Unsealed warrant provides closer look at NC power grid attack investigation

MOORE COUNTY, N.C. — When gunfire attacks took down two critical substations in Moore County in December 2022, 45,000 people were left without power and one woman who relied on an oxygen tank died.

SPECIAL SECTION: 9 Investigates Power Grid Security

A year later, investigators released a picture of a van of interest.

FBI searches for minivan The FBI is sharing a photo of a minivan seen the night of Moore County power grid attack and is asking anyone who saw it that night to call them.

Information on the investigation is scarce and law enforcement did not say why they were searching for the van, but newly unsealed search warrants paint a clearer picture into what law enforcement has been looking into. Former FBI assistant director Chris Swecker reviewed some of the search warrants to help explain what investigators might be thinking.

“The agencies will not feed information to the public unless it’s in their best interest. They don’t give out details of investigations normally unless they can leverage the public to help them solve the crime or identify a suspect,” Swecker said.

Located near the substation in West End, a storage facility captured the van on camera entering and leaving an unpaved driveway on the property. That driveway leads to unpaved trails and could offer a path to the substation.

“I observed video of a van enter the Pinnacle Storage parking lot on December 3, 2022 at approximately 8:35 PM and travel down an unpaved driveway parallel to N.C. Highway 211 towards the rear of Pinnacle Storage,” an affidavit from an investigator reads.

Despite leading towards outdoor storage and another gate, employees said there are no records showing the storage gate opening on the night of the attacks. The van was spotted entering and leaving the facility twice on camera and didn’t stay for long.

0 of 15

“Approximately 1 minute after the van entered the property, it was observed on video leaving the property and traveling east on N.C. Highway 211 towards the West End Duke Energy substation. At approximately 8:46 PM the van was seen on video entering the Pinnacle Storage property a second time and traveling down the same driveway. Approximately 1 minute 10 seconds later, the van was observed on video leaving the property traveling east on N.C. Highway 211 towards the West End Duke Energy substation,” according to the court records.

The van is not the only vehicle of interest investigators mentioned in the warrants.

“A light in color truck was also observed on video leaving the above-described unpaved driveway at Pinnacle Storage from the direction of the West End Duke Energy substation on December 3, 2022 at 21 :25 EST. No Pinnacle Storage video footage was observed of the truck entering the property on the evening of December 3, 2022,” according to search warrants.

PREVIOUS COVERAGE:

The video was sent to the FBI analysis after it was discovered and the investigator alludes to a possibility the van was involved in the attacks.

“In my training and experience as a criminal investigator, I have found it common for accomplices using a “getaway vehicle” to linger in the area of an offense until the offender is able to escape the area and reach the “getaway vehicle,” the warrants read.

The storage facility video appears to be one of the stronger leads law enforcement has, but it’s the lack of more video that has Swecker concerned.

“What scares me a little bit -- and it should concern everybody -- They have obvious blind spots in their video. They were looking at a next-door storage place and hoping they had video, but if the substation itself, you would think would have really strong video coverage since there’s no guard there,” he said.

Cellphone data narrows down the list

Obtaining the storage video wasn’t the only thing investigators looked for. Using geofencing warrants, they were able to obtain data containing phone records of devices in the areas of the substations that night.

Law enforcement was able to narrow down a large list of cellphone numbers to just 17 that pinged in both areas near the attacks.

After obtaining the cellphone information, law enforcement focused on one individual. That man is named in the warrants; however, since he has not been charged with a crime, Channel 9 is not publishing his name.

The first mention of the man came after an employee with another electrical company contacted the sheriff’s office with a tip. The employee said he received a phone call from the man in question the day after the attack telling him he was calling out of work due to the possibility of being questioned by police about the shootings.

“[Redacted] stated that he was calling because his coworker, [Redacted] …, called him on Sunday, December 4, 2022, and stated that he wouldn’t be working Monday, December 6, 2022. [Redacted] stated that [Redacted] sounded upset and told [Redacted] that [Redacted] had been in communication with people connected with a group called the Moore County Patriots and that they had developed a plan to damage substations in Moore County,” according to the warrants.

Despite telling his coworker plans had been made to attack substations, he also claimed the plans were supposed to have been abandoned.

“[Redacted] told [Redacted] that he wasn’t coming into work because he was probably going to be questioned by law enforcement about the substation shootings,” according to warrants.

The tipster also told law enforcement the man in question was not just associated with the Facebook group.

MORE PREVIOUS COVERAGE:

“[Redacted] stated that he asked [Redacted] how likely [Redacted]was to be implicated in the substation attacks based on his connection to the group “Moore County Patriots” or “Moore County Citizens for Freedom”, and [Redacted] responded that he was one of the founding members of the group,” according to warrants.

That tip was not the only time law enforcement heard from the man. Following the attacks, investigators said the man reached out to the county emergency operations center offering assistance to help repair the substations, and later showed up in person.

“At the EOC, [Redacted] spoke with Moore County Public Safety employee, Matt Dawkins. According to an interview conducted with Matt Dawkins, [Redacted] told Dawkins that he was an electrical engineer and had experience with high and low voltage, and substations. Dawkins stated that [Redacted] offered to help with the Moore County power outage,” according to the documents.

Despite his employment with a power company and offers to help, something did not feel right to the county employee.

“Dawkins described [Redacted] as “uncomfortable” and “out of his element” while speaking to Dawkins. Dawkins stated that [Redacted] gave him “weird vibes,” the search warrants reveal.

Once investigators learned of the conversation between the coworkers, they requested a warrant to show the location information from cellphone companies.

The information from that warrant showed at least one phone number associated with the man was used near the Carthage area that night. The phone in question is a phone number linked to the man’s wife -- but he told investigators his wife was in Charlotte the night of the shootings.

“AT&T records of cell tower usage from the Carthage area on December 3, 2022 revealed that at approximately 7:32 PM on December 3, 2022 the cellular telephone number of [redacted] connected to an AT&T tower located approximately 990 yards from the Duke Energy substation in Carthage …” according to the warrants.

All these facts led the investigator to believe the man in question might have had something to do with the attacks.

“I further believe that initial information provided by [redacted], that [redacted] had planned a substation attack with a group of people that was supposed to be abandoned, is supported by the fact that [redacted] made multiple unnecessary efforts to provide unsolicited assistance with the Moore County substation attacks, even going so far as to call out of work and contemplate personally carrying out repair services at Duke Energy substations; repairs that he was not expected to provide and was not realistically capable of providing in response to the attacks. In my training and experience, persons involved in criminal activity may offer assistance after the crime due to feelings of guilt, or to gather information about an ongoing investigation,” according to investigators.

They aren’t alone. Swecker also said he can see why law enforcement decided to focus on the man.

“There were some other tidbits that kind of led you to think, OK, [redacted] might be a viable suspect in this case,” he said.

Swecker tells Channel 9 between the absence of arrests at this point and the fact the public can now review these previously sealed warrants, there are indications that investigators are looking at other leads.

“They generally don’t unseal search warrants unless… somebody has been arrested or the case has been resolved,” he said. “It may be that they have some information that this wasn’t terror-related, that this was perhaps vandalism or a vendetta of some kind.”

The FBI and the Moore County Sheriff’s Office both declined to offer any further information in the investigation when reached for comment. WSOC also attempted to contact the man in question by calling the phone numbers laid out in the warrants, but received no answer.

(WATCH BELOW: Residents, officials look back at Moore Co. substation attacks after one year; still no suspects)