A Cyberattack Has Left Bankruptcy Courts Reassigning Their Own Legal Notices

A cybersecurity incident has disrupted the federal Bankruptcy Noticing Center, forcing courts nationwide to establish temporary procedures for delivering legally required notices.

On October 16, the U.S. Bankruptcy Court for the Southern District of Florida issued an emergency administrative order changing who must deliver official notices in bankruptcy cases. For cases filed on or after October 7, the debtor's attorney, or the debtor personally if unrepresented, must mail the notice announcing the case and the required meeting of creditors. The order gives them three days after the later of its issuance or the court's production of the notice. It also assigns additional mailing responsibilities when cases are discharged, dismissed or closed, and requires affected parties to document that service was completed.

These are ordinarily functions supported by the federal judiciary's Bankruptcy Noticing Center, a centralized system responsible for producing and distributing notices across the country's bankruptcy courts. Since October 9, that system has been unavailable following a cybersecurity incident affecting its contractor, BAE Systems. The Administrative Office of the U.S. Courts publicly confirmed the disruption on October 15, explaining that the incident had stopped the center's production and distribution of notices nationwide. Several associated websites and the National Creditor Registration Service were also unavailable.

Bankruptcy courts have continued accepting filings, opening cases and processing documents. Their primary electronic case-management system remains operational, and registered users can still receive certain electronic filing notifications. But those systems don't replace every notice that must reach a debtor, creditor or other interested party. In particular, people who aren't registered for electronic court notifications may depend on the service that has stopped functioning.

Florida's order illustrates what happens when a centralized administrative function becomes unavailable while the legal obligations it supports remain in force. Hearings and statutory deadlines generally continue unless the court orders otherwise. Parties who believe they were harmed by delayed notice can request relief, but they may need to file a motion identifying the affected notice, explaining the consequences and specifying what remedy they need. Unrepresented parties who cannot comply with the temporary procedures are instructed to contact the clerk or seek relief from the court. Filing that request doesn't automatically extend a deadline.

The court has established protections intended to prevent people from suffering adverse consequences because legally required notice wasn't delivered. It has also preserved judicial discretion to assign notice responsibilities differently in individual cases. Those safeguards matter. They show that the judiciary has retained the authority and some of the practical capacity to respond to the disruption.

But the response also reveals how much administrative work was concentrated in the system that failed. Responsibilities previously handled through a national service are being redistributed among individual courts, attorneys, trustees and debtors. People who entered bankruptcy because they couldn't meet their financial obligations may now have additional procedural work to complete simply because the institution's contracted notice system is unavailable. The order doesn't establish that anyone has lost a legal right. It establishes that protecting those rights now requires different procedures, additional effort and, in some cases, an individual request for relief.

The distinction between a court remaining open and its procedures remaining accessible is central to this development. A functioning docket doesn't guarantee that everyone entitled to participate has received the information necessary to do so. Nor does the existence of a legal remedy guarantee that the person who needs it knows the remedy is available.

That makes the outage more consequential than an ordinary interruption of a government website. It has affected a process through which legal obligations are communicated, deadlines become meaningful and affected people are given an opportunity to respond.

Courts Are Using Different Procedures to Replace the Same National Service

The Bankruptcy Noticing Center was designed to perform a shared function for federal bankruptcy courts. Centralization allows courts to rely on common infrastructure for a large volume of routine communications, including paper and electronic notices. It can reduce administrative duplication and provide consistent processes across districts. But the October incident demonstrates what happens when a service used nationally loses its ability to operate.

The Eastern District of Texas reported that the disruption began late on October 9. By October 14, it had issued two general orders addressing deadlines and relief associated with the outage. The court continued accepting filings and processing cases, but warned that notices and orders might be delayed. It also published instructions for obtaining creditor names and addresses through the case-management system because the normal mailing-matrix function was affected.

That workaround has limitations. The court cautioned that the available creditor list doesn't necessarily include everyone entitled to notice, including debtors, trustees and certain government parties. Attorneys and other users must therefore determine whether additional recipients need to be identified. The technical ability to retrieve a list of creditors is useful, but it doesn't fully replace the administrative process that previously assembled and distributed legally sufficient notices.

The District of Hawaii issued similar guidance. It confirmed that ordinary electronic filing notifications remained operational while notices generated through the Bankruptcy Noticing Center were interrupted. Its instructions directed people without access to the electronic case-management system to contact the court's help desk. The court also advised that people prejudiced by missing or delayed notices could request relief. At the time of its October 14 announcement, it had no estimated restoration date.

These responses demonstrate meaningful compensatory capacity. The judiciary hasn't simply waited for its contractor to restore service. Courts have identified affected functions, published alternative procedures and exercised their authority to address deadlines and notice requirements. The electronic filing infrastructure also provides a functioning channel for some users, limiting the scope of the disruption.

The difficulty is that the substitute procedures aren't equivalent to the original service. A national system ordinarily performs notice-related work without requiring each affected person to determine which parts of the process have failed. Under the temporary arrangements, responsibility is more dispersed. Individual courts must decide how to handle the interruption, legal professionals must verify service requirements, and some unrepresented parties must perform tasks that would otherwise have been handled for them.

There is also a difference between making relief legally available and making it practically accessible. Someone represented by an attorney may have help identifying a missing notice, understanding its significance and requesting an extension. Someone without representation may first have to discover that a notice was delayed, determine which deadline was affected and understand how to bring the problem before a judge.

The Florida order recognizes this problem by allowing unrepresented parties to seek procedural assistance and by authorizing the court to establish alternatives where necessary. It also specifies that a motion for relief doesn't automatically stop an approaching deadline. The system therefore remains capable of correcting individual problems, but some of the work required to obtain that correction has shifted toward the people affected.

The outage's ultimate consequences aren't yet established. There is no verified national count of notices delayed, parties prejudiced, hearings continued or additional costs imposed. Nor has the judiciary publicly established that the incident compromised case records or personal information. The contractor has described the incident as isolated to the Bankruptcy Noticing Center system, while the investigation and restoration work continue.

Those unknowns limit what can responsibly be concluded about the damage already done. They don't prevent an assessment of the structural change documented in the court orders. A nationally shared administrative service stopped performing a legally consequential function, and courts have had to reconstruct that function through local procedures while continuing their ordinary operations.

The central question is how effectively those procedures preserve access for people who depend on the missing service, particularly if restoration takes longer than anticipated.

A London Cloud Outage Interrupted Banking and Court Hearings

On October 20, a separate disruption affected digital services across the United Kingdom and parts of Europe. Google reported that a power-related incident had caused an outage in one of the availability zones within its London cloud region, known as europe-west2. Multiple cloud products experienced service interruptions, elevated error rates or intermittent network failures.

The consequences appeared across organizations that provide very different services. Revolut reported problems affecting card payments, transfers, cash withdrawals and account access. Customers of several other banks experienced difficulties using online services. Britain's courts and tribunals service also encountered problems with its Cloud Video Platform, which is used to connect participants to court proceedings remotely.

The disruption affected legal hearings as well as financial transactions. Reporting from the United Kingdom described difficulties involving remote court attendance, including proceedings that depend on video links for participants who aren't physically present. By early afternoon London time, Google was reporting recovery across most affected workloads, and court video services were beginning to return. Google said the underlying power event had been mitigated and suggested that customers could attempt to move affected workloads to another available zone or region where feasible.

This incident was not caused by the cyberattack affecting U.S. bankruptcy notices. The two events involved different providers, infrastructure and failure mechanisms. There is no evidence connecting them operationally.

Their significance lies in the functions they interrupted. In the United States, a cybersecurity incident at a government contractor stopped a centralized system for communicating legal notices. In Britain, a cloud infrastructure failure temporarily interrupted technology used to participate in court proceedings. The same cloud incident also affected banking services, demonstrating how infrastructure operated by one provider can support organizations whose public responsibilities and commercial activities are otherwise unrelated.

The cloud outage also provides evidence of recovery capacity. Google identified the affected region, reported the power-related failure and began restoring services within hours. Some customers had options to move workloads to another location. Financial institutions communicated with customers, and at least some affected services resumed during the day. These responses distinguish a serious but temporary service interruption from a prolonged loss of the underlying institutions' ability to operate.

Still, moving an application to another region isn't necessarily a practical option for every customer. It depends on how the service was designed, whether its data and dependencies can be transferred, and whether alternative infrastructure is already available. The existence of multiple availability zones doesn't mean every application can automatically survive the loss of one. A service may rely on a particular database, network configuration or supporting component that wasn't designed to fail over immediately.

This is especially important for public institutions and regulated services because their responsibilities continue during a technology failure. A court must still provide lawful proceedings. A financial institution must still account for customer funds and transactions. Restoring the technical system is essential, but organizations may also have to reconcile delayed transactions, reschedule proceedings or verify that records remained complete and accurate.

British financial regulators had already identified the significance of these dependencies. In July, the United Kingdom designated several technology providers, including Google Cloud's European business, as critical third-party suppliers to financial institutions. That designation brought them under direct regulatory oversight intended to address the risks associated with concentrating important financial services in external technology infrastructure. European Union regulators have established related oversight arrangements for critical information and communications technology providers.

The October outage doesn't establish that those regulatory arrangements failed. Their purpose includes identifying and managing risks that cannot necessarily be eliminated. What the incident provides is a concrete test of the relationship between external technology providers and institutions that remain responsible for delivering essential services. The relevant questions now include whether affected organizations had workable continuity plans, how quickly they restored operations, and whether regulators can obtain enough information to evaluate the incident and require improvements where necessary.

Grocery Stores Stayed Open While Their Digital Services Were Disabled

A third development provides a useful comparison because its compensatory arrangements operated differently.

On October 19, international grocery retailer Ahold Delhaize confirmed that malicious activity had prompted it to take parts of its information technology infrastructure offline. The company operates grocery brands in Europe and the United States, including Albert Heijn, Stop & Shop, Giant Food, Hannaford and Food Lion. Its decision to disconnect systems affected websites, applications and other services across most of its brands, although the consequences differed by business.

The incident began around October 11 and was disclosed publicly on October 12. By October 19, some services had been restored, but Albert Heijn's home deliveries in the Netherlands were not expected to resume until October 23. E-commerce services at the company's American brands were also still being restored. Belgian e-commerce operations had returned, along with many websites and applications elsewhere in Europe.

The company reported that its physical grocery stores remained open throughout the incident. It also said that its investigation had not identified evidence that sensitive customer, employee or partner information had been taken, while emphasizing that the investigation was continuing. The identity of the attackers and the precise method used had not been publicly established.

The stores' continued operation is consequential. Customers retained an alternative way to purchase food even when online ordering and delivery services were unavailable. Employees and distribution operations were also able to maintain at least some functions while digital systems were restored. The company's response demonstrates that shutting down compromised technology can preserve other parts of a business, even when the protective action itself causes significant disruption.

But physical stores aren't an interchangeable substitute for every customer. Home delivery may be essential for people who cannot easily travel, lack transportation, have disabilities or depend on scheduled deliveries. The same outage can therefore be a manageable inconvenience for one household and a serious access problem for another. The existence of a functioning alternative tells us something about the organization's resilience, but not necessarily whether that alternative is accessible to everyone who relied on the original service.

The grocery incident also illustrates the operational reach of shared corporate infrastructure. Ahold Delhaize operates distinct brands in different countries, but a security problem affecting shared systems required protective measures across much of the group. That is evidence of an internal dependency capable of transmitting disruption across geographic and organizational boundaries. It doesn't establish that every affected brand used identical systems or that all services were disabled for the same technical reason.

These three incidents shouldn't be combined into a single cybersecurity event. The U.S. bankruptcy disruption involves a contracted court-notification service. The London cloud outage resulted from a reported power event. The grocery disruption followed malicious activity in a corporate network. Their immediate causes, recovery processes and consequences differ.

What makes them analytically related is the location of the work that must continue when the technology becomes unavailable. In each case, organizations had to preserve functions that depended on infrastructure outside the immediate control of the people using those functions. The alternatives ranged from manually delivering court notices to moving cloud workloads or keeping physical stores operational.

Those alternatives have different limits. Some require additional labor. Some require technical preparation before the incident occurs. Others depend on whether customers or affected parties can use a different service channel. The availability of a substitute is therefore only one part of the assessment. Its capacity, accessibility and cost determine how much of the original function it can actually preserve.

Federal Agencies Still Don't Have Complete Inventories of Connected Devices

The latest incidents occurred against a broader record of incomplete technology oversight.

On September 30, the Government Accountability Office released a report examining how federal civilian agencies identify and manage networked devices. These include internet-connected equipment and operational technologies used in buildings, laboratories and other government facilities. Federal requirements call for agencies to maintain inventories containing information necessary to understand and secure those devices.

Of the 22 agencies reviewed, 15 had established an inventory as of September 2026. Eleven were maintaining their inventories, and ten had included all required information for each device. Only seven had fully met all three requirements. GAO also found that the Office of Management and Budget had not issued updated guidance covering fiscal year 2026 or provided the oversight needed to ensure agencies completed the work.

This finding doesn't explain the Bankruptcy Noticing Center incident, the London outage or the grocery cyberattack. GAO examined a different set of federal technology-management responsibilities, and the report doesn't establish that any of those incidents resulted from missing device inventories.

Its relevance is to the capacity to identify and manage technological dependencies before they fail. An organization cannot reliably assess the security of equipment it hasn't identified. Incomplete inventories can leave agencies uncertain about which devices are connected, what software they use, which security controls apply and whether known vulnerabilities have been addressed. The GAO findings document an institutional weakness in maintaining that information, even though the relevant requirements have existed for years.

Another development this week raises the importance of those unresolved responsibilities. On October 19, Reuters reported on a cybersecurity investigation documenting the use of autonomous AI agents to attempt intrusions against more than 1,200 websites across several countries. Researchers reported more than 100 successful compromises, while Reuters independently examined activity records and contacted affected companies. Some businesses confirmed limited intrusions or remediation, although the extent of any data theft remained uncertain.

The investigation suggests that automated tools can reduce the labor required to search for vulnerabilities across large numbers of targets. It doesn't establish that the same tools were involved in any of this month's major service disruptions. The relevance is prospective: organizations with incomplete inventories, poorly secured secondary systems or insufficient monitoring may face a growing volume of attempts to exploit those weaknesses. The number of attempted intrusions could increase without a corresponding increase in the number of human attackers conducting them.

That changes the demands placed on defensive systems. Preventing incidents requires knowing which systems exist, how they connect and what access they provide. Responding to incidents requires isolating affected components without unnecessarily disabling essential functions. Recovering requires alternative procedures, accurate records and enough personnel to restore services while meeting continuing obligations.

The federal bankruptcy response shows that some of those capabilities remain available even after a shared service stops operating. Courts have preserved case processing, identified substitute procedures and established ways to seek relief. The British cloud outage shows that substantial technical recovery can occur within hours. Ahold Delhaize's decision to disconnect affected systems preserved physical retail operations while digital services were restored.

These are meaningful successes. They also demonstrate that resilience isn't captured by whether a system is described as operational. A court can remain open while notice delivery is interrupted. A bank can safeguard deposits while customers cannot complete transactions. A grocery chain can keep stores open while its delivery network is unavailable. Each organization may be functioning in an important sense while particular obligations or services remain difficult to fulfill.

The structural concern becomes more significant when those interruptions require the people least equipped to manage them to perform additional work. Bankruptcy debtors may need to send official notices. Customers may have to find another way to purchase groceries. People participating in remote hearings may have to wait for proceedings to resume. These consequences vary in severity, and the available evidence doesn't establish widespread irreversible harm. But they show where the cost of preserving institutional function can move when centralized systems fail.

This is the point at which the Risk Monitor needs to distinguish technical restoration from institutional repair. Restoring the Bankruptcy Noticing Center would allow ordinary notice production to resume. It wouldn't automatically establish whether every delayed notice had been delivered, every affected deadline had been addressed or every person entitled to relief had received it. Similarly, restoring cloud services doesn't by itself establish that all delayed transactions and proceedings have been reconciled.

The institutions remain responsible for those outcomes even when their contractors operate the systems through which the work is performed. Whether they can identify every affected obligation, correct the consequences and demonstrate that correction is the more consequential measure of recovery.

What I’m watching now

The immediate question is when the Bankruptcy Noticing Center resumes operations and how the federal judiciary handles notices accumulated during the interruption. A restoration announcement would establish that the contractor has recovered the service, but it would not establish that the notice backlog has been cleared. I want to see whether the Administrative Office publishes the duration and scope of the outage, how many notices were delayed, and whether courts identify cases requiring corrective service. The handling of deadlines, continuances and requests for relief will show whether temporary procedures protected affected parties or left problems to be resolved individually.

The differences among district responses also deserve attention. Florida has issued a detailed order reallocating service responsibilities. Texas and Hawaii have published their own procedures and protections. A useful next step would be to determine whether the judiciary develops a more uniform national response or continues relying primarily on district-level arrangements. Neither approach is automatically inadequate. The relevant measure is whether legally required notices reach the appropriate people and whether those affected by failures can obtain timely correction without unreasonable additional burdens.

For the London cloud outage, the strongest evidence of recovery will come from Google's final incident report and the responses of affected institutions. Restoration times, the specific infrastructure that failed, the effectiveness of failover arrangements and any remaining service backlogs will help establish whether the incident exposed weaknesses that require further intervention. Regulatory findings would be particularly important because financial authorities have already identified critical cloud providers as a subject of direct oversight. Evidence that institutions successfully maintained or restored essential operations through tested continuity plans would weaken the assessment of inadequate redundancy.

Ahold Delhaize's restoration schedule provides a more immediate operational measure. The return of home deliveries, online ordering and distribution services would demonstrate that the company can restore affected functions without compromising its remaining operations. Continued outages, additional disruptions or evidence of more extensive compromise would strengthen concern about the consequences of shared digital infrastructure. The company's final investigation may also clarify whether its protective shutdown prevented wider damage.

The GAO findings raise a longer-term question about institutional correction. OMB can issue updated guidance, and agencies can complete and maintain the required inventories. Those would be measurable improvements. The important evidence will be whether agencies actually meet the requirements and whether oversight verifies that the inventories are accurate and useful. A policy announcement without implementation would leave the underlying weakness largely unchanged.

I'm also watching whether the growing use of autonomous tools in cyber intrusions produces verified changes in incident frequency, detection times or defensive capacity. The October 19 investigation provides evidence of one significant campaign, but it doesn't establish how widespread the technique has become or how effectively organizations are adapting. Additional independently verified incidents, especially those affecting essential services, would alter that assessment.

Across these developments, the most important indicators concern the work that remains after a system is technically restored. If institutions can account for interrupted services, identify everyone affected and complete necessary corrections, the evidence would support substantial repair capacity. If systems return online while unresolved obligations, inaccessible remedies or incomplete records remain, the assessment would need to distinguish operational recovery from the restoration of the service people were entitled to receive.

Current Risk Assessment · October 20, 2026

Current assessment: Strained, with substantial compensatory capacity still functioning. A cybersecurity incident has interrupted the nationwide system used to distribute federal bankruptcy notices, requiring courts to establish temporary procedures for legally consequential communications. Separate cloud and corporate cybersecurity incidents have disrupted banking, court participation and grocery services. Recovery mechanisms are operating, but their effectiveness varies by service, institution and the ability of affected people to use available alternatives.

Expected if this assessment holds: Continued reliance on temporary administrative procedures while the Bankruptcy Noticing Center is restored, followed by additional work to reconcile delayed notices and affected proceedings. Organizations dependent on shared digital infrastructure may experience further service interruptions requiring manual workarounds, technical failover or temporary suspension of affected systems. The consequences are likely to be uneven, with greater burdens on people and institutions that lack accessible alternatives.

Would weaken the assessment: Prompt restoration of the Bankruptcy Noticing Center accompanied by verified clearance of delayed notices, consistent protection of affected parties and limited unresolved procedural consequences; evidence that cloud and grocery services have recovered without significant outstanding obligations; effective continuity arrangements demonstrated through incident reviews; and measurable progress in federal technology inventories and oversight.

Status: STRAINED — COMPENSATING. The documented incidents have interrupted essential functions without establishing a general failure of the institutions responsible for them. Courts, technology providers and businesses have preserved or restored substantial operations. The unresolved risk concerns whether their compensatory arrangements can reliably deliver the original services, particularly where legal rights, financial access or essential household needs depend on functions that remain interrupted.

Sources

Administrative Office of the U.S. Courts, “Cybersecurity Incident Disrupting Bankruptcy Court Operations”, October 15, 2026. Primary confirmation of the contractor incident and nationwide interruption of Bankruptcy Noticing Center services.

U.S. Bankruptcy Court, Southern District of Florida, “Administrative Order 2026-06: Bankruptcy Noticing Center Service Interruption”, October 16, 2026. Primary court order establishing temporary notice responsibilities, deadlines, safeguards and procedures for relief.

U.S. Bankruptcy Court, Eastern District of Texas, “BNC Service Interruption Update”, October 14, 2026. Court announcement documenting emergency orders, continued case processing and alternative creditor-list procedures.

U.S. Bankruptcy Court, District of Hawaii, “Notice of BNC Nationwide Outage”, October 14, 2026. Primary description of affected notice services, functioning electronic filing notifications and available procedural remedies.

Reuters, “U.S. Federal Bankruptcy Court Operations Disrupted by Cybersecurity Incident”, October 16, 2026. Independent reporting on the contractor incident and its effects on federal court operations.

Google Cloud Service Health, “Multiple Services Are Experiencing Issues in the europe-west2 Region”, October 20, 2026. Primary incident record identifying the affected infrastructure, reported power event, service interruptions and recovery updates.

Reuters, “Google Cloud Services Down in UK; Banks, Public Sector Report Issues”, October 20, 2026. Reporting on the cloud outage, affected financial services and regulatory oversight of critical technology providers.

The Guardian, “Google Cloud Failure Hits Millions as UK Courts and Banks Knocked Offline”, October 20, 2026. Reporting on disrupted remote court hearings, banking services and the initial recovery.

Ahold Delhaize, “Ahold Delhaize Update on Status of Cybersecurity Incident”, October 19, 2026. Primary company statement documenting the incident, protective shutdowns, continued store operations and restoration schedule.

U.S. Government Accountability Office, “Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices,” GAO-26-108937, September 30, 2026. Primary audit of federal agency networked-device inventories and oversight deficiencies.

Reuters, “How One Hacker Used AI Agents and a Few Thousand Dollars to Break Into Scores of Sites”, October 19, 2026. Investigation documenting autonomous AI-assisted intrusions, affected businesses and remaining uncertainties about the extent of compromise.

Ukraine's Strikes on Russian Data Centers Raise Questions About U.S. Pressure and Election Interference

Ukrainian drone strikes on Russian Yandex data centers in October 2026 disrupted digital infrastructure and prompted questions about whether Russian influence operations were affected. Independent researchers have not established that the strikes disabled networks targeting Western elections.

Between October 7 and 11, Ukrainian drones struck three data centers operated by Yandex, one of Russia's largest technology companies. The attacks disrupted Russian internet infrastructure and were followed by claims that Russian propaganda accounts supporting Donald Trump and other Western political movements had suddenly gone quiet.

The timing was particularly interesting. The United States is less than three weeks away from its midterm elections, and researchers have already documented Russian influence operations targeting Democratic candidates. If Ukrainian attacks had disrupted the infrastructure supporting those operations, the consequences could extend well beyond Russia's war with Ukraine.

But something else was happening at the same time. The Trump administration was pressuring Ukraine to stop attacking Russian oil refineries, reportedly threatening access to American weapons and intelligence. Ukraine then experienced unexpected restrictions on the satellite communications systems used by its military drones. Ukrainian officials also reported that Western intelligence warnings hadn't arrived before Russian missile attacks. On October 14, Russia struck 30 Ukrainian energy facilities, leaving at least 600,000 people without electricity.

I don't think we can establish that these events were coordinated, or that the communications restrictions were retaliation for the Yandex attacks. The evidence available so far doesn't support that conclusion. But I'm interested in the relationships between them, particularly because they involve several forms of power that aren't usually examined together: control over digital infrastructure, the ability to conduct foreign influence operations, dependence on military technology, and the authority to restrict access to systems other people need to survive.

The approaching American election makes those relationships especially consequential.

The Yandex Attacks Disrupted More Than Internet Search

Yandex operates a substantial part of Russia's digital infrastructure. Its services include search, cloud computing, mapping, transportation, advertising and other systems used by businesses and individuals. Its data centers provide computing capacity for services that depend on remote servers rather than equipment located with the end user.

Between October 7 and 11, Ukrainian drone attacks struck three Yandex facilities. According to Cloudflare's October 14 analysis, traffic associated with Yandex's search network fell approximately 99 percent below its previous baseline, while traffic associated with Yandex Cloud fell roughly 90 percent. Both networks remained substantially disrupted through October 13.

Those are significant disruptions, although they don't tell us that every service operating on the affected networks stopped working. Cloudflare also observed a decline in malicious scanning and probing activity originating from Yandex Cloud, followed by activity shifting to other hosting providers.

That last finding is worth paying attention to. Some automated activity was disrupted, but the activity didn't necessarily disappear. Cloudflare found evidence that high-volume automation migrated elsewhere. The distinction matters because the ability to move operations between providers is itself a form of redundancy.

A physical attack can disable a facility, interrupt connections and make a particular provider unavailable. Whether it disables an operation depends on how much that operation relies on the affected infrastructure and whether its operators have somewhere else to go.

In the days following the strikes, social media users circulated charts showing the collapse in Yandex traffic alongside claims that Russian-operated political accounts had disappeared from MAGA communities, Germany's Alternative für Deutschland, Britain's Reform UK and other online groups.

The implication was that Ukrainian drones had unintentionally, or perhaps deliberately, interrupted the infrastructure supporting Russian political influence abroad.

Graphika investigated those claims using its existing maps of online communities. Its researchers found that none of the Western political communities identified in the viral posts had lost their active accounts or their most prolific contributors. The strongest reductions in posting appeared in Russian-speaking communities, where activity declined following the strikes.

The charts that had circulated most widely measured Yandex's automated web crawlers, which index internet content for search. They weren't measuring political accounts on social media platforms.

That changes what we can conclude from the attacks. There was a substantial disruption to Russian digital infrastructure, including some automated activity associated with Yandex Cloud. There wasn't a demonstrated collapse of Russian propaganda operations in Western political communities.

But the distinction also identifies something that remains unresolved. Graphika's findings address the specific claims circulating online. They don't establish that no influence operation anywhere was affected, just as the traffic declines don't establish that one was.

To answer that question, we'd need evidence connecting particular influence networks to the infrastructure that was damaged. We would also need to know whether those networks experienced operational changes that couldn't be explained by ordinary fluctuations or movement to other providers.

That's a much narrower question than whether Russian bots suddenly disappeared from the internet. It's also one we may eventually be able to investigate.

Russian Influence Operations Are Already Targeting the Midterms

The reason I think the election connection deserves attention is that we don't have to speculate about whether Russia is conducting influence operations against American political candidates.

On September 21, Graphika published an investigation identifying a coordinated Russia-aligned operation targeting candidates in the November midterms and Germany's September state elections.

The researchers attributed the activity with high confidence to Operation Overload and the Foundation to Battle Injustice, an organization founded by Yevgeny Prigozhin. The network distributed manipulated videos, impersonated established news organizations and circulated unverified allegations of corruption and electoral misconduct.

Among the American politicians targeted were James Talarico, Jon Ossoff, Chris Pappas, Sherrod Brown, Mary Peltola, Roy Cooper, Abdul El-Sayed, Joshua Turek and Troy Jackson. The operation also used footage of American celebrities with fabricated text suggesting they supported an anti-Democratic campaign.

Some of the material went further. It impersonated news outlets and journalists to promote allegations that Democrats themselves were manufacturing claims of Russian election interference.

That is an important part of the operation because it targets the process by which interference might be recognized. An influence campaign can circulate false allegations against political candidates while simultaneously attempting to discredit the people and institutions investigating those allegations.

The United States has encountered this before. American intelligence agencies concluded that Russia conducted an influence campaign during the 2016 presidential election, including efforts intended to damage Hillary Clinton and a preference for Donald Trump. The Senate Intelligence Committee's bipartisan investigation subsequently documented the scope of Russian activities, including social media operations and efforts to exploit political divisions.

The historical record establishes that Russian actors have sought to benefit Trump politically. The current Graphika findings establish that Russia-aligned operations are targeting Democrats ahead of another American election. They don't establish that Trump requested, directed or coordinated the present campaign.

That distinction doesn't make the political implications disappear. The administration has an interest in the outcome of the midterms, Russian influence operators are attempting to shape the information environment in which those elections occur, and Ukraine has attacked Russian infrastructure that could conceivably support some digital operations.

The question is whether those interests have intersected in decisions about Ukraine.

I wouldn't treat the Yandex traffic collapse as evidence that they have. But I also wouldn't dismiss the possibility of an electoral dimension simply because the most widely circulated explanation of the bot activity was wrong.

There is already enough documented activity to investigate what Russian influence networks are doing, how their infrastructure is distributed, and whether disruption to Russian computing capacity has any measurable effect on their operations.

The U.S. Has Reduced Election-Security Support While Foreign Operations Continue

The Russian influence campaign is occurring during a period when the federal government's election-security support has been significantly reduced.

On September 24, the Cybersecurity and Infrastructure Security Agency released its election infrastructure security plan, approximately 40 days before the midterms. The plan described services intended to help state and local election officials address cybersecurity threats, physical security risks and information sharing.

But Associated Press reporting found that election officials in multiple states considered the plan inadequate and too late to replace assistance they had previously received.

The Trump administration had cut approximately 1,000 positions from CISA and reduced funding for cybersecurity initiatives, including support for state and local election officials. Officials described losing access to services such as penetration testing, security exercises and intelligence briefings. Minnesota expected to spend approximately $250,000 on private penetration testing that federal assistance had previously helped provide.

Other states reported different experiences. Some federal services continued, and election officials have been developing their own arrangements to maintain security. Michigan officials expressed confidence in their ability to administer the election despite reporting a substantial deterioration in their relationship with CISA.

The problem isn't that every state has suddenly become unable to protect its elections. It's that a shared source of expertise and coordination has been reduced, leaving states to compensate according to their individual resources.

That matters for foreign influence operations because the threat doesn't respect state boundaries. A coordinated campaign can target candidates in several states, impersonate national media organizations and circulate content across platforms used throughout the country. Identifying connections between those activities requires information that may be distributed among federal agencies, state officials, private researchers and technology companies.

If the federal coordination layer weakens, individual states can still detect and respond to threats, but they may have less access to the information needed to recognize a larger operation.

There's also a difference between maintaining the ability to conduct an election and maintaining the ability to identify attempts to manipulate the information surrounding it. Election infrastructure can remain secure while foreign actors circulate fabricated material intended to influence voters.

That distinction is particularly relevant here because the documented Russian operation involves political messaging and impersonation rather than a demonstrated compromise of voting equipment.

The election-security system can absorb some of the loss of federal support through private contractors, state resources and independent research. But those substitutions don't necessarily restore the same coordination or investigative capacity. They may also create new differences between jurisdictions with substantial resources and those with fewer options.

We have evidence of continuing foreign influence activity and reduced federal assistance. We don't yet know whether the remaining institutions can compensate adequately for what has been lost.

Washington Was Already Pressuring Ukraine Over Russian Energy Attacks

While the Yandex strikes were taking place, the Trump administration was pursuing a separate dispute with Ukraine over attacks on Russian oil refineries.

Ukraine has targeted Russian refining infrastructure because it contributes to Russia's fuel supply, military logistics and revenue. The attacks also have consequences for energy markets, especially when fuel supplies are already under pressure.

Trump has made lowering fuel prices a political priority ahead of the midterms. His administration recently lifted sanctions on Russian diesel, and he has urged Ukraine to stop attacking Russian refineries.

On October 11, Reuters reported that the Financial Times had obtained accounts from European officials describing American threats to restrict intelligence sharing and the Prioritised Ukraine Requirements List, the mechanism through which European governments purchase American weapons for Ukraine.

Reuters couldn't independently verify those reported threats at the time, and the White House hadn't responded to its request for comment. The Financial Times account nevertheless identified a specific form of pressure: restricting resources Ukraine depends upon unless it changes its military targeting decisions.

Trump also announced that Russia and Ukraine had agreed to an immediate ceasefire covering energy infrastructure. Neither government confirmed the agreement at the time, and Russia continued attacking Ukrainian facilities.

The administration's position has an identifiable economic rationale. Russian refinery disruptions can contribute to fuel-market pressures, and higher fuel prices are politically damaging to a president whose party faces an approaching election.

Ukraine's position has a different rationale. Russian energy infrastructure supports a state conducting an ongoing war against it, and limiting that infrastructure can affect Russia's capacity to sustain military operations.

The disagreement itself isn't unusual. Allies can have conflicting economic and military priorities. What matters here is the mechanism available to resolve that disagreement.

The United States controls access to weapons procurement and intelligence systems that Ukraine needs. If those resources are used to compel changes in Ukrainian targeting decisions, the United States can exercise considerable influence without assuming direct responsibility for the military consequences.

That is where the relationship becomes structurally important. Ukraine remains responsible for defending its territory and population, but some of the capabilities required to do so depend on decisions made by another government.

The pressure over Russian refineries was already documented as the Yandex controversy developed. That means we can't reasonably infer that the pressure began because of the data-center attacks. The chronology supports an existing conflict over Russian energy infrastructure, with the Yandex strikes occurring during the same period.

It leaves open whether the data-center attacks created any additional concern within the administration, but there isn't evidence establishing that they did.

Starlink Restrictions Affected Ukrainian Drone Operations

On October 14, Ukrainian officials reported that restrictions affecting SpaceX's military satellite communications systems had disrupted drone missions.

Ukraine uses Starlink technology extensively for military communications, including systems integrated into drones. Some of those drones operate at speeds that require communications terminals to remain connected while moving rapidly across the battlefield.

According to Reuters, Ukrainian officials said military-grade Starshield terminals began disconnecting when moving above specified speeds. Presidential adviser Serhiy Beskrestnov reported a limit of 160 kilometers per hour, although a Ukrainian defense source said some units experienced disconnections at lower speeds.

Beskrestnov said Ukrainian forces hadn't received advance warning and that several missions had been disrupted. Military sources told Reuters the restrictions affected both offensive drone operations and defensive interception of Russian drones.

Elon Musk responded that limits on the military system's speed or use were determined by the American military and ultimately the president. His statement placed responsibility for those restrictions with the U.S. government rather than solely with SpaceX.

The distinction between Starlink and Starshield matters because they operate under different arrangements. SpaceX controls its commercial services, while Starshield provides military and intelligence capabilities under government arrangements. Reporting about restrictions to one system shouldn't automatically be treated as evidence that every Starlink service was restricted in the same way.

But the broader dependence is clear. Ukraine has incorporated externally controlled satellite communications into military operations that require reliable connectivity. A change in access conditions can affect those operations even when the underlying equipment remains functional.

Ukrainian officials suspected the restrictions might be connected to Washington's pressure over refinery strikes. American officials disputed administration involvement in the reported restrictions. The available reporting doesn't establish who authorized the specific changes, what rules governed them or whether political considerations influenced the decision.

What we do know is that the restrictions were reported by the people operating the systems, that Ukraine said missions were disrupted, and that the resulting questions about responsibility remained unresolved.

The distinction between technical and political causes matters for determining who should answer for the decision. It doesn't change the immediate dependency.

A drone that loses its connection during an interception can't complete the same mission simply because the restriction originated in a contract, a technical configuration or an instruction from another government.

The system's ability to function depends on a condition that its operators don't fully control.

Ukraine Also Reported Missing Intelligence Warnings Before Russian Attacks

The satellite restrictions were accompanied by another concern: Ukraine reported that it hadn't received the usual advance intelligence warnings before Russian missile strikes.

On October 13, Zelenskyy said Ukraine had experienced a second consecutive attack without warnings from Western partners. The attacks included ballistic missiles targeting Kyiv and energy infrastructure.

American officials maintained that intelligence sharing continued. Other reporting indicated that warnings resumed during subsequent attacks, and officials offered technical explanations for the disruptions.

That leaves an important factual question unresolved. A missing warning doesn't establish that intelligence sharing was deliberately suspended, particularly when officials responsible for the systems dispute that interpretation.

But the difference between an interruption in intelligence sharing and an interruption in the delivery of intelligence can be smaller for the people depending on the warning than it is for the institutions responsible for producing it.

An early-warning system has several necessary steps. A threat must be detected, identified, assessed and communicated quickly enough for defensive action. A failure at any point can leave the recipient without useful warning, even if the larger intelligence relationship technically remains in place.

That is why the reported warning failures deserve investigation independently of the political dispute. Ukraine needs to know whether the warnings weren't generated, weren't transmitted, arrived too late or were affected by an intentional change in the sharing arrangement.

Each possibility implies a different problem and a different repair.

If the failure was technical, the system needs technical correction and evidence that the correction works. If it was procedural, the communication process needs to change. If access was deliberately restricted, the relevant decision-makers need to account for the authority they exercised and the foreseeable consequences.

Without that information, Ukraine can recognize the failure but may be unable to prevent it from happening again.

Russia's October 14 Strikes Increased Ukraine's Repair Burden

On October 14, Russia launched another large-scale attack on Ukrainian energy infrastructure, primarily affecting Kyiv and Kharkiv.

According to Ukrainian authorities, 30 energy facilities were damaged and at least 600,000 people lost electricity. Three people were reported killed in Kyiv. Russia acknowledged strikes on energy facilities, while Zelenskyy accused Moscow of disregarding Trump's announced energy ceasefire.

The attacks followed several days of disagreement over whether an energy ceasefire existed at all. Trump had announced an agreement, but neither Russia nor Ukraine had confirmed it in the form he described. Russia continued attacking Ukrainian infrastructure.

There's no evidence establishing that the October 14 strikes were coordinated with American decisions about satellite communications or intelligence warnings. Russia had been attacking Ukraine's energy infrastructure long before the Yandex strikes, and its military campaign has its own objectives.

But the simultaneous pressures matter because they affect different parts of Ukraine's ability to withstand and recover from attacks.

Air defenses attempt to prevent damage. Intelligence warnings provide time to prepare. Communications systems support the operations of defensive equipment. Repair crews and utilities restore infrastructure after an attack succeeds.

A problem in one part of that arrangement increases the demands placed on the others. If fewer incoming drones can be intercepted, more may reach infrastructure targets. If warnings arrive late, preparations may be reduced. If multiple facilities are damaged, restoration crews must divide their equipment and labor across a larger number of sites.

Ukraine has repeatedly restored electricity following Russian attacks. Those restorations demonstrate substantial operational capacity, but they don't tell us how much replacement equipment, redundancy or reserve capacity remains afterward.

An electrical system can return to service while operating with fewer backup options than it had before the attack. Repeated repairs may preserve electricity delivery while consuming the components and labor needed to respond to the next disruption.

The effect extends beyond power generation. Electricity supports water systems, communications, heating, transportation, healthcare and industrial activity. Damage to a relatively small number of critical facilities can therefore create demands across several other systems.

The October 14 attacks add to that accumulated burden. The fact that Ukraine continues restoring service is important, but it shouldn't be mistaken for evidence that the underlying system has recovered all the capacity it has lost.

The Election Connection Changes What Needs to Be Investigated

The strongest reason to examine these events together is that they involve different systems through which governments and private actors can influence outcomes without exercising direct control over the institutions ultimately responsible for them.

Russia-aligned influence operations can distribute fabricated political material across American platforms without controlling American elections. The Trump administration can influence Ukrainian military decisions through access to weapons and intelligence without directly commanding Ukrainian forces. SpaceX and the U.S. government can establish operating conditions for satellite systems used in Ukrainian military equipment without operating that equipment themselves.

In each case, a decision made in one part of a system can change what another part is able to do.

The possibility of retaliation for the Yandex attacks is worth investigating because the affected infrastructure, the ongoing influence operations and the approaching election create a plausible area of overlapping political interest. But plausibility isn't enough to establish that the attacks damaged election operations or that American officials responded to protect them.

For that interpretation to become stronger, we'd need evidence connecting the Yandex facilities to identified influence networks, measurable disruption to those networks, and some indication that the disruption influenced decisions by American officials or technology providers.

We don't have that evidence now.

There is, however, a more immediate question about whether the Trump administration's documented pressure over Russian energy targets was accompanied by changes to Ukraine's access to military resources. The reported threats concerning weapons and intelligence are directly relevant to that question. So are the Starshield restrictions, the missing intelligence warnings and the competing explanations offered by officials.

The available evidence doesn't yet establish a common decision behind those developments. It does establish that Ukraine experienced operational problems involving capabilities controlled by outside actors during a period of unusually explicit political pressure.

I think the distinction is important because uncertainty about the motive shouldn't prevent us from examining the mechanism.

We don't need to know whether the Yandex strikes angered Trump or Musk to recognize that Ukraine's military dependence gives outside decision-makers significant power over its operations. We also don't need proof that the strikes affected Russian election operations to recognize that Russia-aligned networks are actively targeting American candidates while federal election-security support has been reduced.

Those are independently significant conditions. If evidence eventually connects them, the consequences become more serious. If it doesn't, the underlying problems remain.

What I’m watching now

The first thing I'm watching is whether anyone establishes a reliable connection between the damaged Yandex infrastructure and identifiable Russian influence operations. Cloudflare's findings show that some automated activity shifted to other providers after the attacks, while Graphika found no collapse in the Western political communities named in viral claims. I'd want to know whether specific operations changed their hosting arrangements, whether their activity declined for more than a brief period and whether any reduction was actually attributable to the strikes.

I'm also watching the Russia-aligned operations Graphika identified in September. Those accounts were distributing manipulated material about American candidates before the Yandex attacks. Their subsequent activity could provide a useful comparison, although a change in posting alone wouldn't establish its cause. We would need to distinguish disruption from ordinary campaign changes, platform enforcement and movement between accounts or services.

On the American side, I'm watching whether state election officials regain meaningful access to federal intelligence and cybersecurity support before November. CISA has announced services, but state officials have reported that some of the assistance they previously relied upon is no longer available or arrived too late to be useful. I want to know whether the promised coordination actually reaches election officials, particularly when researchers identify foreign operations targeting candidates across multiple states.

For Ukraine, the immediate question is who authorized the Starshield restrictions and whether the affected capabilities have been fully restored. Ukrainian officials reported that missions were disrupted without warning, while Musk said the military system's operating limits were determined by American authorities. That should be traceable through the relevant operational arrangements, even if the records aren't currently public. I'd also want to know whether any restrictions remain and whether Ukraine has been given a reliable process for learning about future changes before they affect active missions.

The intelligence-warning failures require the same attention. American officials say intelligence sharing continued, while Ukraine says warnings didn't arrive before particular attacks. Those accounts could both describe parts of the same event, depending on where the failure occurred. What matters is whether the cause is established and the warning system returns to reliable operation.

I'm also watching whether Washington continues threatening weapons procurement or intelligence access in response to Ukrainian attacks on Russian refineries. The administration has a stated interest in reducing fuel prices, and Ukraine has a military interest in limiting Russia's energy resources. If the United States uses control over essential support to enforce its preferred outcome, that would provide a clearer example of the dependence already visible in the communications dispute.

Finally, I'm watching Ukraine's energy restoration capacity after the October 14 attacks. The number of people without electricity tells us how extensive the immediate disruption was, but the repair timeline and the condition of the restored system will tell us more about what Ukraine has available for subsequent attacks. If service is restored through temporary arrangements, depleted reserves or equipment borrowed from other facilities, the visible recovery may conceal a reduction in the system's ability to absorb another strike.

What interests me most about this sequence is that several of the important questions concern decisions or information held by institutions outside the reach of the people experiencing the consequences. Ukraine can report a lost communications link or missing warning, but it may not have access to the records explaining why. Election officials can recognize foreign influence activity while lacking the federal intelligence relationships that previously helped them investigate it.

Those gaps don't establish misconduct. They do make misconduct harder to distinguish from ordinary failure, and they make both harder to correct.

Current Risk Assessment · October 15, 2026

Current assessment: Ukrainian attacks substantially disrupted Yandex infrastructure, but independent investigations haven't established that they disabled Russian influence operations targeting Western political communities. Separately, Graphika has documented Russia-aligned operations targeting American midterm candidates, while state election officials report reduced federal cybersecurity and intelligence support. During the same period, the United States reportedly threatened restrictions on military assistance over Ukrainian refinery strikes, and Ukraine reported disruptions to military satellite communications and intelligence warnings. The evidence supports elevated concern about Ukraine's dependence on externally controlled defense systems and reduced American election-security coordination. It doesn't establish a coordinated retaliation campaign connecting these developments.

Expected if this assessment holds: Ukraine will remain vulnerable to operational changes involving American-controlled military and intelligence systems, particularly where alternatives can't immediately replace the affected capabilities. Further restrictions or interruptions would increase the demands placed on Ukraine's other defensive systems and could add to the burden of repairing damaged infrastructure. In the United States, state election officials will continue relying on uneven combinations of state resources, private services and remaining federal assistance while Russia-aligned influence operations continue targeting political candidates. Investigations may identify additional activity, but establishing its origins and infrastructure will depend on access to information distributed across multiple institutions.

Would weaken the assessment: A documented explanation and durable correction of the Starshield restrictions and intelligence-warning failures would reduce concern about Ukraine's exposure to unpredictable access changes. Demonstrated alternatives capable of replacing the affected military functions would reduce its dependence on any single provider or government. Consistent restoration of federal election-security services, including actionable intelligence sharing and technical assistance, would weaken the assessment of declining coordination. Evidence that the Yandex disruption was limited to services unrelated to identified influence operations would further narrow the election connection. Conversely, documented links between the damaged infrastructure, election influence networks and subsequent political decisions would substantially strengthen the broader concern.

Status: ELEVATED — Ukraine's military dependence and the reduction in American election-security support are documented structural concerns. The possibility that disruption to Russian digital infrastructure influenced U.S. decisions remains unresolved and should be treated as an investigative question.

---

Sources

• Graphika — Yandex Strikes, Russian Bots and Influence Operations. October 13, 2026.

• Cloudflare — Yandex Outage: Data Shows That Instead of Going Dark, Malicious Bots Went on the Move. October 14, 2026.

• Graphika — Russia-Aligned Influence Operation Targets US Midterm Candidates, German State Elections. September 21, 2026.

• Associated Press — 40 Days to Midterms, Election Officials Say New US Cyber Plan Comes Too Late. September 24, 2026.

• The Washington Post — With Threats to Midterms, States Say Trump Administration Isn't Helping. October 4, 2026.

• Congressional Research Service — Election Security and the Cybersecurity and Infrastructure Security Agency. October 1, 2026.

• Reuters — US Threatens to Block Arms for Ukraine Over Refinery Attacks, FT Reports. October 11, 2026.

• Reuters — Ukraine Says SpaceX Hampers Drones for Attack and Defence, as US Ties Fray. October 14, 2026.

• The Washington Post — U.S. Warnings Sow Confusion, Alarm in Ukraine Over Intelligence, Starlink Access. October 14, 2026.

• Reuters — Russian Strikes Kill Three, Damage Dozens of Power Facilities. October 14, 2026.

The Power Grid Is Running Out of Room for Its Backup Plans

PJM's electricity grid serves approximately 67 million people across the Mid-Atlantic and Midwest. Rising demand, generation shortages and transmission constraints are placing increasing pressure on the resources used to maintain reliability. (Patrick Lewis/Loudoun Now)

On October 9, federal regulators rejected a proposal that would have allowed the nation's largest electricity grid operator to impose special curtailment obligations on certain large electricity customers, including data centers. Three days later, the Department of Energy authorized that same operator to use emergency generating resources and, under specified conditions, direct large electricity users to operate their own backup generators. By October 13, PJM Interconnection had issued a Maximum Generation Emergency/Load Management Alert, recalled active maintenance outages and identified generating resources it needed available to maintain reliability.

The decisions weren't responses to a single event. The Federal Energy Regulatory Commission was addressing how PJM could accommodate rapidly growing electricity demand without compromising future reliability. The Department of Energy was responding to an immediate operating problem involving elevated demand, scheduled generation outages and transmission constraints. But both decisions concern the same electricity system, and both involve arrangements intended to preserve service when ordinary available resources may be insufficient. The distinction between the two problems matters, particularly because a future capacity shortage isn't the same as an immediate shortage of electricity. What makes their convergence significant is that PJM is having to address both while the resources available to compensate for either are becoming more consequential.

PJM coordinates wholesale electricity markets and regional transmission across all or parts of 13 states and the District of Columbia, serving approximately 67 million people. Its July capacity auction, intended to secure electricity resources for the 2028–2029 delivery year, obtained 138,318 megawatts of accredited generation and demand-response capacity. Including resources committed outside the centralized auction, PJM still fell 6,831 megawatts short of its reliability requirement. The auction price reached its federally approved ceiling of $325 per megawatt-day, marking the second consecutive auction that failed to secure the required capacity. The previous shortfall had been approximately 6,517 megawatts. Higher prices were encouraging additional supply, but not enough to keep pace with the resources PJM expected to need.

That shortfall doesn't mean PJM will be unable to provide electricity in 2028. Capacity requirements include reserve margins designed to protect against unexpected failures and periods of unusually high demand, and the system has additional opportunities to secure resources before the delivery year begins. The significance is that the market responsible for arranging those resources in advance hasn't been able to meet its own reliability requirement, even at the maximum permitted auction price. PJM must now rely on additional procurement, changes in demand, generating upgrades or other arrangements to close the gap. Those responses may succeed, but they also require time, regulatory approval, financing and physical infrastructure that isn't yet available.

The October emergency brought a different set of constraints into immediate view. In its October 11 application to the Department of Energy, PJM anticipated electricity demand of approximately 111,500 megawatts or more on October 13, alongside roughly 61,591 megawatts of generation outages during the autumn maintenance season. It identified transmission restrictions limiting the movement of electricity between parts of its territory and neighboring systems, and warned that its operating reserves could become unusually tight. DOE issued Order No. 202-26-50 on October 12, authorizing specified emergency measures through October 16. PJM's subsequent operating notices confirmed that it had identified a reliability need for designated generating resources on October 13.

These measures don't establish that blackouts have occurred, or that every resource authorized under the emergency order has been dispatched. They do establish that the operator is making additional resources available through emergency procedures because the ordinary operating configuration may not provide sufficient flexibility. The distinction is important. An emergency intervention that prevents a service interruption is evidence that a protective mechanism worked. It can also be evidence that the system needed protection from conditions it could no longer comfortably accommodate through ordinary operations. Understanding which of those circumstances is developing requires examining what the intervention absorbed, how often similar interventions are needed and whether the conditions requiring them are improving.

Demand Is Growing Faster Than the System Can Accommodate It

PJM's capacity problems have been developing for several years, but the scale of projected demand growth has changed the planning environment. Data centers, particularly facilities supporting artificial intelligence infrastructure, are becoming increasingly important to the operator's forecasts. Unlike many traditional commercial customers, large data centers can require enormous amounts of electricity concentrated at individual sites, with relatively consistent consumption throughout the day. Some facilities also have demanding reliability requirements because even short interruptions can affect equipment, customer services and contractual obligations.

A single large project can therefore create requirements extending well beyond the amount of electricity it consumes. The grid must have sufficient generating capacity to serve that demand, transmission infrastructure capable of delivering it, and enough reserve capacity to manage equipment failures or unexpected changes in operating conditions. Those requirements become more difficult when several large projects seek connections within the same geographic area, particularly where the existing transmission network was designed around different patterns of electricity consumption.

The pace of development is also uneven. A data center can move from planning to construction and operation on a different timeline than a new generating station or major transmission project. New power plants may require years of permitting, equipment procurement, financing, construction and interconnection work. Transmission projects can involve multiple utilities, jurisdictions and regulatory proceedings. Even when the financing is available, the physical system cannot necessarily expand at the same speed as demand. PJM has been working to accelerate interconnections and obtain additional supply, but its capacity auctions indicate that the resources available within the relevant planning periods haven't caught up with projected requirements.

The July auction also demonstrates why higher prices alone cannot be treated as a sufficient response. The price cap was intended to moderate volatility and protect customers from abrupt increases in capacity costs. It provides a degree of financial predictability, which has value for households, businesses and electricity providers. But the cap doesn't create generating capacity. If the resources required to satisfy projected demand cannot be developed or committed within the relevant period, a higher market price may encourage investment without producing enough available supply in time. PJM itself acknowledged that the price collar could limit volatility without resolving the underlying imbalance between demand and supply.

The system's response has consequently expanded beyond its ordinary capacity auction. PJM has proposed a special Reliability Backstop Procurement process intended to secure additional resources, while pursuing changes to how large electricity customers connect to the grid. Both approaches recognize that the existing arrangements may be insufficient for the amount and timing of demand now being anticipated. They also introduce new questions about cost, authority and responsibility. If additional generation must be procured through long-term commitments, someone must assume the financial obligations. If large customers are allowed to connect before enough new supply becomes available, the operator needs enforceable rules governing what happens when the grid becomes constrained. Neither problem can be resolved solely by identifying the demand or announcing the investment required to serve it.

That was the issue behind FERC's October 9 decision. PJM proposed creating a registry of large electricity loads and an interim service arrangement that would allow certain new customers to connect under special curtailment obligations. FERC approved the registry, which will improve the operator's ability to identify and plan for large loads, but rejected the proposed interim service arrangement. The commission raised questions about jurisdiction and whether the proposal adequately justified treating some customers differently from others. Retail electricity service is generally subject to state regulatory authority, while FERC oversees interstate transmission and wholesale electricity markets. PJM's proposal had to operate within those divisions of responsibility.

The rejection doesn't mean regulators have decided that data centers must receive unrestricted electricity service regardless of system conditions. PJM can revise its proposal, and other arrangements may ultimately be approved. FERC's concerns also reflect legitimate questions about the authority to curtail service and the consequences of applying different rules to different customers. A large industrial facility, a hospital, a data center and a manufacturing plant may all consume substantial amounts of electricity, but they don't necessarily have the same ability to interrupt operations or substitute other sources of power. Any enforceable system must account for those differences without arbitrarily transferring obligations among customers.

For PJM, however, the practical consequence is that a proposed mechanism for accommodating additional demand while preserving emergency flexibility remains unresolved. The registry will provide better information about large loads, but information alone doesn't create capacity or establish when consumption can be reduced. The operator can identify a growing constraint without yet having an approved arrangement to manage every aspect of it. Meanwhile, projects continue moving through planning, financing and development, and the electricity system must prepare for the demand they may eventually create.

The Emergency Measures Are Drawing on the Same Resources That Provide Redundancy

The October emergency illustrates how the system's remaining flexibility can become increasingly important even when the immediate cause isn't the same as the longer-term capacity problem. Autumn is normally an opportunity for electricity generators to perform maintenance because demand is often lower than during the summer cooling season or winter heating season. Taking generating units offline during these periods allows operators to repair equipment, perform inspections and prepare for more demanding conditions. The practice is itself a reliability measure. Equipment that isn't maintained properly may become more likely to fail when it is needed most.

PJM's October 11 application identified unusually extensive generation outages during a period when electricity demand was expected to remain elevated. It also described transmission constraints affecting the movement of electricity between different parts of its territory and neighboring systems. Those constraints are important because electricity available somewhere in a regional network isn't necessarily deliverable wherever it is needed. Transmission lines have physical operating limits, and congestion can prevent generating resources in one area from compensating for shortages elsewhere. PJM also identified limitations involving neighboring systems, including the Midcontinent Independent System Operator, which had issued its own capacity advisory and conservative-operations notice.

Interconnection between regional grids is one of the electricity system's most important sources of redundancy. It allows operators to exchange electricity, share available resources and respond to localized shortages without requiring every region to maintain enough generating capacity to meet every conceivable circumstance independently. But that flexibility depends on conditions outside the affected operator's control. Neighboring systems must have electricity available to export, and the transmission infrastructure connecting them must have sufficient capacity to move it. If multiple regions experience elevated demand, maintenance outages or transmission restrictions at the same time, the amount of assistance available to any one system can become limited.

The Department of Energy's October 12 order provided PJM with additional options for managing those constraints. It authorized the dispatch of specified generating resources when necessary to preserve reliability and permitted the operator, under narrowly defined emergency conditions, to direct backup generation at large electricity-consuming facilities. The latter provision is especially consequential because it allows resources ordinarily maintained for private continuity to help reduce demand on the wider electricity system. A data center operating its own backup generators may continue supporting its equipment while drawing less electricity from the grid, leaving centrally supplied electricity available for other customers.

This is a useful arrangement, but it also exposes the limits of treating backup capacity as an uncomplicated solution. Backup generators require fuel, maintenance and equipment capable of operating safely. Batteries have finite storage capacity. Some facilities need their backup resources available for their own essential operations, and operating those resources may involve environmental restrictions or other practical constraints. The DOE order doesn't convert privately maintained backup equipment into permanent regional generating capacity. It authorizes a temporary response under specified conditions, including circumstances immediately preceding or during the most severe level of an energy emergency.

PJM's operating notices provide a more precise indication of what was happening on October 13. The operator had issued a Maximum Generation Emergency/Load Management Alert and instructed generators to provide information about how quickly they could return from planned outages. It also stated that certain resources identified under the DOE order were needed for the October 13 operating day, while clarifying that the order didn't automatically require those resources to operate at maximum output. That distinction prevents the emergency from being overstated. The authorization and the identified reliability need are documented; the eventual amount of additional generation actually dispatched, and the effect on operating reserves, require subsequent operating records.

The October order also follows earlier emergency authorizations involving PJM during 2026. Repeated authorization doesn't establish that the system is approaching collapse. Emergency procedures exist precisely because unexpected or difficult conditions arise, and their successful use can prevent much more serious consequences. But recurrence changes the questions worth asking. If the operator increasingly needs extraordinary measures during periods that were previously suitable for routine maintenance, those measures may be compensating for a reduction in ordinary operating flexibility. If maintenance must repeatedly be postponed or recalled, the system may also be exchanging flexibility in one period for additional equipment and scheduling pressure in another.

The available evidence doesn't yet establish that this exchange is producing a measurable deterioration in equipment reliability. It does establish that PJM is relying on several compensatory arrangements simultaneously: returning generators from maintenance, obtaining emergency operating authority, managing transmission constraints and preserving the option to reduce large customers' dependence on grid-supplied electricity. Each arrangement can work as intended while the underlying conditions remain unresolved. The important measure isn't simply whether customers retain service during the emergency, but whether the system can restore its ordinary operating margins afterward without requiring the same interventions again.

New Power Generation Won't Arrive Until 2028

Private investment is beginning to address some of the capacity constraints, including through agreements that connect major technology companies directly with electricity producers. On October 6, Google and Constellation announced a long-term agreement involving more than $4.3 billion in upgrades to existing nuclear generating facilities across PJM's territory. The upgrades are expected to add approximately 890 megawatts of generating capacity, with the first additions scheduled for 2028. A separate agreement covers 2,700 megawatts of existing electricity supply. The distinction matters because extending commercial support for existing generation isn't the same as creating new capacity, although retaining dependable resources can be valuable when the system is already facing a shortage.

The agreement demonstrates that large electricity customers can contribute to the infrastructure required to serve their demand. Long-term purchasing commitments can provide generating companies with the financial certainty needed to justify upgrades that might otherwise be difficult to finance. Improving the output of existing nuclear facilities may also avoid some of the permitting and construction challenges associated with building entirely new power plants. Demand-response commitments can provide additional flexibility during emergencies. These are meaningful responses, particularly where investment produces additional dependable capacity rather than simply reallocating electricity already available to the system.

But the timing remains consequential. PJM is managing emergency conditions in October 2026, while its capacity auctions have identified shortfalls for future delivery years. The first additional generation under the Google-Constellation agreement isn't expected until 2028. The planned 890 megawatts also represent only a portion of the 6,831-megawatt shortfall identified in July, although those figures aren't directly interchangeable without accounting for capacity accreditation and the timing of delivery. Additional projects may close more of the gap, and some existing resources may remain available longer than previously anticipated. Those possibilities should be included in the assessment. They don't change the fact that financial commitments and announced construction plans cannot supply electricity before the infrastructure becomes operational.

There is another dimension to this investment response. On October 13, the International Monetary Fund's Global Financial Stability Report identified growing financial exposure to artificial intelligence infrastructure. Hyperscale technology companies now account for approximately 10% of global investment-grade bond issuance, compared with less than 1% in 2024, according to the IMF findings reported that day. That doesn't establish that AI infrastructure investment is unsustainable. The companies involved include businesses with substantial revenues, existing assets and access to financing. But it does show that the expansion of AI infrastructure is becoming more important to corporate borrowing markets, while the IMF has identified the potential for weaker-than-expected returns or changes in investment expectations to affect broader financial conditions.

This creates a relationship between two systems operating on different timelines. Electricity providers need long-term commitments to justify infrastructure investment, while technology companies need reliable electricity to support their planned facilities. Financing arrangements can help both parties proceed, but the resulting commitments may remain exposed to changes in construction costs, interest rates, electricity availability and expected demand. A delay in transmission infrastructure can affect when a data center becomes operational. A change in the data center's development schedule can affect the anticipated demand supporting an electricity investment. Changes in financing conditions can influence both projects, even when the underlying need for additional electricity remains.

The allocation of those risks matters. Some contracts place substantial obligations on the companies purchasing electricity. Other projects may involve regulated utility investments, shared transmission infrastructure or costs recovered from broader groups of customers. It would be inaccurate to assume that private investment automatically transfers costs to the public, just as it would be inaccurate to assume that private financing eliminates public exposure. The relevant questions concern who is obligated to pay, what happens if projected demand doesn't materialize, and whether infrastructure built for concentrated private demand creates costs or benefits extending to other electricity users.

This is where the electricity problem begins interacting with a broader financial one. The same investment cycle generating additional electricity demand is also helping finance the infrastructure intended to satisfy that demand. If the cycle proceeds as anticipated, new generating capacity and transmission improvements may reduce pressure on the grid. If demand, financing or construction schedules diverge, the consequences could extend beyond individual technology projects. That is a conditional exposure, not an established failure. The IMF's findings make it more important to examine because the financial commitments involved are becoming large enough to matter outside the technology sector.

Emergency Measures Are Keeping the Grid Operational

The strongest evidence against an immediate reliability crisis is that PJM continues to have functioning mechanisms for managing difficult operating conditions. Its capacity auctions have attracted additional resources, even though they haven't met the full reliability requirement. Emergency procedures allow the operator to recall generating capacity, coordinate transmission and obtain additional operating authority. Federal regulators have approved the large-load registry, improving the information available for planning, while leaving open the possibility of a revised curtailment framework. Private investment is supporting generating upgrades and longer-term supply commitments. None of these developments should be discounted simply because the underlying problem remains unresolved.

The concern is that the mechanisms aren't interchangeable, and success in one doesn't necessarily repair a constraint in another. A backup generator can reduce demand on the regional grid during an emergency, but it doesn't automatically become a permanent source of accredited capacity. A transmission improvement can make existing electricity more deliverable without increasing the total amount generated. A long-term purchasing agreement can support new investment without ensuring that the resulting capacity will be operational during the next emergency. A regulatory decision can preserve appropriate legal authority while leaving an immediate planning problem unresolved.

PJM's recent experience therefore needs to be evaluated across several measures rather than through a single outcome. The capacity auction measures whether enough dependable resources have been committed for future years. Emergency operating notices show how the system responds when available resources become constrained. Regulatory proceedings determine which obligations can be imposed on different participants. Infrastructure investment indicates whether additional capacity is being developed, but its eventual contribution depends on completion and operation. Financial conditions influence whether the investment needed to close the gap remains viable.

Those measures are now interacting more visibly. The July auction identified a substantial future shortfall. PJM pursued additional procurement and a special arrangement for large loads. FERC rejected central elements of that arrangement in October, while an immediate operating emergency required separate federal authorization. At the same time, technology companies are making major electricity commitments, and international financial regulators are identifying growing exposure to the investment cycle supporting their expansion.

The evidence doesn't establish that these developments will produce widespread electricity shortages or a financial disruption. It establishes that several mechanisms responsible for maintaining reliability, accommodating growth and financing additional infrastructure are under pressure at the same time. Some are successfully absorbing that pressure. Others remain incomplete, delayed or subject to regulatory resolution.

The distinction between absorption and restored capacity is central to the assessment. PJM can successfully manage the October emergency without having resolved its 2028–2029 capacity shortfall. It can secure additional generation commitments without eliminating transmission constraints. It can obtain emergency authorization without establishing a permanent framework for managing large loads. Each successful response preserves service or creates additional options, but whether those responses collectively restore sufficient flexibility remains an open question.

The immediate evidence to examine will be the actual operating outcome of October 13–16, followed by the pace at which PJM resolves its procurement and large-load arrangements. A return to ordinary operating conditions, accompanied by increasing dependable supply and more manageable demand forecasts, would weaken the concern. Repeated reliance on emergency measures, persistent capacity shortfalls and growing dependence on resources that aren't yet operational would strengthen it.

For now, the electricity system is continuing to function through a combination of ordinary market arrangements, emergency authority, private investment and operational adjustments. The unresolved issue is whether those arrangements are creating enough additional capacity to accommodate the demands being placed on them, or whether an increasing share of their flexibility is being consumed simply maintaining the service they already provide.

What I’m watching now

The first test is the outcome of PJM's October 13–16 emergency period. Its subsequent operating records should show whether forecast demand and generation outages materialized, how close the system came to its reserve requirements, and whether additional generating resources or privately maintained backup systems were actually dispatched. An emergency order isn't evidence that every authorized intervention was used. The amount of intervention required, the operating margin remaining afterward and the speed with which normal maintenance schedules resume will provide a clearer measure of the system's condition.

The second is whether PJM can resolve the longer-term capacity problem through ordinary procurement and additional arrangements. Its next capacity auction, proposed reliability backstop and revised large-load rules will show whether the operator is securing enough dependable resources to meet projected demand. The relevant measure isn't simply the number of projects announced or the amount of capacity proposed, but how much accredited capacity becomes available within the delivery periods for which it is needed. Changes in demand forecasts also matter. Delayed or canceled data center projects, improved efficiency or reduced electricity requirements could materially improve the outlook without requiring every projected generating project to be completed.

I'm also watching whether transmission constraints and maintenance pressures become recurring features of operating emergencies. A grid can have substantial generation available overall while still struggling to deliver electricity to particular regions. If neighboring systems experience simultaneous shortages or transmission restrictions, the ability to compensate through imports becomes more limited. Repeated maintenance recalls would warrant attention as well, particularly if they begin affecting equipment availability during later periods of high demand. The October emergency provides a documented set of conditions against which future events can be compared.

Finally, the financing relationship between AI infrastructure and electricity development deserves closer examination. The IMF's findings establish that hyperscale investment is becoming a more significant component of corporate borrowing markets. The next indicators are changes in borrowing costs, capital expenditure commitments, project schedules and contractual arrangements between technology companies and electricity providers. A slowdown in AI investment wouldn't necessarily worsen grid reliability; reduced demand growth could relieve some pressure. But if generating investments have already been financed or costs allocated on the expectation of demand that subsequently changes, the consequences will depend on who carries those obligations. That possibility becomes more important as infrastructure investment and large-load development become increasingly dependent on one another.

Current Risk Assessment · October 13, 2026

Current assessment: Elevated and increasing pressure on electricity-system reliability and planning capacity within PJM. The operator faces a documented 6,831-megawatt shortfall against its 2028–2029 reliability requirement, unresolved regulatory arrangements for certain large electricity loads, and an immediate October operating emergency involving generation outages, elevated demand and transmission constraints. Existing compensatory mechanisms remain functional, but several are being relied upon simultaneously.

Expected if this assessment holds: Continued use of emergency operating measures during periods of constrained supply, additional procurement efforts to address future capacity shortages, and growing reliance on long-term private investment commitments. Reliability and cost pressures may persist where demand growth exceeds the pace of completed generating and transmission infrastructure. The severity of those pressures will depend on actual resource availability, demand growth and the effectiveness of operational responses.

Would weaken the assessment: Completion of the October emergency with adequate operating reserves and limited extraordinary dispatch; restoration of ordinary maintenance schedules; successful procurement of sufficient dependable capacity; approval of workable large-load management arrangements; improved transmission availability; and evidence that new generating resources or lower demand forecasts are closing the projected reliability gap.

Status: Elevated. Multiple mechanisms are absorbing stress, but the evidence doesn't yet establish that they are restoring sufficient capacity or operational flexibility to accommodate projected demand. The October emergency is an immediate test of operating resilience, while future capacity procurement and infrastructure completion will determine whether the longer-term imbalance is improving.

---

Sources

• PJM Interconnection — Capacity Auction Procures 138,318 MW of Generation Resources. July 14, 2026. Primary auction results documenting the 2028–2029 capacity shortfall and auction pricing.

• PJM Interconnection — Capacity Market. Updated 2026. Auction reports, capacity requirements and planning materials.

• PJM Interconnection — The Capacity Auction Is Coming. Here's What We're Doing Now. June 2026. PJM's explanation of capacity pricing, supply constraints and demand growth.

• Federal Energy Regulatory Commission — PJM filings and orders, Docket ER26-3515-000. October 9, 2026. Regulatory proceedings concerning the large-load registry and interim service proposal.

• Reuters — U.S. Panel Approves PJM's Registry of Data Centers, Rejects Plan to Curtail Power to Them. October 12, 2026. Reporting on the FERC decision and implications for large-load management.

• U.S. Department of Energy — PJM Emergency Order No. 202-26-50. October 12, 2026. Primary emergency order and supporting application for the October 13–16 operating period.

• PJM Interconnection — Emergency Procedures and Operating Notices. October 11–13, 2026. Primary operational alerts and notices concerning generation availability and emergency measures.

• U.S. Department of Energy — 2026 Emergency Orders. Updated October 2026. Record of emergency authorizations, including earlier PJM orders.

• Reuters — PJM Capacity Market Woes Spur Activity in Bilateral Power Deals. August 26, 2026. Reporting on alternative procurement, bilateral contracts and generating investment constraints.

• International Monetary Fund — Global Financial Stability Report. October 2026. Assessment of financial vulnerabilities, including growing exposure to AI infrastructure investment.

FHFA Budget Cut Would End Most Mortgage-Fraud Investigations

The Federal Housing Finance Agency in Washington, D.C. FHFA has reduced its inspector general’s fiscal 2027 budget to $20 million, which the watchdog says will require cutting 70 to 80 percent of its staff. (Photo by Ajay Suresh)

On September 29, the Federal Housing Finance Agency’s inspector general published three audits.

One found that FHFA’s security controls weren’t effective at protecting its network and systems against internal threats. Another found that the agency’s oversight of Fannie Mae and Freddie Mac’s multifamily credit-risk transfer programs was effective. The third found that FHFA’s Office of General Counsel was providing sufficient oversight of its suspended-counterparty program, although some controls weren’t documented in its operating procedures. A fourth audit published the previous day found that security controls for one of FHFA’s cloud systems weren’t fully effective.

On September 30, FHFA announced that it was reducing the Office of Inspector General’s fiscal 2027 budget to $20 million.

FHFA says the inspector general has become unusually large compared with other federal watchdogs. According to the agency, OIG requested funding equal to 16 percent of FHFA’s operating budget, while inspector general offices average about 2 percent of their agencies’ budgets across the federal government. OIG employees account for about 18 percent of FHFA’s workforce, compared with an average of about 4 percent at other agencies. FHFA adopted zero-based budgeting and says it couldn’t justify maintaining that difference.

The inspector general’s office says the $20 million allocation will require it to cut approximately 70 to 80 percent of its staff. Acting Principal Deputy Inspector General James Hodge told Congress that the Office of Investigations would discontinue essentially all of its criminal investigations, stop supporting ongoing investigations as soon as feasible and reduce its investigative staff to the minimum necessary to handle FHFA employee matters and operate its legally required hotline.

FHFA regulates Fannie Mae, Freddie Mac and the 11 Federal Home Loan Banks, which together provide more than $8.7 trillion in funding to U.S. mortgage markets and financial institutions. FHFA also remains the conservator of Fannie Mae and Freddie Mac. Its inspector general investigates mortgage, bank and other fraud involving the entities the agency regulates.

The office has maintained roughly 40 special agents in recent years, along with three Special Assistant U.S. Attorneys who prosecute mortgage fraud and related crimes. Hodge told Congress that its criminal enforcement work has produced more than 1,270 convictions and nearly $75 billion in monetary results since 2011.

During the six months ending March 31, 2026, OIG investigations produced 32 indictments or charges, 23 convictions or pleas, 25 sentencings and 54 suspended-counterparty referrals to FHFA. Court-ordered restitution, fines, forfeitures and other investigative results totaled about $87.7 million.

The office was still announcing criminal cases immediately before the budget cut. On September 29, it reported the extradition of a dual U.S.-Peruvian national accused in a $40 million bank-fraud and money-laundering scheme. Earlier that month, it announced a guilty plea in a real-estate fraud case and the sentencing of a defendant in a mortgage-fraud case.

At the same time, its auditors were continuing to find problems inside FHFA itself, including cybersecurity weaknesses that had remained unresolved from earlier reviews. Other audits found that FHFA was doing what it was supposed to be doing. The office losing most of its staff is doing both kinds of work now.

FHFA Says the Inspector General Costs Too Much

FHFA’s case for the reduction rests largely on comparisons with other federal inspector general offices. Its September 30 announcement points to both spending and headcount, comparing the OIG’s 16 percent share of the agency budget and 18 percent share of the workforce with federal averages of about 2 and 4 percent respectively.

OIG’s original fiscal 2027 request was $57.6 million. The administration’s budget request sent to Congress included $55 million. The $20 million allocation represents a reduction of more than 60 percent from both the inspector general’s request and its fiscal 2026 operating level.

FHFA is a relatively small federal agency, but the inspector general’s investigators don’t limit their work to misconduct by FHFA employees. Their jurisdiction follows FHFA into the housing-finance system it regulates. Fannie Mae, Freddie Mac and the Federal Home Loan Banks sit throughout that system, while FHFA’s conservatorship gives the agency additional authority over Fannie and Freddie.

That helps explain why comparing OIG staffing only with FHFA staffing produces such a large number. It doesn’t establish that the OIG needs its existing budget or that all of its current positions should be preserved. FHFA may be able to reduce spending without losing work that another office could perform.

We won’t have to infer whether the $20 million budget crosses that line. Hodge has already told Congress what his office expects to stop doing. Investigators would concentrate on FHFA personnel matters and the hotline, while essentially all external criminal investigations would end. Support for the Justice Department’s National Fraud Enforcement Division would also stop.

The budget dispute therefore reaches beyond how much an inspector general should cost. FHFA has decided that $20 million is enough to perform the office’s statutory mission. The inspector general says that at that level, most of the people who currently investigate fraud involving the housing-finance system won’t be there.

FHFA Still Has Cybersecurity Problems to Fix

The September 29 cybersecurity audit followed several years of findings about FHFA’s information systems.

In fiscal 2023, auditors found that 1,716 of 2,820 identified vulnerabilities hadn’t been fixed within the 14 days required by federal and agency policy. By fiscal 2025, FHFA was tracking overdue vulnerabilities quarterly but still didn’t have estimated completion dates for them.

Penetration testing showed what some of those weaknesses could allow. Auditors gained access to a privileged user account, elevated a standard account to domain administrator and took full control of FHFA’s network. The OIG reported 3,318 potentially exploitable vulnerabilities across agency servers, workstations and other devices, 64 percent of which it classified as critical. Another audit found problems with disaster-recovery planning, including backup data at an alternate site that wasn’t encrypted at rest and had no documented controls compensating for that weakness.

The findings published at the end of September continued that work. The September 28 audit found that selected security controls for FHFA’s eGRC cloud system weren’t fully effective. The following day, the OIG again found that FHFA’s controls weren’t effective at protecting its network and systems against internal threats.

Other programs held up better under the same kind of review. FHFA’s Division of Enterprise Regulation had designed and implemented effective oversight of Fannie Mae and Freddie Mac’s multifamily credit-risk transfer programs. The Office of General Counsel was providing sufficient oversight of the suspended-counterparty program, although auditors recommended documenting some controls that were missing from its operating procedures. Earlier this year, the OIG found that FHFA was effectively overseeing Fannie Mae’s multifamily lenders and loan-monitoring activities, with a narrower problem involving documentation of its sampling approach.

The office doesn’t stop working on a problem when an audit is published. Recommendations remain open until corrective action is completed, and the OIG publishes monthly lists of recommendations that haven’t been resolved. Its cybersecurity work has returned to weaknesses found in earlier years because some of them were still there.

FHFA remains responsible for fixing every one of those problems after the budget cut. Its technology staff can patch vulnerabilities, change procedures and strengthen controls without the inspector general doing it for them. What the OIG has been providing is an independent check on whether those repairs were completed and whether the controls worked afterward.

The fiscal 2027 budget doesn’t eliminate the inspector general, and the public information available so far doesn’t tell us exactly how many auditors will remain after the reduction in force. Hodge’s warning is much more specific about criminal investigations. A 70-to-80-percent staff reduction would reach far beyond the investigators, though, and the office’s publication record will make the effect on audits visible fairly quickly. FHFA-OIG has published nine audits or evaluations so far in 2026, including four between September 17 and September 29.

Other Agencies May Take Some of the Fraud Cases

FHFA-OIG’s criminal cases already involve other federal law-enforcement agencies. Its semiannual reports describe joint investigations, and prosecutions are handled through U.S. Attorneys’ Offices and other parts of the Justice Department. The FBI and other federal investigators will continue to have authority over financial crimes that fall within their jurisdictions.

What we don’t know yet is how many of FHFA-OIG’s cases they’ll take.

That should become measurable because Hodge said support for existing criminal investigations will end as soon as feasible. OIG leadership has told employees that staffing reductions will occur over the coming months and has begun preparing a reduction in force.

If another agency takes an open investigation and continues it, much of that work survives even though FHFA-OIG no longer performs it. If cases are closed, delayed or narrowed because no one else has the staff or specialization to take them, they don’t.

The same question applies before a case becomes a prosecution. During the six months ending in March, OIG investigators sent 54 suspended-counterparty referrals to FHFA. The suspended-counterparty program allows FHFA to restrict individuals or institutions from doing business with its regulated entities, and the inspector general’s September audit found that FHFA’s Office of General Counsel was providing sufficient oversight of the program.

FHFA can continue suspending counterparties after the investigative staff is cut. The investigators are one of the places the information comes from.

That distinction is likely to become more important than the raw number of prosecutions. The Justice Department can prosecute a fraud case that reaches it. FHFA can act on misconduct identified through supervision, regulated entities or law enforcement. The harder number to reconstruct later is how many cases never developed because the investigators who would have found or pursued them were gone.

There’s already an example of why that can be difficult to measure in FHFA’s multifamily mortgage market.

Fannie Mae identified multifamily mortgage fraud as an emerging risk after referrals increased substantially beginning in 2023. An OIG evaluation published in January found that Fannie had expanded its fraud controls and that FHFA continued monitoring the issue. Most of the referrals reviewed from the earlier period were ultimately closed with no fraud found, and Fannie reported no actual multifamily mortgage-fraud losses during the period examined.

Those closed referrals weren’t wasted information. They helped establish how much of the apparent problem was actually fraud and gave Fannie and FHFA evidence they could use to adjust their response. A decline in referrals after investigators disappear won’t tell us by itself whether misconduct declined or whether fewer possible cases were being found.

The Budget Cut Will Be Easier to Measure Than Its Consequences

The staff reduction should leave several records behind.

We’ll know approximately how many employees remain. We can count criminal investigations, indictments, convictions and suspended-counterparty referrals. We can see how many audits and evaluations the office publishes and whether it continues returning to unresolved recommendations. Congress can ask where existing cases went.

FHFA’s supervision will continue. Fannie Mae and Freddie Mac have their own fraud controls. Other federal investigators can take cases, and prosecutors can receive referrals from other sources. If those institutions take over most of the investigations FHFA-OIG can no longer handle, fewer cases will actually be lost. If they don’t, a decline in investigations or referrals won’t necessarily mean there’s less fraud. It may mean fewer people are looking for it.

There could be fewer referrals because regulated institutions improved their controls, or because one of the offices generating referrals has stopped looking for most external cases. Fewer unresolved audit recommendations could mean FHFA fixed its problems, but it could also reflect fewer audits producing recommendations in the first place.

That’s why the September audits are a useful baseline. Immediately before the budget reduction, the office was finding some FHFA programs effective, finding weaknesses in others, following older cybersecurity problems that hadn’t been fixed and producing criminal cases outside the agency.

The question over the next year is which of those activities continue somewhere else, which remain inside a much smaller OIG and which stop.

What I’m watching now

The first thing I’m watching is the reduction in force itself. The $20 million allocation has been announced, but the projected 70-to-80-percent staffing loss hasn’t happened yet. Congress could still change the funding available to the office, and OIG leadership has been seeking a legislative response.

The existing criminal caseload should give us the clearest early measure of what other agencies can absorb. I want to know how many open investigations are transferred to the FBI, Justice Department or another agency, how many joint investigations continue after FHFA-OIG withdraws and how many are closed. The number of new mortgage- and bank-fraud investigations opened after the staffing reduction will matter too.

Suspended-counterparty referrals provide another measure. OIG sent 54 to FHFA during the six months ending March 31. If that number falls sharply after the investigators are cut, the change will need to be read alongside fraud reports and enforcement activity elsewhere before it can tell us whether the underlying problem improved.

I’m also watching the audit calendar. FHFA-OIG published four audits between September 17 and September 29 and nine audits or evaluations during 2026 through the end of September. Its 2027 output will show how much of that work survives.

The unresolved cybersecurity findings give us something specific to follow. If FHFA completes the overdue remediation and later independent testing verifies that the controls work, the underlying problem has improved. If the recommendations remain open while independent testing becomes less frequent, we’ll have less information about whether the weaknesses were fixed.

Finally, I’m watching whether the reduction remains specific to FHFA-OIG. Right now, the evidence supports a major loss of investigative capacity at this office. Similar reductions across other federal watchdogs would be a different and broader development.

Current Risk Assessment · October 6, 2026

Current assessment: FHFA has reduced its inspector general’s fiscal 2027 budget to $20 million, and the official responsible for implementing that budget says it will require cutting 70 to 80 percent of the office’s staff and ending essentially all external criminal investigations. Those investigators currently work mortgage, bank and other fraud cases involving a housing-finance system in which FHFA’s regulated entities provide more than $8.7 trillion in funding. The office is also still auditing FHFA, including cybersecurity problems that have remained unresolved across multiple years. Other federal agencies can take some criminal cases, and FHFA retains its own supervisory and enforcement powers. We don’t yet know how much of the work will move elsewhere.

Expected if this assessment holds: FHFA-OIG will transfer or discontinue much of its existing criminal caseload, open substantially fewer external fraud investigations and send fewer investigative referrals to FHFA. Audit and evaluation work is also likely to decline if the projected staff reduction occurs, although we don’t yet know how large that decline will be. The effect should become visible through case transfers, new investigations, suspended-counterparty referrals, audit output and follow-up on unresolved recommendations.

Would weaken the assessment: Congress or FHFA restores enough funding to prevent most of the projected staff reduction; other agencies take over the existing criminal cases without a substantial loss of investigative work; FHFA-OIG continues publishing a significant number of audits and evaluations after the cuts; and outstanding cybersecurity problems are fixed and independently verified.

Status: Elevated — FHFA’s budget decision is expected to remove most of the investigators dedicated to fraud involving the housing-finance system while the office is still producing criminal cases, regulatory referrals and audits identifying unresolved problems inside FHFA.

---

Sources

Federal Housing Finance Agency, “To Be Good Financial Stewards, FHFA Inspector General’s Budget Will Match the Budgets of Peer Agencies,” September 30, 2026.

Federal Housing Finance Agency Office of Inspector General, “Audits and Evaluations,” accessed October 6, 2026.

Federal Housing Finance Agency Office of Inspector General, “Semiannual Report to the Congress — October 1, 2025 Through March 31, 2026,” 2026.

Federal Housing Finance Agency Office of Inspector General, “Fiscal Year 2026 Management and Performance Challenges,” 2025.

Reuters, “US housing agency internal watchdog warns budget cut will stymie its work,” October 1, 2026.

Federal News Network, “Pulte’s FHFA slashes mortgage fraud watchdog’s budget,” October 1, 2026.

FAA Outage Reveals Redundancy Failures

Aircraft at Newark Liberty International Airport. A September telecommunications failure at the FAA facility controlling Newark-area traffic became a regional disruption after the system's backup fiber path was also unavailable.

In July 2025, the FAA announced that it had completed a new fiber-optic communications network between New York and the Philadelphia facility responsible for Newark-area air traffic. Two months earlier, telecommunications failures had disrupted operations at the Philadelphia TRACON, where controllers handle aircraft arriving at and departing from Newark. The new network was part of the response. The FAA added three high-bandwidth telecommunications connections between New York and Philadelphia, deployed a temporary backup system, and began establishing a local STARS radar-data hub so Philadelphia would no longer depend entirely on radar information coming from New York. By July, the agency said the new fiber connections were running along two separate communications paths so that equipment could continue operating if one path was disrupted.

On September 21, 2026, a telecommunications circuit at the Philadelphia facility failed. The FAA attempted to move communications onto the second path, only to find that a construction crew in New Jersey had accidentally severed the fiber line. Incoming flights were halted at Newark, JFK, LaGuardia, Philadelphia and Boston, and the disruption spread as traffic was redirected through the system. More than 100 flights were diverted. By the FAA's later accounting, roughly 9,500 flights were delayed or canceled, and the telecommunications problem took about eight hours to resolve.

The scale of the disruption got most of the attention, but I'm more interested in the order in which things happened. The FAA had built a second communications path because it knew a failure on the first shouldn't be able to interrupt air traffic across the region. A failure occurred anyway, and the second path had already been lost to an unrelated event.

A fiber line being cut is ordinary enough. So is a telecommunications circuit failing. Put them together in this order, though, and something happening to a fiber line in New Jersey can stop arrivals hundreds of miles away.

The FAA Had Already Added a Backup Route

Had the second communications path been available, most of us probably would've never known the first circuit had failed. One route would've taken over while the other was repaired, and flights would've continued moving.

From the outside, a system in that condition can look unchanged. Inside it, the situation is different. Before the circuit failed, two routes were available. Afterward, one route would've been carrying the work previously distributed across an arrangement that included both. The flights can look the same either way.

We see this elsewhere when electrical grids call demand-response resources or keep generation available that otherwise wouldn't be needed. Hospitals move patients when they run short of beds. Supply chains reroute goods around ports or transportation problems. Government agencies move work elsewhere when an office loses staff.

These responses are supposed to make problems disappear from ordinary life. That's why they exist. It also means the absence of a visible disruption doesn't tell us how much had to happen underneath it to keep things looking normal.

The FAA's response to the Newark problems in 2025 followed the same pattern. The agency wasn't waiting for the next outage. It was adding connections, moving to fiber, building a local radar-data hub and using a temporary backup while the work was underway. It also said that when staffing or equipment problems reduced what controllers could safely handle, it would slow the rate of arrivals into Newark.

By September 2026, the FAA had encountered a problem that the second communications route couldn't take over because the route itself was unavailable, leaving the agency to reduce the number of aircraft entering the affected airspace until controllers had what they needed to handle them safely.

When the second communications route was unavailable, the FAA had to respond outside the telecommunications network by reducing the number of aircraft moving through the affected airspace.

The FAA Is Still Replacing Its Aging Communications Network

The September outage occurred in the middle of a much larger FAA modernization effort. Administrator Bryan Bedford told Congress this month that the National Airspace System is still operating with obsolete technology even as the agency replaces it. As of September 1, the FAA had replaced more than 64 percent of its copper-based Time-Division Multiplexing telecommunications infrastructure with modern equipment and converted more than 400 radio sites. Congress has already provided $12.5 billion for the broader modernization effort.

After the September 21 outage, Transportation Secretary Sean Duffy said the replacement network is supposed to eliminate single and dual points of failure by providing multiple telecommunications routes into FAA facilities. The estimated cost of the telecommunications work has risen to $5.91 billion, and Bedford said the remaining outdated copper telecommunications wiring should be replaced by September 2027.

The FAA is already responding to the weaknesses exposed by the 2025 failures. The difficulty is that recognizing a problem and finishing the work required to fix it happen on very different timelines.

The National Airspace System can't be taken offline while its communications network is replaced. The FAA provides air-traffic services for more than 44,000 flights carrying roughly three million passengers every day, so old equipment has to keep working while new equipment is installed around it. Copper is still carrying traffic while fiber replaces it. Temporary systems have to cover gaps while permanent systems are installed. New equipment has to communicate with parts of the network that haven't been replaced yet.

That leaves a period in which the FAA can know exactly what needs to be repaired, be actively repairing it, and still remain dependent on some of the same equipment and connections that made the repair necessary in the first place.

The September outage happened during that period, when one telecommunications circuit failed while a separate fiber line had already been cut during construction work. There's no indication that one failure caused the other. Their connection was created by the system itself because the fiber line became consequential once the first circuit was gone.

A second route only protects the first route when it's still there at the moment the first one fails. That sounds obvious, but I think it gets lost when redundancy is treated as something a system either has or doesn't have. Its condition can change before anything visible happens.

A New GAO Report Identified Other Communications Vulnerabilities

On the same day as the outage, the Government Accountability Office released a report examining a different set of problems in aviation communications.

GAO looked at electromagnetic-spectrum threats including spoofing and jamming. The FAA has identified those threats, but GAO found that the agency hasn't completed all of the risk and mitigation assessments and updated security documentation needed to address them. The FAA also lacks defined real-time monitoring and detection for every spectrum-related threat GAO examined. In some cases, the agency can investigate an incident only after someone reports it.

GAO made nine recommendations covering risk assessments, monitoring and detection, coordination with other organizations, authentication and protection of aviation communications. The Department of Transportation agreed with all nine, and they remain open.

Nothing in the available evidence connects those findings to the September 21 outage. The fiber damage was reported as accidental construction damage. The GAO report is useful here for what it shows about the communications system around the fiber itself.

For a controller to communicate safely with an aircraft, the FAA has to know where the aircraft is, the controller has to be able to reach it, the information moving between them has to be accurate, and the equipment carrying that information has to work. The FAA also has to be able to recognize when one of those things has changed.

Adding another fiber route protects one part of that chain. It doesn't protect all of it. Another route won't tell the FAA that information has been spoofed, just as better authentication won't restore a cable that's been severed. A second facility also provides less protection if it depends on something that can be lost along with the first one.

Two systems can look independent on paper and still share something underneath them that makes them vulnerable at the same time.

The FAA happened to begin limited use of another new system on September 21. SMART brings roughly 200 data streams into one place, including weather, flight paths, traffic flow and controller staffing. It's intended to help FAA personnel see problems developing earlier and make decisions about traffic before congestion or weather produces larger disruptions.

SMART can give the FAA more information about what's happening across the airspace. The fiber outage gives us an unusually clear example of what information alone can't solve. Officials can know exactly where traffic is accumulating and exactly where they'd like aircraft to go while still lacking the communications route required to move the information controllers need.

The FAA is replacing the network carrying information at the same time it's improving the information available to the people managing traffic. It's also replacing old equipment and trying to close the security gaps GAO identified. Those projects overlap, but they don't solve the same problem, and progress in one doesn't necessarily tell us much about the condition of another.

The FAA Prevented a Safety Crisis by Reducing Air Traffic

When the telecommunications system couldn't support normal operations on September 21, the FAA reduced the amount of traffic controllers had to handle. Arrivals were halted or restricted, aircraft were held on the ground and more than 100 flights were diverted while the telecommunications lines were repaired.

Thousands of passengers experienced delays or cancellations, aircraft were diverted, crews and airlines had to adjust, and other airports received traffic they otherwise wouldn't have handled. Boston was affected even though the telecommunications failure wasn't there because the disruption altered traffic across the Northeast.

This is one reason I've become increasingly wary of describing large systems as either working or failing. The telecommunications network couldn't preserve normal service, while the air-traffic system could still preserve safe service by accepting fewer flights. What failed in one place was accommodated somewhere else, and the cost changed form as it moved.

The FAA reduced traffic until the communications lines could be repaired, shifting the immediate consequences into delays, cancellations and diversions while keeping the affected airspace operating safely.

As the new telecommunications network comes online, I'd expect more of these failures to be handled before they ever reach flight operations. A circuit fails, another route takes over, the first gets repaired and passengers never know it happened. If relatively ordinary technical problems continue making it through the backup systems and forcing the FAA to restrict traffic across several major airports, then we know those backups still aren't containing enough of the problem before it reaches everything connected to them.

What I’m watching now

The investigation into the New Jersey fiber cut should tell us more about how separate the communications routes really were. The FAA's July 2025 announcement described two separate paths intended to keep equipment operating if one was disrupted. I want to know how those routes were physically laid out, what could disable each one and what protection existed around a line that became critical as soon as another circuit failed.

I'm also watching what the FAA says about the temporary backup deployed after the 2025 Newark failures. The agency described it as providing redundancy during the move to the new fiber network, but the public information available so far doesn't establish what it could've carried under the conditions that developed on September 21. Until we know that, I don't think we can say whether another backup was present and unable to do the job, had already been removed from the relevant configuration, or was never intended to cover this particular failure.

More than 64 percent of the FAA's old copper-based TDM telecommunications network had been replaced as of September 1, and Bedford says the remaining outdated copper should be gone by September 2027. The plans described after this outage go further than replacing copper with fiber and call for multiple routes into facilities so that losing one or two doesn't recreate what happened this week.

We should eventually be able to see whether that worked by how uneventful future failures become. If a circuit fails, another independent route takes over and flights continue while the damaged line is repaired, the new network is doing what the FAA says it's being built to do.

The GAO report gives us another set of things we can follow without trying to infer them from outages. All nine recommendations remain open. We can watch whether the FAA completes the missing risk assessments, improves real-time detection of spectrum threats and strengthens authentication and data protection for aviation communications. Those changes would address problems the fiber replacement can't.

Another useful measure will be how often technical problems require the FAA to reduce traffic across multiple airports. Ground stops and traffic restrictions are supposed to protect safety, so their use alone doesn't tell us very much. The more useful question is what keeps requiring them. If relatively ordinary equipment and telecommunications problems repeatedly get past the technical backups and have to be dealt with by moving or stopping flights, then more of the system is depending on that last layer of response than the visible operation of the network would suggest.

Current Risk Assessment · September 25, 2026

Current assessment: The September Northeast aviation outage adds another case in which the existence of a backup tells us less than whether that backup remains available when the original system actually needs it. The FAA had already added separate communications paths after the 2025 Newark failures, but a telecommunications circuit failed after another fiber route had been severed, leaving the agency to reduce traffic across multiple airports while the lines were repaired. The FAA is already replacing the older network, and its response kept aircraft operating safely. The open question is how often problems can still get through the telecommunications backups and reach flight operations while that replacement continues.

Expected if this assessment holds: Individual equipment and telecommunications failures will usually be handled without creating a safety problem, but some will still produce large disruptions when another route or system is already unavailable. As more of the new network comes online, those events should become less common and more failures should be handled without large ground stops, diversions or cancellations.

Would weaken the assessment: Future telecommunications failures move onto independent backup routes without major traffic restrictions; the investigation identifies a specific problem behind the September outage that's subsequently corrected; multiple routes remain available when failures overlap; and the separate communications problems identified by GAO are addressed.

Status: ELEVATED — the FAA is replacing the network, but the September outage showed that two separate telecommunications problems can still reach flight operations before that work is complete.

---

Sources

Federal Aviation Administration, “Secretary Duffy Announces Completion of Another Major Milestone for Operations at Newark Liberty Airport,” July 3, 2025.

Federal Aviation Administration, “FAA Statements on Newark Liberty International Airport,” 2025.

Federal Aviation Administration, “Testimony of Bryan Bedford, FAA Administrator,” September 2026.

U.S. Government Accountability Office, “Aviation Cybersecurity: Enhanced Air Safety Requires FAA to Better Mitigate Threats to Aircraft Communications,” September 21, 2026.

Federal Aviation Administration, “Trump’s Transportation Secretary Sean P. Duffy Delivers State-of-the-Art Air Traffic Control,” September 21, 2026.

Reuters, “Thousands of US flights snarled before FAA resolves telecom problem,” September 21, 2026.

Reuters, “Airport operations in US Northeast resume after telecom lines repaired,” September 21, 2026.

Reuters, “US says new air traffic control system will not suffer disruptions,” September 22, 2026.