# Metcalf sniper attack

On April 16, 2013, an attack was carried out on Pacific Gas and Electric Company's Metcalf transmission substation in Coyote, California, near the border of San Jose. The attack, in which gunmen fired on 17 electrical transformers, resulted in more than $15 million worth of equipment damage, but it had little impact on the station's electrical power supply.

## Assault

On the morning of April 16, 2013, a team of gunmen, using rifles, opened fire on the Metcalf Transmission Substation, severely damaging 17 transformers.

### Preparation

Prior to the attack, a series of fiber-optic telecommunications cables operated by AT&T were cut by the culprits. Additionally, following the attack, investigators found small piles of rocks near to where the shots had been fired, the type of formations that can be used to scout firing positions.

### Timeline

* 12:58 a.m. – AT&T fiber-optic telecommunications cables were cut not far from U.S. Route 101 just outside south San Jose.
* 1:07 a.m. – Some customers of Level 3 Communications, an Internet service provider, lost service. Cables in its vault near the Metcalf substation were also cut.
* 1:31 a.m. – A surveillance camera pointed along a chain-link fence around the substation recorded a streak of light that investigators from the Santa Clara County Sheriff's office think was a signal from a waved flashlight. It was followed by the muzzle flash of rifles and sparks from bullets hitting the fence.
* 1:37 a.m. – PG&E received an alarm from motion sensors at the substation, possibly from bullets grazing the fence.
* 1:41 a.m. – Santa Clara County Sheriff's department received a 911 call about gunfire, sent by an engineer at a nearby power plant that still had phone service.
* 1:45 a.m. – The first bank of transformers, riddled with bullet holes and having leaked 52,000 US gallons (200,000 L; 43,000 imp gal) of oil, overheated, whereupon PG&E's control center about 90 miles (140 km) north received an equipment-failure alarm.
* 1:50 a.m. – Another apparent flashlight signal, caught on film, marked the end of the attack. More than 100 expended 7.62×39mm cases were later found at the site.
* 1:51 a.m. – Law-enforcement officers arrived, but found everything quiet. Unable to get past the locked fence and seeing nothing suspicious, they left.
* 3:15 a.m. – A PG&E worker arrived to survey the damage.

### Sophistication of attack

Former Chairman of the Federal Energy Regulatory Commission Jon Wellinghoff stated that military experts informed him that the assault looked like a "professional job", noting that no fingerprints were discovered on the empty casings. While Wellinghoff described the attack as "the most significant incident of domestic terrorism involving the grid that has ever occurred", a spokesman for the Federal Bureau of Investigation stated that they did not believe a terrorist organization was responsible.
Henry Waxman, a ranking member of the United States House Committee on Energy and Commerce, stated that the attack was "an unprecedented and sophisticated attack on an electric grid substation with military-style weapons. Communications were disrupted. The attack inflicted substantial damage. It took weeks to replace the damaged parts. Under slightly different conditions, there could have been serious power outages or worse."

## Aftermath

Seventeen transformers were seriously damaged, requiring over $15 million worth of repairs. To avert a black-out, energy grid officials had to reroute power from nearby Silicon Valley–based power plants. While some nearby neighborhoods temporarily lost power, “the big users weren’t even aware Metcalf had happened”, according to an expert from the Electric Power Research Institute.
Both PG&E, the company which operated the transformers, and AT&T offered $250,000 rewards for any information leading to the arrest and conviction of the perpetrators of the attack.
In June 2014, PG&E announced that it intended to spend $100 million over a three-year span on upgrading security at substations throughout its territory, including the Metcalf location.
A July 2014 report from the Congressional Research Service titled Physical Security of the U.S. Power Grid: High-Voltage Transformer Substations repeatedly cited the attack and noted that, "... in the wake of the Metcalf incident, the FERC has ordered the imposition of mandatory physical security standards (for substations) in 2014."

## Investigation

In October 2015, it was reported that the Department of Homeland Security had found indications that the attack may have been committed by "an insider".

## Precursor publications

In 2012, the National Research Council of the National Academies of Sciences, Engineering, and Medicine published a declassified report prepared in 2007 for the United States Department of Homeland Security that highlighted the vulnerability of the national electric grid from damage to high voltage transformers.