What remains unknown about the massive blackout in Spain

The Iberian Peninsula experienced a massive and historic blackout on Monday, which left the mainland territories of Spain and Portugal without electricity for hours. “In my more than 40 years in this sector, I have never seen anything like this,” said Jorge Fabra, who for a decade president of Red Eléctrica, the public company that operates the national electricity grid in Spain. In the afternoon, electricity was beginning to be restored in some parts of the country. However, the main question that remains is what exactly happened. “We do not rule out any hypothesis,” said Pedro Sánchez, the country’s prime minister, at a press conference at around 6 p.m. local time “We do not know the causes,” he insisted, thus further increasing the uncertainty surrounding the historic energy collapse.

Possibility of a cyberattack

Judge José Luis Calama of the Audiencia Nacional, Spain’s central criminal court, said on Tuesday he is opening an investigation into whether the power outage “could have been an act of cyber-sabotage against Spanish critical infrastructure.” According to the court, in that case, it would fit within the parameters of a terrorist crime, which the Audiencia has jurisdiction over.

Since the massive blackout occurred, it has been speculated that it could have been caused by a cyberattack. The first to assert this most firmly was the premier of Andalusia, Juan Manuel Moreno, who stated that, according to information from the regional cybersecurity center, “everything points to the fact that a blackout of this magnitude could only be due to a cyberattack.” Moreno, however, acknowledged that he had reached this conclusion without confirmation from La Moncloa or another institution. A couple of hours later, the Vice President of the European Commission, Teresa Ribera, stated in Brussels that, after being in contact with Spanish and Portuguese authorities, there were no “indications that [the blackout] was deliberately caused.”

The National Cryptology Center, which operates under the National Intelligence Center (CNI), has limited itself to saying that it is investigating the cyberattack hypothesis. Spain has become one of the countries most targeted by cyberattacks considered critical due to their severity, with several hundred each year. The Joint Cyber Command, which is under the Ministry of Defense, is also investigating the possible cyber origin of the blackout.

Would a cyberattack of this scale be possible?

The preparation and execution of a cyberattack that shuts down the electricity of almost two entire countries is very complex. It requires a coordinated operation that achieves several objectives simultaneously. “A blackout of this scale through a cyberattack would be complicated because there are many segmented electrical networks,” said Martín Vigo, a cybersecurity specialist. And once it happens, analyzing the networks to find the origin of the attack is not easy either. “Cyberattacks on electrical networks are possible both in theory and in practice because energy infrastructures are very complex systems, full of vulnerable points,” said Lukasz Olejnik, an expert from King’s College London. “An attack, for example, could target transformers or substations, causing damage to hardware until it starts to fail. But coordinating such a large and synchronized attack would be extremely difficult.”

So far in Spain, there is no indication that something like this has occurred. The only successful attacks of this scale took place in Ukraine in 2015 and 2016, with Russia being the culprit. “Other cases were simply demonstrations, failed attempts, or mere rumors,” said Olejnik. The official teams responsible for investigating whether there has truly been an attack have all the necessary tools to find out if it did happen: “Speculating now is not very useful: we simply don’t have enough data,” added the expert. “There is no ‘clear symptom’ that would allow us to say with certainty that a blackout like this is due to a cyberattack. Everything we’ve seen so far could also be explained by normal, non-malicious causes. That’s why it’s important to investigate and avoid falling into rumors or misinformation.”

The National Cybersecurity Institute (INCIBE) warned a year ago about the “significant increase in cyberattacks affecting industrial environments and critical systems.” The institution cited the malicious software BlackEnergy as an example, which was used by Russian hackers on December 23, 2015, to sabotage the electricity distributors in the Ukrainian region of Ivano-Frankivsk, causing a blackout that affected 1.5 million people.

The National Security Department (DSN) of the Prime Minister’s Office also warned in its latest report about the “increase in the number, frequency, sophistication, and severity of cyberattacks.” In 2023, the National Cryptologic Center managed about 108,000 incidents; INCIBE handled 83,500; and the Joint Cyber Command of the Ministry of Defense dealt with 1,480. The advisory body to the prime minister warned of the existence of “increasingly sophisticated attackers and growing interconnectivity, which broadens their potential range of action.”

Could it be caused by a meteorological phenomenon?

Various hypotheses have emerged about the cause of the blackout, some of which have been debunked.

Reuters reported that REN (Redes Energéticas Nacionais, the equivalent of Red Eléctrica in Spain) had suggested that a strange meteorological phenomenon in Spain could be the origin of the blackout. However, sources from this organization have denied that information, which pointed to a supposed temperature variation in the interior of Spain.

What about insufficient nuclear power?

Prime Minister Pedro Sánchez on Tuesday rejected the notion that the blackout was caused by a lack of sufficient nuclear power. Those who say so, said Sánchez, “are either lying or showing ignorance.” “If we had been more dependent on nuclear power, the recovery would not have been as fast as the one we are experiencing,” he said, pointing out that nuclear power plants have not yet fully recovered their activity. The five nuclear power plants in Spain have a combined installed capacity of 7.4 GW.

When did the power outage start?

At 12:32 p.m. local time, “a very strong fluctuation in power flows” was detected in the electrical grids. This fluctuation was due to a loss of generation, meaning a drop in electricity production, which in Spain comes mainly from nuclear plants, hydroelectric plants, combined cycles, and solar and wind farms.

This power loss was caused by the sudden disappearance of 15 GW of generation for five seconds. To understand the scale of the problem, the five nuclear power plants in Spain have a combined installed capacity of 7.4 GW.

The fluctuation caused by this drop, the causes of which are still being investigated, triggered the disconnection of the Spanish electrical system from the European grid, which relies on an interconnection with France. This disconnection “led to the collapse” of the system and the subsequent widespread blackout, according to Eduardo Prieto, Director of Operations Services at Red Eléctrica, in an initial press conference at 2:30 p.m. Later, at 7:00 p.m., Prieto reiterated this explanation and emphasized that this is an “absolutely exceptional event,” of a dimension never before seen in Spain.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition