What happens when the power goes out—and it’s not an accident?
In recent years, attacks on our nation’s critical infrastructure have revealed just how fragile these modern systems we all rely on really are.
When infrastructure fails, the effects cascade fast: hospitals strain, medical devices stop working, fuel pumps go offline, and public safety degrades. Civilians often suffer the most, even though they play no role in protecting these systems.
In this episode, we examine real attacks on the U.S. power grid, what actually happened on the ground, how some plots were detected and stopped, and what these incidents reveal about risk, preparedness, and resilience.
We’ll also explore what you can realistically do—without paranoia or vigilantism—to recognize warning signs, respond during outages, and reduce second-order effects when systems fail.
Let’s go…
In this episode, we’re going to talk about critical infrastructure—not in abstract policy terms, but through real attacks that have already happened here in the United States.
We’ll walk through several documented cases where electrical substations were deliberately targeted: what the attackers did, why they did it, how the attacks unfolded, and what happened afterward. We’ll look at the damage caused, the human consequences, and in some cases, how law enforcement intervention prevented things from getting much worse.
More importantly, we’ll translate those lessons into civilian terms.
Because even if you don’t work in law enforcement, utilities, or emergency management, you still depend on these systems every day. And when they fail, the burden doesn’t fall evenly. The elderly, the sick, families with children, and unprepared communities feel it first and hardest.
Remember, preparedness is the remedy to uncertainty, so let’s clear away the cob webs and get clarity on what you can actually do to mitigate the effects if an aspect of the grid goes down in your area.
By the end of this episode, you should have a better understanding of:
How fragile modern infrastructure actually is
Why small attacks can have outsized effects
What warning signs often appear before an attack
What responsible, non-dramatic preparedness looks like
And how civilians can contribute to stability instead of becoming part of the problem when systems fail
This is about awareness, resilience, and maintaining order when the systems we rely on are stressed—or deliberately attacked.
Before we get into specific attacks, let’s frame the issue. Critical infrastructure is the backbone of modern life. In 2006, the Department of Homeland Security established the National Infrastructure Protection Plan (NIPP). It’s a risk management framework designed to give structure for the federal government, state and local agencies, and private entities manage risk collaboratively across all sectors. The plan identifies 16 sectors of critical infrastructure (CI) as the foundational framework for its risk management approach focusing on system-level resilience and integration of cyber/physical security for safeguard power stations, water treatment, healthcare, heating, communications, fuel pipelines, transportation systems, and more.
As you can imagine, many of these sectors are interconnected, so if one of these systems fail, the consequences cascade and impact the others quickly.
Imagine a winter day when the power goes out for thousands of homes. Hospitals have to run on generators. Traffic signals stop working. Gas pumps fail. Even short outages can ripple outward, creating medical emergencies, economic losses, and safety hazards. Civilians are always affected—even if they play no role in protecting these systems.
That’s why understanding infrastructure vulnerabilities isn’t just for professionals—it’s relevant to everyone.
You might think sophisticated cyberattacks are the main threat—and sometimes they are—but in many cases, attacks are low-tech and physical.
Substations, for example, are often exposed, with minimal security. Rifle fire, sabotage, cutting fences, or even explosives can disable critical equipment. Reconnaissance—observing patterns of security, noting gaps in surveillance—is often part of the planning process.
And the motives vary. Some attacks are criminal: opportunistic acts to create blackouts for burglary. Others are ideological. Some are entirely unknown, driven by curiosity or mischief. The common thread is that these attacks are often simple—but the consequences can be catastrophic.
Resource: National Infrastructure Protection Plan
Let’s look at some real-world examples.
This first case involved an individual by the name of Brandon Clint Russell, the alleged founder of the Florida‑based neo‑Nazi group, the Atomwaffen Division, and Sarah Beth Clendaniel, a Catonsville, Maryland resident with prior felony convictions. Russell and Clendaniel conspired together; he provided extremist ideology and planning guidance, she was positioned on the ground to carry out the attack. The conspiracy was active between 2022-2023.
According to reports, the two planned, a coordinated attack on five electrical substations in the Baltimore, Maryland region designed to cause a cascading failure of the power grid, which could have disrupted electricity, heat, hospitals, fuel, and communications across the metropolitan area.
According to reports, the defendants subscribed to a white supremacist‑linked ideology and an extremist doctrine called accelerationism — the belief that orchestrated violence can hasten societal collapse. Russell saw infrastructure destruction as a way to “completely destroy this whole city” and further his extremist goals.
Russell shared open‑source infrastructure maps with Clendaniel and a confidential informant. They discussed methods to strike transformers with firearms to cause cascading outages. Clendaniel identified multiple substations around the city to hit on the same day for maximum effect. Conversations included the belief that a few well‑placed shots could knock out critical grid functions.
Law enforcement became aware of the plot through a confidential informant working with the FBI.
On February 3, 2023, agents executed a search warrant at Clendaniel’s residence, seizing firearms and ammunition despite her status as a prohibited person. Both defendants were arrested before the plot could be executed.
Clendaniel pleaded guilty to federal conspiracy charges and was sentenced to 18 years in prison plus supervised release. Russell was found guilty of conspiring to damage an energy facility and, in August 2025, was sentenced to 20 years in federal prison with a lifetime of supervision.
Prosecutors estimated the planned attack could have caused over $75 million in damage and widespread service disruption if executed.
Lessons learned:
Violent infrastructure attacks can be ideologically motivated and planned well in advance.
Federal investigations and informants can intercept plots before execution, preventing large‑scale disruption.
These style of attacks don’t require high levels of sophistication to be effective - estimated damages could’ve rose to $75 million.
Targeted attacks on power grids are viewed by extremists as an effective way to destabilize communities.
Resource: Learn more about the Baltimore Grid Plot here.
In this case, we focus on a group of unknown attackers, which as of the most recent reporting, no arrests have been made, and the motive remains unconfirmed.
The attack occurred on December 3, 2022, in Moore County, North Carolina, against two electrical substations owned by Duke Energy, which were deliberately shot by unknown assailants with rifles, damaging transformers and other components. The attack occurred in the evening when substations were staffed minimally.
The motive has not been publicly established, but law enforcement officials described the incident as “intentional, willful and malicious.”
From what we can tell, the assailants used rifles to open fire on transformer banks and critical switchgear. Ballistic evidence (shell casings) was recovered on site, but no vehicles or suspects were publicly identified at the time of the report.
Nearly 35,000 residents where without power for several days, hospitals switched to backup generators; and heat and water systems were disrupted. At least death was linked to the outage (a medical emergency exacerbated by the power loss) and county officials declared a state of emergency and imposed curfews as the community struggled with prolonged outage effects.
Law enforcement coordinated with Duke Energy and federal partners, ballistics were run to identify possible connections, rewards were offered for information leading to arrests, but no arrests have been forthcoming.
Lessons learned:
Physical attacks on grid infrastructure can have immediate, severe civilian impacts.
Extended outages risk medical emergencies and loss of life, not just inconvenience.
Lack of arrests highlights the challenge of solving crimes where perpetrators leave little evidence or evade capture.
Learn more about the North Carolina attack here.
On Christmas Day, December 25, 2022, a coordinated series of deliberate attacks on electrical substations in Pierce County, Washington left thousands of people without power during a major holiday and winter weather. These were not isolated acts of vandalism — they caused up to 3 million of dollars in damage and triggered a multi‑agency law enforcement response that led to federal criminal charges.
According to a press release by the Department of Justice, the suspects were two men from Puyallup, Washington: Matthew Greenwood, age 32, and. Jeremy Crahan, age 40.
Both were ultimately charged in U.S. District Court with conspiracy to damage energy facilities and possession of unregistered firearms after a fast‑moving federal investigation.
Early on Christmas Day, multiple electrical substations in and around the Tacoma area were breached and sabotaged:
Four substations were targeted — two operated by Tacoma Power (Tacoma Public Utilities) and two by Puget Sound Energy (PSE).
The attackers gained access past perimeter fencing, manipulated equipment, and disabled key systems, causing power outages.
One substation was reportedly set on fire after equipment was tampered with.
In the criminal complaint, investigators noted that the suspects used bolt cutters to break into the facilities and manipulated switches or breaker controls to shut down service, causing arcing and sparking in at least one case. FOX 13 Seattle
The attacks caused power outages for approximately 14,000–15,000 customers in the Tacoma area, some of which lasted for much of the holiday. Utilities and crews worked quickly to restore service, and by late December 26 most customers had power restored. KUOW
Loss of electricity also meant interruptions to water systems (for homes with electric well pumps) and general disruption of holiday activities for families. One resident noted that homes lost both power and water during the outages. KVCR News
According to the criminal complaint and later reporting after arrest, the motive appears not to have been ideological terrorism, but criminal opportunism.
Greenwood later made statements to investigators that the blackout was intended to facilitate the burglary of a local business while alarms and power systems were down.
There is no publicly documented linkage between the suspects and any extremist group or broader ideological network — despite initial concerns by officials about possible coordinated sabotage.
A team of federal agents, state and local law enforcement acted quickly. Using cellphone data and location tracking, they were able to match Greenwood’s and Crahan’s phones with proximity to all four attack sites at the relevant times. Surveillance footage from one substation identified one suspect and a distinctive pickup truck that linked to the defendants.
A search warrant executed at the suspects’ home recovered clothing matching surveillance images.
The coordinated investigation involved:
FBI
Pierce County Sheriff’s Department
Tacoma Police
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
Washington State Department of Corrections
Federal Protective Service Department of Justice
Damage to Tacoma Power substations alone was estimated at $3 million or more. Department of Justice
Power was disrupted for thousands of residents during a holiday, impacting daily life and comfort. KUOW
Law enforcement and regulatory attention to grid physical security increased following these incidents nation‑wide.
The arrests brought accountability and prevented further attacks or copycat acts in that region. Department of Justice
Motivations for infrastructure attacks can be purely opportunistic and criminal, not always ideological.
Simple physical access and manipulation of equipment can cause significant disruption.
Law enforcement techniques — including cellphone analysis, surveillance footage, and rapid interagency response — were crucial to identifying, locating, and arresting the perpetrators before additional or ongoing damage occurred.
The case highlights the vulnerability of decentralized infrastructure assets and the need for vigilant security practices and community reporting.
Read the Department of Justice press release here.
Each of these cases highlights a different way the grid can be threatened:
an ideologically driven extremist plot thwarted before execution,
a criminally motivated blackout attempt with arrests,
and a mysterious physical attack with prolonged outages and civilian suffering.
And we haven’t even talked about the threat of cyber-attacks, the potential for state-sponsored attacks, and other domestic terror threats. I’ll leave you to research those on your own.
But the key take-away is this:
Attacks don’t have to be technical or high‑tech.
Consequences are felt by ordinary people.
Law enforcement intervention and intelligence sharing matter.
They also demonstrate why civilians should understand how infrastructure attacks unfold — not to overreact, but to recognize the stakes and the signs without confrontation.
Across these incidents, a few key lessons stand out:
Infrastructure attacks are often simple but highly disruptive
Motives vary—criminal, ideological, opportunistic, or unknown
Early detection and reporting save lives and reduce damage
Coordination between law enforcement and utilities is critical
Now, let’s translate these lessons for civilians. What can you realistically do? As a civilian, you don’t have a badge and you’re not tasked with the job of patrolling or pulling security for these facilities. And let’s be honest, it’s highly unlikely you’re going to catch an attacker preparing for an attack on a site that you drive past on your way to work, but if you:
Notice suspicious activity near substations, transformers, and other infrastructure—but do not confront anyone.
Report concerns to local authorities immediately. Believe me, this is a hot topic for law enforcement. They will respond quickly.
Prepare for short-term outages: 24–72 hours of water, food, medicine, heat, and communication capability.
Reduce secondary risks during outages: avoid unnecessary travel, secure homes, and follow official updates.
Stay calm and help your community. If an attack occurs in your area, preparedness is where you’ll shine. Provide strength, resilience, and assistance to your neighbors. That alone will do more to and reduce chaos and mitigate the negative impact of an attack more than anything else.
Even if you’re not a utility worker or law enforcement officer, you live downstream of infrastructure failure. Awareness, observation, and preparedness can make the difference between a manageable disruption and a disaster.
By understanding the who, what, when, and why of past attacks, we can be more informed, resilient, and proactive. Small actions by everyday people make the difference. Stay alert, report threats, and above all, be preparing for outages. Taking care of yourself and others is the critical role you’ll play in service to your community.
Are you digging this transmission? Share it with a buddy and keep the conversation going.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.