By Rich Heidorn Jr.
SERC Reliability used part of its quarterly open forum last week to provide lessons learned from a series of attacks on Arkansas’ power grid in 2013.
Bill Peterson, SERC’s manager of outreach and training, told the story of Jason Woodring, who was sentenced to 15 years in prison for attacks on grid facilities in the state between August and October 2013.
“We’re trying to share some awareness topics [that will] help you proactively consider some security enhancements to protect your substations,” Peterson said.
Peterson prefaced the presentation with a reference to the April 2013 attack on Pacific Gas and Electric’s Metcalf substation, in which a sniper shot 17 transformers, causing outages in nearby neighborhoods and forcing grid operators to reroute power. (See Substation Saboteurs ‘No Amateurs’.)
The attack ultimately led to NERC reliability standard CIP-014-1, which requires utilities to protect transmission facilities whose loss could cause instability, uncontrolled separation or cascading outages. The standard led utilities to add fencing, cameras and alarms to their facilities. At Metcalf, PG&E removed vegetation near the substation boundary and replaced a chain link fence with a concrete wall to prevent a line of sight into the substation.
Woodring, a pool maintenance worker with a methamphetamine habit, told the court in June 2015 he wanted to cause a power outage to “get everybody’s attention” to what he saw as the deterioration of society. He said he had noticed how people united during an emergency.
“When I went up there on that 500,000-volt power line, I actually thought I was going to be helping people,” he said in his guilty plea.
Woodring’s sabotage began when he attempted to topple an Entergy transmission tower adjacent to a rail line in the city of Cabot, spending weeks removing about 100 steel bolts that secured the tower to its concrete foundation. He then strung a steel cable from the tower to a tree on the other side of the tracks, hoping that a passing train would hit the cable and pull the tower down.
But the cable — insulated with blue plastic hosing used for pool maintenance — was snapped by a train without causing the tower to budge.
On Aug. 21, Woodring returned, climbing the tower armed with a hacksaw, which he used to cut the connectors holding one of the 500-kV lines, and the line itself, which fell onto the track.
“What he was trying to do apparently is get the cable to itself attach to a bypassing train in an attempt to pull the entire tower down,” Peterson said. Later that morning, a Union Pacific freight train struck the line, blacking out nearby homes. Again, the tower did not come down.
The FBI offered a $20,000 reward for the person responsible, speculating that the attacker must “possess above-average knowledge or skill in electrical matters.”
Less than a month after the first incident, Woodring broke into an Entergy extra-high-voltage substation in nearby Scott after surveilling it for several days.
Using bolt cutters to get through a fence and padlocks on the door of the control house, he dumped a gallon of gasoline and oil on the control panel and the floor before setting it ablaze. The building was destroyed.
He left a cryptic, crudely written message: “YOU SHOULD HAVE EXPECTED U.S.”
“Local law enforcement assumed that he was trying to hide his identity and show that it was a [foreign] terrorist attack instead of somebody local,” Peterson said.
A week after setting the fire, and after the FBI raised its reward to $25,000, Woodring used a chain saw and an axe in an attempt to cut through a distribution pole near his house in Jacksonville. After that failed, he discovered an unattended tree maintenance vehicle near his house and drove it back to the poles, dragging one of them down and blacking out 10,000 customers of First Electric Cooperative.
“How easy is it to access these vehicles? Are keys … just left in them? Are there fences around these vehicles? Are they parked in certain locations?” Peterson asked. “What other types of equipment do you use that could be used against you?”
Woodring was arrested after a fourth attempt at sabotage when he used a fishing pole to cast a piece of wire over the power lines near his home, causing an explosion.
That led law enforcement agents to Woodring’s house, where they discovered blue plastic hosing like that found at the scene of the transmission tower sabotage. He confessed.
Woodring was sentenced to 15 years in federal prison and ordered to pay almost $4.8 million in restitution to Entergy and almost $49,000 to First Electric Cooperative.
Peterson said the Woodring story “brings up a couple areas for us to … think about improving our awareness of our infrastructure.”
“Stay in contact with local law enforcement. Make sure you preserve evidence if you do think there’s a disruption or damage done to a facility. … Keep in mind that could become a crime scene.”
Audit Evidence
The quarterly forum also featured a tutorial by SERC officials on best practices for providing audit evidence.
Asked whether audit documentation was improving or getting worse, SERC’s Clay Shropshire said it depends on the entity.
“There are entities that we go to and they really seem to get it. And we can even be asking for something a little different and before we even finish the question they go, ‘OK, I know exactly what you want.’ And they go run off grab it and they come back. [And we say], ‘Yeah that’s what we need.’
“There are other entities we ask for [evidence] six or seven times and we finally run out of time.”
