‘This is not new’: Tampa Bay substation break-ins reveal power grid’s vulnerability

Several Florida substations were burglarized in September, according to a Duke Energy report filed to the Department of Energy. The burglars shut off power to homes in Pinellas and Pasco counties.
This is the Duke Energy substation at 5400 Ulmerton Road in Largo, similar to the Clearwater and two Zephyrhills locations that were broken into in September, according to local officials. Investigations into the break-ins remain ongoing.
This is the Duke Energy substation at 5400 Ulmerton Road in Largo, similar to the Clearwater and two Zephyrhills locations that were broken into in September, according to local officials. Investigations into the break-ins remain ongoing. [ DOUGLAS R. CLIFFORD | TImes ]
Published Dec. 10, 2022|Updated Dec. 10, 2022

After at least one person shot at two substations in North Carolina leaving thousands without power for a day, and a Duke Energy report reveals at least six attacks to substations in Florida — including three in Tampa Bay — experts are once again calling the vulnerability of our power grid into question.

Only a chain-link fence, occasionally with barbed wire, guards many of the substations powering the homes in Tampa Bay. A University of Florida professor said these attacks show that isn’t enough.

At least six substations across Florida were victims of break-ins according to a Duke Energy report filed to the Department of Energy, obtained by NewsNation — three of them in the Tampa Bay area.

Ted Krauthammer, director of the University of Florida’s Center for Infrastructure Protection and Physical Security said he wasn’t surprised to learn of the Florida break-ins during a phone interview with the Tampa Bay Times. Local officials have not released an exact timeline of what happened at the substations on Sept. 21 and Sept. 22, but Krauthammer said it doesn’t take much to get in.

“A chain-link fence around something is OK,” Krauthammer said. “But it does not prevent not even a sophisticated attacker.”

The report labels the Zephyrhills break-in, among others, as “targeted.” In addition to the Tampa Bay area substations, there were two incidents at a substation in Bay Ridge, and another in Orange Blossom. Local officials wouldn’t say if they were related.

NewsNation reports that a memo it acquired says that federal law enforcement officials believe those breaking in had “inside knowledge” of the facilities.

“The U.S. Department of Energy takes the security of the nation’s power grid very seriously and will continue to work with law enforcement, interagency partners, and utilities to address any and all interruptions of electric power and threats to our electric system reliability,” a Department of Energy spokesperson said in an emailed statement to the Tampa Bay Times.

Want breaking news in your inbox?

Want breaking news in your inbox?

Subscribe to our free News Alerts newsletter

You’ll receive real-time updates on major issues and events in Tampa Bay and beyond as they happen.

You’re all signed up!

Want more of our free, weekly newsletters in your inbox? Let’s get started.

Explore all your options

An attack on infrastructure can come in physical form, such as the recent substation burglaries around Tampa Bay, or a cyberattack. In February 2021, hackers got into an Oldsmar water treatment plant’s system and drastically increased the amount of sodium hydroxide, also known as lye, used to treat the city’s water.

“This is a wakeup call,” David Kennedy, a former hacker for the National Security Agency and founder of the cybersecurity firm TrustedSec, told the Times at the time.

Kennedy’s comments then and Krauthammer’s this week make the same point: It often doesn’t take much to break through the security measures in our infrastructure.

City of Zephyrhills spokesperson Kevin Weiss said there were two burglaries at substations in Zephyrhills on the morning of Sept. 21. At least one person broke into the facility at 37834 State Road 54 at 2:19 a.m. and shut off power for nine minutes. That same morning, the Pasco County Sheriff’s Office responded to a second burglary — this one at a substation located at 6939 Wire Road in Zephyrhills.

Weiss said those involved in the break-in at the SR 54 facility were attempting to shut off the power so they could break into the Trulieve medical cannabis dispensary at 6601 Gall Blvd. Three people were later arrested in Marion County in connection to the SR 54 burglary. Their names have not been released.

Duke Energy would not say exactly how many homes were impacted.

The Pinellas County Sheriff’s Office did not provide any updates in its investigation of the Sept. 22 burglary at the Duke Energy Clearwater East substation, citing the open investigation. According to the Duke Energy report, the burglar manually turned off the power for two minutes. Duke Energy also did not state how many homes were impacted in this instance.

No suspects have been named or motives released in the Pinellas County burglary.

The two substations in Zephyrhills and the one in Clearwater where the break-ins happened are roughly 50 miles apart.

Duke Energy has approximately 560,000 customers in Pinellas County and 150,000 in Pasco County.

“Given the nature and scale of our operations, we — alongside federal, state and local law enforcement and security officials and industry partners — are continuously assessing and evolving our measures to protect our infrastructure from vandalism and other misconduct,” Duke Energy said in a statement.

Krauthammer said private companies such as Duke Energy don’t have adequate security systems because they want to save money.

“Everyone is looking to cut cost,” Krauthammer said. “You make the minimum required.”

Cheaper security, Krauthammer said, means vulnerability. He said government facilities have much stronger security systems — both online and on the ground — based on existing Department of Defense and Department of Energy guidelines. In an email, a Department of Energy spokesperson said the department often provides threat briefings to private companies.

But while existing government plans may provide a blueprint for private companies, they aren’t mandated. Weiss said Zephyrhills doesn’t make requirements for Duke Energy’s security systems, though they could make recommendations if and when necessary.

Krauthammer said he thinks government agencies haven’t pressured private companies enough to spend more on bulking up their security. But he hopes changes are made soon — before something worse happens.

“Everyone likes to play the ostrich game,” Krauthammer said. “It’s a disaster waiting to happen.”