Substation intrusion detection is the practice of spotting unauthorized people, vehicles, or tampering inside or at the edge of an electrical site early enough for a person to verify and dispatch. Most utilities already have cameras at substations, solar plants, and storage yards. Running AI on that existing CCTV can flag perimeter breaches, restricted-zone entry, and equipment tampering, so operators review short incident clips instead of chasing raw alarms.
Key takeaways
- Copper theft is a reliability and safety problem. One theft of grounding wire can cut supply to thousands and leave live equipment unsafe.
- The E-ISAC logged more than 2,800 physical security incidents in 2023, and FERC approved a revised CIP-014 standard in September 2026.
- Fence and motion sensors at unmanned sites generate nuisance alarms. Video context lets operators verify before rolling a crew.
- AI on existing cameras can flag unauthorized access, perimeter breaches, equipment tampering, and theft or vandalism attempts.
- Video analytics is one layer in deter, detect, delay, respond. People still decide on dispatch.
How big is the copper and cable theft problem at substations?
Copper theft is the removal of copper conductors, such as cables, busbars, and grounding wire, from energized or recently energized infrastructure, usually for resale as scrap. It hits utilities, rail, telecoms, and renewable operators on every continent.
South Africa. Eskom has said theft and vandalism of its infrastructure cost the country more than R47 billion a year, according to EWN reporting from August 2024. Eskom's own direct losses are smaller: it reported about R221 million in vandalism and theft losses between April 2024 and February 2025, down from R271 million a year earlier, and named mini-substations, pylons, transformers, and siphoned transformer oil among targets (Eskom, April 2025). In Johannesburg, City Power recorded 19 incidents of cable theft, vandalism, and substation fires over a single weekend in July 2026, with preliminary losses above R311,000 (EWN, July 2026).
United States. In July 2026, thieves took copper ground wires from a substation in Danville, Virginia. Nearly 1,700 customers lost power for close to 24 hours during 103°F heat, and about 20 staff were dispatched to replace the grounding (WSET, July 2026).
Australia. Ausgrid recorded 74 copper theft incidents on its Sydney-area network between August 2023 and March 2024, causing almost half a million dollars in damage and supply interruptions for thousands of customers. Thieves were increasingly cutting earth wires from poles rather than breaking into depots (Ausgrid, March 2024).
UK and Europe, renewables. Crime intelligence from DeterTech found more than 750 km of cable stolen from UK solar farms in the first eight months of 2024 across more than 70 incidents, and estimated around 5,000 major solar thefts a year across Europe, about 400 of them in Germany (Electrical Review, December 2024).
The pattern repeats at EV charge points, as our post on EV charging cable theft and vandalism shows. The scrap value is small; the outage, repair crew, and safety exposure are where the cost sits.
Why is cable theft at substations so dangerous?
Grounding (earthing) conductors are the copper connections that carry fault current safely to earth and keep metal structures at a safe potential. They are often the easiest copper to reach inside a fence.
When grounding is cut, the risk does not leave with the thief. Fences and equipment frames can become dangerous to touch during a fault, putting the next crew or a passer-by at risk. Eskom warns that tampering with its infrastructure poses potentially fatal risks, and that transformers drained of oil can overheat and explode (Eskom, April 2025). Ausgrid makes the same point about cut earth wires putting lives at risk (Ausgrid, March 2024).
Knowing quickly that grounding was tampered with, and where, matters as much as catching the thief. A crew that knows which bay was entered can isolate and inspect before anyone touches the structure.
What do physical attacks on substations look like?
On December 3, 2022, gunfire damaged two Duke Energy substations in Moore County, North Carolina, about 10 miles apart, leaving roughly 45,000 customers without power. The FBI offered up to $25,000 for information (FBI). NERC reported receiving close to 1,700 physical security incidents in 2022, a 10.5% rise over the previous year (SecurityInfoWatch, May 2023).
The Electricity Information Sharing and Analysis Center (E-ISAC) received more than 2,800 physical security incidents in 2023, including ballistic damage, theft, and vandalism. About 3% had some level of impact on the grid (E-ISAC 2023 End-of-Year Report).
What does NERC CIP-014 require?
NERC CIP-014 is the North American reliability standard for the physical security of critical transmission stations, transmission substations, and their primary control centers. Covered owners must run periodic risk assessments with third-party verification, evaluate threats and vulnerabilities, and maintain a physical security plan.
On September 10, 2026, FERC approved CIP-014-4, which retires CIP-014-3 and tightens assessment timelines and applicability (FERC, September 2026). According to a Davis Wright Tremaine analysis, the revision extends coverage to jointly owned facilities, sets a 36-month assessment cycle, requires identifying bulk power system facilities within 1,500 feet, and takes effect October 1, 2028. It still does not set a uniform minimum level of physical protection.
Outside North America, CIP-014 is still a useful model: rank sites by consequence, assess the threat, and document how you will detect and respond.
Why do fences and motion alarms produce so many false alarms at remote sites?
A perimeter intrusion detection system (PIDS) is any sensor that signals when the boundary of a site is crossed or disturbed, such as fence-mounted vibration sensors, buried cable, microwave links, or passive infrared detectors.
These sensors detect disturbance, not intent. At an unmanned substation or a solar plant spread over hundreds of hectares, disturbance comes from wind on fence fabric, animals and livestock, vegetation, storms, and contractors arriving without a matching work order.
Each unverified alarm forces a choice: ignore it, or send someone a long way to check. Over time, control rooms stop trusting the alarm. That is alarm fatigue, and it is how a real intrusion gets dismissed as "the fence again."
Video gives an alarm context. An operator who sees a short clip of someone cutting the fence by the transformer bay decides differently than one who sees "Zone 4 fence alarm." See our guide to reactive versus proactive video monitoring.
How do you detect cable theft and intrusion with existing CCTV?
Most substations and renewable sites already have cameras on fence lines, gates, and high-value bays. Nobody can watch them all overnight across dozens of sites.
Kote by Kotelab connects to existing IP cameras and RTSP-capable NVR/DVR streams and monitors connected feeds continuously. When a configured event happens, it surfaces the event with site, zone, camera, time, and a clip for human review. For energy sites, the detections named on the Kotelab energy page are:
- Unauthorized access to restricted areas, such as a person inside the switchyard or near a transformer bay outside a permitted window
- Perimeter breaches, such as someone crossing, climbing, or cutting through the fence line
- Equipment tampering, such as activity at cabinets, cable trenches, or grounding points
- Theft and vandalism attempts, such as removal of cable, damage to equipment, or vehicles staged near the fence
Related configurable events include after-hours activity and loitering near gates, which are often the earliest signs of reconnaissance before a theft.
What does natural-language search add after an incident?
After a theft, the first question is usually "when did this start?" With natural-language video search, an investigator can type "Show unusual activity near Substation 3 overnight" and review the matching clips instead of scrubbing hours of footage. That helps build a timeline, spot earlier reconnaissance visits, and preserve incident clips for police and insurers.
Which energy site types does this apply to?
The energy page covers plants, substations, solar, wind, pipelines, and storage. Priorities shift by site:
- Transmission or distribution substation. Typical theft or intrusion target: Grounding wire, busbars, cable, transformer oil; Zones worth defining first: Fence line, gates, transformer bays, control building door.
- Solar plant. Typical theft or intrusion target: DC and AC string cable, inverter components; Zones worth defining first: Perimeter, cable trench routes, inverter stations, laydown yard.
- Wind farm. Typical theft or intrusion target: Cable drums, tools, substation copper; Zones worth defining first: Collector substation, turbine base doors, storage compounds.
- Battery energy storage (BESS). Typical theft or intrusion target: Cabinets, cabling, site equipment; Zones worth defining first: Container rows, fence line, access road.
- Pipeline facilities. Typical theft or intrusion target: Valves, cathodic protection cable; Zones worth defining first: Above-ground installations, block valve compounds.
How should the response and dispatch workflow work?
Detection without a response plan just moves alarm fatigue elsewhere. A practical workflow:
- Define the operational need. Agree which zones matter, which events count, and who owns each alert, such as "person inside switchyard 18:00–06:00, routed to the GSOC."
- Review the camera estate. Confirm the cameras on those zones have a usable view, night performance, and a stable stream.
- Route alerts. Send each event, with its clip, to the control room or regional security lead.
- Verify. The operator watches the clip and checks work orders and access logs. See our access control and video correlation explainer.
- Dispatch. If confirmed, send security or police, and warn field operations to treat the site as potentially unsafe.
- Investigate and close. Build the timeline with video search, export the incident clip, and record what was taken.
- Tune. Review false positives with operators and adjust zones, schedules, and owners.
Kotelab's onboarding mirrors the first steps: define the need, review the camera estate, then configure and evaluate with operators.
What about bandwidth and power at remote sites?
Remote substations and renewable sites rarely have the connectivity of a city office. Many rely on cellular, microwave, or satellite links, and some sit on circuits that are themselves the target of theft. Mines face the same constraints, as covered in our post on AI video monitoring for mining sites.
Treat these as design questions for every vendor:
- How much upstream bandwidth does one camera need, and how does that scale per site?
- What happens to detection and recording when the link drops?
- Can alerts and clips travel over a thin link while full-resolution video stays local?
- What power does any on-site hardware need, and does it run on backup supply?
Security of the stream matters too. Kotelab encrypts data with AES-256, holds ISO 27001, and has SOC 2 Type 2 in progress, as detailed on the Kotelab security page.
How does video analytics fit with existing alarm and SCADA monitoring?
SCADA tells you a breaker tripped or a ground fault appeared. It does not tell you who was at the site ten minutes earlier.
At a process level, video fills that gap. When a fence alarm or SCADA anomaly comes in, operators should be able to pull the matching camera view and recent events for that site quickly. When video flags a person in a restricted zone, they should be able to check whether the access system shows a valid entry. Ask vendors exactly how alerts would reach your control room and what work is needed to line them up with alarm and SCADA events.
What does a layered substation security program look like?
The table maps common controls to the four functions of physical security.
- Deter. Purpose: Make the site look like a poor target; Typical controls: Signage, lighting, visible cameras, marked copper; Where AI on existing CCTV helps: Actively monitored cameras; evidence for prosecutions.
- Detect. Purpose: Know an intrusion is happening; Typical controls: Fence sensors, door contacts, CCTV, SCADA alarms; Where AI on existing CCTV helps: Flags perimeter breaches, restricted-zone entry, after-hours activity, and tampering with a clip.
- Delay. Purpose: Slow the intruder down; Typical controls: Anti-climb fencing, locked cabinets, caged grounding, ballistic barriers; Where AI on existing CCTV helps: Shows where delay measures are being tested, such as repeated loitering at one fence section.
- Respond. Purpose: Get the right people there safely; Typical controls: GSOC, guard patrols, police liaison, field crew safety procedures; Where AI on existing CCTV helps: Faster verification, scene context for responders, post-incident search.
Hardened fencing buys time; video detection makes sure someone uses it.
Evaluation checklist for substation intrusion detection
Use this when assessing any AI video product for energy sites. Our real-time threat detection guide has a general deployment checklist too.
- Works with the cameras and NVR/DVRs already installed (ask for RTSP and brand compatibility)
- Detects the events you need: perimeter breach, restricted-zone entry, equipment tampering, theft and vandalism attempts, after-hours activity
- Lets you set zones and schedules per site, and sends alerts with site, zone, camera, time, and clip
- Routes alerts to named owners across sites and supports natural-language search
- Handles low-bandwidth and intermittent links (ask for specifics)
- Can be reviewed alongside your access control, alarm, and SCADA events
- Meets your security requirements: encryption, certifications, retention settings, data ownership
- Includes a pilot plan where your operators measure false positives on your own sites
Frequently asked questions
What is substation intrusion detection?
Substation intrusion detection is the set of sensors, cameras, and processes that tell a utility when someone enters or tampers with a substation without authorization. AI video analytics adds the ability to flag specific events on CCTV and show an operator what happened.
How do you prevent copper theft at a substation?
No single control prevents copper theft. Utilities combine deterrence (lighting, signage, marked copper), physical delay (anti-climb fencing, caged grounding), fast detection, and a clear response plan with police. Spotting reconnaissance, such as loitering or repeated after-hours visits, gives the best chance of acting before copper is cut.
Can AI work with the CCTV cameras we already have at substations?
Often, yes. Kote connects to existing IP cameras and RTSP-capable NVR/DVR streams, and Kotelab lists compatibility with brands including Hikvision, Dahua, Uniview, Axis, Bosch, Hanwha Vision, Sony, and Avigilon. Placement and night performance still matter, so onboarding includes a camera estate review.
Does CIP-014 apply to every substation?
No. CIP-014 applies to North American transmission owners and operators for transmission stations and substations whose loss could cause instability or cascading outages, plus their primary control centers. Distribution substations are generally outside it. FERC approved CIP-014-4 in September 2026, with an effective date of October 1, 2028.
Is video analytics useful for solar farms and battery storage sites?
Yes. Solar plants have long perimeters and valuable cable runs, and European data shows thousands of major solar thefts each year. The same detections used at substations, including perimeter breach, restricted-zone entry, and equipment tampering, apply to solar, wind, and BESS sites.
Does AI decide whether to send a response team?
No. AI surfaces events with context, such as the clip, zone, and time. A trained operator verifies the event and decides whether to dispatch security, police, or a field crew. Humans stay accountable for every response.
See substation intrusion detection on your own cameras
From Johannesburg and Sydney to Virginia and UK solar farms, the cameras are usually already there. What's missing is something watching them at 3 a.m. across every site.
Talk to Kotelab about scoping a pilot on your highest-risk substations or renewable sites.