America’s Digital Weak Points Are Now Physical Ones
The old picture of a cyberattack was a teenager in a basement or a criminal gang stealing credit card numbers. That picture is now dangerously incomplete. The more serious fear in Washington is that malicious code can reach into the ordinary machinery of American life: the power grid, water systems, ports, pipelines, hospitals, rail networks, and communications systems that make modern society possible.
This is not a science-fiction concern. The 2021 ransomware attack on Colonial Pipeline forced a temporary shutdown of a major fuel pipeline and led to panic buying and gasoline shortages in parts of the Southeast. Public advisories from U.S. agencies have warned that Chinese state-linked hackers have sought access to critical infrastructure networks, not merely for spying but potentially to prepare for disruption in a future crisis. Water utilities, often small and underfunded, have also become a recurring concern for federal cybersecurity officials.
What makes the issue so difficult is that the United States has built much of its critical infrastructure in the private sector, while the consequences of failure are plainly public. A hacked retailer is a business problem. A hacked water system is a civic emergency.
The Government Cannot Do This Alone
The federal government classifies 16 sectors as critical infrastructure, ranging from energy and transportation to food, finance, health care, and emergency services. But Washington does not own most of the assets it is trying to protect. It advises, regulates in certain areas, shares intelligence, and sometimes provides grants or technical help. The daily burden still falls on utilities, companies, hospital systems, port operators, and local governments.
That reality should discipline both parties. Democrats often reach first for broad federal mandates, as though a rule from Washington can patch every aging control system in the country. Republicans often warn, correctly, about regulatory overreach, but they can be too slow to admit that voluntary cooperation has limits when the adversaries include hostile states and organized criminal networks.
A serious conservative approach begins with a simple recognition: critical infrastructure is not just another market sector. It is part of the common defense. A foreign power that can shut down electricity in a major city, contaminate public confidence in water, or freeze hospital operations has found a way to impose costs without firing a missile. That is not merely a technical problem. It is a national security problem.
Old Systems, New Threats
Much of the danger comes from the collision between old industrial systems and new connectivity. Many utilities and industrial operators use operational technology that was designed for reliability and long service life, not constant exposure to the internet. Equipment that once sat behind a locked door is now connected for remote monitoring, efficiency, and cost savings.
That connectivity has obvious benefits. It also creates openings. Attackers do not always need glamorous tools. They may exploit weak passwords, unpatched software, poorly configured remote access, or vendors with sloppy security practices. In many intrusions, the most frightening lesson is not the brilliance of the attacker but the ordinariness of the vulnerability.
Federal agencies, including the Cybersecurity and Infrastructure Security Agency, have encouraged basic cyber hygiene: multifactor authentication, network segmentation, offline backups, timely patching, incident reporting, and tested recovery plans. These sound dull, which is exactly why they matter. Civilization often depends less on heroic brilliance than on boring maintenance faithfully performed.
What Policy Should Do Next
The first policy priority should be clarity. Companies operating essential systems need to know what minimum standards apply and which agency is in charge. The current landscape can be confusing, with sector-specific regulators, voluntary frameworks, state requirements, and federal guidance overlapping in ways that can leave smaller operators overwhelmed.
Second, Congress should treat cybersecurity for essential services as a resilience issue, not only a compliance issue. A checklist mentality can produce paperwork without security. The better question is whether an operator can detect an intrusion, isolate damage, continue essential service, and recover quickly. For a hospital, a water utility, or an electric cooperative, the test is not whether the binder is complete. The test is whether the lights stay on and the public remains safe.
Third, federal assistance should be targeted toward the weakest links. Large energy companies and major financial firms have strong incentives and resources to invest in defense. Small-town water systems, rural hospitals, and local governments often do not. If Washington is going to spend money, it should prioritize systems whose failure would harm citizens who have little ability to protect themselves.
Fourth, America needs a more honest debate about deterrence. Criminal ransomware groups thrive when the expected costs are low. State-backed actors probe American networks because they believe the benefits outweigh the risks. Better defense is essential, but defense alone is not enough. The United States must be willing to use law enforcement, sanctions, diplomatic pressure, intelligence tools, and, when appropriate, cyber capabilities to impose consequences on attackers and their sponsors.
The Conservative Case for Preparedness
There is a temptation, especially on the right, to hear the phrase critical infrastructure cybersecurity and assume it is another invitation for bureaucracy to expand itself. Sometimes it is. Washington has a genius for turning emergencies into permanent offices and vague mandates.
But prudence is not libertarian fantasy, and limited government is not negligent government. The first duty of public authority is to protect the conditions under which free people can live ordinary lives. In the 19th century, that meant harbors, forts, and roads. In the 20th, it meant air defense, telecommunications, and reliable energy. In our own time, it includes the digital sinews that hold physical systems together.
This does not require nationalizing utilities or pretending that federal experts can manage every local system better than the people who run it. It requires setting serious baselines, sharing timely intelligence, protecting liability-sensitive information when companies report incidents, and helping smaller operators meet standards they cannot realistically meet alone.
It also requires a cultural change. Cybersecurity cannot remain the lonely concern of the IT department, called in after executives have already made every important decision. Boards, mayors, governors, hospital administrators, and utility commissioners need to treat cyber risk as operational risk. If a system cannot function when its network is degraded, then cyber defense is not optional. It is part of keeping faith with the public.
A Test of National Seriousness
Americans are accustomed to abundance so steady that it becomes invisible. Water comes from the tap. Lights answer the switch. Gasoline reaches the station. Emergency rooms open their doors. The hidden labor behind these facts is immense, and the digital layer underneath them has become one of the places where American confidence can be attacked.
The task ahead is not to panic. Panic is what our adversaries would like to produce. The task is to recover an older civic virtue: preparedness. A serious country does not wait until the bridge collapses to inspect the steel. It does not wait until the grid fails to ask who had access to the control room. And it does not confuse freedom with the absence of duty.
Cybersecurity may sound bloodless and technical, but the stakes are deeply human. It is about whether a mother can call 911, whether a patient can receive treatment, whether a city can drink its water, and whether citizens can trust the basic promises of modern life. Defending those promises is not a partisan luxury. It is the plain work of governing.
