The Department of Justice charged two men in attacks on four electric substations that left thousands in Washington state without power on Christmas, saying the incidents were a cover for a burglary plot.

Each of the men — Matthew Greenwood and Jeremy Crahan, both of Puyallup, Wash. — faces a potential prison sentence of 20 years on the vandalism charges. Greenwood was also charged with possessing an unregistered firearm, a potential 10-year sentence.

According to a criminal complaint filed Dec. 31 and unsealed this week, the attacks occurred in Pierce County, beginning early in the morning of Dec. 25. Two of the affected substations were operated by Puget Sound Energy, while the others were controlled by Tacoma Power.

Initial Intrusion in Hemlock Facility

The first sign of a problem came around 2:39 a.m., when PSE crews responded to an alarm from the Hemlock substation. Arriving on the scene, the team discovered that someone had cut the perimeter fence and entered the substation. While the intruders did not steal anything or cut any wires, they did manipulate a bank high side switch, causing a power outage for about 8,000 customers.

While PSE staff were working to restore service at the Hemlock substation, Tacoma Power received a notification around 5:30 a.m. that its Elk Plain substation was offline. Just 30 minutes later, word came that the Graham substation was down as well. Investigators at the Elk Plain facility found the padlocks on the pedestrian gates had been cut and the high side breakers had been handled; at the Graham facility the fence had been cut, similar to Hemlock, and the high side breakers were out.

Tacoma Power said about 7,500 customers lost power because of the two outages. The utility also reported that it would cost about $3 million and take up to 36 months to replace damaged transformers at both facilities. Until the transformers are replaced, Tacoma Power must use mobile transformers at the substations, reducing their combined output from 50 MW to 15 MW.

The final attack occurred around 7:25 p.m. at PSE’s Kapowsin substation. Once again, the chain link fence had been cut and someone had tampered with the bank high side switch. In trying “to pry the linkage open,” the attackers “caused the substation to start arcing and sparking,” according to the complaint. Authorities did not state whether any outages occurred as a result of this attack.

Phone Records Lead to Suspects

The investigation by the FBI’s Joint Terrorism Task Force used surveillance photos from the Elk Plain substation of a man and a vehicle that arrived at the facility at the time of the attack. Investigators also used cell phone records to identify two phones that appeared to have been in the vicinity of each substation around the time the attacks occurred.

Those phones turned out to be connected to Google accounts used by Greenwood and Crahan; in addition, Crahan was identified as the owner of a pickup truck similar to the vehicle seen in the Elk Plain surveillance photos. This connection was enough for the FBI to put both men under “essentially continuous … surveillance” for several days beginning Dec. 27.

Surveillance photos from Tacoma Power showing the individual who damaged the Elk Plain substation. Matthew Greenwood was later arrested wearing similar clothing. | Tacoma Power

Investigators obtained a search warrant on Dec. 30 for a house in Puyallup where both men were often present. Executing the warrant on Dec. 31, federal agents and local law enforcement officers found Greenwood in a trailer on the property along with a rifle and a shotgun later determined to be unregistered. His clothes “matched, in part, the clothing seen in the” Elk Plain surveillance photos. Crahan was found and arrested a short time later, also in Puyallup.

In a statement to police, Greenwood said he and Crahan committed the power station vandalism as part of a plan to burglarize an unnamed local business. He said he used bolt cutters provided by Crahan to enter the facilities, while Crahan drove their getaway car. According to Greenwood, Crahan only entered one facility, referred to in the court filing as the “South Hill” facility but probably referring to the Hemlock substation, which is located in South Hill.

During the outage, Greenwood said they went to the business where Crahan drilled out the lock, while Greenwood stole from the cash register. It was not clear from the filing when in the day this occurred, or whether it happened before or after the Kapowsin substation attack.

The Washington sabotage came just weeks after unknown attackers damaged two substations in Moore County, N.C. with rifles, causing 45,000 customers to lose power for several days. (See Duke Completes Power Restoration After NC Substation Attack.) Investigators have yet to publicly identify any suspects or motive for those attacks; Duke Energy, Moore County, and the state government have each offered a reward of up to $25,000 to catch those responsible.

In a statement, FBI Special Agent Richard A. Collodi, who heads the bureau’s Seattle field office, said the arrests demonstrate “the commitment by all levels of law enforcement to protect our infrastructure and hold those accountable who put our community in danger.”

Tacoma Power also thanked law enforcement officers, noting that it had “committed significant resources to both cyber and physical security” and that investigators said these efforts “aided in these swift arrests.” During the outages the utility had said that “in accordance with best practices, we do not share the details of our resiliency and security tactics,” but that it “follows federal reliability standards, including assessing physical risks to our critical energy infrastructure and applying recommended mitigation measures.”