NBC Bay Area drove 1,600 miles and made 14 unannounced visits to nine of PG&E’s largest and most critical substations to put the corporation’s promise of enhanced security to the test. Chief Investigative Reporter Tony Kovaleski goes undercover in a story that aired on September. 22, 2014.
Security vulnerabilities still exist at many of Pacific Gas & Electric Company’s critical electric substations, an NBC Bay Area undercover investigation and threat assessment expert have found.
The Investigative Unit observed and tested PG&E’s security during more than a dozen unannounced visits to many of California’s biggest and most critical electric substations. The investigation exposed potential holes in the utility corporation’s enhanced security network at many of the locations a year and a half after gunmen attacked a PG&E substation in South San Jose, shutting it down for nearly a month.
Substations are located in virtually every community, though some are larger than others. The facilities are often situated in remote areas with little more than chain link fences with barbed wire tops protecting transformers and other critical equipment. Transformers convert high voltage electricity from power plants and distribution lines to lower-voltage power suitable for homes and businesses.
On April 16 last year, attackers shot 100 high-powered rifle rounds into 17 transformers at the Metcalf substation. The incident lasted just 19 minutes and had the potential to black out much of Silicon Valley.
The Federal Bureau of Investigation has not officially labeled the attack an act of terrorism, but many observers disagree. Sources including sheriff’s deputies who responded to the incident, a high-ranking federal energy regulator and congressional leaders have all raised concerns that the Metcalf attack may foreshadow a more robust plan.
“A trial-run is what it looked like to me,” Congresswoman Zoe Lofgren said of the attack on the substation, which is located in her district. “This was a pro job and I hope the FBI is successful at catching them.”
Local
But a year and a half later, no one has taken responsibility and the FBI has not made an arrest.
“Those substations need to have enhanced security,” Lofgren said. “There was basically none at PG&E. They weren’t expecting this.”
For decades, government documents have pointed out that electric substations are essentially defenseless.
As early as 1981, a Government Accountability Office report noted that the “nation’s electric power systems are highly vulnerable.” In 1990, the congressional Office of Technology found that “major metropolitan areas and even multi-state regions could lose virtually all power following simultaneous attacks on three to eight sites.”
A congressional report issued in June quotes Michael Chertoff, the former director of the Department of Homeland Security, predicting that “the sophistication and resulting damage of the Metcalf attack will…be exceeded in a future attack.”
After the incident, Geisha Williams, PG&E’s Executive Vice President of Electric Operations said in a video posted on the company’s website that the incident was a “game changer.”
PG&E promised to spend $100 million over three years to increase security at critical substations. Changes include enhanced camera technology, increased lighting, and upgraded fencing to obstruct views to critical components. PG&E also promised to trim undergrowth, remove potential hiding places and provide onsite security guards 24 hours a day.
“We are taking aggressive action to make sure the critical infrastructure is protected,” Williams said.
The NBC Bay Area investigation took a closer look to determine just how aggressive PG&E is in protecting its critical substations. The Investigative Unit made 14 unannounced visits to nine of PG&E’s largest and most critical substations in Northern and Central California.
The Investigative Unit stayed on public property while making security observations, which lasted 30 minutes to one hour in the early morning, during the day and late at night. While the names of the substations are not included in this report, open source documents make it easy to locate the largest and most critical facilities.
At two of the nine substations, security guards were not present. At one such facility, the Investigative Unit found an open gate and a PG&E employee who later answered questions.
“It’s not a manned facility,” the employee said, noting that security cameras are located on site but round the clock security guards are not.
NBC Bay Area did find guards at seven locations. At one substation a paid security officer answered questions after spotting the Investigative Unit’s camera, but never asked for names or the purpose of the visit. He said guards work 24 hours a day in 12-hour shifts. He then added, “I can’t be telling you that.”
The NBC Bay Area investigation also included observations and insight from a military veteran who worked in special operations for two decades and was trained to make threat assessments. Because of potential future assignments the veteran asked not to disclose his name. He determined that the layer of security “wouldn’t stop anything” at the substation where the officer answered questions.
At another facility, guards in vehicles spotted the Investigative Unit within a minute of driving near the main gate. The veteran applauded the security guard’s success at “pushing us off site.”
But at the other substations, the security presence appeared to be well short of significant and aggressive. The Investigative Unit was able to get close enough at several facilities to use a thermal imaging camera and locate transformers in the dark. Each time security vehicles were located a few hundred feet away.
One substation provided an ideal hiding place just outside the fence line. A reporter and producer were able to stand on a small hill covered in trees and thick bushes about 50 yards away from a row of transformers. The special operations veteran noted overgrown vines sticking out of the chain link fence, which he said made it more scalable.
“I am simply saying this layer of security is nonexistent,” he said.
The Investigative Unit found the most obvious security upgrades at Metcalf—two onsite guards, increased lighting and opaque fencing. But even with enhanced security, last month vandals broke into the substation and stole construction equipment. The burglary went unreported for five hours.
After reviewing the entire NBC Bay Area investigation and visiting substations over several days, the special operations veteran ultimately found failures in PG&E’s promises to aggressively increase security.
“I think they get a passing grade,” he said. “But is passing good enough? “Is the minimum enough? I think not.”
PG&E has a much different take.
“For our critical facilities right now we have high level security,” said Stephanie Douglas, PG&E’s senior director of corporate security and former special agent in charge of the San Francisco FBI office.
When asked to provide details regarding the unannounced visits to PG&E’s substations, Douglas said, “I’ll let you tell me. I know a couple places you have been and I know that you have been visiting some of our sites at night.”
When asked to provide the specific times and dates that the Investigative Unit visited the facilities, Douglas didn’t answer directly.
“I’ll let you give me some ideas,” she said.
NBC Bay Area has made several requests for details proving that the company’s security net was able to track the visits. PG&E has refused to provide that information.
As for the potential of a future attack, the special operations veteran was confident: “Metcalf could be repeated at all the sites you showed me in less than 15 minutes.”
According to Douglas, PG&E is “working every day to make sure it never happens again.”
If you have a tip for the Investigative Unit email theunit@nbcbayarea.com or call 888-996-TIPS.
