Hybrid coercion ends in an infrastructure blackout

Likelihood, two years

3Possible

to end-2028

Likelihood, ten years

4Likely

to end-2036

Systemic impact

2Moderate

global

National impact

4Severe

typical highly exposed nation

Onset pace

Weeks

Duration (acute phase)

1 year (72-hour blackout, then 30 days of rationing)

Warning time

Months (the campaign is visible; the peak comes without notice)

Scope

National

Recovery horizon

Years (services restored within months)

Capability load

Hard 2/3Soft 2/3Economic 0/3

domains loaded High

Concurrency

Standalone

triggers 4 · triggered by 5

Confidence · movement

medium

new

Rated at Standard Severe. Event reach: single-nation event (clustered). Source of scores: model-panel-v0.5.

A hostile state conducts a deniable campaign below the threshold of war for 12 months: sabotage of subsea cables and energy assets, cyber intrusions, interference with satellite positioning, drone incursions and information operations. At the peak, reached over weeks, it activates concealed access to power and telecommunications systems. Areas producing half of national output lose reliable power and communications for 72 hours and essential services are rationed for 30 days. Attribution remains contested and threats to crews deter repair. The government must coordinate intelligence, operators and public communication, restore services by manual fallback and resist coercion without escalating before it can show evidence. Conventional invasion is outside this scenario.

1. 1

   Sabotage, interference and intrusions degrade cables, energy assets and positioning services piecemeal over 12 months and spread security services across several vectors.

2. 2

   Slow and contested attribution prevents a proportionate response, and information operations turn each incident into a domestic dispute about the government's competence.

3. 3

   The adversary activates concealed access in grid and telecommunications control systems; areas producing half of national output lose power and communications for 72 hours.

4. 4

   Payments, water, fuel distribution and hospital care degrade within hours to days as backup power and battery reserves run out.

5. 5

   Operators restore supply by manual switching because remote control cannot be trusted; threats to crews and vessels delay physical repair.

6. 6

   Essential services are rationed for 30 days; industry works reduced hours and logistics slow.

7. 7

   The adversary attaches demands to restraint; allies consult, but the gap between classified evidence and public proof limits collective action.

8. 8

   Insurers and investors reprice infrastructure and location risk, and deterrence weakens where the campaign is seen to have gone unanswered.

Government

Relevance 5/5

Exposure

Protection of subsea and energy assets, speed of attribution, authority over operators in a crisis and legal powers below the threshold of war

Actions

• Assign one minister authority over intelligence, operators and public communication for hybrid incidents
• Require operators to exercise manual restoration without remote control every year
• Agree in advance with allies the evidence standard and the responses that follow attribution

Watch

• Incident counts by vector
• Time from incident to public attribution
• Intrusions found in operators' control systems

Technology

Relevance 4/5

Exposure

Grid and telecommunications control systems, subsea cables, data centres and services that depend on satellite positioning and timing

Actions

• Separate control networks from corporate networks and test restoration from offline backups
• Hold 72 hours of backup power at core telecommunications sites
• Diversify cable routes and keep an alternative to satellite timing

Watch

• Advisories on state access to control systems
• Cable faults and repair vessel availability
• Positioning interference reports

Investors

Relevance 2/5

Exposure

Utilities, telecommunications operators, insurers and industrial assets in the exposed cluster

Actions

• Test portfolios against 72 hours without power and 30 days of rationing
• Review sabotage and war exclusions in infrastructure and business interruption cover
• Assess an operator's restoration plan before financing it

Watch

• War and sabotage risk listings
• Insurance exclusions for state-backed acts
• Deferred foreign investment in exposed regions

Public

Relevance 3/5

Exposure

Loss of power, communications, payments and water for 72 hours, with false information about cause and responsibility

Actions

• Keep water, food, medicines, a battery radio and cash for 72 hours
• Know the official broadcast channel that works without mobile networks
• Check claims about the cause against official advisories before sharing them

Watch

• Official incident advisories
• Published rationing rotas
• Local authority guidance for vulnerable residents

Triggers

• S05 Legitimacy rupture · Contested attribution and forged evidence weaken the government's claim to competence
• S03 Regional war spillover · If the kinetic threshold is crossed
• S01 Trade bloc rupture · Sanctions and equipment exclusions in response harden bloc division
• S07 Core disaster · A power and telecommunications blackout during extreme heat or cold turns a manageable event into an emergency in the core.

Triggered by

• S03 Regional war spillover · Campaign against states that support a belligerent
• S01 Trade bloc rupture · Bloc rivalry supplies motive and removes economic restraint
• S09 Cryptographic trust break · Forged signatures and decrypted credentials open control systems
• S05 Legitimacy rupture · A divided chain of command and contested attribution lower the cost of a hostile hybrid campaign.
• S18 Public service leap · Concentrated identity and payment systems raise the consequence of concealed access

Amplified by

• S07 Core disaster · Repair crews and reserves already committed
• S10 Severe pandemic · Operator and emergency staff absent

Amplifying trends

Hybrid & grey-zone coercionState cyber intrusion & prepositioningSubsea cable & pipeline dependenceCritical infrastructure protectionElectromagnetic spectrum contestForeign information manipulationDrone & autonomous warfareWhole-of-society resilience

Key trends

Subsea cable & pipeline dependenceCriticalState cyber intrusion & prepositioningCriticalHybrid & grey-zone coercionCriticalTelecom network resilienceVery highCritical infrastructure protectionVery highFirm & black-start capacityVery highSatellite positioning & timing dependenceVery high

From GINC Trends: the trends rated Very high or Critical for this scenario, of 250. All S04 trend scores.

Source of scores: model-panel-v0.5. Confidence refers to the rating, not the scenario. Calibration sources are listed with the anchors above and on the scenario methodology page.

• Whether the likelihood should be published for the exposed cluster and not per nation, since the base rate across the 197 nations understates exposure in Europe, the Indo-Pacific and among Russia's neighbours.
• Whether a 72-hour blackout across half of national output is the right Standard Severe peak, given that no state outside a war has yet experienced activation at that scale.
• Whether an onset of weeks describes the event or only its peak. The record rates the peak; the campaign that precedes it lasts months.
• How to rate a nation that is the author of a campaign and not its target.

No signed commentary in this build.

Version

0.5.0 · active · hybrid-coercion

Change log

• 0.5.0 · 9 October 2026 · Rebuilt in the second pass from Hybrid campaign by a hostile state: the infrastructure blackout of the first-pass S12 is folded in as the campaign's peak, onset moves from months to weeks, national impact rises from 3 to 4 and likelihood falls one band at both horizons.

Full change log