Hybrid attack on Ireland's critical infrastructure 'could cause social collapse within 48 hours'

The Defence Forces team detailed threats to the country’s critical national infrastructure, focusing on the electricity grid. File Picture 

A combined physical and cyberattack on a critical electricity transformer would cause “grid collapse” within two hours, impact critical services within six hours, and threaten “social collapse” in just 48 hours, according to experts from the Defence Forces.

A team of engineers and air corps officers told managers of State utilities and engineers working in critical infrastructure that these timelines were based on a “plausible, evidence-based” hybrid attack.

In a series of presentations at a special Engineers Ireland event, entitled ‘Security of Critical National Infrastructure', the Defence Forces experts said it was “likely” that adversaries have already conducted an intelligence operation identifying vulnerabilities in Ireland’s electricity grid and other critical sectors.

“They may already have more information about your infrastructure than perhaps your own management board,” Lieutenant Kieran White told attendees.

“The HSE is proof that Ireland is already seen as a target,” he said, referring to the crippling cyber incident in 2021. “The HSE cyberattack happened; the hybrid blueprint you have seen today has not — yet.” 

The event also heard other examples of vulnerabilities in, and threats to, Ireland’s critical national infrastructure.

The event heard:

• Ireland’s three major ports have very narrow entry points — 150m-200m wide — and, if a ship sank, food supplies would be disrupted within three days and oil supplies would become critical within three weeks.
• Transport systems are a “soft underbelly”, and just a “pair of pliers” is needed to open up transport cabinets on city streets and gain access to transport networks.
• Drone surveillance of critical infrastructure is not covered in Irish laws, unlike in Britain, and drones can carry out infra-red imaging of a substation from outside a perimeter area.
• Russian 'shadow vessels' represent a “ticking timebomb” both in their threats to sub-sea cables and pipelines and to marine safety, from pollution. Increased military boarding of these vessels by Baltic, Belgian, and French states could “push” more of them westwards to Irish waters. 

Power transformers a 'critical vulnerability'

In presentations to engineers, industry bosses, and utility regulators, the Defence Forces team detailed threats to the country’s critical national infrastructure, focusing on the electricity grid.

Mr White said Ireland’s power transformers are a “critical vulnerability”, not just because they were visible but because the lead time to replace a damaged one was “12 to 24 months”.

He said previous incidents in the US had shown this was technically possible, both from a physical and cyber perspective.

“Engineering analysis suggests there are fewer than a dozen high-value sub-stations [in Ireland],” Mr White said. “An adversary who has mapped this — and they have — knows exactly which ones they are.” 

He said the Irish grid, using EU standards, is designed to survive the loss of a single element “without cascading failures”. But he said it is not designed to withstand multiple simultaneous attacks.

He gave the following outline of a successful physical and cyberattack on a critical power station:

• T+2h (Two hours after action) - Grid collapse: “Regional or national blackout”, with replacement time of station 12-24 months;
• T+6h - Critical services hit: Hospital generators have 48-72 hours of fuel; Irish Water pumping stations lose power; communication infrastructure degrades; emergency communications overwhelmed;
• T+48h – Social collapse: Water pressure falls across urban areas; food cold chains disrupted; fuel rationing begins; Government authority visibly strained; social media becomes second battle space;
• T+72h – Adversary achieves objective: Government credibility damaged; EU Article 5 obligations strained; attack is over, but crisis is not.

The Department of Defence is expected this week to publish Ireland’s first Critical Entities Strategy, mapping out critical national infrastructure, risks to them, and State responses.

In a separate presentation, Commander Cathal Power of the naval service said the recent boarding activities of Russian ‘shadow vessels’ by the Baltic states, France, and Belgium “could push westwards”, into Irish waters, more of these vessels.

He said this is where the new enforcement powers, announced by the Government, would “very much come to the fore”.