Flight of the Thumb Drive

The Severed Seabed

Mara: January the fifteenth, 2022. A volcano has just blown in Tonga, and Sam Vea is sitting in his van in the middle of a rain of ash. The Guardian, which later told his story, describes him staring at his suddenly useless phone. He figured the network was jammed. He'd try his relatives later, once the traffic online died down. It wasn't traffic.

Eli: And that's where a listener's question begins: what would happen if the internet went down worldwide for a week? Today's angle is the analog island and the payment cliff.

Mara: Tonga lived a small version of that, for weeks. So that's where this starts. Then on to water towers, card terminals and the guts of the network, toward what a whole week would actually break, and the one step of it nobody has ever attempted.

Eli: How fast did Tonga actually go dark?

Mara: Fast. Fifteen minutes after the eruption, the island's internet traffic had dropped to about half. About an hour after, it flatlined. What had snapped was a submarine communications cable, a fibre line lying on the seabed. Lines like that carry virtually all the data moving between countries.

Eli: So not satellites. A line on the seabed, carrying Tonga's link out.

Mara: And it isn't fixed quickly. A break like that needs a specialised repair ship. Tonga went weeks without international phone calls, without banking transactions, without internet.

Eli: Banking is where the stakes were. Money sent home by Tongans overseas was worth 44 percent of the country's GDP. Close to half the economy, arriving by wire. With the connection gone, nobody abroad could send it.

Mara: Exports stalled too. Owners of farms and fisheries couldn't fill out the compliance and quarantine forms needed to ship squash and breadfruit. Tonga's isolation showed, on a national scale, how modern civil life fractures when digital connections vanish.

Eli: And by one anecdote, the workaround one bank found is almost comic. Every morning, to reconcile transactions, headquarters on Tongatapu loaded a spreadsheet of Vava‘u residents' accounts onto a thumb drive. The drive was flown to Vava‘u and back daily. Cloud banking, by aeroplane.

Mara: No workaround could replace everything that only travelled down that cable.

The 72-Hour Buffer

Eli: Now stretch Tonga to the whole planet. One published investigation lays the scenario out carefully: seven days with no public internet, while electricity, local radio and isolated private systems keep running wherever they can. So the first test is the utilities. Water and power lean on SCADA, the control systems that let operators in a central room watch and steer pumps, valves and substations from far away.

Mara: In July 2026 that got a real test. A coordinated cyber incident hit more than 30 municipal and community water systems across Minnesota. The state's chief information security officer said the aim was 'disruption, not financial gain.'

Eli: Towns including Plymouth and Braham reported disrupted SCADA communications and disabled cellular telemetry, the remote readings from their equipment. A few municipalities switched straight to physical walk-throughs and manual workarounds at lift stations and water towers. That's the reading FERC assessment participants and CISA hold: core utilities keep isolated networks and analog plans that can carry them for several days.

Mara: In Braham, operators lost control of the well pumps, shut treatment briefly and asked residents to conserve water. Manual overrides had things running again within ninety minutes.

Eli: The grid has its own fallback. Restoring it after a blackout without SCADA is possible, just slower: recovery teams, calculations done offline, running separate electrical islands. In a FERC study, every participant estimated a full restoration could take more than a day, and longer still without those control tools.

Mara: Slower and by hand, but the pipes and wires come back.

Eli: Shops are a different animal. Kamal Kishore, of the Internet Society, holds the other reading: payments, logistics and fuel dispatch lean so heavily on outside connectivity that cascading failures would begin within 24 to 72 hours. The card terminals run on the same clock. Some store pending sales locally for 24 to 72 hours, then delete them if the connection hasn't returned. Visa's guide says merchants should complete authorizations within 24 hours. Inside the window, it's a nuisance. Past it, money the shop counted on simply isn't there.

Mara: Whether one event could cut the whole planet at once, Eli, comes down to how the network itself is built.

No Master Key

Eli: And it's built to make that hard. The internet isn't one thing. It's tens of thousands of separate networks, each an autonomous system: one operator's network, run on its own terms, deciding how its traffic travels. In June 2020, nearly seventy thousand of them were announcing routes into the global internet. Picture that many front doors, and no master key.

Mara: And Tonga sat at the end of one line. Sam Vea's phone had no detour.

Eli: Which is the exception. Doug Madory, who studies internet disruptions, points out that undersea cables break regularly; the UN estimates 150 to 200 faults a year. His guess at the cable industry's reaction: 'dude, we do this all the time.' Ben Bradford makes the same point from the other end: sever a lot of cables and things slow down, but anywhere the pipes still reach keeps working.

Mara: Madory calls a simultaneous worldwide shutdown extremely unlikely, an 'all hands on deck' scenario, because too much would have to fail in too short a time. And his line on the routing protocol is that it's 'super resilient, otherwise it would have crashed by now.'

Eli: So to the mesh, a snapped cable is just a Tuesday.

Mara: That's one reading, Eli. Rob Wainwright and Tomas Lamanauskas hold another: that some weak points are shared by everything. An extreme solar storm damaging the equipment strung along subsea cables. Or deep corruption at the root of the internet's naming system. Either, in their view, could cause an outage that's effectively global.

Eli: The root has been tested. The naming system, DNS, turns website names into the numbers machines use, and the root sits at the very top. In February 2007, a coordinated attack hit multiple root servers. Two of them stopped responding to up to 90 percent of queries. But a root server isn't one box. It's copies on hundreds of machines worldwide, and Anycast, a way of routing, sends each query to the nearest copy. Afterwards the RIPE NCC's chief scientist said: 'I am glad that we have invested in distributing the K-root name server to locations all over the world.'

Mara: Nobody has watched the whole mesh fail at once, so neither reading has faced that test.

Eli: So, beyond Tonga, the place to look next is the part of the system that doesn't live in cables at all.

The Single Choke Point

Mara: July 2024. CrowdStrike makes an endpoint security sensor, protective software that organisations install across their computers, running with deep privileges. One faulty content update went out. Around 8.5 million Windows devices went down with it. The effects cascaded across air and ground transport, finance, healthcare, media and retail, around the world. And not a single cable was cut.

Eli: Microsoft said that was a small percentage of Windows machines. The impact was broad because enterprises running many critical services used CrowdStrike.

Mara: And the bill ran past a billion dollars. That's the reversal. The root rode out 2007 by being in hundreds of places. This spread because one product sat in the same place, everywhere. So many platforms lean on the same few cloud providers and core systems that one point of failure can cascade across multiple services simultaneously. By July 29th, CrowdStrike reported nearly all its sensors back online.

Eli: And it's the same shape as those terminal timers. Offline authorization means the terminal says yes now and the bank checks later. The risk is who swallows a payment that bounces afterwards. A Federal Reserve paper is blunt: if the payer lacks funds, or the internet stays down too long, the merchant takes the loss. So within about three days, the breakdown turns from a communication failure into a commercial freeze, driven by merchants' fraud exposure.

Mara: Stretched past those timers toward seven days, Eli, the trouble stops being about payments alone.

The Cold-Boot Trap

Eli: By day four, plenty of those timers have run out. And in the scenario, the food is still there. Its authors put it this way: 'The world has not run out of food. It has lost the ability to tell the right lorry where to take it.' Automatic ordering systems can't see what sold, and distribution centres struggle to coordinate thousands of deliveries. By day three, trustworthy information is the scarce thing. A petrol station closes for a delivery, and someone says the country has run out of fuel.

Mara: It's the split Tonga showed, just slower.

Eli: And at the end of the week, someone has to switch it back on. Restarting the internet after a shutdown has never been attempted. So how hard that would be, or whether it's even possible, is hard to gauge.

Mara: The closest real thing is one company. October 4th, 2021: during routine maintenance, a command meant to check Facebook's backbone capacity accidentally took down every connection in it, cutting its data centres off globally. Recovery became a cold-boot, restarting from nothing, with none of the usual tools running. By the company's own account, its remote access and its backup access were both down, so it sent engineers to the data centres in person. And even then they held back, worried that switching everything on at once could set off a new round of crashes from the surge.

Eli: That was one company, with its own buildings and its own staff. A world restart means tens of thousands of separate networks coming back at once.

Beyond the Stress Test

Mara: Even the scenario's own authors call their week a deliberately constructed cinematic stress test, not a forecast, and the mesh reading from Madory and others points the same way. Sam Vea, the man in the van who thought it was just traffic, later told a reporter the only way a cable break wouldn't cripple Tonga was a second cable, routed differently, so one undersea convulsion couldn't take out both. The government budgeted about 16.5 million dollars for a new domestic cable, above upgrades to hospitals and water.

Eli: And the other reading hasn't gone anywhere. Rob Wainwright warns the infrastructure isn't unbreakable. A successful attack on DNS, or on BGP, the system networks use to announce routes to each other, he said 'would take down the Internet and have a huge effect on the way in which we do our business.'

Mara: So, the listener's week: the network is built to resist a blackout that total. If one came anyway, the evidence points to water and power running on manual overrides, while payments, cloud records and just-in-time deliveries freeze within 24 to 72 hours.

Eli: Which leaves two things to watch. Post-mortems and black-start drills run across several providers, testing whether recovery systems lock each other out and how big the reconnection surge gets. And seabed geomagnetic sensors and cable power-feed voltages during the next severe space-weather event, showing how hard the repeaters are pushed.

Mara: For listeners digging deeper, look into offline authorization.

Eli: Follow technology stories with us as networks face prolonged disruptions.

Mara: That's all for this one. I'm Mara.

Eli: And I'm Eli. Thanks for listening to Angle. Until next time.