Five Years in a Grid Network, and Nothing Was Stolen

Every incident-response framework assumes an objective. Data is taken, systems are encrypted, funds are moved. Responders scope an intrusion by asking what the intruder wanted and working backwards.

Pre-positioning breaks that method. Reporting on Volt Typhoon describes access maintained inside US critical infrastructure networks for at least five years, with the objective being the access itself — a capability to disrupt at a moment chosen later, rather than anything removed in the meantime.

These operations characteristically avoid malware in favour of the administrative tooling already present. There is no implant to find because the intruder is using the same utilities the operations team uses, from accounts the operations team recognises.

The detection problem is therefore not a sensor problem. It is a baseline problem: distinguishing legitimate administrative activity from identical activity performed by someone else requires knowing what normal looks like on a network built over decades by people who have since left.

The advisory direction of travel is telling. Current US guidance asks critical infrastructure operators to plan for running vital systems in isolation for extended periods — weeks to months — during a conflict scenario, and to have those isolation and recovery plans built and tested in advance rather than improvised.

That is an unusual thing for a government to ask. It concedes that eviction may not be achievable on the timeline that matters, and shifts the objective from keeping intruders out to remaining able to operate while they are in.

For a utility, the budget conversation is genuinely hard. There is no incident to point at, no records to notify, no fine. There is only a capability someone else holds, and the possibility that it is exercised on a day nobody gets to choose.