The Night the Internet Goes Dark: A Thought Experiment on the Planet's Weakest Threads

Imagine a kitchen in Nairobi on the morning of 20 October 2025. The kettle goes on, the coil glows, and the water rises as it always does. Far away in northern Virginia it is the middle of the night, and a record that tells other systems where to find a service has been left empty. Applications, payments and sign-ins that depend on that service stop answering. The kettle has no cloud to fail. It has a switch, a cup and a little electric certainty. This is a thought experiment, and the kitchen is imagined.

Could the entire internet be hacked, and could someone have planned it? Headlines answer yes, in a voice that makes the answer sound like fact. The honest answer is stranger. A total takedown is far harder than the headlines suggest. Partial, correlated, cascading failures are already real. And the most frightening thing in the record is not a secret plan. It is a structure that needs no plan at all.

Of the Empty Record in Virginia

The most instructive outage of recent years was not an attack. Amazon's own post-event summary attributes the disruption of its DynamoDB service in the US-EAST-1 region to "a latent race condition in the DynamoDB DNS management system," which left the regional endpoint's DNS record empty. AWS, "Summary of the Amazon DynamoDB Service Disruption in the N. Virginia (US-EAST-1) Region" DynamoDB API errors ran from 11:48 PM Pacific time on 19 October until 2:40 AM on 20 October. The knock-on errors reached EC2 launches, load balancer health checks, Lambda, container services and IAM sign-in.

The same lesson arrived in July 2024 from another direction. A security company's software update, released on 18 July, began impacting IT systems globally. Microsoft estimated that the update "affected 8.5 million Windows devices, or less than one percent of all Windows machines." Microsoft, "Helping our customers through the CrowdStrike outage" That share is measured against all Windows machines, not against the machines that ran the security software, so it does not say how many of those were hit.

Eight and a half million devices is a small share of the whole. Both episodes were ordinary failures, moving through shared parts faster than anyone could stop them. Nobody needed to want the blackout.

Of the Cables on the Floor of the Sea

The internet is often pictured as a cloud. It is more accurately a set of threads, many of them lying on the seabed, and the record shows how exposed they are where they pass through narrow water.

East Africa has a recent example. On 12 May 2024, the SEACOM and EASSy cables were damaged off KwaZulu-Natal, in South Africa, with a dragging anchor the suspected cause. All were repaired by 3 June. No country suffered a total outage, but rerouted traffic congested the remaining routes. Internet Society, 2024 East Africa Submarine Cable Outage Report Imagine a Nairobi shopkeeper whose mobile-money agent runs slowly for days while the routes strain. She does not know which thread failed. She knows the till is slow, and that the paper ledger in the drawer still works.

Then there is the Strait of Hormuz. On 19 October 2026, an IRGC spokesman said at a Tehran ceremony that "seven major internet cables run beneath the Strait of Hormuz." Windward counts six live cables, and says Iraq, Kuwait, Bahrain and Qatar have no subsea route to the outside world that avoids the Strait. Windward, "Iran threatens the Hormuz internet cables" Windward also says two sanctioned tankers that drifted over cable corridors cannot be "characterized as a confirmed survey." It judges the threat selective rather than blanket, with the physical vulnerability "not fixable in the near term."

Why the Switch Does Not Exist

The honest answer rests on one structural fact. A total takedown would have to break many independent things at once, owned by many organisations, in many countries. The headline folds all of that into one phrase, "the internet."

The Pawanax research reaches the same conclusion. The Linked World v5 (27 Oct 2026) says that network analysis, however detailed, "cannot identify a world controller." The v4 edition puts the image more plainly:

No one holds the wheel. Many hands hold the valves. (The Linked World v4, 27 Oct 2026)

That sentence is the thesis of this experiment. The network has no switch. It has valves, held by providers, carriers, regulators, insurers, banks, and the operators of ships that sail over a cable.

The Pawanax forecast for cyber risk is judgmental and uncalibrated. It puts a cyber-caused outage of 24 hours or more at a G20 systemically important bank or national payment system at 10 per cent by October 2027. It puts a cyberattack causing a 24-hour-plus power outage for at least one million customers in the US or EU at 4 per cent by October 2028. I read these as small numbers. My judgment, not a finding of the model, is that they are small because the architecture is wide.

Correlation Without Conspiracy

A failure does not need to be total to be serious. Think of a bridge that stays standing but is closed to heavy trucks. The trucks go round, the roads choke, prices rise at the far end of the route, and the bread seller at dawn loses her margin. In my judgment, the mechanism behind this kind of failure is shared dependence. Many services sit on the same few large platforms, and many machines run the same security software, so one update can reach them on the same day. In my reading, the CrowdStrike and AWS episodes show what happens when one common part misbehaves: the failure travels sideways across unrelated businesses that leaned on the same beam.

Comparitech counts 2,627 ransomware attacks in the third quarter of 2026, up 61 per cent on the same quarter of 2025. The count comes from leak-site and reporting data, so it is not a complete tally. Comparitech, Ransomware roundup Q3 2026

October brought a current example. GMO Internet confirmed unauthorised access on 20 October. Its notice says malicious programs were installed in the server environments of some customers of its Desktop Cloud hosting service, and that up to 26,739 servers may be affected. GMO has not confirmed any leak of personal information. GMO Internet notice The notice describes a hosting service, not a bank.

On 29 October 2026, roughly $6.36 billion left Binance wallets across ten blockchains, according to TRM Labs, valued at the time of the theft. Most of it went within about twenty minutes from 20:05 UTC. TRM calls it the largest crypto theft on record. TRM Labs, on the Binance theft

None of these, so far as the public record shows, needed a grand design.

The State Actor, Read Carefully

State-actor documents must be read with care, because each mixes three things: a capability (what an actor can do), an intent (what it wants), and a plan (a coordinated design linking many capabilities to one purpose). Public evidence often supports the first, sometimes the second, and very rarely the third.

The Binance theft shows that discipline in a new form. TRM Labs attributes it to TraderTraitor, which it describes as North Korea's elite hacking unit, "with high confidence." That is an assessment by an analytics firm. It is not a finding of a court.

A capability is not a plan, and an attribution is a claim until it is tested. Nothing in the public record binds these capabilities into one coordinated design.

The Elite Plan Nobody Needed to Write

Could someone at the top have planned this? Is there a switch in a room that a small group could turn?

The evidence does not support a coordinated elite plan to take down the internet. The claim circulates and sounds plausible, which is reason enough to test it. The premise that someone called the GMO breach "the end of the internet" has no source in the Pawanax contested-claims record. Nothing in the record shows any group holding a central lever over the network. The Linked World v5 (27 Oct 2026) concludes that shared incentives and common exposure can produce correlated policies without a single directing actor, and that a preparedness strategy is not evidence of secret foreknowledge.

A fragile internet needs no plan at all. In my judgment, ordinary people doing ordinary things produce it. Concentration tends to follow efficiency, common software spreads because it is useful, and updates ship quickly because speed is rewarded. Attackers go where the gaps are. No one needs to plot any of it.

The Pawanax model, judgmental and uncalibrated, shows the same point in numbers. With no links between shocks, the chance of ten or more of seventeen global shocks landing in one year is about 1.2 per cent. Across latent correlation settings of 0.1 to 0.6, the same model gives a one-year chance of 4.9 to 18.5 per cent for ten or more of seventeen shocks. The Linked World v5 (27 Oct 2026) says the range is a sensitivity range, not a confidence interval, and that nothing in the submission identifies the right dependence assumption. My reading is that the mechanism is correlation, not conspiracy. Shared stress makes separate things fall together.

Imagine a meeting in Geneva where a cloud executive, a cable manager, a central banker and a security vendor each say, honestly, that they are doing their job. None of them wants a blackout. The sum of their reasonable choices is a system that is efficient on a good day and brittle on a bad one.

The evidence supports the claim that many hands hold the valves. It does not support the claim that one mind holds them.

The Last Room: What Resilience Looks Like

If the threat is structural, the defence must be structural too.

For a country, the clearest public example is the United Kingdom. Its Be Ready guidance asks households to keep three days of essentials. In the guidance's words, "Being ready for 3 days helps you manage while support reaches those most in need." The official list starts with 3 litres of water per person per day for drinking and runs through food, a torch, a radio, cash and medication. UK Government, Be Ready: get prepared for emergencies The East African outage adds a lesson about routes. A market that depends on one set of routes to reach its cloud has a single long thread. My judgment is that routes, storage and local services should be designed so that one damaged cable slows the country rather than silences it.

For a company, the failures above give the checklist. Multi-cloud design can reduce the risk that one provider's bad day becomes your bad day, though it adds cost and complexity. Offline fallbacks matter for the ticket queue and the payment terminal. Multi-factor authentication is unglamorous, and it is the simplest fix on this list. Practise the failover before you need it.

For a person, the kit is less dramatic than the headlines. Keep the basics together, where you can reach them in the dark. Keep a paper record of the accounts and numbers you need most, because the screen is the first thing to fail. The post-quantum question is personal for anyone who handles long-lived secrets. NIST released the first three finalised post-quantum standards on 13 August 2024: FIPS 203 for key encapsulation, FIPS 204 for signatures, and FIPS 205 for hash-based backup signatures. NIST, first finalised post-quantum standards Start with the data that must stay secret for years.

Imagine the Nairobi kitchen again, on a night when the phone shows no bars. The kettle is on the counter. Beside the rice, a torch sits with fresh batteries. In the drawer, a small paper ledger lists the numbers, the accounts and the debts, written in pencil by someone who knew the screen could fail. The water still boils, because a coil and a switch do not need a cloud. A threat with no switch is still a threat. It is one, though, that a household, a company and a country can prepare for, one thread at a time.

Editorial note: This essay expresses the founder’s ideas, developed with AI-assisted research and writing (parallel Claude Haiku 5.5 agents) and checked against the linked sources on 30 October 2026. Convictions, proposals and forecasts are identified in the text; scenes framed as imagined are illustrative. This is a thought experiment about systemic fragility. It contains no operational guidance, and the Pawanax research finds no evidence of a coordinated plan by any elite.

Cover photograph / illustration: PiDatacenters (Wikimedia Commons user; own work). CC BY-SA 4.0. Original source. Illustrative image: rows of data storage racks at a data centre (Pi Data Centers, Amravati, India). Photograph: PiDatacenters, via Wikimedia Commons. CC BY-SA 4.0. This image does not document the events described.