On the morning of April 16, 2013, a team of gunmen, using rifles, opened fire on the Metcalf Transmission Substation, severely damaging 17transformers.[4][5][6]
Prior to the attack, a series offiber-optic telecommunications cables operated byAT&T were cut by the culprits. Additionally, following the attack, investigators found small piles of rocks near to where the shots had been fired, the type of formations that can be used to scout firing positions.[7][8]
12:58 a.m. – AT&T fiber-optic telecommunications cables were cut not far fromU.S. Route 101 just outside south San Jose.
1:07 a.m. – Some customers ofLevel 3 Communications, an Internet service provider, lost service. Cables in its vault near the Metcalf substation were also cut.
1:31 a.m. – A surveillance camera pointed along a chain-link fence around the substation recorded a streak of light that investigators from the Santa Clara County Sheriff's office think was a signal from a waved flashlight. It was followed by the muzzle flash of rifles and sparks from bullets hitting the fence.
1:37 a.m. – PG&E received an alarm from motion sensors at the substation, possibly from bullets grazing the fence.
1:41 a.m. – Santa Clara County Sheriff's department received a 911 call about gunfire, sent by an engineer at a nearby power plant that still had phone service.
1:45 a.m. – The first bank of transformers, riddled with bullet holes and having leaked 52,000 US gallons (200,000 L; 43,000 imp gal) of oil, overheated, whereupon PG&E's control center about 90 miles (140 km) north received an equipment-failure alarm.
1:50 a.m. – Another apparent flashlight signal, caught on film, marked the end of the attack. More than 100 expended7.62×39mm cases were later found at the site.
1:51 a.m. – Law-enforcement officers arrived, but found everything quiet. Unable to get past the locked fence and seeing nothing suspicious, they left.
3:15 a.m. – A PG&E worker arrived to survey the damage.[7]
Former Chairman of the Federal Energy Regulatory CommissionJon Wellinghoff stated that military experts informed him that the assault looked like a "professional job", noting that no fingerprints were discovered on the empty casings.[7] While Wellinghoff described the attack as "the most significant incident of domestic terrorism involving the grid that has ever occurred", a spokesman for theFederal Bureau of Investigation stated that they did not believe a terrorist organization was responsible.[9]
Henry Waxman, a ranking member of theUnited States House Committee on Energy and Commerce, stated that the attack was "an unprecedented and sophisticated attack on an electric grid substation with military-style weapons. Communications were disrupted. The attack inflicted substantial damage. It took weeks to replace the damaged parts. Under slightly different conditions, there could have been serious power outages or worse."[8]
Seventeen transformers were seriously damaged, requiring over $15 million worth of repairs. To avert a black-out, energy grid officials had to reroute power from nearbySilicon Valley–based power plants.[2][10] While some nearby neighborhoods temporarily lost power, “the big users weren’t even aware Metcalf had happened”, according to an expert from theElectric Power Research Institute.[1]
Both PG&E, the company which operated the transformers, and AT&T offered $250,000 rewards for any information leading to the arrest and conviction of the perpetrators of the attack.[6][11]
In June 2014, PG&E announced that it intended to spend $100 million over a three-year span on upgrading security at substations throughout its territory, including the Metcalf location.[12]
A July 2014 report from theCongressional Research Service titledPhysical Security of the U.S. Power Grid: High-Voltage Transformer Substations repeatedly cited the attack and noted that, "... in the wake of the Metcalf incident, theFERC has ordered the imposition of mandatoryphysical security standards (for substations) in 2014."[13][14]
In October 2015, it was reported that theDepartment of Homeland Security had found indications that the attack may have been committed by "an insider".[15]
