(Bloomberg Businessweek) -- People in a quiet neighborhood in Carthage, a town in Moore County, North Carolina, heard a series of six loud pops a few minutes before 8:00 p.m. on Dec. 3, 2022. A resident named Michael Campbell said he ducked at the sound. Another witness told police they thought they were hearing fireworks.
The noise turned out to be someone shooting a rifle at a power substation next door to Campbell’s home. The substation, operated by the utility Duke Energy Corp., consists of equipment that converts electricity into different voltages as it’s transported to the area and then steered into individual houses. The shots hit the radiator of an electrical transformer, a sensitive piece of technology whose importance would likely be understood only by utility company employees. It began dumping a “vast amount” of oil, according to police reports. A subsequent investigation has pointed to a local right-wing group, one of a wave of attacks or planned attacks on power infrastructure.
By 8:10 the lights in Carthage went out. Minutes later, a security alarm went off at a Duke Energy substation 10 miles away, this one protected from view by large pine trees. When company personnel responded, they found that someone had shot its transformer radiator, too. Police found shell casings on the ground at the site and noticed someone had slashed the tires on nearby service trucks.
The substations were designed to support each other, with one capable of maintaining service if the other went down. Knocking out both facilities prevented the company from rerouting power. Police described the two incidents as a coordinated attack.
About 45,000 families and businesses remained dark for four days. This was a burden for area grocery stores and local emergency services. One woman, 87-year-old Karin Zoanelli, died in the hours after the shooting when the blackout caused her oxygen machine to stop operating. The North Carolina Medical Examiner’s office classified the death as a homicide.
The attack on Duke’s facilities in Moore County remains unsolved, but law enforcement officials and other experts suspect it’s part of a rising trend of far-right extremists targeting power infrastructure in an attempt to sow chaos. The most ambitious of these saboteurs hope to usher in societal collapse, paving the way for the violent overthrow of the US government, according to researchers who monitor far-right communities.
Damaging the power grid has long been a fixation of right-wing extremists, who have plotted such attacks for many years. They’ve been getting a boost recently from online venues such as “Terrorgram,” a loose network of channels on the social media platform Telegram where users across the globe advocate violent white supremacism.
In part, people use Terrorgram to egg one another on—a viral meme shows a stick figure throwing a Molotov cocktail at electrical equipment. People on the forum have also seized on recent anti-immigration riots in the UK, inciting people there to clash with police. In June 2022, months before the Moore County shootings, users on the forum began offering more practical support in the form of a 261-page document titled “Hard Reset,” which includes specific directions on how to use automatic weapons, explosives and mylar balloons to disrupt electricity. One of the document’s suggestions is to shoot high-powered firearms at substation transformers.
Telegram in a statement said that it forbids explicit calls for violence on the platform and that moderators monitor public parts of the site and use AI and user reports to remove content that violates the company’s terms of service. On Aug. 24, the company’s chief executive officer, Pavel Durov, was taken into custody in France on suspicion of failing to take steps to prevent criminal use of Telegram, according to Agence France-Presse. The following day in a post on X, formerly known as Twitter, the company said it abides by European laws. “It is absurd to claim that a platform or its owner are responsible for abuse of that platform,” it wrote.
Attacks on power facilities have spiked recently. Power companies reported 185 physical attacks or threats on grid infrastructure in 2023, more than double the number from 2021, according to the North American Reliability Corp. (NERC), an industry group that monitors risks for utilities. Extremists have planned to knock out power at substations near scheduled Black Lives Matter protests, according to court records. Others planned to hit hydroelectric stations and other critical infrastructure. Since 2022, police have charged suspects in connection with plots to attack energy facilities in Idaho, Maryland and Ohio.
Such domestic terrorism exemplifies the way that online subcultures can develop into real-world threats. The US Department of Homeland Security has issued a series of public advisories about white supremacist extremism, and lawmakers are requesting more information about threats to the grid. The greatest terrorism threat to the US, FBI Director Christopher Wray told Congress in December, comes from lone individuals and small cells who become radicalized online then use accessible weapons to attack soft targets. Threats against critical infrastructure are becoming more acute as the election approaches, according to a senior US law enforcement official tracking this activity, who spoke to Bloomberg Businessweek without authorization and thus asked not to be named. Half of swing state voters expect violence around the US presidential election in November, according to a May Bloomberg News/Morning Consult poll.
Strategic blackouts could affect voting locations or impact the certification of elections, says Kristofer Goldsmith, founder of the nonprofit Task Force Butler Institute, a veterans group dedicated to countering extremism. “Something like a grid attack before, during or after an election could sow an unbelievable amount of political chaos,” he says.
Researchers warn that online conspiracy theorists are also likely to seize on any outages that coincide with an election to further undercut trust in electoral systems. “The past four years have seen more conspiracies focused on action on the local and regional levels,” says Katherine Keneally, director of threat analysis and prevention at the Institute for Strategic Dialogue, a think tank that tracks extremism.
In Moore County, a preliminary analysis of the spent ammunition showed that the bullets used to disable both substations came from the same gun, an AR-15-style rifle. Investigators recovered surveillance video from a local storage company of a white van moving in and out of the area within minutes of the gunfire, a promising lead that didn’t result in any arrests.
Search warrants indicate that it took detectives only a few days to identify suspects associated with a right-wing group called the Moore County Citizens for Freedom. Members of the group, which was involved in the Jan. 6 attack on the Capitol, complained online about a local drag show scheduled to start around the same time of the attack. Witnesses reported that it had developed a plan to disrupt substations in the area. (The drag show went on, with performers singing Beyoncé songs in the dark.)
FBI agents interviewed one man who said he understood the Moore County Citizens for Freedom had developed a plan to attack the power grid, though he told police he’d thought the plan had been called off.
In a warrant, police said the gunmen had “intimate knowledge of the substations far beyond the average person.” Police identified one suspect who’d worked closely with substation transformers while working for another power company and who’d told friends about his connections to the Moore County Citizens for Freedom. A separate warrant concluded that the suspect’s wife’s phone had connected to an AT&T cell tower located near one of the downed substations around the time of the attack.
Yet almost two years after the incident, no one has been arrested. The Moore County Sheriff’s office declined to comment for this story, citing the ongoing investigation. The Moore County Citizens for Freedom didn’t respond to a request for comment on this story.
Weeks after the Moore County attack, the FBI says two suspects hit four substations on Christmas morning in Washington state, leaving about 7,000 people without power. In 2022 three men pleaded guilty to planning attacks on multiple substations through the US in the hopes of starting a race war; three other men with ties to an online forum dedicated to white supremacy called Iron March were sentenced to prison this July for a similar scheme targeting infrastructure in the Northwest.
In another plot from January 2023, the details of which were recounted in court records, a man named Brandon Russell, another former Iron March user, and a partner allegedly planned to shoot at multiple power plants around Baltimore. Communicating in a series of online chats, Russell and Sara Beth Clendaniel allegedly shared public maps of grid infrastructure around the US, widely distributed on Terrorgram channels, to find a “ring” of stations around the Baltimore region. They also studied engineering videos that explained the attack in Moore County and decided they needed to “destroy these cores, not just leak the oil,” according to court records. Russell, who’s scheduled to stand trial in November, has pleaded not guilty. Clendaniel pleaded guilty and faces up to 20 years in prison. She’s due to be sentenced in September.
Power companies, including Duke Energy, have raced to increase their defenses. The NERC recently involved more than 250 participants in an emergency simulation that assessed grid reliability, and the Department of Energy said in January it will dedicate $70 million to boost resiliency.
Yet the attacks remain difficult to defend against, and researchers warn that hyperpartisanship around the election is poised to inspire more extremists. “This is the time when accelerationist and far-right communities pick up and start focusing more online,” says Ben Decker, founder and chief executive officer of the threat intelligence company Memetica. “This will 100% be a contribution to the larger conversation, and they’re trying to convince new recruits to take action.”
In June, a shooting at a Duke Energy facility in Durham, North Carolina, caused another blackout for hundreds of customers. Gunfire struck an electrical transformer, causing a slow leak, just as it had in Moore County and just as it was described in the Terrorgram documents.
That case remains unsolved.
©2024 Bloomberg L.P.