April 12, 2025
0900L – 1200L
Scenario
A series of tornadoes unpredictably impacts many regions within Florida,
leaving infrastructure damaged and communities in need of emergency
response. To heighten the challenge, cyber attackers from hostile nation-
states launch a coordinated attack, crippling the state’s internet
infrastructure and further complicating rescue and recovery operations. This
exercise will test participants’ ability to coordinate cross-agency responses,
communicate under severe operational constraints, and deploy emergency
communication strategies effectively without traditional digital networks
Injects
The following injects will be assigned to participants that check into the ARES net during the exercise.
It is very important to use the phrase
this is a drillat the beginning and end of the any communication that contains information concerning the situation of the inject. This is so that any third party that is listening does not react or think that the inject is a real world message.
- Inject #1: Volusia Eastside
- Inject #2: Volusia Westside
- Inject #3: Volusia Eastside
- Inject #4: Volusia Westside
Participating Organizations
- Florida Division of Emergency Management
- Counties
- Alachua County
- Brevard County
- Columbia County
- Duval – Jacksonville
- Miami-Dade
- Escambia County
- Gilchrist County
- Hillsborough County
- Marion County
- Pinellas County
- Santa Rosa County
- Sumter County
- Suwannee County
- Volusia County
- Walton County
- Bay County
- Lake County
- Nassau County
- Sumter County
- US Coast Guard Auxiliary
Scenario Details
Tensions have continued to rise between the United States and nation states with adversarial relationships toward the U.S. In recent months, Florida has experienced an uptick in cyber-based probing attacks targeting key telecommunications infrastructure and essential services. While these intrusions have caused only minor disruptions to date, cybersecurity experts have warned that they could be reconnaissance efforts for a larger, coordinated assault.
On April 12, 2025, at approximately 0900 ET/0800 CT, an unexpected outbreak of severe thunderstorms begins to sweep across Florida, bringing intense lightning, heavy rain, and strong winds. As the storms intensify, multiple tornadoes rapidly form and touch down in various regions of the state, causing widespread destruction. These tornadoes result insignificant damage to critical infrastructure, including power lines, cell towers, transportation networks, and residential areas.
While emergency services scramble to respond to the storm-related destruction and the aftermath of the tornadoes, the situation escalates. Following the severe weather activity Florida experiences a catastrophic cyber-attack. Internet services statewide are abruptly disabled, and within minutes, the outages spread to cellular networks, disrupting traditional voice communications as well. The timing suggests a deliberate, coordinated assault designed to exploit the chaos caused by the severe weather and tornado outbreaks.
Panic ensues as residents attempt to reach loved ones, contact emergency services, and secure supplies. Gridlocked roads develop around major urban centers as people rush to purchase fuel, food, and emergency goods. Banks become overwhelmed with customers attempting to withdraw cash, fearing the failure of digital payment systems.
County and State Emergency Managers initiate Level 1 activation protocols, opening emergency shelters for displaced individuals and those without access to basic necessities. Amateur radio operators, SHARES, and AUXCOMM volunteers are mobilized to provide emergency communication support at shelters, hospitals, and Emergency Operations Centers (EOCs) due to the widespread failure of traditional communications systems.
Citizens seek to send messages out of state are directed to these operators where capacity allows.
The Governor declares a state of emergency, and the Florida Division of Emergency Management (FDEM) issues an urgent broadcast over amateur radio frequencies. They request situation reports from operators throughout Florida, utilizing both voice communication and the Winlink messaging system. Statewide communication nets are established to facilitate coordination between county EOCs and the State EOC.
Due to the widespread communications impacts, Florida MARC units are directed to establish communications hubs regionally throughout the state. AUXCOMM volunteers are directed to assist State personnel in the setup and operations of these communications resources. They will relay communications as well work to establish communications with county and State Emergency Operations Centers.
Partner organizations such as the Cybersecurity and Infrastructure Security Agency (CISA) offer support to FDEM, deploying specialized communication teams to assist with re-establishing critical links.
Participants in Cyberstorm will face the dual challenge of responding to both natural and cyber-induced disasters, including tornado outbreaks and cyber-attacks. This exercise will test their ability to adapt, communicate, and coordinate effectively in a complex, rapidly evolving crisis.