{ "id": "S04", "slug": "hybrid-coercion", "title": "Hybrid coercion ends in an infrastructure blackout", "version": "0.5.0", "status": "active", "orientation": "downside", "family": "B", "short_title": "Hybrid coercion", "thematics": [ "resilience-crisis-preparedness", "ai-cyber-digital", "information-integrity-social-cohesion" ], "likelihood_type": "idiosyncratic", "likelihood_note": "clustered", "scores": { "likelihood_2y": { "band": 3, "rationale": "The campaign is already observed across the exposed cluster: Baltic cable damage in 2024, drone incursions and airport closures in 2025. The rating is for the full event, which requires a blackout across half of national output. Outside Ukraine no state has yet used concealed access to that effect, although advisories in 2024 confirmed that access was in place. For a nation in the cluster the probability sits in the 1 to 5 per cent band; elsewhere it is lower." }, "likelihood_10y": { "band": 4, "rationale": "Over ten years the conditions accumulate. Access placed in control systems persists for years, grids and telecommunications depend more on remote operation and each unanswered incident lowers the expected cost of the next. Ukraine's grid was attacked by cyber means in 2015 and 2016 and by missile from 2022. For an exposed nation a single activation within a decade falls in the 5 to 25 per cent band." }, "impact_systemic": { "level": 2, "rationale": "The event strikes one nation at a time and the direct output loss is national. Systemic cost arrives through higher insurance and security spending across the exposed cluster, interrupted cross-border cables and interconnectors and weaker deterrence. This is Moderate: band shifts in one domain in a few nations. The level would rise if the target hosted a global financial, cloud or semiconductor hub." }, "impact_national": { "level": 4, "rationale": "Essential services set the level. Areas producing half of national output lose power and communications for 72 hours and services are rationed for 30 days, with payments, water and hospital care degraded. Security and social cohesion are also damaged, because the state is shown unable to protect ordinary life and attribution divides opinion. Physical destruction is limited and services return within months, which holds the rating at Severe and below Catastrophic." }, "confidence": { "level": "medium", "reason": "All three panel members agreed the impact levels and two agreed the likelihood bands. The campaign is well evidenced; activation of concealed access against a state not at war is not." }, "priority": 12, "tier": "II", "source": "model-panel-v0.5" }, "scorecard": { "onset": "weeks", "duration": "1 year (72-hour blackout, then 30 days of rationing)", "warning": "months (the campaign is visible; the peak comes without notice)", "scope": "national", "origin": "adversarial (great power or neighbour)", "external_support": "partial", "policy_response": "current plans executed", "recovery_horizon": "years (services restored within months)" }, "summary": "A hostile state conducts a deniable campaign below the threshold of war for 12 months: sabotage of subsea cables and energy assets, cyber intrusions, interference with satellite positioning, drone incursions and information operations. At the peak, reached over weeks, it activates concealed access to power and telecommunications systems. Areas producing half of national output lose reliable power and communications for 72 hours and essential services are rationed for 30 days. Attribution remains contested and threats to crews deter repair. The government must coordinate intelligence, operators and public communication, restore services by manual fallback and resist coercion without escalating before it can show evidence. Conventional invasion is outside this scenario.", "narrative": { "dateline": "June 2030", "text": "The campaign began in March 2029 and no single incident in it was an act of war. A data cable to the islands was cut by a dragging anchor, and the vessel's owner proved to be a company registered six weeks earlier. A fire destroyed a transformer depot; the men charged had been recruited through a messaging application. Satellite positioning failed across the eastern region for days at a time, and aircraft approach procedures, ambulance dispatch and farm machinery guidance failed with it. Drones closed the capital's airport twice in one month. Each incident was investigated and attributed some weeks later, and each attribution was disputed by accounts that had not existed a month before.\n\nOver the same months the security service found foreign access in the networks of two electricity distributors and one mobile operator. It was removed where it was found. It was not found everywhere.\n\nIn the second week of February 2030 the adversary used what remained. Protection settings at eleven transmission substations were changed remotely while control room displays continued to show normal values. Supply failed across the capital and the two industrial provinces, which together produced half of national output. Mobile networks ran on batteries for about four hours. Card payments stopped. Core systems at the mobile operator had been wiped, so restoring power did not restore service.\n\nReliable power and communications returned after 72 hours. Engineers restored the grid by driving to substations and switching by hand, because remote control could not be trusted. Two repair vessels sent to a damaged interconnector turned back after unidentified drones followed them and an anonymous warning reached their insurer. For the next 30 days electricity was supplied on a published rota. Hospitals, water treatment and food distribution were served first and industry worked three days a week. Several hospitals found that their fuel contracts had assumed an outage of 24 hours.\n\nThe government did not name the state responsible for nine days. The intelligence assessment was firm but rested on sources that could not be published, and ministers judged that an accusation without public evidence would divide allies. During those nine days a forged cabinet memorandum circulated which appeared to show that neglected maintenance had caused the outage. A message passed through a third government offered restraint in exchange for withdrawal from a defence agreement. The offer was refused. Allies consulted, issued a statement and sent grid engineers and mobile generation, but agreed no collective measure.\n\nBy May 2030 services were normal. The costs that remained were of a different kind. Two foreign manufacturers deferred planned plants and insurers excluded state-backed sabotage from infrastructure cover. A parliamentary inquiry recorded that no minister had held authority over operators, the intelligence service and public communication at the same time. It also found that households which had kept water, a battery radio and cash managed the 72 hours with little difficulty, and that fewer than one in three had done so." }, "anchors": [ { "shock_id": "ukraine-grid-attacks-2015", "date": "December 2015, December 2016, 2022–2024", "event": "Ukraine grid attacks", "what_happened": "On 23 December 2015 attackers used access gained months earlier to open breakers remotely at three Ukrainian distribution companies. About 225,000 customers lost power for up to six hours and operators restored supply by manual switching. A second attack in December 2016 cut part of Kyiv's supply for about an hour. From 2022 missile and drone strikes on generation and transmission imposed scheduled outages nationwide.", "calibrates": "The only documented cases of a state cutting power through access placed in advance. They show that manual restoration works within hours where it is still possible, and that an outage of 72 hours is well beyond what cyber means alone have yet achieved." }, { "shock_id": "volt-typhoon-advisory-2024", "date": "7 February 2024", "event": "Volt Typhoon advisory", "what_happened": "The US Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Federal Bureau of Investigation and partner agencies reported that a state-sponsored group had compromised the networks of communications, energy, transport and water operators in the United States. They assessed that the purpose was to enable disruption in a crisis and that access had been held in some networks for at least five years.", "calibrates": "Concealed access exists before any crisis and can stay undetected for years. It supports the Medium exposure for North America and the assumption that removal during the campaign is incomplete." }, { "shock_id": "kyivstar-network-attack-2023", "date": "12 December 2023", "event": "Kyivstar network attack", "what_happened": "A destructive attack disabled the core network of Ukraine's largest mobile operator, which served about 24 million subscribers. Mobile and internet services were lost for several days and some air raid warning systems and bank terminals failed with them. Ukraine's security service said the attackers had been inside the network for months.", "calibrates": "The telecommunications half of the peak. Restoring power does not restore a network whose core systems have been wiped, and services that depend on the network fail with it." }, { "shock_id": "baltic-subsea-cable-damage-2024", "date": "17–18 November and 25 December 2024", "event": "Baltic subsea cable damage", "what_happened": "Two telecommunications cables, BCS East-West Interlink and C-Lion1, were damaged in the Baltic within a day of each other. On 25 December the Estlink 2 power cable between Finland and Estonia and several telecommunications cables were damaged, and Finland detained the tanker Eagle S. Estlink 2 was out of service for about six months.", "calibrates": "The campaign phase: damage by commercial vessels with disputed intent, slow legal process and repair of a power interconnector measured in months." }, { "shock_id": "nord-stream-sabotage-2022", "date": "September 2022", "event": "Nord Stream sabotage", "what_happened": "Explosions on 26 September 2022 ruptured three of the four strings of the Nord Stream 1 and Nord Stream 2 gas pipelines in the Baltic. Sweden and Denmark closed their investigations in February 2024 without naming a perpetrator.", "calibrates": "Attribution of sabotage at sea can remain contested for years, which is the condition the scenario sets for the government's response." }, { "shock_id": "iberian-blackout-2025", "date": "28 April 2025", "event": "Iberian blackout", "what_happened": "Spain and Portugal lost power across the peninsula within seconds, affecting tens of millions of people. Mobile networks, card payments and rail services failed during the outage. Most supply was restored within a day. Investigators found a technical cause and no evidence of attack.", "calibrates": "Restart times and the dependence of telecommunications and payments on power in an advanced grid. The scenario's 72 hours is longer because restoration is itself contested." } ], "parameters": { "common": { "severity": { "major": "major", "severe": "severe", "extreme": "extreme" }, "duration": { "major": "90 days", "severe": "1 year (72-hour blackout, then 30 days of rationing)", "extreme": "3 years" }, "onset": { "major": null, "severe": "weeks", "extreme": null }, "warning": { "major": null, "severe": "months (the campaign is visible; the peak comes without notice)", "extreme": null }, "scope": { "major": null, "severe": "national", "extreme": "regional" }, "origin": { "major": null, "severe": "adversarial (great power or neighbour)", "extreme": null }, "external_support": { "major": "full", "severe": "partial", "extreme": "none" }, "concurrency": { "major": null, "severe": "standalone", "extreme": "plus one named scenario (S03)" }, "policy_response": { "major": null, "severe": "current plans executed", "extreme": null }, "recovery_horizon": { "major": "months", "severe": "years (services restored within months)", "extreme": "years" } }, "specific": [ { "name": "Campaign duration", "default": "12 months", "range": "6 to 36", "unit": "months", "note": "From the first attributed incident to the end of rationing." }, { "name": "Vectors active", "default": "5", "range": "3 to 8", "unit": "count", "note": "Cable and energy sabotage, cyber intrusion, positioning interference, drone incursion and information operations at the default." }, { "name": "Share of national output in the blackout area", "default": "50 per cent", "range": "20 to 80", "unit": "per cent of GDP", "note": "Measured by where output is produced, not by population." }, { "name": "Loss of reliable power and communications", "default": "72 hours", "range": "24 hours to 10 days", "unit": "hours", "note": "Ends when supply is stable without manual intervention at each substation." }, { "name": "Rationing of essential services", "default": "30 days", "range": "7 to 90", "unit": "days", "note": "Electricity on a published rota, with hospitals, water and food distribution served first." }, { "name": "Attribution", "default": "contested", "range": "options: established publicly within days / never established", "unit": null, "note": "Contested means the government holds a firm assessment that it cannot support with published evidence." }, { "name": "Kinetic threshold crossed", "default": "no", "range": null, "unit": null, "note": "Yes at Extreme, where the campaign leads to open armed attack." } ] }, "transmission": [ "Sabotage, interference and intrusions degrade cables, energy assets and positioning services piecemeal over 12 months and spread security services across several vectors.", "Slow and contested attribution prevents a proportionate response, and information operations turn each incident into a domestic dispute about the government's competence.", "The adversary activates concealed access in grid and telecommunications control systems; areas producing half of national output lose power and communications for 72 hours.", "Payments, water, fuel distribution and hospital care degrade within hours to days as backup power and battery reserves run out.", "Operators restore supply by manual switching because remote control cannot be trusted; threats to crews and vessels delay physical repair.", "Essential services are rationed for 30 days; industry works reduced hours and logistics slow.", "The adversary attaches demands to restraint; allies consult, but the gap between classified evidence and public proof limits collective action.", "Insurers and investors reprice infrastructure and location risk, and deterrence weakens where the campaign is seen to have gone unanswered." ], "loading": [ { "dimension": "Hard", "domain": "defence-security", "load": "High", "channel": "counter-intelligence, cyber defence, maritime and air surveillance, protection of repair crews and key sites" }, { "dimension": "Hard", "domain": "strategic-infrastructure", "load": "High", "channel": "grid and telecommunications control systems, subsea cables, interconnectors, backup power, manual restoration" }, { "dimension": "Hard", "domain": "critical-technology", "load": "Medium", "channel": "control-system security, alternatives to satellite positioning and timing, trusted equipment supply" }, { "dimension": "Soft", "domain": "government-effectiveness", "load": "High", "channel": "attribution, coordination of intelligence, operators and communication, rationing administration, legal powers below the threshold of war" }, { "dimension": "Soft", "domain": "human-capital", "load": "Low", "channel": "strain on emergency and health services; shortage of skilled restoration engineers" }, { "dimension": "Soft", "domain": "influence-cohesion", "load": "High", "channel": "information integrity, public trust under contested attribution, alliance diplomacy, resistance to coercion" }, { "dimension": "Economic", "domain": "macro-financial", "load": "Low", "channel": "payments interrupted for 72 hours; insurance exclusions and risk premia on infrastructure" }, { "dimension": "Economic", "domain": "industry-trade-supply", "load": "Medium", "channel": "production stoppages, reduced working weeks under rationing, logistics disruption, deferred foreign investment" }, { "dimension": "Economic", "domain": "energy-resources", "load": "Medium", "channel": "sabotage of energy assets and interconnectors; generation and fuel stocks under 30 days of rationing" } ], "stakeholders": { "government": { "exposure": "Protection of subsea and energy assets, speed of attribution, authority over operators in a crisis and legal powers below the threshold of war", "actions": [ "Assign one minister authority over intelligence, operators and public communication for hybrid incidents", "Require operators to exercise manual restoration without remote control every year", "Agree in advance with allies the evidence standard and the responses that follow attribution" ], "watch": [ "Incident counts by vector", "Time from incident to public attribution", "Intrusions found in operators' control systems" ], "relevance": 5 }, "technology": { "exposure": "Grid and telecommunications control systems, subsea cables, data centres and services that depend on satellite positioning and timing", "actions": [ "Separate control networks from corporate networks and test restoration from offline backups", "Hold 72 hours of backup power at core telecommunications sites", "Diversify cable routes and keep an alternative to satellite timing" ], "watch": [ "Advisories on state access to control systems", "Cable faults and repair vessel availability", "Positioning interference reports" ], "relevance": 4 }, "investors": { "exposure": "Utilities, telecommunications operators, insurers and industrial assets in the exposed cluster", "actions": [ "Test portfolios against 72 hours without power and 30 days of rationing", "Review sabotage and war exclusions in infrastructure and business interruption cover", "Assess an operator's restoration plan before financing it" ], "watch": [ "War and sabotage risk listings", "Insurance exclusions for state-backed acts", "Deferred foreign investment in exposed regions" ], "relevance": 2 }, "public": { "exposure": "Loss of power, communications, payments and water for 72 hours, with false information about cause and responsibility", "actions": [ "Keep water, food, medicines, a battery radio and cash for 72 hours", "Know the official broadcast channel that works without mobile networks", "Check claims about the cause against official advisories before sharing them" ], "watch": [ "Official incident advisories", "Published rationing rotas", "Local authority guidance for vulnerable residents" ], "relevance": 3 } }, "regions": [ { "region": "north-america", "exposure": "Medium", "rationale": "Advisories in 2024 confirmed access placed in communications, energy and water operators; distance limits physical sabotage." }, { "region": "europe", "exposure": "High", "rationale": "The most active theatre: Baltic cable damage, drone incursions, airport closures and incendiary parcels, with dense cross-border cables and interconnectors." }, { "region": "china", "exposure": "Low", "rationale": "Low as a target: state control of operators and networks limits a deniable campaign." }, { "region": "indo-pacific", "exposure": "High", "rationale": "Taiwan's subsea cables have been cut repeatedly; Japan, Korea, the Philippines and Australia face maritime coercion and intrusion into operators." }, { "region": "south-asia", "exposure": "Medium", "rationale": "Campaigns below the threshold of war are established between neighbours; grids have little reserve." }, { "region": "gulf-middle-east", "exposure": "Medium", "rationale": "Drone and proxy attacks on energy and desalination assets; cable routes are concentrated in the Red Sea." }, { "region": "africa", "exposure": "Low", "rationale": "Few states face a capable state adversary with motive; fragile grids raise the damage where one does." }, { "region": "latin-america", "exposure": "Low", "rationale": "State-directed coercion of this kind is rare in the region." }, { "region": "russia-eurasia", "exposure": "High", "rationale": "Ukraine, Moldova, Georgia and Armenia are direct targets; grid attack by cyber means was first used here." } ], "indicators": [ { "name": "Subsea cable and pipeline faults with unexplained cause or attributed to anchor drag", "source": "International Cable Protection Committee", "threshold": "Two or more in one sea basin within 90 days", "cadence": "monthly" }, { "name": "Satellite positioning interference affecting civil aviation", "source": "European Union Aviation Safety Agency safety information bulletins; gpsjam.org", "threshold": "Interference over national territory on more than 10 days in a month", "cadence": "daily" }, { "name": "Advisories on state access placed in the control systems of energy and telecommunications operators", "source": "US Cybersecurity and Infrastructure Security Agency joint advisories; ENISA Threat Landscape", "threshold": "An advisory naming the nation's operators or their equipment suppliers", "cadence": "as issued" }, { "name": "Wide-area grid disturbances without an established technical cause", "source": "ENTSO-E Incident Classification Scale reports; NERC State of Reliability", "threshold": "Any wide-area incident with no technical cause established within 30 days", "cadence": "annual, with incident reports as issued" }, { "name": "Foreign information manipulation timed to infrastructure incidents", "source": "European External Action Service reports on foreign information manipulation and interference threats", "threshold": "Coordinated activity within 48 hours of two successive incidents", "cadence": "quarterly" }, { "name": "Sabotage and arson prosecutions linked to foreign services", "source": null, "threshold": "Three or more in 12 months", "cadence": "quarterly" }, { "name": "Alliance consultations on hybrid incidents", "source": "NATO statements on Article 4 consultations", "threshold": "A consultation requested by the nation or a neighbour", "cadence": "as issued" }, { "name": "War and sabotage risk listings for national waters and infrastructure", "source": "Lloyd's Market Association Joint War Committee listed areas", "threshold": "National waters added to the listed areas", "cadence": "as issued" } ], "compounds": { "triggers": [ { "id": "S05", "note": "contested attribution and forged evidence weaken the government's claim to competence" }, { "id": "S03", "note": "if the kinetic threshold is crossed" }, { "id": "S01", "note": "sanctions and equipment exclusions in response harden bloc division" }, { "id": "S07", "note": "A power and telecommunications blackout during extreme heat or cold turns a manageable event into an emergency in the core." } ], "triggered_by": [ { "id": "S03", "note": "campaign against states that support a belligerent" }, { "id": "S01", "note": "bloc rivalry supplies motive and removes economic restraint" }, { "id": "S09", "note": "forged signatures and decrypted credentials open control systems" }, { "id": "S05", "note": "A divided chain of command and contested attribution lower the cost of a hostile hybrid campaign." }, { "id": "S18", "note": "Concentrated identity and payment systems raise the consequence of concealed access" } ], "amplified_by": [ { "id": "S07", "note": "repair crews and reserves already committed" }, { "id": "S10", "note": "operator and emergency staff absent" } ], "triggered_by_other": [], "amplifying_trends": [ "Hybrid & grey-zone coercion", "State cyber intrusion & prepositioning", "Subsea cable & pipeline dependence", "Critical infrastructure protection", "Electromagnetic spectrum contest", "Foreign information manipulation", "Drone & autonomous warfare", "Whole-of-society resilience" ] }, "open_questions": [ "Whether the likelihood should be published for the exposed cluster and not per nation, since the base rate across the 197 nations understates exposure in Europe, the Indo-Pacific and among Russia's neighbours.", "Whether a 72-hour blackout across half of national output is the right Standard Severe peak, given that no state outside a war has yet experienced activation at that scale.", "Whether an onset of weeks describes the event or only its peak. The record rates the peak; the campaign that precedes it lasts months.", "How to rate a nation that is the author of a campaign and not its target." ], "commentary": null, "overview": { "source": "model-panel-v0.5", "lenses": { "political": "The adversary offers restraint in exchange for a policy concession. Allies consult and send engineers but agree **no collective measure**.", "economic": "Areas producing **half of national output** stop for 72 hours and work reduced hours for 30 days. Insurers exclude state-backed sabotage and investors defer plants.", "social": "A forged document blames neglected maintenance. **Contested attribution** divides opinion on whether the government is failing or exaggerating.", "technological": "**Concealed access** to grid and telecommunications control systems is activated. Engineers restore supply by hand because remote control cannot be trusted.", "legal": "No single incident is an act of war. **Legal powers below that threshold**, over operators, vessels and evidence, decide how quickly the state can act.", "environmental": "Damage falls on **subsea cables and energy assets**. Lasting environmental harm is limited unless pipelines or fuel storage are ruptured." }, "regions": { "north-america": "Rated Medium. Advisories in 2024 confirmed **access placed in advance** in communications, energy and water operators.", "europe": "**The most active theatre**: Baltic cable damage, drone incursions, airport closures and incendiary parcels since 2022.", "china": "Rated **Low as a target**. State control of operators and networks limits the reach of a deniable campaign.", "indo-pacific": "**Taiwan's subsea cables**, Japan, Korea, the Philippines and Australia face coercion at sea and intrusion into operators.", "south-asia": "Rated Medium. Campaigns below the threshold of war are established **between neighbours**, and grids have little reserve.", "gulf-middle-east": "Rated Medium. **Drone and proxy attacks** on energy and desalination assets are the regional form.", "africa": "Rated **Low**. Few states face a capable state adversary with motive, although grids are fragile.", "latin-america": "Rated **Low**. State-directed coercion of this kind is rare in the region.", "russia-eurasia": "**Ukraine, Moldova and Georgia** are direct targets. Grid attack by cyber means was first used at scale in this region." }, "evolution": { "lead_indicators": "Unexplained subsea cable faults recur in one sea basin and **satellite positioning interference** exceeds ten days a month. An advisory names state access in the nation's energy or telecommunications operators.", "triggers": "Late in a 12-month deniable campaign of sabotage, intrusion and interference, the hostile state **activates concealed access** to grid and telecommunications control systems.", "immediate": "Areas producing half of national output lose **power and communications for 72 hours**. Mobile networks last about four hours on batteries, card payments stop and engineers switch substations by hand.", "post_immediate": "Electricity is **rationed for 30 days** and industry works three days a week. Attribution is contested, repair crews are threatened and the adversary offers restraint for a concession.", "stabilisation": "Services are **restored within months**. Allies consult and send grid engineers and mobile generation, but agree no collective measure.", "long_term": "Insurers **exclude state-backed sabotage** from infrastructure cover and foreign manufacturers defer planned plants. Deterrence weakens where the campaign is seen to have gone unanswered." } }, "history": [ { "edition": 2027, "rank": 6, "L2y": 3, "L10y": 4, "impact_systemic": 2, "impact_national": 4, "confidence": "medium" } ], "changelog": [ { "version": "0.5.0", "date": "2026-10-09", "change": "Rebuilt in the second pass from Hybrid campaign by a hostile state: the infrastructure blackout of the first-pass S12 is folded in as the campaign's peak, onset moves from months to weeks, national impact rises from 3 to 4 and likelihood falls one band at both horizons." } ], "citation": "GINC (2027). Scenario S04 Hybrid coercion ends in an infrastructure blackout, Scenario Library v0.5. scenarios.ginc.org/scenarios/hybrid-coercion" }