Critical Infrastructure and Blackouts: How Municipalities and Operators Can Become More Resilient

Prof. Dr. Michèle Knodt, professor at TU Darmstadt and, among other roles, director of Digital Resilience Xchange (DiReX)

© Michèle Knodt

GIT SECURITY International: Prof. Dr. Knodt, where do you currently see the greatest vulnerabilities in Germany when it comes to the security of critical infrastructure?

Michèle Knodt: The recent attacks on substations show that we are not yet sufficiently prepared for targeted attacks against our critical infrastructure. For a long time, our preparedness was based on the assumption that if one facility failed, a second, redundant structure would take over. However, we must also anticipate perpetrators who specifically target such redundancies. Many security concepts are not yet designed to cope with this criminal activity. That is why we need a stronger focus on resilience and, in particular, on the rapid restoration of service.

What role does your center play in researching and solving the related issues?

Michèle Knodt: DiReX translates research from the LOEWE emergenCITY Center into practical applications. To this end, we work closely with local governments, aid organizations, critical infrastructure operators, and companies. They know what difficulties arise on the ground during a crisis and what a solution must be able to accomplish in everyday life. This experience informs the further development and testing of our approaches. This also involves questions of responsibility and collaboration: Who operates a solution, who provides information, and how does it reach people? One example is the Litfaßsäule 4.0, developed at emergenCITY and further refined by DiReX. It can continue to inform the public in public spaces even when electricity, cell service, and the internet are down. Photovoltaic panels and a methanol fuel cell supply it with power for up to 72 hours in the event of a power outage. The fire department can control it directly via their radio and display warnings on the LED screens—even if cellular networks and the internet are down.

Let’s consider the scenario of a widespread power outage. Are Germany, its municipalities, and businesses prepared for prolonged blackouts? In your view, what is already working and what isn’t?

Michèle Knodt: The power supply in Germany is very reliable. However, we are only partially prepared for an outage lasting several days. There are emergency plans, emergency power supplies for critical facilities, and plans for public assembly points. But emergency power requires fuel and personnel. If cell service and the internet go down at the same time, local governments must be able to inform the public through other channels and coordinate their emergency response teams. Businesses need to know how long they can remain operational without electricity and digital systems. These interdependencies are still too rarely practiced together. We need to focus our preparations more strongly on this.

You emphasize that complete protection of KRITIS is not feasible—but that we must strive for resilience. What is your approach here? What might that look like, for example, for a hospital operator or an energy provider?

Michèle Knodt: Following the attack on the Berlin cable bridge in early 2026 and the recent attacks on substations, we often hear the same suggestions: publish less grid data, build higher fences, install more cameras. Such measures can be useful, but they have their limits when it comes to targeted attacks. In many places, power lines and substations are already visible on the ground. Furthermore, a fence does not protect the airspace above a facility, and a camera can record an attack but cannot prevent it on its own. With nearly two million kilometers of power lines and thousands of substations, complete protection is impossible. In this context, resilience means above all restoring the power supply as quickly as possible after an attack. Three things are crucial for this: repair teams that are immediately ready for deployment, stockpiled spare parts, and more standardized components so that damaged parts can be replaced quickly.

Now, increasing digitalization in particular can quickly become a security risk. And disruptions in various areas can reinforce one another all the more. Regulatory adjustments have also been made in this regard. How do you view the situation—and what still needs to be done here?

Michèle Knodt: With NIS-2 and the KRITIS umbrella law, we have an important legal framework. However, the umbrella law must now be supported by regulations and concrete guidelines for operators. In doing so, we must not focus solely on the security of individual facilities. For me, the central problem lies between the infrastructures: Each operator can analyze its own risks and take precautions. But that doesn’t address what happens when power, communications, and water supply are all disrupted at the same time. Digitalization amplifies precisely these interdependencies. That’s why we need to think beyond individual operators: Who will recognize an impending chain reaction? Who consolidates the information into a shared situational picture? And when resources are scarce, who decides which service is restored first? To address this, operators, municipalities, and government agencies need binding procedures and joint exercises. Resilience does not come from everyone having a good plan on their own, but from these plans fitting together in the event of a crisis.

Given the possibility that cellular networks, the internet, and digital warning systems could all fail simultaneously, do we need to focus more heavily on analog and decentralized communication channels again?

Michèle Knodt: Yes, because the various warning channels are not completely independent of one another. With cell broadcast, warning apps, sirens, and radio broadcasts, we have a broad mix of warning methods today. However, if power and communication networks fail, multiple channels can be affected at the same time. A centrally triggered alert must actually reach people on the ground. Sirens draw attention to a danger. People need to learn through other means where to find help and what they should do. Local governments therefore need ways to disseminate information even during a prolonged crisis: through local contact points, loudspeaker vehicles, battery-powered radios, and public information points. The energy-self-sufficient Litfaß column 4.0 is one example of this. At the same time, emergency responders, government agencies, and service providers must be able to continue communicating with one another. We are therefore researching how radio, satellite connections, and drones can temporarily provide a dedicated communication network when the usual networks fail.

Prof. Knodt, today we are dealing with hybrid threat scenarios for KRITIS. How are operators’ responsibilities changing in this regard? Are we on the right track with the KRITIS umbrella law, for example?

Michèle Knodt: Hybrid attacks can combine physical sabotage, cyberattacks, and disinformation. Operators must therefore detect incidents early, exchange information with authorities, and maintain or restore service even under difficult conditions. The KRITIS umbrella law is an important step in this direction, but it still needs to be fleshed out. Drones illustrate this open question particularly clearly: To detect drones, data from various sensors must be integrated. This often leaves only a few minutes for assessment and then for action, while the state police cannot be on site at every facility. One possibility would be to delegate certain defensive powers to qualified operators under clear legal conditions—a so-called delegation of authority. The KRITIS umbrella law does not specify who is authorized to act in an emergency.

You also head the Hessian Drone Competence Center—and drones can be either the threat itself or the means of detecting such threats. What exactly are the center’s responsibilities?

Michèle Knodt: The center combines four areas: research and knowledge transfer, testing under real-world conditions at Kassel Airport, training for professional use, and collaboration with companies, government agencies, and KRITIS operators. In doing so, we focus on both the safe use of drones and their detection and defense.

In Ukraine, the development of and experience with drones are key tools for defending against Russia’s war of aggression. Overall, development is advancing rapidly—across procurement and innovation cycles. How can Germany more quickly develop operational security solutions?

Michèle Knodt: That is precisely the overarching goal of the Hessian Drone Competence Center: We want to create an innovation ecosystem that keeps pace with the rapid development of drone technology. A solution that is operational today may already face new drone types or different control methods tomorrow. That is why research institutions, companies, security agencies, and operators must collaborate on an ongoing basis: They contribute their experience, test new approaches, and rapidly refine them. At Kassel Airport, we can test technologies under real-world conditions while simultaneously involving future users at an early stage. They show us what they need in the field and where a solution reaches its limits. These insights are immediately incorporated into the next round of development and into the training of those who work with the technology. This creates a continuous path from research through testing to operational deployment.

How do you view the increasingly pressing issue of jamming or shooting down drones?

Michèle Knodt: Jamming and shooting down drones are often brought into the discussion from the context of military drone defense. For the protection of civilian critical infrastructure, I do not consider either to be a general solution. Jamming can also interfere with other radio and navigation systems and is only usable to a limited extent. With autonomously flying drones, it may not work at all. When it comes to shooting down a drone, we must consider where the drone and any debris or dangerous payload will land. Over a populated area or an operational facility, such a defense measure could itself cause significant damage. For such locations, net-capture drones seem much more promising. They can specifically capture a drone and, in the best-case scenario, remove it from the danger zone in a controlled manner. However, this only works if the drone is detected in time, the system can intervene quickly enough, and the location is suitable for such an operation.

If you could look five or ten years into the future: How would security and crisis preparedness in Germany need to have improved by then?

Michèle Knodt: A resilient society is prepared for major disruptions and remains capable of taking action in the event of a crisis. Operators, local governments, and security agencies know how to work together, inform the public, and quickly restore services. At the same time, we must be able to test and deploy new security solutions more quickly in order to keep pace with threats such as drones. It is crucial that a major disruption does not turn into a prolonged supply crisis.