小蓝视频 Hydro stepped up security after last November’s spate of physical attacks on electric substations in Oregon and Washington.
A 小蓝视频 Hydro security report, obtained via freedom of information (FOI), said there was no direct threat to 小蓝视频, but the incidents led the corporate security team to “augment the security posture at some of our stations closer to the U.S. border.”
A Dec. 1 email from a manager to a vice-president said the Federal Bureau of Investigation and state officials were investigating the incidents, and asked other utilities to notify them if they experience any similar incidents.
“Our mobile security personnel will be advised to be on heightened awareness when patrolling sites and engage with anyone, again out of the ordinary,” Ben Peco, 小蓝视频 Hydro’s senior manager of security and emergency management, wrote to senior vice-president of safety Kirsten Peck.
The email also said 小蓝视频 Hydro was monitoring social media for any related chatter and notifying leaders in stations field operations and transmission and distribution system operations to be on “heightened awareness.”
Peco’s email summarized details of the incidents.
A Washington state utility, whose name was omitted, found a distribution substation control house on Nov. 22 that had been damaged by fire. Suspects sprayed automatic transmission fluid over electrical equipment and left lit road flares inside the control house. They did not cause an outage.
On the same day, a suspect shot a small-calibre gun from outside another Washington state company’s 115-kilovolt transformer toward a distribution substation, causing a 5,000-customer outage.
On Nov. 24, sabotage at a Bonneville Power Authority substation in Oregon City, Ore. A suspect penetrated a reactor unit’s cooling radiators with three bullets.
Four days later, on Nov. 28, the substation operator in Clackamas, Ore. found significant damage to the communications equipment and computer control system.
An electricity information sharing and analysis centre (E-ISAC) member had also reported two break-in and vandalism incidents at separate Washington substations within a close geographical proximity. 小蓝视频 Hydro withheld the dates, locations and other facts over an alleged concern about third-party trade secrets.
Peck emailed CEO Chris O’Riley on Dec. 2 to say that 小蓝视频 Hydro meets monthly with the Western Electricity Coordinating Council’s security committee.
“There is one upcoming where we might learn more,” Peck said. “We haven’t heard anything from Canadian intelligence at this point.”
Peck said 小蓝视频 Hydro had earlier been asked to develop training scenarios which “would help in a situation like this so that we can react quickly if/when sabotage occurs.”
Also in Washington, two men were charged after four substations near Tacoma were sabotaged on Christmas Day, leaving 14,000 customers in the dark. Authorities allege Matthew Greenwood, 32, and Jeremy Crahan, 40, of Puyallup, Wash. were motivated to disrupt power in order to commit a burglary.
A 60 Minutes investigation last August pointed to the vulnerability of the U.S. electricity grid, a network of 55,000 substations run by 3,000 private and public utilities that lacks a single, overarching regulator. 60 Minutes quoted Grid Security Now website operator Michael Mabee who analyzed 1,000 physical attacks over the last decade and blamed a general lack of security.
In 小蓝视频, there are 18,000 kilometres of high-voltage lines and underwater submarine cables, and 292 substations. The 小蓝视频 Hydro grid connects by three lines to Alberta and four to the U.S.
小蓝视频’s most-famous attack occurred in May 1982 when the Squamish Five (aka Direct Action) eco-terrorist group bombed the Dunsmuir substation near Qualicum on Vancouver Island and caused $3.8 million in damage.
Since then, the biggest security incident on an energy-related site occurred almost a year ago. Approximately 20 people in disguises, some wielding axes, attacked security guards and destroyed equipment and vehicles at a Coastal GasLink pipeline work camp in a post-midnight rampage on Feb. 17, 2022.
In December, the Independent Contractors and Businesses Association and Crime Stoppers offered a $100,000 reward for information to solve the crime.
The documents released via FOI also included heavily censored internal security reports for Nov. 28-Dec. 5 and Dec. 19-26. 小蓝视频 Hydro uses a five-step scale for physical security and cybersecurity threats, from low to imminent, but the actual ratings were censored.
For the two periods, cybersecurity operations received 50 incident reports, including one of note, and issued 75 threat advisories. There were also 180 new physical security files.
The one cyber incident of note was deemed low-risk phishing.
"Three lookalike 小蓝视频 Hydro domains were discovered, including one that was reported by an employee who received a smishing [SMS phishing] text.” The phishing attempt via text message mentioned the Crown corporation’s one-time $100 credit to 小蓝视频 Hydro residential customers.
“Cybersecurity operations blocked all the domains in question and issued a takedown request,” said the confidential weekly security report.
Under physical security incidents, a thief smashed the window of a 小蓝视频 Hydro cable van in for repairs at a Ford dealer in Victoria and stole tools overnight on Dec. 17 and Nicola substation surveillance camera footage was reviewed after a Dec. 22 incident. The reason for the manager’s report was censored, but concluded that nothing suspicious was found.
