Britain is preparing for three days without essential services. The Pentagon is planning for ninety. Add Iran, Ukraine, cyberattacks, AI and nervous financial markets, and I think we're overlooking the possibility that several unrelated problems could collide.

By Tim Lord | Opinion | 3 November 2026

The British government would like us to keep three days' worth of food and water, some cash, a torch and a wind-up radio in case something goes wrong.

Meanwhile, the Pentagon is working on plans for American military bases to operate independently for ninety days, including their own power supplies and, eventually, small nuclear reactors.

Three days for us. Ninety days for them.

I appreciate that an American military base has rather different requirements from my flat in Newquay. I'm not expecting to install a nuclear reactor in the kitchen. But the contrast caught my attention.

Britain isn't alone in its preparedness advice. European countries have been saying similar things and the Americans have been encouraging households to prepare too. There's nothing suspicious about getting ready for storms or power cuts. We should probably all be a little better prepared than we are.

It's the timing, alongside everything else that's going on, that interests me.

We've got the war involving America, Israel and Iran. Russia's continuing war in Ukraine. North Korean hacking operations. Chinese activity inside infrastructure networks. Electricity systems being attacked. European supermarkets discovering that somebody has remotely turned up their freezers. And some of the world's biggest technology companies spending extraordinary amounts of money on AI, just as investors start questioning whether those investments will pay off.

I don't think all of these things are part of some enormous secret plan.

I do think we're underestimating how easily several unrelated problems could turn into one much bigger problem.

And I suspect governments are thinking about that rather more seriously than most of us are.

The war doesn't have to reach Britain

My original concern was Iran.

I've been following the possibility of further American military action after the US midterm elections, and I still suspect the Americans aren't finished. More American naval forces have been sent towards the region, the language from Washington keeps changing, and on 2 November US forces carried out limited strikes around Iran's Qeshm Island.

There are diplomatic efforts as well. A deal is still possible. I'm not pretending to know which way Trump will go.

But suppose the strikes intensify.

If I were looking at the situation from Iran's point of view, I wouldn't assume that the most damaging response would be trying to match American military strength aircraft for aircraft. I would be thinking about ways of making the economic consequences of the war uncomfortable for America and its allies.

That's how I see the strategic problem, not a claim that I know what Iran intends to do.

Electricity, communications, shipping, energy supplies and finance all depend on one another. Damage the systems people rely on, and the consequences can spread much further than the original attack.

Some of that has already happened. In March, Iranian strikes damaged Amazon Web Services facilities in the Gulf and disrupted cloud services. In October, Reuters reported statements from Iranian security officials about contingency plans involving undersea communications cables if major US–Israeli attacks resumed.

Those reported plans concern the Gulf, not an announced attack on Britain. But they show that the infrastructure behind our ordinary digital lives is now part of the conversation about war.

Then there's oil.

Disruption around the Strait of Hormuz has already made energy prices volatile. Higher oil prices don't just affect petrol. They filter into transport, food, manufacturing, deliveries and business costs.

You don't have to see a missile or lose power at home to feel the effects of an energy crisis. You might simply discover that everything has become considerably more expensive.

And that's before we get to the financial markets.

The internet has a postcode

There's an interesting connection close to home.

About twenty miles from where I live, near Bude in Cornwall, some of Britain's most important international submarine data cables come ashore. A parliamentary committee reported in 2025 that just two of those cables accounted for around 75% of the UK's direct transatlantic cable capacity.

That's not 75% of all the internet traffic in Britain. There are other routes, including through Europe. But it's an extraordinary concentration for a stretch of coastline most people associate with holidays.

I work with websites, software and servers, and I'm always slightly amused by how we talk about everything being in 'the cloud', as though that means it isn't anywhere in particular.

It is somewhere.

It's in buildings full of computers. Those buildings need electricity, cooling, communications equipment and people to keep them running. Data travels through actual cables, not some mysterious digital atmosphere.

The internet is resilient in many ways. Traffic can be rerouted, services can recover and there are multiple safeguards.

But those safeguards have limits. Particularly when several things go wrong at the same time.

That, for me, is the important distinction.

Conceptual artwork of a data centre, power substation, port and coastal homes connected by cables rising from the sea, with one cable breaking.
Conceptual artwork: the cloud depends on physical cables, power supplies and places.

Poland ought to have been a bigger warning

On 29 December 2025, attackers targeted Poland's energy infrastructure, including more than thirty wind and solar installations and a major heat-and-power facility.

Polish investigators described the operation as deliberately destructive. Fortunately, it didn't achieve the widespread outage intended.

But Britain's National Cyber Security Centre has now said that the UK and European partners attribute the attack to Russia's FSB, and that a successful operation could have left about half a million people without electricity.

Half a million people. In winter.

That's not some hypothetical argument about what might happen in 2030. Someone actually tried to interfere with infrastructure people depend on for heat and electricity.

And it wasn't Iran.

Russia is still fighting in Ukraine, and the argument over Western weapons supplies continues. German Taurus missiles have been particularly contentious because of questions about how they might be operated and whether German personnel would need to be involved initially. Russia has framed deeper Western involvement as an escalation. Supplying weapons doesn't automatically make Germany a combatant, but what Moscow chooses to regard as involvement matters.

Meanwhile, Russia has military and strategic relationships with North Korea and Iran. American agencies have also documented Chinese state-linked actors gaining and maintaining access within critical infrastructure networks, potentially useful during a future confrontation.

These countries have different interests, and I haven't seen convincing evidence of some coordinated plan to bring down Western infrastructure.

But why would they need one?

One country could be fighting a war. Another could be gathering intelligence. A third could be stealing money. A fourth could be trying to gain leverage in an entirely separate dispute.

The people dealing with the consequences don't necessarily get to know whether the attackers had anything to do with one another.

And the disruption isn't confined to computers. Romanian intelligence officials have accused a network directed from Russia of involvement in a fire near the Carfil defence manufacturer, with criminal proceedings still underway. That's an allegation under investigation, not a final conviction, but it adds suspected physical sabotage to the wider picture.

Then there's Putin's announcement this week.

On 2 November, Russia ordered private data centres to reserve 10% of their space and capacity for possible government use. If the state calls for it, that capacity must be made available within twenty-four hours.

The official reason is resilience, particularly after reported Ukrainian drone strikes on Russian computing facilities.

I can understand that. But I think there's another side to it.

Computing resources that help a government defend itself can also support intelligence processing, communications and potentially offensive cyber operations. The decree doesn't prove Putin intends to use that reserve to launch attacks, and ten per cent of ordinary data-centre space is not automatically ten per cent more AI computing power.

What it does mean is that Russia regards privately owned computing infrastructure as strategically important enough for the state to call upon it at short notice.

That is significant in its own right.

Someone has been hacking supermarket freezers

And then there was the story about the fridges.

In October, hackers interfered with connected refrigeration controls at hundreds of supermarkets in France. Similar incidents were reported in other European countries at the beginning of November. In some affected shops the temperatures were reportedly set as high as 50°C. Food was ruined, stock was thrown away and some French incidents involved fires.

Now, there's a sentence I didn't expect to be writing this year: somebody has been hacking the supermarket freezers.

It sounds almost ridiculous until you consider what's actually happened.

We're no longer just talking about data being stolen or a website going offline. We're talking about somebody remotely interfering with equipment that keeps food safe to sell.

What immediately occurred to me was: if they can interfere with commercial refrigeration systems, what about all the other things we've connected to the internet?

Televisions. Streaming boxes. Heating controls. Security cameras. Household appliances. Building-management systems.

I'm not suggesting that compromising a supermarket's refrigeration controller means an attacker can take over every domestic fridge in Europe. Different devices have different security arrangements, and investigators haven't established who was behind these attacks.

But household devices can be compromised, and the FBI has already warned about internet-connected consumer equipment being misused by criminals.

The refrigeration attacks appear to have exploited weaknesses in older connected systems rather than some extraordinary new AI technology.

Which, if anything, makes the story more unsettling.

We're discussing what the next frontier AI model might be able to do while people are already causing real-world damage with systems that have been connected to the internet for years and haven't been adequately secured.

Conceptual artwork of supermarket freezers on a suspended platform, with blue chilled cabinets opposite overheated red cabinets spilling spoiled food and water.
Conceptual artwork: compromised refrigeration controls can turn digital vulnerabilities into physical losses.

What about the AI we haven't seen?

I've been working with increasingly capable AI systems in software development, and the pace of progress has been remarkable. Some of the work that used to require quite a lot of specialised time and effort can now be researched, analysed or partly completed much more quickly.

That's exciting when you're trying to build something useful.

But the same capabilities don't stop being useful when the person using them has malicious intentions.

AI can help defenders find vulnerabilities and repair systems. It can also help attackers analyse code, identify weaknesses and automate parts of an intrusion.

And then there's what we don't know.

We see the models that OpenAI, Anthropic, Google and other companies choose to release. We don't see every internal experiment or everything being tested behind closed doors. The same applies, with even less visibility, to military and intelligence research.

I suspect the private capabilities being explored are ahead of what the public can access. That's an opinion, not evidence that any particular company is three or four complete generations ahead. I couldn't put a credible number on it.

But what is happening in China? What are Russian operators doing with their own or modified open-source models? What about North Korea?

There's no reason to assume these countries are standing still just because their research isn't all visible to us. Equally, secrecy doesn't prove they have some miraculous AI that outperforms everything else.

And perhaps they wouldn't need one anyway.

A relatively inexpensive, adaptable model that makes existing vulnerabilities easier to discover and exploit could be damaging enough.

Look at the recent PHP2Shell problem. PHP underpins an enormous number of websites and applications. Two critical vulnerabilities disclosed in October left certain unpatched systems exposed to remote code execution.

It didn't mean every PHP website was hacked. Nor has anyone demonstrated that AI caused those attacks.

But it showed how one shared technology can create exposure across organisations that have very little else in common.

The attacker can concentrate on finding an opening. The defenders have to understand the issue, obtain or develop the fix, test it and deploy it without breaking the services everybody relies on.

Now accelerate both sides of that process with AI.

The UK's National Cyber Security Centre published an assessment on 3 November exploring how AI-assisted cyber threats might develop by 2028. One of its plausible scenarios is that offensive capabilities grow much faster than the UK's ability to defend against them.

It's not a forecast of disaster. But I think it tells us that the concern is rather more serious than some people would like to believe.

And there's another danger: creating confusion without doing any physical damage at all.

On 1 November, emergency-warning applications in Ukraine and Russia were hacked and sent false alerts about nuclear and other attacks. Nobody had to launch a nuclear weapon for those warnings to frighten people. The perpetrator hasn't been conclusively established.

Rumours have also circulated about the possibility of an American nuclear strike against Iran. Those aren't substantiated decisions, and I'm not treating them as such.

But a false warning, an alarming rumour and a real military incident arriving together could produce a considerable amount of confusion.

That can be damaging in itself.

You don't have to steal the money to stop people using it

On 29 October, hackers stole more than $6 billion in cryptocurrency from Binance. Two days later, the FBI attributed the theft to North Korea's TraderTraitor group.

Six billion dollars.

I'm aware that a cryptocurrency exchange isn't the same thing as Barclays or Lloyds. Conventional banks have different controls, regulations, payment arrangements and recovery systems.

But my point isn't that somebody could simply repeat the Binance attack and empty everybody's current account.

It's that the financial system relies on technology, communications, power and a surprising number of shared providers.

You don't necessarily have to steal people's money to cause serious disruption. Interrupt their ability to access it or make payments, and you've got a problem that ordinary people will notice immediately.

Imagine reaching the checkout in Tesco with a full trolley and finding your card doesn't work. Then discovering the cash machine is out of service too. Your account balance might be perfectly safe, but that doesn't help you pay for the shopping.

Banks don't all run on the same software and they have substantial contingency plans. But they don't each have their own independent electricity grid, communications network and technology supply chain.

The Bank of England is already testing scenarios involving cloud-provider and other third-party failures. That's sensible, not evidence that a banking collapse is imminent.

It's also an acknowledgement that the dependencies matter.

Google lost nearly half a trillion dollars without a power cut

Then look at what happened to Alphabet on Thursday, 29 October.

Google's parent company lost around $482 billion in stock-market value in a single day as its shares fell 12.6%.

Nearly half a trillion dollars.

That wasn't cash disappearing from Google's bank account. Investors simply decided that a share of the business was worth considerably less than it had been the day before.

The concerns were partly about the cost of Google's AI expansion: the extraordinary amounts going into data centres, processors and computing infrastructure, and whether those investments will deliver enough profit.

Now, I don't actually think Google's spending has necessarily been a mistake. Its AI technology is extremely capable, its cloud business is growing rapidly, and it has advantages that other companies would struggle to replicate.

It might turn out to be one of the smartest investments Google has ever made.

But even a company that successful has to justify the cost. Alphabet reported more than $51 billion in capital expenditure in a single quarter.

And the market's reaction tells us something rather interesting.

No data centre needed to be destroyed. No undersea cable needed to be cut. No electricity grid needed to fail.

Confidence changed, and hundreds of billions of dollars in valuation disappeared.

Just days before that sell-off, Anthropic filed its paperwork for a proposed IPO, updating it on 2 November. Its eventual listing price and date haven't been settled.

Imagine trying to value a company heavily dependent on AI computing at a time when energy prices are volatile, geopolitical risks are increasing and investors are already questioning the enormous cost of the infrastructure.

I'm not saying Iran is planning to interfere with Anthropic's IPO. There's no reason to make that leap.

I'm saying a war, cyberattack or energy shock can damage the financial outlook of a company that was never the intended target.

And when investors react, the consequences can spread into borrowing costs, investment decisions and other industries.

That is the connection I've been trying to make.

Then there's 20 November

Another date I'm keeping an eye on is Friday, 20 November.

Student and youth organisations are planning an International Youth Strike across Europe, protesting against war, rearmament and economic pressures. Walkouts, demonstrations and assemblies are planned. Organisers also discuss occupations and blockades.

That's a genuine programme of protest, not proof of a plan for widespread riots. I don't think the students should be blamed for hypothetical incidents that have nothing to do with them.

But the timing is interesting.

By then the American midterm elections will be over. Decisions around Iran may have moved on. Europe will still be dealing with security concerns and the economic effects of the conflicts already under way. Large numbers of people could be on the streets in several countries.

Now imagine a serious communications or payments failure occurring while those demonstrations are taking place. Or an energy problem affecting transport. Or somebody circulating a false emergency warning while everyone is trying to establish what has actually happened.

The demonstrations wouldn't need to cause any of those incidents.

But emergency services, transport operators, businesses and the public would still have to deal with the overlap.

That's why I think the second half of November deserves attention. Not because I know that something is going to happen on the twentieth, but because there are already several pressures that could coincide.

Conceptual artwork of a communications mast, data centre, railway station, electricity substation and city linked by a glowing line of cascading failures above a busy town square.
Conceptual artwork: separate failures can cascade across the systems behind everyday life.

The domino effect

Here's the scenario I keep coming back to.

A fresh escalation in the Middle East pushes energy prices higher. While businesses and financial markets are dealing with that, a cyberattack disrupts part of Europe's infrastructure.

Security teams are busy, backup arrangements come into use, and then a separate failure affects a major cloud or communications provider. Some businesses can't reach their systems. Payments become unreliable for a while. A new software vulnerability emerges and organisations scramble to patch it.

Meanwhile, people are trying to distinguish genuine warnings from rumours.

And the next problem arrives before the last one has been sorted out.

Every individual incident might be manageable. Electricity networks have protections. Data can take alternative routes. Banks and technology companies spend substantial sums on keeping services available.

Poland's December attack failed to cause the intended mass outage. That's worth remembering.

But backup systems aren't magic. They're designed around assumptions about what might fail, how badly and for how long.

One disruption takes up resources. The next stretches the alternatives. A third affects the organisations trying to repair the first two.

None of it has to be coordinated. The people behind the incidents might have completely different motives, and some failures might not be attacks at all.

It only takes us being more interconnected than we are resilient.

That's what I mean by the domino effect.

Three days for us. Ninety days for them.

I'm not suggesting Britain is about to lose power, banking and communications all at once. I don't know that, and neither do the people confidently predicting it on social media.

But I don't think we should dismiss the possibility of overlapping failures simply because some of the more dramatic predictions turn out to be nonsense.

The individual developments are serious enough. Someone attempted to disrupt Poland's energy infrastructure. Cloud facilities have been damaged in a war. Supermarkets have had their freezers remotely interfered with. North Korean hackers have been accused of stealing billions. Governments are reserving computing resources and advising households to prepare for interruptions.

At the same time, we're making our businesses, financial systems and ordinary lives more dependent on digital infrastructure than ever before.

I have a feeling the secondary consequences of conflict are going to matter increasingly to people who live nowhere near the fighting.

That doesn't mean I'm opposed to AI or technology. I use both constantly. Google might prove its investment was worth every penny, and AI might make cyber defence much more effective.

But I think we've become a little too comfortable assuming that the systems behind our everyday lives will simply keep working because, most of the time, they do.

So yes, I'll probably get the wind-up radio.

There's something rather pleasing about humanity spending billions creating the most advanced computers in history, only to discover that one of the more dependable things in an emergency is a radio with a handle on the side.

But the radio isn't really the point.

My question is whether we're preparing for individual systems to fail when we should be thinking about what happens if several fail together.

And I'd much rather we asked it now than after finding out the hard way.

This is an opinion piece written on 3 November 2026. Events and reported claims are distinguished from my speculation about possible knock-on effects.

Sources

The original documents, official statements and reporting behind the factual claims in this article are listed below. The suggested domino-effect sequence is opinion and scenario analysis, not a reported event.