In the wake of grid sabotage, Moore County and Duke Energy say they are stronger

The attack on the electrical power grid in Moore County in the early evening hours of Dec. 3, 2022, remains unsolved, but it prompted widespread changes.

While law enforcement investigators remain tight-lipped over any progress they’ve made, others have made clear what they learned from the crisis and how they’ve adjusted.

The gunfire attacks on substations in Carthage and West End were severe enough to cut power for almost four days to more than 45,000 customers in Moore County.

Coming just three weeks before Christmas, the attacks stunned the community and became an international news story as police scrambled for evidence and community leaders hustled to organize responses.

Businesses that rely on the busy holiday season missed out on critical sales. Churches that weekend were dark and cold. Help — everything from neighbor-to-neighbor to faith-based disaster assistance teams — filled the gaps.

Since then a new state law has been enacted to stiffen criminal penalties for such attacks. Duke Energy says it has spent millions to upgrade its power grid infrastructure and safeguard it from attack. And local officials say they have improved their crisis-response plans.

Tough scrutiny for Duke Energy

Other than law enforcement, no entity had a higher profile in the wake of the power grid attacks than Duke Energy. Although the company has multiple layers of security to protect its vital infrastructure network systemwide, it became clear after the attacks that some components had gone overlooked.

The West End substation, which distributed power to much of southern and central Moore County, had little protection beyond a metal farm gate and chain. On the morning after the attack, the gate lay on the ground where it had been knocked down. A sand path led straight back to the substation, protected just by a chain link fence. From the fence line, a gunman could take easy aim at the transformers and other equipment.

For Duke, which has elaborate plans for responding to weather-related and human-made disasters, it was a defining moment.

“We have learned a lot from that event, and I think we are a stronger utility from that event as we think about the future, and the ongoing work we’re going to do to deter these types of attacks,” company spokesperson Jeff Brooks said.

Following the attacks, the major power supplier to more than 4 million customers across six states doubled down on security, Brooks said.

Duke Energy has yet to reveal the amount spent at the two Moore County substations, but Brooks said that he estimates it was “a few million dollars.”

But the aftermath set into motion a four-year, $500 million plan to protect substations. That involves physical measures as well as internal methods to keep substations and critical infrastructure from causing widespread outages when damaged.

Brooks said the $500 million spending plan is being covered with requested rate increases through the state Utilities Commission.

Duke is now ranking its thousands of substations based on their importance to the power grid around them. “If you take a substation that’s in a big city where you’ve got lots of options for rerouting power, you may not see as many impacts as you would see in a smaller community, where that substation serves a large portion of the county, so to speak,” Brooks said.

Closer looks at grid building blocks

Installation of “self-healing” power systems has also been a priority for the power company. In North Carolina in the past year, this new technology helped to avoid more than 400,000 outages, which equates to 1.7 million hours of outage time, Brooks said.

He compared the technology to a car’s GPS system that can reroute you in the event a delay is detected on the road ahead.

“For us, not only do we want to strengthen the grid to try and reduce the potential risk of those attacks, but a lot of our work has been focused on how do you isolate those problems and limit the number of customers affected,” Brooks said.

For the areas where such options are available, Brooks said added physical measures like improved monitoring would be needed.

“When we think about securing our grid, we take an all-hazards approach to that, and we want to make sure that we’re not only protecting it against potential bad actors — and we have to do that — but also against severe weather, vehicles hitting utility poles or animals interfering with equipment, all of which are common causes of outages,” Brooks said.

Establishing an inventory of critical components within close proximity to its equipment has also been a focal point for Duke in the past year. A vital piece to the West End substation was stored at a substation in Eastern North Carolina, and it being located within a short distance saved days on power restoration, Brooks said.

Also, local law enforcement has increased its patrolling of substations in Moore County following the attacks, and Duke Energy has worked to identify potential risks to the infrastructure.

“We’ve been deploying more extensive training with local law enforcement since the events last year,” Brooks said. “That training has helped us better identify suspicious activity and protect critical assets on our system. As a result, we are seeing local law enforcement is able to respond even faster to incidents because they know what to look for, and proactively report findings to our security team.”

For Moore County, more preparedness

Following the attacks, Moore County officials stood before pools of international media for several days, talking about the crisis and their response.

In the ensuing months, representatives from Moore County Public Safety have spoken at engagements in North Carolina and as far away as St. Louis to recount details from the attack and the emergency response.

“People are just amazed that there were more events going on across the United States of power outages, but nobody really pays attention to them until they hit you,” said Bryan Phillips, the county’s director of public safety. “People now are paying more attention to it and looking at it.”

After the attacks, questions quickly emerged about how vulnerable multiple public services might be. “That makes you look a little more at all the infrastructure. If they can touch electric, then what can they do to water and sewer and other infrastructures that are key to keeping the county and citizens safe?” Phillips said.

Phillips and his department in the past year have worked to address not only utility infrastructure concerns.

“We didn’t have a grocery store in Moore County that had a generator. Talking with some of your private partners that could be affected by the infrastructure to see if they have thought about generators, or what their contingency plan is to stay up and running,” he said.

Phillips has used the follow-up process from the attacks to see where the county could help local businesses be prepared in the future.

“To me, grocery stores and gas stations are two critical infrastructures. If they are up, people can manage to do a lot because if you’ve got gas and fuel to get somewhere you can get to what you need. If a grocery store has it, you can at least get the basic necessities,” Phillips said. “The county has done a lot in the last 10 years of building up the generators and those infrastructures up.”

Seeing gaps in outreach, including language

After any major incident, whether it’s a flood, snowstorm or substation attack, Moore County Public Safety always does an “after-action” review. That report assesses the strengths and weaknesses from the way the county and its partners responded.

One thing that quickly popped up after the grid attacks: communicating with the non-English speaking public.

“We send it out on Facebook, web page and news media,” Phillips said. The county also has added new software called “Notify Me.” Residents can sign up to receive notification alerts through either text or email.

The county is now using Google Translate to offer information in multiple languages.

It is setting up another notification software called WebEOC, which will allow county agencies to have access to post any information during a crisis situation to a dashboard. In the past, these notifications were sent by email to one person to be uploaded to the county website.

“It’s becoming more of a real-time documentation that we’ve purchased and we’re starting to set that up,” Phillips said. “It kind of gives you a bigger picture of what’s going on. It will work well for all kinds of events.”

With the attacks fresh on the minds of many last January, the county updated its emergency action plan. Many of the elements the county used in response to the attacks fell in line with natural disasters, as far as opening up shelters and working in conjunction with outside partners like the Red Cross and Baptists on Missions. The only thing missing to help prepare the county for the incident was forewarning that comes with certain natural disasters.

“The key lessons now,” Phillips said, is that “you’ve got to be prepared all the time because you don’t know when something is going to happen.