KIRO 7 uncovers security concerns and more substation attacks in Washington

As federal prosecutors build their case against the suspects in the Christmas Day attacks on substations in Pierce County, KIRO 7 has new surveillance video and has uncovered more attacks in Washington state than even federal data shows.

“It looks like they went through one of our actual gates,” a security guard for Tacoma Power told a 911 dispatcher. “They would’ve had to cut one of our locks.”

Surveillance video from the attack on the Tacoma Power substation in the Elk Plain area of Pierce County Christmas morning shows a man within the fenced area of the substation at 5:10 a.m. He approaches the equipment with something in his hand, and at one point, it appears he briefly hides behind the equipment. Just two minutes later, the power goes out.

“He definitely triggered some sort of circuit breaker,” the security guard told the 911 dispatcher.

The video appears to show the outline of a truck as it drives away.

It was the third substation hit that morning. Before it, a Puget South Energy site was hit at 2:39 a.m. and another Tacoma Power substation was hit around 5:00 a.m.

Thousands of customers were plunged into the dark. Then, 14 hours later, around 7:20 p.m., a PSE substation on Kapowsin Highway erupted into an electrical fire.

“I was asking, ‘How far do we have to evacuate?’” Gary Moore said. “Because if the transformers blow, they are very explosive.”

Moore lives just down the road from the substation. He lost power but quickly flipped on his generators. He knows others weren’t so lucky.

“They were without power for at least—well, the 24 hours it took to repair the substation,” he said.

Six days later, the FBI arrested Matthew Greenwood in a trailer parked at this Puyallup home.

They said the surveillance video showed him in the act and seized two guns from his home. The FBI said Greenwood told them Jeremy Crahan was the getaway driver. The FBI arrested him soon afterward the same morning.

Their motive, Greenwood told the FBI, was to take out the power so they could go to a local business, drill out a lock and “steal from the cash register.”

“He’s a domestic terrorist,” Moore said. “He might have been doing it to rob a store, but it’s still a domestic terrorism.”

Deputies said the only burglary on Christmas with a drilled out lock was at Thai Mekong restaurant in Graham sometime before 10 a.m. on Christmas.

The Pierce County Sheriff’s Department report said the suspects stole about $100 from the open register but “they did not take a tip jar and bank bag with additional cash.”

A source familiar with the investigation told KIRO 7 the suspects had at least two other places in mind and may have tried to break into one of them.

When asked about other break-ins, the FBI said in a statement that “it remains vigilant and works closely with our law enforcement partners on a daily basis to detect, disrupt, and dismantle any threats that may emerge.”

Experts like Jon Wellinghoff, the chairman of the Federal Energy Regulatory Commission from 2009 to 2013, said it’s clear that across the country, the number of attacks is growing.

“We’ve seen people have this willingness to actually go after infrastructure in a way that they never would before,” he said. “It really is a wakeup call that the utilities need to start to take some action.”

New numbers show Washington is tied with Texas for number two in the country for the most physical attacks on power facilities in the country last year with 20. Ahead of Washington is California with 41.

Those attacks in Washington include one involving a wire in August in Lewis County and another wire attack there December 27th.

But the federal data did not list a June attack in Lewis County where chains were thrown on the equipment, or two attacks at Tacoma Power’s Elk Plain substation in October.

The first occurred on October 3rd.

“There’s a very large power outage down there and we are looking to get police on site, they threw chains up on the transformer, pried open a bunch of boxes,” a Tacoma Power worker named Mike told the dispatcher.

The substation was attacked again October 5th.

“We have somebody who’s in the substation right now,” a Tacoma Power worker named Sam told the dispatcher.

“I think the first thing they need to do is assess putting in ballistic barriers in front of the critical parts of the infrastructure,” Wellinghoff said. “Continuing to have simply chain link fences and cameras around those facilities is not adequate.”

So KIRO 7 went to a dozen substations over three nights across Snohomish, King, and Pierce Counties to get a first-hand look at the security.

Our crew spotted security cars a couple times, and at a Bonneville Power Administration substation in Renton, KIRO 7 saw plenty of security measures.

“We have not seen any security guards coming by, but we have seen at least three cameras,” reporter Linzi Sheldon said.

A couple minutes later, Renton police pulled up.

“We just got a call from security, just wanted to know what’s going on out here,” the officer stated.

“From Bonneville security?” Sheldon asked.

“Yeah,” the officer confirmed.

Before long, another Renton police officer arrived and explained that concerns about attacks were exactly why security called them.

“Bonneville has been increasing security over the past few years and certainly accelerated that with this most recent threat of sabotage emerging,” BPA spokesperson Doug Johnson said.

BPA is a federal non-profit that markets wholesale electrical power to utilities throughout the Northwest. He said one of Bonneville’s Oregon substations was hit with gunfire on Thanksgiving. After that, a BPA security specialist sent an email mentioning attacks in Western Washington that included “small caliber firearms.”

“Some of these experts are asking for walls, cement walls around substations or even ballistic barriers,” Sheldon said. “What do you say in response to that?”

“I think you have to find a balance … of expense versus return on investment for those measures you take,” he said. “We fully expect national regulatory bodies to be looking into this. We’re not going to wait for what they do to do the things that we think we need to do to protect our facilities.”

Johnson said they are exploring additional measures.

KIRO 7′s visits included the four substations attacked on Christmas Day. Because of the multiple attacks at the Tacoma Power Elk Plain substation, the crew spent an hour there but no one ever showed up to ask questions.

“Do you know when we visited your substations?” Sheldon asked John Nierenberg, Tacoma Power’s Manager of System Planning and Operations.

“I’m not sure we know when you visited our substations,” he said.

KIRO 7 asked him about the October break-ins. The FBI said it is investigating to see if they are— or aren’t— connected to the Christmas Day attack.

“Each time we’ve had issues, we’ve progressively added to our security measures,” Nierenberg said.

So why were attackers able to get in again on Christmas?

“There’s only so much we can do to prevent somebody from breaking into any facility,” he said. “It just depends on how long it takes them to get through it.”

When KIRO 7 asked if he was going to ensure a break-in did not happen a fourth time, Nierenberg said Tacoma Power did not want to expect how it was protecting the system.

“We’ve proactively taken additional security measures,” he said. “It really comes right out of those customer rates… More of our customers, especially in our Tacoma area, tend to be right at the ability to pay, right. And so we want to make sure that we’re making investments that have a big impact.”

©2023 Cox Media Group