TRANSCRIPTJUDY WOODRUFF: Now, just how vulnerable is the United States’ electrical power grid? It’s a question getting new attention, after The Wall Street Journal published a detailed account of an organized sniper attack on an electrical substation near San Jose, California, last April.
Shortly before 1:00 a.m., someone cut telephone cables near the substation. About a half-hour later, multiple gunmen quickly fired dozens of shots at 17 transformers inside the perimeter of the station. Fifteen minutes later, transformers began to fail.
But officials managed to avoid serious disruptions by rerouting power. The shooters escaped before police arrived, and they have not been caught. The chairman of the Federal Energy Regulatory Commission at the time of the attack, Jon Wellinghoff, has described it as the most serious domestic terror attack on the grid.
Yesterday, I recorded a two-part conversation about this incident, starting with Wellinghoff.
Jon Wellinghoff, thank you for being here.
How much of a concern is this to you, what happened last April?
JON WELLINGHOFF, Former Chairman, Federal Energy Regulatory Commission: Well, thank you Judy. I appreciate the opportunity to be here.
It’s a great concern to me, because this does evidence that there are individuals out there who have the capability to plan and carry out a very sophisticated attack on our nation’s grid. And so, given that knowledge and given the fact that we have some very vulnerable aspects to that grid, we need to step up our efforts to protect it.
JUDY WOODRUFF: What — what made this particular station vulnerable?
JON WELLINGHOFF: Well, it’s not any different really than multiple other stages.
It’s a high-voltage transformer station that transforms power from generating stations out to the transmission lines. It is really very much like numbers of others, 100 or so other very high-voltage ones around the country that has very little protection.
It’s only protected by a chain-link fence and in some instances some video cameras and lights internal to the station. Other than that, it’s very open to attack, and this was attacked from the outside. They didn’t even get through the chain-link fence. They actually shot through the fence from 40 to 60 yards outside of the facility.
JUDY WOODRUFF: Why did you call it a terrorist attack?
JON WELLINGHOFF: Well, I don’t think there’s any need to have any particular label on it.
What the facts are, though, is the issue of, in fact, you had individuals who purposely attacked a station, and did so with a very, very detailed plan that they then turned over to individuals who were extremely well-trained and knew exactly what they were doing.
So, regardless of who the individuals were, we know now that there are people with these kinds of capabilities who can carry out this type of an attack on what is a very vulnerable part of our grid.
JUDY WOODRUFF: When you say they were well-trained, I mean, what does that — what does that tell you about what this attack represents? Does that mean they had to study this station, they had to study the grid? What does it mean?
JON WELLINGHOFF: They definitely had to study the station.
They, in fact, it appears, set up targeting positions prior to them arriving at the station, so they had somebody come out ahead of time and determine exactly where to set up and shoot. They also had to determine where the 911 cable was, the fiberoptic cable that they cut prior to going in the station to reduce the number of 911 calls.
So they had a number of specific pieces of information they pieced together. They also knew exactly where to target on the station. They, in fact, targeted the cooling fins on these high-voltage transformers, rather than hitting the transformers or their glass bushings. So they knew that in targeting those cooling fins, they could start the oil to leak out of the fins, cause those transformers to have to shut off, but still have plenty of time to get away, as they did.
JUDY WOODRUFF: And yet, it’s been pointed out, as we said, that power wasn’t lost to people, to folks who use power in the area. Does that say something about the resiliency of the power grid?
JON WELLINGHOFF: Well, I’m not sure it’s so much resiliency or as luck or as to the time that this attack took place.
It took place during a very low-level load time, where there wasn’t a lot of power being used. It was in the spring and it was at night. So those are the times when the least amount of power is being used and the least stress on the system.
If the attack had taken place, for example, in the middle of summer in a very high-power usage time, there might have been a different result, number one. Number two, they actually missed three transformers here in the substation. Those three transformers were able to keep up the entire Silicon Valley area. Without those transformers, there would have been a black out, ultimately, and, again, there could have been blackouts if it had been during the summer.
So I’m not sure that it’s a testament to resilience as it was a testament to just luck and circumstances.
JUDY WOODRUFF: Well, how much — how worried should all of us be about the vulnerability of this nation’s electrical grid, power grid?
JON WELLINGHOFF: I think we should be extremely worried, because, in fact, there are a limited number of high-voltage transformer substation nodes within the country.
And a coordinated attack, physical attack on those nodes could do us a great deal of damage, including causing massive blackouts across the country. And those nodes are currently not being protected in any way, other than, as I say, primarily a chain-link fence. There’s no guards 24/7.
There’s no obscuring of the targets with inside, and there’s also very little protection around those targets.
JUDY WOODRUFF: But some steps have been taken to harden these other substations, haven’t there been, since this happened?
JON WELLINGHOFF: There may have been some steps taken, but they have not been extensive yet.
I have briefed a number of utility executives. I know they’re taking this very seriously. We can’t put any blame on those executives. I think they are taking this as seriously as they can. But we have to understand, this is not a problem for individual utilities. This is a national problem, because, in fact, there are national consequences to these blackouts. And so it has to be something that should be undertaken by Congress and the administration.
JUDY WOODRUFF: So what needs to be done? Can this kind of an attack be — actually be prevented in the future?
JON WELLINGHOFF: It can be — the risk can be reduced substantially. You can never prevent someone from trying to attempt an attack.
But, certainly, you can do simple things like make the fences around these stations opaque, so you can’t see through them. Beef up the camera security, the lighting security. And you can do things like put physical concrete barriers in front of the transformers, like they do in areas overseas where they have critical infrastructure facilities.
There’s a number of things that can be done. And I know that things are moving forward, but, ultimately, I think we need an agency and an administration to be given the authority, like the NRC, the Nuclear Regulatory Commission, has authority over security at power plants, nuclear power plants. We need to have a similar type authority over these grid stations.
JUDY WOODRUFF: Well, it certainly managed to get all of our attention.
We thank you, Jon Wellinghoff.
JON WELLINGHOFF: Thank you, Judy.
JUDY WOODRUFF: For a second view on these questions, we turn to Mark Weatherford, a former deputy undersecretary for cyber-security at the Department of Homeland Security during the Obama administration. He’s also served as the chief of security for the North American Electric Reliability Corporation, which was formed by the power industry to guarantee the reliability of bulk power. He’s now with the Chertoff consulting group.
And we welcome you to the program.
You just heard Mr. Wellinghoff say that he’s very concerned about this. How concerned are you?
MARK WEATHERFORD, Former Deputy Undersecretary, Department of Homeland Security: Oh, I’m concerned as well.
I think the — probably the biggest issue here is that we have focused an awful lot the past couple years on cyber-security within the electricity industry. And this incident is an example of maybe we were focusing too much on the wrong thing, when a simple physical attack like this was able to do this kind of damage.
JUDY WOODRUFF: We talked about it. At one point, he had called this a domestic terrorist attack, the worst of its kind on the power grid. Do you consider it the same thing?
MARK WEATHERFORD: Well, certainly, the chairman had been — had access to and briefed in much more detail than I have. And I am not in the law enforcement game, so I really — I wouldn’t presume to call it a terrorist event. I just don’t have enough information to do that.
It’s certainly something concerning. It is something that was focused. I think it was targeted. It was well-planned-out. So it wasn’t just a couple of guys deciding to go off and shoot a couple rounds at a substation.
JUDY WOODRUFF: Which you were telling us sometimes happens around the country. But this was on a much larger scale.
So what does it say to you about how worried all of us should be about the power grid?
MARK WEATHERFORD: Well, I don’t know that I would say worried.
One of the things that the chairman mentioned was that we can never mitigate our risk down to zero. I mean, we’re not going to live in a risk-free environment. But what we can do is, we can apply some mitigation steps to some of these substations and to some of the other facilities around the country.
The power companies, the utility industry is actually devoting a lot of resources to this already, as the chairman said, to hardening the substations, to putting up barriers. And there’s a lot of new technologies out there that are providing new capabilities for linking the people and the technology components of these remote substations.
And that’s — you can imagine, that’s a challenge. There’s about 45,000 of these substations around the country, obviously, some in more critical areas than others, many in rather rural areas, and some in very urban areas.
JUDY WOODRUFF: Well, I know — he didn’t say this on camera, but I know my colleagues, in talking to him earlier today, he pointed out there may be thousands of substations around the country, but he said there are a much smaller number that are vulnerable in the way that this station was in California.
MARK WEATHERFORD: Well, I wouldn’t say that they’re not more vulnerable, but they’re more critical to the bulk power system, and — because of the location where they are.
This Metcalf substation obviously was in a very sensitive and critical location. But I think, as you pointed out in the interview, it speaks to the reliability of the bulk power system that the operators and the system was able to continue without really even the lights blinking. No one even knew that the event had happened.
JUDY WOODRUFF: But didn’t he say that was mainly because it was spring, there wasn’t a high demand for power at that time of year?
MARK WEATHERFORD: So, I think those are factors.
But I don’t necessarily agree with him on the entire concept there, because the bulk power system is designed to be able to absorb these kinds of the incidents and events. Substations go offline, I won’t say all the time, but it happens. And it happens during nature events. It happens during other kinds of events. They go offline, and, typically, the system heals itself without people even knowing about it.
JUDY WOODRUFF: What about his final point that this is something that the federal government needs to get involved in, that Congress needs to pay attention to, national regulatory attention? He talked about some of the things that need to be done to harden these sites.
But, essentially, his point was that the country, the government needs to focus on this much more than it has been.
MARK WEATHERFORD: There are a few things I think that the government should do.
I always get a little anxious when we start thinking about more regulation. This is an industry that’s already very regulated. But there are a few things that can be done. You know, there’s — certainly, better information-sharing between the government and the private sector is always going to be something I think that the government can do more of.
One of the things I think that would help a lot, and that is if the government could work with the state public utilities commissions and help the state PUCs understand this issue better, because there’s a bit of a gap right now, a bit of a divide between what the federal government is doing and what the state — the 48 PUCs in the continental United States are doing.
JUDY WOODRUFF: Well, we appreciate it. I know it’s a much bigger subject, but we thank you for coming in. Mark Weatherford, thank you.
MARK WEATHERFORD: Thank you, Judy.