Since Tuesday, November 10, Poland's national ePUAP platform has been down after the Ministry of Digital Affairs disconnected the entire system in response to a detected cyberattack. A three-day paralysis of a key public service, met with near-total media silence, is a dangerous warning sign for critical infrastructure.
Table of Contents
Why is it so quiet when we are facing a catastrophe? ePUAP (Poland’s Electronic Platform of Public Administration Services) has been down since Tuesday, November 10, when the Ministry of Digital Affairs disconnected the entire system itself following a detected cyberattack. Both for citizens and for public offices. There is no estimated time of restoration, and the website simply displays a banner about “maintenance work.” The media do write about it, sure—somewhere on page two or three. In my opinion, this should be a breaking-news red ticker with an exclamation mark.
Why is this a catastrophe? Because it is happening in a country that prides itself on the progress of its digital services and on having the most innovative solutions. The mObywatel app with 12 million users, single sign-on via the Trusted Profile (Profil Zaufany), document signing, sending and receiving official correspondence via ePUAP and e-Delivery (e-Doręczenia). And now, for several days, individuals and businesses have been cut off from their ePUAP inboxes. Formally, e-Delivery is working, but this morning I couldn’t log in—I don’t know whether due to a malfunction or server overload. I only managed to get in around noon, both to my business and personal accounts, and some subpages of the service still won’t load.
The Fiction of Service During an Outage
Meanwhile, statutory deadlines are ticking and administrative proceedings are underway. If someone hasn’t downloaded their correspondence history and needs an official reply or a proof of filing or receipt, they have a problem. It is roughly equivalent to the Polish Post (Poczta Polska) shutting down. For that matter, the public e-Delivery service is provided by none other than the Polish Post as the designated operator.
The legal fiction of service (fikcja doręczenia) continues to operate as if nothing happened. A letter left uncollected for 14 days is legally deemed delivered, and statutory deadlines start running from that moment—an outage does not automatically extend anything. Of course, one can later invoke the Code of Administrative Procedure (KPA) and file a motion to restore the missed deadline, but why should the citizen have to make excuses for the failure of a state-run system? And what is a public office supposed to say when it faces its own statutory deadline to respond, while its ePUAP inbox is also switched off? The Gdańsk City Hall stated outright that both ePUAP and the Trusted Profile are unavailable until further notice.
From what I can see—having checked only cursorily—part of the technical layer of ePUAP is still responding (API), so perhaps only the web interface was disabled. Specialists will certainly determine that. Regardless of the technical details, what matters is the effect—and the effect is paralyzing in a country where, just a few months ago, entrepreneurs were receiving urgent notices that they had until the end of September to set up a mandatory digital business inbox.
Suppose someone decided they would read a letter tomorrow, or wait until the last minute to reply to an official notice—which they have every right to do—and respond in the evening via ePUAP, just as they had corresponded in the case from the very beginning. Or the next day, because why wouldn’t it work for days on end… Well, now there’s a problem: it doesn’t work, and nothing can be sent. The only option left is to drive to the post office and mail a physical envelope with return receipt requested, just like in the good old days, and then clip the proof of mailing into a ring binder along with a copy of the letter. Long live progress.
The “Administrative Bomb” and Questions About Risk
It is also worth asking where the people responsible for risk assessment and implementing these solutions were. It has been known for several years that key public services would be a primary attack vector in hybrid warfare, including operations conducted via criminal groups acting as proxies. The Minister himself says the attack came from abroad and was preparation for an “administrative bomb” meant to paralyze public offices in December. He also claims that the system was not breached, while simultaneously stating that logs show someone was conducting preparations inside it. One of those two statements requires clarification.
Today I came across an interesting, slightly paranoid article. The local outlet Radio DTR went a step further and, in a piece titled “A Digital Time Bomb?”, asks whether the entire operation was detected or only a fragment of it, and whether something dormant is lying in other systems waiting for December. It is alarmist journalism without hard facts, as the authors themselves admit. In my opinion, however, this paranoid theory has one virtue: it gives decision-makers food for thought and may soon be falsified (I am referring here to testing in the context of paranoid conspiracy theories, in the scientific sense)—that is, either confirmed or refuted. Hopefully the latter.
ePUAP Is Only a Sample
Because ePUAP is only a sample. Key services also include banks. Imagine that, just like during COVID, you cannot physically withdraw your money (back then, at Bank Millennium, I couldn’t withdraw foreign currency from my own account), or for a week you cannot make a wire transfer. An attack that, according to the Minister, did not succeed was enough to shut down a national platform for three days. If someone doesn’t understand how serious this is, I don’t know what will be serious enough. Cutting off Netflix?
I hope I am wrong, but I have a feeling that sooner than we think we will have to test the recommendations from the #beReady (wGotowości) training courses in practice—a supply of water, food, fuel, and cash for several days of being cut off from the system. And hopefully we won’t have to watch scenes of panic like those from the COVID era, when it finally dawns on us what in our lives and in the state is truly critical infrastructure, and what is merely a convenient toy.
