What Cut Off Venezuela’s Grid?

Cybersecurity and national security analysts remain confounded by a power outage in Caracas tied to a late-night U.S. operation against Venezuelan President Nicolás Maduro, unsure whether U.S. forces blended cyber and kinetic operations to pull off the capture.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Public statements since the operation have offered little clarity on what caused the outage or whether its intention was to aid U.S. forces during the late-night raid. Chairman of the Joint Chiefs of Staff John Daniel Caine said in a press briefing the U.S. layered effects from multiple commands, including Space Command and Cyber Command, without detailing their specific roles (see: US Action in Venezuela Provokes Cyberattack Speculation).

President Donald Trump has referenced American “expertise” but the lack of operational detail has left analysts focused on what would make sense rather than what can be proven. Analysts told Information Security Media Group that power outages by themselves offer little evidence of cyber involvement, and that cyber operations often face significant limitations when used to take down electricity at scale.

“If you need to create a power outage and you are already willing to launch a violent attack, then cyber operations aren’t the best means for the target,” said Jacquelyn Schneider, a cyber conflict researcher at Stanford University and director of the Hoover Wargaming and Crisis Simulation Initiative.

But cyber may have been an “ideal tool” for the mission – dubbed Operation Absolute Resolve – as research shows that in high-risk, high-stakes coercive operations, decision-makers often prioritize tools that are covert, tightly scoped and reversible, even if their effectiveness is uncertain, said Schneider.

“Just because it’s easier to take power out with a bomb doesn’t mean a state wouldn’t still opt for a cyberattack,” she said, pointing to Russia’s war in Ukraine as an example of cyber being used alongside kinetic force to generate temporary disruption through communications degradation, information operations and intelligence collection.

That framing aligns with a broader pattern analysts see in modern military planning where cyber is viewed as an enabling layer operating alongside air, space and electronic warfare. Analysts say cyber effects may include degrading leadership communications, delaying air defense awareness or disrupting command-and-control visibility at critical moments. Recent U.S. operations against Iran reportedly used cyber and electronic effects (see: How US Cyber Ops May Have Assisted the Midnight Hammer Strike).

Other analysts questioned whether the United States would rely on the complexity of a layered cyber-kinetic attack amid such a significant operation. Alan Woodward, a visiting professor of computer science at England’s University of Surrey, said that “sending the city dark using cyber is of course a possibility, but if you look back at the start of [the] second Iraq conflict, it was done using those bombs that short out high voltage lines.”

The U.S. first deployed explosives known as “blackout bombs” against Iraq during the 1990s Gulf War. The munition releases a cloud of chemically treated carbon filaments that short out electrical transformers and power lines. The military again used the munition – also known as a graphite bomb – against Serbia in 1999.

U.S. planners would likely have relied on long-running intelligence collection, Woodward added, including electronic intelligence and signals intelligence to map networks and identify single points of failure, alongside human intelligence to understand who might be bribed or pressured on the ground.

OT security specialists weighing in on what kinds of cyber effects could realistically be achieved have said a cyberattack shouldn’t be ruled out. Robert Lee, CEO of the industrial cybersecurity firm Dragos, said in a LinkedIn post that it was “completely reasonable to assess” that cyber could have been used to affect power or air defenses, while noting that critical information remains missing.

“My pure guess would be more Ukraine 2015 style (abuse of native functionality) than Ukraine 2016 style (custom OT specific malware) but no way to know right now,” he wrote. “Time will tell but the claim is perfectly reasonable.”

The uncertainty around what may have caused the outage further complicates attribution, analysts said. The operation writ-large has blurred legal and political boundaries and prompted demands from lawmakers for congressional oversight.

With reporting from Information Security Media Group’s Mathew J. Schwartz in Scotland.