Grid Lockdown operates across the Purdue model layers, exploiting the historically unmonitored boundary between Level 3 (site operations) and Level 2 (supervisory control). The weapon maps the SIS topology, disables trip points, then encrypts the HMIs and engineering stations — leaving operators blind to a process that has been deliberately pushed past safe operating limits.
The May 2027 incident at a regional water authority demonstrated the full sequence: chlorine dosing was ramped beyond potable limits while the SCADA displays froze at nominal values. Operators did not realize the discrepancy until field technicians reported physical sensor readings. The encryption demand arrived 40 minutes later, timed to the moment of maximum physical consequence.
This is not extortion — it is leverage calibrated against the threat of physical harm. The ransom is paid not to recover data but to halt a process that is, invisibly, already failing.