The arrests this week of two people, one a neo-Nazi leader, on suspicion of conspiracy to attack substations around Baltimore is another warning that electrical infrastructure in the United States is vulnerable to attacks.
The attacks weren’t carried out, but many others in the past few months have left thousands without power in areas across the U.S.
Steve Naumann, chief technical advisor for Protect Our Power, an electrical grid security think tank, released a paper recently on how such attacks on substations and other electrical infrastructure could be carried out by drones.
Unsophisticated Attacks
According to federal court documents, Brandon Clint Russell, who has a history of affiliation with neo-Nazi groups, and Sera Beth Clendaniel had planned to wait for times of high energy use, such as during snowstorms, and use firearms to attack transformers at substations in and around Baltimore.
An FBI investigation revealed that Russell wanted to target the transformers because they can take a long time to replace.
Over the past few months, nine substations have been attacked in North Carolina, Washington State and Oregon using unsophisticated techniques.
The perpetrators of these attacks used simple tools and firearms, but with a little more expertise, someone could modify and fly a drone for such purposes.
“You can buy off-the-shelf drones,” Naumann told Cowboy State Daily. “Even now in Ukraine, they’re actually making them from parts so they can bypass any security measures that might be built in. And it’s something that the government and the industry needs to think about.”
An FBI investigation revealed that Russell and Clendaniel had planned to drive to multiple substations to carry out their attacks.
With the use of drones, Naumann said, a person or group could launch simultaneous attacks on multiple stations from a remote location, and tracing the attacks back to the pilots would be difficult.
No Simple Solution
Naumann said that there are a number of challenges in addressing the risk.
There are about 70,000 power transmission and distribution substations in the U.S., many located away from populated areas and almost all accessible from the air.
Enclosing these facilities in concrete would be very expensive. Transformers give off a lot of heat, so the facility would have to include a way to keep cool, adding costs for power customers. Even retrofitting them might not be possible, Naumann said.
Idaho National Laboratory developed an Armored Transformer Barrier system that would guard against rifle attacks and possibly drones. They cost $2.5 million to $10 million each.
To put that in perspective, Powell renovated its two-transformer substation last year for just under $3 million.
“It’s very expensive, and there’s no simple solution,” Naumann said.
Maximum Payloads
After the Sept. 11, 2001, terrorist attacks, the federal government began taking a close look at potential threats to critical infrastructure, Naumann said.
“If you can fly a plane into a building, you can throw an IED into a substation,” he said.
The quadcopter drones that have become so popular in the past several years can carry a maximum load of about 10 pounds. For a lot more money, there are drones that can carry loads of 100 pounds.
Thomas Rullman, owner of GT Aeronautics based at the Powell Municipal Airport, has been designing and manufacturing unmanned aerial systems – aka drones – for military and civilian purposes. They carry heavier loads and fly much further than the standard quadcopters.
This includes one he’s nicknamed The Bandit, which carries smaller drones called banditos. These can be launched from the Bandit to take out enemy drones.
“I got two phone calls asking me why we didn’t use the bandito to shoot down the balloon,” Rullman told Cowboy State Daily, referring to the Chinese balloon that captured so much media attention last week.
Terrorists And Rednecks
Could terrorists get their hands on drones like GT Aeronautics makes?
Rullman, an engineer, said GT Aeronautics develops stores release units (SRU), which are what releases a canister or weapon on the aircraft. Then they had to develop an interface application software that allows the remote pilot to select an SRU and fire it.
“I’d say it’s easy to do, but I’m an engineer,” Rullman said.
He said there are other ways to release a payload from a drone, such as a simple radio-controlled servo.
“Can a terrorist do it? Absolutely. Can a redneck do it? Absolutely,” Rullman said.
The question comes, then, how much weight can an off-the-shelf quadcopter carry?
“From what I’m understanding, they can carry a 40-millimeter grenade,” Rullman said.
Documented Incidents
The use of drones against America’s infrastructure has already been documented.
The Protect Our Power paper cites 2022 testimony before the U.S. Senate Committee on Homeland Security and Governmental Affairs on the incidents.
In 2020, law enforcement discovered a crashed drone outside an electrical substation in Pennsylvania. The attack failed, but the drone had been modified to “cause an intentional power disruption.” The drone was carry conducting wires with the intention of creating an electrical short.
Between 2021 and 2022, the FBI, according to the testimony, identified 235 reports of suspicious drone flights at or near chemical plants in Louisiana. Similar activities have been seen around oil storage facilities in Oklahoma and natural gas facilities in Texas.
One of the challenges Naumann’s paper notes is that federal law prevents law enforcement and facility owners from implementing active defenses. This means they can’t shoot them out of the sky or use electronic jamming to stop or take over control of the drones.
Planning Ahead
Naumann said drones aren’t the only threats. There are cyber attacks, electromagnetic pulses and solar flares. There’s a lot of threats and a lot of critical infrastructure to protect.
Naumann said he’s not a security expert, but he hopes the paper will reach policymakers at the Department of Defense, utilities, and other agencies, and they will start having a conversation about what to do about the problem.
“People need to start thinking about, what would you do? What do you protect? How do you protect it?” Naumann said.
If people start laying out some ideas now, as opposed to after a drone attack causes serious and extensive power disruption, rational and cost effective solutions can more easily be developed, Naumann said.
