Global Partnerships

In 2021 the energy sector received two warnings. In May a ransomware attack on Colonial Pipeline, which entered through a single virtual private network account without multi-factor authentication, led the operator to halt fuel supply to much of the American East Coast. In February, when a threat intelligence firm reported that a China-linked group had targeted Indian power organisations, the Ministry of Power stated that CERT-In and NCIIPC had already detected the threat, issued alerts and contained it with no data loss. This retrospective examines both episodes, the regulatory response in the United States, and what followed in India, including further intrusions into state load despatch centres, a ransomware attack on Oil India and new cyber security rules for the power sector. It argues that India's early warning success should now be extended from the grid to the whole energy chain, and recommends binding cyber obligations for the oil and gas midstream, chain-wide exercises across sectors, and a standing energy-chain threat intelligence cell.

From October 2022 Russia turned its missiles and drones systematically on Ukraine's electricity system, destroying, by the Ukrainian president's account, nearly a third of the country's power stations within a week and, over the following winters, damaging about half of its large network substations. Ukraine's response combined emergency repair, international supply of spare equipment, synchronisation with the continental European grid, layered physical protection of substations and a civil defence network of heated shelters for citizens without power. This research paper revisits 2022 as the year in which deliberate, sustained attack on a national grid became a practical rather than theoretical threat. Drawing on reports from the International Energy Agency, operators and established news sources, it reconstructs the pattern of attack and response and then draws lessons for India in three domains: physical protection of critical nodes, redundancy through spares, interconnection and decentralised generation, and civil defence planning that assumes prolonged outage. It argues that India, having put in place a strong cyber security framework for the power sector, is well placed to extend it to physical hardening.

In late February 2024 three Red Sea submarine cables, Seacom, AAE-1 and EIG, were severed, most probably by the dragging anchor of the Rubymar, abandoned after a Houthi missile strike. Traffic between Asia, Europe and the Middle East had to be rerouted, and repairs were delayed for months by conflict and permits. India, which has landing stations on all the affected systems, came through with its connectivity largely intact thanks to route diversity, while the Indian Navy mounted its largest deployment in the region. The episode also confirmed the reform agenda its own regulator had already set out: concentration of landing stations in Mumbai and Chennai, dependence on foreign repair vessels based in Singapore and Dubai, and repair response times measured in months. This retrospective paper reviews what happened, India's exposure, and policy since, including the November 2024 critical telecommunication infrastructure rules. It argues for building on these strengths by treating submarine cables as sovereign critical infrastructure, with Indian repair capacity, diversified landings and a single accountable protection mandate.