The Growing Likelihood of Major Disruptions to U.S. Power & Communications
New Title

Executive Summary
Open-source government testimony and credible reporting now establish:
- clear adversary intent to disrupt U.S. critical infrastructure in a crisis,
- documented pre-positioning of access in U.S. networks, and
- well-understood physical choke points—notably large power transformers and subsea/space communications—that could extend outages beyond normal restoration timelines.
While a continental, months-long blackout remains unlikely under routine conditions, the risk of deliberate, regional, multi-sector disruptions—especially amid a U.S.–PRC confrontation—has risen from theoretical to credible and time-bounded likely. Federal Bureau of Investigation
1) Intent & Strategic Context
FBI testimony: On January 31, 2024, FBI Director Christopher Wray told Congress that PRC hackers are targeting U.S. critical infrastructure (electric power, water, oil & gas, transportation) and are “positioning” themselves to cause real-world harm at a time of their choosing. Federal Bureau of Investigation
Public advisories: U.S. and allied agencies have publicly attributed long-running, state-sponsored activity (“Volt Typhoon”) to China, noting stealthy “living-off-the-land” techniques and compromises in U.S. critical-infrastructure environments.
These advisories explicitly frame the activity as pre-positioning for potential disruptive effects. CIS
Press confirmations: Senior officials have reiterated that the accesses could be triggered to deter or punish U.S. action—e.g., in a Taiwan contingency—placing disruption of domestic infrastructure within the expected playbook. Reuters
Bottom line: Motivation and intent are now on the record. The question has shifted from “could adversaries try?” to “when and how extensively might they try?” Federal Bureau of Investigation
2) Capabilities & Pathways to Real-World Impact
2.1 Cyber → Physical Effects on the Grid
Demonstrated feasibility (INL “Aurora”): U.S. labs proved a remote control-sequence could physically damage rotating equipment by out-of-phase switching—a cyberattack producing destructive, mechanical failure. Wikipedia
Operational precedent (Ukraine): Purpose-built ICS malware (e.g., CRASHOVERRIDE/Industroyer) has de-energized substations and automated disruptive switching. Analysts assess such tools could create hours to days of outages and be re-used at multiple sites. CISA
Implication: With prior access and system knowledge, time-bounded but acute grid disruptions are technically feasible. CISA
2.2 Physical Attacks on Substations
The 2022 Moore County, NC incident and similar shootings exposed the ease of disabling equipment and prompted a FERC review of physical-security standards. Axios
Implication: Low-tech physical attacks can amplify cyber campaigns or strain restoration resources regionally. Missouri Independent
2.3 Chokepoint Components: Large Power Transformers (LPTs)
Federal/industry reporting describes severe LPT supply constraints: 80–210-week lead times are now typical, making simultaneous losses at key nodes long-tail risks even after partial service returns. CISA
Implication: Destroying or disabling even a small number of strategically located LPTs could extend restoration from days into months for full capacity. CISA
2.4 Communications Targets (Space & Subsea)
Space segment: The Viasat KA-SAT attack (2022) disrupted tens of thousands of satellite modems across Europe in the opening hours of a major war—an empirical example of civilian comms degradation via cyber means. CSIS+1
Subsea cables: Think tanks and commercial threat intelligence report a rising risk of state-backed interference with undersea internet cables. Taiwan has recorded multiple cable disruptions, and recent analyses warn of escalating threat activity tied to Russia and China. Recorded Future | The Guardian
Implication: Targeted communications outages—via satellite networks or subsea cables—can magnify grid incidents by degrading operator coordination, situational awareness, and public communications. CSIS
3) The Baseline System Risk (Before Adversary Action)
NERC assessments repeatedly flag elevated seasonal reliability risks in multiple regions as load growth, changing resource mixes, and extreme weather stress the system; Senate testimony in 2025 probed how demand growth and generation/transmission constraints affect adequacy. These are not predictions of collapse, but narrower operating margins create more opportunities for adversaries to tip systems into controlled outages or load-shedding. NERC
4) Likelihood Assessment
Peacetime (next 6–12 months):
Deliberate, regional disruptions (power and/or communications) via cyber or blended cyber-physical means: plausible, especially during seasonal peaks or severe weather.
Nationwide, prolonged (weeks–months) blackout: unlikely, but not inconceivable if multiple high-value assets were destroyed, given LPT lead times. CISA
Crisis (e.g., Taiwan war):
Government testimony and advisories imply activation of pre-positioned accesses to deter U.S. action, making multi-state, time-bounded disruptions more likely, along with comms degradation (satellite/subsea). Reuters+1
Key inference: The probability distribution has shifted from “rare theoretical” to “credible, targeted, and repeatable” regional events—while true national-scale collapse remains a low-probability, high-impact tail risk. Federal Bureau of Investigation
5) Consequence Framing
Even short-duration regional outages can create outsized, cross-sector effects:
- Fuel logistics (pipelines, terminals), water treatment, 911/healthcare comms, rail/port operations, and public information flows degrade quickly.
- Where LPTs or major interties are lost, capacity constraints can persist for months, prolonging rationing or rotating outages even after an initial restoration. CISA
6) Recommendations
6.1 Federal & Sector Policy
Accelerate detection/eviction of pre-positioned accesses in ICS/OT (expand joint hunt forward, mandatory incident reporting with safe harbor). CISA
Harden substation physics and relays against Aurora-style switching abuse; verify protective-relay settings and out-of-phase protections; exercise black-start under degraded comms. Wikipedia
Mitigate LPT bottleneck: stand up an LPT strategic reserve and domestic surge capacity; prioritize spares for high-value nodes; streamline transport waivers. CISA
Protect comms dependencies: require diverse paths (terrestrial + satellite + microwave), fund rapid cable repair capacity, and expand monitoring of subsea infrastructure with allies. CSIS
Exercise multi-sector incident playbooks (power, telecom, water, fuel) for blended attacks and public-warning strategies that assume intermittent connectivity. CISA
6.2 State/Local/Utility Operators
Seasonal surge readiness: align with NERC seasonal risks; rehearse load-shedding + comms-loss scenarios; pre-stage mobile generation for water/health. NERC
Substation hardening: ballistic protection at selected sites, rapid-response contracts, and mutual-aid compacts that include comms assets. Missouri Independent
Spare-part realism: validate on-hand spares for breakers/relays; map LPT dependencies and identify temporary bypass options. CISA
6.3 Private-Sector & Community Preparedness
Continuity for 2–6 weeks of rolling disruption: water, heat, lighting, comms redundancy (AM/FM/NOAA, ham, satellite messengers), generator safety, and fuel rotation.
Information hygiene: pre-agreed channels with employees/customers; offline contact trees for when SMS/VoIP are unstable.
Cyber hygiene in OT-adjacent firms: segment networks; monitor for “living-off-the-land” tradecraft; practice manual fallback procedures. CISA
7) Conclusion
The public record—FBI testimony, interagency advisories on Volt Typhoon, technical demonstrations of cyber-physical impacts, LPT supply constraints, and real-world attacks on power and communications—supports a sober reassessment: adversary motivation and capability now make targeted, regional disruptions a credible near-term risk, especially in a geopolitical crisis. The prudent response is focused resilience: accelerate detection and hardening, fix known bottlenecks, diversify communications, and exercise restoration under contested conditions. Doing so narrows the attacker’s payoff and shortens the tail of any disruption. CSIS | Federal Bureau of Investigation | CISA
References (selected, open-source)
FBI Director Wray opening statement to the House Select Committee on the CCP (Jan 31, 2024). Federal Bureau of Investigation
CISA & partners advisories on PRC state-sponsored activity (Volt Typhoon) and living-off-the-land tradecraft (2023–2024). CISA
INL “Aurora” cyber-physical destruction demonstration (background). Wikipedia
CRASHOVERRIDE/Industroyer alerts and analysis (CISA; Dragos). CISA
NERC reliability assessments (seasonal/State of Reliability). NERC
NIAC (draft) report on LPT shortages and lead times (80–210 weeks). CISA
Moore County substation attack coverage & FERC physical-security review prompt. Axios
Viasat KA-SAT cyberattack reporting and analysis (CSIS; CCDCOE). CSIS
Subsea cable risk (Recorded Future; Reuters/Baltic & Taiwan incidents; CSIS policy analysis).
CSIS Recorded Future |The Guardian



