Sovereign Timing Infrastructure

Frontier If the cross-sector cascade is real at the scale the dependency measurements imply — and no jurisdiction has run the exercise that would show it, which is what 7 asks for — the prize is a number no country owns: its own time-to-first-failure, per sector, in hours. That number is the input to every subsequent decision about how much holdover to buy and whether a domestic time scale is worth its cost. Without it, resilient timing is procured on assertion.

Established The magnitude is set by the cost of holding time against the cost of losing it, and both sides have published figures. Britain has committed £180 million to a National Timing Centre of two clock sites distributing an independent national time scale, plus £71 million to a nationally owned eLoran system, against a government estimate that a 24-hour satellite-navigation outage would cost about £1.4 billion. The United States publishes a figure of at least one billion dollars per day for a complete GPS loss and has appropriated nothing comparable for a terrestrial fallback. On those numbers the British programme pays for itself by preventing roughly one outage of a few days — but the loss estimate is modelled, not measured.

Established The engineering gain is measured in hours of autonomy per dollar of oscillator, and the measured spread is wide enough to be a policy variable. A disciplined rubidium clock monitored at NIST held one-microsecond synchronisation for about 73 hours after its antenna was disconnected; a free-running caesium standard stayed within 300 nanoseconds of UTC(NIST) for about eight months. Against sector requirements of roughly 26 microseconds for synchrophasors and 1.5 microseconds for fourth-generation mobile networks, the difference between a receiver with a holdover algorithm and one without is the difference between days of grace and none.

Speculative The gains are badly distributed, which is why this is a legislative subject rather than a procurement one. One broadcast is read by everybody, so nobody who reads it pays to keep it up, and the operators least able to buy holdover — small distribution utilities, regional carriers, municipal systems — are the ones whose failure would be discovered last. The condition on all of the above is in 5: dependent systems do not log the health of their own time source, so even a country that ran the exercise would struggle to read the result.

Established Time is delivered to critical infrastructure as a broadcast utility with one primary supplier. A GNSS satellite transmits a navigation message carrying its own clock offset, drift and drift rate together with orbital parameters; a receiver that knows where the satellite is solves for position and, separately, for time. The two share arithmetic: a nanosecond of clock error is about 30 centimetres of position error. A stationary receiver that knows its own coordinates can solve for time alone from a single satellite, which is why timing receivers are cheap and everywhere.

Established The device that matters in infrastructure is not the receiver but the GPS-disciplined clock. A GPSDC is a local oscillator — quartz, rubidium or caesium — steered slowly toward the satellite signal so that it inherits atomic long-term accuracy while keeping its own short-term stability. NIST states the failure mode plainly: “If GPS cannot be received, a GPSDC will go into holdover mode, where its accuracy will now be limited by the quality of its LO, and if one is present, the quality of the holdover algorithm” — and adds the part operators tend not to know, that “not all GPSDCs include a holdover algorithm, some immediately become free running clocks when GPS signals are lost.”

Established Synchronisation and syntonisation are different requirements and fail differently. Syntonisation is agreement on the length of a second, and a good oscillator supplies it unaided for a long time. Synchronisation is agreement on which second it is and on the phase within it; that degrades cumulatively once the broadcast stops, because a frequency offset integrates into a time offset. A network needing only frequency rides out an outage on quartz. A network needing phase alignment across independently owned sites — a time-division mobile network, a synchrophasor fleet, an audit trail — cannot.

Established Above the receivers sits a treaty-organised metrology system the dependent sectors never touch directly. National metrology institutes realise local approximations to Coordinated Universal Time — UTC(NIST), UTC(NPL) — from ensembles of masers and caesium standards, reconciled after the fact internationally. NIST's primary time scale in Boulder runs 21 commercial atomic clock devices, 14 hydrogen masers and seven high-performance caesium beam clocks, about 12 of which contribute to the primary ensemble, and it has operated continuously for more than 50 years. What infrastructure actually reads is a defence system's signal steered to that civil reference, not the reference itself.

Established Scope boundary, stated up front. The clock physics — optical lattice standards, frequency combs, the scheduled redefinition of the SI second — belongs to Precision Quantum Sensing. The general problem of mapping what depends on what belongs to Critical Dependency Atlas; how long networks take to restore belongs to Infrastructure Resilience. What is owned here is one dependency, measured: a single broadcast read simultaneously by financial settlement, telecommunications and the electricity grid, with no domestic fallback in most of the world and no test of what happens when it stops.

Established The failure mode of interest is a wrong time, not a missing one. An absent signal is detected instantly and puts every clock into a known state. An incorrect signal the receiver believes propagates into systems with no independent check, and 3 contains a worldwide instance of exactly that. The distinction runs through the whole brief and is why the monitoring limb is not optional.

Established The anchor measurement exists and is narrower than it is usually described. NIST Technical Note 2189, An Evaluation of Dependencies of Critical Infrastructure Timing Systems on the Global Positioning System (GPS), by Michael A. Lombardi, November 2021, put numbers on the dependency. Its abstract sets the scope: the “regulatory timing requirements and GPS timing dependencies of United States critical infrastructure systems operating in the financial, telecommunications, and electric power sectors.” Three sectors, not sixteen. The commission for this brief described it as a survey sector by sector; that is the right document and the wrong breadth, and the correction matters, because the sectors nobody measured — water, rail signalling, emergency dispatch, air traffic, broadcast — have no published requirement to test against.

Established The financial sector's tolerance has tightened by orders of magnitude in a quarter-century. TN 2189 records the 1998 rule verbatim: “All computer system clocks and mechanical time stamping devices must be synchronized to within three seconds of the National Institute of Standards and Technology (NIST) atomic clock.” Modern requirements sit in the microsecond domain, five to six orders tighter. This brief prints no single current figure: repeated reads of the source returned different tolerances for the same rule, and an unverified microsecond is worse than an honest order of magnitude. The consequence is not in doubt — a market whose audit trail is defined against a national time scale has made that time scale a regulatory input.

Established The grid's requirement is derived from physics and is about 26 microseconds. TN 2189: “The total vector error (TVE) specification for synchrophasors is 1%, which under normal conditions translates to a time synchronization requirement of approximately 26 microseconds.” That is the whole error budget, so a practical phasor measurement unit is specified far tighter, and the measurement loses meaning rather than stopping when the budget is exceeded. A synchrophasor fleet that drifts does not alarm; it reports angles wrong by an amount nobody in the control room can see.

Established Telecommunications carries the tightest continuous requirement and the clearest published floor. TN 2189 gives a primary reference clock frequency accuracy of one part in 10¹¹ or better over a week. Homeland Security is specific about a substitute: “Any system serving as a timing backup or alternate must provide a minimum of 1.5µs accuracy” for fourth-generation networks, with “50–200 parts per billion frequency stability”, and puts fifth-generation requirements at “~240 nanoseconds”. The Federal Communications Commission stated the coupling in 2025: “individual carrier networks may be able to sustain timing internally, but will eventually lose synchronization with other networks”. That is the cascade hypothesis with no number for “eventually”.

Established Holdover has been measured, and these are the most useful numbers in the field. TN 2189 reports a disciplined rubidium clock that “maintained 1 µs synchronization for about 73 hours after its antenna was disconnected”, and a caesium standard that “remained within 300 ns (0.3 µs) of UTC(NIST) after free running for about eight months.” Undisciplined rubidium accumulates tens of microseconds per day; caesium accumulates 1 to 100 nanoseconds per day. Rubidium buys roughly three days at a one-microsecond tolerance, caesium most of a year at ten times tighter. Both are catalogue items.

Established January 2016 is the best-documented instance of the wrong-time failure mode, and the numbers are precise. On 25 January 2016 at 22:00 UTC the constellation's oldest satellite, SVN 23, was decommissioned; a ground-segment software fault corrupted three UTC offset parameters in the broadcast navigation message. NIST's forensic paper (Yao, Lombardi, Novick, Patla, Sherman and Zhang) records the magnitude exactly: “The erroneous value of A0 broadcast during the timing anomaly was approximately -13696.03 ns, which rounds to the -13.7 µs value”. Fifteen of the 30 remaining satellites broadcast the bad data, for “13 h and 45 min, beginning when PRN 13 first sent bad data on January 25th at 23:30 and ending when PRNs 3 and 24 stopped sending bad data on January 26th at 13:15.”

Established The most important number from 2016 is the survival rate, and it is 8.8 per cent. NIST monitored roughly 80 GPS-controlled clocks across the Americas through the event: “Seven of these clocks, or 8.8 %, ran continuously throughout the UTC offset anomaly (recording measurement data every second) without recording any ~13 µs time steps.” Counting two more that stopped recording rather than stepping, “11.3 % of the GPS clocks made it through the event unscathed.” This is the closest thing in the public record to a measured population response to a real broadcast fault, and it says roughly nine in ten took the error.

Established The 2016 offset was large enough to matter in all three measured sectors. Thirteen microseconds is half the grid's entire 26-microsecond budget, roughly nine times the 1.5-microsecond floor DHS names for fourth-generation mobile, and, as a range error, just under four kilometres. Reported consequences included digital radio disruption in the United Kingdom; a UK timing-support firm with clients in more than 50 countries logged nearly 2,500 alarms at a single customer; radio observatories in Finland, Britain and Australia recorded the disturbance. No sector regulator published a post-event dependency assessment.

Established The second documented case is Galileo in July 2019, and it was also the ground segment. Degradation began 11 July 2019 at 01:00 UTC and became a full outage on 12 July at 01:50 UTC; navigation and timing were unavailable until 17 July, with search and rescue unaffected. The European Commission is unambiguous: “The technical issue was solely related to the ground infrastructure in a Galileo control centre, not to the Galileo satellites.” The fault occurred during a control-centre upgrade while inter-centre redundancy was unavailable and “impacted the time and orbit determination function”. Satellites kept transmitting at normal power; what stopped was the upload of fresh ephemerides and clock corrections. Users were formally notified about 14 hours after onset.

Established Both of the best-documented multi-day GNSS failures originated on the ground, in routine maintenance. Neither was hostile. Both involved a constellation still transmitting an apparently healthy signal carrying wrong or stale data. A resilience architecture designed only against signal denial addresses the failure mode that has not yet caused a global incident, and not the one that twice has.

Frontier The economic case rests on two headline figures, both modelled. The RTI International study for NIST (O'Connor and colleagues, June 2019) put cumulative GPS benefits at roughly $1.4 trillion in 2017 dollars, and NIST cites a loss of “at least $1 billion per day” from a complete outage. The UK government estimates a 24-hour outage at about £1.4 billion, and NPL states these services “directly support over £250 billion (13.4%) of the UK economy.” These are scenario models built from sector assumptions; no published estimate is calibrated against a real multi-day denial, because there has not been one.

Established Terrestrial alternatives have cleared their first operational checks. NPL and VodafoneThree completed trials in April 2026 delivering NPL's traceable time to a 5G standalone network as a GPS alternative, maintaining accuracy within 40 nanoseconds. NPL's Time over eLoran project broadcast UTC(NPL)-traceable time over a UK eLoran transmitter, and tests at Strathclyde's Power Networks Demonstration Centre confirmed substations fitted with eLoran receivers could synchronise monitoring and protection systems with “no discernible difference in system performance”. A White Rabbit fibre link at the same university supplied nanosecond-level accuracy to a synchronised-measurement demonstrator. These are one- and two-site demonstrations, not fleet deployments.

Established The resilient architecture the United States published in 2021 is detailed, partly costed, and largely unbuilt. NIST Technical Note 2187 proposes time over optical fibre, where “ultimate accuracies well below 100 ns should be achievable with suitable calibration” and which is “entirely free from any reliance on satellite signals”; two-way satellite time transfer at capital costs “near $150 000 (2020 USD)” with the warning that “scaling TWSTFT services beyond a few tens of clients would be challenging”; and multi-source common-view disciplined clocks, of which “currently over 20 NISTDC units are in operation”. NIST's secondary time scales are steered within ±25 nanoseconds of UTC(NIST) and would accumulate about ±30 nanoseconds in the first month if the primary failed. The fibre pilot ran between Maryland, Virginia and Georgia.

Established The United States has decided, as policy, not to build a single national backup. The 2020 DHS report is explicit: “there is no single intervention that the U.S. Government can make to ensure risk elimination of a GPS disruption”, and backups “must be application-specific”. It named the flaw in its own recommendation: “There is no reason to assume users will adopt new non-GPS PNT sources more widely than they do today” without mandates or unique benefits. Six years later a House subcommittee hearing on 4 June 2026 was still describing the United States as lacking a backup.

Established The United Kingdom decided the opposite and put money against it on a published schedule. A ten-point framework in October 2023 created a National PNT Office in the Department for Science, Innovation and Technology and funded an initial timing centre proposal at £14 million. In November 2025 the government announced £155 million: £71 million for eLoran, £68 million for the National Timing Centre, £13 million for GNSS interference monitoring, £3 million for space-based time transfer research. In March 2026 it announced £180 million for the next NTC phase, two clock sites generating an independent national time scale distributed over fibre, internet and radio. The preceding R&D phase spent £62.7 million to March 2025 and built two resilient sites against a four-site design, plus two new caesium fountain primary standards.

Established The British procurement is dated, which makes it falsifiable. A market engagement notice for Build and operation of a nationally-owned UK eLORAN PNT system sets a contract period of 30 April 2027 to 31 December 2030, a “resilient, sovereign timing service” to critical national infrastructure from 2027, initial operating capability by early 2028 and full backup PNT from 2029. Those are checkable dates, and they are the only checkable dates in this subject anywhere.

Established Nobody has measured the thing the argument turns on. Every document read here measures a requirement, a device, a policy or a modelled loss. None reports an instrumented observation of what a metropolitan area's dependent systems actually do, in order, when the broadcast stops for days. January 2016 is the closest natural approximation and it lasted under 14 hours, affected a parameter rather than the signal, and was not instrumented at sector level. That gap is the spine of this brief and 7 specifies the test that would close it.

Established Canada appears nowhere in the measured record assembled here. The dependency measurements are American; the build-out is British; the governance lessons are European. No equivalent Canadian timing dependency assessment was located in any source fetched for this brief, and the absence is not evidence that the dependency is smaller. A country with no domestic constellation, a grid interconnected across a border, and financial and telecommunications systems specified against the same international standards has the same exposure and no published measurement of it.

Frontier What is the time-to-first-failure, per sector, in hours? This is the field's missing quantity and everything else is downstream of it. The inputs exist: sector tolerances (about 26 microseconds for synchrophasors, 1.5 microseconds for fourth-generation mobile, around 240 nanoseconds for fifth-generation), holdover performance (about 73 hours at one microsecond for disciplined rubidium), and the installed mix of oscillator grades. The product is a distribution, not a number, and no jurisdiction has published it. A first-order calculation would be worth doing publicly before anyone runs the exercise.

Frontier Is the holdover distribution long-tailed, and where is the left edge? The 8.8 per cent survival figure is a population statistic from one event, on a population selected for being monitored by a national metrology institute and therefore very likely better equipped than average. The systems of interest are the ones nobody monitors. Whether the left edge is “no holdover algorithm, free-runs on quartz immediately” — which TN 2189 says exists — and how much of the installed base sits there, is unmeasured and countable.

Frontier Does inter-sector coupling run in series or in parallel? In the parallel shape each sector degrades independently on its own holdover clock and consequences add. In the serial shape telecommunications fails first and takes with it the network paths the grid's monitoring, the exchange's connectivity and every remote alternative timing service depend on — including network and precision time protocol distribution, carried over the network whose synchronisation is failing. The serial shape is much worse and nobody has tested which obtains.

Speculative Does a wrong time propagate further than a missing one? The 2016 event supports the hypothesis: systems did not stop, they stepped. A stepped clock reorders an audit trail, biases a phasor angle, and degrades mobile handover before it breaks a call. Each produces bad data that is written down and acted on, where an outage produces an alarm. There is no measured comparison of the two failure modes' downstream cost, and building one is a plausible retrospective study on data that already exists.

Frontier Does the market-led approach produce diversity or a second monoculture? DHS predicted in 2020 that users would not adopt alternatives without a mandate or unique benefit. Five to six years of evidence are now available and nobody has scored the prediction. The natural test is the installed base: if alternative timing subscriptions are concentrated in a handful of large financial and telecommunications firms while small utilities and regional carriers remain GNSS-only, DHS was right and the FCC's 2025 inquiry is asking a question its own department already answered.

Established The first bottleneck is instrumentation, and it blocks everything else. A dependent system almost never logs the health of its own time source. A substation records phasor angles, not whether its clock is disciplined or in holdover; a trading venue records timestamps, not the oscillator state that produced them. In 2016 the only population-level record came from NIST, which happened to be monitoring about 80 clocks belonging to its own calibration customers at one-second intervals. Without a timing-health log at the point of use, an exercise could be run and its central result — which system failed first — would be unreadable.

Established Receiver diversity is routinely mistaken for source diversity. A multi-constellation receiver is more robust against a single constellation's ground-segment fault — the 2016 error was confined to GPS and the 2019 error to Galileo — and no more robust against anything affecting the whole signal class at a location. It is a real improvement against exactly the two failure modes in the documented record, which is a better argument than it usually gets, and it is not a fallback. The FCC's 2025 inquiry asks explicitly whether permitting additional foreign constellations would “improve accuracy and resilience while addressing national security concerns”: the technical answer is partly yes, the institutional answer is unresolved.

Established Holdover is a capital cost with no revenue line. The oscillator that buys three days of autonomy does nothing observable on any normal day and produces no service a customer will pay for. DHS named this in 2020: “Additional cost is a barrier to adopting...alternative services and disincentives system diversity.” This is the classic shape of an under-supplied public good, and better technology does not resolve it.

Frontier eLoran's constraint is siting and political durability, not physics. The system works and has carried traceable time into a substation; what it needs is high-power low-frequency transmitters on land, with the antenna sizes that implies, under a stable long-term operating mandate. NIST's architecture note sketched a United States coverage area from four transmitters. Britain is procuring a national system on a 2027–2030 schedule; a decade earlier the UK, France and Norway jointly abandoned the same technology. A question decided twice in opposite directions inside fifteen years is not an engineering question.

Frontier Fibre time transfer is limited by calibration and by reach, in that order. NIST expects “well below 100 ns” over fibre “with suitable calibration”, and the qualifier carries the weight: a one-way delay must be known, and the forward and return paths of a real telecommunications fibre are not identical. Every path needs measuring, and re-measuring after every reroute. The 40-nanosecond NPL result is the achievable end of this, on one network.

Frontier Optical clocks are not a near-term resilience technology, and the reason is uptime rather than accuracy. Precision Quantum Sensing carries the reliability scorecard; the short version is that availability, not uncertainty, disqualifies them from timekeeping duty. NIST's architecture note says only that plans exist to eventually integrate optical clocks into UTC(NIST). A sovereign timing programme that waits for them does nothing this decade.

Speculative Anomaly detection at the receiver is the cheapest unbuilt intervention. A clock that refuses a 13-microsecond step because its own oscillator predicts otherwise is a firmware behaviour, not a hardware upgrade, and would have contained the 2016 event at the edge. No conformance requirement in the read record obliges a timing receiver in critical infrastructure to sanity-check the broadcast against its own holdover, and no inventory exists of which products already do.

Established The last bottleneck is that the decisive measurement has never been scheduled. There is no technical obstacle: the instrumentation is off the shelf, the sectors are identifiable, the tolerances are published. What is missing is a body with authority to call an exercise, a legal basis for the notification and opt-out regime it requires, and a budget line. Every other constraint here could be relieved by money. This one cannot.

Established This brief depends on metrology it does not own. Everything here is stated relative to a realisation of UTC, and the machinery that produces those realisations is the subject of Metrology Infrastructure. That brief's central observation, that the unsolved half of the discipline is everything traded without a primary standard, does not apply to time: time has a primary standard, a treaty and a distribution problem. The dependency runs the other way from most of the corpus.

Established The clock physics is a hard dependency and a well-covered one. Precision Quantum Sensing carries the optical standards, the combs, the fibre-link scorecard and the scheduled redefinition of the SI second. It also makes the connection this brief inherits: power-grid synchrophasors, cellular networks and financial-market timestamping all free-ride on GNSS time, and terrestrial optical timescales with fibre distribution are the resilient alternative, arriving as a byproduct of a record-clock programme rather than as infrastructure anyone commissioned.

Established The grid limb depends on a live controversy about grid dynamics. Grids Without Inertia establishes that an inverter-dominated system's behaviour in the first hundreds of milliseconds after a fault is contested and under-instrumented. A grid moving toward inverter-based resources depends more on synchronised wide-area measurement, not less, so the timing dependency grows exactly as the underlying dynamics become less familiar.

Established The graph-theoretic method belongs to another brief and is imported here. Critical Dependency Atlas sets out the five primitives a cross-sector dependency map needs — typing, correlated failure, substitutability, recovery time, risk transfer — and finds each has been measured once, somewhere, never together. Timing is the cleanest available test case: the coupling type is unambiguous, the correlated-failure driver is a single broadcast, and the substitutes are enumerable. If the atlas method cannot work here it will not work anywhere.

Established Restoration behaviour is a dependency this brief cannot supply. Infrastructure Resilience establishes that the empirical distribution of time-to-restore has never been published despite sitting inside utilities. An exercise would produce a time-to-first-failure; converting that into a consequence needs the restoration distribution, and until someone publishes one the second half of the calculation stays modelled.

Established Space weather is a correlated driver for the broadcast and its backups. Space Weather Engineering carries the hazard calibration. Ionospheric disturbance degrades satellite ranging and terrestrial low-frequency propagation by different mechanisms on different timescales, which argues for pairing them; a severe event correlates them anyway, which argues for holdover underneath both. No joint availability model has been published.

Frontier The decisive experiment is a scheduled, announced, multi-day regional GNSS-denial exercise across a real metropolitan area, instrumented at every dependent system, measuring time-to-first-failure per sector. Nothing else would move the assessment as far. Every claim about cascading multi-sector failure currently rests on adding published tolerances to published holdover figures and assuming the arithmetic transfers to a real city. The exercise replaces an assumption with an observation, and it is the only instrument that can.

Established This is an availability test, not a vulnerability test, and the distinction sets everything about how it is run. The question is what dependent systems do when correct time stops arriving. How the absence is produced is a matter for the spectrum regulator and a national test authority, is not specified here, and is deliberately outside this brief's scope; nothing in this record is a method for interfering with a timing signal. The scientifically interesting variable is the response of the dependent estate, and it is identical whatever the cause.

Frontier The measurement plan is the hard part and has to be built first. Every participating system needs a timing-health log — source state, holdover entry time, offset estimate, alarm state — at one-second resolution against an independent reference, which is the instrumentation the 2016 event showed exists at national metrology institutes and almost nowhere else. Metrics must be pre-registered: time to first tolerance breach per sector, time to first operator-visible alarm, time to first customer-visible effect, and the gap between the second and third, which is the silent-error window.

Established The consent and safety regime is why this needs legislation rather than a research grant. An announced exercise requires a published notice period, a registry of participating and exempt systems, hard carve-outs for aviation, maritime navigation, emergency dispatch and clinical systems, a live abort authority, and legal immunity for operators whose participation reveals non-compliance. None of that exists in any jurisdiction described in these sources. The United States has had an executive requirement for a departmental critical-infrastructure PNT vulnerability testing plan since February 2020; nothing in the read record indicates it produced a metropolitan-scale instrumented exercise.

Established Three cheaper precursors would each retire real uncertainty. First, a national holdover census: a compelled or incentivised inventory of oscillator grade and holdover firmware across the three measured sectors, which converts the cascade question from unknowable to calculable. Second, a mandatory timing-incident register, so the next ground-segment fault produces a dataset rather than a trade-press reconstruction. Third, a retrospective multi-sector forensic of January 2016 — the logs are a decade old, some still exist, and the population response has only ever been analysed on one institute's calibration customers.

Established The single-facility version has already been run and published, which is why the metropolitan version is credible. TN 2189 reports a disciplined rubidium clock that maintained one-microsecond synchronisation for about 73 hours after its antenna was disconnected. That is the whole exercise at n equals one: remove the signal, log the drift, read the number. The step from there is not a new method but a larger and heterogeneous population, which is an organisational problem.

Speculative A natural experiment is running continuously and yields almost no usable data. Regional GNSS interference is a documented feature of several conflict zones and is reported through aviation and maritime channels as a matter of public record. It is the wrong instrument: affected areas are not instrumented at the level of dependent civil infrastructure, exposure is uncontrolled and undocumented, and no pre-registered metrics exist. An uncontrolled natural experiment nobody measured is not evidence, and treating it as such is the main way this subject gets overclaimed.

Frontier The firmware-versus-hardware decomposition is a small, cheap, high-value study. Seven of about 80 monitored clocks took no time step in January 2016. If that was oscillator grade, resilience costs hardware; if it was a receiver refusing an implausible correction, resilience costs a conformance rule. The NIST dataset that produced the 8.8 per cent figure is the right dataset, and the decomposition has not been published.

Established What the exercise would settle, as a falsifiable prediction. The cascade hypothesis predicts that in a metropolitan area denied correct GNSS time for 72 hours, at least one measured sector breaches its published tolerance inside 24 hours; that telecommunications breaches before the grid because its tolerance is roughly seventeen times tighter; and that operator-visible alarms lag tolerance breaches by hours in at least one sector. If all three fail — if everything rides out three days without a breach — the installed holdover base is far better than the documents suggest and the British programme is over-scoped. That is a real possible outcome and it is why the exercise is worth running.

Speculative The honest reservation is that an announced exercise measures the announced case. Operators told six months in advance will check their oscillators, so the result is an upper bound rather than an expectation. That is a known limitation of every announced drill and it is the correct trade: a measured upper bound beats an assumed central estimate, and the pre-exercise scramble is itself a useful intervention.

Established The architecture has four limbs and they can be built in any order. A domestic time scale, a non-satellite distribution path, holdover at the point of use, and monitoring that distinguishes wrong time from absent time. Britain is building all four; the United States has published a design for all four and built the time scale and parts of the monitoring. Holdover has the best ratio of hours bought to money spent.

Established The time scale is the least demanding limb and the most symbolically loaded. NIST's ensemble of 21 clocks has run for over 50 years, and its secondary scales are steered within ±25 nanoseconds and would accumulate about ±30 nanoseconds in the first month unsteered. Britain's National Timing Centre is two clock sites against a four-site design target, plus two new caesium fountain primary standards, from a £62.7 million R&D phase. Duplicating a national ensemble is a known problem with a known cost: tens of millions, not billions.

Established Distribution is where the money and the difficulty are. Time over optical fibre is technically strongest — below 100 nanoseconds expected by NIST, 40 nanoseconds measured by NPL into a 5G standalone network, nanosecond-level over a White Rabbit link at Strathclyde — and reaches only where fibre reaches, with a per-path calibration burden. Terrestrial low-frequency broadcast reaches everywhere within a transmitter footprint at much looser accuracy, and UK work shows it is good enough for a substation. The two are complements with almost no overlap in their failure modes, which is the strongest argument in the subject.

Established Holdover is specified by choosing a tolerance and a duration, which the published measurements make a table rather than a research problem. Against a 26-microsecond grid budget, rubidium buys days. Against a 240-nanosecond fifth-generation requirement it does not, and the operator needs caesium or a terrestrial feed. The specification question is not which oscillator is best but which sector requirement the site actually has, and that mapping is the deliverable no regulator publishes.

Frontier Monitoring has the worst ratio of importance to investment. Britain allocated £13 million of its £155 million package to GNSS interference monitoring, a little over eight per cent, and that is the largest identified monitoring line in any programme in this record. Detecting that a signal is wrong rather than absent requires an independent reference at the monitoring point — the same hardware the resilience layer needs. The two limbs share most of their cost and are usually funded separately.

Speculative The engineering requirement nobody has written is a timing-health telemetry standard. Every dependent system would need to emit a small uniform record — reference source in use, holdover state, time since last discipline, estimated offset, alarm — for the decisive experiment to be readable and for an incident register to mean anything. It is a modest piece of standardisation with no obvious owner, and it is the precondition for almost everything in 7.

Established Optical fibre time distribution has the strongest claim, because it exists as a commercial product in at least two countries. NPL sells a traceable time service into a research network and a mobile operator; NIST ran a fibre pilot between Maryland, Virginia and Georgia. The technology base is precision time protocol and its high-accuracy variants, including White Rabbit, which reached nanosecond-level accuracy in the Strathclyde grid demonstrator. This is an adjacent field that has already crossed into deployment and whose remaining problems are commercial.

Established Terrestrial low-frequency broadcast is an old technology being recommissioned rather than invented. NIST describes WWVB as able to maintain time accuracy at the one-microsecond level throughout long GPS disruption events, and its modernisation is on NIST's recommendation list. eLoran is the higher-performance version, and Britain has committed that UK eLoran time will be freely available to much of northern Europe, with France joining — the clearest case in the subject of a national programme producing a regional public good.

Established Low Earth orbit timing services are a fast-moving adjacent market. They deliver a stronger signal from a lower altitude, which makes indoor reception plausible, and they are subscription services. The relevant adjacency is structural rather than technical: a proliferation of commercial timing constellations changes the correlation of failures rather than eliminating them, which is the same observation Digital Chokepoints makes about cloud concentration.

Frontier Alternative navigation is adjacent and frequently conflated with this subject. Inertial, magnetic and map-matching techniques address position without satellites and do almost nothing for time: an inertial unit does not know what second it is. A national programme that funds alternative navigation and reports it as PNT resilience has addressed one letter of three, and the UK framework's separation of an eLoran positioning programme from a timing centre programme is the structurally correct treatment.

Speculative The adjacency that would matter most is insurance. If a carrier would price business interruption from timing loss, the price would be the first market-generated estimate of the consequence, and it would make holdover a cost-reducing purchase. No such product appears in these sources, consistent with the finding in Critical Dependency Atlas that risk transfer is the least developed dependency primitive.

Established The United States has an executive mandate, a published architecture, a regulatory inquiry and no appropriated fallback. Executive Order 13905, signed 12 February 2020, defines responsible use as “The deliberate, risk-informed use of PNT services... such that disruption or manipulation of PNT services minimally affects national security, the economy, public health, and the critical functions” of government, and set dated deliverables: PNT profiles from Commerce within a year, a vulnerability testing plan from Homeland Security within a year, and — the item that matters most here — a GNSS-independent source of Coordinated Universal Time within 180 days. NIST's two 2021 technical notes are the answer to that instruction.

Established The regulator moved in 2025 and the record is now open. The Federal Communications Commission adopted a Notice of Inquiry, Promoting the Development of Positioning, Navigation, and Timing Technologies and Solutions, WT Docket No. 25-110, circulated 6 March 2025 and announced 27 March 2025, stating that “relying on GPS alone as the primary source of PNT data leaves America exposed to a single point of failure”. It asks about geographic coverage, existing equipment, spectrum, range and precision, durability and cost. As of April 2026 a notice of proposed rulemaking was reported to be circulating internally.

Established Congress has held the hearings and has not legislated the backup. The House Energy and Commerce Subcommittee on Communications and Technology examined US positioning, navigation and timing capabilities on 4 June 2026, with members describing daily reliance on GPS and the absence of a backup. The reporting characterises the United States as having no congressionally mandated backup after a decade of hearings and studies. Core GPS funding has continued: over $2 billion in FY2022 and, for FY2026, $730.826 million in Defense plus $100 million in Transportation. The constellation is funded; the fallback is not.

Established The United Kingdom built an institution first and then bought hardware. The October 2023 framework created a National PNT Office inside the Department for Science, Innovation and Technology and set out a ten-point programme including a National Timing Centre, a sovereign eLoran system, a Ministry of Defence time capability described as a system of last resort, and a UK precise-point-positioning augmentation service to replace reliance on the European overlay. Money followed in stages: £14 million, then £155 million in November 2025 across four lines, then £180 million for the timing centre in March 2026. Whatever one thinks of the technology choices, the sequence — office, framework, staged funding, procurement notice — is the only complete institutional example in this record.

Established The European lesson from 2019 is about governance, not engineering. During the Galileo outage the operating agencies could not communicate independently: neither “is able to speak on its own initiative concerning the Galileo failure” under the structure then in force, and the first formal user notice came roughly 14 hours after onset. For timing users, notification latency is not a public-relations problem. It is the difference between entering holdover deliberately and discovering afterwards that a system ran on wrong time.

Frontier The free-rider structure is the institutional core of the subject. One country funds and operates the broadcast; the world reads it; no reader pays. Britain partially inverts this by distributing national time “free over the air, via the internet and through fibre networks” and by stating that UK eLoran time will be freely available to much of northern Europe, with France joining. That is a country supplying a regional public good, and the durability of that choice across governments is the open question, given that the UK, France and Norway jointly abandoned eLoran a decade earlier.

Established The regulatory hooks that exist are sectoral and were not written for this. Financial clock-synchronisation rules exist because of market surveillance; synchrophasor specifications because of measurement standards; mobile synchronisation requirements because of spectrum efficiency. None was written to manage a shared dependency, none obliges an operator to report a timing incident to anyone, and no regulator in this record requires disclosure of holdover capability. The instruments to compel a census already sit in three separate regulators' hands and have never been used for this.

Established Canada has no programme in this record, and that is the finding rather than an omission. No Canadian dependency assessment, timing centre programme, eLoran commitment or incident register appeared in any of the sources fetched for this brief. A legislator asking what Canada should do therefore starts from a weaker position than a British or American counterpart: not a contested policy but an absent measurement. The cheapest credible first act is the census described in 7, which needs no new hardware and could run under existing sectoral reporting powers.

Established This brief carries no interference methodology, and the omission is deliberate and complete. Nothing here describes how to degrade, deny or falsify a timing signal, and the decisive experiment is specified as an availability test whose denial mechanism is a matter for a spectrum regulator and a national test authority. Documented incidents are reported as public-record facts with their published parameters, because a legislator cannot assess a dependency whose failures are secret. The line drawn is between describing what happened and describing how to make it happen, and everything on the second side is absent by design.

Established The consent problem in the decisive experiment is real and solvable. A metropolitan exercise affects people who did not volunteer. The mitigations are ordinary civil-defence practice: long published notice, a registry of exempt systems, hard carve-outs for aviation, maritime navigation, emergency dispatch and clinical equipment, staged escalation with abort authority, and compensation for demonstrated loss. The comparison class is a planned grid islanding test, already run under existing law.

Frontier Operator liability is the obstacle nobody prices. An operator whose participation reveals it cannot meet a regulatory tolerance has produced evidence against itself. Without a statutory safe harbour, rational operators decline or harden specifically for the exercise window, and the measurement is worthless either way. Legislation authorising the exercise has to carry the immunity clause, and that clause will be the contested part of the bill.

Established Holdover is bought by the well-capitalised. A large exchange or tier-one carrier can afford caesium standards, multi-source clocks and a fibre time contract. A rural distribution utility, regional carrier or municipal water system cannot, and the fee-based structure of the alternatives — DHS's 2020 survey found every candidate available “for a fee” — widens the gap. A timing failure would not be experienced uniformly, and the places that would notice first are those with the least capacity to respond.

Frontier Publishing a dependency map is a genuine dilemma with an underrated answer. The security argument against publication is that it tells an adversary where to push. The argument for it is that both documented multi-day failures were accidents inside routine maintenance, that unmeasured dependency produced the present state, and that the parties who most need the map are operators setting a budget. The workable compromise is asymmetric disclosure: aggregate distributions published, site-level attribution withheld. That is standard practice in several other safety domains and is not standard here.

Established Time is where a wrong number becomes a wrong record. Financial audit trails, evidentiary timestamps, chain-of-custody logs and contract execution all inherit whatever the clock said. The 2016 event stepped clocks by roughly 13 microseconds for under 14 hours, small enough that most records stayed usable; nothing in the physics prevents a larger offset, and no sector regulator in this record requires an audit trail to carry evidence of its own time source's health. A record that cannot say how it knew the time cannot be challenged on that basis either.

Frontier The regime shift that matters is from outage to silent error. A civilization whose systems stop when time stops has a bad day and an obvious diagnosis. One whose systems continue on wrong time writes bad records, trades in the wrong order, mismeasures its own grid and finds out later, in reconciliation. January 2016 was the second kind, lasted under 14 hours, and roughly nine in ten monitored clocks took the step. Nothing in the record says what a week of the second kind looks like.

Established The asymmetry between operating the broadcast and surviving without it is the civilizational fact. The United States budgeted $730.826 million in Defense and $100 million in Transportation for GPS in FY2026 and has appropriated no comparable national terrestrial fallback. Britain has committed roughly £250 million in two announcements to timing and terrestrial backup. Both are small against a modelled loss of a billion dollars a day or £1.4 billion in 24 hours, which means either the loss figures are wrong or the spending is, and no measurement distinguishes the two.

Handwave The strongest form of the civilizational worry is unsupported and should be named as such. A picture in which a multi-day timing failure collapses settlement, communications and power together into a self-reinforcing failure has no measured support anywhere in this record. It is a coherent story built from real tolerances and real holdover figures, and it remains a story until someone runs the exercise. Stating it as a prediction is exactly the overclaim the flag system exists to prevent.

Speculative The counter-case deserves equal weight: the system may be far more robust than its critics assume. GPS has run for four decades with two documented multi-day service failures, one under 14 hours; operators have quietly bought holdover for their own reasons; multi-constellation receivers spread without any mandate. If a metropolitan exercise showed 72 hours with no tolerance breach, the correct conclusion would be that decentralised procurement worked and the resilience programmes are over-scoped. That outcome is live, and the exercise is what would establish it.

These horizons track measurement and procurement, not invention: nothing here waits on a device that does not exist.

• 10 yr: Established Britain's programme reaches its stated milestones or misses them publicly: a sovereign timing service to critical national infrastructure from 2027, eLoran initial operating capability by early 2028, full backup PNT from 2029, and the National Timing Centre's two clock sites in service. Frontier A US rulemaking follows the 2025 inquiry and either does or does not impose a conformance requirement on timing receivers in critical infrastructure, making the DHS adoption prediction scoreable. Speculative The first announced metropolitan GNSS-denial exercise is run somewhere, most plausibly in a jurisdiction that has already built the alternative it wants to test, and a time-to-first-failure distribution enters the literature for the first time.
• 25 yr: Frontier Time over fibre becomes an ordinary purchased utility for large infrastructure operators in countries with dense fibre, on the trajectory the 40-nanosecond mobile trial and the NIST fibre pilot indicate, while the last mile to distribution substations and regional carriers remains unsolved. Speculative Enough jurisdictions have run exercises that time-to-first-failure becomes a comparable statistic and a regulatory target, in the way restoration time is not yet for the networks in Infrastructure Resilience. Speculative Insurance pricing for timing-loss business interruption appears, supplying the first market-generated consequence estimate.
• 50 yr: Speculative The architecture inverts: terrestrial and fibre-borne national time becomes the primary reference for fixed infrastructure, with satellite timing the mobile and wide-area complement rather than the default. Speculative Holdover sufficient to ride out multi-day outages at sector tolerance becomes a standard specification rather than a premium option, driven by falling compact-clock costs originating in the programmes Precision Quantum Sensing describes. Handwave Whether any of this happens in jurisdictions that did not start in the 2020s is unknown; the mechanism by which such a policy diffuses to a country with no domestic metrology programme is described nowhere in this record.
• 100 / 250+ yr: Handwave Time distribution becomes a layered utility with no single privileged source, the way water and electricity supply did after their own single-source eras, and the present arrangement is remembered as a transitional accident of the late twentieth century. Handwave Off-Earth timekeeping, whose first requirements are being written now in Cislunar Navigation and Lunar Time, becomes routine, and relativistic corrections between reference frames become an ordinary engineering line item rather than a specialist concern.

• Depends on This brief depends on Metrology Infrastructure for the traceability chain every claim here is stated against, and on Precision Quantum Sensing for the clocks, combs and fibre links that make a domestic time scale possible at all. It borrows its method from Critical Dependency Atlas and its unresolved second half — how long restoration takes once something breaks — from Infrastructure Resilience. No result on this map blocks the engineering; the constraints below are institutional and they are the whole difficulty.
• Requires (not on this map) Six constraints, in order. First, a statutory authority able to schedule and indemnify an announced regional GNSS-denial exercise, because no body described in this record can currently call one. Second, a mandatory timing-incident register, so the next ground-segment fault produces a dataset rather than a trade-press reconstruction. Third, a timing-health telemetry record emitted by every dependent system — source in use, holdover state, estimated offset, alarm — without which the exercise is unreadable. Fourth, transmitter siting and, more importantly, durable operating mandates for terrestrial low-frequency broadcast, the technology three European states abandoned a decade before one of them recommissioned it. Fifth, a funding route that stops holdover being a pure cost to the operator, the mechanism DHS predicted would block adoption and nobody has built. Sixth, the scientific result nobody is producing: a measured time-to-first-failure distribution per sector, which is the decisive experiment this brief turns on.
• Enables Delivers to Grids Without Inertia, whose wide-area measurement and protection become more timing-dependent exactly as the underlying dynamics become less familiar, and to Critical Dependency Atlas, for which timing is the cleanest single-variable test of whether the atlas method works at all.
• Adjacent Adjacent to Digital Chokepoints, which makes the same argument about concentration changing the correlation of failures rather than their rate; to Space Weather Engineering, which supplies the correlated natural driver for the broadcast and its terrestrial alternatives at once; to Infrastructure Resilience for restoration behaviour; and to Cislunar Navigation and Lunar Time, where the same architecture is specified from scratch with the disconnection requirement written down explicitly.

Handwave “A multi-constellation receiver solves the problem.” It helps against the two failure modes actually in the documented record — a GPS ground-segment fault in 2016 and a Galileo ground-segment fault in 2019 — which is more credit than the claim usually gets. It does nothing about anything affecting reception of the whole signal class at a location, and it leaves the receiver reading space. Treating the partial answer as the whole answer is the misconception.

Established “A GNSS timing failure means a blackout.” No. Losing synchrophasor synchronisation degrades wide-area measurement and some protection functions; it does not de-energise a grid, which runs on local protection and control that needs no satellite. The honest concern is loss of visibility and mismeasurement when operators most need both, and the effect worsens on a grid that has come to rely on wide-area measurement, which is the direction Grids Without Inertia describes.

Frontier “eLoran is a proven off-the-shelf backup.” It has carried traceable time into a substation with no discernible performance difference against existing methods, a real result at one site. Britain is procuring a national system with initial capability targeted for early 2028 and full capability from 2029, which is a schedule, not a deployment. A decade earlier the UK, France and Norway abandoned the same technology. Both the capability and the political fragility are established; the national-scale performance is not.

Handwave “Nobody noticed in 2016, so the system is robust.” Roughly nine in ten monitored clocks took a 13-microsecond step; digital radio broadcasting was disrupted in the United Kingdom; a timing-support firm with clients in more than 50 countries logged nearly 2,500 alarms at a single customer; radio observatories on three continents recorded it. What did not happen is a visible public failure, which is what a 13.7-microsecond error for under 14 hours predicts. Robustness is a claim about a larger or longer event that has not occurred.

Established “The threat is jamming and spoofing.” Those are real, documented, and the subject of a dedicated British monitoring line. They are also not what caused either documented multi-day global failure, both of which originated in ground-segment maintenance by the system operators themselves. An architecture designed only against hostile denial optimises for the failure mode with no global precedent and under-weights the one with two.

Frontier “A billion dollars a day is a measured number.” It is modelled, repeated often enough to acquire the texture of a measurement. So is the £1.4 billion per 24 hours figure. No estimate in this record is calibrated against an observed multi-day denial, because there has not been one — the same gap the decisive experiment exists to close. The figures order magnitudes and should not justify a budget to two significant figures.

Handwave “Canada is covered because it is next to the United States.” Nothing in this record supports that. American resilience investment is in national time scales and pilot distribution links inside the United States; the broadcast both countries read is the same one; and there is no described mechanism by which a US terrestrial fallback, if built, would reach a Canadian substation. The claim is not merely unsupported, it is unexamined.

Handwave “The cascade is obvious; the exercise is a formality.” This is the misconception this brief most wants to correct, because it is held by people sympathetic to the subject. The arithmetic looks compelling and it is arithmetic: published tolerances divided by published drift rates, applied to an installed base nobody has surveyed. Two of the three quantities are measured and the third is assumed. Whether the cascade happens, in what order and on what timescale is exactly what nobody knows, and 7 says what would settle it.