A city is a machine that has to be fed every day, and most of the emergency services inside it are built on the assumption that the feeding continues. When resupply stops, the failures do not arrive in the order the plans expect: firefighting water goes before drinking water, hospital diesel goes before hospital staff, and the dispatch center loses the ability to hear about an incident before it loses the ability to respond to one. This piece works through what the documented sieges of Leningrad, Berlin and Sarajevo show about that sequence, and what a peacetime emergency manager can take from it.

The tonnage a city eats every day

The Berlin blockade gives the cleanest arithmetic in the record because somebody had to calculate it under pressure and then deliver against the calculation. The Soviet authorities closed the surface routes into the western sectors in June 1948, the airlift began within days, and the blockade was lifted on 12 May 1949 while flights continued into that September. Allied planners had to work out the daily minimum tonnage for a population usually given as between two and two and a half million people, and the early estimates landed in the range of four to five thousand tons a day, which was later exceeded by a wide margin. The published totals for the whole operation come to roughly 2.3 million tons, with figures near 2.32 million commonly cited, and coal rather than food made up around two thirds of that weight.

That proportion is the part worth carrying away. A city under siege is not primarily hungry for food, it is hungry for energy, because heat, water pumping, sewage pumping, hospital power, bakery ovens and vehicle movement all draw on fuel that arrives by pipeline, rail, barge or truck and cannot be improvised locally in any quantity. West Berlin also lost the electricity it had been drawing from generating plants in the Soviet sector, so power in the western sectors was rationed to a few hours a day, often at night, while components for a new power station were flown in piece by piece. The single busiest day of the airlift, 15 to 16 April 1949, delivered nearly 13,000 tons in something close to 1,400 flights, which tells you how much aviation it takes to substitute for a rail line.

Leningrad shows the other end of the range. The land blockade closed on 8 September 1941 around a civilian population usually given as about 2.5 million, and from 20 November 1941 the bread ration for dependents and children fell to 125 grams a day, with manual workers at 250 grams. The ice road across Lake Ladoga, remembered as the Road of Life, began carrying truck convoys in late November 1941 and never approached the tonnage the city needed, which is why the mass deaths clustered in the winter of 1941 to 1942 rather than at the end of the 872 days.

Firefighting water when the pumps stop

Municipal water pressure in most cities is manufactured continuously by electric pumps, sometimes supported by elevated storage, and the storage is generally sized around a day of average demand plus a fire flow allowance rather than around a week of siege. Once the pumps stop, the tanks drain at whatever rate the system is still leaking and consuming, and broken mains from shelling, earth movement or freezing accelerate that considerably. When pressure falls to zero the distribution network also stops being a sanitary barrier, because groundwater and sewage intrude at the breaks, so the drinking water problem and the firefighting problem arrive at the same moment from the same cause.

The fire service arithmetic is unforgiving. A single handline flows in the range of 150 to 200 gallons per minute, a master stream runs from 500 to well over 1,000, and a working fire in an occupied multi-family building can absorb more than 1,000 gallons per minute for an extended period. An engine carrying 500 gallons of tank water supports one handline for about three minutes, which means that without a hydrant the entire operation depends on relay pumping from a static source, a tender shuttle, or a portable dam arrangement that somebody has to have practiced. In Leningrad the water and sewer systems had largely failed by late January 1942, and residents and crews drew water from holes cut in the ice of the Neva and the city canals, with fire companies working from static sources while their own members were dying of starvation.

Sarajevo lost water for a different reason with the same effect, because the pumping stations that fed the city sat in or beyond the confrontation line and their electricity was intermittent for most of the 1,425 days from April 1992 to February 1996. Residents queued at springs, standpipes and the brewery well and carried water by hand, utility crews repaired mains under fire and some were killed doing it, and international agencies supplied fuel and parts to keep pumps turning. When the National and University Library burned in late August 1992, accounts of the fire describe crews coming under fire, hose lines being cut and water being unavailable in useful quantity, which is the practical picture of what a fire department becomes when the hydraulic system behind it is gone.

Hospitals, generator fuel, and the water nobody counted

American hospitals hold on-site diesel in the range of one to four days at emergency load, and the exact number is a design decision made years earlier by an engineer working to a code minimum and a site constraint rather than to a siege scenario. Accreditation expectations push facilities to assess their ability to sustain operations for 96 hours without outside support, and the Centers for Medicare and Medicaid Services emergency preparedness requirements oblige providers to plan for fuel and alternate energy, so the paperwork usually exists. Verify what your local hospitals actually hold with their facilities engineer and their accrediting body rather than with a plan annex, because the tank capacity written into a 1998 drawing set and the tank capacity in the ground in 2026 are not always the same figure.

The dependency that surprises people is water. Generator cooling, chillers, sterile processing, dialysis, boilers and laundry all draw on the municipal supply, so a hospital with three days of diesel and no water is not a hospital with three days of capability. Hurricane Sandy demonstrated the placement problem in New York on 29 October 2012, when flooding of basement fuel pumps and switchgear forced evacuations reported at the time as roughly 300 patients from NYU Langone and several hundred more from Bellevue over the following days, and those were institutions with generators, fuel and a functioning region around them. In a besieged city there is no receiving facility to evacuate to and no tanker coming from the next state.

Kosevo hospital in Sarajevo operated for years on intermittent power, rationed water, and surgical supplies that arrived by airlift and convoy, with surgery performed under emergency lighting during outages and sterilization constrained by both fuel and water. Relief agency reporting from the siege describes rising diarrheal disease and hepatitis A associated with water quality and crowding, which is the pattern that shows up in almost every siege record: the trauma from weapons is visible and countable, and the deaths from water, cold and interrupted chronic care accumulate underneath it.

Reporting a fire when the phones are gone

The dispatch center is usually described as the thing that dispatches, but its first function is hearing about incidents, and that function rests on a telephone network with its own power problem. Central office batteries and cell site batteries are typically sized for hours rather than days, generators at those sites need the same diesel everyone else needs, and microwave and fiber paths get cut by the same shelling or ground movement that broke the water main. Once the reporting path fails, the call volume a center sees drops sharply while the actual incident rate rises, and an unwary command staff reads the quiet radio as an improvement.

Sieges solve this with human channels. Citizens walk to the nearest fire station or aid post, agencies pre-designate those locations and mark them, runners and bicycle couriers move written traffic between nodes, and amateur radio operators carry what the public networks no longer will, as contemporary accounts of Sarajevo document for personal messages moving out of the city. Leningrad ran the opposite direction as well, using the city’s wired radio network and street loudspeakers as the public alerting channel, with a metronome tone between broadcasts that signaled the network itself was still alive. That is a genuinely instructive piece of design, because it gave the population a continuous, cheap, verifiable indication that the civil authority was still functioning.

The other change is in what gets dispatched at all. Routine call handling assumes that every request generates a response, and under siege the center has to run a published prioritization scheme in which whole categories receive advice, a delayed response, or nothing. That decision belongs to a named official under written authority rather than to a call taker improvising at three in the morning, and the categories should be written before the event, because the version drafted during the emergency will be defended afterward by people who were not there.

Crisis standards of care and defensive-only firefighting

American medicine has an established vocabulary for this shift, developed through the Institute of Medicine’s 2009 letter report on establishing crisis standards of care and its 2012 systems framework volumes, which describe a continuum from conventional through contingency to crisis operations. Under conventional operations the sickest patient receives the most resources. Under crisis standards the goal becomes the largest number of survivors from the resources that physically exist, which changes ventilator allocation, changes who goes to an operating room, and changes documentation and legal protection in ways that have to be authorized by a state health authority rather than assumed by a hospital. The reports are worth reading directly, and your state health department should be able to tell you what its own crisis standards plan says and who activates it.

The fire service equivalent is less formalized and just as consequential. When water supply cannot support interior operations, the strategy becomes protecting exposures, creating separation between buildings, and letting involved structures burn, which is the same logic behind historical firebreaks applied under a supply constraint rather than a manpower one. Somebody has to hold the authority to declare that posture for the whole jurisdiction, because a company officer who makes that call alone will be second-guessed, and companies that continue interior attack on the last of the tank water leave nothing for the incident that matters more an hour later.

Preserving systems ahead of individuals is the whole of siege civil protection, and Leningrad is the clearest illustration. Bread production was the one distribution system the city could not lose, and accounts of the winter of 1941 to 1942 describe bakery water being maintained from the river when the mains were dead, because a bakery that stops does not resume quickly and its failure is measured in the whole population rather than in the people standing in front of you. The same reasoning applies to water treatment chemicals, to the fuel that keeps sewage lift stations running, and to the mechanics who keep pumps and generators alive.

Corridors, convoys, and who is allowed to deliver

Every documented siege that ended with a surviving population had a corridor, and the corridor was always inadequate and always contested. Leningrad had the Ladoga ice road in winter and barge traffic in the open season. Berlin had three air corridors and eventually three airfields, with Tegel constructed during the operation itself. Sarajevo had the UNHCR-led airlift that ran from July 1992 to January 1996 and is generally described as the longest humanitarian airlift on record, with published accounts putting the delivery near 160,000 tonnes on roughly 13,000 flights, and it had a hand-dug tunnel under the airport runway, completed in July 1993 and usually described as around 800 meters long, with sources differing on the exact figure.

Access is a legal question as well as a logistical one. Additional Protocol I to the Geneva Conventions prohibits starvation of civilians as a method of warfare and protects objects indispensable to civilian survival, naming drinking water installations and supplies among them, and the parallel provision in Additional Protocol II applies to non-international armed conflict. The Rome Statute was amended in 2019 to extend the war crime of starvation of civilians to non-international conflicts. Read the treaty text and the current commentaries from the International Committee of the Red Cross rather than a summary, mine included, because the operative conditions and exceptions matter and I am describing the shape of the law rather than reciting it.

For a civil protection planner the practical lesson is that the corridor is a negotiated object with a throughput, a schedule, an inspection regime and a set of actors who control it, none of which the receiving agency commands. That means the local authority’s job is prioritization of what comes in and control of what happens to it once it lands, which is warehousing, security, distribution lists, and a defensible record. Contemporary sieges are live events with contested numbers, so I am not putting figures from Mariupol or Gaza into this article; go to the current United Nations and ICRC reporting and read the methodology sections before you cite anything from them.

Why siege death tolls do not settle

Leningrad is the largest disputed toll in the modern record. The Soviet figure presented at Nuremberg gave roughly 632,000 civilian deaths from starvation plus around 17,000 from bombardment and shelling, while later historians working from burial records, evacuation data and population accounting have argued for a substantially higher number. David Glantz and Anna Reid, among others, put the civilian toll in the range of roughly 800,000 to over a million, and the range is genuine rather than a matter of one source being careless. Deaths during evacuation, deaths of people who were not registered residents, and deaths recorded under other causes in a city where record keeping itself collapsed all move the number.

Sarajevo is disputed for different reasons. Demographic evidence prepared for the International Criminal Tribunal for the former Yugoslavia by Ewa Tabeau and colleagues counted on the order of 14,000 people killed in the Sarajevo siege area, of whom roughly 5,000 to 6,000 were civilians, while the Sarajevo-based Research and Documentation Center’s count of city residents killed produced the figure of 11,541 that was used for the row of empty chairs laid along the main street for the twentieth anniversary in 2012. Those numbers are not measuring the same population, since one counts a geographic siege area including combatants on both sides and the other counts residents of the city, which is exactly the kind of definitional difference that produces apparently contradictory headlines.

None of these counts capture the indirect deaths well, and the indirect deaths are usually the majority in a siege. A diabetic who dies because insulin stopped arriving, an infant who dies of diarrheal disease from a depressurized water main, and an elderly resident who dies of cold in an unheated apartment appear in vital statistics as ordinary causes if they appear at all. When you write about tolls, give the range, name who publishes each end of it, and say plainly what each figure is counting.

What transfers to a city cut off without a war

No American emergency manager is planning for artillery on the ring road, and that is not the point of studying sieges. The transferable condition is isolation with degraded utilities for a duration measured in weeks, which arrives through a major earthquake that drops the bridges, a hurricane that closes the port and the fuel terminals, a prolonged regional grid failure, or a cyber incident that takes down the systems that schedule and bill freight. Puerto Rico after Hurricane Maria in September 2017 ran hospitals on generators for weeks while diesel moved by prioritized convoy over a damaged road network, and the constraint was distribution and fuel rather than the existence of supplies.

Water systems produce the same failure regardless of the cause. Christchurch, New Zealand, lost large portions of its water and wastewater network to liquefaction in the February 2011 earthquake, with residents on tankered water and chemical toilets for an extended period, and the fire service worked with a compromised hydrant system. The lesson for a fire department is that the static water source survey, the drafting site inventory, the portable dam capability and the relay pumping practice are the parts of the plan that hold when the pressurized system does not, and they are the parts that get deferred because they are inconvenient to drill.

The organizational lesson is about authority and sequencing. Someone has to be empowered in advance to move the jurisdiction from responding to every call to protecting the systems that keep the population alive, which means bread and water and sewage and the hospital, and someone has to tell the public honestly what is being protected and what is not. That decision is easier to defend if it is written into an existing plan, exercised once, and briefed to elected officials while there is still fuel in the tanks.

What to do at your agency

• Ask your water utility’s operations manager for a written statement of how many hours of usable storage the system holds at average demand with no pumping, where each elevated tank sits, and which pump stations have on-site generation with what fuel capacity.
• Have the fire chief or training officer produce a current static water source list for the response area, with drafting access verified in the field this quarter for at least three sites, and get that list onto the apparatus and into the pre-plan system rather than in a binder at headquarters.
• Ask the facilities engineer at each hospital in your jurisdiction for the generator fuel volume in gallons, the measured burn rate at emergency load, the resulting hours, and a plain answer on whether generator cooling, chillers or sterile processing depend on municipal water pressure.
• Run one relay pumping or tender shuttle evolution with a flow meter or pitot reading, record the gallons per minute actually delivered at the nozzle, and put that number in the training record so the next incident commander is planning against a measurement instead of a hope.
• Add one item to an officer meeting already on the calendar: name the position that authorizes jurisdiction-wide defensive-only firefighting when water supply fails, and write that authority and its notification path into the existing emergency operations plan as a single paragraph.
• Have the communications manager designate and placard walk-in incident reporting points at staffed stations, brief the crews on how to log and relay a walk-in report, and test the process once during a shift with a simulated citizen report.
• Ask your state health department for its current crisis standards of care plan, confirm who activates it and what legal protections it invokes, and record the answer in your EOC’s medical annex with the date you received it.

Takeaways

• The Berlin airlift delivered roughly 2.3 million tons between June 1948 and September 1949, with coal making up around two thirds of the weight, which shows that a besieged city’s dominant requirement is energy rather than food.
• Leningrad’s bread ration fell to 125 grams a day for dependents and children from 20 November 1941, and the mass deaths clustered in that first winter rather than at the end of the 872 day blockade.
• Firefighting water fails before drinking water becomes scarce, because pressurized distribution depends on continuous pumping and an engine’s 500 gallon tank supports one handline for roughly three minutes.
• Hospital generator autonomy is a division problem using the measured burn rate and the usable tank volume, and a hospital with fuel and no municipal water has lost sterile processing, cooling and dialysis regardless of the diesel.
• Dispatch centers lose the ability to hear about incidents before they lose the ability to respond, so falling call volume during a utility collapse is a symptom rather than good news, and human reporting channels have to be designated in advance.
• The shift from treating individuals to preserving systems has an established American framework in the Institute of Medicine’s 2009 and 2012 crisis standards of care work, and it requires activation by a named authority rather than improvisation at the bedside.
• Leningrad’s death toll is genuinely contested, with the Soviet figure presented at Nuremberg near 632,000 civilian starvation deaths and historians including Glantz and Reid arguing for roughly 800,000 to more than a million.
• Sarajevo’s counts differ because they measure different populations, with ICTY demographic evidence counting around 14,000 killed in the siege area including combatants and the Research and Documentation Center’s residential count of 11,541 used for the 2012 memorial.
• Mutual aid, EMAC and regional task forces all assume a functioning outside, so every plan sentence that exports a shortfall needs a written answer for the case where the help arrives on day nine.