannot find it) and what he was saying regarding the US grid was that it was totally exposed due to the way it was earthed (If I remember correctly), that as a result of this it was totally vulnerable to either EMP or a mass loading event........ It was in his view that this was by design as it required a lot more work to have it this way and that it made no sense from a power security point-of-view.


Regards.

To add:

There are quite a few vids on YooTube:

Source: https://youtube.com/watch?v=-NobRSJoZ5c

Source: https://youtube.com/watch?v=mUdo7jIFexs

[Zampano]

For example, if a cyber criminal or group with such intent, uses computer based systems with a side order of a physical attack, in order to steal from a major banking or technology player, the technology and/or banking player.... will probably NOT report that they have been "robbed". They could never report that their systems of security or trading of stocks or whatnot, have weakness and holes. They'd lose their clientele and standing, if they reported it.

Isnt that business as usual?

[Sierra]

I heard this, but I do not know if it's true.

Paradise is a town where virtually every house has its own septic system, the largest town of this nature in the U.S. The electrical grid went down a few years ago, but the system was successfully brought back up again. Which is good, because every septic tank in town would shut down if it it did not get a sensor response from the grid every 24 hours.

A PGE employee told someone, it was a Russian hack that brought down the system.

Sheesh. Paradise??? Why hit dinky Paradise, a town of 30,000 souls?

So gross. And whose idea was it anyway, that the entire septic system can be shut down for the lack of an enk-ack ping?

Monumentally stupid or extremely ingenious depending on the agenda.

[Patrikas]

Citizen No2
Heres the interview with Eric u spoke of ......the his theory on what is happening wit the grid starts at the 50 minute mark....50:00...........cheers

https://www.youtube.com/watch?v=s5fPR7Jc9u4

[Cardillac]

I think our biggest concern should be nuclear power plants: all, ALL of them are completely defenseless from an outside physical attack :-(

Larry

[M-Albion-3D]

Yes I remember this and was in the area during that time. Well ok, yep, just like in the UK, we get "fear porn" shoved down our throats too....nowhere near as much, but sick "main stream fear porn" nonetheless.


All bull crap...nothing to do with real terrorism. Makes me laugh if it wasn't so darn sickening!

[Citizen No2]

I do not believe for one minute that this was 'terrorists'.

The fact that this team were able to attack a primary facility and disappear into the shadows, and the fact that higher-up the chain of command there was no interest in pursuing the investigation any further can only suggest one thing............ Knowledge of which components to hit, and where those components were points to a very detailed knowledge of the system.

If I had to put money on who carried out this attack........... It just smells of a military SF unit.



Regards.

[Bill Ryan]

Posted by Citizen No2 (here)
I do not believe for one minute that this was 'terrorists'.

The fact that this team were able to attack a primary facility and disappear into the shadows, and the fact that higher-up the chain of command there was no interest in pursuing the investigation any further can only suggest one thing............ Knowledge of which components to hit, and where those components were points to a very detailed knowledge of the system.

If I had to put money on who carried out this attack........... It just smells of a military SF unit.

Right. Matt Bracken, talking to Jeff Rense, points out that this was a precision-organized military operation. In the Wall Street Journal article, it's reported that Mark Johnson, retired vice president of transmission for PG&E, states:

"This wasn't an incident where Billy-Bob and Joe decided, after a few brewskis, to come in and shoot up a substation. This was an event that was well thought out, well planned and they targeted certain components."

[Calz]

Cannot tell if this has yet been posted here.

If so forgive me.

Source: https://youtube.com/watch?v=CK4OqCK5oxY

[Bill Ryan]

Posted by Calz (here)
Cannot tell if this has yet been posted here.

If so forgive me.

Source: https://youtube.com/watch?v=CK4OqCK5oxY

Wonderful, thanks.

(Aside: a tech tip that's very useful. To see if a YouTube video has been posted, just enter the YouTube code CK4OqCK5oxY as a search term in Advanced Search)

[shaberon]

Not sure if I remember this one; it's sabotage, not terrorism.

I do remember the 2003 blackout in the northeast, and the vulnerability is that all that power is drawn from Canada.

Yes, this type of incident will definitely be under-reported for "copy-catting" as well as business reputation; but it is not that hard to do. If run strategically as a component of cyber or other attacks, it magnifies the devastation. I looked at a fenced cell tower for about three minutes, which was all it took to determine that it could be entered and damaged with something as simple as a crowbar pretty easily.

A nuclear plant takes a lot more than a crowbar or rifle to affect it seriously, but the overall grid of substations/wires/transformers is pretty much a sitting duck. It's been fairly well mapped out by Israelis, Chinese, and who really knows how many kinds of groups. Push comes to shove, and that stuff will be offline maybe forever.

[CD7]

MASSIVE COLLAPSE IS A G O O D T H I N G


Disabling this SORRY EXCUSE for a world is nothing associated with Terror ...IF anything allowing this world to continue IS THE MOST TERRIORIST ACT EVER ....

[Bill Ryan]

.
Two more interviews of Matt Bracken:

1) With Jeff Rense, 28 April 2016:

http://projectavalon.net/Matt_Bracke...l_2016_hr2.mp3 (20 Mb, 48 mins)

2) With Alex Jones, 2 May 2016:

Source: https://youtube.com/watch?v=8pdZPeCH7HM

[norman]

This 2nd Alex Jones interview is really shaking me up, bad.

The 2nd Rense interview was much calmer and salivated ready to swallow.

Startling stuff, all of it. SO bang-on in my left brain, for sure, my right brain is preoccupied firing off every alarm system in me.

Not sure i can cope through all that. I have a sickening feeling I will be 'hospitalised' well before it gets to the mushroom cloud scenario.

Ah well, hopefully, I've still got a cyber community to talk to................... for a while yet.

[norman]

Posted by Bill Ryan (here)

Posted by Citizen No2 (here)
I do not believe for one minute that this was 'terrorists'.

The fact that this team were able to attack a primary facility and disappear into the shadows, and the fact that higher-up the chain of command there was no interest in pursuing the investigation any further can only suggest one thing............

Knowledge of which components to hit, and where those components were points to a very detailed knowledge of the system.

If I had to put money on who carried out this attack........... It just smells of a military SF unit.

Right. Matt Bracken, talking to Jeff Rense, points out that this was a precision-organized military operation.

In the Wall Street Journal article, it's reported that Mark Johnson, retired vice president of transmission for PG&E, states:

"This wasn't an incident where Billy-Bob and Joe decided, after a few brewskis, to come in and shoot up a substation. This was an event that was well thought out, well planned and they targeted certain components."

I think this posted grasp of what actually happened at the sub station, is worthy of clarification and repetition for a while longer.

[ I've reformatted the above quotes, errr, obviously ]


edit to ask a question:

In the Wall Street Journal article, it's reported that Mark Johnson, retired vice president of transmission for PG&E, states:

If Mark Johnson lost out over the operation, has he been compensated or reassured yet?

another edit:

I get a bit lost and confused where, in his first Rense interview, he insists it's known trade-craft to use students.

At that point, I quickly feel I can not go further, without giving in to fuzzy thinking logic. What I'd call fuzzy thinking logic, at least.

Trying to wrap my head around the logistics of using both badged special forces AND drawn up Patsy muslim "boffins", is too strenuous for me. I mean, come on, who's intelligence service is really running this?

Perhaps someone else can explain it to me in easy to understand terms sometime.