The Threat You Can’t See.

Author: Ericson Tua’one, Chief Executive July 31, 2026 | Power, Resilience

National security depends on equipment most people never notice.

A pump delivering water. A radio carrying instructions. A control system keeping a critical facility running.

We cannot wait for those systems to stop before asking what protects them.

On May 10, 2024, NOAA reported G5, or extreme, geomagnetic storm conditions at Earth. Severe space weather had brought a familiar concern back into view: disturbances from the Sun can affect the power and communications systems we depend on.

The storm was not an attack. It was a reminder that essential infrastructure faces threats beyond the ones we can see approaching.

A deliberate electromagnetic attack presents a different problem. Nuclear-generated high-altitude electromagnetic pulse can produce fast effects that a solar geomagnetic disturbance does not. CISA’s guidance distinguishes these hazards. The protection must match the exposure.

For the person responsible for a critical facility, the question is direct: What must keep working, and what evidence supports that confidence?

We have received this warning before At 2:44 a.m. on March 13, 1989, Earth’s magnetic field was fluctuating violently. Hydro-Québec’s protective systems operated, and its grid collapsed in less than a minute.

The blackout lasted more than nine hours, according to Hydro-Québec’s account.

The disturbance had arrived from the Sun.

Hydro-Québec responded with changes to protective settings, real-time monitoring, operating procedures, and equipment. Its account credits those measures with reducing the impact of later magnetic storms.

That is the useful precedent: a failure investigated, weaknesses identified, and engineering applied.

Québec does not prove that every severe solar storm will collapse a grid. It shows why understanding the failure mechanism matters.

The national security concern is longstanding, too.

Congress established an EMP threat commission in legislation enacted in 2000 for fiscal year 2001. Its assignment included examining vulnerabilities, recovery capability, and the feasibility and cost of protecting selected military and civilian systems.

In 2019, Executive Order 13865 directed a coordinated federal approach to electromagnetic resilience. It explicitly recognized potential consequences for national security, economic prosperity, commerce, and stability.

We have had years to recognize the issue. Recognition alone does not protect a facility.

The generator starts. Now what? Picture a water facility during an outage.

The backup generator starts. The engine settles into a steady rumble. There is fuel in the tank.

Now look past the generator.

Can the operator read the tank level? Can the pumps be started safely? Are alarms reaching anyone outside the building? What happens if the control screen is unavailable?

This is a planning exercise, not an account of a particular incident.

It exposes a distinction: supplying electricity and sustaining the mission are not the same task.

CISA’s guidance addresses power, communications, controls, shielding, surge protection, spares, and operating continuity. Its protection levels reflect different tolerances for mission interruption.

I would start with the work the facility must perform.

Then follow every dependency needed to perform it: power, controls, communications, fuel, personnel, and outside services.

Only after that review would I compare protection packages.

A full equipment list is not evidence of a complete plan.

What sovereignty means here I think about sovereignty as the ability to make decisions and carry them out under pressure.

For a critical facility, that becomes practical.

Can the responsible people communicate? Can operators understand what their equipment is doing? Can essential work continue while outside services are disrupted?

The answer does not have to be unlimited independence.

It does need to be specific. Identify what must continue, what can stop, and how long the facility can tolerate each interruption.

That gives the owner a basis for deciding what to protect and what recovery arrangements are acceptable.

Put a requirement behind “defense-grade” “Defense-grade” is not an acceptance test.

If the phrase appears in a proposal, I want the applicable requirement beside it.

MIL-STD-188-125-1 addresses high-altitude electromagnetic pulse protection for fixed facilities performing critical, time-urgent missions. Revision A was issued in July 2021. The Defense Logistics Agency’s standards catalog describes performance requirements, testing, and a hardness maintenance and surveillance program that includes periodic reverification.

In this context, hardness means the ability to withstand the specified electromagnetic environment.

The standard is not a universal label for every building. The responsible authority must establish which requirements and revision apply to the project.

Before procurement, I want four decisions documented:

What is inside the protection boundary?

Which connections cross it?

What testing establishes acceptance?

Who reviews and accepts the results?

A qualified component does not, by itself, establish that the completed facility meets its requirements.

Nor does a metal enclosure prove that everything inside it is protected. The connections entering and leaving the protected space need attention as well. CISA’s guidance explicitly addresses protection at those entry points.

The owner should know exactly what the protection claim covers.

The next cable matters A facility changes after opening day.

Equipment is replaced. A communications service is added. A contractor needs another connection.

Protection has to survive that work.

CISA’s guidance calls for maintenance and surveillance to preserve the integrity of electromagnetic protection over the system’s life. That is an operating responsibility, not simply a construction closeout item.

I would want the protection boundary shown in the records used by maintenance staff and contractors.

Before a new connection crosses it, someone should review the change. Afterward, the team should know whether inspection or retesting is required.

Assign that responsibility. Fund it.

The acceptance test establishes a condition at a point in time. The owner still needs a process for preserving it.

Spend against the mission The economic question deserves the same discipline.

Which functions require protection? What interruption can they tolerate? What can be restored through spares, alternate services, or a safe manual procedure?

CISA’s public guidance offers different protection levels rather than treating every facility as the same case. The appropriate scope depends on mission needs and acceptable interruption.

I would not begin with “protect everything.” I would begin with the essential work and compare options against a defined requirement.

That gives engineering something to design, procurement something to evaluate, and the operator something to maintain.

I would also keep the threat categories clear. Solar geomagnetic disturbances are not interchangeable with nuclear-generated EMP. Protection against one exposure should not be assumed to satisfy every other requirement.

An owner deserves that distinction before spending money.

Six questions before calling it protected In the earlier posts, I asked what stays on during an outage and who pays for the power.

This question reaches into the facility itself: What still works when the disturbance affects the equipment needed to carry out the mission?

Before selecting a protection package, I want six answers:

Which mission must continue, and what interruption is acceptable?

Which electromagnetic threats are included in the design basis?

What equipment, connections, and outside services does the mission depend on?

Which standard and revision apply, and who approves their use?

What inspection and testing establish acceptance?

Who funds maintenance, controls changes, and arranges reverification?

At Ber Wilson, I want those questions addressed while the power, controls, communications, and building design can still be reviewed together.

The Québec lesson is straightforward. Understand the failure. Apply the appropriate measures. Keep checking the system.

The threat may be invisible. Readiness needs evidence.

Bring the mission to the table If you are responsible for a federal installation or critical facility, ask Ber Wilson about a MIL-STD-188-125 scoping discussion.

Bring the mission requirements, available drawings, existing protection records, and direction from the responsible authority.

We can discuss the project boundaries, identify missing information, and determine the appropriate next step for an engineering and testing scope.

A scoping discussion does not certify compliance. It defines what must be evaluated, what evidence is required, and who needs to be involved.

Start before equipment is selected. The first decision is what must keep working.

Contact Ber Wilson

info@berwilson.com