2Nov

The Cascade: Anatomy of a Compound Crisis

Posted by: CyberSecurityChief Categories: Active Cyber Defense Articles Intel-Based Defenses Spotlight - Cybersecurity News & Events
No comments

A follow-up to “The Tangled Web: How Today’s Threats Feed Each Other.”

In my last post, I argued that today’s threats are not separate problems but a web, and that we are thinning out the defenders at the moment the threats converge. Arguments like that can feel abstract. So this time I want to make it concrete: one shock, traced step by step, as it moves through the systems we depend on.

The scenario is a Chinese blockade of Taiwan. I chose it because the U.S. intelligence community treats it as one of the most consequential risks we face, and because it touches nearly every strand of the web at once: chips, minerals, medicines, cyber, space, markets, and politics.

A few ground rules. This is an illustration, not a prediction. The intelligence community assesses that China’s leaders do not currently plan to invade Taiwan in 2027 and prefer to achieve their goals without force. The timeline below is invented, and real events would unfold differently. But each link in the chain is drawn from public government assessments, congressional testimony, and real events we have already lived through. Nothing here requires imagining a capability that does not already exist. What it does require, as the 9/11 Commission put it, is imagination.

The starting conditions

A crisis is shaped as much by the country it lands on as by the shock itself. So before the first ship moves, consider where we would start if this happened in early 2027:

  • The rare earth truce has just run out. The latest extension of China’s suspended export controls expires January 10, 2027, and the original 2025 licensing controls never went away.
  • Our medicine depends on the other side. The United States makes about 12% of its own drug ingredients, and roughly 90% of the world’s antibiotic ingredients come from China. More than 200 drugs are already in shortage.
  • The infrastructure defenders are mid-rebuild. CISA lost about a third of its staff and is only beginning to rehire, and half of its 10 regional offices are led by acting directors. Mandatory incident reporting under CIRCIA is still not in force. Federal support for the local-government warning center has ended. The law protecting threat-data sharing expires in mid-December 2026, so unless Congress acts it will have lapsed again. And threat intelligence is unevenly spread: defense contractors get it through DIBNet, big banks through FS-ISAC and private vendors, while small utilities and county governments get far less.
  • GPS runs on its old ground system, with the modern replacement cancelled and no national backup.
  • Adversaries are already inside. The intelligence community says China has pre-positioned in U.S. critical infrastructure for use in a conflict.
  • There is little fiscal room. Federal debt is about the size of the whole economy, interest costs top a trillion dollars a year, and households owe nearly $19 trillion.
  • Trust is thin. Each party believes the other is trying to rig the system, and confidence in institutions, including public health, is split along party lines.

The economic stakes are enormous on their own. Bloomberg Economics estimated that a one-year blockade of Taiwan would cut global GDP by about 5% and U.S. GDP by about 3%; an outright war would cost roughly $10 trillion. Taiwan holds about two-thirds of the world’s advanced chipmaking capacity. But those models measure trade and output. They do not capture what happens when the shock hits fragile systems, a shrinking defense, and a divided public all at once. That is what the rest of this post tries to trace.

Hours 0–24: The blockade begins

Hour 0. Beijing announces a “customs quarantine” around Taiwan. It is not called a blockade, and no shots are fired. Chinese coast guard ships begin stopping vessels bound for Taiwanese ports. The framing matters: by avoiding the word “war,” Beijing makes it harder for Washington and its allies to agree on how to respond.

Hour 2. Shipping companies and insurers do what they always do when risk spikes: they pull back. Insurance rates for the region jump, and container lines begin rerouting or holding ships. A large share of the world’s container traffic moves through the waters around Taiwan, so delays start rippling through global schedules immediately.

Hour 4. Beijing’s commerce ministry announces that, “for national security reasons,” exports of rare earths, rare earth magnets, and a list of pharmaceutical ingredients to the United States and allied countries will require new reviews. Shipments already in progress stop at the docks. No one is told how long the reviews will take.

Hour 6. Markets open in Asia, then Europe, then New York. Chip stocks collapse. Investors rush into some assets and out of others, and borrowing costs swing wildly. Retirement accounts lose a meaningful share of their value before lunch.

Hour 10. Strange problems begin surfacing in the United States. A logistics system at a major West Coast port goes down. A regional utility reports unexplained outages. A handful of water systems report control problems. None of it is catastrophic, and it is not immediately clear whether any of it is connected. That uncertainty is part of the design. It is the kind of disruption the threat assessment warned about when it said adversaries have pre-positioned inside U.S. infrastructure. Washington learns of it piecemeal. The rule that would require operators to report major incidents to CISA within 72 hours is still not in effect, so word arrives through news reports, security vendors, and phone calls between people who happen to know each other.

Hour 14. Ships and aircraft across the western Pacific report GPS jamming and spoofing. Commercial pilots switch to backup navigation. Shipping slows further.

Hour 18. Social media fills with claims, some true and many not. A convincing video appears to show a U.S. official announcing a draft. Another claims a major bank has frozen withdrawals. Gas stations in several cities see lines, recalling the panic after the Colonial Pipeline shutdown.

Hour 24. In Washington, the National Security Council is meeting around the clock. On paper, the machinery is clear. Under PPD-41, CISA leads the response to protect the systems that were hit, the FBI leads the hunt for the attackers, and the intelligence community supports both. The National Response Framework brings in FEMA, the sector agencies (Energy for the grid, EPA for water, HHS for hospitals), and the states. But the plan runs on people. Officials are trying to answer basic questions: Which outages are attacks? Which companies have been hit? Who knows whom at the port, the utility, the hospital chain? In half of CISA’s regions the director is acting, and many of the analysts who spent years building trust with local operators are gone. The calls that matter most are made person to person, and fewer of those people are still in place.

Days 2–7: The first cascades

Day 2: Ports and freight. The port logistics outage takes days, not hours, to fix. Containers pile up. Trucking and rail schedules that depend on the port fall behind. Retailers and manufacturers that run on just-in-time inventory start warning of delays. The threat assessment’s phrase for this kind of hit to transportation was “significant but recoverable.” Recoverable is not the same as painless.

Day 3: Power and water. The regional utility restores most customers, but some areas see rolling outages. Hospitals switch to generators, which typically carry fuel for hours to days, not weeks. A few water systems issue boil-water notices as a precaution. Small utilities, the ones least able to afford security staff, are the slowest to diagnose what went wrong. Many of them used to get warnings and help through the state and local warning center whose federal funding was cut. The contrast is stark. A large bank hears early through FS-ISAC and its private security vendors. A defense contractor gets indicators through DIBNet. The rural water district learns from its own failing pumps.

Day 4: Hospitals. Ransomware gangs, some working with or tolerated by hostile states, see opportunity in the chaos. Several hospital systems are hit. Emergency rooms divert ambulances, as they did in six states during the 2023 Ardent attack. Electronic records go dark. Pharmacies tied to the affected systems cannot fill prescriptions.

Day 5: The information war. The flood of false claims grows. Real outages are blamed on the wrong causes. Fake “official” messages tell people in one city to evacuate and in another to stay home. Because real evidence can now be dismissed as a deepfake, genuine government warnings are met with suspicion. After Hurricane Helene, false rumors led to threats that paused FEMA work in parts of North Carolina. Something similar happens here, on a larger scale.

Day 6: Timing and navigation. GPS jamming spreads beyond the Pacific to areas near U.S. bases and some domestic airspace. Most critical systems keep running on internal clocks for a while, but drift starts to matter for some cell networks, power grid measurements, and financial timestamps. There is no national backup to switch to.

Day 7: The first week ends. No single disaster has occurred. The grid is mostly up, the ports are slowly moving, and most hospitals are open. But the country has absorbed a dozen simultaneous hits, each one manageable alone, and the public is frightened, angry, and unsure whom to believe. And the deeper shortages have not even arrived yet.

Weeks 2–6: Shortages spread

The first week was about disruption. The next month is about depletion, as inventories that were never built for a long interruption begin to run out.

Medicines. Hospitals and wholesalers hold weeks of stock for many generic drugs, not months. As Chinese ingredient exports stall, and as Indian manufacturers that depend on Chinese ingredients slow down, shortages spread from the 200-plus drugs already scarce to common antibiotics, heart medications, and sterile injectables. Hospitals start rationing. Pharmacists triage. The former official’s warning to the Senate, that hospitals could stop functioning within months, stops sounding hypothetical.

Chips. Taiwan’s factories cannot ship. Carmakers, appliance makers, and medical device companies that remember 2021 know what comes next. Production lines idle. Prices for electronics spike. The AI build-out stalls, because the most advanced chips come overwhelmingly from Taiwan, and the data centers being fought over in local zoning meetings suddenly have nothing to put in them.

Magnets and minerals. Defense contractors and manufacturers burn through stockpiles of rare earth magnets. Production of drones, missiles, and electric motors slows just as the military needs them most. The Pentagon’s investments in domestic mining are real, but a mine and refinery take years to build, and a crisis is measured in weeks.

Prices and jobs. Shortages push prices up quickly. Shipping costs, insurance costs, and energy prices feed into everything else. Companies facing lost production cut hours and lay off workers. Firms already shrinking their staff with AI use the moment to cut deeper and call it a crisis response.

Households. This is where personal debt turns a shock into a crisis for families. Millions of households were already one missed paycheck from trouble, with credit card delinquency near record levels among young adults and student loan garnishment underway. Layoffs and rising prices push many of them over the edge. Missed payments climb. Lenders tighten credit just as families need it.

By week six, the country is not in collapse. But almost every system described in the last post is under stress at the same time, and each one’s problems are making the others worse.

Months 2–6: The political test

A long crisis eventually becomes a test of government and of the public’s faith in it. This is where the web pulls tightest.

The money. Congress needs emergency funding for defense, for hospitals, for displaced workers, and for companies that lost their supply chains. But the government enters the crisis with debt about the size of the entire economy and interest costs already above a trillion dollars a year. Investors demand higher interest rates to keep lending. Every new dollar of relief costs more to borrow, and a government spending more on interest has less for everything else. In 2008 and 2020, Washington could borrow its way through. This time the cushion is much thinner.

The blame. In a less divided country, an external shock might bring people together, as 9/11 briefly did. In a polarized one, the first question is often whose fault it is. One side blames years of dependence on China and the policies that allowed it. The other blames the current administration’s response and the cuts to agencies like CISA. Both have some evidence. Both are louder than the facts.

The neighbors. Crises with a foreign enemy have often turned into suspicion of fellow citizens, from the internment of Japanese Americans in World War II to the wave of harassment of Asian Americans during COVID. Chinese American and Taiwanese American communities, whatever their views, face that risk again. Foreign disinformation campaigns, which the threat assessment warns about, will try to make it worse.

The streets. Rising prices, empty pharmacy shelves, and layoffs supply the anger. France showed this fall how quickly a cost-of-living revolt can turn violent and attach itself to other grievances. Protests here start over prices and shortages, then fracture along the lines that already divide the country.

The trust. By month six, the outcome depends less on the original blockade than on whether Americans still believe their institutions are telling the truth and doing their jobs. If people trust public health guidance on rationed drugs, accept official explanations of outages, and believe relief is being distributed fairly, the country can absorb a great deal. If they do not, every new problem becomes a reason to believe the system is rigged, and the crisis feeds itself.

The blockade might end through negotiation, or drag on for a year. Either way, the damage that lasts longest may not be economic. It may be the trust that was spent and not rebuilt.

Where the chain could break

Step back from the timeline and the scenario turns out to be a chain, with each link pulling the next. That is bad news and good news. Bad, because a shock in one place travels everywhere. Good, because cutting any single link weakens everything that comes after it.

None of these defenses is exotic. Most were recommended after 9/11, COVID, or Hurricane Helene, and several were built and then allowed to erode. The difference between the scenario above and a survivable crisis is mostly whether they are in place before the first ship is stopped.

The choice in front of us

Nothing in this scenario required a new weapon, a secret capability, or a single catastrophic failure. It required only that a set of weaknesses we already know about be tested at the same time. The ports, the utilities, the hospitals, the GPS timing, the medicine supply, the magnets, the debt, and the distrust are all real today. What turns them from separate problems into a cascade is the connections between them, and the absence of anyone positioned to watch and manage those connections as a whole.

The hopeful part is the same as in the last post: because the links are connected, cutting any one of them weakens the whole chain. A hospital with a backup supply of antibiotics, a utility that can run manually, a GPS backup that already exists, regional cyber coordination staff rebuilt with their relationships intact, threat data that reaches the small utility and municipality as well as the defense prime, a stockpile of magnets, a government with some fiscal room, and a public that still trusts its institutions would each turn a cascade into a series of survivable problems.

Every one of those defenses takes years to build. A crisis gives you days. The 9/11 Commission’s warning was not that we lacked information. It was that we failed to imagine how the pieces fit together, and failed to act before the pieces came together for us. We do not have to repeat that mistake.

Sources

This scenario draws on the sources cited in The Tangled Web, plus: