The week the phones died: cyber chief’s storm experience becomes a national resilience test.
Kurtis Toy, Chief Executive of the Cyber Centre of Excellence, publishes Analogue 72 – a Green Paper arguing that Britain plans emergencies from the top down, while the resilience people actually rely on is built from the bottom up.
When Storm Arwen tore through Scotland in November 2021, Kurtis Toy was not
reading about it in a briefing. He was living in it: a cyber security professional in a
remote community, without power, without a working phone network, and with no way to find out what was happening or when services would resume. It was, he says, the moment the question changed. He had spent his career assessing how organisations could be attacked and that became a focus when he founded Onca Technologies Ltd back in 2016. That week he experienced what happens after the systems stop – not to an organisation, but to the people who depend on it. The following year he joined up with IESE to help found what became the Cyber Centre of Excellence (CCoE) for Local Government. Today, as its Chief Executive, he sets out what he has built from that experience: Analogue 72 (A72), a recurring national diagnostic that tests what households, communities, councils and essential operators can still do during 72 hours of severe digital disruption.
What Arwen actually did
Aberdeenshire Council’s own published account of Storm Arwen records the scale of it. Around 60,000 homes lost power in the first 48 hours. The network suffered some 200 separate faults – the equivalent of two years’ worth in a single night. Around 8,000 homes were still without electricity a further seven days later. And, critically, the loss of power took down digital and mobile telephony across several rural areas, Aberdeen went back to Analogue.
That final detail is the foundation of the A72 Green Paper. The outage removed the
very channels through which the response would ordinarily have been coordinated
and through which residents would ordinarily have been informed. Nobody attacked anything. The weather produced, in the north-east of Scotland, precisely the conditions A72 is designed to test. The Green Paper’s point is that Britain already knows what this looks like. It has simply never treated the experience as a diagnostic – never asked, systematically, what worked, what people did for themselves, and what the law and the systems around them allowed.
The storm came first, then the measurement
The sequence matters. Arwen came in November 2021. The CCoE was founded in late 2022. The first passive scan of UK local authorities followed in 2023, and this year’s was the fourth annual cycle. The lived experience of a multi-day outage preceded both the organisation and the measurement programme, and shaped what they were built to look for.
The passive scan assesses externally visible vulnerabilities without touching internal systems, awarding each authority a health score from 5 (strong outward-facing cyber health) to 1 (significant improvements required). The most recent cycle, reported in July 2026, found some councils more vulnerable to cyberattack than a year earlier, but many more had improved.
The scans answer one question and raise another. They show where an authority is
exposed but they cannot show what happens to residents when exposure becomes
disruption – which is the question Arwen had already put to him personally. Four
cycles of data have shown rising awareness, uneven remediation, and essential services growing more digitally dependent each year.
The Green Paper is the product of that shift in question, refined through eighteen
months of consultation with local-government officers, emergency planners, resilience practitioners, essential-service operators, security specialists and voluntary and community organisations.
The threat horizon is no longer hypothetical
Between autumn 2025 and summer 2026, the Green Paper argues, the A72 premise stopped being a scenario and became an expectation:
- In July 2026 a small UK power plant was taken offline for four days after a cyber attack reported as linked to the Iranian regime. Ministers confirmed a cyber incident affecting a small-scale generator and said there was no risk to the wider energy system. The generator reportedly fell below the size threshold at which cyber activity must be notified to government – meaning local responders would have had almost no consequence information to work from.
- The National Cyber Security Centre managed more than 200 incidents affecting UK critical national infrastructure and its supporting ecosystem in the year to May 2026, around three-quarters assessed as linked to hostile state actors. The NCSC has named Russia, China and Iran as increasingly targeting the systems underpinning essential services, and judges it highly likely that by 2028 AI-enabled tools will be used to exploit known vulnerabilities in legacy technology across critical infrastructure.
- Wildfire pressure has risen across the UK. In England and Wales the summer of 2026 passed the previous annual record of 1,017 fires, with services reporting multiple major incidents inside single 24-hour periods, homes destroyed and hundreds of people evacuated. Scotland recorded its most severe wildfire season on record in 2025 – more than 230 wildfires and over 100 days of firefighting – prompting a Scottish Government Strategic Action Plan on Wildfires in March 2026; in August 2026 the Cairngorms fire near Nethy Bridge became one of the most resource intensive wildfire incidents in recent years, in a rural area served by an on-call service with significant unfilled posts.
- Autumn and December 2025 produced near-simultaneous flooding across England and Wales, with saturated catchments and towns such as Monmouth reporting their worst flooding since the 1970s.
Neither the fires nor the floods were cyber events. Both consumed exactly the local capacity a digital-disruption response would depend on — staff, fuel, vehicles, welfare provision, public information. The Green Paper’s conclusion is that the realistic planning expectation is not one catastrophic event but compound disruption, hostile and accidental and climatic, arriving in communities that are more digitally dependent every year.
The gap: top-down response, bottom-up resilience
UK resilience planning is organised largely from the top down — around categories of responder, statutory duties, command structures, mutual aid and the preservation of a minimum viable level of public service delivery. In the fires, floods and outages of the past year that architecture broadly worked as designed.
Digital resilience works the other way round. Whether a person can obtain safe water, verified information, medicines, cash or help in the first 72 hours depends on what exists within physical reach: a neighbour, a hub, a noticeboard, a pharmacy, a local radio signal, a paper list, someone who knows which household depends on powered medical equipment. None of that can be commanded into existence during an incident. It either exists beforehand, or it does not.
Covid-19, the Green Paper argues, demonstrated both halves. The formal response
was directed nationally, but much of what reached people was organised locally and at speed – mutual aid, food and medicine distribution, welfare checks on isolated neighbours, informal information networks — often faster than formal structures could direct, and often ahead of them. Communities were not passive recipients of a minimal service. They were active responders whose capability the state discovered rather than designed.
The gap A72 exists to fill sits between those two halves: between top-down emergency service response planning, which is well developed, and bottom-up digital resilience building, which is largely untested. It is not a gap in awareness or doctrine but in evidence and connection. Nobody has systematically tested whether the community capability Covid-19 revealed can be located, resourced, safeguarded and lawfully connected to formal structures under conditions of digital denial.
What A72 proposes
- A two-part diagnostic. Part I tests households, household-equivalent settings such as care homes and boarding schools, communities and local authorities. Part II tests regional, devolved and UK-state coordination. Essential operators cut across both.
- A needs-led starting point. The first question is not who attacked what, but what each person must still be able to obtain, know, do or rely upon — and who can lawfully provide it without working digital channels.
- Named local ownership. Every participating authority identifies its A72 lead and deputy, the authority under which they act, where they would physically work without digital access, and how they hand off to regional arrangements.
- Minimum viable functions as a floor, not an ambition — covering public direction, life safety, health and medicines, water, food, warmth, payments, lawful governance, information integrity, operator coordination, public confidence and reconciliation.
- Physical information as a minimum viable function in its own right, because a national message has no effect if a person cannot physically obtain or trust it.
- Maturity scoring and an improvement cycle measured in “Analogue X” — the hours removed from ungoverned analogue time for each essential function, tested and retested rather than assessed once.
Quotes
“I have spent my career telling organisations how they could be attacked. During
Arwen I found out what it is like to be on the other side of it — no power, no phone signal, no way of knowing anything. What struck me was not that the response failed. It was that the people around me were organising long before anybody official could reach us. That is the capability nobody is measuring.”
“Our planning asks how the state keeps a minimum service running. Covid showed that communities do far more than that when they are trusted, informed and connected. A72 asks a harder question: could they do it in the dark, and would the law and the systems around them let them? We do not know, because nobody has tested it. That is what this Green Paper is for.”
Kurtis Toy
An invitation, not a conclusion
The Green Paper is explicitly provisional. The CCoE invites public bodies, essential
operators, regulators, researchers and community organisations to challenge its
framework, submit benchmarks and evidence, identify relevant precedents the author may have missed, and volunteer as pilot areas. The Green Paper states that to the best of the author’s knowledge no UK-wide exercise has previously combined these elements in this way – and describes that as a claim it wants tested.
Consultation responses should be sent to [email protected].
