Electromagnetism: Attack in waves

Targeted attacks with high-energy radiation can disrupt or destroy power grids, data centers, and communication systems within seconds. Clear protection standards and binding regulations are still lacking in Europe.

By Sofia Delgado

Experts have been warning for years: the increasing digitalization and interconnection of critical infrastructures are making states and companies increasingly vulnerable. The threat comes not only from conventional hacking attacks but also from electromagnetic attacks. At the same time, there is a lack of uniform protection standards, Europe-wide regulations, and sufficient awareness of this danger. An attack with high-energy electromagnetic radiation, or HPEM (High-Power Electromagnetics), can incapacitate central technical systems within fractions of a second. The deliberately generated electromagnetic pulses target controllers, sensors, or communication links, causing malfunctions or permanent damage.

The core threat from HPEM consists of artificially generated high-power microwaves. Unlike a HEMP (High Altitude Nuclear Electromagnetic Pulse), which is usually triggered over a large area, for example by a nuclear explosion at high altitude, HPEM attacks are locally confined. They can be generated with mobile devices, vehicles, or drones, inconspicuously, without leaving visible traces. Data centers, substations, communication networks, or traffic control systems can be affected. Protection against such attacks was long primarily important for military systems. Today, however, security-relevant key technologies that are not only essential for a society’s defense capability must be protected broadly.

The effects of both nuclear-generated HEMPs and non-nuclear HPEM pulses are based on the propagation of electromagnetic fields and the law of induction. While nuclear-generated HEMPs can reach across entire continents, HPEM pulses act over a range of a few kilometers, but more precisely, and their source is difficult to locate. They have the ability to penetrate physical barriers such as fences or walls without leaving visible traces. Only rooms very well shielded with metal (Tempest rooms or shielded rooms) provide limited protection, but they are very complex to implement.

Tempest rooms are structurally shielded to prevent the unintended emission of electromagnetic signals from electronic devices. They are often part of high-security areas where sensitive data must be protected from external access.

| Faraday Defense Corp.

Since the 1990s, institutes worldwide have been researching non-nuclear HPEM systems and suitable protective measures. Between 2010 and 2015, the European Union funded several research projects—HIPOW, SECRET, and STRUCTURES—aimed at protecting critical infrastructures. These projects marked the transition from basic research to practical application.

In parallel, expert committees such as the International Electrotechnical Commission (IEC) and the Institute of Electrical and Electronics Engineers (IEEE) developed international standards. The technical specification IEC TS 61000-5-10 describes testing procedures and environments for electromagnetic shielding. In the United States, the military standard MIL-STD-188-125 also applies.

Despite these guidelines, protection in civilian sectors remains patchy. “Operators of power grids, hospitals, or waterworks generally do not work with military standards, but limit themselves to minimal requirements that barely go beyond enhanced lightning protection,” warns André Schmitt, a longtime Bundeswehr special operations member and crisis management consultant.

"I expect an increase in electromagnetic attacks on critical infrastructures in Europe in the coming years." – Frank Sabath, Director and Professor at the Military Institute for Protective Technologies – ABC Protection (WIS) in Munster

| WIS

Experience from the war in Ukraine shows that electromagnetic attacks have long been part of hybrid warfare. “I expect an increase in such attacks on critical infrastructures in Europe in the coming years,” says Frank Sabath, Director and Professor at the Military Science Institute for Protection Technologies – CBRN Defense (WIS) in Munster. “Without adapted protection, we will not be able to withstand this.” The Federal Office for Information Security (BSI) has laid the groundwork with its technical guideline BSI TR-03209 (Electromagnetic Shielding of Buildings). Its application, however, remains voluntary. “Compliance with this guideline is still far too low,” notes Sabath.

There is also no clear definition in Germany of what constitutes “critical infrastructure.” Dr. Hans Wolfsperger, Managing Director of W+R Shielding Technology GmbH, sees a need for catch-up and a lack of awareness in the civilian sector, since protection against electromagnetic influences is not legally mandated. “The technology exists, from shielded server racks to hardening entire buildings. Considering the potential damage, these investments are worthwhile,” emphasizes Wolfsperger.

A particular risk arises from the combination of different attack technologies. Drones equipped with portable HPEM generators can approach sensitive facilities unnoticed. “The entry barrier drops dramatically, while hardly any operational concepts exist to detect or counter such attacks,” says Schmitt. In Germany, responsibilities are fragmented, and response forces are barely available. Hybrid attacks combining cyberattacks, supply chain manipulations, drone operations, and electromagnetic disruptions could overwhelm even robust systems.

The European Union intends to highlight cross-sector topics in the future with the “European Programme for the Protection of Critical Infrastructures (EPSKI).” “Without the development and application of protection adapted to the threats, we will not be able to endure here. Protective measures must be enhanced in their effectiveness, incorporating new materials, and adapted to the forms of threat,” Sabath concludes.