A Cyberattack Has Left Bankruptcy Courts Reassigning Their Own Legal Notices

A cybersecurity incident has disrupted the federal Bankruptcy Noticing Center, forcing courts nationwide to establish temporary procedures for delivering legally required notices.

On October 16, the U.S. Bankruptcy Court for the Southern District of Florida issued an emergency administrative order changing who must deliver official notices in bankruptcy cases. For cases filed on or after October 7, the debtor's attorney, or the debtor personally if unrepresented, must mail the notice announcing the case and the required meeting of creditors. The order gives them three days after the later of its issuance or the court's production of the notice. It also assigns additional mailing responsibilities when cases are discharged, dismissed or closed, and requires affected parties to document that service was completed.

These are ordinarily functions supported by the federal judiciary's Bankruptcy Noticing Center, a centralized system responsible for producing and distributing notices across the country's bankruptcy courts. Since October 9, that system has been unavailable following a cybersecurity incident affecting its contractor, BAE Systems. The Administrative Office of the U.S. Courts publicly confirmed the disruption on October 15, explaining that the incident had stopped the center's production and distribution of notices nationwide. Several associated websites and the National Creditor Registration Service were also unavailable.

Bankruptcy courts have continued accepting filings, opening cases and processing documents. Their primary electronic case-management system remains operational, and registered users can still receive certain electronic filing notifications. But those systems don't replace every notice that must reach a debtor, creditor or other interested party. In particular, people who aren't registered for electronic court notifications may depend on the service that has stopped functioning.

Florida's order illustrates what happens when a centralized administrative function becomes unavailable while the legal obligations it supports remain in force. Hearings and statutory deadlines generally continue unless the court orders otherwise. Parties who believe they were harmed by delayed notice can request relief, but they may need to file a motion identifying the affected notice, explaining the consequences and specifying what remedy they need. Unrepresented parties who cannot comply with the temporary procedures are instructed to contact the clerk or seek relief from the court. Filing that request doesn't automatically extend a deadline.

The court has established protections intended to prevent people from suffering adverse consequences because legally required notice wasn't delivered. It has also preserved judicial discretion to assign notice responsibilities differently in individual cases. Those safeguards matter. They show that the judiciary has retained the authority and some of the practical capacity to respond to the disruption.

But the response also reveals how much administrative work was concentrated in the system that failed. Responsibilities previously handled through a national service are being redistributed among individual courts, attorneys, trustees and debtors. People who entered bankruptcy because they couldn't meet their financial obligations may now have additional procedural work to complete simply because the institution's contracted notice system is unavailable. The order doesn't establish that anyone has lost a legal right. It establishes that protecting those rights now requires different procedures, additional effort and, in some cases, an individual request for relief.

The distinction between a court remaining open and its procedures remaining accessible is central to this development. A functioning docket doesn't guarantee that everyone entitled to participate has received the information necessary to do so. Nor does the existence of a legal remedy guarantee that the person who needs it knows the remedy is available.

That makes the outage more consequential than an ordinary interruption of a government website. It has affected a process through which legal obligations are communicated, deadlines become meaningful and affected people are given an opportunity to respond.

Courts Are Using Different Procedures to Replace the Same National Service

The Bankruptcy Noticing Center was designed to perform a shared function for federal bankruptcy courts. Centralization allows courts to rely on common infrastructure for a large volume of routine communications, including paper and electronic notices. It can reduce administrative duplication and provide consistent processes across districts. But the October incident demonstrates what happens when a service used nationally loses its ability to operate.

The Eastern District of Texas reported that the disruption began late on October 9. By October 14, it had issued two general orders addressing deadlines and relief associated with the outage. The court continued accepting filings and processing cases, but warned that notices and orders might be delayed. It also published instructions for obtaining creditor names and addresses through the case-management system because the normal mailing-matrix function was affected.

That workaround has limitations. The court cautioned that the available creditor list doesn't necessarily include everyone entitled to notice, including debtors, trustees and certain government parties. Attorneys and other users must therefore determine whether additional recipients need to be identified. The technical ability to retrieve a list of creditors is useful, but it doesn't fully replace the administrative process that previously assembled and distributed legally sufficient notices.

The District of Hawaii issued similar guidance. It confirmed that ordinary electronic filing notifications remained operational while notices generated through the Bankruptcy Noticing Center were interrupted. Its instructions directed people without access to the electronic case-management system to contact the court's help desk. The court also advised that people prejudiced by missing or delayed notices could request relief. At the time of its October 14 announcement, it had no estimated restoration date.

These responses demonstrate meaningful compensatory capacity. The judiciary hasn't simply waited for its contractor to restore service. Courts have identified affected functions, published alternative procedures and exercised their authority to address deadlines and notice requirements. The electronic filing infrastructure also provides a functioning channel for some users, limiting the scope of the disruption.

The difficulty is that the substitute procedures aren't equivalent to the original service. A national system ordinarily performs notice-related work without requiring each affected person to determine which parts of the process have failed. Under the temporary arrangements, responsibility is more dispersed. Individual courts must decide how to handle the interruption, legal professionals must verify service requirements, and some unrepresented parties must perform tasks that would otherwise have been handled for them.

There is also a difference between making relief legally available and making it practically accessible. Someone represented by an attorney may have help identifying a missing notice, understanding its significance and requesting an extension. Someone without representation may first have to discover that a notice was delayed, determine which deadline was affected and understand how to bring the problem before a judge.

The Florida order recognizes this problem by allowing unrepresented parties to seek procedural assistance and by authorizing the court to establish alternatives where necessary. It also specifies that a motion for relief doesn't automatically stop an approaching deadline. The system therefore remains capable of correcting individual problems, but some of the work required to obtain that correction has shifted toward the people affected.

The outage's ultimate consequences aren't yet established. There is no verified national count of notices delayed, parties prejudiced, hearings continued or additional costs imposed. Nor has the judiciary publicly established that the incident compromised case records or personal information. The contractor has described the incident as isolated to the Bankruptcy Noticing Center system, while the investigation and restoration work continue.

Those unknowns limit what can responsibly be concluded about the damage already done. They don't prevent an assessment of the structural change documented in the court orders. A nationally shared administrative service stopped performing a legally consequential function, and courts have had to reconstruct that function through local procedures while continuing their ordinary operations.

The central question is how effectively those procedures preserve access for people who depend on the missing service, particularly if restoration takes longer than anticipated.

A London Cloud Outage Interrupted Banking and Court Hearings

On October 20, a separate disruption affected digital services across the United Kingdom and parts of Europe. Google reported that a power-related incident had caused an outage in one of the availability zones within its London cloud region, known as europe-west2. Multiple cloud products experienced service interruptions, elevated error rates or intermittent network failures.

The consequences appeared across organizations that provide very different services. Revolut reported problems affecting card payments, transfers, cash withdrawals and account access. Customers of several other banks experienced difficulties using online services. Britain's courts and tribunals service also encountered problems with its Cloud Video Platform, which is used to connect participants to court proceedings remotely.

The disruption affected legal hearings as well as financial transactions. Reporting from the United Kingdom described difficulties involving remote court attendance, including proceedings that depend on video links for participants who aren't physically present. By early afternoon London time, Google was reporting recovery across most affected workloads, and court video services were beginning to return. Google said the underlying power event had been mitigated and suggested that customers could attempt to move affected workloads to another available zone or region where feasible.

This incident was not caused by the cyberattack affecting U.S. bankruptcy notices. The two events involved different providers, infrastructure and failure mechanisms. There is no evidence connecting them operationally.

Their significance lies in the functions they interrupted. In the United States, a cybersecurity incident at a government contractor stopped a centralized system for communicating legal notices. In Britain, a cloud infrastructure failure temporarily interrupted technology used to participate in court proceedings. The same cloud incident also affected banking services, demonstrating how infrastructure operated by one provider can support organizations whose public responsibilities and commercial activities are otherwise unrelated.

The cloud outage also provides evidence of recovery capacity. Google identified the affected region, reported the power-related failure and began restoring services within hours. Some customers had options to move workloads to another location. Financial institutions communicated with customers, and at least some affected services resumed during the day. These responses distinguish a serious but temporary service interruption from a prolonged loss of the underlying institutions' ability to operate.

Still, moving an application to another region isn't necessarily a practical option for every customer. It depends on how the service was designed, whether its data and dependencies can be transferred, and whether alternative infrastructure is already available. The existence of multiple availability zones doesn't mean every application can automatically survive the loss of one. A service may rely on a particular database, network configuration or supporting component that wasn't designed to fail over immediately.

This is especially important for public institutions and regulated services because their responsibilities continue during a technology failure. A court must still provide lawful proceedings. A financial institution must still account for customer funds and transactions. Restoring the technical system is essential, but organizations may also have to reconcile delayed transactions, reschedule proceedings or verify that records remained complete and accurate.

British financial regulators had already identified the significance of these dependencies. In July, the United Kingdom designated several technology providers, including Google Cloud's European business, as critical third-party suppliers to financial institutions. That designation brought them under direct regulatory oversight intended to address the risks associated with concentrating important financial services in external technology infrastructure. European Union regulators have established related oversight arrangements for critical information and communications technology providers.

The October outage doesn't establish that those regulatory arrangements failed. Their purpose includes identifying and managing risks that cannot necessarily be eliminated. What the incident provides is a concrete test of the relationship between external technology providers and institutions that remain responsible for delivering essential services. The relevant questions now include whether affected organizations had workable continuity plans, how quickly they restored operations, and whether regulators can obtain enough information to evaluate the incident and require improvements where necessary.

Grocery Stores Stayed Open While Their Digital Services Were Disabled

A third development provides a useful comparison because its compensatory arrangements operated differently.

On October 19, international grocery retailer Ahold Delhaize confirmed that malicious activity had prompted it to take parts of its information technology infrastructure offline. The company operates grocery brands in Europe and the United States, including Albert Heijn, Stop & Shop, Giant Food, Hannaford and Food Lion. Its decision to disconnect systems affected websites, applications and other services across most of its brands, although the consequences differed by business.

The incident began around October 11 and was disclosed publicly on October 12. By October 19, some services had been restored, but Albert Heijn's home deliveries in the Netherlands were not expected to resume until October 23. E-commerce services at the company's American brands were also still being restored. Belgian e-commerce operations had returned, along with many websites and applications elsewhere in Europe.

The company reported that its physical grocery stores remained open throughout the incident. It also said that its investigation had not identified evidence that sensitive customer, employee or partner information had been taken, while emphasizing that the investigation was continuing. The identity of the attackers and the precise method used had not been publicly established.

The stores' continued operation is consequential. Customers retained an alternative way to purchase food even when online ordering and delivery services were unavailable. Employees and distribution operations were also able to maintain at least some functions while digital systems were restored. The company's response demonstrates that shutting down compromised technology can preserve other parts of a business, even when the protective action itself causes significant disruption.

But physical stores aren't an interchangeable substitute for every customer. Home delivery may be essential for people who cannot easily travel, lack transportation, have disabilities or depend on scheduled deliveries. The same outage can therefore be a manageable inconvenience for one household and a serious access problem for another. The existence of a functioning alternative tells us something about the organization's resilience, but not necessarily whether that alternative is accessible to everyone who relied on the original service.

The grocery incident also illustrates the operational reach of shared corporate infrastructure. Ahold Delhaize operates distinct brands in different countries, but a security problem affecting shared systems required protective measures across much of the group. That is evidence of an internal dependency capable of transmitting disruption across geographic and organizational boundaries. It doesn't establish that every affected brand used identical systems or that all services were disabled for the same technical reason.

These three incidents shouldn't be combined into a single cybersecurity event. The U.S. bankruptcy disruption involves a contracted court-notification service. The London cloud outage resulted from a reported power event. The grocery disruption followed malicious activity in a corporate network. Their immediate causes, recovery processes and consequences differ.

What makes them analytically related is the location of the work that must continue when the technology becomes unavailable. In each case, organizations had to preserve functions that depended on infrastructure outside the immediate control of the people using those functions. The alternatives ranged from manually delivering court notices to moving cloud workloads or keeping physical stores operational.

Those alternatives have different limits. Some require additional labor. Some require technical preparation before the incident occurs. Others depend on whether customers or affected parties can use a different service channel. The availability of a substitute is therefore only one part of the assessment. Its capacity, accessibility and cost determine how much of the original function it can actually preserve.

Federal Agencies Still Don't Have Complete Inventories of Connected Devices

The latest incidents occurred against a broader record of incomplete technology oversight.

On September 30, the Government Accountability Office released a report examining how federal civilian agencies identify and manage networked devices. These include internet-connected equipment and operational technologies used in buildings, laboratories and other government facilities. Federal requirements call for agencies to maintain inventories containing information necessary to understand and secure those devices.

Of the 22 agencies reviewed, 15 had established an inventory as of September 2026. Eleven were maintaining their inventories, and ten had included all required information for each device. Only seven had fully met all three requirements. GAO also found that the Office of Management and Budget had not issued updated guidance covering fiscal year 2026 or provided the oversight needed to ensure agencies completed the work.

This finding doesn't explain the Bankruptcy Noticing Center incident, the London outage or the grocery cyberattack. GAO examined a different set of federal technology-management responsibilities, and the report doesn't establish that any of those incidents resulted from missing device inventories.

Its relevance is to the capacity to identify and manage technological dependencies before they fail. An organization cannot reliably assess the security of equipment it hasn't identified. Incomplete inventories can leave agencies uncertain about which devices are connected, what software they use, which security controls apply and whether known vulnerabilities have been addressed. The GAO findings document an institutional weakness in maintaining that information, even though the relevant requirements have existed for years.

Another development this week raises the importance of those unresolved responsibilities. On October 19, Reuters reported on a cybersecurity investigation documenting the use of autonomous AI agents to attempt intrusions against more than 1,200 websites across several countries. Researchers reported more than 100 successful compromises, while Reuters independently examined activity records and contacted affected companies. Some businesses confirmed limited intrusions or remediation, although the extent of any data theft remained uncertain.

The investigation suggests that automated tools can reduce the labor required to search for vulnerabilities across large numbers of targets. It doesn't establish that the same tools were involved in any of this month's major service disruptions. The relevance is prospective: organizations with incomplete inventories, poorly secured secondary systems or insufficient monitoring may face a growing volume of attempts to exploit those weaknesses. The number of attempted intrusions could increase without a corresponding increase in the number of human attackers conducting them.

That changes the demands placed on defensive systems. Preventing incidents requires knowing which systems exist, how they connect and what access they provide. Responding to incidents requires isolating affected components without unnecessarily disabling essential functions. Recovering requires alternative procedures, accurate records and enough personnel to restore services while meeting continuing obligations.

The federal bankruptcy response shows that some of those capabilities remain available even after a shared service stops operating. Courts have preserved case processing, identified substitute procedures and established ways to seek relief. The British cloud outage shows that substantial technical recovery can occur within hours. Ahold Delhaize's decision to disconnect affected systems preserved physical retail operations while digital services were restored.

These are meaningful successes. They also demonstrate that resilience isn't captured by whether a system is described as operational. A court can remain open while notice delivery is interrupted. A bank can safeguard deposits while customers cannot complete transactions. A grocery chain can keep stores open while its delivery network is unavailable. Each organization may be functioning in an important sense while particular obligations or services remain difficult to fulfill.

The structural concern becomes more significant when those interruptions require the people least equipped to manage them to perform additional work. Bankruptcy debtors may need to send official notices. Customers may have to find another way to purchase groceries. People participating in remote hearings may have to wait for proceedings to resume. These consequences vary in severity, and the available evidence doesn't establish widespread irreversible harm. But they show where the cost of preserving institutional function can move when centralized systems fail.

This is the point at which the Risk Monitor needs to distinguish technical restoration from institutional repair. Restoring the Bankruptcy Noticing Center would allow ordinary notice production to resume. It wouldn't automatically establish whether every delayed notice had been delivered, every affected deadline had been addressed or every person entitled to relief had received it. Similarly, restoring cloud services doesn't by itself establish that all delayed transactions and proceedings have been reconciled.

The institutions remain responsible for those outcomes even when their contractors operate the systems through which the work is performed. Whether they can identify every affected obligation, correct the consequences and demonstrate that correction is the more consequential measure of recovery.

What I’m watching now

The immediate question is when the Bankruptcy Noticing Center resumes operations and how the federal judiciary handles notices accumulated during the interruption. A restoration announcement would establish that the contractor has recovered the service, but it would not establish that the notice backlog has been cleared. I want to see whether the Administrative Office publishes the duration and scope of the outage, how many notices were delayed, and whether courts identify cases requiring corrective service. The handling of deadlines, continuances and requests for relief will show whether temporary procedures protected affected parties or left problems to be resolved individually.

The differences among district responses also deserve attention. Florida has issued a detailed order reallocating service responsibilities. Texas and Hawaii have published their own procedures and protections. A useful next step would be to determine whether the judiciary develops a more uniform national response or continues relying primarily on district-level arrangements. Neither approach is automatically inadequate. The relevant measure is whether legally required notices reach the appropriate people and whether those affected by failures can obtain timely correction without unreasonable additional burdens.

For the London cloud outage, the strongest evidence of recovery will come from Google's final incident report and the responses of affected institutions. Restoration times, the specific infrastructure that failed, the effectiveness of failover arrangements and any remaining service backlogs will help establish whether the incident exposed weaknesses that require further intervention. Regulatory findings would be particularly important because financial authorities have already identified critical cloud providers as a subject of direct oversight. Evidence that institutions successfully maintained or restored essential operations through tested continuity plans would weaken the assessment of inadequate redundancy.

Ahold Delhaize's restoration schedule provides a more immediate operational measure. The return of home deliveries, online ordering and distribution services would demonstrate that the company can restore affected functions without compromising its remaining operations. Continued outages, additional disruptions or evidence of more extensive compromise would strengthen concern about the consequences of shared digital infrastructure. The company's final investigation may also clarify whether its protective shutdown prevented wider damage.

The GAO findings raise a longer-term question about institutional correction. OMB can issue updated guidance, and agencies can complete and maintain the required inventories. Those would be measurable improvements. The important evidence will be whether agencies actually meet the requirements and whether oversight verifies that the inventories are accurate and useful. A policy announcement without implementation would leave the underlying weakness largely unchanged.

I'm also watching whether the growing use of autonomous tools in cyber intrusions produces verified changes in incident frequency, detection times or defensive capacity. The October 19 investigation provides evidence of one significant campaign, but it doesn't establish how widespread the technique has become or how effectively organizations are adapting. Additional independently verified incidents, especially those affecting essential services, would alter that assessment.

Across these developments, the most important indicators concern the work that remains after a system is technically restored. If institutions can account for interrupted services, identify everyone affected and complete necessary corrections, the evidence would support substantial repair capacity. If systems return online while unresolved obligations, inaccessible remedies or incomplete records remain, the assessment would need to distinguish operational recovery from the restoration of the service people were entitled to receive.

Current Risk Assessment · October 20, 2026

Current assessment: Strained, with substantial compensatory capacity still functioning. A cybersecurity incident has interrupted the nationwide system used to distribute federal bankruptcy notices, requiring courts to establish temporary procedures for legally consequential communications. Separate cloud and corporate cybersecurity incidents have disrupted banking, court participation and grocery services. Recovery mechanisms are operating, but their effectiveness varies by service, institution and the ability of affected people to use available alternatives.

Expected if this assessment holds: Continued reliance on temporary administrative procedures while the Bankruptcy Noticing Center is restored, followed by additional work to reconcile delayed notices and affected proceedings. Organizations dependent on shared digital infrastructure may experience further service interruptions requiring manual workarounds, technical failover or temporary suspension of affected systems. The consequences are likely to be uneven, with greater burdens on people and institutions that lack accessible alternatives.

Would weaken the assessment: Prompt restoration of the Bankruptcy Noticing Center accompanied by verified clearance of delayed notices, consistent protection of affected parties and limited unresolved procedural consequences; evidence that cloud and grocery services have recovered without significant outstanding obligations; effective continuity arrangements demonstrated through incident reviews; and measurable progress in federal technology inventories and oversight.

Status: STRAINED — COMPENSATING. The documented incidents have interrupted essential functions without establishing a general failure of the institutions responsible for them. Courts, technology providers and businesses have preserved or restored substantial operations. The unresolved risk concerns whether their compensatory arrangements can reliably deliver the original services, particularly where legal rights, financial access or essential household needs depend on functions that remain interrupted.

Sources

Administrative Office of the U.S. Courts, “Cybersecurity Incident Disrupting Bankruptcy Court Operations”, October 15, 2026. Primary confirmation of the contractor incident and nationwide interruption of Bankruptcy Noticing Center services.

U.S. Bankruptcy Court, Southern District of Florida, “Administrative Order 2026-06: Bankruptcy Noticing Center Service Interruption”, October 16, 2026. Primary court order establishing temporary notice responsibilities, deadlines, safeguards and procedures for relief.

U.S. Bankruptcy Court, Eastern District of Texas, “BNC Service Interruption Update”, October 14, 2026. Court announcement documenting emergency orders, continued case processing and alternative creditor-list procedures.

U.S. Bankruptcy Court, District of Hawaii, “Notice of BNC Nationwide Outage”, October 14, 2026. Primary description of affected notice services, functioning electronic filing notifications and available procedural remedies.

Reuters, “U.S. Federal Bankruptcy Court Operations Disrupted by Cybersecurity Incident”, October 16, 2026. Independent reporting on the contractor incident and its effects on federal court operations.

Google Cloud Service Health, “Multiple Services Are Experiencing Issues in the europe-west2 Region”, October 20, 2026. Primary incident record identifying the affected infrastructure, reported power event, service interruptions and recovery updates.

Reuters, “Google Cloud Services Down in UK; Banks, Public Sector Report Issues”, October 20, 2026. Reporting on the cloud outage, affected financial services and regulatory oversight of critical technology providers.

The Guardian, “Google Cloud Failure Hits Millions as UK Courts and Banks Knocked Offline”, October 20, 2026. Reporting on disrupted remote court hearings, banking services and the initial recovery.

Ahold Delhaize, “Ahold Delhaize Update on Status of Cybersecurity Incident”, October 19, 2026. Primary company statement documenting the incident, protective shutdowns, continued store operations and restoration schedule.

U.S. Government Accountability Office, “Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices,” GAO-26-108937, September 30, 2026. Primary audit of federal agency networked-device inventories and oversight deficiencies.

Reuters, “How One Hacker Used AI Agents and a Few Thousand Dollars to Break Into Scores of Sites”, October 19, 2026. Investigation documenting autonomous AI-assisted intrusions, affected businesses and remaining uncertainties about the extent of compromise.

Trump Waives Russia Sanctions Weeks After Signing Them Into Law

US President Donald Trump speaks with Russian President Vladimir Putin, as they meet to negotiate for an end to the war in Ukraine, at Joint Base Elmendorf-Richardson in Anchorage, Alaska, US, August 15, 2025. Photo: Kevin Lamarque

On October 16, President Donald Trump waived most of the sanctions and tariffs established under the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, less than a month after signing the legislation into law. The measures were intended to increase economic pressure on Russia over its invasion of Ukraine, including through substantial tariffs on countries purchasing Russian oil and gas. Instead, the administration suspended their application before they could take effect, citing the national interest and the potential economic consequences of enforcement.

The decision follows Trump's October 9 announcement of an agreement with Russian President Vladimir Putin to purchase Russian diesel in an effort to reduce fuel prices. It also comes amid deteriorating relations between Washington and Kyiv, with Trump criticizing Ukrainian strikes on Russian energy infrastructure while the war involving Iran continues to disrupt global energy supplies. Together, these developments represent a change in how the United States is approaching the economic pressure it has sought to impose on Russia.

There is another development that warrants examination. In September, ProPublica revealed that Umar Kremlev, a Russian oligarch with close ties to Putin, had paid hundreds of thousands of dollars toward celebrations surrounding Donald Trump Jr.'s wedding. The arrangement prompted congressional investigations and a formal request for an FBI counterintelligence assessment. The payments were subsequently reported to have been reimbursed, and there is no publicly established evidence connecting them to the sanctions waiver. Nevertheless, the financial relationship raises questions about foreign access to the president's family, the safeguards surrounding presidential decision-making, and the institutions responsible for examining potential conflicts of interest.

Congress Passed the Sanctions, but Trump Controls Their Enforcement

The Graham Act became law on September 18, 2026, following months of negotiations and bipartisan support in Congress. Its purpose was to increase the economic consequences of Russia's continued invasion of Ukraine, particularly by targeting the international trade that sustains Russian energy revenues. The legislation established additional sanctions against Russian officials, financial institutions, and entities involved in moving Russian energy products, while creating penalties for countries that continue purchasing those products or facilitate sanctions evasion.

The October 16 executive order describes a 500% increase in duties on goods imported from Russia, along with 100% tariff increases affecting major importers of Russian oil and natural gas and countries facilitating sanctions evasion. These provisions were designed to extend American economic pressure beyond Russia itself. China and India, among the largest purchasers of Russian energy, were particularly exposed to the potential consequences, and both governments had raised concerns about the legislation.

Yet Section 4 of the executive order waives the application of the new duties and numerous sanctions provisions. The order relies on Section 115 of the Graham Act, which permits the president to waive penalties after certifying to Congress that doing so serves the national interest and providing a report explaining the decision. Trump states that those submissions have been made. The waivers remain effective until the president or designated administration officials determine that further action is appropriate.

The administration has not eliminated all sanctions on Russia. The order explicitly preserves measures imposed under separate executive authorities, meaning existing restrictions remain in force even as the newly enacted provisions are suspended. Nor has the law itself been repealed. Congress's statutory framework remains available for future enforcement, but its principal new penalties are not currently being applied.

That leaves Congress in an unusual position. Lawmakers enacted a sanctions package with overwhelming bipartisan support, but they also included the authority Trump used to suspend it. The administration's action therefore cannot be treated as a straightforward refusal to obey the statute. The law expressly permits waivers, subject to specified requirements. The more consequential issue is how much control Congress retained over the policy it enacted and what meaningful options remain available when the executive branch exercises that discretion in a way lawmakers oppose.

Members of both parties have criticized the decision, arguing that it undermines efforts to pressure Russia. But Congress is currently in recess, and any attempt to change the waiver authority or compel a different outcome would require additional legislative action. The sanctions law remains intact while its intended enforcement has been postponed, demonstrating how broad agreement on a policy can coexist with limited congressional control over whether that policy actually operates.

Energy Prices Are Changing the Administration's Calculations

The waiver arrives during a period of considerable strain in global energy markets. The war involving Iran has disrupted production and shipping, contributing to higher fuel prices and uncertainty over the availability of oil and gas. The administration has increasingly focused on expanding available energy supplies, including through arrangements involving Russia, even as the United States continues to support Ukraine in its defense against the Russian invasion.

Trump's October 9 announcement of a diesel agreement with Putin is especially relevant. According to the president, Russia agreed to supply more than 300,000 tons of diesel initially, followed by additional deliveries in November and afterward. The administration presented the arrangement as an effort to reduce fuel costs, while critics warned that renewed purchases of Russian energy could provide revenue supporting Moscow's war effort. The announced agreement establishes the administration's intention to purchase Russian fuel, although the delivery volumes and economic effects still require confirmation through subsequent trade data.

Secretary of State Marco Rubio said the administration would take up to 60 days to evaluate the economic consequences of implementing the sanctions. He pointed to the potential effects on the United States, the global economy, and countries such as India that depend heavily on Russian energy. Rubio also cited the existing pressure on energy markets from the Iran war and other tariffs already in place.

Those concerns reflect a genuine difficulty in the legislation's design. Secondary sanctions and tariffs are intended to influence behavior by imposing costs on countries and companies that continue trading with the targeted state. But the same international connections that make those penalties potentially effective also create consequences for businesses, consumers, and governments beyond the intended target. A substantial tariff on goods imported from India, for example, could affect American companies and households whose supply chains depend on Indian manufacturing, even when those businesses have no direct relationship with Russian energy purchases.

The administration is effectively arguing that the costs of enforcing the new measures require further consideration. That doesn't establish whether the waiver is economically necessary or whether the alternative approach will produce better results. It does show that the government is confronting a conflict between two stated objectives: increasing pressure on Russia and limiting additional economic strain on the United States and its trading partners.

The legislation was designed to make continued purchases of Russian energy more costly. The administration is now treating the potential consequences of those costs as a reason to delay enforcement. Whether the government can achieve the law's objectives without applying its principal penalties remains an open question.

A Putin-Connected Oligarch Paid for Donald Trump Jr.'s Wedding Celebrations

On September 14, ProPublica published an investigation revealing that Umar Kremlev, a Russian businessman with close ties to Vladimir Putin, had financed substantial portions of the celebrations surrounding Donald Trump Jr.'s May wedding in the Bahamas. According to financial records reviewed by the newsroom and interviews with people familiar with the event, Kremlev paid hundreds of thousands of dollars toward expenses that included renting a private island, accommodations, fireworks, and event planning.

Kremlev is president of the International Boxing Association, an organization that has received financing from Gazprom, Russia's state-owned energy company. ProPublica reported that the wedding payments originated from a Dubai-based entity affiliated with the boxing association. Kremlev has received state honors from Putin, including the Order of Friendship, and has accompanied him on international visits. Ukraine has sanctioned Kremlev, describing him as closely connected to senior figures in Russia's security establishment.

The wedding celebrations involved approximately 50 guests, including members of Trump's family and several Russian attendees associated with Kremlev. Jared Kushner, who has participated in American negotiations concerning Russia and Ukraine, was among the guests. ProPublica also identified Alexander Lagutin, a businessman who has held senior positions at a Russian defense contractor and a state-backed energy company. The presence of these individuals does not establish improper conduct, but it places the financial arrangement within a network of relationships involving Russian state-connected business interests and people with access to senior American policymakers.

The relationship between Kremlev and Trump Jr. was not entirely new. The two appeared together at an International Boxing Association event in Istanbul in September 2025. Following that appearance, the organization issued a statement indicating that further joint initiatives were expected. Kremlev's representatives have described the relationship as a personal friendship and said that political matters were never discussed. Trump Jr.'s spokesperson similarly described Kremlev as a friend rather than a business associate.

After ProPublica published its investigation, Donald Trump Jr. and his wife, Bettina, publicly acknowledged Kremlev's role in financing two nights of celebrations following their private wedding ceremony. They characterized the arrangement as a generous gift from a friend and rejected suggestions that it carried a political motive. President Trump, who did not attend the wedding, said he did not know Kremlev and defended the arrangement as permissible. He subsequently told reporters that his son intended to repay the money, and reporting at the time indicated that reimbursement had occurred. On October 6, Kremlev publicly stated that Trump Jr. had repaid him. The public reporting does not independently establish the precise amount, timing, or financial records of that repayment.

The disclosure nevertheless prompted congressional scrutiny. On September 15, Representative Robert Garcia, the ranking Democrat on the House Oversight Committee, opened an investigation and requested financial records concerning the arrangement. Two days later, Representative Jim Himes, the ranking Democrat on the House Intelligence Committee, wrote to FBI Director Kash Patel requesting a counterintelligence assessment of the relationship.

Himes's letter focused on the risks created when foreign nationals with connections to adversarial governments provide substantial financial benefits to people close to American decision-makers. Although Donald Trump Jr. does not hold public office, his family relationship and political influence make him a potential avenue of access to senior officials. Himes asked whether the FBI had evaluated the arrangement and what steps had been taken to identify or mitigate any resulting risks. His letter requested answers by September 30. A substantive public response establishing the FBI's findings has not been identified in the reporting reviewed for this analysis.

The concerns are not limited to whether the payments violated a criminal statute. Counterintelligence work also examines relationships that may provide foreign governments or their associates with access, information, influence, or opportunities to cultivate obligations. A financial benefit does not have to result in a documented exchange of favors to warrant examination, particularly when it involves someone connected to a foreign government whose interests are directly affected by American policy.

The reported repayment is relevant because it may have ended the immediate financial benefit. It does not, by itself, establish what access Kremlev obtained, whether any expectations accompanied the original arrangement, or whether appropriate safeguards were applied. Those questions require evidence beyond the existence of the wedding payments.

There is no publicly established evidence that Kremlev requested the October 16 sanctions waiver, that Trump discussed the waiver with him, or that the financial arrangement influenced the president's decision. The chronology alone cannot establish causation. But the relationship is relevant to an assessment of institutional safeguards because the administration is making consequential decisions affecting Russian economic interests while Congress is seeking answers about financial access to the president's family by an individual with documented ties to Putin's government.

The Counterintelligence Questions Extend Beyond the Wedding

The Kremlev investigation raises a separate but related question about the government's capacity to identify and address potential foreign influence. That question becomes more consequential when the people involved have access to officials responsible for foreign policy, economic sanctions, intelligence cooperation, and diplomatic negotiations.

Former American intelligence and counterintelligence officials interviewed by ProPublica and The Atlantic described the wedding arrangement as the kind of access opportunity that foreign intelligence services may seek. Their concerns centered on the combination of substantial financial generosity, private social access, and relationships with individuals close to presidential decision-making. Those assessments identify a potential vulnerability; they do not establish that Kremlev acted on behalf of Russian intelligence or that anyone attending the wedding engaged in improper conduct.

The distinction is important because counterintelligence risk and proven corruption are not the same thing. A government may need to investigate a relationship precisely because its purpose and consequences are uncertain. Waiting until a specific improper decision can be proven may leave the institutions responsible for preventing foreign influence unable to act until after any damage has occurred.

The reported presence of Kushner adds another dimension. He has been involved in negotiations concerning Russia and Ukraine, placing him within the administration's diplomatic efforts involving the same foreign government to which Kremlev is closely connected. His attendance at a family wedding does not establish a conflict of interest. It does, however, make the question of access more significant than it would be if the event involved individuals with no connection to government decisions.

The institutional response is therefore as important as the relationship itself. Congress has requested information, but the public record reviewed here does not establish whether the FBI conducted an assessment, what it found, or whether any additional safeguards were implemented. Nor does it establish whether the administration considered the financial relationship when evaluating potential conflicts surrounding its Russia policy.

These gaps do not justify assuming that improper influence occurred. They do limit the public's ability to evaluate whether the relevant institutions identified and addressed the risk. A functioning counterintelligence process should be capable of examining potentially consequential foreign relationships without requiring proof of a completed crime, and the institutions responsible for oversight should be able to obtain enough information to assess whether that process occurred.

The sanctions waiver makes these questions more immediate because it is a concrete exercise of presidential authority with consequences for Russian economic interests. The wedding investigation does not explain why Trump waived the sanctions. It does establish a separate, documented concern about foreign financial access to his family that remains relevant when examining the safeguards surrounding decisions of this magnitude.

Ukraine Faces a Reduction in New Economic Pressure on Russia

For Ukraine, the waiver removes a newly authorized source of economic pressure intended to constrain Russia's ability to sustain its invasion. President Volodymyr Zelenskyy criticized the decision, arguing that it undermines the legislation's purpose and could encourage Russia to continue its attacks. His response follows growing tensions with Trump over Ukrainian strikes on Russian energy infrastructure and the administration's attempts to reduce global fuel prices.

Reuters reported on October 17 that relations between Washington and Kyiv had deteriorated over the preceding week, with disputes involving Russian energy, American intelligence support, and satellite communications important to Ukraine's defense. The sanctions decision is therefore not occurring in isolation. It is part of a broader set of changes affecting Ukraine's relationship with its most important international supporter.

The immediate consequences should not be overstated. The waiver does not eliminate existing American sanctions, end military assistance, or establish that Russia has received a measurable financial benefit from the suspended provisions. Because the new penalties had not yet taken effect, their removal cannot be measured as a reduction from an already operating enforcement system. The direct change is that additional pressure authorized by Congress will not begin on the original schedule.

Still, that change affects the options available to the United States and its allies. The Graham Act was intended to increase the costs of continued Russian energy trade, including by extending penalties to countries and intermediaries outside Russia. Suspending those measures leaves existing trade arrangements less exposed to the new American penalties, at least for now. It also changes the incentives facing countries that had been preparing for their implementation.

Whether Russia receives additional revenue, whether major energy purchasers change their behavior, and whether the waiver influences negotiations over Ukraine will require further evidence. But the direction of American policy has already changed. The administration is pursuing additional Russian energy supplies and delaying newly enacted penalties while simultaneously attempting to manage the diplomatic and security consequences for Ukraine.

That places economic policy, international security, and alliance relationships in increasingly direct competition. Measures intended to weaken Russia's capacity to wage war may also increase costs for countries the United States depends on economically. Efforts to reduce those costs may, in turn, limit the pressure available to support American security objectives.

The Law Remains in Place, but Its Enforcement Has Been Suspended

The institutional concern is not simply that the president exercised discretion. Governments need discretion to respond to changing conditions, and Congress explicitly authorized it in this legislation. The concern is what happens when a policy's enforcement depends on the willingness of the same institution that can suspend it, particularly when the reasons for enforcement are also the reasons enforcement becomes costly.

The Graham Act established a mechanism intended to change conduct through economic consequences. Those consequences were supposed to reach Russia and the countries helping sustain its energy revenues. But before the penalties became operative, the administration determined that their potential economic effects justified a waiver. The United States retains the authority to impose them, yet the decision to activate that authority now rests with the president and designated officials.

There is a difference between retaining a legal power and maintaining an effective enforcement system. A sanctions regime can exist in statute without changing the behavior it was designed to influence, especially if affected governments and businesses believe its penalties are unlikely to be applied. Conversely, the credible possibility of future enforcement may still influence behavior even while a waiver remains in place. Which of those conditions develops will depend on what the administration does next and how other governments respond.

The executive order directs the U.S. Trade Representative, working with other agencies, to continue monitoring Russian energy purchases and sanctions evasion. That preserves an administrative mechanism for gathering information and recommending further action. It does not establish an automatic date when the waived penalties will become effective. Rubio's proposed 60-day review may produce a new decision, but the order itself allows the waivers to continue until officials determine otherwise.

Congress's role also remains important. Section 115 requires a certification and explanatory report, creating a formal means by which the executive branch must account for its decision. Whether that requirement provides meaningful oversight depends on what the administration disclosed, how lawmakers evaluate the justification, and whether Congress can respond if it concludes that the waiver defeats the legislation's purpose.

The separate counterintelligence concerns involving Kremlev expose another part of the same institutional problem. Congress can request an assessment of potential foreign influence, but the effectiveness of that process depends on whether the responsible agencies examine the relationship, whether their findings reach the officials empowered to act, and whether any necessary safeguards are implemented. The existence of oversight authority does not establish that the underlying concern has been resolved.

These two developments should not be treated as proof of a common cause. The sanctions waiver is a confirmed policy decision, while the wedding investigation concerns a documented financial relationship and potential foreign influence risk. Their connection lies in the institutional responsibilities they engage: the ability to enforce policies, identify conflicts, evaluate foreign influence, and provide meaningful answers when consequential decisions are questioned.

Governments routinely establish mechanisms to regulate harmful conduct, enforce obligations, or correct failures. Those mechanisms often impose costs on the institutions and interests responsible for implementing them. If those costs become grounds for repeatedly suspending enforcement, the government can preserve the appearance of a functioning policy without delivering the consequences the policy was created to produce. Likewise, if oversight bodies cannot establish whether potential conflicts have been examined, formal accountability mechanisms may exist without providing the information necessary to evaluate government conduct.

Russia's war against Ukraine has not ended, and the economic relationships the Graham Act sought to influence remain active. The administration may ultimately determine that alternative measures can achieve the same objectives with fewer economic consequences. But that outcome has not been established. For now, the government has replaced scheduled enforcement with monitoring and the possibility of later action, while separate questions about foreign financial access to the president's family remain under congressional scrutiny.

What Happens After the Waiver

The administration's next decisions will determine whether the October 16 order represents a temporary adjustment or a more durable change in American sanctions policy. Rubio's 60-day review provides an initial point to watch, although the executive order does not require the waivers to expire at the end of that period. A decision to restore the penalties, narrow the waivers, or establish specific conditions for enforcement would materially change the current situation.

Congress's response will be equally important. Lawmakers can request additional information about the national-interest determination, examine the certification and explanatory report, hold hearings, or seek to amend the legislation. The effectiveness of those measures will depend on whether they produce substantive scrutiny and whether Congress can assemble the support necessary to alter the administration's discretion.

The Kremlev investigation requires its own follow-up. Garcia's request for financial records and Himes's request for an FBI counterintelligence assessment could establish more about the nature of the relationship, the original payments, the reported reimbursement, and whether government agencies identified any security concerns. Evidence of contacts involving Kremlev or his associates and officials responsible for Russia policy would also be relevant, although no such connection to the sanctions waiver has been established in the reporting reviewed here.

The international effects will be harder to measure immediately. Changes in Russian energy exports, purchases by major trading partners, sanctions-evasion activity, and American import patterns may provide evidence of how governments and businesses respond. Developments in Ukraine's security relationship with Washington will also matter, particularly if economic concessions to Russia coincide with changes in military assistance, intelligence cooperation, or diplomatic commitments.

The central question is whether the United States can maintain the economic pressure Congress intended while managing the domestic and international costs of enforcement. Alongside that question is whether the institutions responsible for examining foreign influence can meaningfully assess financial relationships involving people close to the president when those relationships intersect with matters of national security. Neither question can be resolved through the existence of a law, an investigation, or an executive review alone. The answers depend on what those mechanisms actually produce.

Current Risk Assessment · October 18, 2026

Current assessment: The United States has suspended major sanctions and tariff provisions of the Graham Act before implementation, leaving the statutory authority intact but shifting enforcement to future executive discretion. The change reduces the immediate availability of a newly enacted economic-pressure mechanism targeting Russia and countries involved in Russian energy trade. Existing sanctions under separate authorities remain in force. The administration continues to monitor relevant transactions, but the executive order establishes no automatic expiration date for the waivers. Separately, documented financial benefits provided by a Putin-connected Russian businessman to Donald Trump Jr. have prompted congressional oversight and counterintelligence concerns. The public record does not establish a causal connection between that relationship and the sanctions waiver.

Expected if this assessment holds: The new penalties will remain inactive while the administration reviews their economic consequences, and governments and businesses exposed to secondary tariffs will continue operating under uncertainty about possible future enforcement. American policy may continue balancing efforts to increase energy supply against the economic pressure intended to constrain Russia. Congressional scrutiny could increase after lawmakers return, particularly if the waivers remain in effect without a clear enforcement timetable. The Kremlev investigation may produce additional information about financial relationships, access to senior policymakers, and the government's handling of potential counterintelligence risks.

Would weaken the assessment: The administration reinstates the penalties or establishes enforceable conditions and deadlines for their application; Congress successfully modifies the waiver authority or demonstrates effective oversight of the national-interest determination; or verified evidence shows that alternative American measures are achieving the legislation's objectives without the waived sanctions. A documented reduction in Russian energy revenues attributable to American policy would also weaken concerns that the suspended provisions have materially reduced economic pressure. Regarding the separate foreign-influence concerns, independently documented financial records, completed counterintelligence assessments, and evidence of effective safeguards would help clarify whether the Kremlev relationship created an unresolved institutional vulnerability.

Status: HIGH — A confirmed change in the operation of newly enacted sanctions authority, with consequential exposure across governance, security and foreign policy, international energy trade, and global spillover. The Kremlev financial relationship is documented and has prompted congressional scrutiny, but its relationship to presidential policy decisions remains unestablished. The longer-term economic, security, and institutional effects remain uncertain.

---

Sources

The White House, “Implementing the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026,” October 16, 2026.

U.S. Government Publishing Office, Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, Public Law 119-111, September 18, 2026.

ProPublica, “Donald Trump Jr.'s Bahamas Wedding Was Secretly Bankrolled by Russian Oligarch Close to Putin,” September 14, 2026.

ProPublica, “Top Oversight Dem Opens Investigation of Donald Trump Jr.'s Russian Oligarch-Funded Wedding,” September 15, 2026.

House Permanent Select Committee on Intelligence Democrats, “Top Intel Democrat Probes Counterintelligence Threat from Trump Family Ties to Kremlin,” September 17, 2026.

The Atlantic, “Don Jr.'s Wedding Trap,” September 22, 2026.

Reuters, “Trump says his son told him he will repay Russian oligarch for wedding parties,” September 18, 2026.

Deseret News, “Trump Jr. returns wedding gift to Russian oligarch amid backlash,” October 6, 2026.

Reuters, “Trump waives many Russia-related sanctions, tariffs before they were to take effect under new law,” October 16, 2026.

Associated Press, “Trump puts new Russia sanctions passed by Congress on hold, saying waiver is in US national interest,” October 16, 2026.

Associated Press, “Trump's decision to waive Russian sanctions outrages Congress, but no quick counter seen,” October 17, 2026.

Reuters, “Trump-Zelenskiy rift threatens vital support for Kyiv,” October 17, 2026.

Reuters, “Rubio says Trump to take up to 60 days to weigh Russia sanctions,” October 18, 2026.

Ukraine's Strikes on Russian Data Centers Raise Questions About U.S. Pressure and Election Interference

Ukrainian drone strikes on Russian Yandex data centers in October 2026 disrupted digital infrastructure and prompted questions about whether Russian influence operations were affected. Independent researchers have not established that the strikes disabled networks targeting Western elections.

Between October 7 and 11, Ukrainian drones struck three data centers operated by Yandex, one of Russia's largest technology companies. The attacks disrupted Russian internet infrastructure and were followed by claims that Russian propaganda accounts supporting Donald Trump and other Western political movements had suddenly gone quiet.

The timing was particularly interesting. The United States is less than three weeks away from its midterm elections, and researchers have already documented Russian influence operations targeting Democratic candidates. If Ukrainian attacks had disrupted the infrastructure supporting those operations, the consequences could extend well beyond Russia's war with Ukraine.

But something else was happening at the same time. The Trump administration was pressuring Ukraine to stop attacking Russian oil refineries, reportedly threatening access to American weapons and intelligence. Ukraine then experienced unexpected restrictions on the satellite communications systems used by its military drones. Ukrainian officials also reported that Western intelligence warnings hadn't arrived before Russian missile attacks. On October 14, Russia struck 30 Ukrainian energy facilities, leaving at least 600,000 people without electricity.

I don't think we can establish that these events were coordinated, or that the communications restrictions were retaliation for the Yandex attacks. The evidence available so far doesn't support that conclusion. But I'm interested in the relationships between them, particularly because they involve several forms of power that aren't usually examined together: control over digital infrastructure, the ability to conduct foreign influence operations, dependence on military technology, and the authority to restrict access to systems other people need to survive.

The approaching American election makes those relationships especially consequential.

The Yandex Attacks Disrupted More Than Internet Search

Yandex operates a substantial part of Russia's digital infrastructure. Its services include search, cloud computing, mapping, transportation, advertising and other systems used by businesses and individuals. Its data centers provide computing capacity for services that depend on remote servers rather than equipment located with the end user.

Between October 7 and 11, Ukrainian drone attacks struck three Yandex facilities. According to Cloudflare's October 14 analysis, traffic associated with Yandex's search network fell approximately 99 percent below its previous baseline, while traffic associated with Yandex Cloud fell roughly 90 percent. Both networks remained substantially disrupted through October 13.

Those are significant disruptions, although they don't tell us that every service operating on the affected networks stopped working. Cloudflare also observed a decline in malicious scanning and probing activity originating from Yandex Cloud, followed by activity shifting to other hosting providers.

That last finding is worth paying attention to. Some automated activity was disrupted, but the activity didn't necessarily disappear. Cloudflare found evidence that high-volume automation migrated elsewhere. The distinction matters because the ability to move operations between providers is itself a form of redundancy.

A physical attack can disable a facility, interrupt connections and make a particular provider unavailable. Whether it disables an operation depends on how much that operation relies on the affected infrastructure and whether its operators have somewhere else to go.

In the days following the strikes, social media users circulated charts showing the collapse in Yandex traffic alongside claims that Russian-operated political accounts had disappeared from MAGA communities, Germany's Alternative für Deutschland, Britain's Reform UK and other online groups.

The implication was that Ukrainian drones had unintentionally, or perhaps deliberately, interrupted the infrastructure supporting Russian political influence abroad.

Graphika investigated those claims using its existing maps of online communities. Its researchers found that none of the Western political communities identified in the viral posts had lost their active accounts or their most prolific contributors. The strongest reductions in posting appeared in Russian-speaking communities, where activity declined following the strikes.

The charts that had circulated most widely measured Yandex's automated web crawlers, which index internet content for search. They weren't measuring political accounts on social media platforms.

That changes what we can conclude from the attacks. There was a substantial disruption to Russian digital infrastructure, including some automated activity associated with Yandex Cloud. There wasn't a demonstrated collapse of Russian propaganda operations in Western political communities.

But the distinction also identifies something that remains unresolved. Graphika's findings address the specific claims circulating online. They don't establish that no influence operation anywhere was affected, just as the traffic declines don't establish that one was.

To answer that question, we'd need evidence connecting particular influence networks to the infrastructure that was damaged. We would also need to know whether those networks experienced operational changes that couldn't be explained by ordinary fluctuations or movement to other providers.

That's a much narrower question than whether Russian bots suddenly disappeared from the internet. It's also one we may eventually be able to investigate.

Russian Influence Operations Are Already Targeting the Midterms

The reason I think the election connection deserves attention is that we don't have to speculate about whether Russia is conducting influence operations against American political candidates.

On September 21, Graphika published an investigation identifying a coordinated Russia-aligned operation targeting candidates in the November midterms and Germany's September state elections.

The researchers attributed the activity with high confidence to Operation Overload and the Foundation to Battle Injustice, an organization founded by Yevgeny Prigozhin. The network distributed manipulated videos, impersonated established news organizations and circulated unverified allegations of corruption and electoral misconduct.

Among the American politicians targeted were James Talarico, Jon Ossoff, Chris Pappas, Sherrod Brown, Mary Peltola, Roy Cooper, Abdul El-Sayed, Joshua Turek and Troy Jackson. The operation also used footage of American celebrities with fabricated text suggesting they supported an anti-Democratic campaign.

Some of the material went further. It impersonated news outlets and journalists to promote allegations that Democrats themselves were manufacturing claims of Russian election interference.

That is an important part of the operation because it targets the process by which interference might be recognized. An influence campaign can circulate false allegations against political candidates while simultaneously attempting to discredit the people and institutions investigating those allegations.

The United States has encountered this before. American intelligence agencies concluded that Russia conducted an influence campaign during the 2016 presidential election, including efforts intended to damage Hillary Clinton and a preference for Donald Trump. The Senate Intelligence Committee's bipartisan investigation subsequently documented the scope of Russian activities, including social media operations and efforts to exploit political divisions.

The historical record establishes that Russian actors have sought to benefit Trump politically. The current Graphika findings establish that Russia-aligned operations are targeting Democrats ahead of another American election. They don't establish that Trump requested, directed or coordinated the present campaign.

That distinction doesn't make the political implications disappear. The administration has an interest in the outcome of the midterms, Russian influence operators are attempting to shape the information environment in which those elections occur, and Ukraine has attacked Russian infrastructure that could conceivably support some digital operations.

The question is whether those interests have intersected in decisions about Ukraine.

I wouldn't treat the Yandex traffic collapse as evidence that they have. But I also wouldn't dismiss the possibility of an electoral dimension simply because the most widely circulated explanation of the bot activity was wrong.

There is already enough documented activity to investigate what Russian influence networks are doing, how their infrastructure is distributed, and whether disruption to Russian computing capacity has any measurable effect on their operations.

The U.S. Has Reduced Election-Security Support While Foreign Operations Continue

The Russian influence campaign is occurring during a period when the federal government's election-security support has been significantly reduced.

On September 24, the Cybersecurity and Infrastructure Security Agency released its election infrastructure security plan, approximately 40 days before the midterms. The plan described services intended to help state and local election officials address cybersecurity threats, physical security risks and information sharing.

But Associated Press reporting found that election officials in multiple states considered the plan inadequate and too late to replace assistance they had previously received.

The Trump administration had cut approximately 1,000 positions from CISA and reduced funding for cybersecurity initiatives, including support for state and local election officials. Officials described losing access to services such as penetration testing, security exercises and intelligence briefings. Minnesota expected to spend approximately $250,000 on private penetration testing that federal assistance had previously helped provide.

Other states reported different experiences. Some federal services continued, and election officials have been developing their own arrangements to maintain security. Michigan officials expressed confidence in their ability to administer the election despite reporting a substantial deterioration in their relationship with CISA.

The problem isn't that every state has suddenly become unable to protect its elections. It's that a shared source of expertise and coordination has been reduced, leaving states to compensate according to their individual resources.

That matters for foreign influence operations because the threat doesn't respect state boundaries. A coordinated campaign can target candidates in several states, impersonate national media organizations and circulate content across platforms used throughout the country. Identifying connections between those activities requires information that may be distributed among federal agencies, state officials, private researchers and technology companies.

If the federal coordination layer weakens, individual states can still detect and respond to threats, but they may have less access to the information needed to recognize a larger operation.

There's also a difference between maintaining the ability to conduct an election and maintaining the ability to identify attempts to manipulate the information surrounding it. Election infrastructure can remain secure while foreign actors circulate fabricated material intended to influence voters.

That distinction is particularly relevant here because the documented Russian operation involves political messaging and impersonation rather than a demonstrated compromise of voting equipment.

The election-security system can absorb some of the loss of federal support through private contractors, state resources and independent research. But those substitutions don't necessarily restore the same coordination or investigative capacity. They may also create new differences between jurisdictions with substantial resources and those with fewer options.

We have evidence of continuing foreign influence activity and reduced federal assistance. We don't yet know whether the remaining institutions can compensate adequately for what has been lost.

Washington Was Already Pressuring Ukraine Over Russian Energy Attacks

While the Yandex strikes were taking place, the Trump administration was pursuing a separate dispute with Ukraine over attacks on Russian oil refineries.

Ukraine has targeted Russian refining infrastructure because it contributes to Russia's fuel supply, military logistics and revenue. The attacks also have consequences for energy markets, especially when fuel supplies are already under pressure.

Trump has made lowering fuel prices a political priority ahead of the midterms. His administration recently lifted sanctions on Russian diesel, and he has urged Ukraine to stop attacking Russian refineries.

On October 11, Reuters reported that the Financial Times had obtained accounts from European officials describing American threats to restrict intelligence sharing and the Prioritised Ukraine Requirements List, the mechanism through which European governments purchase American weapons for Ukraine.

Reuters couldn't independently verify those reported threats at the time, and the White House hadn't responded to its request for comment. The Financial Times account nevertheless identified a specific form of pressure: restricting resources Ukraine depends upon unless it changes its military targeting decisions.

Trump also announced that Russia and Ukraine had agreed to an immediate ceasefire covering energy infrastructure. Neither government confirmed the agreement at the time, and Russia continued attacking Ukrainian facilities.

The administration's position has an identifiable economic rationale. Russian refinery disruptions can contribute to fuel-market pressures, and higher fuel prices are politically damaging to a president whose party faces an approaching election.

Ukraine's position has a different rationale. Russian energy infrastructure supports a state conducting an ongoing war against it, and limiting that infrastructure can affect Russia's capacity to sustain military operations.

The disagreement itself isn't unusual. Allies can have conflicting economic and military priorities. What matters here is the mechanism available to resolve that disagreement.

The United States controls access to weapons procurement and intelligence systems that Ukraine needs. If those resources are used to compel changes in Ukrainian targeting decisions, the United States can exercise considerable influence without assuming direct responsibility for the military consequences.

That is where the relationship becomes structurally important. Ukraine remains responsible for defending its territory and population, but some of the capabilities required to do so depend on decisions made by another government.

The pressure over Russian refineries was already documented as the Yandex controversy developed. That means we can't reasonably infer that the pressure began because of the data-center attacks. The chronology supports an existing conflict over Russian energy infrastructure, with the Yandex strikes occurring during the same period.

It leaves open whether the data-center attacks created any additional concern within the administration, but there isn't evidence establishing that they did.

Starlink Restrictions Affected Ukrainian Drone Operations

On October 14, Ukrainian officials reported that restrictions affecting SpaceX's military satellite communications systems had disrupted drone missions.

Ukraine uses Starlink technology extensively for military communications, including systems integrated into drones. Some of those drones operate at speeds that require communications terminals to remain connected while moving rapidly across the battlefield.

According to Reuters, Ukrainian officials said military-grade Starshield terminals began disconnecting when moving above specified speeds. Presidential adviser Serhiy Beskrestnov reported a limit of 160 kilometers per hour, although a Ukrainian defense source said some units experienced disconnections at lower speeds.

Beskrestnov said Ukrainian forces hadn't received advance warning and that several missions had been disrupted. Military sources told Reuters the restrictions affected both offensive drone operations and defensive interception of Russian drones.

Elon Musk responded that limits on the military system's speed or use were determined by the American military and ultimately the president. His statement placed responsibility for those restrictions with the U.S. government rather than solely with SpaceX.

The distinction between Starlink and Starshield matters because they operate under different arrangements. SpaceX controls its commercial services, while Starshield provides military and intelligence capabilities under government arrangements. Reporting about restrictions to one system shouldn't automatically be treated as evidence that every Starlink service was restricted in the same way.

But the broader dependence is clear. Ukraine has incorporated externally controlled satellite communications into military operations that require reliable connectivity. A change in access conditions can affect those operations even when the underlying equipment remains functional.

Ukrainian officials suspected the restrictions might be connected to Washington's pressure over refinery strikes. American officials disputed administration involvement in the reported restrictions. The available reporting doesn't establish who authorized the specific changes, what rules governed them or whether political considerations influenced the decision.

What we do know is that the restrictions were reported by the people operating the systems, that Ukraine said missions were disrupted, and that the resulting questions about responsibility remained unresolved.

The distinction between technical and political causes matters for determining who should answer for the decision. It doesn't change the immediate dependency.

A drone that loses its connection during an interception can't complete the same mission simply because the restriction originated in a contract, a technical configuration or an instruction from another government.

The system's ability to function depends on a condition that its operators don't fully control.

Ukraine Also Reported Missing Intelligence Warnings Before Russian Attacks

The satellite restrictions were accompanied by another concern: Ukraine reported that it hadn't received the usual advance intelligence warnings before Russian missile strikes.

On October 13, Zelenskyy said Ukraine had experienced a second consecutive attack without warnings from Western partners. The attacks included ballistic missiles targeting Kyiv and energy infrastructure.

American officials maintained that intelligence sharing continued. Other reporting indicated that warnings resumed during subsequent attacks, and officials offered technical explanations for the disruptions.

That leaves an important factual question unresolved. A missing warning doesn't establish that intelligence sharing was deliberately suspended, particularly when officials responsible for the systems dispute that interpretation.

But the difference between an interruption in intelligence sharing and an interruption in the delivery of intelligence can be smaller for the people depending on the warning than it is for the institutions responsible for producing it.

An early-warning system has several necessary steps. A threat must be detected, identified, assessed and communicated quickly enough for defensive action. A failure at any point can leave the recipient without useful warning, even if the larger intelligence relationship technically remains in place.

That is why the reported warning failures deserve investigation independently of the political dispute. Ukraine needs to know whether the warnings weren't generated, weren't transmitted, arrived too late or were affected by an intentional change in the sharing arrangement.

Each possibility implies a different problem and a different repair.

If the failure was technical, the system needs technical correction and evidence that the correction works. If it was procedural, the communication process needs to change. If access was deliberately restricted, the relevant decision-makers need to account for the authority they exercised and the foreseeable consequences.

Without that information, Ukraine can recognize the failure but may be unable to prevent it from happening again.

Russia's October 14 Strikes Increased Ukraine's Repair Burden

On October 14, Russia launched another large-scale attack on Ukrainian energy infrastructure, primarily affecting Kyiv and Kharkiv.

According to Ukrainian authorities, 30 energy facilities were damaged and at least 600,000 people lost electricity. Three people were reported killed in Kyiv. Russia acknowledged strikes on energy facilities, while Zelenskyy accused Moscow of disregarding Trump's announced energy ceasefire.

The attacks followed several days of disagreement over whether an energy ceasefire existed at all. Trump had announced an agreement, but neither Russia nor Ukraine had confirmed it in the form he described. Russia continued attacking Ukrainian infrastructure.

There's no evidence establishing that the October 14 strikes were coordinated with American decisions about satellite communications or intelligence warnings. Russia had been attacking Ukraine's energy infrastructure long before the Yandex strikes, and its military campaign has its own objectives.

But the simultaneous pressures matter because they affect different parts of Ukraine's ability to withstand and recover from attacks.

Air defenses attempt to prevent damage. Intelligence warnings provide time to prepare. Communications systems support the operations of defensive equipment. Repair crews and utilities restore infrastructure after an attack succeeds.

A problem in one part of that arrangement increases the demands placed on the others. If fewer incoming drones can be intercepted, more may reach infrastructure targets. If warnings arrive late, preparations may be reduced. If multiple facilities are damaged, restoration crews must divide their equipment and labor across a larger number of sites.

Ukraine has repeatedly restored electricity following Russian attacks. Those restorations demonstrate substantial operational capacity, but they don't tell us how much replacement equipment, redundancy or reserve capacity remains afterward.

An electrical system can return to service while operating with fewer backup options than it had before the attack. Repeated repairs may preserve electricity delivery while consuming the components and labor needed to respond to the next disruption.

The effect extends beyond power generation. Electricity supports water systems, communications, heating, transportation, healthcare and industrial activity. Damage to a relatively small number of critical facilities can therefore create demands across several other systems.

The October 14 attacks add to that accumulated burden. The fact that Ukraine continues restoring service is important, but it shouldn't be mistaken for evidence that the underlying system has recovered all the capacity it has lost.

The Election Connection Changes What Needs to Be Investigated

The strongest reason to examine these events together is that they involve different systems through which governments and private actors can influence outcomes without exercising direct control over the institutions ultimately responsible for them.

Russia-aligned influence operations can distribute fabricated political material across American platforms without controlling American elections. The Trump administration can influence Ukrainian military decisions through access to weapons and intelligence without directly commanding Ukrainian forces. SpaceX and the U.S. government can establish operating conditions for satellite systems used in Ukrainian military equipment without operating that equipment themselves.

In each case, a decision made in one part of a system can change what another part is able to do.

The possibility of retaliation for the Yandex attacks is worth investigating because the affected infrastructure, the ongoing influence operations and the approaching election create a plausible area of overlapping political interest. But plausibility isn't enough to establish that the attacks damaged election operations or that American officials responded to protect them.

For that interpretation to become stronger, we'd need evidence connecting the Yandex facilities to identified influence networks, measurable disruption to those networks, and some indication that the disruption influenced decisions by American officials or technology providers.

We don't have that evidence now.

There is, however, a more immediate question about whether the Trump administration's documented pressure over Russian energy targets was accompanied by changes to Ukraine's access to military resources. The reported threats concerning weapons and intelligence are directly relevant to that question. So are the Starshield restrictions, the missing intelligence warnings and the competing explanations offered by officials.

The available evidence doesn't yet establish a common decision behind those developments. It does establish that Ukraine experienced operational problems involving capabilities controlled by outside actors during a period of unusually explicit political pressure.

I think the distinction is important because uncertainty about the motive shouldn't prevent us from examining the mechanism.

We don't need to know whether the Yandex strikes angered Trump or Musk to recognize that Ukraine's military dependence gives outside decision-makers significant power over its operations. We also don't need proof that the strikes affected Russian election operations to recognize that Russia-aligned networks are actively targeting American candidates while federal election-security support has been reduced.

Those are independently significant conditions. If evidence eventually connects them, the consequences become more serious. If it doesn't, the underlying problems remain.

What I’m watching now

The first thing I'm watching is whether anyone establishes a reliable connection between the damaged Yandex infrastructure and identifiable Russian influence operations. Cloudflare's findings show that some automated activity shifted to other providers after the attacks, while Graphika found no collapse in the Western political communities named in viral claims. I'd want to know whether specific operations changed their hosting arrangements, whether their activity declined for more than a brief period and whether any reduction was actually attributable to the strikes.

I'm also watching the Russia-aligned operations Graphika identified in September. Those accounts were distributing manipulated material about American candidates before the Yandex attacks. Their subsequent activity could provide a useful comparison, although a change in posting alone wouldn't establish its cause. We would need to distinguish disruption from ordinary campaign changes, platform enforcement and movement between accounts or services.

On the American side, I'm watching whether state election officials regain meaningful access to federal intelligence and cybersecurity support before November. CISA has announced services, but state officials have reported that some of the assistance they previously relied upon is no longer available or arrived too late to be useful. I want to know whether the promised coordination actually reaches election officials, particularly when researchers identify foreign operations targeting candidates across multiple states.

For Ukraine, the immediate question is who authorized the Starshield restrictions and whether the affected capabilities have been fully restored. Ukrainian officials reported that missions were disrupted without warning, while Musk said the military system's operating limits were determined by American authorities. That should be traceable through the relevant operational arrangements, even if the records aren't currently public. I'd also want to know whether any restrictions remain and whether Ukraine has been given a reliable process for learning about future changes before they affect active missions.

The intelligence-warning failures require the same attention. American officials say intelligence sharing continued, while Ukraine says warnings didn't arrive before particular attacks. Those accounts could both describe parts of the same event, depending on where the failure occurred. What matters is whether the cause is established and the warning system returns to reliable operation.

I'm also watching whether Washington continues threatening weapons procurement or intelligence access in response to Ukrainian attacks on Russian refineries. The administration has a stated interest in reducing fuel prices, and Ukraine has a military interest in limiting Russia's energy resources. If the United States uses control over essential support to enforce its preferred outcome, that would provide a clearer example of the dependence already visible in the communications dispute.

Finally, I'm watching Ukraine's energy restoration capacity after the October 14 attacks. The number of people without electricity tells us how extensive the immediate disruption was, but the repair timeline and the condition of the restored system will tell us more about what Ukraine has available for subsequent attacks. If service is restored through temporary arrangements, depleted reserves or equipment borrowed from other facilities, the visible recovery may conceal a reduction in the system's ability to absorb another strike.

What interests me most about this sequence is that several of the important questions concern decisions or information held by institutions outside the reach of the people experiencing the consequences. Ukraine can report a lost communications link or missing warning, but it may not have access to the records explaining why. Election officials can recognize foreign influence activity while lacking the federal intelligence relationships that previously helped them investigate it.

Those gaps don't establish misconduct. They do make misconduct harder to distinguish from ordinary failure, and they make both harder to correct.

Current Risk Assessment · October 15, 2026

Current assessment: Ukrainian attacks substantially disrupted Yandex infrastructure, but independent investigations haven't established that they disabled Russian influence operations targeting Western political communities. Separately, Graphika has documented Russia-aligned operations targeting American midterm candidates, while state election officials report reduced federal cybersecurity and intelligence support. During the same period, the United States reportedly threatened restrictions on military assistance over Ukrainian refinery strikes, and Ukraine reported disruptions to military satellite communications and intelligence warnings. The evidence supports elevated concern about Ukraine's dependence on externally controlled defense systems and reduced American election-security coordination. It doesn't establish a coordinated retaliation campaign connecting these developments.

Expected if this assessment holds: Ukraine will remain vulnerable to operational changes involving American-controlled military and intelligence systems, particularly where alternatives can't immediately replace the affected capabilities. Further restrictions or interruptions would increase the demands placed on Ukraine's other defensive systems and could add to the burden of repairing damaged infrastructure. In the United States, state election officials will continue relying on uneven combinations of state resources, private services and remaining federal assistance while Russia-aligned influence operations continue targeting political candidates. Investigations may identify additional activity, but establishing its origins and infrastructure will depend on access to information distributed across multiple institutions.

Would weaken the assessment: A documented explanation and durable correction of the Starshield restrictions and intelligence-warning failures would reduce concern about Ukraine's exposure to unpredictable access changes. Demonstrated alternatives capable of replacing the affected military functions would reduce its dependence on any single provider or government. Consistent restoration of federal election-security services, including actionable intelligence sharing and technical assistance, would weaken the assessment of declining coordination. Evidence that the Yandex disruption was limited to services unrelated to identified influence operations would further narrow the election connection. Conversely, documented links between the damaged infrastructure, election influence networks and subsequent political decisions would substantially strengthen the broader concern.

Status: ELEVATED — Ukraine's military dependence and the reduction in American election-security support are documented structural concerns. The possibility that disruption to Russian digital infrastructure influenced U.S. decisions remains unresolved and should be treated as an investigative question.

---

Sources

• Graphika — Yandex Strikes, Russian Bots and Influence Operations. October 13, 2026.

• Cloudflare — Yandex Outage: Data Shows That Instead of Going Dark, Malicious Bots Went on the Move. October 14, 2026.

• Graphika — Russia-Aligned Influence Operation Targets US Midterm Candidates, German State Elections. September 21, 2026.

• Associated Press — 40 Days to Midterms, Election Officials Say New US Cyber Plan Comes Too Late. September 24, 2026.

• The Washington Post — With Threats to Midterms, States Say Trump Administration Isn't Helping. October 4, 2026.

• Congressional Research Service — Election Security and the Cybersecurity and Infrastructure Security Agency. October 1, 2026.

• Reuters — US Threatens to Block Arms for Ukraine Over Refinery Attacks, FT Reports. October 11, 2026.

• Reuters — Ukraine Says SpaceX Hampers Drones for Attack and Defence, as US Ties Fray. October 14, 2026.

• The Washington Post — U.S. Warnings Sow Confusion, Alarm in Ukraine Over Intelligence, Starlink Access. October 14, 2026.

• Reuters — Russian Strikes Kill Three, Damage Dozens of Power Facilities. October 14, 2026.

The Power Grid Is Running Out of Room for Its Backup Plans

PJM's electricity grid serves approximately 67 million people across the Mid-Atlantic and Midwest. Rising demand, generation shortages and transmission constraints are placing increasing pressure on the resources used to maintain reliability. (Patrick Lewis/Loudoun Now)

On October 9, federal regulators rejected a proposal that would have allowed the nation's largest electricity grid operator to impose special curtailment obligations on certain large electricity customers, including data centers. Three days later, the Department of Energy authorized that same operator to use emergency generating resources and, under specified conditions, direct large electricity users to operate their own backup generators. By October 13, PJM Interconnection had issued a Maximum Generation Emergency/Load Management Alert, recalled active maintenance outages and identified generating resources it needed available to maintain reliability.

The decisions weren't responses to a single event. The Federal Energy Regulatory Commission was addressing how PJM could accommodate rapidly growing electricity demand without compromising future reliability. The Department of Energy was responding to an immediate operating problem involving elevated demand, scheduled generation outages and transmission constraints. But both decisions concern the same electricity system, and both involve arrangements intended to preserve service when ordinary available resources may be insufficient. The distinction between the two problems matters, particularly because a future capacity shortage isn't the same as an immediate shortage of electricity. What makes their convergence significant is that PJM is having to address both while the resources available to compensate for either are becoming more consequential.

PJM coordinates wholesale electricity markets and regional transmission across all or parts of 13 states and the District of Columbia, serving approximately 67 million people. Its July capacity auction, intended to secure electricity resources for the 2028–2029 delivery year, obtained 138,318 megawatts of accredited generation and demand-response capacity. Including resources committed outside the centralized auction, PJM still fell 6,831 megawatts short of its reliability requirement. The auction price reached its federally approved ceiling of $325 per megawatt-day, marking the second consecutive auction that failed to secure the required capacity. The previous shortfall had been approximately 6,517 megawatts. Higher prices were encouraging additional supply, but not enough to keep pace with the resources PJM expected to need.

That shortfall doesn't mean PJM will be unable to provide electricity in 2028. Capacity requirements include reserve margins designed to protect against unexpected failures and periods of unusually high demand, and the system has additional opportunities to secure resources before the delivery year begins. The significance is that the market responsible for arranging those resources in advance hasn't been able to meet its own reliability requirement, even at the maximum permitted auction price. PJM must now rely on additional procurement, changes in demand, generating upgrades or other arrangements to close the gap. Those responses may succeed, but they also require time, regulatory approval, financing and physical infrastructure that isn't yet available.

The October emergency brought a different set of constraints into immediate view. In its October 11 application to the Department of Energy, PJM anticipated electricity demand of approximately 111,500 megawatts or more on October 13, alongside roughly 61,591 megawatts of generation outages during the autumn maintenance season. It identified transmission restrictions limiting the movement of electricity between parts of its territory and neighboring systems, and warned that its operating reserves could become unusually tight. DOE issued Order No. 202-26-50 on October 12, authorizing specified emergency measures through October 16. PJM's subsequent operating notices confirmed that it had identified a reliability need for designated generating resources on October 13.

These measures don't establish that blackouts have occurred, or that every resource authorized under the emergency order has been dispatched. They do establish that the operator is making additional resources available through emergency procedures because the ordinary operating configuration may not provide sufficient flexibility. The distinction is important. An emergency intervention that prevents a service interruption is evidence that a protective mechanism worked. It can also be evidence that the system needed protection from conditions it could no longer comfortably accommodate through ordinary operations. Understanding which of those circumstances is developing requires examining what the intervention absorbed, how often similar interventions are needed and whether the conditions requiring them are improving.

Demand Is Growing Faster Than the System Can Accommodate It

PJM's capacity problems have been developing for several years, but the scale of projected demand growth has changed the planning environment. Data centers, particularly facilities supporting artificial intelligence infrastructure, are becoming increasingly important to the operator's forecasts. Unlike many traditional commercial customers, large data centers can require enormous amounts of electricity concentrated at individual sites, with relatively consistent consumption throughout the day. Some facilities also have demanding reliability requirements because even short interruptions can affect equipment, customer services and contractual obligations.

A single large project can therefore create requirements extending well beyond the amount of electricity it consumes. The grid must have sufficient generating capacity to serve that demand, transmission infrastructure capable of delivering it, and enough reserve capacity to manage equipment failures or unexpected changes in operating conditions. Those requirements become more difficult when several large projects seek connections within the same geographic area, particularly where the existing transmission network was designed around different patterns of electricity consumption.

The pace of development is also uneven. A data center can move from planning to construction and operation on a different timeline than a new generating station or major transmission project. New power plants may require years of permitting, equipment procurement, financing, construction and interconnection work. Transmission projects can involve multiple utilities, jurisdictions and regulatory proceedings. Even when the financing is available, the physical system cannot necessarily expand at the same speed as demand. PJM has been working to accelerate interconnections and obtain additional supply, but its capacity auctions indicate that the resources available within the relevant planning periods haven't caught up with projected requirements.

The July auction also demonstrates why higher prices alone cannot be treated as a sufficient response. The price cap was intended to moderate volatility and protect customers from abrupt increases in capacity costs. It provides a degree of financial predictability, which has value for households, businesses and electricity providers. But the cap doesn't create generating capacity. If the resources required to satisfy projected demand cannot be developed or committed within the relevant period, a higher market price may encourage investment without producing enough available supply in time. PJM itself acknowledged that the price collar could limit volatility without resolving the underlying imbalance between demand and supply.

The system's response has consequently expanded beyond its ordinary capacity auction. PJM has proposed a special Reliability Backstop Procurement process intended to secure additional resources, while pursuing changes to how large electricity customers connect to the grid. Both approaches recognize that the existing arrangements may be insufficient for the amount and timing of demand now being anticipated. They also introduce new questions about cost, authority and responsibility. If additional generation must be procured through long-term commitments, someone must assume the financial obligations. If large customers are allowed to connect before enough new supply becomes available, the operator needs enforceable rules governing what happens when the grid becomes constrained. Neither problem can be resolved solely by identifying the demand or announcing the investment required to serve it.

That was the issue behind FERC's October 9 decision. PJM proposed creating a registry of large electricity loads and an interim service arrangement that would allow certain new customers to connect under special curtailment obligations. FERC approved the registry, which will improve the operator's ability to identify and plan for large loads, but rejected the proposed interim service arrangement. The commission raised questions about jurisdiction and whether the proposal adequately justified treating some customers differently from others. Retail electricity service is generally subject to state regulatory authority, while FERC oversees interstate transmission and wholesale electricity markets. PJM's proposal had to operate within those divisions of responsibility.

The rejection doesn't mean regulators have decided that data centers must receive unrestricted electricity service regardless of system conditions. PJM can revise its proposal, and other arrangements may ultimately be approved. FERC's concerns also reflect legitimate questions about the authority to curtail service and the consequences of applying different rules to different customers. A large industrial facility, a hospital, a data center and a manufacturing plant may all consume substantial amounts of electricity, but they don't necessarily have the same ability to interrupt operations or substitute other sources of power. Any enforceable system must account for those differences without arbitrarily transferring obligations among customers.

For PJM, however, the practical consequence is that a proposed mechanism for accommodating additional demand while preserving emergency flexibility remains unresolved. The registry will provide better information about large loads, but information alone doesn't create capacity or establish when consumption can be reduced. The operator can identify a growing constraint without yet having an approved arrangement to manage every aspect of it. Meanwhile, projects continue moving through planning, financing and development, and the electricity system must prepare for the demand they may eventually create.

The Emergency Measures Are Drawing on the Same Resources That Provide Redundancy

The October emergency illustrates how the system's remaining flexibility can become increasingly important even when the immediate cause isn't the same as the longer-term capacity problem. Autumn is normally an opportunity for electricity generators to perform maintenance because demand is often lower than during the summer cooling season or winter heating season. Taking generating units offline during these periods allows operators to repair equipment, perform inspections and prepare for more demanding conditions. The practice is itself a reliability measure. Equipment that isn't maintained properly may become more likely to fail when it is needed most.

PJM's October 11 application identified unusually extensive generation outages during a period when electricity demand was expected to remain elevated. It also described transmission constraints affecting the movement of electricity between different parts of its territory and neighboring systems. Those constraints are important because electricity available somewhere in a regional network isn't necessarily deliverable wherever it is needed. Transmission lines have physical operating limits, and congestion can prevent generating resources in one area from compensating for shortages elsewhere. PJM also identified limitations involving neighboring systems, including the Midcontinent Independent System Operator, which had issued its own capacity advisory and conservative-operations notice.

Interconnection between regional grids is one of the electricity system's most important sources of redundancy. It allows operators to exchange electricity, share available resources and respond to localized shortages without requiring every region to maintain enough generating capacity to meet every conceivable circumstance independently. But that flexibility depends on conditions outside the affected operator's control. Neighboring systems must have electricity available to export, and the transmission infrastructure connecting them must have sufficient capacity to move it. If multiple regions experience elevated demand, maintenance outages or transmission restrictions at the same time, the amount of assistance available to any one system can become limited.

The Department of Energy's October 12 order provided PJM with additional options for managing those constraints. It authorized the dispatch of specified generating resources when necessary to preserve reliability and permitted the operator, under narrowly defined emergency conditions, to direct backup generation at large electricity-consuming facilities. The latter provision is especially consequential because it allows resources ordinarily maintained for private continuity to help reduce demand on the wider electricity system. A data center operating its own backup generators may continue supporting its equipment while drawing less electricity from the grid, leaving centrally supplied electricity available for other customers.

This is a useful arrangement, but it also exposes the limits of treating backup capacity as an uncomplicated solution. Backup generators require fuel, maintenance and equipment capable of operating safely. Batteries have finite storage capacity. Some facilities need their backup resources available for their own essential operations, and operating those resources may involve environmental restrictions or other practical constraints. The DOE order doesn't convert privately maintained backup equipment into permanent regional generating capacity. It authorizes a temporary response under specified conditions, including circumstances immediately preceding or during the most severe level of an energy emergency.

PJM's operating notices provide a more precise indication of what was happening on October 13. The operator had issued a Maximum Generation Emergency/Load Management Alert and instructed generators to provide information about how quickly they could return from planned outages. It also stated that certain resources identified under the DOE order were needed for the October 13 operating day, while clarifying that the order didn't automatically require those resources to operate at maximum output. That distinction prevents the emergency from being overstated. The authorization and the identified reliability need are documented; the eventual amount of additional generation actually dispatched, and the effect on operating reserves, require subsequent operating records.

The October order also follows earlier emergency authorizations involving PJM during 2026. Repeated authorization doesn't establish that the system is approaching collapse. Emergency procedures exist precisely because unexpected or difficult conditions arise, and their successful use can prevent much more serious consequences. But recurrence changes the questions worth asking. If the operator increasingly needs extraordinary measures during periods that were previously suitable for routine maintenance, those measures may be compensating for a reduction in ordinary operating flexibility. If maintenance must repeatedly be postponed or recalled, the system may also be exchanging flexibility in one period for additional equipment and scheduling pressure in another.

The available evidence doesn't yet establish that this exchange is producing a measurable deterioration in equipment reliability. It does establish that PJM is relying on several compensatory arrangements simultaneously: returning generators from maintenance, obtaining emergency operating authority, managing transmission constraints and preserving the option to reduce large customers' dependence on grid-supplied electricity. Each arrangement can work as intended while the underlying conditions remain unresolved. The important measure isn't simply whether customers retain service during the emergency, but whether the system can restore its ordinary operating margins afterward without requiring the same interventions again.

New Power Generation Won't Arrive Until 2028

Private investment is beginning to address some of the capacity constraints, including through agreements that connect major technology companies directly with electricity producers. On October 6, Google and Constellation announced a long-term agreement involving more than $4.3 billion in upgrades to existing nuclear generating facilities across PJM's territory. The upgrades are expected to add approximately 890 megawatts of generating capacity, with the first additions scheduled for 2028. A separate agreement covers 2,700 megawatts of existing electricity supply. The distinction matters because extending commercial support for existing generation isn't the same as creating new capacity, although retaining dependable resources can be valuable when the system is already facing a shortage.

The agreement demonstrates that large electricity customers can contribute to the infrastructure required to serve their demand. Long-term purchasing commitments can provide generating companies with the financial certainty needed to justify upgrades that might otherwise be difficult to finance. Improving the output of existing nuclear facilities may also avoid some of the permitting and construction challenges associated with building entirely new power plants. Demand-response commitments can provide additional flexibility during emergencies. These are meaningful responses, particularly where investment produces additional dependable capacity rather than simply reallocating electricity already available to the system.

But the timing remains consequential. PJM is managing emergency conditions in October 2026, while its capacity auctions have identified shortfalls for future delivery years. The first additional generation under the Google-Constellation agreement isn't expected until 2028. The planned 890 megawatts also represent only a portion of the 6,831-megawatt shortfall identified in July, although those figures aren't directly interchangeable without accounting for capacity accreditation and the timing of delivery. Additional projects may close more of the gap, and some existing resources may remain available longer than previously anticipated. Those possibilities should be included in the assessment. They don't change the fact that financial commitments and announced construction plans cannot supply electricity before the infrastructure becomes operational.

There is another dimension to this investment response. On October 13, the International Monetary Fund's Global Financial Stability Report identified growing financial exposure to artificial intelligence infrastructure. Hyperscale technology companies now account for approximately 10% of global investment-grade bond issuance, compared with less than 1% in 2024, according to the IMF findings reported that day. That doesn't establish that AI infrastructure investment is unsustainable. The companies involved include businesses with substantial revenues, existing assets and access to financing. But it does show that the expansion of AI infrastructure is becoming more important to corporate borrowing markets, while the IMF has identified the potential for weaker-than-expected returns or changes in investment expectations to affect broader financial conditions.

This creates a relationship between two systems operating on different timelines. Electricity providers need long-term commitments to justify infrastructure investment, while technology companies need reliable electricity to support their planned facilities. Financing arrangements can help both parties proceed, but the resulting commitments may remain exposed to changes in construction costs, interest rates, electricity availability and expected demand. A delay in transmission infrastructure can affect when a data center becomes operational. A change in the data center's development schedule can affect the anticipated demand supporting an electricity investment. Changes in financing conditions can influence both projects, even when the underlying need for additional electricity remains.

The allocation of those risks matters. Some contracts place substantial obligations on the companies purchasing electricity. Other projects may involve regulated utility investments, shared transmission infrastructure or costs recovered from broader groups of customers. It would be inaccurate to assume that private investment automatically transfers costs to the public, just as it would be inaccurate to assume that private financing eliminates public exposure. The relevant questions concern who is obligated to pay, what happens if projected demand doesn't materialize, and whether infrastructure built for concentrated private demand creates costs or benefits extending to other electricity users.

This is where the electricity problem begins interacting with a broader financial one. The same investment cycle generating additional electricity demand is also helping finance the infrastructure intended to satisfy that demand. If the cycle proceeds as anticipated, new generating capacity and transmission improvements may reduce pressure on the grid. If demand, financing or construction schedules diverge, the consequences could extend beyond individual technology projects. That is a conditional exposure, not an established failure. The IMF's findings make it more important to examine because the financial commitments involved are becoming large enough to matter outside the technology sector.

Emergency Measures Are Keeping the Grid Operational

The strongest evidence against an immediate reliability crisis is that PJM continues to have functioning mechanisms for managing difficult operating conditions. Its capacity auctions have attracted additional resources, even though they haven't met the full reliability requirement. Emergency procedures allow the operator to recall generating capacity, coordinate transmission and obtain additional operating authority. Federal regulators have approved the large-load registry, improving the information available for planning, while leaving open the possibility of a revised curtailment framework. Private investment is supporting generating upgrades and longer-term supply commitments. None of these developments should be discounted simply because the underlying problem remains unresolved.

The concern is that the mechanisms aren't interchangeable, and success in one doesn't necessarily repair a constraint in another. A backup generator can reduce demand on the regional grid during an emergency, but it doesn't automatically become a permanent source of accredited capacity. A transmission improvement can make existing electricity more deliverable without increasing the total amount generated. A long-term purchasing agreement can support new investment without ensuring that the resulting capacity will be operational during the next emergency. A regulatory decision can preserve appropriate legal authority while leaving an immediate planning problem unresolved.

PJM's recent experience therefore needs to be evaluated across several measures rather than through a single outcome. The capacity auction measures whether enough dependable resources have been committed for future years. Emergency operating notices show how the system responds when available resources become constrained. Regulatory proceedings determine which obligations can be imposed on different participants. Infrastructure investment indicates whether additional capacity is being developed, but its eventual contribution depends on completion and operation. Financial conditions influence whether the investment needed to close the gap remains viable.

Those measures are now interacting more visibly. The July auction identified a substantial future shortfall. PJM pursued additional procurement and a special arrangement for large loads. FERC rejected central elements of that arrangement in October, while an immediate operating emergency required separate federal authorization. At the same time, technology companies are making major electricity commitments, and international financial regulators are identifying growing exposure to the investment cycle supporting their expansion.

The evidence doesn't establish that these developments will produce widespread electricity shortages or a financial disruption. It establishes that several mechanisms responsible for maintaining reliability, accommodating growth and financing additional infrastructure are under pressure at the same time. Some are successfully absorbing that pressure. Others remain incomplete, delayed or subject to regulatory resolution.

The distinction between absorption and restored capacity is central to the assessment. PJM can successfully manage the October emergency without having resolved its 2028–2029 capacity shortfall. It can secure additional generation commitments without eliminating transmission constraints. It can obtain emergency authorization without establishing a permanent framework for managing large loads. Each successful response preserves service or creates additional options, but whether those responses collectively restore sufficient flexibility remains an open question.

The immediate evidence to examine will be the actual operating outcome of October 13–16, followed by the pace at which PJM resolves its procurement and large-load arrangements. A return to ordinary operating conditions, accompanied by increasing dependable supply and more manageable demand forecasts, would weaken the concern. Repeated reliance on emergency measures, persistent capacity shortfalls and growing dependence on resources that aren't yet operational would strengthen it.

For now, the electricity system is continuing to function through a combination of ordinary market arrangements, emergency authority, private investment and operational adjustments. The unresolved issue is whether those arrangements are creating enough additional capacity to accommodate the demands being placed on them, or whether an increasing share of their flexibility is being consumed simply maintaining the service they already provide.

What I’m watching now

The first test is the outcome of PJM's October 13–16 emergency period. Its subsequent operating records should show whether forecast demand and generation outages materialized, how close the system came to its reserve requirements, and whether additional generating resources or privately maintained backup systems were actually dispatched. An emergency order isn't evidence that every authorized intervention was used. The amount of intervention required, the operating margin remaining afterward and the speed with which normal maintenance schedules resume will provide a clearer measure of the system's condition.

The second is whether PJM can resolve the longer-term capacity problem through ordinary procurement and additional arrangements. Its next capacity auction, proposed reliability backstop and revised large-load rules will show whether the operator is securing enough dependable resources to meet projected demand. The relevant measure isn't simply the number of projects announced or the amount of capacity proposed, but how much accredited capacity becomes available within the delivery periods for which it is needed. Changes in demand forecasts also matter. Delayed or canceled data center projects, improved efficiency or reduced electricity requirements could materially improve the outlook without requiring every projected generating project to be completed.

I'm also watching whether transmission constraints and maintenance pressures become recurring features of operating emergencies. A grid can have substantial generation available overall while still struggling to deliver electricity to particular regions. If neighboring systems experience simultaneous shortages or transmission restrictions, the ability to compensate through imports becomes more limited. Repeated maintenance recalls would warrant attention as well, particularly if they begin affecting equipment availability during later periods of high demand. The October emergency provides a documented set of conditions against which future events can be compared.

Finally, the financing relationship between AI infrastructure and electricity development deserves closer examination. The IMF's findings establish that hyperscale investment is becoming a more significant component of corporate borrowing markets. The next indicators are changes in borrowing costs, capital expenditure commitments, project schedules and contractual arrangements between technology companies and electricity providers. A slowdown in AI investment wouldn't necessarily worsen grid reliability; reduced demand growth could relieve some pressure. But if generating investments have already been financed or costs allocated on the expectation of demand that subsequently changes, the consequences will depend on who carries those obligations. That possibility becomes more important as infrastructure investment and large-load development become increasingly dependent on one another.

Current Risk Assessment · October 13, 2026

Current assessment: Elevated and increasing pressure on electricity-system reliability and planning capacity within PJM. The operator faces a documented 6,831-megawatt shortfall against its 2028–2029 reliability requirement, unresolved regulatory arrangements for certain large electricity loads, and an immediate October operating emergency involving generation outages, elevated demand and transmission constraints. Existing compensatory mechanisms remain functional, but several are being relied upon simultaneously.

Expected if this assessment holds: Continued use of emergency operating measures during periods of constrained supply, additional procurement efforts to address future capacity shortages, and growing reliance on long-term private investment commitments. Reliability and cost pressures may persist where demand growth exceeds the pace of completed generating and transmission infrastructure. The severity of those pressures will depend on actual resource availability, demand growth and the effectiveness of operational responses.

Would weaken the assessment: Completion of the October emergency with adequate operating reserves and limited extraordinary dispatch; restoration of ordinary maintenance schedules; successful procurement of sufficient dependable capacity; approval of workable large-load management arrangements; improved transmission availability; and evidence that new generating resources or lower demand forecasts are closing the projected reliability gap.

Status: Elevated. Multiple mechanisms are absorbing stress, but the evidence doesn't yet establish that they are restoring sufficient capacity or operational flexibility to accommodate projected demand. The October emergency is an immediate test of operating resilience, while future capacity procurement and infrastructure completion will determine whether the longer-term imbalance is improving.

---

Sources

• PJM Interconnection — Capacity Auction Procures 138,318 MW of Generation Resources. July 14, 2026. Primary auction results documenting the 2028–2029 capacity shortfall and auction pricing.

• PJM Interconnection — Capacity Market. Updated 2026. Auction reports, capacity requirements and planning materials.

• PJM Interconnection — The Capacity Auction Is Coming. Here's What We're Doing Now. June 2026. PJM's explanation of capacity pricing, supply constraints and demand growth.

• Federal Energy Regulatory Commission — PJM filings and orders, Docket ER26-3515-000. October 9, 2026. Regulatory proceedings concerning the large-load registry and interim service proposal.

• Reuters — U.S. Panel Approves PJM's Registry of Data Centers, Rejects Plan to Curtail Power to Them. October 12, 2026. Reporting on the FERC decision and implications for large-load management.

• U.S. Department of Energy — PJM Emergency Order No. 202-26-50. October 12, 2026. Primary emergency order and supporting application for the October 13–16 operating period.

• PJM Interconnection — Emergency Procedures and Operating Notices. October 11–13, 2026. Primary operational alerts and notices concerning generation availability and emergency measures.

• U.S. Department of Energy — 2026 Emergency Orders. Updated October 2026. Record of emergency authorizations, including earlier PJM orders.

• Reuters — PJM Capacity Market Woes Spur Activity in Bilateral Power Deals. August 26, 2026. Reporting on alternative procurement, bilateral contracts and generating investment constraints.

• International Monetary Fund — Global Financial Stability Report. October 2026. Assessment of financial vulnerabilities, including growing exposure to AI infrastructure investment.

FHFA Budget Cut Would End Most Mortgage-Fraud Investigations

The Federal Housing Finance Agency in Washington, D.C. FHFA has reduced its inspector general’s fiscal 2027 budget to $20 million, which the watchdog says will require cutting 70 to 80 percent of its staff. (Photo by Ajay Suresh)

On September 29, the Federal Housing Finance Agency’s inspector general published three audits.

One found that FHFA’s security controls weren’t effective at protecting its network and systems against internal threats. Another found that the agency’s oversight of Fannie Mae and Freddie Mac’s multifamily credit-risk transfer programs was effective. The third found that FHFA’s Office of General Counsel was providing sufficient oversight of its suspended-counterparty program, although some controls weren’t documented in its operating procedures. A fourth audit published the previous day found that security controls for one of FHFA’s cloud systems weren’t fully effective.

On September 30, FHFA announced that it was reducing the Office of Inspector General’s fiscal 2027 budget to $20 million.

FHFA says the inspector general has become unusually large compared with other federal watchdogs. According to the agency, OIG requested funding equal to 16 percent of FHFA’s operating budget, while inspector general offices average about 2 percent of their agencies’ budgets across the federal government. OIG employees account for about 18 percent of FHFA’s workforce, compared with an average of about 4 percent at other agencies. FHFA adopted zero-based budgeting and says it couldn’t justify maintaining that difference.

The inspector general’s office says the $20 million allocation will require it to cut approximately 70 to 80 percent of its staff. Acting Principal Deputy Inspector General James Hodge told Congress that the Office of Investigations would discontinue essentially all of its criminal investigations, stop supporting ongoing investigations as soon as feasible and reduce its investigative staff to the minimum necessary to handle FHFA employee matters and operate its legally required hotline.

FHFA regulates Fannie Mae, Freddie Mac and the 11 Federal Home Loan Banks, which together provide more than $8.7 trillion in funding to U.S. mortgage markets and financial institutions. FHFA also remains the conservator of Fannie Mae and Freddie Mac. Its inspector general investigates mortgage, bank and other fraud involving the entities the agency regulates.

The office has maintained roughly 40 special agents in recent years, along with three Special Assistant U.S. Attorneys who prosecute mortgage fraud and related crimes. Hodge told Congress that its criminal enforcement work has produced more than 1,270 convictions and nearly $75 billion in monetary results since 2011.

During the six months ending March 31, 2026, OIG investigations produced 32 indictments or charges, 23 convictions or pleas, 25 sentencings and 54 suspended-counterparty referrals to FHFA. Court-ordered restitution, fines, forfeitures and other investigative results totaled about $87.7 million.

The office was still announcing criminal cases immediately before the budget cut. On September 29, it reported the extradition of a dual U.S.-Peruvian national accused in a $40 million bank-fraud and money-laundering scheme. Earlier that month, it announced a guilty plea in a real-estate fraud case and the sentencing of a defendant in a mortgage-fraud case.

At the same time, its auditors were continuing to find problems inside FHFA itself, including cybersecurity weaknesses that had remained unresolved from earlier reviews. Other audits found that FHFA was doing what it was supposed to be doing. The office losing most of its staff is doing both kinds of work now.

FHFA Says the Inspector General Costs Too Much

FHFA’s case for the reduction rests largely on comparisons with other federal inspector general offices. Its September 30 announcement points to both spending and headcount, comparing the OIG’s 16 percent share of the agency budget and 18 percent share of the workforce with federal averages of about 2 and 4 percent respectively.

OIG’s original fiscal 2027 request was $57.6 million. The administration’s budget request sent to Congress included $55 million. The $20 million allocation represents a reduction of more than 60 percent from both the inspector general’s request and its fiscal 2026 operating level.

FHFA is a relatively small federal agency, but the inspector general’s investigators don’t limit their work to misconduct by FHFA employees. Their jurisdiction follows FHFA into the housing-finance system it regulates. Fannie Mae, Freddie Mac and the Federal Home Loan Banks sit throughout that system, while FHFA’s conservatorship gives the agency additional authority over Fannie and Freddie.

That helps explain why comparing OIG staffing only with FHFA staffing produces such a large number. It doesn’t establish that the OIG needs its existing budget or that all of its current positions should be preserved. FHFA may be able to reduce spending without losing work that another office could perform.

We won’t have to infer whether the $20 million budget crosses that line. Hodge has already told Congress what his office expects to stop doing. Investigators would concentrate on FHFA personnel matters and the hotline, while essentially all external criminal investigations would end. Support for the Justice Department’s National Fraud Enforcement Division would also stop.

The budget dispute therefore reaches beyond how much an inspector general should cost. FHFA has decided that $20 million is enough to perform the office’s statutory mission. The inspector general says that at that level, most of the people who currently investigate fraud involving the housing-finance system won’t be there.

FHFA Still Has Cybersecurity Problems to Fix

The September 29 cybersecurity audit followed several years of findings about FHFA’s information systems.

In fiscal 2023, auditors found that 1,716 of 2,820 identified vulnerabilities hadn’t been fixed within the 14 days required by federal and agency policy. By fiscal 2025, FHFA was tracking overdue vulnerabilities quarterly but still didn’t have estimated completion dates for them.

Penetration testing showed what some of those weaknesses could allow. Auditors gained access to a privileged user account, elevated a standard account to domain administrator and took full control of FHFA’s network. The OIG reported 3,318 potentially exploitable vulnerabilities across agency servers, workstations and other devices, 64 percent of which it classified as critical. Another audit found problems with disaster-recovery planning, including backup data at an alternate site that wasn’t encrypted at rest and had no documented controls compensating for that weakness.

The findings published at the end of September continued that work. The September 28 audit found that selected security controls for FHFA’s eGRC cloud system weren’t fully effective. The following day, the OIG again found that FHFA’s controls weren’t effective at protecting its network and systems against internal threats.

Other programs held up better under the same kind of review. FHFA’s Division of Enterprise Regulation had designed and implemented effective oversight of Fannie Mae and Freddie Mac’s multifamily credit-risk transfer programs. The Office of General Counsel was providing sufficient oversight of the suspended-counterparty program, although auditors recommended documenting some controls that were missing from its operating procedures. Earlier this year, the OIG found that FHFA was effectively overseeing Fannie Mae’s multifamily lenders and loan-monitoring activities, with a narrower problem involving documentation of its sampling approach.

The office doesn’t stop working on a problem when an audit is published. Recommendations remain open until corrective action is completed, and the OIG publishes monthly lists of recommendations that haven’t been resolved. Its cybersecurity work has returned to weaknesses found in earlier years because some of them were still there.

FHFA remains responsible for fixing every one of those problems after the budget cut. Its technology staff can patch vulnerabilities, change procedures and strengthen controls without the inspector general doing it for them. What the OIG has been providing is an independent check on whether those repairs were completed and whether the controls worked afterward.

The fiscal 2027 budget doesn’t eliminate the inspector general, and the public information available so far doesn’t tell us exactly how many auditors will remain after the reduction in force. Hodge’s warning is much more specific about criminal investigations. A 70-to-80-percent staff reduction would reach far beyond the investigators, though, and the office’s publication record will make the effect on audits visible fairly quickly. FHFA-OIG has published nine audits or evaluations so far in 2026, including four between September 17 and September 29.

Other Agencies May Take Some of the Fraud Cases

FHFA-OIG’s criminal cases already involve other federal law-enforcement agencies. Its semiannual reports describe joint investigations, and prosecutions are handled through U.S. Attorneys’ Offices and other parts of the Justice Department. The FBI and other federal investigators will continue to have authority over financial crimes that fall within their jurisdictions.

What we don’t know yet is how many of FHFA-OIG’s cases they’ll take.

That should become measurable because Hodge said support for existing criminal investigations will end as soon as feasible. OIG leadership has told employees that staffing reductions will occur over the coming months and has begun preparing a reduction in force.

If another agency takes an open investigation and continues it, much of that work survives even though FHFA-OIG no longer performs it. If cases are closed, delayed or narrowed because no one else has the staff or specialization to take them, they don’t.

The same question applies before a case becomes a prosecution. During the six months ending in March, OIG investigators sent 54 suspended-counterparty referrals to FHFA. The suspended-counterparty program allows FHFA to restrict individuals or institutions from doing business with its regulated entities, and the inspector general’s September audit found that FHFA’s Office of General Counsel was providing sufficient oversight of the program.

FHFA can continue suspending counterparties after the investigative staff is cut. The investigators are one of the places the information comes from.

That distinction is likely to become more important than the raw number of prosecutions. The Justice Department can prosecute a fraud case that reaches it. FHFA can act on misconduct identified through supervision, regulated entities or law enforcement. The harder number to reconstruct later is how many cases never developed because the investigators who would have found or pursued them were gone.

There’s already an example of why that can be difficult to measure in FHFA’s multifamily mortgage market.

Fannie Mae identified multifamily mortgage fraud as an emerging risk after referrals increased substantially beginning in 2023. An OIG evaluation published in January found that Fannie had expanded its fraud controls and that FHFA continued monitoring the issue. Most of the referrals reviewed from the earlier period were ultimately closed with no fraud found, and Fannie reported no actual multifamily mortgage-fraud losses during the period examined.

Those closed referrals weren’t wasted information. They helped establish how much of the apparent problem was actually fraud and gave Fannie and FHFA evidence they could use to adjust their response. A decline in referrals after investigators disappear won’t tell us by itself whether misconduct declined or whether fewer possible cases were being found.

The Budget Cut Will Be Easier to Measure Than Its Consequences

The staff reduction should leave several records behind.

We’ll know approximately how many employees remain. We can count criminal investigations, indictments, convictions and suspended-counterparty referrals. We can see how many audits and evaluations the office publishes and whether it continues returning to unresolved recommendations. Congress can ask where existing cases went.

FHFA’s supervision will continue. Fannie Mae and Freddie Mac have their own fraud controls. Other federal investigators can take cases, and prosecutors can receive referrals from other sources. If those institutions take over most of the investigations FHFA-OIG can no longer handle, fewer cases will actually be lost. If they don’t, a decline in investigations or referrals won’t necessarily mean there’s less fraud. It may mean fewer people are looking for it.

There could be fewer referrals because regulated institutions improved their controls, or because one of the offices generating referrals has stopped looking for most external cases. Fewer unresolved audit recommendations could mean FHFA fixed its problems, but it could also reflect fewer audits producing recommendations in the first place.

That’s why the September audits are a useful baseline. Immediately before the budget reduction, the office was finding some FHFA programs effective, finding weaknesses in others, following older cybersecurity problems that hadn’t been fixed and producing criminal cases outside the agency.

The question over the next year is which of those activities continue somewhere else, which remain inside a much smaller OIG and which stop.

What I’m watching now

The first thing I’m watching is the reduction in force itself. The $20 million allocation has been announced, but the projected 70-to-80-percent staffing loss hasn’t happened yet. Congress could still change the funding available to the office, and OIG leadership has been seeking a legislative response.

The existing criminal caseload should give us the clearest early measure of what other agencies can absorb. I want to know how many open investigations are transferred to the FBI, Justice Department or another agency, how many joint investigations continue after FHFA-OIG withdraws and how many are closed. The number of new mortgage- and bank-fraud investigations opened after the staffing reduction will matter too.

Suspended-counterparty referrals provide another measure. OIG sent 54 to FHFA during the six months ending March 31. If that number falls sharply after the investigators are cut, the change will need to be read alongside fraud reports and enforcement activity elsewhere before it can tell us whether the underlying problem improved.

I’m also watching the audit calendar. FHFA-OIG published four audits between September 17 and September 29 and nine audits or evaluations during 2026 through the end of September. Its 2027 output will show how much of that work survives.

The unresolved cybersecurity findings give us something specific to follow. If FHFA completes the overdue remediation and later independent testing verifies that the controls work, the underlying problem has improved. If the recommendations remain open while independent testing becomes less frequent, we’ll have less information about whether the weaknesses were fixed.

Finally, I’m watching whether the reduction remains specific to FHFA-OIG. Right now, the evidence supports a major loss of investigative capacity at this office. Similar reductions across other federal watchdogs would be a different and broader development.

Current Risk Assessment · October 6, 2026

Current assessment: FHFA has reduced its inspector general’s fiscal 2027 budget to $20 million, and the official responsible for implementing that budget says it will require cutting 70 to 80 percent of the office’s staff and ending essentially all external criminal investigations. Those investigators currently work mortgage, bank and other fraud cases involving a housing-finance system in which FHFA’s regulated entities provide more than $8.7 trillion in funding. The office is also still auditing FHFA, including cybersecurity problems that have remained unresolved across multiple years. Other federal agencies can take some criminal cases, and FHFA retains its own supervisory and enforcement powers. We don’t yet know how much of the work will move elsewhere.

Expected if this assessment holds: FHFA-OIG will transfer or discontinue much of its existing criminal caseload, open substantially fewer external fraud investigations and send fewer investigative referrals to FHFA. Audit and evaluation work is also likely to decline if the projected staff reduction occurs, although we don’t yet know how large that decline will be. The effect should become visible through case transfers, new investigations, suspended-counterparty referrals, audit output and follow-up on unresolved recommendations.

Would weaken the assessment: Congress or FHFA restores enough funding to prevent most of the projected staff reduction; other agencies take over the existing criminal cases without a substantial loss of investigative work; FHFA-OIG continues publishing a significant number of audits and evaluations after the cuts; and outstanding cybersecurity problems are fixed and independently verified.

Status: Elevated — FHFA’s budget decision is expected to remove most of the investigators dedicated to fraud involving the housing-finance system while the office is still producing criminal cases, regulatory referrals and audits identifying unresolved problems inside FHFA.

---

Sources

Federal Housing Finance Agency, “To Be Good Financial Stewards, FHFA Inspector General’s Budget Will Match the Budgets of Peer Agencies,” September 30, 2026.

Federal Housing Finance Agency Office of Inspector General, “Audits and Evaluations,” accessed October 6, 2026.

Federal Housing Finance Agency Office of Inspector General, “Semiannual Report to the Congress — October 1, 2025 Through March 31, 2026,” 2026.

Federal Housing Finance Agency Office of Inspector General, “Fiscal Year 2026 Management and Performance Challenges,” 2025.

Reuters, “US housing agency internal watchdog warns budget cut will stymie its work,” October 1, 2026.

Federal News Network, “Pulte’s FHFA slashes mortgage fraud watchdog’s budget,” October 1, 2026.

FAA Outage Reveals Redundancy Failures

Aircraft at Newark Liberty International Airport. A September telecommunications failure at the FAA facility controlling Newark-area traffic became a regional disruption after the system's backup fiber path was also unavailable.

In July 2025, the FAA announced that it had completed a new fiber-optic communications network between New York and the Philadelphia facility responsible for Newark-area air traffic. Two months earlier, telecommunications failures had disrupted operations at the Philadelphia TRACON, where controllers handle aircraft arriving at and departing from Newark. The new network was part of the response. The FAA added three high-bandwidth telecommunications connections between New York and Philadelphia, deployed a temporary backup system, and began establishing a local STARS radar-data hub so Philadelphia would no longer depend entirely on radar information coming from New York. By July, the agency said the new fiber connections were running along two separate communications paths so that equipment could continue operating if one path was disrupted.

On September 21, 2026, a telecommunications circuit at the Philadelphia facility failed. The FAA attempted to move communications onto the second path, only to find that a construction crew in New Jersey had accidentally severed the fiber line. Incoming flights were halted at Newark, JFK, LaGuardia, Philadelphia and Boston, and the disruption spread as traffic was redirected through the system. More than 100 flights were diverted. By the FAA's later accounting, roughly 9,500 flights were delayed or canceled, and the telecommunications problem took about eight hours to resolve.

The scale of the disruption got most of the attention, but I'm more interested in the order in which things happened. The FAA had built a second communications path because it knew a failure on the first shouldn't be able to interrupt air traffic across the region. A failure occurred anyway, and the second path had already been lost to an unrelated event.

A fiber line being cut is ordinary enough. So is a telecommunications circuit failing. Put them together in this order, though, and something happening to a fiber line in New Jersey can stop arrivals hundreds of miles away.

The FAA Had Already Added a Backup Route

Had the second communications path been available, most of us probably would've never known the first circuit had failed. One route would've taken over while the other was repaired, and flights would've continued moving.

From the outside, a system in that condition can look unchanged. Inside it, the situation is different. Before the circuit failed, two routes were available. Afterward, one route would've been carrying the work previously distributed across an arrangement that included both. The flights can look the same either way.

We see this elsewhere when electrical grids call demand-response resources or keep generation available that otherwise wouldn't be needed. Hospitals move patients when they run short of beds. Supply chains reroute goods around ports or transportation problems. Government agencies move work elsewhere when an office loses staff.

These responses are supposed to make problems disappear from ordinary life. That's why they exist. It also means the absence of a visible disruption doesn't tell us how much had to happen underneath it to keep things looking normal.

The FAA's response to the Newark problems in 2025 followed the same pattern. The agency wasn't waiting for the next outage. It was adding connections, moving to fiber, building a local radar-data hub and using a temporary backup while the work was underway. It also said that when staffing or equipment problems reduced what controllers could safely handle, it would slow the rate of arrivals into Newark.

By September 2026, the FAA had encountered a problem that the second communications route couldn't take over because the route itself was unavailable, leaving the agency to reduce the number of aircraft entering the affected airspace until controllers had what they needed to handle them safely.

When the second communications route was unavailable, the FAA had to respond outside the telecommunications network by reducing the number of aircraft moving through the affected airspace.

The FAA Is Still Replacing Its Aging Communications Network

The September outage occurred in the middle of a much larger FAA modernization effort. Administrator Bryan Bedford told Congress this month that the National Airspace System is still operating with obsolete technology even as the agency replaces it. As of September 1, the FAA had replaced more than 64 percent of its copper-based Time-Division Multiplexing telecommunications infrastructure with modern equipment and converted more than 400 radio sites. Congress has already provided $12.5 billion for the broader modernization effort.

After the September 21 outage, Transportation Secretary Sean Duffy said the replacement network is supposed to eliminate single and dual points of failure by providing multiple telecommunications routes into FAA facilities. The estimated cost of the telecommunications work has risen to $5.91 billion, and Bedford said the remaining outdated copper telecommunications wiring should be replaced by September 2027.

The FAA is already responding to the weaknesses exposed by the 2025 failures. The difficulty is that recognizing a problem and finishing the work required to fix it happen on very different timelines.

The National Airspace System can't be taken offline while its communications network is replaced. The FAA provides air-traffic services for more than 44,000 flights carrying roughly three million passengers every day, so old equipment has to keep working while new equipment is installed around it. Copper is still carrying traffic while fiber replaces it. Temporary systems have to cover gaps while permanent systems are installed. New equipment has to communicate with parts of the network that haven't been replaced yet.

That leaves a period in which the FAA can know exactly what needs to be repaired, be actively repairing it, and still remain dependent on some of the same equipment and connections that made the repair necessary in the first place.

The September outage happened during that period, when one telecommunications circuit failed while a separate fiber line had already been cut during construction work. There's no indication that one failure caused the other. Their connection was created by the system itself because the fiber line became consequential once the first circuit was gone.

A second route only protects the first route when it's still there at the moment the first one fails. That sounds obvious, but I think it gets lost when redundancy is treated as something a system either has or doesn't have. Its condition can change before anything visible happens.

A New GAO Report Identified Other Communications Vulnerabilities

On the same day as the outage, the Government Accountability Office released a report examining a different set of problems in aviation communications.

GAO looked at electromagnetic-spectrum threats including spoofing and jamming. The FAA has identified those threats, but GAO found that the agency hasn't completed all of the risk and mitigation assessments and updated security documentation needed to address them. The FAA also lacks defined real-time monitoring and detection for every spectrum-related threat GAO examined. In some cases, the agency can investigate an incident only after someone reports it.

GAO made nine recommendations covering risk assessments, monitoring and detection, coordination with other organizations, authentication and protection of aviation communications. The Department of Transportation agreed with all nine, and they remain open.

Nothing in the available evidence connects those findings to the September 21 outage. The fiber damage was reported as accidental construction damage. The GAO report is useful here for what it shows about the communications system around the fiber itself.

For a controller to communicate safely with an aircraft, the FAA has to know where the aircraft is, the controller has to be able to reach it, the information moving between them has to be accurate, and the equipment carrying that information has to work. The FAA also has to be able to recognize when one of those things has changed.

Adding another fiber route protects one part of that chain. It doesn't protect all of it. Another route won't tell the FAA that information has been spoofed, just as better authentication won't restore a cable that's been severed. A second facility also provides less protection if it depends on something that can be lost along with the first one.

Two systems can look independent on paper and still share something underneath them that makes them vulnerable at the same time.

The FAA happened to begin limited use of another new system on September 21. SMART brings roughly 200 data streams into one place, including weather, flight paths, traffic flow and controller staffing. It's intended to help FAA personnel see problems developing earlier and make decisions about traffic before congestion or weather produces larger disruptions.

SMART can give the FAA more information about what's happening across the airspace. The fiber outage gives us an unusually clear example of what information alone can't solve. Officials can know exactly where traffic is accumulating and exactly where they'd like aircraft to go while still lacking the communications route required to move the information controllers need.

The FAA is replacing the network carrying information at the same time it's improving the information available to the people managing traffic. It's also replacing old equipment and trying to close the security gaps GAO identified. Those projects overlap, but they don't solve the same problem, and progress in one doesn't necessarily tell us much about the condition of another.

The FAA Prevented a Safety Crisis by Reducing Air Traffic

When the telecommunications system couldn't support normal operations on September 21, the FAA reduced the amount of traffic controllers had to handle. Arrivals were halted or restricted, aircraft were held on the ground and more than 100 flights were diverted while the telecommunications lines were repaired.

Thousands of passengers experienced delays or cancellations, aircraft were diverted, crews and airlines had to adjust, and other airports received traffic they otherwise wouldn't have handled. Boston was affected even though the telecommunications failure wasn't there because the disruption altered traffic across the Northeast.

This is one reason I've become increasingly wary of describing large systems as either working or failing. The telecommunications network couldn't preserve normal service, while the air-traffic system could still preserve safe service by accepting fewer flights. What failed in one place was accommodated somewhere else, and the cost changed form as it moved.

The FAA reduced traffic until the communications lines could be repaired, shifting the immediate consequences into delays, cancellations and diversions while keeping the affected airspace operating safely.

As the new telecommunications network comes online, I'd expect more of these failures to be handled before they ever reach flight operations. A circuit fails, another route takes over, the first gets repaired and passengers never know it happened. If relatively ordinary technical problems continue making it through the backup systems and forcing the FAA to restrict traffic across several major airports, then we know those backups still aren't containing enough of the problem before it reaches everything connected to them.

What I’m watching now

The investigation into the New Jersey fiber cut should tell us more about how separate the communications routes really were. The FAA's July 2025 announcement described two separate paths intended to keep equipment operating if one was disrupted. I want to know how those routes were physically laid out, what could disable each one and what protection existed around a line that became critical as soon as another circuit failed.

I'm also watching what the FAA says about the temporary backup deployed after the 2025 Newark failures. The agency described it as providing redundancy during the move to the new fiber network, but the public information available so far doesn't establish what it could've carried under the conditions that developed on September 21. Until we know that, I don't think we can say whether another backup was present and unable to do the job, had already been removed from the relevant configuration, or was never intended to cover this particular failure.

More than 64 percent of the FAA's old copper-based TDM telecommunications network had been replaced as of September 1, and Bedford says the remaining outdated copper should be gone by September 2027. The plans described after this outage go further than replacing copper with fiber and call for multiple routes into facilities so that losing one or two doesn't recreate what happened this week.

We should eventually be able to see whether that worked by how uneventful future failures become. If a circuit fails, another independent route takes over and flights continue while the damaged line is repaired, the new network is doing what the FAA says it's being built to do.

The GAO report gives us another set of things we can follow without trying to infer them from outages. All nine recommendations remain open. We can watch whether the FAA completes the missing risk assessments, improves real-time detection of spectrum threats and strengthens authentication and data protection for aviation communications. Those changes would address problems the fiber replacement can't.

Another useful measure will be how often technical problems require the FAA to reduce traffic across multiple airports. Ground stops and traffic restrictions are supposed to protect safety, so their use alone doesn't tell us very much. The more useful question is what keeps requiring them. If relatively ordinary equipment and telecommunications problems repeatedly get past the technical backups and have to be dealt with by moving or stopping flights, then more of the system is depending on that last layer of response than the visible operation of the network would suggest.

Current Risk Assessment · September 25, 2026

Current assessment: The September Northeast aviation outage adds another case in which the existence of a backup tells us less than whether that backup remains available when the original system actually needs it. The FAA had already added separate communications paths after the 2025 Newark failures, but a telecommunications circuit failed after another fiber route had been severed, leaving the agency to reduce traffic across multiple airports while the lines were repaired. The FAA is already replacing the older network, and its response kept aircraft operating safely. The open question is how often problems can still get through the telecommunications backups and reach flight operations while that replacement continues.

Expected if this assessment holds: Individual equipment and telecommunications failures will usually be handled without creating a safety problem, but some will still produce large disruptions when another route or system is already unavailable. As more of the new network comes online, those events should become less common and more failures should be handled without large ground stops, diversions or cancellations.

Would weaken the assessment: Future telecommunications failures move onto independent backup routes without major traffic restrictions; the investigation identifies a specific problem behind the September outage that's subsequently corrected; multiple routes remain available when failures overlap; and the separate communications problems identified by GAO are addressed.

Status: ELEVATED — the FAA is replacing the network, but the September outage showed that two separate telecommunications problems can still reach flight operations before that work is complete.

---

Sources

Federal Aviation Administration, “Secretary Duffy Announces Completion of Another Major Milestone for Operations at Newark Liberty Airport,” July 3, 2025.

Federal Aviation Administration, “FAA Statements on Newark Liberty International Airport,” 2025.

Federal Aviation Administration, “Testimony of Bryan Bedford, FAA Administrator,” September 2026.

U.S. Government Accountability Office, “Aviation Cybersecurity: Enhanced Air Safety Requires FAA to Better Mitigate Threats to Aircraft Communications,” September 21, 2026.

Federal Aviation Administration, “Trump’s Transportation Secretary Sean P. Duffy Delivers State-of-the-Art Air Traffic Control,” September 21, 2026.

Reuters, “Thousands of US flights snarled before FAA resolves telecom problem,” September 21, 2026.

Reuters, “Airport operations in US Northeast resume after telecom lines repaired,” September 21, 2026.

Reuters, “US says new air traffic control system will not suffer disruptions,” September 22, 2026.

Why Is Europe Preparing Its Citizens for Disruption?

The Be Emergency Ready booklet contains essential information. Photograph: Jessica Doyle/The Irish Times

Beginning today, approximately 2.2 million households in Ireland are being sent a government booklet explaining how to prepare for emergencies. Be Emergency Ready recommends keeping water, food, medication, a battery-operated radio, flashlights and other supplies available in case electricity, communications or other basic services are interrupted. Ireland’s Department of Defence has said the program was influenced in part by Storm Éowyn, which left 768,000 households without power in January 2025.

Ireland joins several European countries that have moved civilian preparedness further into ordinary household planning over the past two years. The Netherlands distributed emergency-preparedness booklets to more than 8.5 million households between November 2025 and January 2026, advising residents to be capable of managing independently for the first 72 hours of a major emergency. Dutch guidance covers power failure, digital attack, flooding and other events that could interrupt access to electricity, water, communications or public assistance.

The European Union has adopted the same 72-hour benchmark. Its Preparedness Union Strategy, introduced in March 2025, calls for guidelines enabling households to remain self-sufficient for at least three days, along with stronger early-warning systems, stockpiling, civil-military planning, public-private emergency protocols and regular preparedness exercises.

The household campaigns are developing alongside changes in military planning, healthcare, infrastructure protection and civil defense. Germany is planning for civilian hospitals to absorb large numbers of military casualties in a NATO conflict. Finland has expanded public guidance for drone attacks and proposed new authorities to protect undersea infrastructure and counter unmanned systems. Switzerland adopted a new national security strategy on September 18 centered on resilience, protection and defense capacity. Poland has been running civil-defense exercises involving drones, evacuations and interruptions to drinking water while also activating real air-threat alerts during Russian attacks on Ukraine.

These programs were not created at the same time and are not responses to a single threat. Their overlap is in the kinds of failures governments are preparing civilian systems to absorb: electricity outages, communications failures, disrupted transport, cyberattacks, infrastructure sabotage, military spillover and periods in which normal government services cannot immediately reach everyone.

Households are being asked to carry the first several days

The Dutch preparedness campaign gives residents a specific time horizon: 72 hours. Households are advised to store water, food and necessary medication, maintain ways to receive information without internet access and prepare for interruptions to services they normally assume will remain continuously available. The program treats household preparedness as a way to reduce immediate dependence on emergency services while authorities respond to the broader disruption.

The EU’s Preparedness Union Strategy extends that approach across member states. Alongside the 72-hour household standard, the strategy calls for stronger preparedness in schools, improved warning systems, emergency protocols between governments and private companies, greater stockpiling capacity and comprehensive civil-military arrangements. It also calls for regular EU exercises and closer preparedness coordination with NATO.

Ireland’s new booklet is broader than military preparedness. It addresses severe weather, prolonged power failure and other emergencies, and the government has explicitly connected the initiative to lessons from Storm Éowyn. The distribution still places Ireland within a wider European shift toward asking households to maintain a small amount of independent operating capacity during disruptions to centralized systems.

The Netherlands and Ireland are therefore arriving at a similar household model through somewhat different threat environments. Residents are being asked to assume that electricity, water, communications or government assistance may occasionally become unavailable for long enough that the first stage of response has to happen inside the household.

Germany is planning civilian healthcare into a NATO conflict

Germany’s planning extends this model into healthcare. Bundeswehr contingency planning for a major conflict on NATO’s eastern flank uses an assumption of as many as 1,000 wounded military personnel arriving for treatment each day. Germany’s location would make it a transit point for troops and supplies moving east and for casualties moving west, while military medical services would depend heavily on civilian hospitals.

The 1,000-per-day figure is a planning assumption rather than a prediction that Germany expects that number of casualties. It determines the scale of hospital capacity, medical transport, pharmaceutical supply chains and coordination that would be required under a severe conflict scenario. Bundeswehr discussions this year have continued to focus on civilian-military healthcare structures, secure medical supply chains and the ability to treat large numbers of casualties during crisis or war.

The planning expands the resources relevant to military readiness beyond military hospitals. Civilian beds, medical staff, medicines, transport networks and supply systems become necessary to sustain operations if military demand rises sharply at the same time civilian healthcare continues to function.

Switzerland has formally expanded its security planning

Switzerland adopted its 2026 Security Policy Strategy on September 18. The Federal Council identified three priorities: strengthening resilience, improving resistance and protection capabilities, and strengthening defense capacity. Implementation of the strategy’s 10 objectives and 46 measures had already begun by the time it was formally approved.

The strategy describes Russia’s war against Ukraine, hybrid threats and critical dependencies as part of a substantially worse European security environment. It includes cyberattacks, espionage, sabotage, long-range weapons and other threats alongside conventional military attack, and it calls for coordination among federal and cantonal authorities as well as the private sector, academia, associations and the public where necessary.

Switzerland also states that a direct armed attack on the country remains unlikely in the foreseeable future. Its government is nevertheless expanding preparations for long-range attacks, hybrid activity and disruptions that could affect civilian infrastructure or public safety. The strategy therefore provides a clear example of preparedness increasing without a public assessment that conventional war on Swiss territory is likely.

Finland is changing both public guidance and legal authority

Finland added instructions for airborne threats to its national preparedness guide in June. The guidance explains how authorities would issue warnings, how civilians should respond to drone threats and where they should take shelter. It explicitly notes that an airborne threat could include a drone carrying explosives.

On September 10, the Finnish government submitted legislation that would give the Border Guard new responsibilities for protecting critical underwater infrastructure and additional powers to intercept unmanned vehicles. The proposal covers Finland’s territorial waters and exclusive economic zone and is intended to improve the Border Guard’s ability to respond to emerging security situations.

Those measures place civilian infrastructure, maritime security and drone defense inside the same preparedness framework. They also move beyond public information campaigns by changing the authority available to state institutions before a disruption occurs.

Poland is exercising scenarios it is also encountering in practice

Poland conducted a two-day civil-defense exercise called DRON-26 on September 9 and 10. The scenario included unidentified drones crashing in Mazovia, a large forest fire, disruption to drinking-water access and the evacuation of civilians. Fire services, police, territorial defense forces and regional authorities participated in the exercise.

Poland has also been testing warning sirens across multiple districts throughout September. At the same time, the government’s RCB alert system has issued real warnings during Russian aerial attacks on Ukraine. On September 17, residents received messages stating that a Russian attack was underway in Ukraine, Polish military aircraft were operating, and further communications should be monitored. Polish and allied aircraft have also been placed on preventive alert during major Russian strikes, including on September 19, when no violation of Polish airspace was ultimately recorded.

The same warning and response systems are therefore being used in exercises and activated during actual regional military events. Poland’s September activity includes both planned tests of civilian response and operational precautions prompted by attacks immediately across its border.

Drone incidents have increased the operational burden on NATO states

On September 14, an Italian fighter operating under NATO’s Baltic mission shot down a Russian-made drone after it entered Lithuanian airspace from Belarus. Initial reporting identified it as a suspected Geran-2 military drone. Lithuanian investigators later identified the aircraft as a Gerbera-type drone, and President Gitanas Nausėda said it was probably intended for Ukraine rather than Lithuania. Investigators continued examining its electronics and did not establish that Lithuania had been its intended target.

The later assessment limits what can be inferred about Russian intent, but the incident still required an operational NATO interception inside allied airspace. It also occurred during a period in which European governments have reported additional drone activity, sabotage concerns and other forms of hybrid disruption.

At NATO’s Military Committee meeting in Copenhagen on September 19, committee chair Admiral Giuseppe Cavo Dragone referred publicly to recent Russian airspace violations, drone incidents and hybrid activities and said they had been testing allied responses. The meeting focused on readiness, multi-domain operations, capability targets and the ability of defense industry to deliver equipment at greater speed and scale.

France has also moved to strengthen infrastructure protection. President Emmanuel Macron directed his government this month to prepare measures protecting sensitive infrastructure and defense sites against drones, cyberattacks and other hybrid threats.

What the public record shows

Public documents do not establish whether European governments possess classified intelligence pointing to a specific future Russian attack. They show governments making concrete preparations for severe disruption through legislation, exercises, infrastructure protection, hospital planning, warning systems and household preparedness.

The programs also began on different timelines. The EU Preparedness Union Strategy dates to March 2025. The Dutch household campaign began in November 2025. Germany published its 1,000-casualty planning assumption last year. Switzerland’s strategy went through a consultation process before formal approval this month. Ireland has linked its own program in part to the experience of a major weather event.

The public explanations also cover more than Russia. Flooding, cyberattack, prolonged power failure, sabotage, extreme weather, infrastructure damage and military conflict appear across national and EU preparedness documents. Switzerland explicitly describes direct armed attack as unlikely in the foreseeable future while still preparing for long-range weapons and hybrid threats.

The public record cannot show what classified intelligence, if any, sits behind individual decisions. It can show that governments across Europe are committing more resources to circumstances in which civilian systems may be interrupted for hours or days and central authorities may not be able to restore normal service immediately.

Civilian continuity is becoming part of security planning

The programs differ in scope, but they increasingly allocate responsibility across more parts of society. Households are asked to maintain basic supplies. Hospitals are incorporated into casualty planning. Border agencies receive powers to protect infrastructure. Municipalities practice evacuations and warning procedures. Governments are testing how civilian and military institutions would operate together under conditions that affect several systems at once.

A large disruption can produce secondary problems that extend beyond its original source. Loss of electricity affects communications, payment systems and fuel distribution. Transport disruption can interfere with medical supply chains. Cyberattack or sabotage can increase demand for emergency services while reducing the systems those services normally rely on. The 72-hour household model reduces immediate demand on centralized response by moving a small amount of continuity capacity to households.

Germany’s healthcare planning applies the same principle at an institutional scale. Civilian hospitals would absorb demand that military medical infrastructure could not handle alone. Finland’s proposed maritime authorities distribute infrastructure protection across agencies before an incident develops. Poland’s civil-defense exercises test the ability of separate services to operate together when a drone event produces fire, water disruption and evacuation requirements.

The preparations do not indicate that every government is planning for the same event. They indicate a broader reduction in the assumption that normal civilian systems will remain continuously available during a serious crisis.

What I’m watching now

The first indicator is whether household preparedness develops into more formal requirements for essential services. The EU has already called for minimum preparedness standards, 72-hour household self-sufficiency and stronger civil-military coordination. Additional national requirements for hospitals, telecommunications providers, schools, utilities or municipalities would extend the same planning assumptions further into civilian infrastructure.

Spending on physical capacity will provide another measure. Emergency stockpiles, shelter capacity, backup communications, redundant power, medical reserves and infrastructure hardening require sustained investment. Announced preparedness becomes more consequential when it changes what governments and public institutions can actually operate during an extended disruption.

Civil-military exercises will also show how far the integration has progressed. Germany is already planning civilian healthcare into a large-scale NATO conflict scenario, while the EU calls for regular civil-military exercises. Expansion into rail, ports, logistics, telecommunications and energy would increase the amount of civilian capacity incorporated directly into security planning.

The frequency of real activations will be equally important. Poland has repeatedly raised air-defense readiness during Russian attacks on Ukraine, and NATO has now used force against an unmanned aircraft inside Lithuanian airspace. Additional incidents would give governments more operational experience with systems that until recently were exercised primarily through planning scenarios.

Current Risk Assessment · September 21, 2026

Current assessment: Civilian preparedness is becoming more deeply integrated into European security planning. Household self-sufficiency programs, hospital contingency planning, infrastructure protection, drone-response powers, warning exercises and national security strategies are expanding across countries with different alliance relationships and threat profiles. The public record does not establish whether classified intelligence points to a specific forthcoming attack.

Expected if this assessment holds: European governments should continue increasing civil-defense capacity, infrastructure protection, emergency stockpiles, public warning systems and coordination between civilian and military institutions. More healthcare, transport, telecommunications, energy and local-government systems are likely to appear in contingency planning and exercises designed around prolonged interruption of ordinary services.

Would weaken the assessment: Reduced civil-defense investment, failure to implement recently announced measures, fewer operational responses to cross-border drone or sabotage incidents, lower official threat assessments, or evidence that the current programs remain temporary national initiatives rather than becoming durable parts of European security planning.

Status: Elevated, with civilian preparedness expanding.

---

Sources

European Commission, EU Preparedness Union Strategy, March 2025.

Swiss Federal Council, Comprehensive approach to security: Federal Council adopts the 2026 Security Policy Strategy, September 18, 2026.

Bundeswehr, Healthcare provision in a defense scenario, November 5, 2025, and Healthcare in crisis and war, May 13, 2026.

Finnish Government, Instructions on staying safe during threats from the air, June 30, 2026, and Border Guard preparedness and counter-drone authorities, September 10, 2026.

Netherlands NCTV, Prepare for an Emergency, November 17, 2025.

The Irish Times, Government emergency booklet distribution, September 17, 2026.

Polish government, DRON-26 civil-defense exercise, September 10, 2026.

NATO Military Committee statement, Military Committee Conference in Copenhagen, September 19, 2026. NATO Military Committee statement

Saudi Arabia Is Moving More Oil Back Through Hormuz

Commercial vessels in the Strait of Hormuz.

Saudi Arabia has recovered part of the export volume lost after attacks damaged the East–West Pipeline by moving more crude through the Persian Gulf. Saudi Aramco increased shipments through the Strait of Hormuz after halting some loadings at Yanbu, and Saudi exports have risen above 4 million barrels per day in September after falling to 2.4 million barrels per day in August, according to provisional Kpler data. Satellite data cited by JPMorgan showed Saudi crude moving through Hormuz averaging about 2.9 million barrels per day over six days, compared with roughly 700,000 barrels per day in August.

The additional shipments have helped relieve the immediate supply pressure created by the damage to the East–West Pipeline. They have also changed where the system is carrying that pressure. The pipeline had allowed Saudi crude to cross the peninsula to Yanbu and reach the Red Sea without passing through Hormuz. With that route impaired, more of the replacement volume is moving through the same strait that the pipeline had been used to bypass.

That change is occurring while visible commercial traffic through Hormuz remains far below prewar levels. Twelve commodity vessels crossed the strait over the weekend of September 19–20, compared with 35 the previous weekend. Before the conflict began in February, the strait typically handled about 125 large commercial vessels per day. Some oil tankers are moving with their transponders turned off, so visible vessel counts understate actual traffic, but the available data still show a waterway operating under substantial constraint.

Saudi Arabia has therefore restored a significant amount of throughput without restoring the geographic redundancy that existed before the East–West Pipeline attacks.

Saudi exports have recovered faster than the pipeline

The East–West Pipeline had become increasingly important during the disruption of Hormuz because it provided a route from Saudi Arabia’s eastern oil fields to the Red Sea. Reuters reported on September 17 that three pumping stations were damaged in the attack, one more than initially assessed. The 1,200-kilometer pipeline had been moving roughly 4 million to 5 million barrels per day and temporarily shut after the strikes. Industry sources gave repair estimates ranging from partial operation sooner to five or six weeks for more complete repairs.

Saudi Arabia did not wait for the pipeline to return to full service. Aramco increased Gulf exports and arranged additional ship-to-ship transfers outside the strait, allowing crude to reach Asian buyers despite the reduction in Yanbu loadings. By the week of September 13, 13 tankers carrying about 34 million barrels of crude had exited Hormuz, with Saudi Arabia accounting for approximately half of that volume.

The rerouting has reduced the immediate risk of a sharp Saudi supply loss. Middle Eastern oil flows averaged about 17.1 million barrels per day over the ten days covered by a September 18 JPMorgan analysis, roughly 6.1 million barrels per day below the 2025 average but substantially higher than would be expected under a near-total regional export shutdown. Oil prices have also retreated from the levels reached after the East–West Pipeline disruption. Brent fell to $101.71 per barrel early September 21 as markets responded to recovering Saudi shipments and the possibility of renewed diplomacy between Washington and Tehran.

The recovery is not equivalent to restoration of the pre-attack transport system. Before the damage, Saudi Arabia could move large quantities of crude westward without using Hormuz. The current arrangement preserves exports by sending more oil east through the Gulf first. The available volume has improved, while the number of independent routes available to move it has not.

Hormuz remains constrained

Shipping data continue to show a large difference between current activity and prewar traffic. Reuters reported four commodity vessels crossing Hormuz on September 17, below a ten-day average of about 16. Over the following weekend, 12 commodity vessels crossed, down from 35 the weekend before. Tracking data do not capture every tanker because ships operating in the conflict zone may switch off transponders, but that limitation applies to an environment in which normal commercial visibility and routing have already been disrupted.

LNG movements have shown a similar pattern of partial activity rather than normalization. Three LNG vessels reappeared outside Hormuz on September 17 after periods in which they had not been visible on tracking systems. Kpler also recorded a ship-to-ship transfer between two Qatar-linked vessels off Oman on September 13 while their transponders were off. These movements show that cargoes can still be moved through or around the disruption, but they also involve operating practices different from ordinary peacetime shipping.

The shift in Saudi exports makes those conditions more important to the regional supply system. Saudi Arabia is now relying more heavily on a route with reduced visible traffic, elevated security risk and greater operational uncertainty. If the East–West Pipeline returns to substantial service, some of that dependence can move back toward the Red Sea. Until then, recovery in Saudi export volume increases the amount of supply using Hormuz rather than reducing the system’s dependence on it.

Pressure around Bab el-Mandeb has also increased

The Red Sea route has not remained isolated from the conflict. Reuters reported that Houthi forces had seized Yemen’s Red Sea coastline and strengthened their position around Bab el-Mandeb, the southern entrance to the Red Sea. On September 17, 23 commodity vessels crossed Bab el-Mandeb, close to the ten-day average of 26, so commercial traffic through the strait had not stopped. The military environment surrounding that traffic had nevertheless changed.

On September 19, the Houthis said they launched missiles and drones at sites in Riyadh and at an Aramco facility in Yanbu. Reuters video showed smoke near Riyadh’s main international airport following explosions, while Saudi Arabia did not confirm the Houthis’ description of the targets. A Saudi-led coalition said it had intercepted other attacks on the kingdom.

Yanbu matters because it is the Red Sea terminus of the East–West Pipeline. Bab el-Mandeb matters because ships leaving the Red Sea for Asian markets eventually pass through it. The infrastructure and waterway that provide the principal alternative to Hormuz are therefore operating within the same expanding security environment that has pushed additional Saudi exports back toward the Gulf.

Iran added further uncertainty on September 20 when its military central command said any new U.S. attack would trigger sustained retaliation against U.S. bases and interests and warned that regional states assisting such an attack could be treated as parties to the conflict. The command also claimed it had information that another attack was being prepared but did not provide evidence supporting that claim. The United States separately issued a regional security alert warning of possible escalation, flight cancellations and airspace closures.

At the same time, the possibility of renewed U.S.-Iran talks has reduced some of the market risk premium. President Donald Trump said he would be open to meeting Iranian President Masoud Pezeshkian during the UN General Assembly, and oil prices fell as investors priced in the possibility of de-escalation. The physical constraints on the pipeline and shipping system remain in place while that diplomatic outcome is unresolved.

Qatar is seeing effects on both current and future LNG capacity

The shipping disruption is also affecting Qatar’s LNG system. QatarEnergy CEO Saad al-Kaabi said on September 20 that the company was producing only a very small volume of LNG and that delays in receiving critical equipment through the Strait of Hormuz could affect some expansion projects. The first trains in Qatar’s North Field East expansion are scheduled to begin operating in 2027, followed by North Field South in 2028.

The equipment problem extends the effect of the shipping constraint beyond cargoes currently trying to leave the Gulf. Large energy projects depend on equipment, replacement parts and construction inputs moving into the region as well as fuel moving out. If those deliveries remain disrupted, the effect can move from current export capacity into the schedule for future production.

That is different from a temporary tanker delay. The immediate LNG loss affects current supply; delayed project equipment can affect capacity expected in later years. The extent of that effect will depend on how long access remains constrained and whether QatarEnergy can reroute or replace the affected deliveries.

Saudi Arabia’s current export strategy shows that the region still has substantial capacity to improvise around damaged infrastructure. Qatar’s difficulty receiving equipment shows where the limits of that improvisation can appear. Not every interrupted flow can be replaced by sending the same cargo through another terminal.

The economic effects remain uneven

The partial recovery in Saudi exports has reduced crude-price pressure, but other energy and transport costs do not necessarily move at the same speed. Reuters reported U.S. diesel prices above $6 per gallon during the previous week while global refining capacity remained constrained and inventories were tight. Diesel costs reach trucking, agriculture, construction and other parts of the physical economy even when crude prices are falling.

That pattern is consistent with the previous Risk Monitor analysis, Energy Disruption Is Spreading Into Freight and Credit. The original energy shock has not produced a uniform downstream effect. Crude availability, refined-product supply, tanker capacity, freight rates and borrowing conditions respond through different mechanisms and on different timelines.

The latest Saudi data add another layer to that picture. Additional oil is reaching the market, but some of it is doing so through longer or more operationally complicated routes. A decline in Brent therefore does not establish that the transportation and logistics effects associated with the disruption have disappeared. It establishes that crude supply has proved more adaptable than the worst-case scenarios implied immediately after the pipeline attack.

The next question is whether that adaptation persists long enough for the damaged infrastructure to be repaired, or whether another disruption affects one of the routes now carrying the additional load.

What I’m watching now

East–West Pipeline throughput is the clearest measure of whether Saudi Arabia is regaining actual redundancy. Partial repair may increase capacity, but the more important change would be sustained restoration of westbound crude flows sufficient to reduce reliance on Hormuz.

Hormuz vessel traffic also needs to recover over a sustained period. Because transponder data are incomplete, any individual daily count is a poor measure of total oil movement. A broader rise in visible tanker, LNG and commercial traffic alongside lower reliance on dark shipping would provide stronger evidence that operating conditions are normalizing.

Bab el-Mandeb remains relevant because the Red Sea route only provides meaningful redundancy if ships can move through its southern exit without a comparable increase in security risk. Continued commercial traffic is evidence that the strait remains usable. Further Houthi attacks on Saudi infrastructure or tighter control over shipping near the strait would increase the exposure of the alternative route.

QatarEnergy’s LNG production and equipment deliveries will show whether the current disruption remains primarily a shipping problem or begins to affect longer-term capacity. Resumed equipment access would reduce the risk of project delays even if some LNG exports remain constrained.

Diplomatic developments could alter all of these conditions before physical repairs are complete. A sustained reduction in U.S.-Iran military risk would lower the threat to shipping and regional infrastructure. Renewed direct attacks would raise the probability that additional transport routes or energy facilities are affected while current workarounds are still carrying extra load.

Current Risk Assessment · September 20, 2026

Current assessment: Saudi and regional energy flows remain materially impaired but continue to adapt. Saudi Arabia has recovered substantial export volume by routing more crude through Hormuz and using additional transfer arrangements outside the Gulf, while the East–West Pipeline remains damaged and normal commercial traffic through Hormuz remains sharply reduced. The available supply picture has improved faster than the transport system’s redundancy.

Expected if this assessment holds: Saudi exports should remain above their August lows as long as Hormuz remains usable for large crude carriers and Aramco can continue routing additional shipments through the Gulf. Freight, refining and LNG constraints may remain uneven even if crude prices continue to fall. Continued dependence on Hormuz would leave Saudi export recovery exposed to another disruption in the strait until meaningful East–West Pipeline capacity returns.

Would weaken the assessment: Sustained restoration of East–West Pipeline throughput, a durable increase in normal commercial traffic through Hormuz, continued operation of Bab el-Mandeb without additional interference, recovery in Qatari LNG production and equipment access, and a reduction in the extraordinary shipping arrangements currently being used to maintain exports.

Status: Elevated, with redundancy weakening.

---

Sources

Reuters, “Vessels trickle through Strait of Hormuz as Middle East conflict persists,” September 20, 2026.

Reuters, “Oil hits over 1-week low on hopes of boost to diplomacy in Iran war,” September 20, 2026.

Reuters, “Iran and US trade threats after Houthi attacks escalate regional conflict,” September 20, 2026.

Reuters, “QatarEnergy says Hormuz crisis may delay some expansion projects,” September 20, 2026. Read the Reuters report

Reuters, “Hormuz traffic below 10-day average, LNG vessels reappear outside strait,” September 18, 2026.

Reuters, “Three pumping stations along Saudi East-West Pipeline were hit in recent attack, sources say,” September 17, 2026.

Energy Disruption Is Spreading Into Freight and Credit

Container operations at the Port of Houston. Rising fuel and shipping costs are carrying the effects of energy disruption farther into U.S. freight and distribution networks.

The damage to Saudi Arabia’s East–West Pipeline is more extensive than initially reported.

When the pipeline was attacked on September 13, early reporting indicated that two pumping stations had been damaged. Satellite imagery reviewed by Reuters now shows damage at three. Three industry sources estimated that full repairs could take five to six weeks, although partial operations may resume sooner. That is substantially longer than the “days” suggested by U.S. Energy Secretary Chris Wright on September 15. Saudi authorities had not provided a detailed public repair schedule as of Reuters’ September 17 report.

The pipeline is important because it is one of Saudi Arabia’s primary alternatives to the Strait of Hormuz. It carries crude from production areas in the east of the country to the Red Sea, allowing those exports to avoid the strait. With traffic through Hormuz already constrained by the war with Iran, roughly 4 to 5 million barrels per day had been moving through the East–West line.

That was the basis for the September 13 Risk Monitor analysis, The Backup Routes Are Failing, which focused on the simultaneous exposure of routes that normally provide redundancy for one another. Hormuz was under pressure, fighting in Yemen was moving closer to Bab el-Mandeb, and the East–West Pipeline had been damaged while serving as an alternative to Hormuz.

The new evidence strengthens that assessment. There is more damage to the pipeline than was known five days ago, and the possible repair period is longer.

But several developments since then also show how the disruption is moving beyond the physical energy network. Shipping costs have increased sharply. U.S. diesel prices have continued rising. The Federal Reserve has raised interest rates for the first time in more than three years. Household expectations around credit and financial conditions were already deteriorating before that increase.

These are not independent indicators anymore, as the same disruption that has reduced physical redundancy in the energy system is increasing transportation costs while the cost of financing those increases is also rising.

Shipping is absorbing the disruption, at a higher cost

Saudi Arabia has not lost the ability to export oil.

It has continued selling crude through other arrangements, including additional loadings from inside the Persian Gulf. Oil prices fell on September 17 as markets became somewhat more confident that Saudi supply would continue reaching buyers despite the pipeline outage.

Commercial shipping is also continuing. But the price of maintaining those flows has increased substantially.

Reuters reported on September 17 that the spot rate for a forty-foot container from China to the U.S. East Coast had reached $10,948, more than four times its level at the beginning of the Iran war. Analysts said rates could approach or exceed pandemic-era records if fuel costs remain elevated.

Oil shipping has been affected even more directly. Rates for very large crude carriers reached record levels after attacks on commercial shipping increased security and insurance costs and disrupted normal routing. Marine fuel costs have also risen.

Some of those costs are now visible inside the United States.

The Energy Information Administration reported that the national average price of diesel reached $6.285 per gallon on September 14. It was $5.348 at the beginning of August and $3.897 in early March. Regular gasoline reached $4.319 nationally.

Diesel has broader economic effects than the price paid by drivers who own diesel vehicles. It is used throughout freight transportation, agriculture, construction and distribution. Higher diesel prices therefore increase operating costs across supply chains that were already facing higher maritime freight costs.

There is no fixed relationship between those increases and consumer prices yet. Businesses can absorb some costs through lower margins, and they can change suppliers, reduce inventory, postpone purchases or increase prices. Freight rates and fuel prices can also fall quickly if the underlying disruption improves.

For now, however, the direction is consistent across several parts of the transportation system: maintaining the movement of energy and goods has become more expensive.

Financing conditions are tightening at the same time

On September 16, the Federal Open Market Committee raised the federal funds target range by 25 basis points to 3.75–4.00 percent. It was the first rate increase since July 2023.

In June, the median FOMC participant projected a federal funds rate of 3.8 percent at the end of 2026 and 3.6 percent at the end of 2027. In September, both projections moved to 4.1 percent.

The Fed also raised its median projection for 2026 PCE inflation from 3.6 to 3.7 percent and core PCE inflation from 3.3 to 3.4 percent.

At the same time, the Fed increased its expected 2026 GDP growth rate and lowered its unemployment projection. Those forecasts are not observed outcomes or independent assessments of the economy. FOMC participants make them using their own assumptions about appropriate monetary policy and how the economy will respond to it, so they are more useful as evidence of how policymakers currently understand the economy and the effects they expect their decisions to have than as evidence that those outcomes will actually occur.

The rate increase therefore should not be read as evidence that the Fed believes the energy disruption itself can be corrected through monetary policy. Interest rates cannot restore the East–West Pipeline or increase shipping capacity.

The Fed's decision appears to reflect concern about what happens if higher energy and transportation costs spread into broader inflation. If businesses and households begin expecting higher prices to persist, those expectations can affect wages, contracts, spending and pricing decisions. Monetary tightening is intended to reduce that risk.

It also increases borrowing costs, as major U.S. banks raised their prime lending rates from 6.75 to 7 percent following the Fed decision, while the 10-year Treasury yield was around 5 percent this week.

Businesses facing higher fuel or freight costs may absorb them through lower margins, pass some of them on through higher prices, or reduce activity where the additional expense makes existing operations less viable. Credit can help bridge a period of unusually high costs or allow businesses to carry inventory until conditions improve, but borrowing becomes a more expensive way to create that room as interest rates rise.

The same applies to households, where higher prices can be absorbed through income, savings, reduced consumption or borrowing. Credit can delay or distribute financial stress rather than eliminating it, and tighter credit conditions reduce the flexibility households have to use it that way.

There was already evidence of weakening household expectations before the September rate increase.

The Federal Reserve Bank of New York’s August Survey of Consumer Expectations found that the perceived probability of finding another job after losing one had fallen to 45.4 percent. The share of respondents reporting that credit was harder to obtain increased, expectations for future credit availability deteriorated, and the perceived probability of missing a minimum debt payment during the next three months rose to 13.2 percent.

Households also reported worse assessments of their current and future financial situations.

The survey does not show that those outcomes have occurred. Some labor measures were also stronger, as perceived job-loss probability declined slightly and expected quits increased.

The survey establishes that additional energy and transportation costs are arriving while households already report less confidence in employment replacement, credit access and their financial position.

The Fed’s rate increase adds another source of pressure to that existing condition.

Public capacity is also being used to manage the conflict

The federal government is absorbing part of the same disruption through military spending.

On September 15, the Congressional Budget Office estimated that Department of Defense combat operations against Iran had cost approximately $38 billion through August 1. CBO estimates that another month of fighting at recent levels could add roughly $2 billion to $3 billion, with higher costs possible if operations intensify.

Those estimates don't include every federal cost associated with the conflict, and CBO cautions against simply adding all of its cost categories together.

The important point for this analysis is that public resources are being used at the same time private systems are adapting to the economic consequences of the conflict.

That is not inherently evidence of deteriorating state capacity. Governments maintain fiscal and military capacity specifically so that they can respond to emergencies. However, the question is how much capacity is being used, for how long, and whether additional demands begin arriving before existing ones have receded.

PJM Interconnection activated pre-emergency and emergency demand-response resources as unusually warm September weather coincided with generation and transmission outages. The Department of Energy also issued an emergency order under Section 202(c) of the Federal Power Act after PJM requested additional authority.

Demand response allows participating customers to reduce electricity use when grid conditions become tight, creating additional operating margin without requiring an equivalent amount of new generation.

It worked, as there was no reported blackout. PJM subsequently said it did not expect emergency conditions to continue beyond September 17.

The event therefore wouldn't support a claim that the PJM grid is failing. It shows that the system encountered conditions sufficient to require resources normally held in reserve, and those resources successfully absorbed the stress.

That is relevant to the broader assessment because the same distinction applies to the energy and economic systems currently under pressure.

Saudi Arabia still has other ways to get oil to market, and shipping companies have kept cargo moving by rerouting vessels and taking on higher fuel, insurance and security costs. Those costs then have to be absorbed somewhere else, whether that's by businesses through margins, inventories or prices; by households through changes in spending, or through additional borrowing. Government spending and monetary policy sit farther downstream, responding to consequences that the physical energy and shipping systems haven't been able to eliminate.

The existence of those responses is evidence that compensatory capacity remains available.

What has changed since the September 13 analysis

The Backup Routes Are Failing focused primarily on physical redundancy in the energy and maritime system, and that assessment has strengthened.

The known damage to the East–West Pipeline increased from two pumping stations to three, and industry estimates now suggest full repairs may take several weeks. Pressure at Hormuz therefore remains important while one of the principal alternatives around it is operating with reduced capacity.

What has changed since September 13 is the evidence farther downstream.

Container shipping costs have increased sharply as tanker rates reached records. U.S. diesel prices have risen above $6 per gallon nationally. The Federal Reserve has resumed monetary tightening and raised its expected policy-rate path. Major banks immediately raised their prime rates, and household expectations around credit access and financial conditions had already weakened before the rate increase.

None of those developments proves that the original supply disruption will produce a broader economic crisis yet. But they do show that several mechanisms used to absorb the disruption are now interacting.

Higher shipping costs can be absorbed through margins, prices or financing. Higher fuel costs can be absorbed through the same channels, while higher interest rates make financing more expensive. Households facing higher prices have less flexibility if credit becomes harder or more expensive to obtain. U.S. government intervention can offset some private-sector pressure, but that uses fiscal and administrative capacity.

The current concern is therefore no longer limited to whether enough oil can physically reach the market. We're now tracking whether the economic systems that compensate for reduced physical capacity are also becoming more constrained.

So far, they are still functioning.

What I’m watching now

The first indicator is actual throughput on the East–West Pipeline. Partial restoration would return some capacity around Hormuz even before repairs are complete. A rapid restoration would weaken this assessment, while continued delays, additional damage or lower-than-expected throughput would strengthen it.

The second is the relationship between crude prices and downstream transportation costs. If crude prices fall and diesel, marine fuel, tanker rates and container freight follow, that would indicate that current pressures are beginning to unwind. If crude stabilizes or falls while those downstream costs remain elevated, the disruption will have become more persistent inside transportation and distribution networks.

Credit conditions are the next indicator. The September rate increase changes the price of borrowing, but it does not establish that businesses or households have lost access to credit yet. Lending standards, delinquencies, high-yield spreads, revolving-credit use and small-business borrowing conditions will show whether higher rates are materially reducing the ability to absorb other costs.

I am also watching household data for confirmation or contradiction of the August New York Fed survey. Realized increases in delinquencies, unemployment or financial distress would strengthen the assessment, while improving job-finding expectations, easier credit conditions or stronger household balance sheets would weaken it.

PJM should be treated as a separate but relevant capacity indicator. One September demand-response activation is insufficient to establish a broader grid trend. But repeated emergency actions during shoulder seasons, particularly when they coincide with other infrastructure constraints, would be more significant. A return to normal operations would indicate that the September 17 event was successfully contained.

Finally, I am watching for additional cases in which one compensatory mechanism depends on another that is already under pressure. Freight costs combined with tighter business credit are more significant than either development separately. Higher household prices combined with weaker credit access would be more significant than higher prices alone. Additional federal emergency spending would matter differently if Treasury financing conditions continue tightening.

Those interactions will determine whether the current pressures remain manageable or begin reducing the system’s ability to absorb additional shocks.

Current Risk Assessment · September 18, 2026

Current assessment: Physical energy and shipping disruptions are increasingly interacting with freight costs and U.S. financing conditions. Compensatory mechanisms remain functional, but several are becoming more expensive to use at the same time.

Expected if this assessment holds: Energy and goods continue moving, but businesses, households and governments face higher costs to maintain normal activity. Additional disruption produces larger downstream effects if existing freight, credit and fiscal pressures remain elevated.

Would weaken the assessment: Restoration of substantial East–West Pipeline capacity; sustained improvement in Hormuz and Bab el-Mandeb shipping conditions; declining diesel, marine fuel and freight rates; stable or improving credit conditions; and evidence that recent emergency or compensatory measures can be withdrawn without replacement.

Status: DEGRADING — COMPENSATORY CAPACITY REMAINS FUNCTIONAL

The evidence does not currently support a finding of systemic failure.

Oil is still moving, commercial shipping continues, financial markets are functioning, and PJM used reserve capacity and maintained service. Current evidence also does not establish that the U.S. economy has entered a contraction.

What has changed is the number of connected systems now involved in absorbing the original disruption.

The September 13 analysis identified a reduction in physical redundancy across energy and maritime routes. Five days later, that problem remains unresolved, the known pipeline damage is more extensive, and higher transportation costs are interacting with tighter financial conditions.

Whether that becomes substantially more serious depends on what happens next: how quickly physical capacity is restored, whether transportation costs decline, and whether households and businesses retain enough financial capacity to absorb the costs that have already moved through the system.

---

Sources

Reuters — “Three pumping stations along Saudi East-West Pipeline were hit in recent attack, sources say,” September 17, 2026. Satellite imagery and industry-source reporting on the expanded damage footprint and repair estimates.

Reuters — “Ocean container shipping rates could test record highs as Iran war fuel spike drives rise,” September 17, 2026. China-to-U.S. East Coast spot freight rates and fuel-cost effects on container shipping.

Reuters — “Oil tanker rates hit record highs following Iran, US shipping attacks,” September 11, 2026. Tanker rates and the cost of maintaining oil shipments during maritime disruption.

U.S. Energy Information Administration — Gasoline and Diesel Fuel Update, September 15, 2026. National and regional retail gasoline and diesel prices through September 14.

Federal Reserve — FOMC Statement and Implementation Note, September 16, 2026. Official decision raising the federal funds target range to 3.75–4.00 percent.

Federal Reserve — Summary of Economic Projections, September 16, 2026. September projections for inflation, growth, unemployment and the federal funds rate.

Federal Reserve Bank of New York — Survey of Consumer Expectations, August 2026. Household expectations for employment, credit availability, debt payments and financial conditions.

Congressional Budget Office — “Estimating the Cost of Combat Operations Against Iran,” September 15, 2026. Estimates of Department of Defense costs associated with the conflict.

Department of Energy — PJM Emergency Order No. 202-26-45, September 17, 2026. Federal authorization for additional generation and emergency resources during PJM grid stress.

PJM Interconnection — Emergency Procedures, September 17–18, 2026. Operational notices documenting demand-response activation and the subsequent end of emergency conditions.

The Backup Routes Are Failing

View from orbit of the Strait of Hormuz connecting the Persian Gulf with the Gulf of Oman, with Iran to the north and the Arabian Peninsula to the south.

UPDATE — SEPTEMBER 17, 2026

Three days after this analysis was published, the evidence around the Saudi East–West Pipeline has become clearer. Reuters analysis of satellite imagery and industry reporting now indicates that three pumping stations were damaged in the attack, one more than initially assessed. Estimates for full repair remain uncertain: three industry sources said repairs could take five to six weeks, while another said partial flows may resume sooner. The pipeline had been carrying roughly 4–5 million barrels per day while traffic through the Strait of Hormuz remained severely constrained.

Saudi Arabia is already adapting to the outage. Loadings at Yanbu have been suspended and some September cargoes to Europe canceled. At the same time, crude loadings from Saudi terminals inside the Gulf have increased, and Aramco has offered additional barrels through ship-to-ship transfers off Oman. Those measures preserve some export capacity, but they do so by adding handling, routing, and dependence on other constrained corridors rather than restoring the redundancy the East–West system provided.

The original assessment therefore still holds: compensatory capacity is degrading. The important development isn’t that every alternative route has stopped functioning. It’s that maintaining flow now requires more rerouting through systems that are themselves exposed to the same regional conflict. Hormuz traffic remains far below recent averages, while disruption is already showing up in shipping and fuel costs reaching the United States.

---

On September 10, Saudi Arabia’s East–West oil pipeline was hit in multiple attacks in the Riyadh and Madinah regions. The Saudi Energy Ministry said the line was shut down as a precaution while emergency and technical teams secured the pipeline and assessed its safety. The government has not publicly given a date for its return to service.

That uncertainty matters because the pipeline has spent much of this war doing exactly what it was built to do: letting Saudi crude avoid the Strait of Hormuz. Earlier this year, Saudi Aramco ramped it all the way to its maximum capacity of seven million barrels a day as shipping through Hormuz became constrained. In its first-quarter results, Aramco described the pipeline as a “critical supply artery” that had helped offset the energy shock. Saudi Aramco’s Q1 statement made unusually explicit just how important the bypass had become.

Before this latest shutdown, around four million barrels a day were moving through the line to Yanbu on the Red Sea. That is approximately 4 percent of global oil supply. Once the pipeline stopped, Saudi Arabia began relying on crude already positioned at Yanbu and smaller stocks elsewhere. Three industry sources told Reuters that the Yanbu inventories could sustain current export rates for roughly five to seven days. Saudi stocks at Egypt’s Ain Sukhna and Sidi Kerir ports provide some additional time, and repair estimates still vary. One estimate runs as long as five to six weeks; others anticipate at least partial pumping sooner.

Saudi Arabia still has the crude. The immediate constraint is the infrastructure required to get it to buyers while the principal eastern maritime route is constrained and the western bypass is offline.

That distinction has become increasingly important because, only a little more than two weeks ago, the White House was describing the Strait of Hormuz as a problem the United States had essentially solved.

On August 28, the administration published a release titled “President Trump Was Right: America Controls the Strait of Hormuz”. It said Iranian mines had been cleared from international shipping lanes, nearly 1,500 commercial vessels carrying 750 million barrels of crude had passed under U.S. protection, Iranian oil exports had been stopped by the blockade, and Gulf exports had recovered to about two-thirds of their previous level. Trump had repeatedly described American control of the strait as “total.”

There was observable capacity behind the claim. Ships were moving again. U.S. naval operations had reduced Iran’s ability to simply stop traffic through the waterway. On September 2, Energy Secretary Chris Wright said that 17 million barrels of oil had moved through Hormuz in a single day, the largest volume since the war began disrupting traffic. Reuters reported the figure at the time.

Traffic has not held at that level. Current estimates put oil flows through Hormuz at roughly six to eight million barrels a day, and overall vessel traffic remains far below the prewar baseline. Over the weekend, only four commodity vessels exited the Gulf and ten entered, compared with a recent ten-day average of fourteen a day and roughly 125 vessel transits per day before the war. Shipping data reported by Reuters show how far the system remains from normal even when the strait is technically open.

Oil traders are pricing that uncertainty into the physical market. Brent moved above $108 on Monday. Asian refiners are paying higher premiums for crude from the Middle East and increasingly competing for alternatives from West Africa and the United States. Some U.S. crude cargoes have reportedly sold into South Korea at premiums nearly twice what buyers were paying last month. Reuters’ reporting from Asian oil markets also puts current Hormuz flows in the six-to-eight-million-barrel range.

And the route Saudi Arabia has been using to reduce its dependence on Hormuz now has pressure at both ends.

The East–West pipeline carries crude across Saudi Arabia to Yanbu so it can leave through the Red Sea. Ships using that route eventually have to contend with the Bab el-Mandeb, the narrow passage between Yemen and the Horn of Africa.

The Houthis have been gaining ground around it. They took the Red Sea port of Mokha and Mayun Island, which sits inside the Bab el-Mandeb itself. They have since taken Greater and Lesser Hanish, two more strategically located islands in the Red Sea. Shipping through the region had already fallen dramatically after years of Houthi attacks; Associated Press reporting put the decline at roughly 60 percent even before the latest territorial gains.

The sequence is becoming more important than any individual event. Hormuz becomes dangerous and constrained, increasing the value of the East–West pipeline. The pipeline shifts Saudi crude to Yanbu, which makes Red Sea access more important. The Houthis move into positions around the Bab el-Mandeb. Then the pipeline itself is hit and shut down.

The response to one point of stress keeps increasing the load carried by another part of the structure.

The pipeline is one buffer. Storage at Yanbu is another. Red Sea access, tanker rerouting, U.S. naval escorts, alternative crude suppliers and Saudi diplomatic relationships can all absorb some portion of a disruption.

They do not have to disappear for the structure to change. A route that still functions can become slower and more expensive. Inventories can remain available while being steadily drawn down. Military protection can continue while requiring more ships, interceptors, intelligence and political commitment. Buyers can find alternative crude while paying much more for it.

A lot of resilience looks like this in practice. Something breaks and the rest of the system compensates. Traffic moves somewhere else. Inventories replace interrupted supply. Governments spend money. Ships take longer routes. Buyers bid against one another for substitutes. For a while, the headline can still be that the system is functioning.

Saudi Arabia has already been through an earlier version of this during the same conflict. Attacks in April reduced East–West pipeline capacity by about 700,000 barrels a day and damaged other energy facilities. Three days later, the Energy Ministry said the line had been restored to its full seven-million-barrel capacity, calling the quick repair evidence of the kingdom’s “operational resilience.”

Five months later, the same pipeline matters even more because Hormuz remains constrained, and it has been hit again. At the same time, the maritime route it feeds is becoming more exposed to Houthi control and attack.

Saudi Arabia’s fallback route is now under pressure

This is the part of the crisis that gets harder to see when each development is treated as its own story.

A vessel is hit, and shipping adjusts. Hormuz becomes dangerous, and crude moves overland. The pipeline stops, and storage covers some of the gap. Buyers look farther away for barrels. Insurance prices the additional risk. Naval forces keep other traffic moving.

There are still answers available.

I’m interested in what happens to the next disruption after several of those answers are already carrying more weight than they were before.

Whether Iran can literally close Hormuz is one question. Whether the Houthis can literally close Bab el-Mandeb is another. Whether Saudi exports fall to zero after seven days is another, and the evidence does not support that claim.

The accumulation across those questions is more consequential for the Risk Monitor than any one of them by itself.

The United States is embedded throughout this structure. American forces are policing traffic around Hormuz and enforcing the blockade on Iranian exports. Gulf oil producers have built their security assumptions around American military capacity for decades. Saudi Arabia has also been asking Washington for help as the Houthi front expands. Crown Prince Mohammed bin Salman recently sought additional U.S. military assistance against the Houthis. Trump declined to authorize direct American strikes but agreed to provide intelligence-sharing and targeting support. On Monday, bin Salman met CENTCOM commander Admiral Brad Cooper in Jeddah as the conflict continued to spread. Reuters reported the meeting and U.S. support arrangements.

That makes the usual measures of military success incomplete. Reopening a shipping lane matters. Intercepting a missile matters. Destroying a launch site matters. Enforcing a blockade matters.

They tell us what the United States is capable of doing at a particular point in the conflict. They do not necessarily tell us whether the wider structure is becoming easier or harder to sustain.

The U.S. can retain enough military power to keep some traffic moving through Hormuz while the economic and logistical burden migrates elsewhere. Iranian exports can be constrained while Saudi Arabia loses access to infrastructure designed to compensate for the same disruption. One corridor can become safer while another becomes more important and more exposed.

Some of those costs are already arriving in the United States through channels that do not look military.

U.S. ten-year Treasury yields reached 5 percent on Monday, their highest level since 2023. Oil-driven inflation concerns are one contributor, alongside heavy debt issuance, fiscal concerns and other pressures. Reuters’ bond-market reporting makes the mixed causality clear.

Markets are also overwhelmingly expecting the Federal Reserve to raise interest rates this week. Reuters put the implied probability at about 90 percent on Monday, with renewed energy inflation among the pressures policymakers are confronting. Morning Bid also noted that Brent had climbed back above $108 after the pipeline shutdown and renewed regional escalation.

A pipeline attack in Saudi Arabia does not mechanically produce a Federal Reserve rate increase. The U.S. economy is carrying plenty of other pressures. The connection matters because energy moves through so many other prices. It enters freight, manufacturing and food. It changes inflation expectations. Interest-rate decisions then reach mortgages, credit cards, business financing, government debt service and employment.

There is a diplomatic version of the same problem. Gulf governments have to keep recalculating how much security Washington can actually provide, how much regional risk they are willing to absorb, and how much room they need to preserve for relationships with Iran and other regional powers. A planned meeting involving Saudi Arabia, Iran and other Gulf states over maritime security was postponed Monday as the crisis worsened. Reuters’ live coverage followed the postponement alongside the renewed rise in oil prices and continued Houthi attacks.

“Winning” and “losing” do not describe this particularly well.

The United States can retain overwhelming coercive capacity while the number of things that capacity has to hold together keeps growing. The relevant question for this project is how much compensatory capacity remains available before another disruption arrives.

What I’m watching now

I would not forecast that Saudi Arabia simply stops exporting oil when the five-to-seven-day Yanbu inventory window closes. The reporting does not support that certainty. There are stocks elsewhere. Repairs could restore part of the pipeline. Shipping patterns can change. Saudi Arabia may be able to redirect additional volumes through other routes.

What matters over the next several days is whether those alternatives restore some slack to the structure or simply become the next mechanisms carrying an unusual amount of load.

If the East–West pipeline remains substantially offline while Yanbu inventories decline, relatively small additional disruptions should begin producing larger effects than they would have earlier in the conflict. Shipping and insurance costs should remain high. Buyers should continue paying premiums for crude outside the Gulf. Saudi officials should have increasing incentives to restore at least partial pipeline service and to reduce threats around Red Sea shipping. The economic effects should continue appearing farther from the conflict through fuel prices, inflation expectations and financial conditions.

There are also clear ways for this assessment to weaken. A durable restart of the East–West pipeline would restore significant export capacity. Sustained recovery in Hormuz traffic would reduce the load on alternative routes. Lower tanker and insurance costs would suggest that markets see the threat receding. Safer passage through Bab el-Mandeb and replenishing inventories would add back some of the redundancy that has been disappearing.

For now, several of those indicators are moving in the opposite direction.

The East–West pipeline reduced Saudi Arabia’s dependence on Hormuz. Yanbu storage is now buying time while the pipeline is unavailable. The Red Sea provides the pipeline’s route to global buyers while the Houthis acquire more leverage around it. U.S. military power is keeping part of the larger architecture functioning while more of that architecture requires active protection.

That is the structure I’m watching. The amount of stress matters, but so does the condition of the places the stress is supposed to go.

Current Risk Assessment · September 14, 2026

Current assessment: Compensatory capacity in the U.S.-linked Gulf energy and security architecture is degrading.

Expected if this assessment holds: Shipping and insurance costs remain elevated; oil prices become increasingly sensitive to additional disruptions; export inventories continue to be drawn down; Saudi Arabia intensifies efforts to restore pipeline capacity; U.S. military and diplomatic commitments remain under pressure; and economic spillovers continue appearing through energy prices, inflation and financial conditions.

Would weaken the assessment: Durable restoration of the East–West pipeline, sustained recovery of Hormuz flows, declining Red Sea shipping risk, replenishing inventories, and stabilization without continued reliance on increasingly expensive workarounds.

Status: Open.

---

Sources

• Saudi Press Agency — East–West Pipeline Shut Down as a Precaution Following Multiple Attacks, September 11, 2026

• Saudi Press Agency — Energy Facilities and East–West Pipeline Restored to Operational Capacity, April 12, 2026

• Saudi Press Agency — Saudi Aramco Q1 2026 Results, May 10, 2026

• Reuters — Saudi pipeline outage threatens loss of 4% of global oil supply, September 13, 2026

• White House — President Trump Was Right: America Controls the Strait of Hormuz, August 28, 2026

• Reuters — U.S. energy secretary says 17 million barrels transited Hormuz, September 2, 2026

• Reuters — Hormuz shipping traffic remains below recent average, September 14, 2026

• Reuters — Asia’s oil traders see no quick end to Middle East war, September 14, 2026

• Associated Press — Houthi advance raises concerns about Bab el-Mandeb, September 11, 2026

• Associated Press — Houthis seize Greater and Lesser Hanish, September 14, 2026

• Reuters — Saudi crown prince and CENTCOM chief discuss Houthi escalation, September 14, 2026

• Reuters — U.S. 10-year Treasury yield reaches 5%, September 14, 2026

• Reuters — Morning Bid: Go slow AI, September 14, 2026

• Reuters — Hormuz talks postponed as oil prices rise and Houthi attacks continue, September 14, 2026