Sophisticated but low-tech power grid attack baffles authorities

WASHINGTON — They came after midnight, two or more armed individuals so deft that they cut telecommunication cables in an underground vault and outsmarted security cameras and motion sensors at the power substation in a remote corner of Santa Clara County.

At daylight, FBI agents began poring over time-lapse photographs from the surveillance cameras. But the photos revealed only staccato muzzle flashes from a semiautomatic weapon and sparks as shots hit rows of transformers. There was not a face, not a shadow, of who was doing the firing.

The shooters disappeared into the gloom minutes before the first police car arrived.

The military-style raid on April 16 knocked out 17 giant transformers at the Metcalf Transmission Substation, which feeds power to Silicon Valley. The FBI is still working the case, and agents say they are confident it was not the work of terrorists.

What they do not have is a motive, fingerprints or suspects.

But theories are piling up. Was it a modern-day Monkey Wrench Gang bent on eco-terrorism? Was it a test of the vulnerability of the U.S. electrical grid? Was it a dress rehearsal for a larger attack to come?

Was it an inside job by disgruntled Pacific Gas and Electric Co. employees? Was it related to the bombing of the Boston Marathon across the country only 13 hours earlier? Was it aimed at killing power in Silicon Valley, as one official wondered, “maybe somebody trying to knock down service to Google or something?”

Utility officials quickly rerouted power around the site, and nearby power plants picked up the slack, so there was no major blackout. And no one was injured. But it took utility crews nearly a month to repair the damage.

Four Democratic senators, including California’s Dianne Feinstein, chairwoman of the Senate Intelligence Committee, and Senate Majority Leader Harry Reid of Nevada, on Friday urged utility regulators to beef up security at power plants and substations around the nation. They said the “sophisticated attack” was a “wake-up call” about threats to crucial infrastructure.

“We ought to be hyper-alert,” said Rep. Zoe Lofgren (D-San Jose), whose district includes the substation. “These were pros.”

Counter-terrorism officials have repeatedly warned of a potential cyberattack that could disable or crash electric grids, causing outages and billions of dollars in damage, and federal authorities and utilities have rushed to beef up their digital defenses. But the assault 15 miles southeast of San Jose was decidedly low-tech.

Law enforcement sources and others briefed on the investigation say the gunmen fired 120 rounds from a high-powered rifle and that nearly every shot hit the transformers 40 yards away in a 20-minute period.

The transformers began to leak tens of thousands of gallons of oil. They overheated and shut down, but did not explode.

The attackers managed “to disable these transformers without blowing them up and attracting attention,” Rep. Adam B. Schiff (D-Burbank) said on “Fox News Sunday.”

Officials say the attackers brought night-vision scopes for their weapons, used heavy wire cutters to snip fiber-optic cables in a below-ground bunker and knew the specific manholes to open to reach the right cables.

The team briefly disabled the 911 emergency system and phone lines. They set off a motion detector by the fence before leaving, but the facility sits beside U.S. 101, a convenient escape route.

They were “clearly knowledgeable” about the layout of the substation and its communication systems, said one federal official, who, like others, was speaking confidentially because the investigation is continuing.

The perpetrators arrived shortly before 1 a.m. and were gone 52 minutes later. Apparently the first call to authorities came from a driver speeding by on U.S. 101. He alerted police in Gilroy, about 20 miles south. “Fireworks” were coming from the substation, he said.

An operator at the Metcalf Energy Center, beside the substation, placed an emergency call about the same time.

Then the trail went dry.

“These guys took pains to make sure they would not be detected,” a federal official said. “And they got away.”

Sources said investigators had found no fingerprints on the shell casings, no matchable boot prints and no tire tracks from getaway vehicles.

A four-minute black-and-white surveillance video, which the Santa Clara County Sheriff’s Office posted online, shows little more than a line of trees and flashes of light along a chain-link perimeter fence, possibly including a waving flashlight.

No phone calls, emails or letters have claimed responsibility, “at least none that are credible,” one official said.

No composite drawings of possible suspects have been released. Few clues have emerged since local authorities issued a brief news release hours after the attack saying that “no suspect information is available.”

“Everything now plays into motivation,” an FBI official said. “You know what happened but not yet who might have done it. So a couple of key thoughts come into play. How sophisticated were they, and what was their intent here?”

Dozens of facilities linked to the nation’s three major electric grids, including transmission towers and substations, are vandalized each year. But those incidents generally involve disgruntled workers, bored target shooters, copper wire thieves or disturbed individuals.

In November, for example, a federal grand jury indicted Jason Woodring of Jacksonville, Ark., on charges of sabotaging energy facilities in central Arkansas. Court documents describe him as a methamphetamine addict who owned two rifles, three shotguns and ammunition. After he was arrested, Woodring was ordered to undergo a psychiatric evaluation.

In 1990, the U.S. Office of Technology Assessment warned that utilities were “vulnerable to saboteurs with explosives or just high-power rifles.”

Authorities are fairly certain that the assailants in California were not drunk hunters or bored teenagers on a late-night lark.

“They knew what they wanted to target, they had an objective and carried it out,” said Jon Wellinghoff, who was chairman of the Federal Energy Regulatory Commission at the time of the shooting. “You don’t learn from a video game how to target an AK-47 in those kinds of conditions as precisely as these people did.”

R. James Woolsey, who headed the CIA from 1993 to 1995, agreed. “This was not just half a dozen teenagers who got hold of their father’s hunting rifles and had too much beer,” he said.

He noted it occurred in mid-April, the same month as the 1993 Waco siege, the 1995 Oklahoma City bombing, the 1999 Columbine High School and 2007 Virginia Tech massacres, as well as the Boston Marathon bombing, which killed three people and wounded more than 260 others a day earlier.

“Maybe whoever was doing it was looking for a double hit,” Woolsey said.

In the earlier attacks, the assailants were arrested or killed. Whoever shot up the Silicon Valley substation remains free.

“We’d definitely like some arrests,” said Stephanie McCorkle, spokeswoman with the California Independent System Operator, the nonprofit corporation that manages most of the state’s power grid. “We’d all sleep better then.”

richard.serrano@latimes.com

evan.halper@latimes.com

Times staff writers Brian Bennett in Washington and Marc Lifsher in Sacramento contributed to this report.