Substation security: intrusion and copper theft at unmanned sites

Substation security: intrusion and copper theft at unmanned sites

Substation security is the work of making an unmanned fence line notice an intruder, answer them on site, and keep a record a responder can act on. Spot AI's AI Security Guard does that work on the cameras already at a substation and on security trailers parked at the fence, detecting people and vehicles in context, deterring with strobes, horns and natural-conversation talkdown, and sending a clip to the person who decides whether to dispatch. The cost of a slow answer is public: on December 3, 2022, gunfire at two Duke Energy substations in Moore County, North Carolina led to an outage for about 45,000 customers (Source: FBI). This guide covers what NERC CIP-014 asks of transmission owners, where video fits in a physical security plan, and how to run detection, verification and response at sites hours from help.

What are the main security risks at an unmanned substation

Spot AI's AI Security Guard is set up around four kinds of after-hours event at substations: intrusion, copper and equipment theft, vandalism, and deliberate damage meant to take a station offline. Each looks different on camera and calls for a different response:

Event	What it looks like on camera	Why it matters at a substation
Intrusion	A person at the fence, a climbed or cut fence, someone in the yard with no work vehicle at the gate	Energized equipment makes every intruder a safety event as well as a security one
Copper and equipment theft	Short repeat visits, a vehicle parked off the access road, people at ground connections, cable trenches or stored spools	Missing ground connections endanger the next crew, and stolen material slows repairs
Vandalism	Damage to the fence, lighting, cameras or control house in a short visit	Damage aimed at security equipment can blind a site before a larger event
Deliberate damage	Gunfire from outside the fence, a vehicle driven at the gate, an attempt on a transformer	The outage lands on customers, not only on the owner

Copper theft is rarely just a materials loss. The FBI listed electrical substations among copper thieves' targets in 2008, citing a Polk County, Florida case in which thieves stripped copper wire from a transformer, leaving nearly 4,000 residents without power, with estimated losses of $500,000 (Source: FBI).

Deliberate attacks often go after communications first. The 2013 attack on PG&E's Metcalf substation involved cutting AT&T fiber-optic lines to knock out phone and 911 service before shots were fired into the substation (Source: Security Magazine). Federal guidance from CISA and the Department of Energy lists the wider range: vandalism, theft and sabotage, ballistic attacks, vehicle ramming, drones, and pre-operational activity around a site (Source: CISA).

What does NERC CIP-014 require of transmission owners

Spot AI's AI Security Guard does not make a utility compliant with NERC CIP-014, but it produces the detection, assessment and recorded video that a CIP-014 physical security plan has to describe. CIP-014-3, the version in force today, exists to identify and protect the transmission stations, substations and primary control centers whose loss to a physical attack could cause instability, uncontrolled separation or cascading within an interconnection (Source: NERC).

Who CIP-014-3 applies to

It applies to Transmission Owners whose stations or substations meet any one of four criteria, and to the Transmission Operators that run the primary control centers for the sites those owners identify:

1. Transmission facilities operated at 500 kV or higher.
2. Facilities at 200 kV to 499 kV at a station connected at 200 kV or higher to three or more other stations, where the aggregate weighted value of those lines exceeds 3,000 (each line weighs 700 at 200 to 299 kV and 1,300 at 300 to 499 kV).
3. Facilities the Reliability Coordinator, Planning Coordinator or Transmission Planner identifies as critical to deriving Interconnection Reliability Operating Limits.
4. Facilities essential to meeting Nuclear Plant Interface Requirements.

A typical distribution substation meets none of these, so it sits outside CIP-014. That says nothing about its risk. It means the owner writes its own plan, usually on the same layered logic.

The six requirements, and where video evidence fits

Requirement	What CIP-014-3 asks	Where video evidence fits
R1 risk assessment	A transmission analysis identifying the stations whose loss could cause instability, uncontrolled separation or cascading, repeated at least every 30 calendar months if any were found and every 60 if none	None. This is a planning study
R2 verification	An unaffiliated, qualified third party verifies the assessment within 90 calendar days of its completion	None
R3 notification	The Transmission Operator controlling an identified primary control center is told within seven calendar days of R2	None
R4 evaluation	An evaluation of the potential threats and vulnerabilities of a physical attack on each site, considering its characteristics, prior attacks on similar facilities, and intelligence from law enforcement and government	Spot AI's case history and Agents Reporting show what has actually happened at a site, by camera and by location
R5 physical security plan	A documented plan, developed within 120 calendar days of R2, with measures designed collectively to deter, detect, delay, assess, communicate and respond, plus law enforcement contacts, a timeline and provisions for evolving threats	Spot AI's AI Security Guard covers deter, detect, assess and communicate, and its time-stamped clips support law enforcement coordination. Delay stays physical: fences, barriers, locks
R6 third-party review	An unaffiliated reviewer, for example a team with a member holding a CPP or PSP certification, reviews R4 and R5 within 90 calendar days of completing the plan	None directly

CIP-014-3 also asks for evidence that the plan was executed on its timeline, so keep the date each camera zone and deterrence rule went live.

The standard is changing. FERC approved CIP-014-4 on September 10, 2026, with a single 36-month assessment cycle in place of the 30 and 60 month cycles. It takes effect on the first day of the calendar quarter 24 months after the approval order takes effect, and until then CIP-014-3 applies.

How should detection be layered at the fence line, yard and control house

Spot AI's AI Security Guard applies a different rule in each of three zones, because the same person means something different at the fence, inside the yard and at the control house door. CISA and the Department of Energy recommend camera coverage of the control house or cabinet, the vehicle gates and the entire perimeter, with the feed recorded for post-incident forensics. The zones turn that coverage into decisions:

Zone	What to detect	What Spot AI's AI Security Guard does	Coverage note
Approach and fence line	A vehicle stopping off the access road, a person lingering at the fence, a fence climb	Spot AI flags loitering and fence jumping, can flag license plates of interest, and starts talkdown at a crossing	Cover the approach as well as the fence, so the record starts before the breach
Yard	Any person inside the fence after hours, activity at ground connections, trenches or stored material	Spot AI treats presence in the yard as the event and escalates through talkdown, strobes and horns while a clip goes to the on-call person	Add a trailer where the yard has no pole positions
Control house or cabinet	A door opened, a person at a cabinet, tampering with lights or cameras	Spot AI flags unauthorized entry and routes it at the highest priority	The control house often holds the power and network for the security system itself

Spot AI runs on the cameras a utility already owns, over ONVIF or RTSP, with legacy analog cameras connected through the IVR. With Spot AI's Iris, a team can describe a site-specific detection in plain language, such as a person near a particular cable trench. The camera choices behind each zone are covered in perimeter intrusion detection approaches.

Telling a crew from an intruder. Spot AI reasons about what is happening, a person, a vehicle, a place, a time, a behavior, and does not identify who anyone is. The reliable separation is procedural: crews log a visit before arrival, and whoever verifies an alert checks it against that schedule. More in the guide to copper theft across substations, solar farms, telecom towers and EV chargers.

Which security approach fits an unmanned substation

Spot AI's AI Security Guard is one of five ways utilities cover unmanned substations, and the right mix turns on how critical a site is and how far it sits from a responder. Here is what each does at 2 a.m.:

Approach	Detects	Verifies	Deters on site	Evidence	Best fit
Spot AI's AI Security Guard on existing cameras and trailers	People and vehicles in context, 24 hours a day	Spot AI sends a clip to the on-call person or a monitoring partner	Spot AI escalates through talkdown, strobes and horns in seconds	Spot AI keeps time-stamped clips, logs and case files	Every site with cameras or room for a trailer, remote sites most of all
Guard patrols on a varied timetable	What a patrol finds when it arrives	In person	Presence while on site	Patrol notes	The highest-ranked stations, and as the responder behind detection
Remote monitoring by a central station	Alarms or feeds operators watch	Operator review	Live voice where speakers exist	Operator logs and clips	Sites with alarm wiring and budget for operator hours
Motion-alarm cameras on a legacy recorder	Pixel change, including weather and animals	Someone reviews the recording later	None	Recording, if retained	Low-criticality sites where review after the fact is enough
Fence and door intrusion sensors	A disturbance at the sensor	Needs a camera or a visit	None on their own	Alarm log	Paired with cameras, not instead of them

Most programs combine layers: detection and on-site deterrence everywhere, a person verifying every escalation, and patrols reserved for the stations the risk assessment ranks highest. Monitoring models are compared in remote monitoring, remote guarding and the AI Security Guard compared.

See it on your own footage. Book a demo to watch Spot AI's AI Security Guard run on video from your own substation cameras, including a fence line covered from a trailer.

How does verification before dispatch work at a site hours from help

Spot AI's AI Security Guard closes the gap between detection and dispatch by deterring on site first and sending a clip to a person who confirms what is happening before anyone is sent. The gap shows up across unmanned infrastructure. In one telecom operator's metro network, thieves breaking into backup power cabinets typically finished in under three minutes, while law enforcement response often stretched to 45 minutes or longer, despite tamper alarms wired to a network operations center (Source: Security Magazine). A response on site shortens the visit, and a verified clip makes the call to dispatch worth answering.

1. Detect. Spot AI confirms a person or vehicle in a zone where nobody should be at that hour and opens a case.
2. Deter. Spot AI plays natural-conversation talkdown that describes what it sees and asks the person to leave, then escalates through strobes and horns. Wording and escalation are covered in talkdown thresholds and scripts.
3. Verify. The on-call person, or a monitoring partner, watches the clip and checks it against the work schedule.
4. Decide. Close it as a scheduled visit, send a technician or guard, or call law enforcement.
5. Brief the responder. The call carries what the video shows: how many people, which vehicle, which direction, whether they have left. Spot AI's clip can go to responding officers directly.

CISA and the Department of Energy call this step assessment: a process to evaluate the legitimacy of an alarm. It is where false alarms get filtered before they cost a truck roll.

What does a remote substation need for power and connectivity

Spot AI's AI Security Guard processes video on the IVR at the substation, so recording and detection run on site and only detections and clips need the uplink. At a remote station that means:

• Bandwidth. Spot AI's IVR keeps full-resolution video in the facility, so a cellular modem or Starlink back-haul can carry a site's alerts without streaming raw video.
• Outages. When the uplink drops, Spot AI keeps detecting, deterring and recording at the site, and alerts go out when the link returns. Cloud-dependent detection goes blind with its radio.
• A quiet site is an event. Spot AI's camera health alerts flag a camera or site that stops reporting. After Metcalf, a substation that goes silent at night deserves the same attention as a detection.
• Power and placement. Where the yard has no pole positions or spare power, a solar and cellular trailer at the fence fills the gap. Size it for the worst month using the guide to sizing solar and cellular security trailers.
• OT review. Spot AI is NDAA-compliant and SOC 2, and only metadata crosses the network, which is what an OT security team asks first about any device near a substation.

Running trailers and fixed cameras as one system is covered in running security trailers and the cameras you already own together.

The substation response playbook, step by step

Spot AI's AI Security Guard handles the first minutes automatically, and the rest of the playbook belongs to named people. Write it with an owner and a target time against each step:

1. Automated first response. Detection, on-site deterrence and the case open without anyone touching a screen.
2. Verification. The on-call person reviews the clip against the work schedule and decides, inside a target measured in minutes.
3. Dispatch. Call law enforcement using the contact details the plan holds, which CIP-014 R5 requires for covered sites. CISA and the Department of Energy recommend recording law enforcement response times for each substation.
4. Federal reporting. On the Department of Energy's Form OE-417, a physical attack that causes major interruptions or impacts to critical infrastructure facilities or operations is an Emergency Alert due within one hour. One that could affect system adequacy or reliability, or vandalism aimed at security system components, is a Normal Report due within six hours. Name who files.
5. Safe entry. After a theft, crews treat grounding as compromised until checked, because missing ground conductors are a shock hazard in an energized yard.
6. Review. Within a week, adjust the zones, add the incident to the site's history for the next R4 evaluation, and check the response time against target.

What evidence to keep after a substation incident

Spot AI's AI Security Guard builds a time-stamped case for every incident, holding the clips, the detections and the actions taken, which is the core of what police and insurers ask a utility to hand over. Keep with it:

1. The clip from the first approach to the departure, not only the breach.
2. The camera name, its location in the yard and the time stamps.
3. The vehicle and plate, if the approach camera caught them, which license plate recognition helps with.
4. The responder log: who verified, who was called, when they arrived.
5. The crew's damage photos and the list of what was taken.

The case also feeds the plan, because prior attacks on similar facilities are one of the three things a CIP-014 R4 evaluation considers. Packaging the same case for each recipient is covered in building an evidence package for police, insurers and attorneys.

What autonomous deterrence has done at other unmanned sites

Spot AI's AI Security Guard already runs this pattern for copper theft at unmanned sites outside the utility sector. A top five North American EV charging network faced thieves cutting charger cables for the copper, at about $5,000 in replacement per incident plus lost revenue and downtime. It rolled out autonomous deterrence, horns and strobes triggering within seconds, from 10 sites to about 120 in roughly a year:

"We've reduced incidents by 80% without any kind of human monitoring."

Jeremy N., Sr. Manager of Operations & Maintenance, Top 5 EV Charging Network (North America)

That is the customer's own measurement on its own sites, not a promise for a substation.

Where a substation security program starts

Spot AI's AI Security Guard gives a utility one system across fixed cameras and trailers, so a program can start at the stations its risk assessment ranks highest and extend to distribution sites without a second platform. Start where a responder is furthest away and copper or attack history already exists, write the verification rule and the OE-417 owner into the plan, and measure response time from the first month. For the wider frame, see what critical infrastructure physical security covers.

Most substations already have cameras that record and nobody watches. Book a demo to see Spot AI turn them into an AI Security Guard that answers at the fence.

Frequently asked questions

What is substation security

Spot AI's AI Security Guard treats substation security as three jobs: detecting people and vehicles at the fence, yard and control house, deterring them on site, and keeping a time-stamped record. More broadly, it is the measures, procedures and technology that protect a station from intrusion, theft, vandalism and attack, set inside a CIP-014 physical security plan at covered transmission sites.

Does NERC CIP-014 apply to distribution substations

Spot AI's AI Security Guard runs the same way at a distribution substation as at a transmission site, but CIP-014 covers only a defined set of transmission sites. CIP-014-3 applies to stations at 500 kV or higher, certain 200 to 499 kV stations above a weighted connectivity threshold, and sites critical to operating limits or nuclear plant interfaces. A typical distribution substation meets none of these.

How do utilities reduce copper theft at substations

Spot AI's AI Security Guard reduces the likelihood of copper theft by detecting a person at the fence or in the yard after hours and deterring them on site before material leaves. Utilities pair that with locked storage for spare conductor, marked material, a camera on the access road, and a named person who verifies each alert.

Can video AI work at a remote substation with a weak connection

Spot AI's AI Security Guard runs detection on the IVR at the site, so recording and on-site deterrence continue when the uplink drops, and alerts go out once it returns. Because only detections and clips leave the site, a cellular or Starlink link is enough, and a solar trailer covers a fence line with no pole or power.

Does video AI satisfy CIP-014 physical security requirements

Spot AI's AI Security Guard does not make a utility CIP-014 compliant. Compliance rests on the risk assessment, verification, evaluation, plan and third-party review, all owned by the utility. Spot AI supports the deter, detect, assess and communicate measures a plan describes, and its time-stamped clips support law enforcement coordination.

About the author

Rish Gupta, CEO and Co-founder

Rish Gupta is CEO and Co-founder of Spot AI, leading the charge in business strategy and the future of video intelligence. With extensive experience in AI-powered security and digital transformation, Rish helps organizations unlock the full potential of their video data.