An electrical substation fire and an entire airport shut down – with over 1,000 flights cancelled, others rerouted worldwide, and 200,000 passengers affected by the disruption.
The Heathrow closure on Friday really highlights the ‘critical’ part of critical national infrastructure (CNI) – the systems and facilities that are essential for society to function.
At best it’s an embarrassment. At worst, it points to serious vulnerabilities across the country that could be exploited by bad actors.
Heathrow first.
Heathrow needs a lot of power, the equivalent of a small town, and the bulk of this is supplied by a dedicated connection at the North Hyde substation – reflecting Heathrow’s critical status.
But that also appears to be the problem – because Heathrow requires so much power, having a second dedicated connection would likely be prohibitively expensive, especially for the low probability scenario of such a catastrophic fire. This is the first time this has happened in decades, after all.
“Fires like this are not common at all,” said Dr Robin Preece, a reader in future power systems at the University of Manchester. “If it just broke down without catching fire… you might never have noticed anything as we have sufficient alternative routes for the electricity to follow.”
But uncommon doesn’t mean impossible – and when infrastructure is critical, it’s supposed to be protected.
MI5 in charge of critical infrastructure protection
The organisation ultimately responsible is MI5, through the National Protective Security Authority. This lists 13 national infrastructure sectors, from chemicals to nuclear, emergency services to food, space to water.
It’s a lot to look after – this map shows just some of the sites that would be considered CNI. Airports and power stations. Or the tubes that supply us with energy (gas and fuel pipelines) and internet (undersea cables).
Many of those risks are collected in the National Risk Register. This plots the likelihood and the impact of a risk.
Measuring risk chances and impact
So an accidental fire or explosion at an onshore fuel pipeline is estimated to have less than a 0.2% chance of happening in the next two years but would have only a “moderate” impact, defined as between 41-200 casualties and/or hundreds of millions of pounds in economic losses.
A civil nuclear accident has a similar probability but would have a “catastrophic” impact, defined as the loss of more than 1,000 lives and/or an economic cost of tens of billions of pounds. Pandemics also meet the catastrophic impact threshold.
A regional failure of the electricity network, one due perhaps to “a specific power substation”, is listed as having a 1% to 5% chance of happening every two years, and a moderate impact. But this is what happened to Heathrow – and the impact doesn’t appear moderate at all.
👉 Listen to Sky News Daily on your podcast app 👈
Read more from Sky News:
How Heathrow closure ruined travel plans
What we know about shutdown as flights grounded
Catalogue of vulnerabilities
The National Risk Register is sensible planning but it’s also a catalogue of vulnerabilities.
Accidents do happen, but so do attacks. It can be hard to tell the difference – and that’s the point of what are known as “grey zone” attacks.
Follow our channel and never miss an update.
For example, undersea cables keep unfortunately being cut, whether in the Baltic Sea or the waters around Taiwan.
Taiwan has accused China of doing this deliberately. China responded by saying that damage to undersea cables is a “common maritime accident”.
“Malicious actors see opportunities and vulnerabilities”, Marco Wyss, Professor of International History and Security at Lancaster University, told Sky News.
“And if you showcase vulnerabilities to such an extent as today, even if it wasn’t a malicious actor, it can give them some ideas.”
Additional reporting by Sophia Massam, junior digital investigations journalist
