what if Russian hackers shut down the gas?

The control room in Utrecht. If the emergency number no longer works after a cyber attack or a power failure, the municipality must man all fire and police stations.Statue Marcel van den Bergh / de Volkskrant

She chooses her words carefully. Mayor Sharon Dijksma would like to tell us how the municipality of Utrecht is preparing for all the dire consequences that the war in Ukraine could have for her city. But she doesn’t want to immediately create an atmosphere of ‘total panic’. That’s unnecessary, she says. “We shouldn’t give our residents the impression that the war is coming this way.”

Nevertheless, the municipality and the Utrecht Security Region have taken extra steps since the Russians invaded Ukraine – just like other regions, by the way. In Utrecht, for example, they recently made an inventory of how many air-raid shelters there are in the region in the event of a military clash. The answer: none.

The focus of security people also shifted. Until recently, this was mainly aimed at local and regional incidents in which systems are down for a maximum of 48 hours: the failure of a control room, for example, or a local power failure. However, larger scenarios are now also receiving attention – scenarios in which the power supply, the banks or the gas supply are cut for a longer period of time.

‘We have no concrete reason to think that we will have to deal with massive disruption today or tomorrow’, says Luuk Steenwelle, public order and safety manager at the municipality. “But it’s not totally unthinkable.”

‘We must treat all scenarios seriously’, says Dijksma. “The improbable ones too.”

Pamphlets and sound cars

These major scenarios are now also covered in administrative training courses. Just last week, the mayor, the chief public prosecutor and employees of the municipality and the Utrecht Security Region, among others, discussed a scenario in which the gas network no longer functioned.

If that happens, for example through a cyber attack, major problems quickly arise. For example, a large part of the electricity is generated with gas. And without electricity, telecom towers will fail, although they can continue to shine on their batteries for the first few hours.

‘The municipality cannot solve such problems itself,’ says Mayor Dijksma. That responsibility lies with the ministries. ‘We are there to deal with consequences: we take care of the people who get into trouble.’

During the training, for example, it became apparent how important it is in such extreme cases to communicate quickly with the citizen. This has to be done in the first hours, when the radio, television and telecom masts are still working. After that, the municipality can only resort to old-fashioned means: they have to put up pamphlets at neighborhood offices and fire stations or have sound cars drive around.

And how do you ensure that the fire brigade still turns out if the emergency number no longer works? To this end, the municipality must staff all fire and police stations. ‘Then you have to run to the barracks in your socks,’ says Steenwelle.

Red Team

The municipality of Utrecht is currently ‘extra alert’ on other fronts too, says chief information officer Mariëlle van der Zanden. It ensures that municipal information systems are not hit by cyber-terrorists. Because if those systems fail, for example due to a Russian hack, the execution of municipal tasks is endangered.

‘We recently mapped out which parts must continue under all circumstances,’ says Van der Zanden. ‘Paying out benefits, for example. That should never falter, because that has direct consequences for the people who depend on it.’

That is why the municipality has also practiced with this. A crisis team was presented with a scenario in which a hacker was still in the systems. It was unknown if he had done any damage. What were the drivers supposed to do? What plans could they come up with? How can the service continue?

The technicians also receive training. A so-called Red Team of hackers regularly infiltrates the systems, without the employees knowing this beforehand. ‘That way we can see how quickly they react’, says Van der Zanden.

Cans of beans

And what about the Utrecht population? Is it well prepared for any disaster?

‘In other countries they are better prepared for difficult situations’, says Dijksma. ‘On islands in the Caribbean, for example, where they regularly have to deal with hurricanes. There the government says: seal up your house and take a stock at home. That’s not common here.’

‘Some people expect the government to be on their doorstep within 10 minutes of a disaster to rescue them,’ says Steenwelle. ‘But that’s not true. The first time you have to be able to support yourself. That’s why we would say: buy a few cans of beans and a jerry can of water. Although we don’t want to instill fear either.’

‘I also don’t think the municipality should inform citizens about this,’ says Dijksma. ‘That is the task of the national government.’ After which the inevitable question arises how many cans of kidney beans does the mayor have in his house. She has to laugh. Then: ‘I don’t like brown beans.’

ttn-23