What If The Internet Really Went Off?

A human look at the fallout, the fragile pillars holding it up, and what happens in a world at war

Cloudflare’s recent outage gave us a tiny glimpse of something bigger.

For a short time, a lot of people saw the internet “go weird”. Sites would not load, apps failed, payments glitched. Most of us shrugged, hit refresh and carried on with our day.

That shrug hides a much bigger question:

What happens to people, families, jobs and communities if the internet really goes off?

Before we talk about that, it is worth looking at some of the big choke points that keep everything standing, and how they can be disrupted in very simple terms.

Four big choke points, in plain English

1. CDNs and “front doors” like Cloudflare

What they are

CDNs and edge platforms like Cloudflare sit in front of millions of websites. When you visit a site, quite often you are not talking to that site first, you are talking to Cloudflare or a similar service. They:

• speed things up by serving cached content
• filter out attacks
• act as the front door to lots of different services

How they could be disrupted

In simple terms, you break the reception desk.

• Flood them with traffic that looks real but is cleverly designed to be hard work to process
• Abuse features like bot checks or API gateways so they have to think too much about every request
• Hit an internal bug or bad configuration that makes a shared service fall over, like we just saw with Cloudflare

Result: one company’s bad day turns into hundreds or thousands of websites throwing errors at once.

2. DNS, the internet’s phone book

What it is

DNS is the system that turns names into numbers, like:

www.example.com → an IP address your device can actually connect to.

If DNS does not work, your device has no idea where anything is.

How it could be disrupted

This is like ripping out or scribbling over the phone book.

• Knock major DNS providers offline with overload or attacks on their systems
• Feed them bad information so names point to the wrong place
• Break the links between local DNS servers and the bigger providers

Result: from a normal user’s point of view, “the internet is down”, even if the servers themselves are fine, because nothing can be found.

3. Cloud data centres, where the apps actually live

What they are

AWS, Azure, Google Cloud and others host a huge number of the services we use. Banking apps, booking systems, business software, government portals, all live in a relatively small number of large data centres, called regions.

How they could be disrupted

This is like shutting the doors to a business park where half your town works.

• Technical failures or attacks on one region so servers there are unreachable
• Problems with the control systems that manage virtual machines and storage
• Power issues, cooling failures or physical incidents

Result: anything that lives in that region is gone for normal users. Shops cannot take orders, businesses cannot log in, public services cannot reach their own systems.

4. Payment rails and card processing

What they are

When you tap your card or phone, there is a chain of systems behind that tap:

• your bank
• the card scheme
• the payment processor or gateway
• the merchant’s bank

Most of that chain runs over the internet.

How they could be disrupted

This is like jamming the card machines for an entire country.

• Overload or attack critical APIs used to authorise payments
• Hit a bug or outage in a major gateway used by lots of retailers
• Disrupt connectivity between banks and schemes

Result: shops start saying “cash only” or “cards not working”, online payments fail, and people who do not use cash are stuck very quickly.

Cloudflare: a small taste of a big problem

Cloudflare’s recent outage is a neat example of how this plays out in real life.

According to their own post mortem, it was not a Hollywood hack. A change to how one of their internal systems worked caused a file to grow larger than expected, hit a hidden limit in shared infrastructure, and a core service fell over. Because Cloudflare sits in front of so many sites, that one bad day showed up as errors on everything from major platforms to small business websites.

From a cyber and resilience point of view, the cause almost does not matter. A single glitch at one company briefly looked, for a lot of people, like “the internet is broken”.

That is the taste. The rest of this article is about what happens if that kind of thing stops being a short lived accident and starts being a deliberate strategy.

If the internet went off…

Imagine a serious, wide scale outage of public internet connectivity. Not a few apps glitching, but the thing itself not being there.

1 hour – annoying

• Your Teams or Zoom call drops
• The card machine in the coffee shop fails
• The kids cannot get on Xbox Live

You swear at the router, joke about being back in the 90s and carry on. It is annoying, not life changing.

1 day – you feel it in your stomach

• Work and income
  • If you are paid by the hour and your work depends on cloud systems, you lose that day’s wages
  • Remote workers and freelancers simply cannot log in
• Money and bills
  • You cannot move money between accounts or fix a payment problem
  • The card machine fails in the supermarket when you have no cash
• Family and care
  • Parents miss video consultations for children’s health
  • Elderly relatives who rely on online food deliveries do not get their shop
• Vulnerable people
  • Someone in an abusive relationship cannot reach online support
  • A teenager who lives in online communities suddenly finds themselves completely cut off

It is only a day, but real people are making choices that have consequences.

1 week – the thin layer of “normal” tears

• Jobs and businesses
  • Gig workers, drivers, creators, freelancers, all lose income. Savings, if they had any, are draining
  • Small businesses that run on online bookings and cloud tools are in real trouble. Shifts are cut, staff sent home
• Food and daily life
  • Supermarket shelves start to show real gaps, not just a few missing items
  • People without cars, who relied on online shopping, are now queuing at big stores that were never designed for this
• Health and medication
  • Appointments and referrals back up
  • Automatic prescription renewals and electronic requests fail. Some people run low on medication
• Mental health and connection
  • People who manage anxiety or depression with online therapy or communities lose their lifeline
  • For many, social life is WhatsApp, Discord, gaming chat. A week of silence is isolation, not “detox”

At a week, the question at home is no longer “why is the internet down” but “what are we going to do if this carries on”.

Panic, fear and the risk of riots

The hardest part of a serious outage is what happens inside people’s heads when uncertainty drags on.

We cope with inconvenience if we believe someone is in control and it will be fixed soon. Take both away and things get ugly.

First you get queues, rumours and empty shelves:

• People rush to ATMs because they heard “cards might stop working”
• Someone says a supermarket is running out of fuel, baby formula or insulin
• A few people stockpile, everyone behind them sees that and copies it

Then panic turns into confrontation:

• Arguments and fights in queues when people think others are taking more than their share
• Abuse and threats towards shop staff who have no control over deliveries or payments
• Groups trying to jump queues or “reserve” access for themselves

If the outage runs long enough, or hits during a time when trust is already low, it is a short step from repeated flashpoints to riots and looting in particular areas.

Not because society suddenly turns feral, but because fear, anger and uncertainty pile up on top of existing pressures until something gives.

1 month – the cracks become breaks

• Who gets hurt first
  • People with savings, strong family networks and flexible jobs cope
  • People living month to month, on zero hour contracts or benefits, in insecure housing, do not. For them this is not an outage, it is a slide into debt, eviction and crisis
• Family pressure
  • Parents who relied on online work from home are forced to take whatever job they can reach physically. Childcare breaks
  • Families abroad lose contact for weeks. No video calls, no quick “are you safe” check
• Health outcomes
  • Missed screenings and delayed follow ups turn into later diagnoses and worse outcomes
  • People who should have been managed in the community turn up in A and E instead
• Trust and behaviour
  • With normal digital information flows broken, rumours fill the gap
  • Crime patterns change. Some cybercrime disappears. Burglary, fraud and opportunistic violence rise in stressed areas
• Politics and public order
  • Elections, public consultations and basic democratic processes are disrupted
  • Protests about “getting answers” or “getting help” become more likely. Some tip into disorder

At this point, it is not an “outage”. It is a structural shock that hits the people with the least buffer the hardest.

Now add the world we are actually living in

All of this would be worrying enough in a calm, peaceful world.

We are not in a calm, peaceful world.

We have live shooting wars, frozen conflicts, sanctions, energy crises, disinformation campaigns and open talk of “de-risking”, “decoupling” and “spheres of influence”. You can call it east vs west if you want, or blocs vs blocs, but the basic reality is:

• some states see the current global internet as an asset to defend
• some see it as a vulnerability to exploit
• some see it as something to break up and control on their own terms

In that environment, the idea that a hostile state, or a loose alliance, might try to “cut off” parts of the internet from others is not fantasy. It is strategy.

Think about a few examples that fit the pattern:

• attacks on undersea cables that carry traffic between regions
• pressure on big cloud and CDN providers through sanctions, regulation or quiet coercion
• national firewalls and routing policies that can be tightened overnight
• cyber operations aimed at payment systems, logistics platforms and identity providers in a rival bloc

You do not need a dramatic “the east cuts off the west in one second” moment. You can do it in stages.

• First you make certain services unreliable
• Then you make certain routes flaky or slow
• Then you add legal and technical barriers
• Then, when the population is used to that level of friction, you can close doors more aggressively

From the outside, each move can be explained as regulation, safety, technical problems or “protecting national sovereignty”. From the inside, what people feel is more outages, more friction, more things that used to “just work” becoming unpredictable.

Cyberwarfare is about people, not packets

Put this together with the choke points.

If you are a serious state backed attacker, or part of a bloc that wants to weaken a rival, you do not need to take the entire internet down. You look at those pillars and ask simple, human questions:

• Can we stop people being paid on time?
• Can we make food and medicine harder to get?
• Can we stop families talking to each other when they are scared?
• Can we make people doubt that their institutions are competent or honest?

If you can do that, repeatedly, by leaning on CDNs, DNS, cloud regions, payments and the rest, you can apply pressure that ordinary people feel in their wallets, kitchens and hospital appointments, while every incident is still explained away as “technical issues”.

Is it difficult to do? Not as much as you would hope

Here is the uncomfortable truth:

Is this kind of operation difficult to pull off?
Not as difficult as you would hope.

You still need serious capability, planning and intelligence. This is not something a random teenager can do to a whole country. But for a small number of well resourced states and groups, the ability is already there.

And so is the motive.

• They can see how dependent we are on a few fragile pillars
• They can see the tensions in our politics, the cost of living pressure, the trust issues
• They can see that a “simple IT problem” at the right time could tip all of that in the wrong direction

Unlike nuclear warfare, there is no shared understanding of mutually assured destruction here. There is no instant, obvious mushroom cloud that guarantees overwhelming retaliation.

A state can lean on another country’s digital choke points and:

• blame criminals
• blame “technical faults”
• deny everything
• or simply sit back while the target government struggles to explain to its own citizens why nothing works

You can bring a modern, internet dependent country to its knees without firing a single bullet in the traditional sense, just by turning the systems it relies on into sand, for long enough, at the worst possible moment.

And that is happening in a world where we already have live wars, proxy conflicts and open talk of “de-risking” and “decoupling” between blocs. The ability is there. The motive is there. The deterrence is weaker and fuzzier than it is in the nuclear world.

That is exactly why outages and “glitches” at the big chokepoints should not be treated as boring back page IT stories. They are dry runs for something much nastier.

The Cloudflare outage matters not because of the specific bug, but because it shows, in miniature, how quickly a problem at one private company can become a problem for everyone else.

In a world with real wars, real rival blocs and real incentives to cause pain without crossing the line into open kinetic conflict, that should be a wake up call.

The real wake up call

The uncomfortable part is not that systems fail. They always will.

The uncomfortable part is:

• how thin the margin is between a glitchy afternoon and genuine social disruption, and
• how numb we have become to that risk, even in a world that is clearly more unstable

If our default reaction to big digital outages is a shrug, we will keep building a world where a small number of fragile pillars hold up almost everything, and where the people with the least buffer suffer most when those pillars crack.

We do not need panic. But we do need to:

• be honest about which chokepoints we rely on
• think through 1 hour, 1 day, 1 week scenarios for our own organisations and communities
• recognise that, in the current geopolitical climate, these are not just IT risks, they are levers in modern conflict
• treat concentration risk and third party dependency as critical infrastructure issues, not just procurement choices

Cloudflare gave us a taste. Wars and rivalries in the real world mean someone, somewhere, is thinking about how to serve that taste at scale.

This article was conceived by Dr David J Day. The words were beaten into shape with the “help” of an AI writing assistant, which is cheaper than a ghostwriter and complains less.