This week’s revelation about a drone’s close encounter with a Pennsylvania power substation joins other troubling indicators of the physical threat to energy infrastructure as expressed by extremists of varying ideologies.
A Joint Intelligence Bulletin from DHS, FBI and the National Counterterrorism Center to law enforcement said that on July 16, 2020, a small, four-rotor off-the-shelf drone was discovered on the top of a building next to the power substation. Nylon ropes hanging from the drone dangled a two-foot curved piece of copper wire, and analysis of the device indicated that this was likely intended to short circuit the substation in “the first known instance of a modified UAS likely being used in the United States to specifically target energy infrastructure.”
The operator of the drone still has not been identified; the UAS camera, memory storage card, and all identifiable markings had been removed, indicating that the operator was trying to avoid identification and was also likely “within visual line of sight of the intended target” while flying the drone. The bulletin notes that the incident, which did not result in any disruption to the power grid, was first included in an August 2020 DHS report disseminated on the Homeland Security Information Network and was resurrected to raise awareness about the potential capability of modified drones.
The bulletin cited other too-close-for-comfort drone operations near critical infrastructure and stressed that while these incidents could be the result of drone operators who lack awareness of their flight paths, potential illicit activity cannot be ruled out and targeting of other critical infrastructure facilities using UAS is expected.
The day after ABC News first reported on the bulletin, a familiar meme emphasized that power stations are a vulnerable and enticing target for violent extremists and accelerationists.
One Twitter account that gives “mad respect” to the Nazis for mass murder at Auschwitz, glorifies Oklahomas City bomber Timothy McVeigh and Olympic Park bomber Eric Rudolph, and spouts other racist and antisemitic content posted a map of power grid interconnections Thursday, writing that the fragility of the grid is “convenient for foul play” and recommending a specific portable band saw for cutting metal, and separately posting images of power lines, a cell phone tower, a tanker truck and a bridge while citing founder of the eco-fascist Pine Tree Party Mike Ma — a meme commonly seen across social media and online forums. “Electricity is a ghost, but one you can catch and kill… Do not become the sort of person who gets really good at blowing power stations up while never getting caught,” Ma wrote in his 2019 book Harassment Architecture.
Another commonly referenced attack is the 2013 incident in which multiple gunmen opened fire on the Pacific Gas and Electric Company’s Metcalf Transmission Substation south of San Jose, Calif., causing more than $15 million in damage to 17 transformers. It also appears to have been a likely reference for one group accused of plotting an attack on the power grid.
Substation Plot to ‘Cause Chaos for the Country’
In August, the U.S. Attorney’s Office in the Eastern District of North Carolina announced a superseding indictment levying additional charges of targeting energy facilities against Paul James Kryscuk, Liam Collins, Jordan Duncan, and Joseph Maurino; Collins and Duncan are former Marines who were previously stationed at Camp Lejeune along with Justin Hermanson, an active-duty Marine named in the original indictments focusing on weapons charges, and Collins and Kryscuk are alleged to have been members of the now-defunct Iron March neo-Nazi online forum. Duncan worked as an Air Force and then Navy contractor after leaving active duty. Maurino is a member of the Army National Guard.
On Iron March, Collins discussed forming “a modern day SS” in which all members were “going to be required to have served in a nation’s military.”
“I’ll be in the USMC for 4 years while my comrades work on the groups physical formation,” Collins wrote, according to the indictment. “…It will take years to gather all the experience and intelligence that we need to utilize – but that’s what makes it fun.”
The Justice Department says that in early 2017 Kryscuk, in discussion with Collins, wrote that the group’s “first order of business is knocking down The System, mounting it and smashing it’s [sic] face until it has been beaten past the point of death… eventually we will have to bring the rifles out and go to work.” Then would come “buying property in remote areas that are already predominantly white and right leaning, networking with locals, training, farming, and stockpiling” and preparing for “a takeover of local government and industry.” As the size of their force and territory grew, the plan continued, they would then attack urban areas in “a ground war very reminiscent of Iraq.”
The indictment describes the manufacturing and illegal acquisition of weapons, collecting information on “various weaponry, to include firearms, explosives, and even nerve toxins,” surveillance of Black Lives Matter protests and discussions about attacking protesters, and members meeting in Idaho to train together. One recruitment video from training in July 2020 showed participants in Atomwaffen Division masks and giving Nazi salutes.
In the third superseding indictment filed on Aug. 18, Kryscuk, Collins, Duncan, and Maurino are alleged to have discussed attacking the power grid both “for the purpose of creating general chaos and to provide cover and ease of escape in those areas in which they planned to undertake assassinations and other desired operations to further their goal of creating a white ethno-state.” The four also “discussed using homemade thermite to burn through and destroy power transformers.”
The four “researched, discussed and critically reviewed at length a previous attack on the power grid by an unknown group,” the indictment states. “That group used assault-style rifles in an attempt to explode a power substation.” That attack is not named but can be assumed to be the Metcalf attack; surveillance and re-enactment videos can be found online.
Hermanson is alleged to have shown an individual a re-enactment of the attack and stated “that if his group would manage to blow up one of these substations, it would take down the entire regional or coastal power grid and cause chaos for the country.” Hermanson was allegedly asked by Collins to purchase Tannerite, which can be used to make thermite.
In October 2020, the four named in the superseding indictment “discussed their plans to take out the power grid,” including “a handwritten list of approximately one dozen intersections and places in Idaho and surrounding states” that “contained a transformer, substation, or other component of the power grid for the northwest United States, that if destroyed could cause damage exceeding $100,000 to the power grid.” Collins, Kryscuk and Duncan were arrested that month.
Critical Infrastructure in the Crosshairs
A National Socialist Order (formerly known as the neo-Nazi Atomwaffen Division) video posted on Telegram earlier this year used simple animation to encourage followers to identify allies and enemies and finally act – and the first “act” depicted an individual chucking an incendiary device at a power substation that subsequently bursts into flames. The video, which also depicted a vehicle attack on protesters and an assassination of a person behind a podium, encouraged followers to educate themselves with books such as The Turner Diaries before attacking.
The Base, another neo-Nazi group, in New Jersey distributed a 2019 propaganda image showing two members saluting in front of power lines.
One social media account that was sharing accelerationist memes and references to the Boogaloo Bois posted an animated meme depicting a masked shooter in front of a power substation to the tune of “Electric Avenue.” Another meme posted on YouTube in April 2020 and circulated in other online forums asked people to “repost if you would dismantle the electrical transmission grid with your male followers” and included a short video showing an unknown individual blowtorching the leg of a transmission tower.
Anti-government propaganda also has included memes encouraging wreaking vast destruction on infrastructure and civic institutions. “Killdozer” memes circulate online that reference the 2004 incident in which Marvin John Heemeyer demolished numerous buildings with a modified bulldozer in Granby, Colo. The memes are popular with anti-government extremists and Boogaloo, and were shared by Steven Carrillo, the airman who said he wanted to start a civil war and was arrested in the May 2020 killing of a Federal Protective Service security contractor in Oakland.
Conspiracy theorists online also have claimed that there is a suspicious, nefarious, or “false flag” nature to grid security exercises that are announced and conducted by government entities in conjunction with private-sector stakeholders. A worrisome threat with conspiracy theory extremism is the possibility that a believer may feel driven to stop something they think is bad, and could take violent action against one of these exercises or the infrastructure itself.
Islamist Groups Target Power
The first issue of al-Qaeda’s English-language One Ummah magazine published in 2019 specifically encouraged hacking the power grid but acknowledged this would require tech capability and investment, training, and appropriate recruiting of skilled jihadists. Regardless, adherents were encouraged to “focus their energies on creative ways of dismantling the enemy’s electronic and cyber defenses.”
But Islamist extremist propaganda has also urged physical attacks on critical infrastructure. A 2019 online threat from ISIS supporters depicted a faceless figure in a black hoodie with a faint Islamic State flag standing in front of transmission towers and lines holding a bomb. Along the power lines was the phrase “Just Terror” — the ISIS slogan for lone jihadist operations — and blood-spattered ground. The poster directed jihadists to “make a surprise for the Crusaders.”
Some of the encouragement that could lead inspired followers to attack the energy sector is more indirect, with ISIS depicting complex attacks that can cripple major metropolitan areas and encouraging would-be jihadists to think outside of the box and try less common tactics, targets that have downstream effects beyond the initial attack (such as one call from ISIS supporters to attack gas stations or oil pipelines), or take advantage of their unique skillsets or access — such as lone actors who are employed at sensitive or critical infrastructure facilities.
But ISIS has turned talk into execution with attacks on the energy sector in Iraq — a region where the group has also done test runs with drones for reconnaissance purposes, filming attacks, and IED delivery. In August, the Iraqi military launched a special operation against ISIS after attacks on transmission towers that supplied power to part of Baghdad’s water system — using one critical infrastructure sector to cripple another.
This followed months of attacks on power lines in a country that relies heavily on air conditioning. In June, ISIS claimed responsibility for a Katyusha rocket attack that damaged the generating unit at the Salah al-Din Power Station in Samarra. In July, a trio of high-voltage lines in Kirkuk were blown up with remotely detonated devices. Dozens of transmission towers were damaged or destroyed over the summer.