At 12:33 on the afternoon of 28 April 2025, mainland Spain and Portugal lost their electricity supply. Red Eléctrica de España, the Spanish transmission operator, logged the loss of about fifteen gigawatts of generation — close to sixty per cent of Spanish demand at that moment — within seconds. Supply was interrupted for roughly ten hours across most of the peninsula and longer in some districts, affecting an estimated sixty million people. Trains stopped between stations, payment terminals froze, mobile service thinned as tower batteries drained, and water pressure sagged in elevated neighbourhoods.
The final report from ENTSO-E, the European network of transmission operators, published on 20 March 2026, attributed the event to a combination of technical factors and successive generation disconnections rather than to a single fault. Nothing had attacked the Iberian grid, which is part of why the afternoon deserves to be remembered. Every serious rehearsal the industry runs assumes something worse.
Since then the system has not become more forgiving. On 4 May 2026, the North American Electric Reliability Corporation issued a Level 3 “Essential Actions” alert, its highest severity, after a run of incidents in which a thousand megawatts or more of computing load dropped off the bulk power system without warning. NERC’s State of Reliability for 2026 recorded conventional forced-outage rates climbing to 9.2 per cent, and documented one event in which data-centre uninterruptible power supplies tripped during an otherwise routine fault and removed 1,800 megawatts in a single movement. By August the subject had reached the New York Times Magazine, where Mark Lauby, NERC’s chief engineer, argued that the network’s complexity and redundancy made a cascading national collapse “unlikely”. Federal regulators have taken a less relaxed view: the Federal Energy Regulatory Commission has treated the physical protection of substations as a national security matter since riflemen fired on one in California in 2013.
Alongside the present tense sits evidence that has been produced in public for fifteen years and read almost exclusively inside the industry. Since 2011, NERC’s information-sharing arm has run a biennial exercise called GridEx, in which utilities, agencies and cross-border partners respond to a scripted emergency on the real bulk power system, using real spares, real fuel contracts and real staffing. The eighth edition ran on 18 and 19 November 2025 and drew more than three hundred and seventy participating organisations, an increase of nearly fifty per cent over 2023. The scenario was a coordinated cyber and physical attack by a nation-state adversary, with intrusion and physical damage timed to compound each other. The resulting report, published on 2 March 2026 and running to thirty-two pages, concentrated on communication and coordination. What it did not do is establish a restoration timeline. An exercise tests a scenario and shows where assumptions break; it does not measure how long a real outage would last.
A third line of evidence arrives by an entirely different route. A nuclear burst high above the atmosphere produces an electromagnetic pulse in three waves, the slowest of which behaves like a continent-wide geomagnetic storm. The physics was demonstrated by accident in July 1962, when a 1.4-megaton test called Starfish Prime detonated roughly four hundred kilometres above Johnston Atoll and knocked out streetlights in Hawaii, some fifteen hundred kilometres away. Congress commissioned a study in 2001, and its reports, delivered in 2004, 2008 and 2015, produced a figure that never entered public consciousness. William R. Graham, the physicist who chaired the commission and had earlier served as science adviser to Ronald Reagan, testified that if the power went out and stayed out for as long as a year, nine out of ten Americans would be dead — not from the pulse, but from the failure of water treatment, cold storage, fuel distribution and medical care. That number is a scenario projection built on stated assumptions rather than an observation, and it is contested. It is also the only serious estimate anyone has produced.
The difficult question is not whether any of this can happen. It is how much damage a particular event would cause, and how long the repair would take.
What follows, in the order it unfolds:
- ⚡ How a blackout spreads — the mechanics of a cascade, the four ways an adversary can trigger one, and why transformers set the repair timeline.
- 🕯️ What a household actually needs — water, temperature, sanitation and medication, then fuel, light, communication, cash and transport.
- 🧲 Ten effects of an electromagnetic pulse — the documented history, the physics, and a note on how certain each effect is.
- 🗓️ A century of blackouts, tabulated — sixty years of documented events, and what the record does and does not show.
- 🧭 What the evidence supports — a closing assessment that separates established fact from inference and from speculation.
Cyber intrusion, physical sabotage and geomagnetic disturbance are handled by separate departments with separate budgets, yet all three converge on one object: a network of copper and steel synchronised to sixty cycles per second, carrying very little spare capacity. The sections below follow that object from its mechanics to its failure modes to the ordinary household standing at the end of the chain.
North America runs on three electrical islands that barely interact: an Eastern Interconnection reaching from the Rockies to the Atlantic, a Western Interconnection covering the mountain states and the Pacific coast, and a smaller Texas system, ERCOT, which keeps itself deliberately separate. A handful of direct-current ties connect them, each carrying a fraction of total load. Inside each island the arrangement is denser: roughly four hundred and fifty thousand miles of high-voltage transmission, in the order of five and a half million miles of distribution, about fifty-five thousand substations, more than seven thousand generating plants, and — the figure that governs everything downstream — something near two thousand large power transformers rated above a hundred megavolt-amperes.
Alternating current at sixty hertz is a continuously corrected equilibrium. Every generator on an interconnection turns in near-perfect synchrony with every other, and the shared frequency tells each machine whether supply is ahead of demand or behind it. Operators hold frequency within a few hundredths of a hertz of sixty. When supply and demand diverge badly enough, protective relays disconnect pre-arranged blocks of load — deliberately darkening some customers to save the remainder — and if the divergence continues, generators begin tripping in self-defence, which removes supply and drags frequency lower still. The 2003 event removed sixty-one thousand megawatts from the Eastern Interconnection in a few minutes.
Two properties of this equilibrium have changed in ways that reduce margin. Inertia is the first. A heavy spinning rotor resists sudden frequency change the way a loaded truck resists sudden braking, and the coal and nuclear plants that supplied most of that mass are retiring. Solar, wind and batteries are connected through power electronics and have no rotating mass unless programmed to emulate it, which modern equipment does competently but which alters the system’s reflexes. The second is the disappearance of slack. For most of the twentieth century, generating capacity grew ahead of demand. Since roughly 2022 the relationship has inverted in the United States, driven by data centres, electrified heating, electric vehicles and onshore manufacturing. The queue of projects waiting to connect has at points exceeded two terawatts of proposed capacity, and only a fraction clears each year.
Introduce an adversary and four categories of attack become relevant. They differ in likelihood, in what they damage, and in how well they have been tested.
- Cyber intrusion. Demonstrated at national scale. In December 2015, a coordinated attack on three Ukrainian distribution companies opened breakers remotely and left roughly two hundred and twenty-five thousand customers without power, with operators reduced to re-closing substations by hand. Malware named Industroyer followed a year later, speaking industrial protocols directly; a variant called Industroyer2 was used against the Ukrainian transmission operator in 2022.
- Physical sabotage. The template was set on the morning of 16 April 2013, when riflemen near San Jose, California, fired into a Pacific Gas and Electric substation, disabled seventeen transformers, cut fibre-optic cables in an underground vault, and withdrew before dawn. Repair took twenty-seven days and roughly fifteen million dollars.
- Coordinated hybrid attack. The GridEx scenario. Cyber operators degrade the monitoring and control systems that tell humans what is happening; physical teams then damage substations chosen because they hold the rest together. The two effects compound, because operators are partly blind exactly when they most need to see.
- Electromagnetic and geomagnetic assault. A high-altitude burst, or an unlucky coronal mass ejection, drives quasi-direct currents through long conductors, saturating transformer cores and heating them internally.
Restoration in the first three cases depends less on the wires than on the transformers. A large power transformer is closer to a bespoke building than to a commodity: each unit is designed for its site, with its own voltage ratio, impedance, cooling class, seismic rating and transport dimensions. Cores are stacked from grain-oriented electrical steel, produced in a small number of plants worldwide, and windings are wound under the supervision of experienced operators whose global number is small enough to be treated as a strategic constraint. A finished unit weighs between two hundred and four hundred tonnes and travels on a Schnabel car, a specialised wagon that clamps the transformer into its own frame and lets it hang between the rails, because the load is taller than the loading gauge.
WARNING: The AI Cyber Threat You Need to Understand… Don’t Watch If You’re Not Ready.
Watch the full AI documentary below.
Affiliate Disclosure: This post contains affiliate links. If you make a purchase through these links, I may earn a small commission at no additional cost to you. Thank you for your support!
Delivery times have lengthened sharply since 2020. Wood Mackenzie’s procurement surveys put standard power transformers at around one hundred and twenty-eight weeks and generator step-up transformers at around one hundred and forty-four weeks, and by early 2026 lead times for the largest units had pushed past one hundred and sixty weeks, with tier-one manufacturers quoting forty-eight to sixty months. A utility that loses a large unit today does not place an order; it joins a queue. Three documented events show what a small trigger can do. On 9 November 1965, a mis-set protective relay near Niagara blacked out thirty million people across the north-eastern United States and Ontario for up to thirteen hours. On 13 July 1977, a lightning strike in Westchester County, compounded by operator error, darkened New York City for up to twenty-five hours. On 14 August 2003, a sagging conductor touching a tree in Ohio, combined with a failed alarm system in one company’s control room, cascaded across eight states and Ontario and left fifty-five million people without power for up to two days.
The 2003 sequence is the closest thing to a dress rehearsal the Eastern Interconnection has had. The chain ran for more than an hour while the control room was effectively blind. By the time operators understood the situation, collapse had become irreversible. Restoration took days in places not because the damage was severe — most of it was not — but because restarting a dead grid is a slow, sequential process.
That process has a name. Black start. Bringing power back means forming small islands of generation from units capable of starting without external supply — hydroelectric plants, certain gas turbines with on-site starting capability, a limited number of others — then growing each island by adding load in blocks while matching generation to it, and finally synchronising islands together. NERC designates a modest number of black-start resources per interconnection, and the procedure is rehearsed because it is unforgiving. When equipment is intact, black start is measured in hours to a couple of days. When equipment is damaged, the constraint changes.
Sustained overvoltage or geomagnetically induced current damages transformers in ways that stay invisible for weeks. The usual mechanism is hot-spot heating: induced current drives the core into saturation, the unit draws reactive power, windings heat locally, and dissolved gas comes out of the insulating oil as bubbles. A bubble in the wrong place degrades insulation, and the degradation can produce a dielectric failure when the transformer is energised again. A unit that survives the event may fail a month later, which is why utilities sample dissolved gas in transformer oil after any significant geomagnetic disturbance.
What the exercises genuinely established, as opposed to what they are often said to establish, is a set of unresolved dependencies: fuel supply for standby generators, telecommunications that work without commercial power, spares that do not exist, and mutual-aid arrangements that assume the neighbour has capacity to spare. The GridEx VIII report of March 2026 grouped these under communication and collaboration, and its recommendations are procedural rather than technical. Whether that translates into a fortnight or a month in a real event depends on how much equipment fails, which is exactly the variable the exercises cannot fix.
Documented major blackouts, 1965 to 2026
Two things stand out in that table, and a third does not. Landmark events have become more frequent: roughly one per decade in the 1960s and 1970s, two in the 1990s, and several per decade after 2000. Average duration has also drifted upward, though the evidence for this is weaker than the frequency trend, because definitions of a “major” event and reporting standards have changed over sixty years. What the table does not show is any simple trend in severity, and that is worth saying plainly: the sample is small, the events differ enormously in cause, and comparing a 1965 relay failure with a 2012 monsoon-driven collapse is not like for like
Survival advice has a poor reputation, partly because it is usually sold rather than explained and partly because it is framed around wilderness scenarios most people never encounter. A grid-down event is a municipal scenario. The environment does not change; the systems do. What a household needs is the ability to substitute, for a fortnight, functions that municipalities and markets normally perform invisibly.
Water. A person can go roughly three weeks without eating and about three days without drinking, and in heat the second figure falls. The planning number is one gallon per person per day for drinking and basic hygiene — twenty-eight gallons for a fortnight — but the figure misleads in both directions, because a domestic hot-water cylinder holds thirty to fifty gallons of drinkable water, a toilet cistern holds another three, and municipal pressure usually persists for a day or two, which is time to fill containers. Water from a hot-water cylinder should be drawn from the drain tap, allowed to cool, and disinfected if there is any doubt. Water in a toilet cistern is usually drinkable provided no chemical cleaner has been added; water in the bowl is not.
Disinfection needs more care than most guides give it. The standard field dose is two drops of plain, unscented household bleach per litre of clear water, or eight drops per gallon, using bleach of about five to six per cent sodium hypochlorite. Double the dose if the water is cloudy, and allow thirty minutes of contact before drinking. Bleach sold as “concentrated” at around eight per cent needs proportionally less, and bleach loses strength as it ages, so the label and the age of the bottle both matter. Household bleach must be plain: nothing scented, nothing thickened, nothing with added detergent.
Temperature. Extreme heat and cold account for much of the illness and death in prolonged outages, though the proportions vary with climate and season, and the two cases are not symmetrical. Cold kills slowly and indoors; heat kills faster and falls hardest on the elderly, particularly in flats where cross-ventilation is theoretical. Useful preparations are unglamorous: sleeping bags rated for the actual climate, layers, a carbon-monoxide alarm, and a small indoor-rated propane heater used according to its instructions. A tent pitched indoors raises the temperature of the space around it, and one room can be closed off and occupied rather than the whole house heated.
Sanitation. Waste that cannot leave a building becomes an odour, then a hygiene problem, then a disease vector, and the problem usually arrives around the fourth day. A five-gallon bucket, a supply of bags, and a covering of sawdust or earth handles it, and separating solid from liquid makes the arrangement far more manageable. Hand-washing with stored water and soap matters more than any other single measure, and it is the one most often skipped when water is heavy and scarce.
Medication. Insulin that is already in use can usually be kept at room temperature for up to twenty-eight days, depending on the product, but unopened supplies should be refrigerated where possible; freezing damages it, and heat and direct sunlight shorten its life. Oxygen concentrators need electricity, which means a battery or a small generator. Dialysis is a three-times-weekly dependency with no home substitute for most patients, and dialysis units draw heavily. CPAP machines, nebulisers, blood-pressure monitors and the routine prescriptions that expire on a fixed date rather than a convenient one all sit inside the outage rather than outside it. Paper copies of prescriptions, a written medication list and a fortnight’s buffer of anything essential is a larger intervention than it sounds, and any household managing a chronic condition should confirm the details with its own clinician rather than rely on general guidance.
Everything beyond those four is logistics, and the useful way to think about it is by dependency rather than by category.
- Fuel. Petrol pumps need power, so stored quantity and a way to move it matter. Household generators consume between half a gallon and a gallon an hour, which means a five-gallon can lasts less than a working day. Stabiliser extends petrol storage to about a year; diesel stores longer; propane stores indefinitely and does not gum carburettors. Petrol should be kept in approved containers away from ignition sources, and generators must run outdoors, never in a closed garage, because carbon monoxide is invisible and the exhaust is lethal.
- Cooking. A camp stove, adequate ventilation and a stock of fuel. A charcoal grill works outdoors. An open fire indoors works only if the flue actually draws, and even then it needs ventilation and an alarm; a blocked or poorly maintained chimney can fill a room with smoke and carbon monoxide while appearing to work.
- Light. Head torches beat hand torches because they free both hands, and LED efficiency means batteries last. Candles are pleasant and dangerous; a candle knocked over in a dark house is a real fire risk.
- Communication. Mobile towers carry four to eight hours of battery before needing refuelling, so the useful window is short. A battery or hand-crank radio tuned to a national broadcaster is the most reliable information source in a wide-area outage. Licence-free handhelds cover a neighbourhood; a licensed amateur operator covers more.
- Cash. Small denominations, because nobody can make change when the till is a biscuit tin. Card terminals, cash machines and bank branches all depend on the same network, and payroll depends on the same banks.
- Transport. Signals go dark, so intersections become four-way stops and some drivers will not know the convention. Trams and metros stop. Electric vehicles become immobile once the battery runs down unless there is generation on site, though a charged EV can also serve as a domestic power bank for days with the right equipment.
Food storage is where expectation and reality diverge most. A refrigerator keeps food safe for about four hours if the door stays shut; after that, perishables that have spent more than two hours above about four degrees Celsius should be discarded, which is a stricter rule than most people apply. A full freezer holds temperature for about forty-eight hours, a half-full one for twenty-four, and frozen food can be refrozen if it still contains ice crystals or has stayed at or below four degrees. A fridge thermometer removes the guesswork, and the correct response to a thaw is to cook what thawed first and eat it first. The real answer to food security is shelf-stable stock — rice, pulses, tinned goods, oil, salt, sugar — plus a rotation habit that stops the stock becoming archaeology.
Three documented events show how differently the social dimension plays out, and none of them proves anything about human nature. In New York on 13 July 1977, darkness coincided with a heatwave and a fiscal crisis, and roughly sixteen hundred shops were looted with nearly four thousand arrests. Across a larger and wealthier area on 14 August 2003, looting was almost an afterthought and the dominant memory is of strangers directing traffic at dead intersections. In Texas in February 2021, the blackout arrived with freezing temperatures, burst pipes and a simultaneous gas-supply failure; the state’s official death toll was at least two hundred and ten, with independent analyses higher, and the causes were overwhelmingly thermal and cardiovascular rather than social.
Days three through fourteen are the part that resists preparation, because improvisation exhausts itself before anything is rebuilt. Three things make the period survivable. Knowing neighbours is the first, since most serious problems — a broken generator, a medical need, a shared water source, a security rotation — are solved socially rather than individually. A routine that is not merely waiting is the second, because morale depletes like any other resource. The third is having accepted the situation in advance, which sounds trivial and is not: people who spend the first week expecting the lights to come back suffer more than those who do not.
The pulse arrives in three acts, and conflating them causes most of the confusion about the threat. The first, called E1, is a spike of electric field lasting nanoseconds to microseconds, produced when gamma rays from a high-altitude burst strip electrons from air molecules and those electrons are deflected by the Earth’s magnetic field. The second, E2, lasts microseconds to about a second and resembles a close lightning strike, which is why ordinary surge protection sometimes copes with it. The third, E3, unfolds over seconds to minutes and matters most for infrastructure: a slow magnetic perturbation, functionally identical in effect to a geomagnetic storm, that drives quasi-direct currents through long conductors.
Simplified accounts often say that E1 kills electronics and E3 kills transformers. That is a useful shorthand and a slightly misleading one. Whether a given piece of equipment fails depends on field intensity, on how the equipment is coupled to the field, on the length and orientation of connected conductors, and on whatever protection was built in. Equipment in a shielded enclosure with short cable runs may be untouched; equipment attached to a long overhead line may not. The shorthand describes a mechanism, not a guarantee.
The empirical base is thin and old, which is part of why the threat is under-argued rather than over-argued. Starfish Prime in July 1962 produced effects at a distance nobody had predicted: streetlights failed in Hawaii, some fifteen hundred kilometres away, and several satellites were damaged. The Carrington event of 1859 lit auroras near the equator and set telegraph offices alight. A storm in May 1921, remembered as the New York Railroad Storm, induced currents strong enough to cause fires in railway signalling equipment. The storm of March 1989 collapsed the Hydro-Québec system in ninety seconds and left six million people without power for nine hours, damaging a transformer in New Jersey and another in the United Kingdom. The Halloween storms of October 2003 damaged transformers in Sweden and South Africa. On 23 July 2012 a coronal mass ejection of Carrington-class intensity crossed the Earth’s orbit and missed by about nine days. A study published that year in the journal Space Weather put the probability of a Carrington-class event within a decade at roughly twelve per cent, an estimate that has now had a decade in which to be wrong.
The congressional EMP Commission, chaired by William R. Graham, delivered reports in 2004, 2008 and 2015. Its central finding has not been refuted, though it has been argued with. A high-altitude burst over the continental United States could damage the grid badly enough to produce a blackout measured in months rather than days, and in that circumstance the commission concluded that nine out of ten Americans could be dead within a year. Two caveats belong with that number. It assumes a worst-case burst, a long outage and no effective improvisation. And it is a modelling result, not a record. A past chairman of the Federal Energy Regulatory Commission put the physical version of the same problem in a sentence worth remembering: attacks on fewer than a dozen major substations could produce protracted, widespread blackouts.
What follows is a list of ten effects, ranked by how badly each one disrupts ordinary life rather than by how dramatic it sounds. Each entry carries a rough confidence marker.
1. Transformer damage (high confidence on mechanism, low on quantity). The E3 wave and its geomagnetic twin push direct current through transformer windings, saturating cores and causing localised overheating. Because a unit that survives may fail on re-energisation, damage often reveals itself late. With roughly two thousand large units in the United States, a spare ratio in the low single digits and lead times past a hundred and sixty weeks, simultaneous damage to a hundred units becomes a multi-year reconstruction programme. How many units would actually fail in a given storm is genuinely disputed; utilities have argued that the worst-case literature overstates the risk, and the 1989 and 2003 storms caused less fleet damage than some predictions implied.
2. Loss of timing (high confidence). Almost nothing in the modern economy keeps its own time. Financial exchanges, mobile networks, substation automation and data centres derive clocks from GPS, and GPS satellites sit directly in the E1 environment. Losing the reference clock does not stop electricity, but it corrupts transactions and logs and scrambles the sequencing that distributed systems use to agree on what happened and in what order.
3. Water stops moving (high confidence). Treatment works, borehole pumps, booster stations and sewage lift stations need continuous electricity. The reservoir is full; the machinery that moves it is not. Waste that cannot be lifted flows where gravity permits and backs up where it does not.
4. The cold chain breaks (high confidence). Refrigeration is the least romantic and most consequential technology in the food system. Meat, dairy, produce and frozen goods move through chilled warehouses and trucks, all of which need power, and the chain has very little buffer. Insulin, vaccines and blood products sit in the same category.
5. Hospitals exhaust fuel (high confidence). Hospitals are among the best-prepared institutions in any society, and the preparation is finite: generators holding a few days of fuel, deliveries that depend on pumps and trucks, and staff who must reach work through dark streets. Dialysis, surgery, imaging and intensive care become scheduling problems with no good solution.
6. Nuclear plants lose offsite power (high confidence). A shut-down reactor still generates decay heat and still needs pumped cooling, supplied from the grid or from on-site diesel generators. Fukushima Daiichi in 2011 was, in part, a story about diesel generators that were flooded — an offsite-power-loss scenario in all but name. Spent fuel pools on the same sites carry the same dependency.
7. Money stops circulating (moderate confidence). Cash survives a pulse; payment terminals do not. Banks, cash machines, card readers, payroll systems and clearing houses all live on networks, and networks need power and timing. Within days the economy reverts to whatever physical currency people happen to be carrying, and the informal economy that forms around it is fast, local and unregulated.
8. Substitute technologies fail too (moderate confidence). Rooftop solar with a battery is genuinely useful in an outage, but most grid-tied inverters shut down when the grid does unless they have islanding capability and a transfer switch. Electric vehicles become immobile when they run out and cannot be refuelled from a can. Modern cars carry dozens of microprocessors, and while many will survive, the ones that do not become parked furniture.
9. Communications fail in sequence (moderate confidence). Mobile networks fail first, as towers exhaust their batteries. Fibre backbones fail next, because the amplifiers along them need power even though the fibre itself does not. Landlines survive longest where they still exist, since old copper pairs carry their own power from the exchange.
10. The sky changes (high confidence, low consequence). A geomagnetic storm can produce auroras at latitudes that have not seen one in living memory. Visibility of an aurora, however, says nothing about whether the grid has suffered damage; the two are related but not equivalent.
Taken together, the honest summary is this. The mechanism of an electromagnetic pulse is well understood and has been observed at small scale. The consequences for a continental grid are modelled rather than observed. The modelling has been done by serious people, reviewed and repeated, and it keeps arriving at the same order of magnitude. That is not proof. It is the best available basis for planning.
Four things can be stated with reasonable confidence. The grid is a tightly coupled system with declining margin, and it has failed at continental scale several times in living memory. Damage to large transformers is the binding constraint on recovery, because the units are bespoke, the spare pool is thin and the lead times are now measured in years. There are at least four credible ways to cause such damage, and three of them have been demonstrated in the field. A prolonged outage propagates into water, sanitation, medicine and food in ways that are well documented and only partially rehearsed.
Three things remain open. The first is quantity: how much equipment would fail in a given event, which is the difference between an unpleasant fortnight and a bad year. The second is timing: whether a serious event arrives as a cyber operation, a physical strike, a solar storm or an accident, and whether any of them coincide with a period of low spare capacity. The third is behaviour: how institutions and households actually respond, which no exercise can fully predict because exercises have observers.
Two further points deserve care, because both are commonly overstated.
That blackouts have become more frequent does not by itself prove they will become more severe. The frequency trend is reasonably supported by the record since the 1960s, though reporting standards have changed. The severity trend is weaker, resting on a small sample of heterogeneous events, and anyone who claims a clear direction of travel is extrapolating.
That the EMP Commission estimated nine deaths in ten does not mean nine deaths in ten should be expected. The figure comes from a specific scenario — a worst-case burst, a year-long outage, an economy unable to substitute — and it was produced by a commission with a mandate to characterise risk. Graham’s own framing, that nine out of ten would be dead if the power stayed out for a year, is deliberately conditional. It describes what happens when nothing goes right, and is offered as a planning envelope rather than a forecast.
What the drills, the history and the physics have in common is narrower and more useful than catastrophe. They all describe a system in which the failure mode is ordinary. Nothing collapses dramatically; a sequence of manageable failures accumulates until the list of things that can be taken for granted is empty. In 2003 the trigger was a tree and a broken alarm. In 2021 it was cold weather and a gas system that could not keep up. In 2025 it was a voltage oscillation on a sunny afternoon. In each case the mechanism was mundane and the consequence was large.
The last ordinary Tuesday has not happened yet, and the useful preparation does not depend on knowing which Tuesday it will be. Water, warmth, sanitation, medication, fuel, a radio and neighbours cover the great majority of what a fortnight without power actually demands, whether the cause turns out to be a sniper, a worm, a sunspot or a mis-set relay.
- 2025 Iberian Peninsula blackout — background and timeline: https://en.wikipedia.org/wiki/2025_Iberian_Peninsula_blackout
- What is and is not known about the Iberian blackout: https://www.carbonbrief.org/qa-what-we-do-and-do-not-know-about-the-blackout-in-spain-and-portugal
- EU technical experts on the Iberian blackout: https://www.euronews.com/my-europe/2025/10/03/obsolete-electricity-grid-triggered-blackout-in-portugal-and-spain-experts-reveal
- GridEx VIII lessons learned report, March 2026: https://www.nerc.com/globalassets/programs/electricity-isac/gridex/gridex-viii-lessons-learned-report-tlp_clear_final.pdf
- NERC 2026 Summer Reliability Assessment: https://www.nerc.com/globalassets/our-work/assessments/nerc_sra_2026.pdf
- NERC Level 3 alert on data-centre loads, May 2026: https://www.businessinsider.com/nerc-issues-alert-on-data-centers-threatening-grid-stability-2026-5
- NERC 2026 State of Reliability, forced outages at 9.2%: https://mgrid.org/2026/07/15/nerc-2026-state-of-reliability-forced-outages-hit-9-2-as-data-center-load-swings-top-1000-mw/
- New York Times Magazine on a national blackout, August 2026: https://www.nytimes.com/2026/08/18/magazine/national-blackout-power-electricity-outage.html
- Transformer lead times and supply deficit: https://www.industrialsage.com/power-transformer-lead-times-us-grid-shortage/ and https://www.powermag.com/transformers-in-2026-shortage-scramble-or-self-inflicted-crisis/
- EMP Commission report: https://www.empcommission.org/docs/A2473-EMP_Commission-7MB.pdf
- On the nine-in-ten figure: https://www.usni.org/magazines/proceedings/2023/february/emp-or-solar-incident-could-result-blackout-warfare
