The bulletin, first reported by Shannon Vavra at Daily Beast, says that “domestic violent extremists” have “developed credible, specific plans to attack electricity infrastructure since at least 2020, identifying the electric grid as a particularly attractive target given its interdependency with other infrastructure sectors.”

It suggests that these extremists will continue plotting attacks against the power grid that “may result in physical damage.” It indicates that conversations among far-right extremists online have focused in recent months on encouraging so-called “lone wolf” attacks involving only a single terrorist. Other online chatter includes efforts to inspire people with minimal training to also target electrical infrastructure, with weapons ranging from improvised incendiary devices, hammers, power saws, and guns.

Some of these conversations in 2019 explored attacking power stations in southeastern states if Donald Trump did not win re-election.

It’s likely that most such extremists wildly overestimate their ability to disrupt the power grid. The bulletin notes:

“Absent significant technical knowledge or insider assistance, small scale attacks are unlikely to cause widespread, multi-state power loss but may result in physical damage that poses risks to operations or personnel.”

The Idaho group—comprised of a former porn-film actor, two veterans of the U.S. Marine Corps, a currently serving Marine, and an enlisted National Guardsman—moved to the state in early 2020 and began setting up operations there. They were arrested in November of that year, originally charged with a gun-running scheme.

Three of the four men—Justin Hermanson, 21, who used the code name “Sandman”; Liam Collins, 21, aka “Disciple”; and Jordan Duncan, 25, aka “Soldier”—had met while serving in the Marines at Camp Lejeune, North Carolina. The fourth—Paul Kryscuk, 35, whose nom de plume was “Deacon”—was a porn actor (under the stage name “Pauly Harker”) who had lived most of his life on Long Island, New York. He met the other men online in the now-defunct neo-Nazi message board Iron March, and was the group’s general leader, though all they identified as members of the terrorist organization Atomwaffen Division.

Investigators found an abundance of evidence to charge them with plotting to attack the power grid in the region. According to the Idaho Statesman, the four men made plans to use their assault-style rifles to target transformers at power substations in Idaho and nearby states. They researched a previous attack on the grid by an unidentified group.

The men also had a plan to target power transformers using homemade thermite, concocted from Tannerite, which is an explosive available to the public as a target for gun owners. Their plan was to collect enough of the target explosive units to manufacture the thermite, which burns at such a high temperature that it will destroy metal transformers.

Hermanson, the indictment says, told a coconspirator that if the group was successful in blowing up a power substation, “it would take down the entire regional or coastal power grid and cause chaos for the country.”

Just before their late-October arrest, Collins, Kryscuk, and Duncan discussed plans to take out a power grid. When they were arrested, prosecutors say, investigators found a handwritten list in Kryscuk’s possession that identified a dozen locations in Idaho and other Northwest states with transformers, substations, or other power-grid components.

The prospect of terrorist attacks on their facilities has been an increasing focus of concern for utility companies, who reportedly requested an assessment of the situation from DHS. Of particular concern for them is the repeated targeting of transformers, which require a significant lead time to be replaced. That is a threat to U.S. grid resilience, which in 2015 led Congress to order the creation of a strategic reserve for critical power system equipment.

“The major concern is that large transformers, which are critical to grid operations, have a long lead time from order to delivery, often longer than 12 months,” Mark Carrigan, cyber vice president of process safety and operational technology cybersecurity at Hexagon PPM, told Utility Dive.

Carrigan said that a widespread outage is “unlikely,” unless the terrorists have specific knowledge about the grid and can conduct a coordinated attack at dispersed locations. But “the potential for a prolonged outage is possible depending upon the scope of an attack,” he said.