THIS WEEK’S SIGNAL
Three Clocks, One Decision
“An attack does not decide how long a service is out. It shows whether
the community can reroute, has to rebuild, or is simply exposed. In the
worst case, all three.”
On 1 September 2026 the transmission operator 50Hertz said that the general electricity supply had at no time been impaired. The next day Amprion, the transmission operator in the Rhineland, said the same of an incident near one of its own installations. Just under eight months earlier, on a January morning in Berlin, a distribution operator could say only that it was still unclear when power would be restored. The two substation attacks came about 12 hours apart on 1 September, improvised explosive devices at a substation in Brandenburg in the morning and, that evening, a short circuit at Bergheim near Cologne that investigators put down to a deliberate act. A suspect was arrested on 8 September. Weeks earlier, data had flowed out of the Berlin state government's own network in a cyber attack, and when an extortion deadline expired the material was released publicly.
From these events, we find that an operator, a city administrator, and a municipal authority are all committed to one of three outcomes before anything happens. Reroute, rebuild, or expose. Which of the three a service faces is not a reading of how bad the attack was. This brief covers how long a service stays down and what decided that. It does not cover who attacked, what the damage cost, or whether any of it could have been stopped on the day. This edition follows three countries, three kinds of attack, and three different recovery timelines. The “clocks”, as we call them here, measure how long it takes to restore critical services to an affected population. None of these outcomes was determined on the day of the event. Each was decided in the years before, in the mundane decisions of services, specifications, and contracts.
What we're reviewing in this issue.
What set the recovery clock in the attacks on European infrastructure since 2021, from two substations in one day to a capital city that lost control of its data, reviewed case by case for how services were restored.
The Berlin data theft, where there was no recovery clock at all, because the timeline and publication belonged to the attacker, not the city.
Why the decision logic for who is inside the protection regime actually measures something else, where its requirement came from, and the three-way decision a community makes long before an attack arrives.
INTELLIGENCE BY CRISIS LAB · ISSUE 007 · THREE CLOCKS, ONE DECISION
Two substations attacked in a day. A capital city unable to say when power would return. A government's data released on an attacker's schedule. Across eight attacks on European infrastructure, every recovery timeline was set before the first strike. Reroute. Rebuild. Expose. Which clock is your community on?
CURATED BRIEFINGS
German Power Grid Under Fresh Sabotage Attack, Police Say
Reuters · September 2, 2026
The second attack in 24 hours, investigated as Berlin warned of a growing hybrid warfare threat, with RWE confirming five generating units knocked out at two coal-fired plants. The two statements at the heart of this issue, supply unaffected and capacity offline, appear here side by side.
Ultimatum abgelaufen: Daten nach Angriff auf Berliner Landesnetz veröffentlicht
tagesschau · September 5, 2026
The Rhysida group published the stolen material on a Friday afternoon after its deadline expired and the Senate refused to pay: parts of personnel files, identity documents, and salary statements among them. The case this issue files under the third clock, the one with no recovery time, because the release date belonged to somebody else.
Directive (EU) 2022/2557 on the resilience of critical entities
EUR-Lex · December 2022
The Critical Entities Resilience Directive, including the Article 7 significance criteria that count the users relying on the service, the entity's market share, and the availability of alternative means. The sorting rule this issue sets against the three clocks.
Drucksache 558/25 (Beschluss): Stellungnahme des Bundesrates
Bundesrat · November 21, 2025
The chamber's move to replace the 500,000-inhabitant threshold in Germany's KRITIS transposition with 150,000, on the record that the majority of the population is supplied by operators below the line and that the higher figure rests on a 2015 assumption that was never empirically proven.
Conti cyber attack on the HSE: Independent Post Incident Review
PwC, commissioned by the HSE Board · December 2021
The full review of the ransomware attack on Ireland's health service: an operator classified as critical infrastructure under the EU's security directive, and a recovery that still ran for over four months. The strongest counter-example this issue walks through.
LOOK AHEAD
IET Cyber Security for Critical Industries 2026
15-16 September 2026 · London, UK. Opens next week: two days on securing operational systems across critical industries, the same systems this issue counts as sorted but not measured.
Critical Infrastructure Protection & Resilience Europe (CIPRE) 2026
20-22 October 2026 · Brussels, Belgium. Governments, operators, and agencies on securing Europe's critical infrastructure; early-bird rates close September 20.
9th European Civil Protection Forum
3-4 November 2026 · Tour & Taxis, Brussels, Belgium. The flagship gathering of the European civil protection community, held every two years, this edition under the theme "Preparing today, ready for tomorrow." Registration is open.
THIS WEEK FROM CRISIS LAB
Course: Marine Transportation System (MTS) Recovery and Resilience
When a port closes, everything downstream starts counting. Cargo misses its window, terminals back up, and the question that lands on the planner's desk is always the same: how long until the system comes back? Most continuity plans answer that question with an assumption. This course replaces the assumption with an estimate you can defend. Across five modules, you move from disruption mechanics to recovery planning: how disruptions propagate through the maritime transportation system, how to sequence recovery when channels, terminals, and cargo compete for the same hours, and how seasonal pressure changes port recovery operations.
Podcast: When Disasters Become Battlefields: Disinformation as a Gray Zone Weapon
What if someone is actively working to make your disaster worse? Not by intensifying the physical impact, but by flooding the information space with narratives designed to make the response fail. In this episode of the Crisis Lab Podcast, Kyle King takes disaster disinformation seriously as what it has become, not a communications problem but a gray zone weapon, and works through what that shift demands of the people running the response.
Listen on Spotify, Apple Podcasts, or Crisis Lab
You’re missing something…and it might be a problem.
Right now, a control room somewhere is drafting the sentence that says the supply was never affected. The sentence may be accurate, and it may describe only the fastest of three clocks while the slower ones keep running. That is the nature of this work: the signals that matter rarely arrive as headlines, and they never arrive on schedule.
You're busy. The feed is endless, the reports are long, and the one document that would change your planning is usually the one you didn't have time to read. Crisis Lab's job is to close that gap. Every day, our team tracks events, reads the documents, and talks with senior professionals across policy, security, defense, and crisis management, so what reaches you is already distilled: what happened, what it means, and what to watch next.
That's why we built Intelligence. Every issue gives you the full picture behind the newsletter: the complete analytical brief, every key judgment with its confidence level, the assessment that backs it, the toolkit that turns the analysis into action. Intelligence+ goes a level deeper, adding the exclusive debrief alongside every edition.
You make the decisions. We make sure you make them with your eyes open.
INTERNATIONAL CAREER OPPORTUNITIES
Role | Apply |
Program Manager I, RAPID Disaster Risk Reduction and Anticipatory Action | |
Resilience, Crisis Response, & Social Cohesion (Call for Roster) | |
Research Manager | |
Emergency Supply Chain Coordinator | |
Senior Preparedness and Response Officer |
Crisis Lab is the intelligence and education arm of Capacity Building International. Twice-monthly intelligence briefings for senior crisis management practitioners.