The Microsoft outage reminds us how reliant we are on technology – so what could happen in a total wipeout?

After a worldwide Windows glitch took much of the world’s infrastructure offline on Friday, power outages and internet disruptions are on everyone’s mind. Flights were grounded and TV channels including Sky News were taken off air. Everything from banks and payment companies to airlines and train companies said they would see delays and technical issues caused by a flawed software update from cybersecurity firm CrowdStrike.

It is something the former deputy prime minister Oliver Dowden, warned of when he made the case for us to all think about how prepared we are for prolonged disruption during a cyberattack. While, George Kurtz, the founder and chief executive of the cybersecurity firm CrowdStrike, has made it clear there was no possibility that this power outage was a cyber-attack it has certainly focused our minds.

It is also a reminder of the smash Netflix hit Leave the World Behind, which pondered the stark, post-apocalyptic depiction of the immediate aftermath of an attack. In the movie, the first time anyone notices something is wrong is when they discover their mobile phone coverage is out, and their wifi disappears, but it takes a push notification on their TV screens for the characters to learn that an attack has been launched.

In reality, the emergency alert system, tested this April, would be used in the UK. This would mean our phones would buzz, and we would receive advice and instructions if needed on what to do in the event of a large-scale attack or extreme weather event – whether that would be to stay indoors or evacuate to a place of safety.

In the government’s annual preparedness plan, unveiled by Dowden under Rishi Sunak, it advised that people have non-digital alternatives to radios, alongside candles and power banks to keep devices going in the event of a prolonged power outage. Other experts suggest that everyone should have enough food and water for up to three to four days.

open image in gallery

Such plans into insignificance when you consider towns and cities in Sweden maintain bunker capacity for up to 7 million citizens, located in cellars under apartment blocks, and in underground metro stations and some commercial centres too. Inside, there are enough provisions for almost a week and an emergency siren system for a life-threatening attack in peacetime – the “Hoarse Fredrik”, as it is known,  is tested at 3pm on the dot in Swedish cities on the first Monday of March, June, September, and December.

The UK’s physical air raid siren network was also regularly tested in the Seventies but was disbanded in the 1990s. However, reports suggest around 1,200 remain in use – and would be used if there was an imminent danger to surrounding residents.

In the Netflix film, the other sign that something is seriously amiss is when an oil tanker runs ashore, thanks to malfunctioning navigation systems. Later, we see planes crashing out of the sky, reminiscent of the Y2K millennium bug scare, when people worried that computers would misinterpret the “00” in 2000 as 1900, which some believed would spark disruption in everything from navigation systems to power infrastructure. This never happened, largely because many people behind the scenes got to work, but there were still failures internationally when 15 nuclear reactors shut down, power cuts hit Hawaii, and government computers failed in China and Hong Kong.

Our reliance on computer systems was also highlighted by the August 2023 outage of air traffic control systems in the UK that brought flights to a standstill, and recently, we have seen that smaller-scale outages can have widespread ramifications. The flight outage took several days to unpick as NATS, the company overseeing UK air traffic control, sought to find the underlying issue that had caused it. But at least it showed that there are sufficient early-warning systems and contingency plans in place to stop planes falling out of the sky, as we see happen in the film.

open image in gallery

However, that is not to underestimate how much our systems are linked – much more so than when we worried about the millennium bug. Around 15 years ago, the UK took a path with its national cybersecurity strategy that prioritised the continuity of government computer systems at the expense of everything else.

“It was wrong in 2009 because we completely ignored the fact that a massive proportion of the economy was already virtual, and that that was only going to increase,” says Lynette Nusbacher, who at the time was a senior intelligence officer with Britain’s Joint Intelligence Committee and founded the Cabinet Office’s national security horizon scanning unit.

While Nusbacher left her role in 2010, she says that, from an outsider’s perspective, attitudes haven’t changed much since. “We have not moved far from that,” she says.

However, the likelihood of such a large-scale cyberattack happening is still small, reckons Ciaran Martin, professor of practice at the Blavatnik School of Government, and the first CEO of the UK’s National Cyber Security Centre until August 2020. “The chances of this happening with no wider complex declaration of hostilities are very, very, very low,” he says.

A lot of what we think of as critical national infrastructure like the National Grid is comparatively well-protected and has been for decades. The UK’s National Protective Security Authority (NPSA) lists 13 sectors that it deems are critical, including energy, chemicals, and civil nuclear, as well as health, communications, food, and water. Those 13 were chosen because “a major detrimental impact on the availability, integrity, or delivery of [these] essential services... could result in significant loss of life or casualties”, according to the NPSA.

“However,” Nusbacher adds, “if one part of national infrastructure is a hard target, an attacker is going to seek out soft targets.” Communication is key, and she says: “The government has special agreements with certain providers to ensure that there are no single points of failure.”

Outages include the things that affect ordinary people, like your internet connection and potentially your mobile service as people turn to it because they can’t use wifi. However, emergency services are able to still operate – the government learned after the 7/7 terror attack on London in 2005 that first responders can’t use the same network as the general public. The emergency services use a new system, called the Emergency Services Network, that is separate from the core public communications network.

There has been a focus on landline phone services recently and their analogue value and use, particularly, in a cyberattack. “We’re in the process of taking a step backward by closing down the plain old telephone system, which was a separate network, powered separately and with its copper infrastructure,” says Alan Woodward, professor of cybersecurity at the University of Surrey. BT and other telephone providers are partway through migrating their services from the traditional copper wires to digital alternatives, powered by voice over IP (VoIP) technology – the same tech that underpins Skype. The phone company, however, says it has contingency plans in place to keep services going in a serious event and liaises regularly with the government to keep things safe.

“In the UK, there is also a hidden benefit in that we have several network providers,” says Woodward. “While lots of service providers use the same physical networks, there are several physical mobile networks.”

The same thing is true for banks, says Ciaran Martin, which all have back-up plans in the event of major cyber incidents. The goal is to ensure services remain online. “Big banks and the energy grid are designed, in principle, so you’ll be able to get capacity from elsewhere,” he says.

“Outside of a massive high altitude electromagnetic pulse, some infrastructure for general users would survive,” says Woodward. “Emergency generators would kick in, keeping core systems online.

One of the movie’s most evocative scenes – at least on social media – sees Tesla self-driving electric vehicles careening across roads. That scene has raised the hackles of Tesla CEO Elon Musk, who promptly posted on X, formerly Twitter, that electric vehicles like his could still run even if mains electricity was taken down. “Teslas can charge from solar panels even if the world goes fully Mad Max and there is no more gasoline!” he wrote.

open image in gallery

Whether the other 850,000 or so solely electric cars the RAC estimates are on the nation’s roads would be able to be charged by solar power isn’t fully known. However, Nusbacher says the idea of cars or ships heading in the wrong direction isn’t too far-fetched. “If a widely available satnav product was changed ever so slightly to mess everything up, the effect could be significant,” she says. Of course, humans could override that by simply ignoring the directions and follow analogue plans. Remember maps?

Continuity of public services and access to food is key in the event of persistent issues. The Resilience Capabilities Programme is thee national-level plan that oversees what happens in the case of a major emergency. At a local level, responsibility will be devolved to local councils who will organise where to evacuate people in the event of a disaster. In an extreme event like a nuclear attack, there are thought to be no more than 50 usable nuclear bunkers across the country and space in these would be reserved for key members of government, the military, and people who would be needed to run the country after an attack.

On a lesser scale, though, it doesn’t take much for normal service to be disrupted. Just as we saw a couple of years ago, when a tanker was grounded in the Suez Canal and with Covid, where just-in-time supply chains are interrupted, shortages quickly follow. In 2021, the army was put on standby to cope with food shortages caused by a lack of qualified truck drivers and the Royal Logistic Corps and other corps would be used to help distribute food and other essential supplies, including medicine if needed.

What the movie, and any real unspooling of our digital lives like we’re seeing today, does show is quite how important tech and the internet have become in how we live today. “It’s important to recognise that as we hand over more control of our world, for all the best reasons, to the tech, then those dependencies become sharper,” says Nusbacher. “Even well-prepared, we could find ourselves having tremendous difficulty.”

But in an extreme event will we turn on each other or towards each other? When you consider one statistic that cited 90 per cent of lives saved in disasters are saved by those near them and not the emergency services, let’s hope it’s the latter.