Cliff Notes – Serious vulnerabilities infrastructure
- Heathrow airport back open but still not fully operational.
- An electrical substation fire led to the shutdown of Heathrow Airport, resulting in over 1,000 flight cancellations and affecting approximately 200,000 passengers, underscoring the significance of critical national infrastructure (CNI).
- Heathrow’s reliance on a single power supply connection raises concerns about potential vulnerabilities, as a second connection would be prohibitively costly, despite the relatively low probability of such catastrophic incidents.
- MI5 oversees the security of national infrastructure, but the incident at Heathrow highlights broader vulnerabilities and the potential for malicious actors to exploit them, drawing attention to the need for enhanced protective measures.
- Hotels near the airport on Bath road all capitalised from the cancellations, with Holiday Inn charging 541 per night.
Heathrow airport back open – but at worst it points to serious vulnerabilities in UK infrastructure
After almost 24 hours closed heathrow airport is back open. After an electrical substation fire forced the entire airport shut down – with over 1,000 flights cancelled, others rerouted worldwide, and 200,000 passengers affected by the disruption.
More flights will hopefully be taking off and landing there in the next 24 hours, as the airport says it hopes to run a full service on Saturday.
The Heathrow closure on Friday really highlights the ‘critical’ part of critical national infrastructure (CNI) – the systems and facilities that are essential for society to function.
says there will be an investigation into how the fire started and Heathrow’s decision to close operations for the day.
Transport secretary Heidi Alexander says there will be an investigation and that counter-terrorism services will be involved because the fire happened so close to a critical infrastructure site.
At best it’s an embarrassment. At worst, it points to serious vulnerabilities across the country that could be exploited by bad actors.
Heathrow needs a lot of power and the bulk of this is supplied by a dedicated connection at the North Hyde substation – reflecting Heathrow’s critical status.
But that also appears to be the problem – because Heathrow requires so much power, having a second dedicated connection would likely be prohibitively expensive, especially for the low probability scenario of such a catastrophic fire. This is the first time this has happened in decades, after all.
“Fires like this are not common at all,” said Dr Robin Preece, a reader in future power systems at the University of Manchester. “If it just broke down without catching fire… you might never have noticed anything as we have sufficient alternative routes for the electricity to follow.”
But uncommon doesn’t mean impossible – and when infrastructure is critical, it’s supposed to be protected.
A chain is only important as its weakest link. The cost of having a whole extra power supply to run the airport just in case would cost huge amounts of money and resources for a privately-owned business like Heathrow.
MI5 in charge of critical infrastructure protection
The organisation ultimately responsible is MI5, through the National Protective Security Authority. This lists 13 national infrastructure sectors, from chemicals to nuclear, emergency services to food, space to water.
It’s a lot to look after – this map shows just some of the sites that would be considered CNI. Airports and power stations. Or the tubes that supply us with energy (gas and fuel pipelines) and internet (undersea cables).
- UK infrastructure
- Airports
- Sea Ports
- Train Stations
- Power Stations
- Fuel pipelines
- Undersea cables
Many of those risks are collected in the National Risk Register.
In 2023, the National Infrastructure Commission recommended to the government that it should set standards for some key sectors of infrastructure such as telecoms, water, transport and energy by 2025. But the Government has failed to act on any of them.
Measuring risk chances and impact
So an accidental fire or explosion at an onshore fuel pipeline is estimated to have less than a 0.2% chance of happening in the next two years but would have only a “moderate” impact, defined as between 41-200 casualties and/or hundreds of millions of pounds in economic losses.
A civil nuclear accident has a similar probability but would have a “catastrophic” impact, defined as the loss of more than 1,000 lives and/or an economic cost of tens of billions of pounds. Pandemics also meet the catastrophic impact threshold.
A regional failure of the electricity network, one due perhaps to “a specific power substation”, is listed as having a 1% to 5% chance of happening every two years, and a moderate impact. But this is what happened to Heathrow – and the impact doesn’t appear moderate at all.
Catalogue of vulnerabilities
The National Risk Register is sensible planning but it’s also a catalogue of vulnerabilities.
Accidents do happen, but so do attacks. It can be hard to tell the difference – and that’s the point of what are known as “grey zone” attacks.
For example, undersea cables keep unfortunately being cut, whether in the Baltic Sea or the waters around Taiwan.
Taiwan has accused China of doing this deliberately. China responded by saying that damage to undersea cables is a “common maritime accident”.
“Malicious actors see opportunities and vulnerabilities”, Marco Wyss, Professor of International History and Security at Lancaster University.
“And if you showcase vulnerabilities to such an extent as today, even if it wasn’t a malicious actor, it can give them some ideas.”
Heathrow airport uses as much energy as a small city, so it is not possible for it to have the back-up power by itself to run its operation safely.
A source at Heathrow said it did however have back-up options for certain key systems, but kickstarting the alternative power supplies for the whole airport took time.