2022 Moore County substation attack

Overview

On December 3, 2022, a significant infrastructure incident occurred in Moore County, North Carolina, involving a targeted shooting attack on two electrical distribution substations operated by Duke Energy. The assault resulted in substantial damage to the local grid infrastructure, triggering widespread power outages that affected up to 40,000 residential and business customers in the region. The incident was notable not only for the scale of the electrical disruption but also for the immediate human toll, which included the confirmed death of one woman. In the wake of the attack, local government officials declared a state of emergency and enacted a corresponding curfew to manage the resulting logistical and social challenges. Initial assessments indicated that full restoration of electrical power could require up to four days, highlighting the vulnerability of critical energy infrastructure to direct physical threats.

Background and Context

In the months leading up to the December 3, 2022 attack on Moore County substations, federal law enforcement agencies had issued specific warnings regarding threats to the United States' electrical grid. The Federal Bureau of Investigation (FBI) highlighted a growing risk from racially motivated violent extremist ideology, identifying electrical infrastructure as a prime target for disruption. These warnings were not isolated administrative notes but were part of a broader intelligence assessment suggesting that attackers were seeking to create tangible, widespread impact through relatively simple means.

Central to this threat landscape was a 14-page document circulated on the messaging platform Telegram. This document detailed strategies for executing low-tech attacks on grid infrastructure, emphasizing the vulnerability of distribution substations to conventional weaponry and environmental factors. The guidance suggested that even minor damage to key nodes could cascade into significant regional outages, leveraging the grid's interconnectedness to amplify the effect of a single incident. The Moore County attack aligned closely with these described tactics, utilizing gunfire to disable transformers and switchgear, thereby validating the FBI's earlier assessments of the threat profile.

The Moore County incident did not occur in a vacuum; it was part of a series of targeted strikes on electrical infrastructure across the United States in late 2022. Other notable attacks occurred in multiple states, demonstrating a pattern of coordinated or inspired actions against the power grid. The following table outlines these prior incidents:

These events collectively underscored the heightened vulnerability of the North American grid to low-tech, high-impact attacks. The FBI's warnings and the Telegram document provided a strategic framework that attackers appeared to follow, selecting substations that could maximize customer disruption with minimal technical expertise. The Moore County attack, which left up to 40,000 customers without power, served as a stark realization of these predicted threats, prompting immediate emergency responses and long-term security reviews by operators like Duke Energy.

The Attack

The incident, carried out against infrastructure operated by Duke Energy, represented a significant disruption to the regional power grid. The attack specifically focused on the Carthage and West End substations, which are key nodes in the local distribution network. Gunfire was directed at both facilities, causing structural and mechanical damage that immediately impacted power delivery to the surrounding communities.

Damage to Infrastructure

The assault involved gunfire aimed at the gates and internal equipment of the substations. At the Carthage substation, the damage was extensive enough to disrupt the flow of electricity to a large portion of the county. Similarly, the West End substation suffered hits to its protective barriers and electrical components. The precision of the shots suggests a deliberate effort to disable the transformers and switchgear essential for voltage regulation and power distribution. This physical damage to the grid infrastructure led to an immediate cascade of outages across the service area.

Immediate Power Loss

The simultaneous damage to the Carthage and West End substations resulted in the loss of electrical power to approximately 36,000 residential and business customers. This figure represents a substantial portion of the Moore County population, leaving homes, commercial establishments, and critical facilities without electricity in the midst of winter. The scale of the outage was significant enough to trigger broader regional concerns about grid resilience. Local officials noted that initial estimates suggested it could take up to four days to fully restore power to all affected customers, depending on the extent of the equipment damage and the availability of repair crews.

Investigation and Evidence

The investigation into the December 3, 2022, attack on the Duke Energy substations in Moore County, North Carolina, involved a coordinated multi-agency effort to determine the scope of the damage and identify the perpetrator. Local law enforcement, state investigators, and federal agencies collaborated to secure the scene and analyze physical evidence recovered from the two targeted facilities.

Multi-Agency Investigation

The Moore County Sheriff’s Department led the initial on-the-ground response, working in conjunction with the North Carolina State Bureau of Investigation (SBI). The Federal Bureau of Investigation (FBI) also joined the inquiry, bringing federal resources to analyze the potential strategic nature of the attack on the regional grid infrastructure. Additionally, the Center for Energy Security and Emergency Response (CESER) was involved in the assessment, focusing on the operational impact on the electrical distribution network and the broader implications for energy security in the region.

Evidence and Forensic Analysis

Forensic teams recovered significant physical evidence at the substation sites. Investigators found approximately two dozen shell casings, which were identified as being fired from a high-powered rifle. This evidence suggested that the attack was methodical, with the shooter targeting critical components of the substations to maximize disruption. The specific type of rifle and the trajectory of the bullets were analyzed to reconstruct the sequence of events during the shooting.

Reward Offer

To spur public interest and gather additional leads, a reward of $75,000 was offered for information leading to the identification and arrest of the suspect. This financial incentive was part of the broader strategy to engage the local community and potential witnesses who might have observed unusual activity in the area around the time of the incident. The investigation continued to evolve as new evidence was processed and analyzed by the combined law enforcement teams.

What was the motive behind the attack?

Investigative efforts into the December 3, 2022, shooting attacks on the Duke Energy substations in Moore County, North Carolina, focused on two primary potential motives: domestic extremist accelerationism and anti-LGBTQ+ sentiment. Law enforcement and federal agencies examined the incident through the lens of broader national threats to critical infrastructure. The concept of accelerationism, a strategy employed by some domestic extremists to provoke societal collapse through targeted infrastructure damage, was considered a significant lead. This theory suggested the attackers aimed to create widespread disruption to highlight vulnerabilities in the U.S. power grid and spur political or social change. The scale of the outage, which left up to 40,000 residential and business customers without electrical power, aligned with the impact sought by such strategic attacks (per local government emergency declarations).

Anti-LGBTQ+ Sentiment and the Local Drag Show

A second major investigative angle centered on anti-LGBTQ+ sentiment, specifically linked to a local drag show that had recently drawn both supporters and protesters. The timing of the attack coincided with heightened local tensions surrounding the event. Investigators explored whether the attackers were motivated by a desire to punish the community for its perceived acceptance of LGBTQ+ individuals, using the power grid as a lever to exert pressure on the broader population. The drag show had become a focal point for local political discourse, with demonstrations occurring on both sides of the issue. This context provided a potential social motive for the violence, suggesting the attack was not merely an infrastructure strike but also a symbolic message to the local community.

Lack of Concrete Evidence

Despite the strong circumstantial links to both accelerationist strategies and local social tensions, concrete evidence directly tying the attack to either motive remained limited in the immediate aftermath. The lack of a single, clear confession or definitive forensic link to a specific extremist group or individual made it difficult to assign a singular cause. The investigation highlighted the complexity of modern infrastructure attacks, where ideological and social motives can overlap. The state of emergency and corresponding curfew enacted by local government officials underscored the severity of the incident, which also resulted in the death of one woman. Initial estimates suggested that up to four days could be required to fully restore power in the area, amplifying the impact of the attack regardless of the ultimate motive. The absence of a definitive link to the drag show meant that while social tensions were a factor, they could not be proven as the sole driver without further investigative developments.

Aftermath and Impact

The December 3, 2022, shooting attack on two electrical distribution substations in Moore County, North Carolina, resulted in significant immediate consequences for the local community and the regional power grid operated by Duke Energy. The damage inflicted during the incident left up to 40,000 residential and business customers without electrical power. The disruption was severe enough to trigger a state of emergency and a corresponding curfew enacted by local government officials in the wake of the incident.

Human Toll and Community Disruption

The attack had a direct and tragic impact on the local population. One woman, identified as Karin Zoanelli, died as a result of the power outage caused by the damage to the substations. The loss of power affected essential services and daily life for thousands of residents and businesses in the area. In response to the widespread darkness and potential safety hazards, local authorities implemented a curfew to help manage the situation. Schools in the region were also forced to close, adding to the disruption for families already dealing with the uncertainty of the power grid's status.

Power Restoration Timeline

The restoration process involved assessing the damage to the two substations and coordinating repair efforts by Duke Energy crews. The following table outlines the estimated timeline of the power outage based on initial reports.

The state of emergency declaration allowed for greater coordination among local agencies and utility workers. The curfew helped to reduce traffic and potential incidents in the darkened streets. The death of Karin Zoanelli highlighted the critical nature of electrical infrastructure and the potential human cost of grid failures. The incident served as a reminder of the vulnerability of distribution substations to external physical attacks.

Why it matters

The December 3, 2022, attack on Duke Energy substations in Moore County, North Carolina, serves as a critical case study in the vulnerability of regional electrical distribution infrastructure. The incident demonstrated how targeted physical damage to grid assets can rapidly cascade into widespread service disruptions, affecting up to 40,000 residential and business customers. This scale of outage underscores the sensitivity of distribution networks, where the failure of key nodes can isolate large consumer bases from the broader transmission system.

Human Cost and Infrastructure Resilience

The attack resulted in the confirmation of a homicide directly linked to grid failure, marking a significant milestone in understanding the human cost of energy infrastructure disruptions. The death of one woman highlighted the immediate life-safety risks associated with power loss, particularly for residents relying on electric heating or medical equipment during winter conditions. Initial estimates suggested that up to four days could be required to fully restore power in the area, illustrating the time-intensive nature of substation repairs and the logistical challenges of restoring distribution lines under emergency conditions.

Emergency Response and Governance

These measures reflected the broader governance challenges posed by grid failures, where energy disruptions can trigger secondary effects such as traffic signal outages, water pumping interruptions, and commercial closures. The declaration of a state of emergency facilitated coordinated response efforts between utility operators, local law enforcement, and state agencies.

Domestic Terrorism and Federal Attention

The Moore County substation attack drew significant attention from state and federal authorities regarding its classification as an act of domestic terrorism. The shooting attack on two electrical distribution substations represented a deliberate targeting of critical infrastructure, raising questions about the security protocols for grid assets and the need for enhanced surveillance and hardening measures. This incident contributed to ongoing discussions about the intersection of energy security and national defense, prompting reviews of vulnerability assessments for similar distribution facilities across the United States.

How do grid attacks affect residential power?

Electrical distribution substations serve as critical nodes in the power grid, stepping down voltage levels to make electricity usable for residential and commercial consumers. When these facilities suffer physical damage, the impact on the end-user is often immediate and widespread, as seen in the December 3, 2022 attack on two substations in Moore County, North Carolina, operated by Duke Energy. The incident demonstrates how localized infrastructure failure can cascade into regional blackouts, leaving up to 40,000 residential and business customers without power. Such outages disrupt essential services, including lighting, heating, cooling, and the operation of small-scale generators that many households rely on during grid instability.

Cascading Outages and Customer Impact

The destruction or impairment of distribution substations can lead to cascading outages, where the failure of one component triggers a chain reaction across the network. In the Moore County incident, the damage was significant enough to require initial estimates of up to four days for full power restoration. This prolonged duration highlights the vulnerability of residential and business customers who may not have immediate access to alternative power sources. The loss of electricity affects daily life, economic activity, and even public health, as evidenced by the death of one woman linked to the incident. Local government officials responded by enacting a state of emergency and a corresponding curfew, underscoring the broader societal disruption caused by grid failures.

Generator Dependency and Resilience

In the wake of such attacks, many households and businesses become heavily dependent on backup generators. However, the effectiveness of these generators can vary based on fuel availability, maintenance, and capacity. The Moore County attack revealed the limitations of relying solely on individual generator solutions during extended outages. While generators can provide temporary relief, they are not a long-term fix for large-scale grid disruptions. This dependency also raises concerns about air quality, noise pollution, and the equitable distribution of power, as not all customers have equal access to reliable backup systems.

The incident in Moore County serves as a stark reminder of the importance of grid resilience and the need for robust infrastructure protection. As grid attacks become more frequent, understanding their impact on residential and business customers is crucial for improving emergency response strategies and enhancing overall grid reliability.

See also

• The Dalles Dam: Hydroelectric Infrastructure and the Submergence of Celilo Falls
• FutureGen: The Rise and Fall of a US Coal CCS Demonstration
• Shepherds Flat Wind Farm
• Capricorn Ridge Wind Farm: Texas onshore wind infrastructure
• Fort Calhoun Nuclear Generating Station: Flood Crisis, Structural Defects, and Closure