Fires require little expertise and can cause major outages. Substations are vulnerable due to dry vegetation and flammable components. Countermeasures include fire-resistant materials, vegetation management and thermal detection.
For decades, the electric grid has faced a range of security challenges. Historically, these threats were largely limited to opportunistic crimes such as copper theft, equipment vandalism and unauthorized access. In response, utilities implemented relatively modest security measures that were generally seen as sufficient for the level of risk at the time.
However, in recent years, the threat landscape has shifted. Increasingly, the grid has become the target of more deliberate, sophisticated and sometimes coordinated attacks. These emerging threats have exposed the inadequacy of traditional security practices, particularly when it comes to protecting the most critical substations and infrastructure.
As reported by E-ISAC, since 2018 there has been a 5-fold increase in attacks and incidents against the grid, with ballistic attacks also rising sharply.
This Insight explores the evolving nature of physical threats to the electric grid, examines the historical context of grid-related attacks, the motivations and objectives behind them and the changing security strategies required to safeguard the most critical substations on the grid.
Understanding Transmission’s Role in Grid Reliability
The Bulk Electric System (BES) is an extensive network of generation facilities, high-voltage transmission lines, substations and associated control systems that work together to reliably deliver electricity across vast geographic regions. Among these components, transmission substations play a pivotal role, acting as critical nodes responsible for voltage regulation, transformation and the routing of electrical power from generation plants to distribution systems. Transmission substations typically operate at high voltage levels between 100-765 kilovolts (kV) and their integrity is fundamental to maintaining overall grid stability and the continuity of electricity supply across large areas.
In contrast to distribution systems, which handle lower voltage electricity to local communities, neighborhoods and end users, transmission systems route significantly higher power flows, often traversing state and regional boundaries. The sheer scale and interconnectedness of transmission infrastructure inherently increases their vulnerability and the potential consequences of disruption. Unlike distribution assets, transmission substations, due to their centralized and strategic positions within the BES, can trigger widespread outages if compromised.
Safeguarding critical transmission infrastructure is an imperative national priority, given the electric grid’s foundational role in economic stability, public safety and national security. Disruptions to transmission substations could result in cascading failures with significant economic consequences, underscoring the urgency of robust physical security strategies.
A Turning Point: Substation Attack
Years ago, an attack on a power substation was a watershed event in infrastructure security. Assailants severed fiberoptic telecommunications cables and attacked critical transformer equipment, causing significant damage. Although service disruption was minimized due to timely rerouting and redundancy, the incident underscored the need for enhanced physical security measures and policy revisions nationwide. This event directly influenced regulatory responses, particularly the Federal Energy Regulatory Commission (FERC) and North American Electric Reliability Corporation (NERC), catalyzing the development and implementation of NERC CIP-014, a dedicated physical security standard aimed explicitly at protecting critical substations against attacks.
NERC CIP-014 Sets the Standard for Physical Security Enhancements
The NERC CIP-014 Standard was established to explicitly identify and protect substations in both the US and Canada which are deemed critical due to their potential to impact overall grid reliability. Under CIP-014, utilities must identify substations whose disruption could result in widespread instability or uncontrolled outages and develop comprehensive security plans accordingly. Compliance with CIP-014 requires rigorous threat assessments, physical security enhancements, and periodic reviews, thereby formalizing and enforcing robust security protocols across the industry.
NERC periodically convenes committees to revise and refine the CIP-014 standards using collaborative forums and cross-functional working groups which are active across utilities, regional entities and industry associations. These groups, often composed of representatives from corporate security, system planning, compliance and operations teams, play a key role in sharing implementation strategies, reviewing threat assessments and shaping how CIP-014 is interpreted and applied. Additionally, previous CIP-014 revisions have been informed by NERC’s Standards Drafting Teams, where industry stakeholders provided input on technical language, applicability criteria, and mitigation expectations. Such collaborative efforts foster consistency, innovation and continuous improvement in protecting critical transmission substations from emerging physical threats.
What’s Driving the Current Threat Landscape?
Transmission substations are increasingly perceived as attractive targets for a variety of reasons, such as politically motivated domestic extremism, or international terrorism, anti-technology beliefs (i.e., Luddite and related ideologies) and people who want to sow distrust in institutions, or hamper crime responses. These types of threats represent criminal activity, but they persist. Current threats include:
With ballistic attacks increasing over 400% in the past five years, they represent an evolving and highly concerning threat to substations. Attackers using rifles or handguns target transformers, circuit breakers and other essential equipment that, once damaged, can cause substantial outages.
Though less common, explosives pose a severe risk, especially to large, hard-to-replace transformers. Enhanced barriers and blast-resistant designs are essential.
Drones present a growing threat, capable of surveillance or attacks. Utilities must invest in detection, tracking and standoff strategies within regulatory frameworks.
Attacks can release oil or SF₆, a greenhouse gas 23,000 times more potent than CO₂. This can lead to contamination, fines and costly cleanups, making physical security also an environmental priority.
People with inside knowledge of the substation’s components may carry out damaging acts against substations.
Due to their critical role and cascading failure potential, substations are targets to terrorists. High-value transformers with long procurement lead times intensify this risk, highlighting the need for strong national security resilience strategies.
Together, these evolving motives highlight the need for a layered, risk-based approach to substation security which was not typically considered decades ago when many of these substations were built.
Modern Security Approaches are Critical for Substation Protection
The evolving threat landscape requires utilities to reevaluate existing security infrastructure. NERC emphasizes the importance of implementing a defense-in-depth strategy that integrates both physical and cyber security measures. This approach involves multiple layers of security controls designed to detect, delay and respond to unauthorized access attempts effectively. NERC’s guidelines advocate for the integration of advanced technologies and security practices into the planning, design and operation of the electric grid to enhance its resilience against emerging threats.
Reassess Physical Security Measures
In light of these considerations, utilities are encouraged to assess and upgrade their physical security measures, moving beyond minimal standards such as chain link fencing to adopt comprehensive solutions that address the complexities of current and future threat scenarios.
Plan for Risk-Based Decision Making
Utilities typically make these decisions after careful risk assessment, considering factors like asset criticality, redundancy and local threat environments. This process should, however, start at the planning and design phase for projects involving new substations or construction projects that are altering existing stations. Some of these costs can be passed on to ratepayers, while others are absorbed as operational costs, but both have implications for the business. This more pragmatic approach ensures resources are allocated effectively, balancing security needs with economic sustainability. The risk management approaches can vary depending upon whether the infrastructure is being designed and built for the future or a retrofit of existing facilities.
Implement Security Technologies
The exact strategies and technologies being used in industry to protect substations vary and are not generally part of public discussion. Utilities across various regions have adopted diverse approaches to retrofitting existing substations to enhance security in the face of these increasing threats. These measures can include deploying gunshot detection systems, drone detection systems, bigger and stronger gates/fences, ballistic hardening, enhanced thermal imaging and a wide array of sensors. Some utilities even hide substations inside multi-story buildings that can take up an entire city block or purchase large swaths of land to create buffer zones on either side of the substation.
Adopt Layered and Risk-Informed Security Enhancements
Utilities are generally applying a layered and risk informed approach to physical security enhancements, incorporating best practices aligned with CIP-014 requirements. Substation upgrades must be guided by detailed risk assessments that consider criticality, location specific threats and system impacts. Implementing enhancements to perimeter security, access control and threat detection systems improve infrastructure resilience. By integrating multiple security measures into each substation upgrade, utilities can maximize resilience against threats, ensuring operational continuity even during targeted attacks.
Communicate with Stakeholders and the Community
Utilities should also communicate security enhancements to stakeholders, regulators and to local community permitting groups as necessary. Transparent, educational outreach initiatives highlight the rationale behind investments and their critical role in ensuring community safety and national security. Acknowledging public questions and concerns about community impacts due to these security changes is also important, as they balance those issues with the public good by having a reliable electric grid.
Maintain Compliance Flexibility as Regulations Evolve
As the threat landscape continues to evolve, regulatory frameworks must adapt to support the implementation of modern, effective physical security measures. While NERC CIP-014 provides a foundational performance standard for identifying and protecting critical transmission substations, it leaves significant discretion to each utility in determining their own specific mitigation strategies. In certain jurisdictions, existing regulations or permitting constraints may inadvertently hinder the deployment of advanced security features, which can jeopardize the overall reliability for the grid on a large scale or regional basis.
Leverage Industry Best Practices
Utilities are encouraged to proactively leverage established industry best practices and guidance documents provided by authoritative organizations, such as the NERC and the Electric Power Research Institute (EPRI). By referencing widely accepted guidelines and frameworks, utilities can strengthen their decision-making processes, demonstrate prudent judgment to regulators and stakeholders, and ensure that their physical security measures align effectively with current and emerging threats. Utilizing industry benchmarks not only helps bridge compliance gaps or uncertainties but also fosters consistency, resilience and a higher standard of protection across the broader electric power industry.
Next Steps: TRC Can Help
Due to the evolving and escalating threats to transmission substations, proactive and comprehensive physical security measures are indispensable. Partnering with a trusted leader like TRC can help utilities navigate these complexities and confidently implement best-in-class security strategies. TRC has a fully functional team comprised of security practitioners, threat analysts, security designers, engineers, attack specialists and others to assess, design and implement enhanced security measures to protect these critical facilities.
Our tested practitioners help utilities meet the security and emergency response challenges of today while preparing for the demands of the future. With decades of combined experience, and one of the highest rates of professional certifications in the industry, we deliver threat and vulnerability assessments, security plans, design, training, exercises and disaster recovery support.
Drawing from a wide range of professional backgrounds, our diverse team provides direction setting perspectives that bring insight and best practices so we can understand your goals and craft comprehensive solutions to your unique needs.
