Neo-Nazis Say Attack Leaving 40,000 Americans in Dark Is Only the Beginning

Amid a long-running campaign by far-right communities threatening to attack the nation's power grid, domestic extremists cheered when two still unattributed shootings at North Carolina substations plunged tens of thousands of people into darkness.

Beyond celebration, however, their comments called for more, bigger attacks targeting critical infrastructure on U.S. soil. Experts told Newsweek that the attack in Moore County, North Carolina, as well as in similar previous attacks across the country, may only be the start of a more destructive campaign.

Prior to Saturday's attacks and in the leadup to the midterm election, Newsweek obtained documents demonstrating dozens of instances of radical groups and individuals sharing threats online against critical infrastructure sites across the nation, along with materials designed to advance such plots. Now, two new reports show how far-right communities, including neo-Nazis, reacted to the most recent sabotage.

The Moore County Sheriff's Office has yet to establish a perpetrator or motive in the December 3 attack, but initial suspicion has centered on right-wing backlash toward a drag show set to be held that same day at the Sunrise Theater in the town of Southern Pines.

That event inspired protests involving armed individuals clad in military gear and the participation of groups such as Moore County Citizens for Freedom, whose director, former U.S. Army psychological operations officer Emily Grace Rainey, was questioned by the Moore County Sheriff's Office after the attack.

Rainey, who was implicated in the January 6, 2021 storming of the Capitol by pro-President Donald Trump crowds seeking to overturn the presidential election, attributed the substation shootings to "God," whom she said was "chastising Moore County" over the drag show.

Far-right chatter also drew a connection between the attacks and the drag show, which was ultimately held in spite of its detractors. One neo-Nazi Telegram post laden with slurs against the LGBT+ community and shared with Newsweek by the SITE Intelligence Group celebrated the "magnificent act of sabotage" as a "beautiful escalation" in a broader culture war.

Another neo-Nazi publication warned that "these attacks will only continue" unless such events are not held. A number of posts on message board 4Chan described specific tactics to cause further damage to the power grid, and others proposed conducting similar actions in larger cities such as New York and Washington, D.C. because they "are not majority white."

Rita Katz, founder and executive director of the SITE Intelligence Group, told Newsweek that the Moore County attack is consistent with the neo-Nazi messaging promulgated online.

"The sabotage against the North Carolina substation aligns perfectly with directives and methods seen in accelerationist neo-Nazi communities," she said, "which we at SITE have exhaustively reported on."

"If this was indeed a far-right terrorist attack, my worry is that it will serve as a proof of concept for other far-right extremists," Katz explained. "Immediately after the reports about the attacks, we at SITE saw such communities praise what happened in North Carolina and call for more, while sharing more directives about what to target and how to do so. Some have specifically suggested large cities."

But Katz, who recently authored the book "Saints and Soldiers: Inside Internet-Age Terrorism, From Syria to the Capitol Siege" on the threat posed by saboteurs to digital infrastructure, explained how targeting infrastructure as "a key objective for accelerationist neo-Nazis, who care less about any distinct outcome and far more about sowing any kind of chaos."

"It is these communities that have inspired mass shooters all over the world," she stated. "Thus, if this act of sabotage was indeed inspired by these communities, it is yet more proof how dangerous these online spaces are, as I described in my recent book on Internet-age terrorism."

A second report shared with Newsweek by the Middle East Media Research Institute's (MEMRI) Domestic Terrorism Threat Monitor (DTTM) featured a neo-Nazi collective on Telegram calling for more attacks on substations and railways, as well as grocery stores and centers for the online megastore Amazon.

The same channel forwarded a video from another account that showed two men armed with rifles opening fire on what one describes as a "water plant." The clip ends with the message "Kill Infrastructure" and is subtitled in English and Russian.

Some of the content in the two reports overlapped with one another, and with materials previously seen by Newsweek in October in a corporate intelligence security memo and an intelligence assessment issued by the California State Threat Assessment Center.

One earlier post by a neo-Nazi publication in summer referenced by Katz included "a detailed manual" that called power grids "the main satiating tool the system uses to keep the masses from rioting" and advised on ways to inflict maximum damage.

"The guide even advised on what to target when 'shooting at substations,' which notably fits with the reported method by which the substations in North Carolina were attacked," Katz said. "Since this manual was released, its many sections have been regularly shared across neo-Nazi online venues."

With such material readily available to would-be saboteurs, DTTM Director Simon Purdue told Newsweek that "the threat posed by attacks on critical infrastructure cannot be underestimated."

"The situation in Moore County offers only a glimpse into the chaos that attacks such as this can cause, and larger scale assaults could bring disruption on a statewide or even national level," Purdue said, referencing "a steady slew of manifestos, social media posts, videos and even instruction manuals on this kind of attack being produced by extremists over the past few years."

Purdue noted that "this is not the first attempted attack on electrical infrastructure by extremist groups," and that many threats envision much more ambitious attacks against critical infrastructure across the nation.

Should such an attack succeed, the consequences could far exceed those experienced by Moore County.

"If a large-scale attack were to occur in a major city or against a major node in either the electrical, gas, or water infrastructure, we could see very deadly results," Purdue said. "Some accelerationists have spoken about using large-scale blackouts caused by such an attack as cover for further, directed terror attacks, while others have promoted the sewing of discord to incite riots or further violence."

"The Moore County case was small-scale when compared to some of the plans that we have seen," he added, "and infrastructure needs to be better protected against such attacks."

Newsweek has previously reported on concerns over the limited toolset available to federal law enforcement when it comes to pursuing domestic threats without any clear foreign connection, as is the case when investigating activity associated with groups such as Al-Qaeda and the Islamic State militant group (ISIS).

Further complicating federal probes is the fact that many of the far-right communities promoting ideologically driven attacks on infrastructure do not abide by traditional group structures.

"While some of these groups are indeed organized and structured, the kind of ideology that underlies an attack such as this often relies on leaderless resistance and directed self-radicalization," Purdue said. "Many extremists are moving away from the group model — believing that groups are vulnerable to infiltration or other targeting from law enforcement — and towards what they tend to call lone-wolf attacks."

"It bears saying, however, that no attack happens in a vacuum," he added, "and the dissemination of materials and radicalization process are very clearly intentional and directed."

But the digital, decentralized and domestic nature of the threat continues to serve as a potentially dangerous blind spot for federal agencies.

"We find that many of these real-world attacks come from singular individuals or small cells whose engagement with the wider extremist milieu happens primarily online," Purdue said.

"This makes intervention and disruption extremely difficult," he explained, "but law enforcement, Congress, and tech companies have a responsibility to prevent the dissemination of violent and harmful content online, and this will play a key role in preventing this kind of attack in future."

While such threats and attacks have persisted for years, including the infamous, unsolved April 2013 organized assault on a substation in Metcalf, California, far-right mobilization is on the rise overall, according to the Armed Conflict and Location Event Data (ACLED) Project.

An ACLED report released Tuesday found that "far-right activity in 2022 is on track to exceed the level of activity reported in 2021," a year already defined deep polarization in the wake of the January 6 riots. The report noted that the two primary factors driving this surge were "continued support of white supremacy and white nationalism," which ramped up last year, and "anti-LGBT+ mobilization," which has seen an uptick in activity since this summer.

The ACLED report also mentioned North Carolina specifically as a state in which "anti-LGBT+ rhetoric has long been salient." Data showed that, in the months leading up to the midterm election, "almost all demonstrations involving far-right groups were anti-LGBT+."

Meanwhile, the investigation continues on local, state and federal levels into what actually happened at the two Duke Energy substations in Moore County.

Major Andy Conway of the Moore County Sheriff's Office told Newsweek that at this stage "all possibilities are being explored and investigated," and that "no threats whatsoever were made prior to the incident."

A spokesperson for the FBI, which is also involved in the probe, told Newsweek that the Bureau "cannot comment" on "specific questions" regarding the ongoing investigation, but that "the FBI remains vigilant and works closely with our law enforcement partners on a daily basis to detect, disrupt, and dismantle any threats that may emerge."

"As always," the spokesperson added, "we ask members of the public to report anything they consider suspicious to law enforcement."

A spokesperson for the Department of Homeland Security, which oversees the Cybersecurity and Infrastructure Security Agency (CISA), said that "DHS will continue to share information with the FBI and state and local authorities as the investigation unfolds." The spokesperson added that "CISA leadership and regional teams have offered support to Duke Energy as they work to restore service."

President Joe Biden also briefly addressed the issue Tuesday, saying the administration remained unaware of the identity the perpetrators, but that he and his officials were currently "running that down."

That same day, White House Press Secretary Karine Jean-Pierre spoke on both the administration's reaction to the attacks and what was being done to address the still-ongoing outages in Moore County.

"We condemn this apparent attack on critical infrastructure," Jean-Pierre said. "Federal law enforcement continues to support the investigation, and we will continue to monitor the situation as that investigation plays out."

"The Department of Energy is working with utilities in the region to ensure they have everything they need to restore power as quickly and safely as possible," she added.

Jean-Pierre also referenced Biden's critical infrastructure security initiatives, saying he has made "resilience to all hazards, both natural and manmade, a priority since day one of his administration."

And while she said these efforts "still have a long way to go," she touted the administration's progress in delivering results though initiatives such as the Bipartisan Infrastructure Law and the Inflation Reduction Act.

"To protect against and limit the impacts of incidents like this," she explained, "we've worked closely with the private sector to strengthen resilience against the full spectrum of potential threats, including through utilizing new technologies and improving how government communicates and shares that information with the private sector, which owns the majority of our nation's critical infrastructure, as you all know."

An update provided Wednesday on Duke Energy's online outage map said that "equipment damaged from recent vandalism has either been repaired or replaced." In a statement on its website Wednesday night, the company announced that it "anticipates having nearly all customers restored by 11:59 p.m. Wednesday [December 7] in the aftermath of an attack on two major substations Saturday in Moore County."

Newsweek has contacted Moore County Citizens for Freedom for comment.