Resilience Is What Works on the Bad Day

A newsletter about heat and wildfire resilience ought to begin with weather, smoke, evacuation routes, cooling, power and water. This week’s supplied reporting contains none of that underlying climate evidence. It does, however, offer a useful and rather less cinematic lesson: resilience is not a gadget one buys after a committee meeting. It is the accumulated ability of ordinary systems to continue behaving tolerably when conditions are not.

Richard Cook’s account of complex-system failure is a useful corrective to the hunt for one culprit, one broken valve, one employee to put in a training video. Transportation, health care and power generation operate with technical backups, rules, training, institutions and workers making real-time adjustments. In Cook’s formulation, “Safety is an emergent property of systems; it does not reside in a person, device or department of an organization or system.” Read Cook’s treatise.

That matters for climate preparedness because extreme conditions do not merely test assets; they test the handoffs among assets and people. The grid, the road network, a hospital’s staffing, a public-alert system and a household’s internet connection are each expected to work while the others are under strain. The bad-news corollary is that catastrophe can arise from individually manageable failures lining up. The better-news corollary is that frontline adaptation—the unglamorous work of rerouting, prioritizing, repairing and noticing degradation—counts as infrastructure too.

Or, as Cook puts it, “People continuously create safety.” The phrase is not a license to substitute exhausted workers for public investment. It is an argument for designing systems that make their expertise usable rather than treating it as a free consumable until the incident report arrives.

Consider Slovakia’s proposed traffic-camera rollout, a small parable about the difference between owning a system and understanding it. The country’s security service, NBU, warned against using NERO R-ONE high-speed cameras after finding what it said was an SMS-triggered mechanism for shell and network access from hardcoded Russian phone numbers. NBU identified the devices as rebranded Russian CORDON PRO.M cameras; the Interior Ministry had reportedly bought 279 units for a €30 million EU-funded traffic-monitoring project and paused deployment after the report. Risky Bulletin has the details.

The ministry had initially argued that a closed ministry network meant there was no data-theft danger. The cited technical report alleged a more complicated reality: SecureBoot disabled, weaknesses in a web-management portal, and live streams exposed without a password to anyone who knew the broadcasting IP. A closed loop is a reassuring shape on a PowerPoint slide. It is not a security property if the equipment inside it arrives with an undisclosed side entrance.

For resilience planners, the lesson is not that every camera is a spy novel waiting for casting. It is that public systems increasingly depend on embedded software, supplier choices and update paths that can be invisible during procurement and painfully visible during disruption. A traffic camera, a sensor, a communications device: each may be part of the operational picture during an emergency. Security review is therefore not a specialized afterthought; it is part of knowing whether the picture on the screen is available, authentic and controllable when it matters.

The reporting attributes the technical findings to NBU and notes that deployment was paused pending an independent assessment. That pause is not proof of a solved problem. It is what institutional reflexes are supposed to look like before a vulnerability graduates into an incident.

The same dependency problem now rides in the passenger compartment. Kaspersky reported a multi-stage malware campaign delivered through the built-in update mechanism of DoFun Android automotive head units. Its researchers said the legitimate TWCore system app could receive instructions via an MQTT broker to download and install APKs, leading to components used for ad fraud and a reverse-proxy botnet. Kaspersky’s technical report is here.

This was not the familiar morality play in which someone clicked an implausible attachment at 2:13 a.m. The reported infection chain ran through a system updater—precisely the sort of mechanism meant to keep a device maintained. Kaspersky wrote, “This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.” DoFun subsequently reported fixing the security issues, though the report does not specify the scope or deployment of those fixes.

There is a resilience implication here that is broader than automotive cybersecurity. Connected devices are often purchased as appliances and governed as software only after something catches fire, metaphorically if we are lucky. During real emergencies, vehicles and their communications equipment may be relied upon for navigation, alerts, coordination and basic mobility. The question is not whether every dashboard becomes a threat. It is whether institutions and consumers know which systems can update themselves, who controls those channels, and what happens when the update mechanism is the problem.

Convenience has become a supply chain with a touchscreen. That is not an argument for abandoning connected tools; it is an argument for treating maintainability, auditability and recovery as features, not as the fine print beneath the Bluetooth logo.

There is a modestly hopeful countercurrent in the coming Wi-Fi 8 standard. Rather than pursuing another round of peak-speed numerology, the IEEE’s in-development standard is being framed as “Ultra High Reliability.” It is expected to retain much of Wi-Fi 7’s headline radio capability while targeting performance under interference, crowding and multiple-access-point conditions. The standard is expected to be finalized in May 2028, and the performance figures remain goals, not household results. XDA explains the proposal.

Its stated targets include a 25% throughput improvement at different signal-to-interference-and-noise levels, a 25% reduction in 95th-percentile latency and a 25% drop in MPDU loss. Those figures should be read with the caution reserved for every pre-standard promise. Yet the direction is sensible: the useful network is not the one that wins a laboratory drag race at 3 a.m.; it is the one that still behaves when the house, office or shelter is full of devices competing for air.

That is the same political economy of resilience in miniature. We routinely reward maximum capacity, lowest sticker price and the cleanest dashboard metric. Then a stressed system reveals that the real premium was paid for reliability at the edge: interference handling, graceful roaming, spare capacity, clear authority and the ability to recover. None photographs especially well at a ribbon-cutting.

Cook’s warning against monocausal blame belongs here too. When a system fails under pressure, the failure may be distributed across design choices, procurement, maintenance, staffing and assumptions that worked on normal days. The practical standard for a climate-ready society is not invulnerability—complex systems do not offer that product—but whether failure is detected early, contained fairly and repaired before ordinary strain becomes a public emergency.