When digital systems fail: Understanding the Risk of a Global Digital Pandemic

Expanded Summary: When Digital Systems Fail - Understanding the Risk of a Global Digital Pandemic

#

Opening and Framing

The side event, hosted jointly by the International Telecommunication Union (ITU), the United Nations Office for Disaster Risk Reduction (UNDRR), and Sciences Po Paris, opened with a power cut in the conference room, which moderator Loretta Hieber-Girardet used to illustrate the session's central theme. She asked the audience: "Have we just experienced a global pandemic on digital infrastructure?" She invited those present to imagine the same disruption spreading across Geneva, Switzerland, and all of Europe, and to consider what it would mean if hospitals, emergency services, and transport systems were affected . This device was designed to make the risk viscerally tangible rather than merely theoretical, and it introduced the session's governing metaphor - the "digital pandemic" - in an emotionally resonant way .

Hieber-Girardet then set out the intellectual stakes of the discussion, noting that digital infrastructure underpins every aspect of modern life, from energy systems and financial services to healthcare, emergency alerts, public administration, and humanitarian action . She emphasised that the more interconnected these systems become, the more critical it is to understand how disruption in one sector can spill over across many sectors, societies, and communities . The discussion, she explained, was anchored by a joint report - When Digital Systems Fail and Three Plausible Scenarios of Systemic Disruption - produced through a collaboration between ITU, UNDRR, and Sciences Po, which brought together senior experts to examine how digital disruptions cascade across interconnected systems . The transcript refers to this as "the May report," indicating it was published in May.

---

#

The Solar Storm Scenario: A Credible and Imminent Threat

Before the panel discussion began, a short video was screened to illustrate the scale of potential digital disruption . The video centred on the threat of a major solar storm, drawing on the historical precedent of the 1859 Carrington Event, when a solar storm caused telegraph machines to spark and shock their operators, with some continuing to transmit even after the power was cut . The video noted that a storm of equivalent magnitude narrowly missed Earth in 2012 , and explained that if such an event were to occur today, it would drive geomagnetically induced currents through power grids, causing transformers to fail in a cascade faster than any grid could recover . Replacing a single transformer takes between 12 and 18 months, and no strategic reserve exists .

The cascading consequences would extend far beyond the power grid: data centres would go dark, financial systems would lose the satellite timing signals that sequence every transaction, GPS would fail, and aircraft would be unable to fly - all with only 18 hours of warning . Scientists estimate the probability of a Carrington-level event at up to 12 per cent per decade, making it a real possibility rather than a remote one . The video concluded with a pointed observation: "We know the risks. We know the mechanisms. What we lack is coordinated action." This framing - that the barrier is not knowledge but collective will - set the tone for the entire panel discussion that followed.

---

#

Audience Poll and the Scale of Unpreparedness

Following the video, Hieber-Girardet conducted a brief audience poll, asking how many participants believed the world is actually prepared for a digital pandemic . The poll suggested that very few, if any, participants believed adequate preparation exists, while the majority indicated they did not . This result, combined with the acknowledgement that a major digital disruption is a very real possibility with very real consequences , established a sense of urgency before the panel had spoken.

---

#

Scenario Planning and the Absence of Isolated Risks

Constance de Leusse, Senior Advisor of the Tech and Global Affairs Innovation Hub at Sciences Po in Paris, who was closely involved in producing the joint report, was invited to explain the methodology and key findings of the scenario planning process . Hieber-Girardet framed the discussion by describing one of the report's scenarios - beginning with a severe heat wave and ending with cascading disruption across power, data centres, cloud services, healthcare, payments, and emergency alerts - before inviting de Leusse to elaborate on the methodology.

De Leusse described how the expert group identified that there are no isolated risks in digital systems: a heat wave that disrupts connectivity can cascade to impact the entire chain of modern life, ultimately disrupting healthcare, financial systems, and any system that people depend on daily . This insight led the group to adopt a holistic, systemic approach rather than relying on traditional risk assessments, which tend to treat hazards in isolation . The scenario planning methodology brought experts together - through virtual and in-person meetings in Paris - to work collectively on what a disrupted future might look like and, more importantly, how collaboration could identify solutions and anticipate cascading effects . De Leusse emphasised that scenario planning must be treated as an ongoing effort rather than a one-off exercise, and that the collaborative process itself generated insights that no single expert or institution could have reached alone .

---

#

Nigeria: From Lived Experience to Concrete Action

Nigeria's Minister of Communications, Innovation, and Digital Economy, Bosun Tijani, offered one of the most candid and humanising contributions of the session. He described how his country had already experienced a real-world test of digital fragility when a submarine cable cut left young Nigerians unable to access social media, caused the banking system to stop working, and disrupted a portion of government services . He acknowledged openly that citizens had blamed him personally for the disruption, and that this experience - rather than any policy document - had driven home the importance of resilience . He reflected: "Everything we do as we talk about data transformation and as we move humanity more online, we must also take responsibility to ensure that these systems are resilient." To contextualise why resilience had become personally urgent to him, Tijani described how studies had shown Nigeria needed an additional 90,000 kilometres of fibre optic network, that he had raised $2 billion for this purpose, and that deployment was now underway. This expansion of digital connectivity made the question of resilience all the more pressing for him as a minister actively increasing his country's digital dependence.

Tijani also identified a structural governance failure that he argued is not unique to Nigeria: energy, aviation, and healthcare resilience planning are conducted independently, in silos, with his ministry playing little or no role in major digital projects in other sectors . He noted that when a digital crisis strikes, it touches every part of the economy and society simultaneously, leaving no luxury of time for delayed decision-making . He accepted that sectors would "still likely walk in silos" and that "there's nothing we can do about it" , framing fragmentation as an unavoidable reality to be managed through workaround protocols.

His proposed response was threefold: first, to map critical digital dependencies within Nigeria so that interdependencies are understood and documented before a crisis occurs ; second, to conduct cross-sector stress tests simulating total digital breakdown scenarios, with financial services as a starting example ; and third, to clarify which institution within his ministry is responsible for leading coordination during a crisis . He committed publicly to returning to a future event with a progress report on these three actions .

---

#

The UAE: Resilience Proven Under Real Attack

The UAE's Director General of the Telecommunications and Digital Government Regulatory Authority, Majed Sultan Al Mesmar, provided the most dramatic and consequential disclosure of the session. He revealed that in early March, the UAE had been subjected to a deliberate attack by a neighbouring country on its civilian ICT infrastructure, with data centres, mobile sites, and satellite infrastructure all targeted . Despite this, all critical services - including schools, hospitals, and government systems - remained fully operational . He was emphatic that this outcome was not the result of chance but of long-term, deliberate preparation: "It's not by a chance. We have prepared for this a long time ago." Al Mesmar outlined the principles underpinning the UAE's resilience architecture, which has been developed since the adoption of a national approach in 2010 . The first principle is understanding risks before they become incidents, including cyberattacks, natural disasters, supply chain disruptions, and emerging AI-driven risks, and reviewing them continuously as the threat landscape evolves . As early as 2010, the UAE identified damaged submarine cables as a strategic risk and worked with operators to diversify connectivity and eliminate single points of failure . Today, the UAE connects to the world through 21 to 22 submarine cables entering from two different locations, complemented by 2G-to-5G mobile coverage at 99.8 per cent, two satellite companies providing broadband and mobile services respectively, and the ability to activate all available VoIP services with a single button if all five mobile networks fail . He described this as "the result of long-term investment, not a chance." The second principle is that resilience is a shared responsibility requiring coordination across governments, operators, energy providers, financial institutions, and technology companies . To operationalise this, the UAE established the National Crisis, Emergency, and Disaster Management Authority (NCEMA) in 2007, uniting government and the private sector under one framework for coordinated decisions and rapid information sharing . Al Mesmar stressed that "resilience depends on strong institutions as much as robust technology" , and that the UAE conducts annual table-top drills within the ICT sector and field drills every two years, in addition to national drills involving other entities . The third principle is that resilience must be designed into the architecture itself, with distributed loads, redundancy, and geographical diversity ensuring that services continue seamlessly when one component fails . He concluded: "Resilience is about governance, partnership, continuous learning, and innovation, not only technology." ---

#

Cyber Diplomacy: Managing Risk Across Borders

Australia's Ambassador for Cyber Affairs and Critical Tech, Jessica Hunter, addressed the transboundary dimension of digital disruptions, noting that such events do not stop at national borders . She grounded her remarks in lived national experience, citing Australia's own encounter with a weather crisis that took out the electricity grid for several days, as well as the case of Tonga's 38-day connectivity outage in 2022 following a cable disruption - a real-world illustration of how swiftly digital isolation can become a humanitarian emergency.

She identified three specific risks that emerge in the information vacuum of a crisis. The first is misunderstanding: in the immediate aftermath of a disruption, it is often unclear whether the cause is a physical attack, a cyberattack, or an unintentional event, and this ambiguity creates dangerous potential for miscommunication across different political jurisdictions . The second is escalation, both within domestic agencies and across international borders, as different governments may respond to their own incomplete understanding of events . The third is delay - in detection, problem-solving, and response - which compounds the damage caused by the initial disruption .

Hunter argued that diplomacy, human relationships, and pre-established points of contact are the critical tools for managing these risks . She outlined several practical approaches. At the global level, international law applies in digital crises just as in offline ones, and UN norms on responsible state behaviour provide a framework for clarifying technical facts when they become contested . Trusted global networks - including computer emergency response teams (CERTs), the International Watch and Warning Network (IWWN), and the directory of global mechanisms on cyber - enable rapid information sharing and reduce miscommunication . At the regional level, Australia works with the Asia-Pacific CERT and the Pacific Cyber Security Operations Network (PACSON) to connect nations and build resilience capacity . Through its Southeast Asia Programme, Australia works closely with ASEAN members and Pacific Island partners to test and exercise cross-sectoral crisis scenarios, provide trusted and secure technologies, and conduct crisis preparedness work . She emphasised that public-private partnership is essential because, whilst governments and regulators define what good looks like, most critical systems are owned and managed by industry partners who must be included in scenario testing and crisis preparedness . She concluded that testing, exercising, and preparing represent the best collective effort across government and public-private infrastructure to ensure readiness for the next digital disruption - adding, with a self-correction, that such a disruption is not a matter of if, but when .

---

#

ITU: Raising the Alarm and Making Preparedness Operational

ITU Deputy Secretary General Tomas Lamanauskas was asked how ITU is helping countries move from reacting to digital disruptions to building resilience before crises occur . He began by drawing a parallel to COVID-19, noting that many policymakers currently dismiss catastrophic digital disruption scenarios as science fiction - just as a pandemic was dismissed as implausible only a few years before it happened . He used the probability of a Carrington-level solar event to challenge this complacency: "It's a pretty big chance. And if it burns down your electricity network and kind of mobile networks, can you take that chance?" Lamanauskas described ITU's approach as a structured chain of preparedness activities, modelled on its existing cybersecurity work: national assessments, national cybersecurity strategies, infrastructure building, and cyber drills . He noted that this chain must be triggered by a genuine understanding that preparedness is important, and that ITU's role includes raising awareness as well as providing technical assistance . He highlighted two specific areas of ongoing international work: submarine cable resilience, where an international advisory board was concluding its cycle with a high-level panel and recommendations the following day ; and space sustainability, where ITU is working to address the accumulation of orbital debris as satellite infrastructure becomes increasingly critical . He argued that the next frontier is making people genuinely experience disruption at scale, so that the reality of a digital crisis becomes visceral rather than abstract .

---

#

GSMA: Mobile Networks as Humanitarian Lifelines

Kimberly Brown, Head of Mobile for Humanitarian Innovation at GSMA, highlighted the role of mobile networks as lifelines during humanitarian crises and the importance of pre-agreed mechanisms for maintaining connectivity . She noted that the issues discussed throughout the panel are not only technical but fundamentally about coordination and preparedness . Drawing on GSMA's experience working at the intersection of mobile network operators, governments, humanitarian partners, and regulators , she described how learnings from mobile network operators' resilience practices can be translated into broader digital resilience frameworks .

Brown emphasised that mechanisms such as pre-agreed crisis protocols, business continuity plans, energy and fuel access arrangements, infrastructure sharing, and emergency roaming require significant advance preparation to be effective . She noted that GSMA had recently contributed to an ITU report on emergency roaming, and that instigating emergency roaming in an emergency requires a great deal of work in advance . She also underscored that compound and cascading sequential events - storms following floods, earthquakes leading to displacement - are already a lived reality for humanitarian actors and the mobile ecosystem, making cross-sector collaboration and pre-agreed protocols essential for the restoration of mobile networks and all other vital services .

---

#

The European Union: Multi-Hazard Governance and AI-Driven Foresight

Martin Bailey of the European AI Office at the European Commission outlined the EU's multi-layered approach to digital resilience . On cybersecurity, he described a range of long-established mechanisms: the EU Cyber Shield for cross-border threat detection, the EU Cyber Blueprint for command and information sharing during crises, large-scale cyber exercises conducted by the EU Cyber Agency across member states, and stockpiling of digital as well as medical goods . He also referenced the EU's Preparedness Union Strategy as an all-hazards approach to resilience .

Bailey then described the work of the EU AI Office, which is focused on shifting from fragmented, single-hazard monitoring to integrated foresight, using open and trustworthy AI tools . He cited the July 2021 European flooding disaster - which caused 400 deaths and 40 billion in damages - as a case study in systemic failure . He argued that what went wrong was not the forecasting model but the entire chain: the data, the decision-making, and the action . This observation reinforced the session's broader theme that resilience requires not just technical infrastructure but functional institutional chains for acting on information. Bailey also emphasised the importance of building redundancy into systems, keeping them open source, and moving away from proprietary "black boxes" whose operators may be unknown . He mentioned specific initiatives including projects to make cities ready for any kind of disaster - whether digital or physical - and noted that the EU is engaged in reconstruction modelling work in Ukraine and other affected areas. He described the EU's aim to develop tools and make them available beyond EU borders through trusted partnerships, recognising that the communities least prepared for digital disruptions are often those with the fewest tools at their disposal .

---

#

Convergences, Tensions, and Unresolved Questions

Across the panel, a remarkably high degree of consensus emerged on the fundamental principles of digital resilience. All speakers agreed that digital disruptions cascade across interconnected sectors ; that resilience must be built before a crisis through long-term investment rather than improvised during one ; that drills, exercises, and stress testing are indispensable ; that cross-sector coordination with clear protocols is essential ; and that no single organisation or country can manage a digital crisis alone .

Beneath this surface consensus, however, lay meaningful tensions. Tijani accepted that sectors would "still likely walk in silos" and that "there's nothing we can do about it" , framing fragmentation as an unavoidable reality to be managed through workaround protocols. Al Mesmar, by contrast, presented the UAE's NCEMA as proof that unified cross-sector coordination is structurally achievable , implying that siloed planning is not inevitable. Similarly, Al Mesmar's remarks placed considerable emphasis on technical infrastructure solutions , while Hunter and Bailey also foregrounded governance, diplomacy, and institutional chains as equally essential . An audience member also raised the question of whether broadcasting networks - radio and television - should be more explicitly integrated into resilience frameworks , a challenge that Al Mesmar acknowledged but did not fully resolve, noting that broadcasting services had continued during the UAE attack but pivoting quickly to argue that "mobile is taking over everything" .

---

#

Conclusions and the Path Forward

Hieber-Girardet closed the session by drawing together the key themes and identifying the most significant remaining gap: "Digital risk has not been systematically integrated into a lot of the disaster risk management plans that we see at a country level. So there is a lot of work to be done, a lot of lessons to be learned." This observation served as a corrective to the impressive examples of preparedness presented by the UAE, Australia, and the EU, reminding the audience that these represent the exception rather than the rule. She committed to continuing to work with ITU to disseminate the recommendations of the joint report and to capture and share lessons learned across countries .

The session concluded with broad agreement that the tools, frameworks, and partnerships needed to act already exist, but that translating this consensus into coordinated action at national and international levels remains the central challenge. The joint ITU, UNDRR, and Sciences Po report was identified as a vehicle for raising awareness among ministers and policymakers worldwide , and Tijani's public commitment to return with a progress report on Nigeria's three action points provided a concrete accountability mechanism that gave the discussion a sense of ongoing momentum beyond the session itself.