2015: “While we have not yet identified the shooter, there's some indication it was an insider," said Caitlin Durkovich, assistant secretary for infrastructure protection at the Department of Homeland Security.
After reading one of the references (https://money.cnn.com/2015/10/16/technology/sniper-power-gri...), and learning that they think it might have been an insider, a third possibility occurs to me: what if it was someone—maybe a PG&E employee—who knew first-hand how unprotected this infrastructure was, and wasn't being taken seriously? Especially given the Homeland Security report a year earlier about how easy this kind of attack would be.
Conspiracy-theory stuff, maybe, but:
> The assault...became a harsh wake-up call for energy providers, who have since become obsessed with the physical security of their remote power stations.
> PG&E alone has pledged to spend $100 million to improve security at its facilities...Transformers are often custom designed, sometimes costing $3 million each—and replacements are slow. Plus, physical attacks on energy distribution machines are much more effective at taking out the power grid than a computer hack. And it's incredibly easy to pull off, several energy utility firms told CNNMoney.
> Experts attending GridSecCon, held by the North American Electric Reliability Corporation this week, are now discussing the need to enclose electronics in 1/2-inch thick armor plating that can stop high-powered rifle rounds. Power utilities have started loading remote substations with infrared cameras, gunshot audio sensors and even seismic recorders that catch vibrations.
- it caused $15 million in damage, and $100 million in updated security -> contractor needing work
- it was a "domestic terrorism" event -> what legislation or policies were on the table at this time?
Those would be my starting points.
I'm less sure about the terrorist angle. The point of a terrorist act is to advance or discourage a specific political agenda; that only works if you're clear about who you are and why you did it, though. These guys never did that (although maybe scaring PG&E into securing their facilities roughly fits the definition of goal-oriented violence, even if it wasn't motivated by politics).
- losing power
- losing network connection
- a distraction in the news
Compare e.g. the incident where a disgruntled worker decided to flood an area with raw sewage through false radio commands (https://www.mitre.org/sites/default/files/pdf/08_1145.pdf)
If it was an insider, it was probably someone with a workplace grievance. Maybe someone who had raised concerns about security and wanted to prove himself correct, or just someone with a boss they disliked who wanted to make trouble.