Some believe the 2013 sniper attack on the Metcalf substation was a dry run for blacking out America. The gunmen cut the fiber lines first, shot out 17 transformers and were never caught.
Nineteen minutes
The Week's account of the night reads like a mission plan. Just before 1 a.m. on April 16, the attackers cut underground fiber-optic telephone cables. At 1:30 they opened fire for 19 minutes, destroying 17 of the 23 giant transformers that feed power to Silicon Valley. A minute before police arrived, they were gone.
The damage came to $15.4 million and took 27 days to repair. Nobody lost power, because PG&E routed electricity around the station, and almost nobody outside the industry knew it had happened until the former chairman of the Federal Energy Regulatory Commission, Jon Wellinghoff, went public in early 2014. His fear was simple: Metcalf was a dry run for synchronized attacks on a handful of substations, and a FERC analysis suggested it would take surprisingly few of them to black out most of the country.
https://theweek.com/articles/451393/maybe-americas-energy-grid-safer-than-thought
A professional job
PBS SoCal, summarizing The Wall Street Journal's reconstruction, laid out why Wellinghoff would not accept the word vandalism. He called Metcalf "the most significant incident of domestic terrorism involving the grid that has ever occurred" in the US. He later toured the site with forensics experts from the Navy's Dahlgren Surface Warfare Center, who judged it a professional job. "They said it was a targeting package just like they would put together for an attack," he said.
The details support the feeling. The phone lines were cut so they could not be repaired easily. The shooters aimed at cooling equipment so the transformers would overheat and shut down rather than explode. Flashlight signals appear to have started and stopped the firing. Shell casings left at the scene carried no fingerprints, and small piles of rocks marked good firing positions, possibly left by advance scouts. PG&E still called it vandalism, and the FBI was not treating it as a terrorist act.
Washington hopes it was not practice
When the story broke, Congress reacted. On Fox News Sunday, Rep. Adam Schiff of the House Intelligence Committee called it "a sophisticated attack." He added: "I hope this wasn't a dry run, but this is of great concern." He suggested the country had focused so hard on cyberattacks that it had taken its eye off the physical grid, and that remote stations needed far more protection.
Fox's account differs from others in its timing. It describes an attack that lasted 52 minutes, beginning with the cut telephone cables and including at least 100 shots fired into the facility. Rep. Mike McCaul, chairman of the House Homeland Security Committee, said any attack on a power station was of grave concern. For people who follow the case, the question was never whether Metcalf was serious. It was who had trained for it, and what they were training for.
The insider remark, and the walk-back
In October 2015, CBS San Francisco reported that no one had been arrested. It also reported that Homeland Security's assistant secretary for infrastructure protection had told an energy conference in Philadelphia that "there's some indication it was an insider."
The FBI quickly disputed that version, telling KPIX 5 that "there is a significant gap in what was said and what was reported." Other law enforcement sources told the station an inside job had long been suspected because the attack was so targeted. Key fiber lines were cut, and someone with a high-caliber rifle hit the cooling radiators, so the transformers leaked oil, overheated and shut down. For theorists, the pattern repeats: an official says something revealing, and the agency running the case rushes to narrow it.
What the government's own researchers wrote
The Congressional Research Service report on the physical security of high-voltage transformer substations treats Metcalf as a turning point. Together with recent grid security exercises, it writes, the attack changed the way grid security is viewed and focused congressional interest on transformers. On November 20, 2014, FERC approved a new mandatory physical security standard, CIP-014-1, proposed by NERC.
The same report records the split at the heart of the theory. Some federal officials reportedly described Metcalf as domestic terrorism, potentially a "dry run" for a more destructive attack on several substations, while the FBI said it did not believe Metcalf was a terrorist incident. Because the perpetrators have not been identified, the CRS concludes, it is impossible to know for certain. A government report saying the government cannot know is one reason this file is still open.
https://www.congress.gov/crs_external_products/R/PDF/R43604/R43604.6.pdf
Still unsolved
The Unresolved case write-up collects the details that keep the dry-run idea alive. The gunmen fired from about 25 meters away and appear to have scouted the site in advance. They are believed to have used night-vision gear. Before the shooting, they lifted two manhole covers and cut fiber belonging to AT&T and Level 3, knocking out some landline, cell, internet and 911 service in the area, which suggests they knew how the site was wired.
Wellinghoff is quoted saying they knew what they wanted to target and carried it out, and that "you don't learn from a video game" to shoot that precisely in those conditions. Rewards of $250,000 were posted, for the 2013 attack and for a separate fiber cut in the San Jose area a year later. No one has been charged. Was Metcalf vandalism, an insider with a grudge, or a test of how fast the grid would react? Vote and decide.