Hubbry Logo
Moore County substation attackMoore County substation attackMain
Open search
Moore County substation attack
Community hub
Moore County substation attack
logo
7 pages, 0 posts
0 subscribers
Be the first to start a discussion here.
Be the first to start a discussion here.
Moore County substation attack
Moore County substation attack
from Wikipedia

Moore County substation attack
Damaged substation fence in West End
LocationMoore County, North Carolina, US
DateDecember 3, 2022 (2022-12-03)
c. 7:00 p.m. (EST)
TargetDuke Energy substations
Attack type
Sabotage
WeaponsFirearms
Deaths1

On December 3, 2022, a shooting attack was carried out on two electrical distribution substations located in Moore County, North Carolina, United States. Damage from the attack left up to 40,000 residential and business customers without electrical power, causing the death of one woman. Initial estimates were that up to four days could be required to fully restore power in the area. A state of emergency and corresponding curfew were enacted by local government officials in the wake of the incident.[1]

Background

[edit]

Less than two weeks prior to the Moore County substation incident, the Federal Bureau of Investigation (FBI) had sent a report to private industry in which they stated that there had been an increase in reported threats to electric infrastructure from people who espouse "racially or ethnically motivated violent extremist ideology", with an aim of creating civil disorder and inspiring further violence. The Department of Homeland Security cited[2][3]

a 14-page document released in a Telegram channel favored by accelerationist groups seeking to speed the overthrow of the US government featured a white supremacist instruction guide to low-tech attacks meant to bring chaos, including how to attack a power grid with guns.

While it is unclear whether such threats are directly associated with this attack, government officials have previously expressed concern over the possibility of violent extremists attacking the electrical grid.[2][3] Prior to the Moore County attack, other attacks on the electrical grid had occurred in Metcalf, California in 2013, in Arkansas in 2013, in Utah in 2016, and in Washington and Oregon (dates undisclosed).[4][5][6]

Attack

[edit]

According to Moore County Sheriff Ronnie Fields, a Duke Energy power substation was severely damaged by gunfire in Carthage at around 7 p.m. Gunfire was later directed at a second substation in West End, ultimately resulting in a loss of electrical power to the majority of the county.[1][7] A journalist from a local newspaper reported that one of the substations' gates had been damaged and was lying in an access road, with the pole holding the gate having been snapped off at the ground.[7]

Outages began starting just after 7 p.m. on December 3 in Moore County and spread to central and southern parts of the county, with roughly 36,000 customers reported to be without power.[7][8] Duke Energy officials indicated that significant, serious damage had occurred to equipment located at the substations and that repairs could take several days.[9]

Investigation

[edit]
The FBI released a poster appealing for information on the attack on December 7.[10]

In addition to the Moore County Sheriff's Department, the North Carolina State Bureau of Investigation, the FBI, and police departments from all eleven municipalities in Moore County are[when?] participating in the investigation.[1] The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) of the Department of Energy is also reported to be assisting.[11][12]

Investigators revealed that they had recovered about two dozen shell-casings, described as being from a "high powered rifle", from the attack sites. These casings were expected to be used to query the National Integrated Ballistic Information Network for possible matches with casings fired from the same weapon at other crime scenes. The casings, some of the only physical evidence available, were also being looked at as a starting point which could lead to other evidence such as tire tracks or shoe prints.[13]

On December 7, 2022, Governor Roy Cooper announced that a reward of up to $75,000 was being offered for information leading to an arrest and conviction in the case. The money consists of three separate $25,000 rewards, offered by the State of North Carolina, Duke Energy, and Moore County.[14]

Motive

[edit]

Officials have described the attack as "targeted" and "intentional, willful and malicious" but did not immediately provide any information on suspects or a motive for the attack.[1][15]

After the incident, numerous posts on the internet speculated that the attack was an attempt to disrupt a local drag show that was taking place in the nearby town of Southern Pines that evening; however, these claims are unconfirmed and disputed.[16][17][18]

By December 7, investigators were focusing on two possible motives for the attack. One scenario relates to known online writings by domestic extremists, which encourage attacks on critical infrastructure; the other relates to anti-LGBTQ+ activity. Investigators said they still have no evidence specifically tying the attack to the contemporaneous drag show, but the timing of the two incidents, as well as a general growth in tension around LGBTQ+ events, leads them to consider a possible connection.[19]

Aftermath

[edit]

It was estimated that by December 6, about 35,000 Moore County residents were still without power, and the timeline for completing repairs and restoring power county-wide was revised from December 8 to midnight December 7.[6][20] By the morning of December 7, the number of affected residents without power was down to about 23,000, and power had been restored to the Moore County hospital. Additionally, the Duke Energy website stated "All substation equipment damaged from recent vandalism has either been fully repaired or replaced."[21] By 4 p.m. on December 7, the number of customers remaining without power had dropped to approximately 1,200. As a result, it was announced that the curfew would be permanently lifted as of 5 a.m. on the morning of December 8.[19]

As a result of the power outage, Moore County Regional Hospital was forced to operate on generator power. The town of Southern Pines also had to resort to operating their sewer and water services on backup generators. Residents of the area were asked to stay off the roads if possible or proceed with caution due to the absence of traffic lights.[1]

On December 4, a curfew was placed in effect for Moore County, from 9 p.m. until 5 a.m. The nightly curfew was expected to remain in effect until the power was restored. A shelter was established at the Moore County Sports Complex, and Moore County schools were ordered closed from December 5 through December 8 as a result of the power outage.[9][22][23][6]

A Moore County resident died during the power outage and investigators are determining whether the death was related to the outage, which could have implications for any criminal charges.[24]

On August 30, 2023, the death of Karin Zoanelli, an 87-year-old woman who died during the power outage, was ruled a homicide by the Office of the Chief Medical Examiner of North Carolina. A resident of Pinehurst, Zoanelli suffered from chronic lung problems and was dependent on an oxygen machine to breathe at night. The machine was rendered inoperable after her house lost power which contributed to her death, according to the medical examiner.[25][26]

Responses

[edit]

During a press conference shortly after the attacks, Moore County Sheriff Ronnie Fields claimed the substations were targeted and that attack was intentional. Fields also claimed that the perpetrators most likely knew what they were doing but did not state that the attacks may have been domestic terrorism. The sheriff also reported that his office has not been able to tie anything back to a drag show in Southern Pines, scheduled around the time the power went out, thereby addressing a rumor that began on social media.[8]

U.S. National Security Council spokesman John Kirby advised that the White House was monitoring the situation closely, and emphasized the importance of shoring up the security of the infrastructure.[22]

North Carolina Governor Roy Cooper issued a statement via Twitter, saying, "An attack like this on critical infrastructure is a serious, intentional crime and I expect state and federal authorities to thoroughly investigate and bring those responsible to justice."[22]

See also

[edit]

References

[edit]
Revisions and contributorsEdit on WikipediaRead on Wikipedia
from Grokipedia
The Moore County substation attack was a deliberate physical assault involving gunfire on two electrical substations located in and West End, , on the evening of December 3, 2022. Unknown perpetrators fired multiple rounds from the same firearm at transformers and other high-voltage equipment in both facilities, which are approximately 10 miles apart, causing severe damage that disrupted power distribution across the county. The incident left around 45,000 residents without for several days amid winter conditions, exposing significant vulnerabilities in the U.S. power grid's . The outages prompted a declaration, school closures, and a , with restoration efforts requiring manual reconfiguration of the grid due to the extent of the . One fatality occurred when a succumbed to from operating a generator indoors during the blackout. The , alongside the Moore County Sheriff's Office, leads the probe, which has identified a 2011-2017 minivan as a of interest sighted near both sites but has yielded no arrests or identified motives as of late 2024. A $100,000 reward remains offered for information leading to prosecution, highlighting ongoing concerns over domestic threats to . The event has spurred federal discussions on enhancing substation defenses, including ballistic-resistant barriers, amid recognition of the grid's susceptibility to low-tech attacks.

Background

Regional Electrical Infrastructure

Duke Energy Carolinas serves as the primary provider for , managing the transmission and distribution that supplies the majority of the county's approximately 100,000 residents and associated commercial demands. The network includes high-voltage transmission lines feeding into local substations, which step down to distribution levels for delivery via overhead and underground lines to end-users. Portions of the county, particularly rural areas, receive service from electric membership cooperatives such as Randolph Electric Membership Corporation, Central Electric Membership Corporation, and Pee Dee Electric Membership Corporation. Two critical electrical distribution substations operated by in Moore County handle a substantial share of the local load, supporting power to around 45,000 customers across residential, tourism-related, and light industrial sectors in communities like , Southern Pines, and . These facilities connect to the regional grid, enabling power flow from distant generation sources, but prior to enhancements following the incident, the system lacked immediate redundant routing options from these specific sites, amplifying their importance to uninterrupted service. The county's infrastructure reflects typical radial distribution designs common in suburban-rural U.S. regions, where substations act as focal points for voltage transformation and load balancing, with limited on-site backups to mitigate single-point failures. Energy's operations in the area integrate with the larger Southeastern grid, but local reliability hinges on the physical of these substations and associated protective like transformers and circuit breakers.

Known Vulnerabilities in U.S. Power Grids

The U.S. comprises over 79,000 transmission substations, many situated in remote rural locations with obstructed visibility from foliage, rendering them highly susceptible to undetected physical intrusion and . These facilities often depend on rudimentary perimeter fencing and limited , which provide inadequate deterrence against determined attackers employing firearms, vehicles, or explosives to target critical components like insulators and transformers. Damage to even a single substation can cascade due to the grid's interconnected design, potentially causing widespread outages affecting thousands of customers, as evidenced by multiple incidents in recent years. High-voltage transformers, which handle 60-70% of transmission across , represent a particularly acute owing to their massive scale, custom requirements, and replacement lead times exceeding 12-18 months amid global supply constraints. Physical assaults, such as gunfire that shatters insulating oil or components, can induce catastrophic failures through overheating or explosions, with limited domestic spares exacerbating recovery delays. The scarcity of in these assets—each often serving expansive regions—means targeted damage can propagate instability across multiple states, underscoring 's reliance on unhardened despite federal alerts on escalating threats. Reports of physical attacks on grid elements have intensified, rising 77% in from the previous year according to Department of Energy data, with incidents including , gunfire, and deliberate peaking at levels unseen in over a decade. While cybersecurity receives substantial attention, physical defenses lag, hampered by inconsistent standards across the 3,000-plus utilities operating the and insufficient federal mandates for ballistic-resistant enclosures or rapid-response hardening. This disparity has prompted agencies like the to issue targeted guidance, yet implementation remains uneven, leaving the system exposed to both domestic actors and potential foreign adversaries exploiting these gaps.

Preceding Incidents of Grid Sabotage

One notable preceding incident occurred on April 16, 2013, at the Metcalf transmission substation operated by in , . Unknown assailants, positioned approximately 60 yards away, fired around 100 rounds from a high-powered over a 19-minute period, targeting 17 large transformers and penetrating the facility's perimeter fence. The attack damaged the underbellies of two transformers, causing a leak of 52,000 gallons of cooling oil, but redundant systems prevented any power outages; repair costs exceeded $15 million. The FBI investigated but classified it as non-terroristic , with no arrests made despite evidence including shell casings and surveillance footage showing the attackers' preparation. This event highlighted the physical vulnerabilities of substation equipment to precise, low-technology assaults and prompted federal regulators to urge enhanced security measures across the grid. In during 2013, a series of deliberate acts targeted high-voltage transmission infrastructure, primarily attributed to individual Jason Woodring. Beginning in spring and escalating through summer and fall, Woodring used a to fire at insulators on transmission towers, downing a 500,000-volt line on August 21 and causing outages for up to 10,000 customers in multiple instances. Additional attacks involved cutting utility poles with a in Lonoke County in early October, further disrupting service. Woodring, motivated by personal grievances against perceived government overreach, was arrested in 2014 and sentenced to 15 years in federal prison in 2015, ordered to pay over $4.7 million in restitution to . These incidents demonstrated how targeted damage to insulators and lines—inexpensive components critical to grid stability—could achieve widespread disruptions with minimal resources, influencing later assessments of grid resilience. Prior to these 2013 events, documented cases of intentional grid sabotage in the U.S. were rare and typically involved opportunistic rather than coordinated assaults, with federal reports noting fewer than a dozen confirmed physical attacks annually in the preceding decade. The Metcalf and Arkansas incidents marked an uptick, correlating with broader intelligence on domestic extremists discussing grid targets, though attribution often remained unclear without ideological manifestos. By , voluntary reporting to the Electricity Information Sharing and Analysis Center indicated over 1,300 physical security incidents grid-wide from 2016–2021, underscoring escalating risks but with most preceding the Moore County event classified as rather than .

The Attack

Chronology of the Incident

On the evening of December 3, 2022, unknown assailants carried out coordinated gunfire attacks on two electrical substations in , located near and West End, approximately 10 miles apart. The assaults occurred between approximately 6:00 p.m. and 10:00 p.m. EST, with a of interest observed in the area during that window. The first substation near was struck by multiple gunshots, triggering a failure reported around 7:00 p.m. EST and initiating widespread power outages. This was followed by gunfire at the second substation, which compounded the damage and expanded the blackout to affect nearly 45,000 customers across the county amid sub-freezing temperatures. Ballistic evidence confirmed the use of the same weapon in both incidents. The attacks caused extensive physical damage to critical transformers and equipment, rendering the substations inoperable and necessitating prolonged repairs. No injuries were reported directly from the gunfire, but the resulting outages led to secondary effects including school closures and a local declared the following day. As of 2024, the case remains unsolved with no arrests or identified perpetrators.

Technical Details of the Assault

The assault on the two substations in —the West End substation near Vass and the substation—occurred on the evening of December 3, 2022, with shots fired at approximately 8:35 p.m. and 8:46 p.m. local time. Attackers gained access to at least one site by ramming open a security gate, allowing proximity to . The primary method involved sustained gunfire from a single high-powered , with ballistic evidence confirming the same weapon was used at both locations roughly 10 miles apart. Forensic recovery included nearly two dozen shell casings ejected from the 's chamber during rapid fire, scattered across the attack sites. The rounds targeted high-voltage equipment, particularly housings and associated components, penetrating metal enclosures to inflict internal damage. High-powered , capable of velocities exceeding 2,500 feet per second, readily breaches the thin-gauge steel or aluminum panels shielding substation gear, disrupting electrical insulation, windings, or cooling systems. This precision targeting mirrors vulnerabilities observed in prior incidents, where bullets sever control wiring or induce faults in oil-filled , triggering automatic shutdowns to prevent cascading failures. The resulting equipment failures—primarily short circuits and loss of key transformers—de-energized transmission and distribution lines, isolating the substations from and halting power flow to downstream feeders. No explosives or sophisticated cyber intrusions were involved; the attack relied solely on kinetic damage from projectiles, exploiting the physical fragility of exposed substation assets lacking hardened ballistic protection. Repairs necessitated isolating damaged units, bypassing via redundant lines where possible, and replacing perforated components, underscoring the substations' role in stepping down voltage for local delivery.

Immediate Physical Damage

The gunfire attack on December 3, 2022, targeted transformers at Duke Energy's (115 kV) and West End (230 kV) substations in , with bullets penetrating the cooling fins of multiple units. These fins, thin metal radiators essential for dissipating heat from the oil-cooled transformers, were punctured by rounds from a high-powered , compromising management and prompting protective shutdowns to avert overheating, oil leaks, or catastrophic failure. Investigators documented bullet holes in the substation equipment, particularly visible at the site, where photographs revealed direct impacts on critical components. Nearly two dozen shell casings were recovered near the facilities, indicating a deliberate barrage rather than random . The West End substation sustained the most severe effects due to its higher voltage integration, though no secondary incidents like fires or explosions materialized. All affected equipment required repair or replacement, with confirming full restoration of damaged substation assets by early 2023. The precision of the targeting—focusing on vulnerable cooling systems—highlighted the attackers' apparent familiarity with substation design, as random shots would less effectively disable operations. No structural breaches beyond ballistic impacts were reported, and perimeter fencing showed minor tampering but was not the primary vector of damage.

Response and Restoration

Utility and Emergency Actions

, the operator of the affected substations, immediately isolated the damaged equipment at the and West End facilities following the gunfire attacks on December 3, 2022, to mitigate risks and contain the outage to approximately 45,000 customers. Repair crews operated in 24-hour shifts under protection, assessing bullet-damaged transformers, insulators, and while coordinating with investigators to avoid contaminating evidence. Moore County officials declared a local on December 4, 2022, enabling resource mobilization and imposing a from 5 p.m. to 5 a.m. to ensure public safety amid widespread blackouts and heightened security concerns. The Department of Public Safety deployed state resources, including the for traffic management, Alcohol Law Enforcement for support, and the State Highway Patrol alongside the for security and investigative assistance. A temporary shelter was established that afternoon with aid, and local schools closed on to address safety and accessibility issues. Restoration efforts progressed with replacing or repairing all critical substation components by December 7, 2022, followed by systematic testing to ensure grid stability before gradually reconnecting customers throughout the day. These actions, conducted in hazardous conditions with ongoing threats, prioritized both rapid recovery and long-term infrastructure hardening, though initial estimates projected up to four days for full restoration.

Power Outage Duration and Scope

The coordinated gunfire attacks on two substations in , on December 3, 2022, triggered immediate and extensive power outages beginning around 7:00 p.m. ET, affecting the majority of the county's electrical customers. The disruptions initially stemmed from damage to the Carthage substation, with subsequent impacts from the nearby Vass (West End) substation, leading to a that blacked out nearly all of 's grid-fed areas. At its peak, the outages impacted approximately 45,000 utility customers, representing over half of the county's roughly 100,000 residents and encompassing residential, commercial, and municipal loads across urban centers like Southern Pines, , and Pinehurst, as well as rural zones. While the primary scope was confined to Moore County, minor spillover effects reached adjacent areas in neighboring counties due to interconnected grid dependencies, though these were limited and resolved faster. Power restoration occurred progressively over several days, with emergency measures including mobile generators and rerouting from unaffected lines enabling partial service to critical facilities by December 4–5. Full restoration county-wide took five days, completing by December 8, 2022, after extensive repairs to transformers and control systems exceeded initial estimates of up to four days. The prolonged duration was attributed to the severity of ballistic damage, which required specialized equipment and federal coordination, highlighting the grid's vulnerability to targeted physical assaults.

Human and Community Impacts

The coordinated attacks on two substations in , on December 3, 2022, triggered widespread power outages that initially impacted approximately 45,000 customers, encompassing both residential and commercial users across much of the county. By the following Monday, December 5, between 35,000 and 38,000 customers remained without , with restoration efforts extending several days for most and nearly a week for some isolated areas. These disruptions occurred during freezing winter conditions, with overnight temperatures dropping into the low 20s (around -6°C), exacerbating risks of and complicating heating for vulnerable populations reliant on electric systems. Human health and safety were directly threatened by the loss of power-dependent medical equipment, such as oxygen concentrators and refrigerated medications, particularly for elderly and chronically ill in a with a median age exceeding 40 and a significant retiree population. Local hospitals, including those in the affected areas, experienced operational strains despite generators, with reports indicating threats to care continuity and necessitating resource reallocations. No direct fatalities from the outages were officially attributed in initial assessments, though the abrupt blackout forced many to seek alternative or aid, contributing to heightened stress and minor incidents of exposure from improper generator use. Community-wide effects included the closure of public schools and imposition of a nighttime to manage safety risks amid darkness and potential further threats, disrupting for thousands of students and daily routines for families. Businesses, especially small enterprises without robust backups, faced immediate revenue losses from halted operations, with perishable goods spoiling and services like retail and dining grinding to a halt; preliminary estimates suggested millions in combined economic damages, though precise figures for community-level losses remain unquantified in public reports. The incidents underscored the fragility of rural electrical dependence, prompting temporary reliance on state resources for warming centers and water distribution, while fostering local unease about grid resilience in an area known for its resorts and retirement communities.

Investigation

Agencies Involved

The led the federal response to the December 3, 2022, substation attacks in , with agents from the Charlotte Field Office arriving at the scenes within hours to support local efforts. The FBI classified the incidents as targeted shootings and has pursued leads including surveillance of a suspect vehicle, a 2011-2017 observed near both sites. As of February 2023, the agency offered up to $25,000 rewards per substation for information leading to arrests and convictions, later increasing combined incentives to $100,000. The Moore County Sheriff's Office, under Sheriff , handled initial on-scene investigations and coordinated with federal partners, reporting that gunfire from high-powered rifles damaged transformers at the and West End Duke Energy substations. Local deputies secured the perimeters and collected preliminary evidence, such as bullet casings, while collaborating on joint task forces for ongoing suspect identification. No arrests have been made as of December 2024, with the office emphasizing community tips amid a $100,000 total reward pool. The State Bureau of Investigation () provided specialized assistance to the Moore County Sheriff's Office in the criminal probe, focusing on forensic analysis and ballistic tracing of the over 50 rounds fired across both sites using the same weapon. State resources, including the , integrated with FBI efforts to examine digital and without attributing motives publicly beyond intentional . Additional state entities like the supported perimeter security during the immediate aftermath but deferred primary investigative roles to these core agencies.

Key Evidence Collected

Investigators recovered nearly two dozen shell casings from a high-powered rifle at the two substation sites in West End and , with casings collected from areas outside the perimeter fencing where shots were fired into electrical transformers and control equipment. The casings were analyzed by the FBI for potential ballistic matches to other incidents, though specific details such as .223 or 5.56mm were not publicly disclosed to preserve investigative . Physical damage included dozens of bullet holes in substation transformers, confirmed through on-site examinations and photographs showing entry points consistent with rifle fire from elevated or distant positions. No fingerprints, DNA, or manifesto materials were reported as recovered, limiting direct perpetrator identification from biological or written evidence. Authorities sought and reviewed surveillance footage from nearby homes and businesses, capturing audio of 20 to 25 gunshots near the West End site around 7:00 p.m. on December 3, 2022, but no publicly released video definitively identified suspects. A potential vehicle of interest emerged from witness reports and possible footage: a silver or light blue 2011-2017 observed in the vicinity between 6:00 p.m. and 10:00 p.m. that evening, prompting an FBI public appeal for information on its occupants. The FBI's depicted two individuals in dark clothing—one carrying a —based on from the scenes, though exact sourcing of these descriptions remains unspecified in official releases.

Search Warrants and Leads Pursued

Following the December 3, 2022, attacks on the and West End substations, the Moore County Sheriff's Office and FBI rapidly pursued leads, applying for multiple search warrants within days, including federal warrants that remained sealed initially. These early warrants targeted properties and records to identify suspects knowledgeable in operations, as evidenced by the precise targeting of transformers with gunfire. By , investigators identified a based on a tip from an individual who contacted 911 claiming prior knowledge of the outages and referencing the "Moore County Patriots" group as planning substation damage; this led to further warrants for phone records from and associated with four numbers, one of which pinged a cell tower less than 1,000 yards from the substation during the attack window. Unsealed warrants filed between December 4, 2022, and February 21, 2023—totaling at least 12—revealed searches of footage from Pinnacle Storage near the West End substation, which captured a 2011-2017 van (possibly silver or light blue) entering and exiting the area at 8:35 p.m. and 8:46 p.m. on December 3, alongside a light-colored departing a nearby driveway at 9:25 p.m. Geofencing warrants for cellphone data near both substations narrowed activity to 17 numbers, with one linked to the wife of the —a local man and former Army Ranger with expertise in , affiliated with the Moore County Patriots and Citizens for groups—whose device was near the site at 7:32 p.m. He was interviewed on December 7, denied involvement, and provided an of being home, though he later offered assistance in substation repairs; no charges resulted from these leads. Additional warrants sought records on terminated or active employees in Moore County from September to December 2022. Forensic analysis of .223/5.56 shell casings recovered from both sites, obtained via warrants, confirmed they were fired from the same , supporting a single perpetrator or coordinated team. The FBI publicized the as a key lead in December 2022, seeking public tips, while hundreds of additional tips were vetted without yielding arrests. As of December 2023, no suspects had been charged, with the investigation ongoing amid over 100 leads pursued but lacking to link any individual or group definitively.

Motives and Theories

Official Assessments of Intent

The (FBI) has classified the December 3, 2022, attacks on two substations in , as deliberate acts involving gunfire that caused significant disruption to the power grid, but has not publicly disclosed a specific motive. The FBI's involvement, including a reward for information leading to arrests and convictions, underscores the assessment of the incidents as coordinated criminal rather than random , though ideological drivers remain unconfirmed in official releases. Moore County Sheriff initially described the events as "intentional " based on evidence of targeted gunfire at , emphasizing the premeditated nature without speculating on underlying intent. Governor echoed this view on December 5, 2022, stating that while a motive had not been confirmed, the acts constituted "violence and sabotage" that would not be tolerated, framing them as threats to public safety irrespective of purpose. As of December 2024, two years after the attacks, federal and state investigators have not released any updates attributing a definitive intent, such as ideological or , despite ongoing probes and evidence linking the same to both sites. This reticence aligns with standard protocol in active cases to avoid compromising leads, though it has drawn for lacking transparency on potential patterns in grid-targeted incidents. No arrests have been made, and official assessments continue to prioritize the operational impact—disruption to approximately 45,000 customers—as evidence of intent to impair essential services.

Evidence-Based Speculations

The coordinated use of gunfire from a single high-powered rifle at two substations approximately five miles apart, with shots fired between 6:45 p.m. and 8:45 p.m. on December 3, 2022, suggests at least one mobile perpetrator or a small team capable of rapid repositioning while evading immediate detection in a rural area. Nearly two dozen shell casings recovered from the sites confirm the employment of armor-piercing ammunition effective against substation enclosures, implying prior reconnaissance or technical familiarity with grid hardware vulnerabilities rather than opportunistic vandalism. The deliberate targeting of oil-filled transformers, which led to cascading failures and outages lasting up to nine days for some customers, points to an intent to maximize disruption over mere , as evidenced by the equipment's design for resilience against minor faults but susceptibility to concentrated ballistic impacts. This method aligns with patterns in other U.S. substation incidents but lacks forensic ties to them, suggesting either isolated actors exploiting publicly known weaknesses or emulation without coordination. Absence of digital footprints, claims of responsibility, or ideological markers in recovered , combined with the attacks' amid a local event without apparent linkage, supports speculation of non-publicized motives such as testing resilience or personal grudge against utility operations, though federal assessments emphasize no confirmed connections to broader threats. Search warrants pursued on individuals linked to planning analogous attacks elsewhere indicate investigators' focus on networks with grid intent, yet unsealed documents reveal no direct evidentiary bridge to Moore County perpetrators as of late 2023. Sightings of a dark near one site between 6:00 p.m. and 10:00 p.m. represent a tangible lead, potentially indicating vehicular for transporting weaponry or escaping undetected, consistent with low-profile tactics avoiding high-traffic routes. The ongoing lack of arrests two years later, despite a reward and multi-agency involvement, underscores challenges in tracing anonymous, low-tech execution but reinforces the hypothesis of prepared, non-impulsive actors prioritizing operational security over publicity.

Extremist and Ideological Hypotheses

Speculation regarding extremist motives for the December 3, 2022, attack on Moore County Electrical Cooperative substations has primarily focused on far-right accelerationist ideologies, which advocate disrupting to precipitate and radicalize supporters. Analysts from the Combating Terrorism Center at West Point have noted that violent far-right extremists, including neo-Nazi and white supremacist networks, increasingly target power grids as low-risk methods to sow chaos, amplify anti-government narratives, and recruit by demonstrating the vulnerability of modern society. These groups operate in encrypted "Terrorgram" chatrooms on platforms like Telegram, where manifestos and guides explicitly encourage substation sabotage as a precursor to broader unrest, with the Moore County incident cited in subsequent discussions as inspirational despite no direct claim of responsibility. Federal investigators have examined online theories and forums for leads, but have not publicly confirmed any ideological linkage, emphasizing instead the deliberate of the gunfire damage without overt political messaging at the sites. Sources familiar with the probe indicated early focus on " behavior" as potential motives, aligning with a pattern of over 100 reported grid attacks nationwide in 2022, many probed for ties but few resolved with ideological attribution. reporting highlighted a spike in such incidents, attributing rising threats to neo-Nazi that frames infrastructure attacks as against perceived systemic decay, though the Moore case lacks forensic ties to specific actors like or similar cells. Left-wing or environmental extremist hypotheses, such as those invoking antifa or eco-sabotage against dependency, have circulated in unverified commentary but lack substantiation in official investigations or expert analyses, with authorities dismissing premature partisan attributions amid the absence of manifestos or symbolic claims. UNC-Chapel Hill terrorism researcher Cori Dauber cautioned that ideological classification often requires post-event claims or affiliations, which remain absent here, preventing definitive labeling as over one year later. As of December 2023, the FBI continued treating the incident as a criminal case without ideological confirmation, underscoring how unclaimed attacks complicate hypothesis-testing against like ballistic matches or digital footprints.

Aftermath

Economic Consequences

The substation attacks on December 3, 2022, resulted in power outages for approximately 45,000 customers across , disrupting commercial activities for several days. Many businesses, including retailers, restaurants, and service providers, were forced to close, leading to estimated losses in the millions of dollars from lost , spoiled inventory, and operational . The outage's timing exacerbated impacts on the local sector, which had seen record visitor spending of over $1 billion in 2021, as holiday events and attractions like the were affected. Duke Energy faced substantial repair expenses for the damaged transformers and fiber optic lines at the two targeted substations, with the utility compiling costs in the immediate aftermath but deferring decisions on cost recovery, potentially through rate adjustments or . State authorities invoked North Carolina's price gouging laws during the outage to curb opportunistic increases on essentials like generators and fuel, mitigating some secondary economic distortions but highlighting vulnerabilities in supply chains for emergency goods. While power was largely restored by December 7, 2022, the incident briefly interrupted Moore County's ongoing economic expansion, driven by golf tourism and residential growth, though no quantified long-term GDP setbacks have been documented. The event underscored the financial fragility of localized grid dependencies, with repair efforts prioritizing redundancy investments that could impose future on ratepayers.

Casualty Analysis

The Moore County substation attack on December 3, 2022, produced no direct human casualties, with attackers employing gunfire against unmanned electrical infrastructure, avoiding confrontation with personnel. No injuries or fatalities were reported among utility workers, , or bystanders during the incident itself, as confirmed by federal and local investigations. The sole reported human casualty was the death of 87-year-old Karin Zoanelli of , on , 2022, two days after the attack began. Zoanelli, who relied on an electrically powered for a pre-existing respiratory condition, succumbed after her home lost power amid widespread outages affecting nearly 45,000 customers. The Office of the Chief Medical Examiner ruled her death a in August 2023, attributing it causally to the power disruption that rendered her life-sustaining equipment inoperable, despite her underlying medical issues. This classification highlights the indirect but foreseeable risks of infrastructure sabotage on vulnerable populations dependent on continuous , though no additional deaths or injuries linked to the outages—such as from , traffic accidents, or secondary failures—were officially documented in subsequent reviews. Outages persisted up to five days in some areas, prompting emergency measures like curfews and shelter openings, but these mitigated further harm without incident.

Long-Term Community Effects

Duke Energy's post-attack enhancements to substation security and the introduction of self-healing grid technologies in Moore County contributed to broader infrastructure resilience, preventing an estimated 400,000 outage events equivalent to 1.7 million customer-hours across in the year following the incident. These upgrades, including physical barriers and increased monitoring evaluated across over 2,000 substations, were part of a $500 million four-year investment plan, with initial costs in Moore County totaling several million dollars and financed in part through customer rate adjustments. Local businesses faced revenue shortfalls from the multi-day holiday outage disrupting December 2022 sales, exacerbating economic pressures in a reliant on seasonal , though no quantified long-term decline has been documented. Community-level adaptations included improved communications via tools like Notify Me alerts and WebEOC software, which addressed prior issues such as language barriers through automated translation, enhancing future crisis coordination. Social responses during the blackout fostered neighbor-to-neighbor assistance and involvement from faith-based groups, which local officials noted as bolstering communal ties amid the disruption. Separately, unverified rumors linking the attack to a concurrent prompted a surge in support for the Sandhills PRIDE organization, with trainings rising from three in to twelve in 2023, alongside new flags, heightened donations, an expanded film festival, and the first PrideFest street fair—efforts organizers attributed to generating "a sense of unity" from the event. As of December 2024, the lack of arrests despite a $100,000 reward has sustained local vigilance on grid vulnerabilities, coinciding with state measures like Senate Bill 58, enacted in June 2024, to impose harsher penalties on infrastructure and encourage proactive defenses. This unresolved status underscores persistent community awareness of potential repeat threats, though empirical data on widespread psychological distress or behavioral shifts remains absent from public records.

Broader Implications

Revelations on Grid Security Weaknesses

The Moore County substation attacks on , 2022, exposed the electrical grid's susceptibility to low-tech physical , as assailants used high-powered rifles to fire dozens of rounds into transformers at two facilities, causing oil leaks and equipment failures that disrupted power for approximately 45,000 customers over several days. This method required no explosives or entry beyond perimeter barriers, highlighting how gunfire can effectively disable high-voltage components from accessible distances. Perimeter security at the targeted sites, such as chain-link fences and a basic metal farm gate at the West End substation, offered inadequate protection against intrusion or ranged attacks, allowing attackers to breach or bypass defenses with minimal effort. Across the U.S., over 55,000 substations depend on similar rudimentary , making widespread infrastructure vulnerable to coordinated or opportunistic assaults without robust hardening like ballistic shielding or reinforced enclosures. The attacks underscored limited in rural or less interconnected grid segments, where damaged substations cannot easily reroute power, prolonging outages in areas like Moore County with fewer transmission alternatives. replacement faces severe constraints, including 12- to 18-month lead times for custom high-voltage units often sourced internationally, amplifying the cascading effects of targeted damage. Publicly available substation schematics and locations, combined with the facilities' visibility from roads, facilitate and , as noted in post-incident analyses revealing guides on the for such operations. The lack of a unified federal oversight body for leaves utilities reliant on self-regulated measures, despite over 700 reported attacks on grid infrastructure since 2013. M. Granger Morgan, an and professor at , described the system as "inherently vulnerable" due to its expansive, dispersed nature and historical underinvestment in defenses against deliberate .

Policy and Legislative Reactions

In response to the December 3, 2022, attacks on two Duke Energy substations in Moore County, North Carolina, state lawmakers introduced legislation to impose harsher penalties for intentional damage to utility infrastructure. Senate Bill 58, titled "Protect Critical Infrastructure," passed the North Carolina Senate unanimously on March 15, 2023, creating a new high-grade felony offense punishable by up to 20 years in prison for willfully damaging or attempting to damage energy facilities, with enhanced sentences if outages affect multiple counties or critical services like hospitals. The bill received final approval in the House on June 15, 2023, and was signed into law by Governor Roy Cooper on June 21, 2023, elevating such acts from misdemeanors or lower felonies to Class C felonies in many cases. At the federal level, the (FERC) directed the (NERC) on December 21, 2022, to review and potentially revise standards for the bulk power system, citing the Moore County incident as evidence of vulnerabilities to targeted gunfire attacks. U.S. House Energy and Commerce Subcommittee on Energy held hearings in June 2023 specifically addressing the Moore County attacks, focusing on improving information sharing between utilities and government agencies, as well as bolstering substation protections amid a reported uptick in nationwide incidents from 91 in 2021 to 163 in 2022. North Carolina Congressman Richard Hudson, representing the district encompassing Moore County, advocated for federal measures to enhance grid resiliency, including provisions in the Fiscal Responsibility Act of 2023 for risk assessments of and funding for physical hardening. By the second anniversary on December 3, 2024, Hudson highlighted ongoing congressional efforts to mandate better perimeter security and rapid-response protocols for substations, though no comprehensive federal legislation directly naming the Moore County event had been enacted as of that date. These reactions emphasized deterrence through penalties and proactive security upgrades rather than reactive outage mitigation.

Comparisons to Other Attacks

The Moore County substation attacks on December 3, 2022, involved coordinated gunfire targeting two facilities approximately 10 miles apart, resulting in outages for about 45,000 customers and one fatality from during restoration efforts. This physical assault using high-caliber rifles parallels the April 16, 2013, Metcalf transmission substation attack in , where unknown assailants fired over 100 rounds from .30-06 caliber rifles at 17 transformers over 19 minutes, causing $15 million in damage but no immediate blackout due to grid redundancies. Both incidents exploited vulnerabilities in substation perimeter security, such as inadequate fencing and surveillance, demonstrating how small teams with legal firearms could inflict disproportionate harm on high-voltage equipment like transformers and insulators, which are difficult and costly to repair rapidly. Unlike Metcalf, where attackers cut nearby AT&T fiber optic cables to potentially hinder response coordination but fled undetected after breaching a , the Moore County perpetrators severed control cables inside the substations post-shooting, amplifying disruption and requiring manual isolation that prolonged outages up to several days in freezing conditions. The Metcalf event prompted enhanced federal guidelines from the (FERC) on physical security, yet the Moore attacks highlighted persistent gaps, as utilities reported insufficient pre-attack hardening like ballistic barriers despite post-2013 awareness. Another comparable case occurred in in 2013, with at least four documented attacks on high-voltage transmission infrastructure, including the August 21 downing of a 500,000-volt line via gunfire or , investigated by the FBI as potential . These incidents, like Moore , involved targeted of insulators and conductors from accessible distances, causing localized outages but exposing the grid's fragility to lone actors or small groups without sophisticated tools. However, Arkansas events resulted in shorter disruptions and no fatalities, contrasting Moore's broader impact from hitting multiple interdependent substations during winter, which cascaded failures across a less redundant rural network.
AttackDateMethodImpactOutcome
Metcalf, CAApril 16, 2013 fire (100+ rounds) on 17 transformers; fiber cut$15M damage; no outageNo arrests; spurred FERC security reviews
transmission linesMultiple in 2013 (e.g., Aug. 21)Gunfire/ on linesLocalized outagesFBI probe as ; vulnerabilities noted
Moore County, NCDec. 3, 2022Gunfire on two substations; cable cuts45,000 outages (days); 1 deathUnsolved; $10M+ reward, heightened alerts
These cases underscore a pattern of escalating physical threats to U.S. substations since , with attackers leveraging off-the-shelf weapons against minimally protected assets, yet federal and utility responses have lagged in mandating comprehensive retrofits, as evidenced by repeated successes despite prior warnings.

Controversies

Delays in Investigation Progress

As of December 2024, nearly two years after the December 3, 2022, attacks on two substations in , federal and local investigators had made no arrests and identified no suspects publicly. The investigation, led by the FBI, Moore County Sheriff's Office, and , continued without significant breakthroughs, with officials citing a scarcity of and leads as primary obstacles. Moore County Sheriff stated in December 2023 that the probe remained active but offered no new details, emphasizing persistence amid public inquiries. Unsealed search warrants released in late 2023 and early 2024 revealed investigative steps, including analysis of surveillance footage and identification of a "person of interest," but these disclosures did not yield arrests or motive clarifications. The FBI maintained a $25,000 reward offer, matched by state and local entities to total $100,000, specifically for information leading to the identification and apprehension of those responsible, underscoring the stalled momentum. By November 2023, one year post-attack, neither the sheriff's office nor the FBI had announced a motive, despite the coordinated gunfire damaging transformers and causing outages for approximately 45,000 customers. Progress appeared hampered by the attackers' use of high-caliber firearms from distant positions, leaving minimal forensic traces beyond casings and a discarded , which yielded limited DNA or fingerprints. Local media reports highlighted ongoing challenges, with agencies declining detailed updates to avoid compromising leads, though this opacity fueled questions about efficacy one and two years later. No major developments were reported through October 2025, maintaining the case's status as unsolved despite interagency collaboration.

Criticisms of Preparedness and Response

The Moore County substation attacks revealed significant shortcomings in the of electrical , as the assailants easily breached perimeter fences and inflicted with small-arms without triggering immediate detection or response mechanisms. Substations targeted on December 3, 2022, fell just below thresholds set by the (NERC) for mandatory enhanced protections, allowing reliance on basic fencing that proved inadequate against deliberate sabotage. Critics, including members of , argued that utilities like failed to heed prior warnings from incidents such as the 2013 in , which demonstrated similar vulnerabilities to gunfire on transformers. Regulatory response drew further scrutiny, with NERC declining to recommend new mandatory standards for thousands of substations nationwide following the attacks, despite evidence of rising threats to the grid. This stance was criticized for perpetuating reliance on voluntary measures, which empirical data from Moore County showed insufficient to prevent widespread outages affecting 45,000 customers for up to a week amid winter conditions. executives faced questioning from the North Carolina Utilities Commission on the company's preparedness, including surveillance gaps and response protocols that allowed the coordinated strikes to cascade into major blackouts. Post-incident improvements, such as enhanced surveillance and access controls implemented by , were acknowledged but highlighted as reactive rather than proactive, underscoring broader systemic underinvestment in grid redundancy and hardening against low-tech threats. Advocacy groups and security experts contended that government inaction on known risks, including a surge in substation attacks documented by federal agencies, contributed to the event's severity, as limited backup systems prolonged restoration efforts. These lapses emphasized causal factors like insufficient deterrence and rapid capabilities, prompting calls for mandatory federal standards to address empirical vulnerabilities rather than depending on utility discretion.

Media Framing and Public Discourse

Initial media coverage of the December 3, 2022, attacks on two substations in , emphasized the widespread power outages affecting approximately 45,000 customers, with some enduring disruptions for up to five days, while contextualizing the incident amid a concurrent controversy over a drag performance at a local school theater. Outlets such as and framed the event as a deliberate raising alarms about electrical vulnerabilities, but often highlighted the timing's with anti-drag protests organized by groups including the , without attributing a confirmed motive. This framing aligned with narratives from advocacy organizations like Equality NC, which linked the attacks to broader anti-LGBTQ+ sentiment observed in local protests, though federal investigators, including the FBI, described potential motives as tied to unspecified extremist behaviors without endorsing the interpretation. Public discourse, particularly on social media platforms, amplified unverified theories positing the outages as an intentional effort to disrupt the drag event, fueled by the attack's occurrence during the performance and prior community debates over its venue at a public school facility. Local LGBTQ+ groups and figures, such as Sandhills PRIDE's executive director, publicly asserted the attacks aimed to halt the show, interpreting them through the lens of escalating cultural tensions, a view echoed in progressive-leaning publications like The Nation. However, law enforcement statements consistently noted the motive remained undetermined, with no arrests tied directly to the substation shootings even two years later, prompting skepticism toward motive-driven framings that prioritized ideological narratives over evidentiary gaps. As coverage evolved, conservative commentators and outlets shifted focus to systemic grid frailties exposed by the gunfire damage—requiring over 100 rounds to transformers and control equipment—criticizing mainstream reports for underemphasizing risks in favor of localized social conflicts. This divergence reflected broader patterns where left-leaning media, prone to amplifying identity-based explanations amid institutional biases toward such interpretations, contrasted with discussions in security-focused analyses prioritizing physical vulnerabilities over unproven ideological drivers. Public reactions on forums like framed the incident as potential akin to prior substation assaults, such as Metcalf in 2013, urging enhanced physical protections rather than speculative cultural attributions. By late 2023, discourse increasingly centered on policy failures in substation hardening, with figures like Rep. Richard Hudson advocating federal reforms, underscoring how initial event-specific framing yielded to enduring concerns over resilience absent perpetrator identification.

References

Add your contribution
Related Hubs
User Avatar
No comments yet.