EXCLUSIVE: Records show uncoordinated response to Moore County power grid attack

MOORE COUNTY, N.C. — There are still signs of the gunfire attacks nearly three months ago that knocked West End and Carthage substations offline, leaving Moore County in the dark.

The substations were attacked on Dec. 3, causing a days-long power outage that affected tens of thousands of people. No arrested have been made.

Details about the criminal investigation have been slim, but Channel 9′s Madison Carter has uncovered new information about how the case is being handled by law enforcement.

PREVIOUS COVERAGE:

• Gun shop owner sleeps in store to ward off thieves during Moore County blackouts
• NC families seek shelter from cold amid power outages caused by substation attack
• FBI investigating power grid attack in Moore County, sheriff says
• Power restored: Moore County residents try to return to normal after substation attack

Security upgrades

Last month, a Duke Energy spokesperson told Channel 9 it had made security upgrades around the Moore County substations. At first, when Channel 9 went back out to the sites of the attacks, it appeared the stations were unsecured. But upon closer inspection, we spotted new cameras watching from above.

Now, Carter has discovered Duke Energy may have forgotten to tell law enforcement investigators about the work they were doing after the attacks.

She obtained emails showing a new camera caused confusion in the days after the attacks.

We learned in that correspondence a Moore County investigator allocated resources for a forensic analysis to determine who that camera belonged to -- only to learn it had been placed by Duke’s security team.

Similar attacks across the country

Attacks like those in Moore County have happened all across the country.

Jon Wellinghoff was the chairman of the Federal Energy Regulatory Commission (FERC) during an attack on the Metcalf transmission substation in California in 2013. It was the largest gunfire attack on an electric substation in the country.

“There were cameras at Metcalf and all you can see is muzzle flash from the gunfire,” he said.

No one was ever arrested.

“That level of sophistication, if it’s replicated by Moore County and by any of these other attacks, it’s going to be extremely difficult to catch these people,” Wellinghoff said.

And more recently, a similar incident happened in Seattle. ABC affiliate KIRO reported thousands were plunged into the darkness over Christmas after four substations there were attacked.

FBI agents in the Seattle area arrested two suspects within days.

Moore County investigation

Court records reveal Seattle investigators looked at cell phone pings in four different locations at the time of the attacks.

Carter obtained records that show the FBI in North Carolina tried to do that too after the Moore County attacks. The emails, which federal investigators later said they shouldn’t have provided to us, show what was in federal warrants we reported on back in December.

According to the emails, the FBI asked Google for its controversial geofencing data, which identifies known cell phone users within a certain area during a specific window of time. Warrants also went to T-Mobile, AT&T and Verizon.

In the course of the investigation, Moore County Sheriff Ronnie Fields asked a data analyst to pull names and addresses of everyone living within a mile of the two substations.

MORE PREVIOUS COVERAGE:

• Power grid attack: Duke Energy previously fined for security violations, report alleges
• Authorities file search warrants in connection with Moore County power grid attack
• 9 Investigates: Duke Energy steps up security after Moore County power grid attack
• FBI offers reward for tips on North Carolina electrical substation shootings

Documents also show the FBI also asked Duke Energy for GPS tracking data of employees who had been to either of the substation locations in the month prior. They also wanted employee records of anyone who Duke terminated three months prior to the attack.

“Absolutely, the person that done this, or the person knew exactly what they were doing. Absolutely,” Moore County Sheriff Ronnie Fields said in December.

The FBI wouldn’t comment on any of their tactics, after learning Carter had seen some of their emails about the investigation.

Instead, an FBI spokesperson sent a statement saying, “FBI agents and Moore County Sheriff’s Office deputies continue to follow tips and develop investigative leads to determine who is responsible for shooting two substations on December 3, 2022. We are using every available investigative tool and technique to hold the offender(s) accountable for the devastation caused by this act.”

Carter made several attempts to speak with the Moore County sheriff, who last updated residents on the case on Dec. 28. She was told by the department’s public relations officer, “Sheriff Fields is grateful for the offer but must respectfully decline your interviewing him at this time as he focuses all efforts toward the investigation.”

Channel 9 asked for his emails and his calendar to determine how much time was being dedicated to this investigation. We found a long holiday break and several other social engagements unrelated to the substation attacks.

But Field’s emails did yield one other tidbit of information: A lack of coordination regarding nearly two dozen shell casings found at the substations.

Evidence in the case

Investigators collected nearly two dozen shell casings from what they called high-powered rifles. But after looking through the emails she obtained, Carter also found there was a lack of coordination between investigating agencies.

In one email, a Moore County investigator reached out to the FBI to ask about the status of the evidence in the case. An FBI investigator replied, “I just checked on [the shell casings] and they are still at our lab. I’m not sure why. I just had our evidence tech request they send everything back ASAP.”

The casings were supposed to be moved from the FBI lab to the North Carolina crime lab. The FBI was the agency responsible for making sure that happened, but as of Jan. 4 -- nearly a month after the attack -- those shell casings hadn’t made it to the NC crime lab.

But even when the casings do make it to the state crime lab for analysis, investigators still might not be able to answer who shot up the substations. Jon Wellinghoff said investigators had casings from the California attack a decade ago, too, but those didn’t help solve the case.

“The FBI recovered all of the brass that was shot, but there was no fingerprints on any of the brass,” Wellinghoff said. “So obviously it was wiped, or they put it in with gloves or whatever.”

Channel 9 learned the Moore County Sheriff’s Office also put up its own motion-activated cameras at the two substations. Deputies were given clear instructions: “If something suspicious is seen, they want to get personnel to these sites as fast as possible,” an email reads. But while Channel 9 crews were at the Carthage substation earlier this month, a deputy drove right by them and never asked what they were doing.

Channel 9 visited more than just the two substations that were attacked in December in order to see how secure the power grid is across our entire area.

>> On Thursday, we’ll share our findings, what Duke Energy had to say about it, and how it could be on Duke customers to bankroll security upgrades.

(PREVIOUS: Duke Energy steps up security after Moore County power grid attack)

Duke Energy steps up security after Moore County power grid attack

©2023 Cox Media Group