When the Grid Goes Down, the Clock Starts Running

Part 4: The forecast, the collision map, and the first accelerant already active in U.S. systems

Barking Justice Media, Mika Douglas, and Robert Anderson

Mar 03, 2026

∙ Paid

The Firing Line | Barking Justice Media
March 3, 2026 | By Mika Douglas and Robert Anderson

═══════════════════════════════════
National Threats and Citizen Harms:

Tradecraft Series: 4 of 6 | When the Grid Goes Down, the Clock Starts Running

═══════════════════════════════════

Six conditions are currently active in American infrastructure that can turn a manageable crisis into an unmanageable one. We outline what your household can do about each threat before the collision arrives.

The Scene That Explains the Model

Angela wakes up to a buzzing phone. The power is out. Somewhere across town, her neighbor’s oxygen concentrator has gone silent. The pharmacy’s refrigerated medications are warming up. Her mother’s CPAP machine shut off two hours ago. Angela doesn’t know that yet.

A city alert circulates telling people to boil water. Minutes later, another message claims the alert was fake. Real guidance arrives much too late, buried under panic posts and rumors.

You don’t know what to trust, and the clock is running.

This is the compounding engine. A failure becomes a community trauma when three conditions overlap:

Thin capacity: not enough redundancy, staffing, maintenance, or surge.
Trust deficit: people either do not believe the guidance or cannot tell what is real.
Tight coupling: power, water, healthcare, telecom, and logistics fail together, so one outage cascades into the next.

This briefing maps the conditions that make recoveries slow, guidance weak, and mistakes fatal. These conditions are already present. They are the starting configuration for the scenario Angela’s morning describes, and at least one is already in place in most American metro areas today.

The Forecast Spine: Three Paths (and what moves the probabilities)

Think of the next year as having three plausible paths that will shape our threat posture. Do not chase daily headlines; follow the patterns being formed.

Path 1: ‘The Grind’ (probability: 50 to 70% over the next 12 months)

(All probability estimates in this briefing are analytical judgments grounded in documented conditions, not model outputs — see methodology note at the end of this section.)

No single collapse. Just continued strain. Restoration times lengthen. Staffing gaps widen. Insurance becomes harder to get. People start accepting less and call it normal. This path is dangerous because it sneaks up on us.

The policy-shifters make ‘The Grind’ worse: sustained underinvestment, high turnover in civic and infrastructure roles, and a rising baseline of fraud and misinformation.

Path 2: ‘The Collision’ (probability: 15 to 30% within 12 to 18 months)

Two or three shocks land close together: a cyber disruption, an extreme-weather outage, and an information breakdown that ruins compliance. Each event is survivable alone. Their overlap produces a system behavior that appears to be incompetence but is actually compounding overload.

This overload is what interrupts Angela’s morning.

Path 3: ‘The Hardening Turn’ (probability: 10 to 25% within 24 months)

Threat prevention starts protecting us when it becomes hardened infrastructure. Baselines become more reliable. Maintenance budgets stop being the first to be cut. Communication channels continue to work during a crisis. The system gains durability.

‘The Hardening Turn’ requires funded redundancy and enforceable standards, Infrastructure, not soundbites.

The rest of this two-part series explains why Path 2 has a higher probability than most people want to admit and what it takes to shift the weight toward Path 3. The six conditions that determine which path we’re on are below, starting with the one already inside the infrastructure that powers Angela’s neighborhood.

The path probabilities above are not abstract. They are determined by six conditions already active in U.S. systems, conditions that convert Angela’s morning from a scenario into a forecast.

[See methodology note at the end of the section.]

Collision Map: Why Recoveries Are Getting Slower

The path probabilities above tell you where things are headed. The Collision Map tells you what actually happens at the moment of impact, and why the damage goes further than anyone planned for.

A collision is not “bad luck.”

Pre-positioned access (bad actors inside a critical network)

plus

Thin staffing (operators not well-trained or improvising under stress)

plus

Information pollution (fake guidance competing with real guidance)

equals

Restoration drag: the long, uncertain stretch after a crisis when nobody can say, with confidence, what is safe to turn back on. The delay is not just technical. It is a trust problem, and trust does not restart with a switch.

These are not the cause of threats. They are accelerants, conditions already present that determine how fast a manageable crisis becomes an unmanageable one. Together, they produce a failure mode that no single system is designed to absorb, and the question is not whether one of these accelerants will appear. They will.

One accelerant is detailed in this free section: cyber pre-positioning. It is the mechanism that converts a manageable outage into Angela’s morning.

Part B adds five more accelerants: the erosion of shared reality, artificial intelligence (AI) enabled deception at scale, climate overlap exceeding recovery capacity, physical material chokepoints, and insider risk in under-protected sectors. It also includes the full ‘Hardening Turn Playbook’.

Accelerant 1: Pre-Positioned Cyber Access in Critical Infrastructure

🚩 Probability: Moderate to High (exploitation risk in a 12 to 18 month window, particularly during a simultaneous physical crisis)

Some intrusions are designed to go undetected. The goal is to trigger an event so disruption can occur later, when restoration is hardest, staff are under stress, and trust is low. [1]

What the record actually supports

U.S. agencies have been warned that People’s Republic of China-linked actors associated with “Volt Typhoon” sought to maintain access to U.S. critical infrastructure IT environments. U.S. officials have described the activity as pre-positioning for possible disruptive cyberattacks during a crisis. Open sources cannot prove intent, but surprise access is the prerequisite for disruption when timing matters most. [1], [2]

This matters because “creating a crisis” is the point. Attackers do not need to win a technical contest against the strongest operators. They only need one weak point that forces a slow, uncertain restoration.

The standards nuance most coverage misses

Bulk power system entities registered with the North American Electric Reliability Corporation (NERC, the reliability body for the high-voltage grid) must follow mandatory reliability standards approved by the Federal Energy Regulatory Commission (FERC, the federal regulator). These include cybersecurity standards known as Critical Infrastructure Protection (CIP, baseline cyber rules for covered grid systems). [3], [4]

Meeting those standards matters. Yet the vulnerability is actually the unevenness in applying these standards across power companies:

The bulk power system is the high-voltage transmission network that moves electricity across regions. It is what most people picture when they think of “the grid.” This is not the part that powers your house.

What most households depend on is distribution: the local lines and systems from substations to homes and businesses. Oversight is more fragmented here, budgets are often thinner, and enforceable cyber baselines are uneven.

The result: the bulk grid can be hardened while local distribution interfaces remain the weak link. Telecom, water, and municipal interfaces can also become restoration chokepoints, even if they are not attacked directly; full recovery depends on them.

Think of it this way: Angela’s neighbor’s oxygen concentrator runs on distribution power, the local line from the substation to the house, not the hardened transmission network the news covers when it talks about grid security.

Why the patchwork persists (and who pays the cost)

In public proceedings, cost, jurisdiction, and implementation burden are common objections to expanding mandatory cyber baselines, especially for smaller utilities. Combined with fragmented authority, those constraints have limited the extent to which enforceable requirements apply. The result is uneven protection: the most exposed nodes often have the weakest enforceable requirements. A targeted disruption of a distribution-level interface can stall regional recovery without touching the bulk grid’s hardened assets.

How does this become a compounding event?

A physical storm knocks down power lines. Everyone can see the damage. Fixing it is an engineering problem; crews go out, repair the lines, and restore power.

A cyberattack on the control systems creates something different. Before operators can turn the power back on, they must prove that the systems haven’t been compromised. That takes time nobody can predict.

And in that gap, that window of uncertainty, the crisis multiplies. Rumors spread. Scammers move in. People don’t know what information to trust or who to listen to.

That’s the compounding effect: the outage itself may be manageable, but the loss of trust makes it worse and longer. Power coming back on doesn’t end the crisis. The crisis ends when people believe it’s safe to act on what they’re being told, and that’s much harder to restore than electricity.

Household consequence, translated

This does not look like a Hollywood blackout. It looks like:

An outage that lasts long enough for refrigerated medications to cross the safety threshold.
Backup generators are becoming a community backorder as demand surges.
Water treatment disruptions create a health threat in the first 72 hours.
Fake alerts and impersonation scams are flooding the information vacuum while official guidance is delayed.
For households with medical dependencies, insulin that requires refrigeration, oxygen equipment on a continuous draw, and decisions that nobody pre-planned for.

Tripwires that signal we are moving toward a collision

Government advisories confirming that a foreign actor has gained and is actively holding access inside critical infrastructure systems, not merely probing from the outside, but positioned to act from within. [1]
Public messaging that hints restoration is slowed by “system integrity” concerns rather than physical damage alone.
Simultaneous disruption across power, telecom, and water in the same region, without a clear single cause.

What actually changes outcomes

Real protection requires rules with teeth, not voluntary guidelines, but enforceable legal standards. And those standards have to cover the entire system, including the local distribution networks and backup resources that enable recovery after an outage.

Who has the power to act

FERC can push for stronger, binding requirements at the points where local distribution systems connect to the larger national grid, particularly where those connections affect how quickly power can be restored.

State regulators and public utility commissions hold most of the authority over local grid security. They can require utilities to meet specific, enforceable standards rather than aspirational ones.

Congress can resolve the gaps and ambiguities that allow standards to remain optional or inconsistently applied, and direct funding so that smaller or less-resourced utilities aren’t left behind.

Before the next outage forces the decision for you

1. Build a “restoration drag” plan, not a generic emergency kit. Write down what becomes dangerous at 24, 48, and 72 hours (meds, medical devices, communication, cash, fuel), and who in your household owns each decision. In a long outage, the plan beats improvisation.

2. Create a verification ladder for emergency guidance. Pick your trusted source for evacuation and water instructions (your county or city emergency management channel) and save it now. When rumors spike, follow what you pre-screened as trustworthy, not the feed.

Maria did not know her husband’s insulin had crossed the temperature safety threshold until the outage ended. She had no decision tree: who calls, who drives, and which channel to trust when three advisories say three different things. The five accelerants in Part B explain how her Tuesday played out. ‘The Hardening Turn’ playbook shows what would have changed if it had. If your household has a medical dependency, depends on a supply chain, or touches any critical system, Part B is written for you. If you are a local official, a small business owner, or a renter in a region where insurance is repricing faster than incomes, it maps the specific mechanism that reaches you, too.

[Methodology note: High = greater than 50% likelihood in 12 months; Moderate = 20 to 50%; Low = under 20%. The path estimates above reflect that same basis: Path 1 at 50 to 70%, Path 2 at 15 to 30%, Path 3 at 10 to 25%.]

Barking Justice Media LLC is an independent journalism organization. This publication is for informational purposes only and does not constitute legal, medical, financial, or other professional advice.