One of the two men charged with attacking electric substations in Washington state over the Christmas holiday has pleaded guilty to conspiracy to damage energy facilities, federal prosecutors said on Friday.

Matthew Greenwood of Puyallup, Wash., filed his guilty plea Friday with the U.S. District Court
for Western Washington, according to a statement. In the plea, Greenwood admitted to vandalizing four substations owned by Puget Sound Energy and Tacoma Power on Dec. 25. In addition, the plea said Greenwood and his co-defendant Jeremy Crahan, also of Puyallup, planned to cut down trees “to take out power lines,” although this plan was not acted on before the two were arrested.

Greenwood said he and Crahan sought to disrupt power in order to break into ATMs and local businesses to steal money, the same motive he mentioned to the officers who arrested him on Dec. 31. (See Feds Charge Two in Wash. Substation Sabotage.)

He also faced a charge of possessing unregistered firearms; a spokesperson for the Department of Justice confirmed that Friday’s guilty plea was only for the charges related to the substation damage. The plea agreement included a pledge from the U.S. Attorney’s Office for the Western District of Washington “not to prosecute [Greenwood] for any additional offenses known to it as of the time of this plea agreement” based on “the promises made by” Greenwood.

Crahan was also charged with conspiracy to destroy an energy facility. According to court records, he has not entered a plea. The conspiracy charges carry a maximum sentence of 20 years for both men, along with a fine of up to $250,000 and three years of supervised release, although the Justice Department said prosecutors will “recommend the low end of the [sentencing] guidelines range when Greenwood is sentenced.”

Greenwood was released on bail at the end of January to attend drug treatment.

Pair Damaged Multiple Facilities

According to the plea agreement, Crahan drove Greenwood to the substations and Greenwood performed the actual attacks. Their first target was the Hemlock substation in South Hill, where Greenwood cut through the perimeter fence around 2:30 a.m., manipulated a bank high side switch, and damaged additional equipment, causing an outage for about 8,000 customers.

Surveillance photos from Tacoma Power showing Greenwood at the Elk Plain substation. | Tacoma Power

The pair then drove to the Elk Plain substation about nine miles away in Spanaway, arriving around 5 a.m. Greenwood cut the padlocks on the exterior gate, manipulated the high side breakers, and damaged additional equipment. They arrived at the Graham substation about 30 minutes later, where Greenwood again manipulated a bank high side switch and damaged equipment. Together, the damage to the Elk Plain and Graham facilities caused at least 7,500 customers to lose power.

Finally, Crahan drove Greenwood to the Kapowsin Substation, also in Graham. Greenwood tampered with the facility’s bank high side switch and tried to pry open the linkage, causing sparks and flames. No outages were attributed to this attack in the plea agreement.

This was not the end of the men’s plans; they intended to continue causing outages by cutting down trees that would then fall on power lines. Although the men spent some time with a chainsaw looking for trees to cut over the next several days, the FBI tracked them down using cell phone records and surveillance photos before they could do so.

Greenwood’s arrest statement said that he and Crahan burglarized a local business and stole from its cash register during the outage, but this incident was not mentioned in the plea agreement.

The Washington sabotage was one of several physical security incidents late last year, most prominently the Dec. 3 gunfire attack on two Duke Energy (NYSE:DUK) substations in North Carolina, which left 45,000 customers without power for as long as four days. (See Duke Completes Power Restoration After NC Substation Attack.)

In response to the North Carolina attacks, FERC ordered NERC to review the effectiveness of its physical security reliability standards and determine whether improvements are needed. NERC released its report last month, identifying several possible areas of improvement and proposing a new standards development project to address the issues. (See NERC Says Changes Coming to Physical Security Standards.)