Georgia Investigates ‘Sabotage’ After Two National Blackouts: Security Threat—or a Grid Failure Still Without an Answer?
Georgia’s State Security Service has opened a sabotage investigation after nationwide outages on July 24 and 25. A major transmission-line disconnection is one technical lead, but opening a criminal case does not mean deliberate interference has been proven.
Georgia’s State Security Service has opened an investigation under the country’s criminal-law provision covering sabotage after two nationwide electricity failures on July 24 and July 25.
The outages disrupted power across Tbilisi and multiple regions, affected the metro, communications and water-pumping systems, and extended into the breakaway region of Abkhazia.
The investigation is real. Sabotage has not been established.
This distinction is essential because the legal article under which investigators open a case describes the suspected category of conduct. It does not announce the final cause.
Georgia’s security service said it would examine whether the repeated emergency shutdowns involved deliberate interference intended to threaten state interests.
Officials have not released evidence showing explosives, cyber intrusion, insider manipulation or foreign involvement.
A technical explanation remains possible.
Levan Mebonia, director of the Enguri Hydroelectric Power Plant, said the country’s 500-kilovolt Imereti transmission line disconnected while carrying a very large load. According to his explanation, the loss of that line disrupted the operating regime and caused the entire energy system to collapse.
He emphasised that the transmission line was not under the hydroelectric plant’s direct control.
That statement provides a plausible sequence but not a complete root-cause analysis.
A transmission line can disconnect because of equipment failure, overheating, protection-system action, human error, weather, vegetation contact, cyber manipulation or deliberate physical interference.
Investigators must determine not only which component tripped, but why.
The first major outage occurred shortly after midnight on July 24. The second followed on the morning of July 25, after power had been restored.
Repeated failure is more concerning than a single accident because it suggests that the system remained unstable, the original fault was not fully understood or another disturbance occurred.
It does not automatically suggest an attacker.
Modern electricity grids require constant balance between generation and demand. When a major transmission line fails, power flows rapidly shift to other lines. Automatic systems may disconnect generators or regions to prevent physical damage.
A protective shutdown can therefore make an accident look like a coordinated nationwide attack.
Restoring the grid also carries risk.
Operators must reconnect generators and demand gradually. If too much load returns before the network is stable, frequency or voltage can collapse again.
Georgia’s grid has several strategic vulnerabilities.
The country depends heavily on hydropower, including the Enguri complex, whose infrastructure spans territory controlled by Tbilisi and Abkhazia’s de facto authorities. It also exchanges electricity with neighbouring systems.
These links provide flexibility but can transmit disturbances across a wide area.
The outages affected water because pumping stations depend on electricity. Mobile and internet services also suffered where backup systems were exhausted or overloaded.
This demonstrates why a grid failure is a national-security event even when no sabotage occurs.
Electricity supports hospitals, transport, banking, communications and public order. A repeated blackout can create political instability without an explosion or armed attack.
Georgia’s political environment will make the investigation controversial.
Government supporters may suspect hostile foreign actors or domestic opponents. Critics may argue that the sabotage investigation is designed to distract from poor maintenance, corruption or inadequate energy planning.
Both conclusions are premature.
A credible investigation should include independent engineers, grid logs, protection-system data, equipment inspections and cybersecurity analysis. The findings should explain the chain of failure in language the public can understand.
Transparency is especially important because several institutions initially offered different explanations. Abkhaz authorities pointed toward Enguri. Georgian sources highlighted the Imereti line. The state grid company said the cause remained under investigation.
These statements may describe different parts of the same cascading event rather than contradict one another.
The sabotage inquiry should not become an excuse to withhold technical information.
Security agencies may need to protect sensitive details, but the public has a right to know whether infrastructure was poorly maintained, whether backup systems functioned and whether utilities had prepared for the loss of a major transmission line.
The investigation may ultimately find deliberate intervention. Critical infrastructure is a recognised target for intelligence services, political extremists and cyber actors.
It may instead reveal a conventional failure amplified by a fragile network.
The open question is not simply whether someone attacked Georgia’s power grid. It is whether the country can identify and repair the weakness that allowed one disturbance—intentional or accidental—to shut down electricity nationwide twice in less than two days.