America's Off Switch

“America’s Off Switch” is an informal term for the combined set of vulnerabilities that would let an adversary disable large parts of U.S. digital and physical infrastructure at once. That includes broadband, telecommunications, cloud computing, the power grid, water systems, and navigation and timing services. The term reflects a shift in how national security officials describe the threat. The concern is no longer a single dramatic attack. It is an adversary that quietly places access inside many systems ahead of time and then triggers them all together during a crisis.

The idea gained wide attention in early 2024. U.S. agencies disclosed that the PRC state-sponsored group known as Volt Typhoon had been hiding inside the networks of U.S. communications, energy, transportation, and water operators, in some cases for at least five years. The intrusions were not built for espionage. CISA, the NSA, and the FBI assessed that the actors were pre-positioning to disrupt or destroy critical services if a conflict broke out, such as one over Taiwan. FBI Director Christopher Wray told Congress in January 2024 that Chinese hackers were positioning themselves on U.S. infrastructure so they could cause real-world harm to American communities whenever Beijing chose to act.

The “switch” is not one device or one network. It is the total of hidden access, concentrated chokepoints, and interdependent systems. When those are activated together, they can cause cascading failures that go far beyond the damage of any single attack.

Components of the Off Switch

1. Pre-positioned Network Access —

2. Intrusions like Volt Typhoon use “living off the land” techniques. The attackers use legitimate administrative tools and compromised small-office routers to blend in with normal traffic and avoid detection. The goal is persistence: access that stays dormant until it is needed.

3. Telecommunications Compromise —

4. In 2024, the group known as Salt Typhoon was found to have breached several major U.S. carriers, including systems used for lawful intercept. Access to carrier core networks could let an adversary watch, degrade, or cut off communications for government, emergency services, and the public.

5. Physical Chokepoints —

6. A small number of facilities carry a large share of traffic and power. These include submarine cable landing stations, internet exchange points, dense data center clusters, and large power transformers, which can take a year or more to replace. Damage to submarine cables near Taiwan and in the Baltic Sea in recent years has shown how exposed these links are.

7. Supply Chain Dependencies —

8. Network equipment, modules, and grid-connected devices made by companies subject to foreign government control can carry hidden functions or update paths. In 2025, reports of undocumented communication components in some imported solar inverters raised concerns about remote disablement of energy equipment.

9. Systemic Interdependence —

10. Broadband depends on power, power depends on communications, and both depend on GPS timing. Because of this, disabling one sector can bring down others. A regional outage can spread nationally if there is no redundancy and no ability to fail gracefully.

Why It Matters for Broadband and Infrastructure Providers

Rural broadband providers, electric cooperatives, municipal utilities, and water systems are often the easiest entry points. They usually have small security teams, older equipment, and flat networks, yet they connect to larger regional and national systems. Every unhardened network adds to the reach of the off switch. Every resilient one takes something away from it.

Countermeasures

• Network hardening and segmentation — to stop lateral movement from IT systems into operational technology
• Threat hunting — for persistent, dormant access, not only active incidents
• Replacement of end-of-life routers and edge devices — that attackers commonly use as relay infrastructure
• Trusted supply chains — , including removal of covered equipment and verification of firmware and update channels
• Multi-modal transmission diversity — fiber, microwave, free-space optics, and satellite paths that fail over automatically, so cutting one medium or route doesn’t isolate a community
• Distributed, hardened edge infrastructure — modular, ruggedized enclosures that place compute, storage, and connectivity at substations, tower sites, PSAPs, and anchor institutions. This reduces reliance on a few distant data centers that make attractive targets.
• Local exchange and peering capacity — mirroring internet exchange point functions at the edge so regional traffic can keep flowing when national backbones or major exchanges are disrupted
• Grid-independent power — battery, fuel, and solar-extended backup sized to keep critical network and emergency functions running through extended outages
• Situational awareness at the site — sensor coverage across physical and electromagnetic bands to detect tampering, intrusion, and interference at unattended infrastructure
• Edge continuity for emergency services — keeping 911 call records, routing, and coordination tools available locally when links to central systems degrade
• Rapidly deployable capacity — mobile, road-towable edge cores that can restore compute and satellite-first connectivity within hours where fixed infrastructure is down
• EMP-resistant enclosures and graceful degradation — so services shrink in capacity instead of failing outright
• Incident response planning — that assumes communications and power may be down at the same time

Sources

• CISA, NSA, FBI et al. “PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure.” Advisory AA24-038A, February 2024. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a
• Wray, Christopher. Testimony before the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, January 31, 2024.
• CISA and FBI. Joint statements on PRC-affiliated compromise of commercial telecommunications infrastructure (Salt Typhoon), November–December 2024.