Energy Attack in Washington: Two men arrested after power grid knocked out on Christmas Day

PIERCE COUNTY, Wash. - Two Washington men are charged with conspiracy to damage energy facilities after several utility substations in Pierce County were attacked on Christmas Day causing at least $3 million in damage.

The attacks also left more than 14,000 in the dark on the holiday with power being restored for most by Dec. 26.

According to the U.S. Attorney Nick Brown, Matthew Greenwood, 32, and Jeremy Crahan, 40, of Puyallup, Wash., were arrested on Dec. 31, 2022.

According to the criminal complaint, the two men were identified by analyzing phone records.

At one of the substations, Tacoma Power captured images of a pickup truck and an image of one of the suspects. Authorities said one of the suspects had a truck matching the description. When serving a search warrant, authorities said they found clothing similar to what is worn in the surveillance images.

Agents said they also seized two short barreled firearms, one with a makeshift silencer, that had not been registered.

"We have seen attacks such as these increase in Western Washington and throughout the country and must treat each incident seriously," Seattle U.S. Attorney Nick Brown said in a news release. "The outages on Christmas left thousands in the dark and cold and put some who need power for medical devices at extreme risk."

Attorneys who represented the men at their appearances in federal court did not immediately return emails seeking comment on the case. Greenwood faces a detention hearing Friday, Crahan on Tuesday. Federal prosecutors are seeking to have them remain in custody pending trial.

The four substations targeted were the Graham and Elk Plain substations operated by Tacoma Power and the Kapowsin and Hemlock substations operated by Puget Sound Energy. The complaint said transformers at the Tacoma Power substations would have to be replaced and damage was estimated to be at least $3 million.

According to the complaint, the pair hit the first three substations early on Christmas Day, then struck the last — the Kapowsin substation — that evening. In each case, they used bolt cutters to access the properties and manipulated switches to knock out power. At the Kapowsin substation, their actions cause arcing and sparking, the complaint said.

Greenwood and Crahan were identified as suspects because location data showed cellphones linked to them to be in the vicinity of all four incidents, FBI Special Agent Mark Tucher wrote in the complaint. Agents surveilled them from Dec. 27 to Jan. 3 and they appeared to be sharing a home in Puyallup, he said.

"The substations are spread out over dozens of miles; the attacks occurred early in the morning and in the evening; and the first and fourth attacks were separated by over twelve hours," the complaint said. "This makes it at least unlikely that an individual would simply happen to be at all four locations around the times they were each vandalized."

When he was arrested, Greenwood had several articles of clothing that matched images of one of the suspects in surveillance images, and agents found him to have two unregistered short-barreled weapons, the complaint said.

The two men face up to 20 years in prison for conspiracy to attack energy facilities and up to ten years in prison or possession of an unregistered firearm.

Prosecutors will ask for the two men to remain detained at the Federal Detention Center in SeaTac. They are also charged with possession of an unregistered firearm.

At least four electrical substations were targeted in earlier attacks in Oregon and Washington beginning in late November. Attackers used firearms in at least some of the incidents and some power customers in Oregon temporarily lost service. In one of the attacks, two people cut through a fence surrounding a high-voltage substation and then shot several pieces of equipment.

The utilities affected in those cases — Portland General Electric, the Bonneville Power Administration and Puget Sound Energy — said they were working with the FBI.

Threats against power grid across U.S.

The damage comes as the federal government monitors potential domestic threats and attacks against the power grid across the United States.

Increasing protection at utility substations may soon be a new practice for power companies across Washington and the U.S.

"There needs to be an awareness that this is now a target," Randall Blazak, an extremism expert & sociology professor in Oregon.

Tacoma Public Utilities owns two of the four substations vandalized. The company tweeted that the substations were "attacked" and "deliberately targeted."

"The security around infrastructure is going to have to change," said Blazak.

The U.S Department of Homeland Security’s Office of Intelligence and Analysis has been monitoring the potential threats and attacks. In January 2022, federal officials indicated extremist groups in the U.S. appeared to be increasing interest in targeting the power grid as a way of disrupting the nation.

In November, DHS published a bulletin that warned of a "heightened threat environment" from those following "violent extremist ideologies." It further stated the domestic groups could potentially act on violent threats during big upcoming events like "the holiday season" against U.S. targets including "critical infrastructure."

"That puts the onus on law enforcement and utilities and people who have to monitor this; kind of raise the security level because there are now these soft targets that are in the sights of the extremists," said Blazak.

Tacoma Public Utilities said federal law enforcement warned the company earlier in December about a security alert for the electrical grid. In a statement, TPU said, "Tacoma Power follows federal reliability standards, including assessing physical risks to our critical energy infrastructure and applying recommended mitigation measures"

Puget Sound Energy owns the other two substations vandalized. Company officials said they have, "extensive measures to monitor, protect and minimize the risk to our equipment and infrastructure." 

Sgt. Darren Moss, public information officer for the sheriff’s office, said surveillance cameras recorded the vandalism.