The Growing Likelihood of Major Disruptions to U.S. Power & Communications
New Title
Executive Summary
Open-source government testimony and credible reporting now establish:
- clear adversary intent to disrupt U.S. critical infrastructure in a crisis,
- documented pre-positioning of access in U.S. networks, and
- well-understood physical choke points—notably large power transformers and subsea/space communications—that could extend outages beyond normal restoration timelines.
While a continental, months-long blackout remains unlikely under routine conditions, the risk of deliberate, regional, multi-sector disruptions—especially amid a U.S.–PRC confrontation—has risen from theoretical to credible and time-bounded likely.
1) Intent & Strategic Context
FBI testimony: On January 31, 2024, FBI Director Christopher Wray told Congress that PRC hackers are targeting U.S. critical infrastructure (electric power, water, oil & gas, transportation) and are “positioning” themselves to cause real-world harm at a time of their choosing.
Public advisories: U.S. and allied agencies have publicly attributed long-running, state-sponsored activity (“Volt Typhoon”) to China, noting stealthy “living-off-the-land” techniques and compromises in U.S. critical-infrastructure environments.
These advisories explicitly frame the activity as pre-positioning for potential disruptive effects.
Press confirmations: Senior officials have reiterated that the accesses could be triggered to deter or punish U.S. action—e.g., in a Taiwan contingency—placing disruption of domestic infrastructure within the expected playbook.
Bottom line: Motivation and intent are now on the record. The question has shifted from “could adversaries try?” to “when and how extensively might they try?”
2) Capabilities & Pathways to Real-World Impact
2.1 Cyber → Physical Effects on the Grid
Demonstrated feasibility (INL “Aurora”): U.S. labs proved a remote control-sequence could physically damage rotating equipment by out-of-phase switching—a cyberattack producing destructive, mechanical failure.
Operational precedent (Ukraine): Purpose-built ICS malware (e.g., CRASHOVERRIDE/Industroyer) has de-energized substations and automated disruptive switching. Analysts assess such tools could create hours to days of outages and be re-used at multiple sites.
Implication: With prior access and system knowledge, time-bounded but acute grid disruptions are technically feasible.
2.2 Physical Attacks on Substations
The 2022 Moore County, NC incident and similar shootings exposed the ease of disabling equipment and prompted a FERC review of physical-security standards.
Implication: Low-tech physical attacks can amplify cyber campaigns or strain restoration resources regionally.
2.3 Chokepoint Components: Large Power Transformers (LPTs)
Federal/industry reporting describes severe LPT supply constraints: 80–210-week lead times are now typical, making simultaneous losses at key nodes long-tail risks even after partial service returns.
Implication: Destroying or disabling even a small number of strategically located LPTs could extend restoration from days into months for full capacity.
2.4 Communications Targets (Space & Subsea)
Space segment: The Viasat KA-SAT attack (2022) disrupted tens of thousands of satellite modems across Europe in the opening hours of a major war—an empirical example of civilian comms degradation via cyber means.
Subsea cables: Think tanks and commercial threat intelligence report a rising risk of state-backed interference with undersea internet cables. Taiwan has recorded multiple cable disruptions, and recent analyses warn of escalating threat activity tied to Russia and China.
Implication: Targeted communications outages—via satellite networks or subsea cables—can magnify grid incidents by degrading operator coordination, situational awareness, and public communications.
3) The Baseline System Risk (Before Adversary Action)
NERC assessments repeatedly flag elevated seasonal reliability risks in multiple regions as load growth, changing resource mixes, and extreme weather stress the system; Senate testimony in 2025 probed how demand growth and generation/transmission constraints affect adequacy. These are not predictions of collapse, but narrower operating margins create more opportunities for adversaries to tip systems into controlled outages or load-shedding.
4) Likelihood Assessment
Peacetime (next 6–12 months):
Deliberate, regional disruptions (power and/or communications) via cyber or blended cyber-physical means: plausible, especially during seasonal peaks or severe weather.
Nationwide, prolonged (weeks–months) blackout: unlikely, but not inconceivable if multiple high-value assets were destroyed, given LPT lead times.
Crisis (e.g., Taiwan war):
Government testimony and advisories imply activation of pre-positioned accesses to deter U.S. action, making multi-state, time-bounded disruptions more likely, along with comms degradation (satellite/subsea).
Key inference: The probability distribution has shifted from “rare theoretical” to “credible, targeted, and repeatable” regional events—while true national-scale collapse remains a low-probability, high-impact tail risk.
5) Consequence Framing
Even short-duration regional outages can create outsized, cross-sector effects:
- Fuel logistics (pipelines, terminals), water treatment, 911/healthcare comms, rail/port operations, and public information flows degrade quickly.
- Where LPTs or major interties are lost, capacity constraints can persist for months, prolonging rationing or rotating outages even after an initial restoration.
6) Recommendations
6.1 Federal & Sector Policy
Accelerate detection/eviction of pre-positioned accesses in ICS/OT (expand joint hunt forward, mandatory incident reporting with safe harbor).
Harden substation physics and relays against Aurora-style switching abuse; verify protective-relay settings and out-of-phase protections; exercise black-start under degraded comms.
Mitigate LPT bottleneck: stand up an LPT strategic reserve and domestic surge capacity; prioritize spares for high-value nodes; streamline transport waivers.
Protect comms dependencies: require diverse paths (terrestrial + satellite + microwave), fund rapid cable repair capacity, and expand monitoring of subsea infrastructure with allies.
Exercise multi-sector incident playbooks (power, telecom, water, fuel) for blended attacks and public-warning strategies that assume intermittent connectivity.
6.2 State/Local/Utility Operators
Seasonal surge readiness: align with NERC seasonal risks; rehearse load-shedding + comms-loss scenarios; pre-stage mobile generation for water/health.
Substation hardening: ballistic protection at selected sites, rapid-response contracts, and mutual-aid compacts that include comms assets.
Spare-part realism: validate on-hand spares for breakers/relays; map LPT dependencies and identify temporary bypass options.
6.3 Private-Sector & Community Preparedness
Continuity for 2–6 weeks of rolling disruption: water, heat, lighting, comms redundancy (AM/FM/NOAA, ham, satellite messengers), generator safety, and fuel rotation.
Information hygiene: pre-agreed channels with employees/customers; offline contact trees for when SMS/VoIP are unstable.
Cyber hygiene in OT-adjacent firms: segment networks; monitor for “living-off-the-land” tradecraft; practice manual fallback procedures.
7) Conclusion
The public record—FBI testimony, interagency advisories on Volt Typhoon, technical demonstrations of cyber-physical impacts, LPT supply constraints, and real-world attacks on power and communications—supports a sober reassessment: adversary motivation and capability now make targeted, regional disruptions a credible near-term risk, especially in a geopolitical crisis. The prudent response is focused resilience: accelerate detection and hardening, fix known bottlenecks, diversify communications, and exercise restoration under contested conditions. Doing so narrows the attacker’s payoff and shortens the tail of any disruption.
References (selected, open-source)
FBI Director Wray opening statement to the House Select Committee on the CCP (Jan 31, 2024).
CISA & partners advisories on PRC state-sponsored activity (Volt Typhoon) and living-off-the-land tradecraft (2023–2024).
INL “Aurora” cyber-physical destruction demonstration (background).
CRASHOVERRIDE/Industroyer alerts and analysis (CISA; Dragos).
NERC reliability assessments (seasonal/State of Reliability).
NIAC (draft) report on LPT shortages and lead times (80–210 weeks).
Moore County substation attack coverage & FERC physical-security review prompt.
Viasat KA-SAT cyberattack reporting and analysis (CSIS; CCDCOE).
Subsea cable risk (Recorded Future; Reuters/Baltic & Taiwan incidents; CSIS policy analysis).
Preparedness is only the beginning. The Ridge Plan explores what happens when stored supplies are no longer enough—and ordinary neighbors must turn preparation into decisions, trust, and survival.
