An old English proverb anchored in superstition from
ancient Greek and Roman beliefs is that bad luck always comes in threes, but
that does not mean bad luck was always random.
The United States has now experienced two debilitating,
unprecedented blackouts across critical infrastructure in two days. The timing
is almost too coincidental to be a coincidence – coming on the heels of the
removal of Jensen Huang as Nvidia CEO amidst an affair with a suspected Chinese spy,
widespread recriminations about chip exports to China, and demands for tighter
export controls and more hawkish policies against China.
Could China and other hostile foreign actors be targeting
U.S. infrastructure? It’s too early to know for sure, but the country deserves
far more transparent answers than we have received so far.
An extraordinary timeline, too coincidental to be a
coincidence?
At 3:54
p.m. ET on Friday, November 13, the Federal Aviation Administration
grounded every departing flight in America, “due to
extraordinary circumstances and for reasons of safety.” It was only the third
nationwide ground stop ever ordered. The first came on Sept. 11, 2001; the
second more than 20 years later, on Jan. 11, 2023.
Transportation Secretary Sean Duffy would say only that “a
communication issue” had struck every one of the 22 centers that guide
planes across the country, and that technicians were investigating. A
subsequent press conference by Homeland Security Secretary Markwayne Mullin did
little to reassure anyone, with no answers about what happened and little
reassurance that it would be fixable anytime soon, with airports sending
travelers home and communicating that flight cancellations would persist for
many hours at a minimum, if not days.
It was the second time in two days that critical
infrastructure the country cannot function without simply stopped, potentially
for very nefarious reasons. The day before, Microsoft’s Outlook, Teams and
Copilot went dark in 74 countries and stayed down for hours. Both blackouts
struck within a day-and-a-half of the most damaging China espionage story in
years.
Two blackouts, measured in billions in lost economic
activity and inconvenience
The last nationwide ground stop, in 2023, lasted about 90
minutes and still delayed
more than 10,000 flights and canceled 1,300. Friday’s lasted hours with no
resolution imminent on the horizon. At the four-hour point of this latest
ground stop, 10,243 flights were already delayed and 3,234 cancelled, with
flights grounded not only at single regional airports but across the entire
nation, suggesting systemic breakdowns rather than localized issues.
Microsoft’s failure began at 11:17
a.m. ET on Thursday and spread across 19
Microsoft 365 services. Within an hour, complaints about Outlook were
running at more
than 2,000 times their normal level. Microsoft counts more
than 450 million paid commercial seats, with many millions of those users
locked out entirely from their inboxes and other critical services.
The casualty list reads like a roll call of essential
services: the
U.S. House of Representatives was substantively incapacitated; a federal
appeals court that could not send or receive email; Britain’s
Parliament and its National Health Service, where the failure threatened
patients’ prescriptions; Australia’s
spy agency and federal police were sent offline as well.
When a botched CrowdStrike update crashed 8.5 million
machines in 2024, the Fortune 500 alone lost an
estimated $5.4 billion. One risk adviser already puts Microsoft’s bill in
the billions for Australia alone, not to mention the lost economic value in
the U.S. or the rest of the world. This was the first time in history so many
users were locked out for so long – with shifting and unsatisfactory
explanations. Similarly, this is the first time in global aviation history
where there has been a nationwide ground stop with no satisfactory, clear
explanation and immediate fix.
Reassurance first, explanation later does not work as a crisis playbook in these extraordinary circumstances. Microsoft wrote the playbook for false comfort.
For a full day it insisted there was “no indication” of malicious activity while its own bulletins showed it did not know what had broken. If it did not know for sure, then how could they know for sure there was no indication of anything malicious amidst shifting explanations?
First, it blamed elevated load, then servers
that had unexpectedly dropped out. It found no recent change that lined up
with the failure. Hours later, it was rolling
back a network change that did. Early Friday, engineers were still trying
to “pinpoint
the underlying cause of the traffic influx.”
Only on Friday afternoon did Microsoft name
a culprit: a flaw introduced during a network capacity upgrade, “not
related to cyber.” That sequence is as nonsensical as it is falsely
reassuring. No patient would trust a doctor who swears it is not an infection
before he can diagnose the fever. You cannot rule out what you cannot yet
explain, and nobody can feel particularly reassured from this disturbing
sequence of events and shifting explanations.
Suspicious timing and a 15-year track record
On Thursday morning, Nvidia, whose board failures we
dissected in Fortune this week, announced
the resignation of Jensen Huang, the chip industry’s loudest advocate for
selling to China, after he admitted an affair with a businesswoman U.S.
officials suspect of spying for Beijing. Beijing has been vocal in calling
it a smear amidst a rapid escalation of U.S.-China tensions. Lawmakers in both
parties are demanding testimony
and tighter export controls. Within three hours, inboxes went dark from
Capitol Hill to Canberra. A day later, planes stopped and were grounded.
Could that really be a coincidence?
Perhaps we are being too conspiratorial, but there is a
certain uncanny resemblance to Beijing’s favorite playbook, which is to divert
from negative news stories by shutting down internet services and diverting
public attention.
For example, in 2011, a petition to free Ai Weiwei got Change.org
knocked offline. In 2012, exposés of the family fortunes of Xi Jinping and
Wen Jiabao got Bloomberg and The New York Times blocked
in China and targeted by hackers. In 2014, as Hong Kong marched for
democracy, a newspaper and a voting site were buried under one
of the largest attacks the internet had ever seen. In 2015, China’s “Great Cannon”
hammered GitHub for days for hosting banned news. In 2019, Telegram
and the LIHKG
forum were swamped as Hong Kong marched again. In 2022, news of the
zero-COVID protests on Twitter drowned
in a deluge of spam. Maybe this pattern of untimely hacks was merely a
coincidence – or could it have been more than coincidence?
Microsoft knows this adversary better than anyone.
Hackers tied to Beijing tore
through its customers’ Exchange servers in 2021 and stole some 60,000 State
Department emails through its cloud in 2023, a breach a federal review board
blamed on a “cascade
of security failures” at Microsoft. Just three weeks ago, Microsoft itself
said a China-aligned group had turned AI agents loose on more
than 2,250 Microsoft 365 customers.
Is it time to buy home batteries, water tanks,
k-rations and porta potties?
Whatever the cause, the lesson is identical. Some cyber
experts are warning about potentially economically destabilizing cyberattacks,
with researchers warning that AI-enabled hacking is spreading like a virus:
attacks on previously unknown flaws have roughly doubled since capable
open-source models arrived.
U.S. agencies say China’s Volt Typhoon hackers have
already burrowed
into American communications, transportation, energy and water networks, in
some cases for five years, positioning themselves to disrupt them. They sat
inside one small Massachusetts electric and water utility for more
than 300 days. If the inbox and the skies can go dark on consecutive days,
why not the grid, or the tap? Is it time for every business and household to
buy storage batteries, water tanks, MREs and porta potties?
Of course, regardless of whether this was a Chinese or
foreign malevolent actor attack, or whether it was merely the coincidental
degradation of antiquated and outdated infrastructure systems, all of this
takes place against the backdrop of the substantive hollowing out of U.S.
government counterintelligence and cyber capabilities, with
more than 1,500 special agents having departed the FBI and
almost 1,000 staffers—about one-third of the workforce—have left the
Cybersecurity and Infrastructure Security Agency (CISA) since
Trump returned to office. Domestic commentators point out that this comes
despite $1 trillion in Pentagon
spending; and that the upgrades needed for aviation infrastructure would have
cost $40 billion.
Legendary Intel CEO Andy Grove’s renowned book was titled, “Only the
paranoid survives”, suggesting paranoia is not entirely unwarranted. The poet
Delmore Schwartz said in 1966 that “even paranoids have enemies.” And everyone
from Joseph Heller to Henry Kissinger to Kurt Cobain has repeated some
variation of “just because you’re paranoid, doesn’t mean they’re not out to get
you.”
Sometimes, superstition that seems delusional can connect
authentic facts. And sometimes it behooves us to look at “worst case” scenarios
in an effort to avoid them.
This story was originally featured on Fortune.com








