Power outages and food shortages are on the minds of many at the moment. Nations like Switzerland, Germany, and Finland have urged citizens to mentally prepare for disruptions, sabotage, and conflict scenarios. The UK government is accelerating work on its “war book” – a manual for the defence of the nation against external threats – and launching a social media campaign with advice to help people deal with the impacts of extreme events, with practical advice on things you can do to improve domestic resilience, like having some bottled water, tinned food and wind-up radios.
The Chief of the Defence Staff, Sir Richard Knighton, this week said the threat from Russia meant Britain was living through the "most dangerous" period of his 35-year career in the armed forces. Some of the scenarios of what could happen next are being acted out in Sky’s new show The Wargame – a four-part series set nine months in the future where a high-profile, cross-party cabinet of former politicians (Conservative MP Michael Gove is the fictional PM) and experts simulate a war with Russia. The message is loud and clear: The realities of a hybrid war are something people are thinking about every day.
But as we are left to wonder how to prepare physically and psychologically, how much do we know about what would really happen if a serious cyber assault actually took place?
In the world of movies, like Netflix’s 2023 apocalyptic disaster movie Leave the World Behind, the first sign that something is wrong is when people discover their mobile phone coverage is out and their wifi disappears, but it takes a push notification on their TV screens for the characters to learn that an attack has been launched.
In reality, the UK government’s Emergency Alerts mobile phone system, first tested UK-wide three years ago, would be used. This would mean our phones would buzz, and we would receive advice and instructions, if needed, on what to do in the event of a large-scale attack or other extreme event – whether that would be to stay indoors or evacuate to a place of safety.
In the government’s annual preparedness plan, people are also being advised to have non-digital alternatives to radios, alongside candles and power banks to keep devices going in the event of a prolonged power outage; and have enough food and water for up to three to four days.
While these plans are meant to bolster our preparedness, they pale into insignificance when you consider towns and cities in Sweden maintain bunker capacity for up to 7 million citizens, located in cellars under apartment blocks, and in underground metro stations and some commercial centres too. Inside, there are enough provisions for almost a week and an emergency siren system for a life-threatening attack in peacetime – the “Hoarse Fredrik”, as it is known, is tested at 3pm on the dot in Swedish cities on the first Monday of March, June, September, and December.
The UK’s physical air raid siren network was also regularly tested in the Seventies but was disbanded in the 1990s. However, reports suggest around 1,200 remain in use – and would be used if there was an imminent danger to surrounding residents.
In the Netflix film, the other sign that something is seriously amiss is when an oil tanker runs ashore, thanks to malfunctioning navigation systems. Later, we see planes crashing out of the sky, reminiscent of the Y2K millennium bug scare, when people worried that computers would misinterpret the “00” in 2000 as 1900, which some believed would spark disruption in everything from navigation systems to power infrastructure. This never happened, largely because many people behind the scenes got to work, but there were still failures internationally when 15 nuclear reactors shut down, power cuts hit Hawaii, and government computers failed in China and Hong Kong.
Our reliance on computer systems has also been exposed by the recent failures of the UK’s air traffic control system, which brought flights and airports to a standstill. The chaos took several days to unpick as NATS, the company overseeing UK air traffic control, sought to identify the underlying cause. The huge failure on 8 September, which saw more than 2,000 flights cancelled, was blamed on an unknown software bug; this week’s disruption was a separate technical fault at Prestwick. The second incident came just 13 days after the first, prompting airlines to question NATS’s resilience. But at least it showed that sufficient early-warning systems and contingency plans are in place to prevent planes falling out of the sky, as they do in the film.
However, that is not to underestimate how much our systems are linked – much more so than when we worried about the millennium bug. Around 15 years ago, the UK took a path with its national cybersecurity strategy that prioritised the continuity of government computer systems at the expense of everything else.
“It was wrong in 2009 because we completely ignored the fact that a massive proportion of the economy was already virtual, and that that was only going to increase,” says Lynette Nusbacher, who at the time was a senior intelligence officer with Britain’s Joint Intelligence Committee and founded the Cabinet Office’s national security horizon scanning unit.
While Nusbacher left her role in 2010, she says that, from an outsider’s perspective, attitudes haven’t changed much since. “We have not moved far from that,” she says.
A lot of what we think of as critical national infrastructure, like the National Grid, is comparatively well-protected and has been for decades. The UK’s National Protective Security Authority (NPSA) lists 13 sectors that it deems are critical, including energy, chemicals, and civil nuclear, as well as health, communications, food, and water. Those 13 were chosen because “a major detrimental impact on the availability, integrity, or delivery of [these] essential services... could result in significant loss of life or casualties”, according to the NPSA.
“However,” Nusbacher adds, “if one part of national infrastructure is a hard target, an attacker is going to seek out soft targets.” Communication is key, and she says: “The government has special agreements with certain providers to ensure that there are no single points of failure.”
Outages would include the things that affect ordinary people, like your internet connection and potentially your mobile service as people turn to it because they can’t use wifi. However, emergency services would still operate – the government learned after the 7/7 terror attack on London in 2005 that first responders can’t use the same network as the general public. The emergency services will use a new system, called the Emergency Services Network, which is separate from the core public communications network.
Outside of a massive high-altitude electromagnetic pulse, some infrastructure for general users would survive. Emergency generators would kick in, keeping core systems online
Alan Woodward, computer science and cyber security professor at University of Surrey
There has also been a recent focus on landlines and the value of their analogue technology, particularly in the event of a cyberattack or other major outage. “We’re in the process of taking a step backward by closing down the plain old telephone system, which was a separate network, powered separately and with its copper infrastructure,” says Alan Woodward, visiting professor of computer science and cyber security at the University of Surrey. BT and other telephone providers are partway through migrating their services from traditional copper networks to digital alternatives, using Voice over IP (VoIP) technology – the same technology that underpins services such as Skype. The old Public Switched Telephone Network is due to be retired by January 2027, and while providers have contingency measures and resilience requirements in place, digital landlines depend on power and broadband connectivity, meaning they can be vulnerable during outages.
“In the UK, there is also a hidden benefit in that we have several network providers,” says Woodward. “While lots of service providers use the same physical networks, there are several physical mobile networks.”
The same thing is true for banks, which all have back-up plans in the event of major cyber incidents. The goal is to ensure services remain online, so big banks and the energy grid are designed, in principle, so you’ll be able to get capacity from elsewhere.
“Outside of a massive high-altitude electromagnetic pulse, some infrastructure for general users would survive,” says Woodward. “Emergency generators would kick in, keeping core systems online.”
Continuity of public services and access to food will be key in the event of persistent issues. The Resilience Capabilities Programme is the national-level plan that will oversee what happens in the case of a major emergency. At a local level, responsibility will be devolved to local councils who will organise where to evacuate people in the event of a disaster. Each area of the UK has a dedicated Local Resilience Forum, partnerships that are broadly made up of representatives from local public services, including the emergency services, local authorities, the NHS, the Environment Agency and other organisations involved in emergency preparedness, such as utilities providers. They are tasked with identifying potential risks and producing emergency plans to either prevent or lessen the impact of any incident on their local communities.
In an extreme event like a nuclear attack, there are thought to be no more than 50 usable nuclear bunkers across the country and space in these would be reserved for key members of government, the military, and people who would be needed to run the country after an attack.
On a lesser scale, though, it doesn’t take much for normal service to be disrupted. We are seeing this with the Iran war, and also when a tanker was grounded a few years ago in the Suez Canal and with Covid, where just-in-time supply chains are interrupted, shortages quickly follow. In 2021, the army was put on standby to cope with food shortages caused by a lack of qualified truck drivers and the Royal Logistic Corps and other corps would be used to help distribute food and other essential supplies, including medicine if needed.
However, as tech and the internet become more integrated into how we live today, the digital unspooling of our lives is a real possibility. “It’s important to recognise that as we hand over more control of our world, for all the best reasons, to the tech, then those dependencies become sharper,” says Nusbacher. “Even well-prepared, we could find ourselves having tremendous difficulty.”
But will we turn on each other or towards each other? When you consider one statistic that cited 90 per cent of lives saved in disasters are saved by those near them and not the emergency services, let’s hope it’s the latter.
