{
  "id": "S12",
  "slug": "critical-infrastructure-collapse",
  "title": "Critical infrastructure collapse",
  "version": "0.2.0",
  "status": "active",
  "orientation": "downside",
  "family": "D",
  "short_title": "Infrastructure collapse",
  "thematics": [
    "ai-cyber-digital",
    "resilience-crisis-preparedness"
  ],
  "likelihood_type": "idiosyncratic",
  "likelihood_note": null,
  "scores": {
    "likelihood_2y": {
      "band": 3,
      "rationale": "Nationwide outages above 24 hours remain rare in large economies, but several occurred in 2023–2025 across the 197; a 72-hour outage plus rationing is a tail for most."
    },
    "likelihood_10y": {
      "band": 4,
      "rationale": ""
    },
    "impact_systemic": {
      "level": 2,
      "rationale": "Unless a global hub."
    },
    "impact_national": {
      "level": 4,
      "rationale": ""
    },
    "confidence": {
      "level": "low",
      "reason": "Cyber-physical likelihoods are poorly evidenced."
    },
    "priority": 12,
    "tier": "II",
    "source": "ginc-desk-v0.2"
  },
  "scorecard": {
    "onset": "sudden",
    "duration": "90 days (72-hour outage then rationing)",
    "warning": "none",
    "scope": "national",
    "origin": "adversarial, accidental or natural",
    "external_support": "partial",
    "policy_response": "current plans",
    "recovery_horizon": "months"
  },
  "summary": "The national power grid and communications fail for 72 hours and operate under rationing for 90 days. The cause may be cyber attack, physical sabotage, cascading technical failure or space weather; the scenario is origin-agnostic because the capability loaded is the same. v0.2 reframed v0.1's 'systemic cyber attack' around power, following Switzerland (electricity shortage second of 44 hazards), the UK National Risk Register (national electricity transmission failure rated catastrophic) and the Iberian blackout of April 2025.",
  "narrative": {
    "dateline": "July 2027",
    "text": "At 12:33 the frequency drops and the grid operator's protective relays do what they were designed to do: they shed everything. Sixty million people lose power in five seconds. Mobile networks run on batteries for four hours, then go dark. Card payments stop; the cash machines are already empty. Water pressure fails on the third day in the hill suburbs. Hospitals run on diesel and discover the fuel contracts assumed a 24-hour outage. The restart takes 19 hours in the capital and four days in the regions where black-start capacity was retired to save money. Then the second phase: a generation shortfall that cannot be closed before winter, so the government publishes a rationing calendar and industry runs three days a week. Whether the trigger was an intrusion into the operator's control network, a solar storm, a cyber-physical attack on substations, or a protection misconfiguration is debated for months; the capabilities that failed are the same list in every version: reserve generation, black start, telecoms backup power, cash and payments continuity, fuel logistics and the ability to tell people what to do when no screen works."
  },
  "anchors": [
    {
      "shock_id": "iberian-blackout-2025",
      "date": "28 April 2025",
      "event": "Iberian blackout",
      "what_happened": "Spain and Portugal lost power across the peninsula; tens of millions affected; most supply restored within a day",
      "calibrates": "restart times, cash and telecoms dependence"
    },
    {
      "shock_id": "crowdstrike-outage-2024",
      "date": "19 July 2024",
      "event": "CrowdStrike outage",
      "what_happened": "A faulty update disabled about 8.5 million Windows devices; airlines, hospitals and payments disrupted worldwide",
      "calibrates": "accidental systemic failure"
    },
    {
      "shock_id": "ukraine-grid-attacks-2015",
      "date": "December 2015, December 2016, 2022–2024",
      "event": "Ukraine grid attacks",
      "what_happened": "Cyber attacks on distribution, then sustained missile and drone strikes on generation",
      "calibrates": "adversarial variant"
    },
    {
      "shock_id": "notpetya-2017",
      "date": "June 2017",
      "event": "NotPetya",
      "what_happened": "Destructive malware; losses around US$10 billion",
      "calibrates": "destructive cyber"
    },
    {
      "shock_id": "texas-winter-storm-2021",
      "date": "February 2021",
      "event": "Texas winter storm",
      "what_happened": "Around 4.5 million customers without power; more than 200 deaths",
      "calibrates": "cascading infrastructure under weather"
    },
    {
      "shock_id": "lloyds-cyber-scenario-2023",
      "date": "October 2023",
      "event": "Lloyd's cyber scenario",
      "what_happened": "Major cyber attack on payment systems: five-year global loss US$3.5 trillion",
      "calibrates": "systemic impact"
    },
    {
      "shock_id": "allianz-risk-barometer-2026",
      "date": "January 2026",
      "event": "Allianz Risk Barometer 2026",
      "what_happened": "Cyber incidents top business risk for the fifth year (42 per cent of 3,338 respondents)",
      "calibrates": "business exposure"
    }
  ],
  "parameters": {
    "common": {
      "severity": {
        "major": "major",
        "severe": "severe",
        "extreme": "extreme"
      },
      "duration": {
        "major": null,
        "severe": "90 days (72-hour outage then rationing)",
        "extreme": null
      },
      "onset": {
        "major": null,
        "severe": "sudden",
        "extreme": null
      },
      "warning": {
        "major": null,
        "severe": "none",
        "extreme": null
      },
      "scope": {
        "major": null,
        "severe": "national",
        "extreme": null
      },
      "origin": {
        "major": null,
        "severe": "adversarial, accidental or natural",
        "extreme": null
      },
      "external_support": {
        "major": null,
        "severe": "partial",
        "extreme": null
      },
      "concurrency": {
        "major": null,
        "severe": "standalone",
        "extreme": null
      },
      "policy_response": {
        "major": null,
        "severe": "current plans",
        "extreme": null
      },
      "recovery_horizon": {
        "major": null,
        "severe": "months",
        "extreme": null
      }
    },
    "specific": [
      {
        "name": "Sectors affected",
        "default": "power and telecoms",
        "range": "options: plus payments / water / transport",
        "unit": null,
        "note": null
      },
      {
        "name": "National outage duration",
        "default": "72 hours",
        "range": "12 hours to 14 days",
        "unit": "hours",
        "note": null
      },
      {
        "name": "Rationing period",
        "default": "90 days",
        "range": "0–365",
        "unit": "days",
        "note": null
      },
      {
        "name": "Origin",
        "default": "cyber",
        "range": "options: physical / accidental / space weather",
        "unit": null,
        "note": null
      },
      {
        "name": "Destructive versus disruptive",
        "default": "disruptive",
        "range": null,
        "unit": null,
        "note": "destructive at Extreme"
      },
      {
        "name": "Share of population affected",
        "default": "80 per cent",
        "range": "30–100",
        "unit": "per cent",
        "note": null
      }
    ]
  },
  "transmission": [
    "Grid collapse.",
    "Telecoms and payments fail within hours.",
    "Water, fuel and health services degrade within days.",
    "Restart constrained by black-start capacity and damaged equipment.",
    "Rationing regime; industrial output cut.",
    "Public order and trust depend on communication without networks.",
    "Cross-border effects through interconnectors and supply chains."
  ],
  "loading": [
    {
      "dimension": "Hard",
      "domain": "defence-security",
      "load": "Medium",
      "channel": "military support, security of key sites, cyber defence"
    },
    {
      "dimension": "Hard",
      "domain": "strategic-infrastructure",
      "load": "High",
      "channel": "grid, black start, telecoms, water, fuel distribution"
    },
    {
      "dimension": "Hard",
      "domain": "critical-technology",
      "load": "High",
      "channel": "cybersecurity, control systems, GNSS and timing dependence"
    },
    {
      "dimension": "Soft",
      "domain": "government-effectiveness",
      "load": "High",
      "channel": "emergency management, communication, rationing administration"
    },
    {
      "dimension": "Soft",
      "domain": "human-capital",
      "load": "Medium",
      "channel": "health continuity; vulnerable populations"
    },
    {
      "dimension": "Soft",
      "domain": "influence-cohesion",
      "load": "Medium",
      "channel": "public order, trust, information integrity during outage"
    },
    {
      "dimension": "Economic",
      "domain": "macro-financial",
      "load": "High",
      "channel": "payments continuity, cash availability, output loss"
    },
    {
      "dimension": "Economic",
      "domain": "industry-trade-supply",
      "load": "High",
      "channel": "production stoppages, cold chains, logistics"
    },
    {
      "dimension": "Economic",
      "domain": "energy-resources",
      "load": "High",
      "channel": "generation adequacy, fuel stocks"
    }
  ],
  "stakeholders": {
    "government": {
      "exposure": "Black-start capacity, telecoms backup power standards, cash contingency, rationing law",
      "actions": [
        "Mandate 72-hour backup power for telecoms and water",
        "Test black start",
        "Maintain an offline payments fallback",
        "Publish household 72-hour guidance"
      ],
      "watch": [
        "Grid frequency incidents",
        "Reserve margins"
      ],
      "relevance": 4
    },
    "technology": {
      "exposure": "Data centres, cloud regions, control-system security",
      "actions": [
        "Diesel for 72 hours plus",
        "Segmented OT networks",
        "Exercise restart"
      ],
      "watch": [
        "CISA and ENISA advisories",
        "ICS vulnerabilities"
      ],
      "relevance": 5
    },
    "investors": {
      "exposure": "Utilities, insurers, business interruption",
      "actions": [
        "Scenario on 72 hours plus 90-day rationing"
      ],
      "watch": [
        "Reserve margin forecasts",
        "Cyber insurance exclusions"
      ],
      "relevance": 5
    },
    "public": {
      "exposure": "Cash, water, medicines, communication",
      "actions": [
        "72-hour kit",
        "Battery radio",
        "Cash at home"
      ],
      "watch": [
        "Operator and government alerts"
      ],
      "relevance": 3
    }
  },
  "regions": [
    {
      "region": "north-america",
      "exposure": "Medium",
      "rationale": "Ageing grid, extreme weather, cyber"
    },
    {
      "region": "europe",
      "exposure": "Medium",
      "rationale": "Interconnected but exposed to sabotage and renewables integration"
    },
    {
      "region": "china",
      "exposure": "Medium",
      "rationale": "Strong state capacity; cyber-physical targets"
    },
    {
      "region": "indo-pacific",
      "exposure": "Medium",
      "rationale": "Taiwan's grid concentration"
    },
    {
      "region": "south-asia",
      "exposure": "High",
      "rationale": "Pakistan 2023 nationwide blackout; India 2012"
    },
    {
      "region": "gulf-middle-east",
      "exposure": "Medium",
      "rationale": "Desalination dependence"
    },
    {
      "region": "africa",
      "exposure": "High",
      "rationale": "South African load-shedding; fragile grids; no backup depth"
    },
    {
      "region": "latin-america",
      "exposure": "High",
      "rationale": "Venezuela 2019; Ecuador 2024 rationing"
    },
    {
      "region": "russia-eurasia",
      "exposure": "Medium",
      "rationale": "Ukraine under attack"
    }
  ],
  "indicators": [
    {
      "name": "Reserve margin forecasts",
      "source": null,
      "threshold": null,
      "cadence": null
    },
    {
      "name": "Grid frequency and protection incidents",
      "source": "ENTSO-E, NERC",
      "threshold": null,
      "cadence": null
    },
    {
      "name": "ICS and OT vulnerability advisories",
      "source": null,
      "threshold": null,
      "cadence": null
    },
    {
      "name": "Telecoms backup power compliance",
      "source": null,
      "threshold": null,
      "cadence": null
    },
    {
      "name": "Cash in circulation and ATM density",
      "source": null,
      "threshold": null,
      "cadence": null
    },
    {
      "name": "Black-start test results",
      "source": null,
      "threshold": null,
      "cadence": null
    },
    {
      "name": "Kp index forecasts",
      "source": null,
      "threshold": null,
      "cadence": null,
      "note": "space-weather variant"
    },
    {
      "name": "Utility ransomware incidents",
      "source": null,
      "threshold": null,
      "cadence": null
    }
  ],
  "compounds": {
    "triggers": [
      {
        "id": "S07",
        "note": "if prolonged"
      },
      {
        "id": "S04",
        "note": "output loss"
      },
      {
        "id": "S10",
        "note": "as cascade"
      }
    ],
    "triggered_by": [
      {
        "id": "S06",
        "note": null
      },
      {
        "id": "S09",
        "note": null
      },
      {
        "id": "S10",
        "note": null
      },
      {
        "id": "S14",
        "note": "staff"
      }
    ],
    "amplified_by": [],
    "triggered_by_other": [
      "space weather (parked)"
    ],
    "amplifying_trends": [
      "electrification",
      "digitalisation of payments",
      "retirement of dispatchable and black-start capacity",
      "cyber threat growth"
    ]
  },
  "open_questions": [
    "Whether space weather should rejoin the Library as a separate scenario or remain an origin option here.",
    "Whether 72 hours or seven days is Standard Severe.",
    "How to treat nations with chronic rationing (South Africa) where the shock is the baseline."
  ],
  "commentary": null,
  "overview": {
    "source": "ginc-desk-v0.2",
    "lenses": {
      "political": "The cause is **debated for months**. Public order depends on telling people what to do when no screen works.",
      "economic": "Card payments stop and **the cash machines are already empty**. Under rationing, industry runs three days a week.",
      "social": "Water pressure fails on the third day. Hospitals on diesel find their fuel contracts assumed **a 24-hour outage**.",
      "technological": "Protective relays **shed everything**. Mobile networks last four hours on batteries; black-start capacity had been retired to save money.",
      "legal": "The government publishes a **rationing calendar**; rationing law and backup-power standards are tested.",
      "environmental": "Sixty million people lose power in **five seconds**. The generation shortfall cannot be closed before winter."
    },
    "regions": {
      "north-america": "An **ageing grid**, extreme weather and cyber.",
      "europe": "Interconnected, but exposed to sabotage and renewables integration. The **Iberian blackout** of 2025 is the anchor.",
      "china": "Strong state capacity; **cyber-physical targets**.",
      "indo-pacific": "**Taiwan's grid** concentration.",
      "south-asia": "Pakistan's **nationwide blackout** in 2023; India in 2012.",
      "gulf-middle-east": "**Desalination** depends on power.",
      "africa": "South African load-shedding; fragile grids with **no backup depth**.",
      "latin-america": "Venezuela in 2019; **Ecuador's rationing** in 2024.",
      "russia-eurasia": "**Ukraine's grid** under attack."
    }
  },
  "history": [
    {
      "edition": 2027,
      "rank": null,
      "L2y": 3,
      "L10y": 4,
      "impact_systemic": 2,
      "impact_national": 4,
      "confidence": "low"
    }
  ],
  "changelog": [
    {
      "version": "0.2.0",
      "date": "2026-10-02",
      "change": "Entered the Library at v0.2 with GINC desk scores."
    }
  ],
  "citation": "GINC (2027). Scenario S12 Critical infrastructure collapse, Scenario Library v0.2. scenarios.ginc.org/library/critical-infrastructure-collapse"
}