The Attack We Knew Was Coming

The East Bay Municipal Utility District Wastewater Treatment Plant in Oakland, California. (Photo by Justin Sullivan/Getty Images)

WHEN REPORTS EMERGED LAST WEEK that hackers had penetrated water systems across multiple American states, public attention immediately turned to the question of responsibility. Was it Iran, Russia, China, or—as President Trump wildly suggested—Democrats within the affected states? While Iranian-affiliated cyber actors are widely considered the leading suspects, federal investigators have yet to make a formal attribution. More importantly, so far there is no evidence that drinking water has been contaminated or that public health has been endangered. What the attacks did demonstrate, however, was that malicious actors have the capacity and, at times, desire to compromise the operational systems that control essential public infrastructure.

Yet the greatest significance of these attacks lies not in their novelty but in their familiarity. For those who have spent careers in the military or national security space, the reports were unsurprising: The attacks represent precisely the kind of threat that American strategists and analysts have anticipated for more than two decades. Long before cyberwarfare entered the public vocabulary, successive administrations, military planners, and allied governments repeatedly warned that America’s greatest vulnerabilities would not necessarily be found on distant battlefields but at home, embedded within the civilian infrastructure that underpins modern society.

That conclusion has appeared consistently in a range of national security planning documents, in various threat assessments by all agencies, and within the National Cybersecurity Strategy. The specific language has evolved over the years, but the underlying assessment has remained strikingly consistent. America’s critical infrastructure—including energy grids, communications systems, transportation networks, financial institutions, health care ecosystems, pipelines, and water systems—would become targets for adversaries seeking strategic advantage while avoiding direct military confrontation. These systems support every other element of national power while often remaining lightly defended compared with traditional military targets, which makes them soft targets.

Within the military, recognizing this has fundamentally changed how campaigns are planned. Leaders no longer view cybersecurity as a technical specialty to be delegated to communications experts after operational plans have been completed. Instead, it has necessarily become an integral part of campaign design from the outset. While joint doctrine describes offensive cyberspace operations, defensive cyberspace operations, and the operation of the Defense Department’s own information networks as distinct missions, commanders tend to think about cyber in broader operational terms. More and more, however, the military integrates cyber capabilities into comprehensive campaigns in which diplomacy, intelligence, economic pressure, information operations, and military force are all synchronized to achieve strategic objectives. Cyber has become another asymmetric capability available and integrated into virtually every modern campaign plan rather than treated as a supporting specialty.

Some cyber operations are conducted independently to collect intelligence, penetrate networks, or create strategic effects without employing conventional military force. Others directly support combat operations by disrupting the enemy’s command-and-control systems, logistics networks, air defenses, or communications, thereby allowing friendly aircraft, ships, and ground forces to maneuver inside the disrupted space.

The strategic evolution of cyber operations reflects a broader truth about contemporary conflict: Adversaries no longer need to destroy a nation’s military to impose real strategic costs; they can instead undermine the systems upon which civil society itself depends. On the face of it, a water-treatment facility may appear to have little connection to national defense until one considers the cascading consequences of disabling it. Hospitals rely upon clean water. Fire departments rely upon water (and water pressure). Manufacturing plants depend upon reliable municipal systems. Citizens expect government to provide potable water every day without interruption. Even a temporary disruption to that confidence forces governments to divert resources, commands attention at the highest political levels, and reminds the public that essential services are more fragile than they are believed to be. The strategic objective is often less about physical destruction than about eroding confidence and trust in government and its institutions. A cyber attack that causes the public to question its drinking water, for example, becomes psychological as much as operational.

---

Support our independent political and cultural journalism by snagging a Bulwark+ membership:

---

WHILE SERVING AS CHIEF OF OPERATIONS for U.S. Army Europe nearly twenty years ago, I was present as Estonia experienced what many military professionals now regard as the opening chapter of modern strategic cyberwarfare. In April 2007, the Estonian government decided to relocate a statue called the Bronze Soldier, a Soviet war memorial in central Tallinn that many ethnic Estonians viewed as a symbol of decades of Soviet occupation. The decision ignited protests and diplomatic outrage from Moscow, and, within days, a wave of coordinated cyber attacks unlike anything the world had previously witnessed.

The attacks targeted far more than government websites. The Estonian parliament, ministries, banks, newspapers, broadcasters, telecommunications providers, and other essential services found themselves overwhelmed by distributed denial-of-service (DDOS) attacks that flooded networks with malicious traffic. Financial transactions slowed or stopped. News organizations struggled to communicate. Government agencies found it difficult to provide public services. Emergency communications were affected. It wasn’t war. Nothing exploded, no missiles crossed the border, and no Russian armored columns rolled toward Tallinn. Yet millions of Estonians experienced something deeply unsettling all the same: the realization that a hostile power had found a way to disrupt the daily life of an entire society without firing a shot.

These attacks were particularly acute because of their target. In 2007, only sixteen years had passed since Estonia had regained its independence from the Soviet Union. During that short period, the country had reinvented itself as one of the world’s most digitally advanced democracies. Citizens filed taxes online, voted electronically, managed financial transactions digitally, and embraced technology as a symbol of both national progress and independence from Moscow. The cyber attacks struck at Estonia’s confidence in the very institutions that had defined its remarkable post–Cold War transformation. For many Estonians, the attacks felt less like electronic vandalism than a reminder that geography alone could no longer protect sovereignty.

Rather than retreating from the digital frontier, Estonia invested more deeply in resilience (as well as other counterintelligence programs). Estonian planners redesigned networks with redundancy in mind. Government agencies strengthened partnerships with private industry and facilitated cybersecurity education throughout society. Reserve cyber capabilities were developed. Estonia shifted the emphasis from an impossible goal of preventing every intrusion to an achievable one of ensuring that society could continue functioning despite them. Estonia understood that resilience—not invulnerability—was the true measure of national security.

NATO drew the same conclusion from the lessons of 2007. The alliance established the Cooperative Cyber Defence Centre of Excellence in Tallinn, where military officers, civilian experts, and researchers from across NATO now study cyber doctrine, conduct advanced research, and participate in multinational exercises. (I was proud to have later participated in one of those events as commander of U.S. Army forces in Europe.)

---

I HAVE WRITTEN REPEATEDLY in The Bulwark about the importance of the Cybersecurity and Infrastructure Security Agency here in the United States, about the value of Estonia’s whole-of-society resilience model, and about the growing disconnect between our strategic understanding of cyber threats and our willingness to sustain the institutions responsible for defending against them. Cybersecurity rarely commands public attention when it succeeds because successful cyber defense is measured largely by crises that never occur: The absence of headlines is evidence that the system is working.

No network can ever be made completely secure. The objective isn’t perfect defense but resilient defense—the ability to continue operating despite persistent attacks. That distinction has become important because our adversaries know they don’t need to destroy infrastructure to achieve strategic effects; they only need to convince citizens that they are vulnerable. An attack on water infrastructure will certainly do just that.

It is difficult to avoid the uncomfortable conclusion highlighted by the widely reported attacks last week. They aren’t a failure of imagination or intelligence. America’s security thinkers correctly identified the threat years ago. It’s been assessed, tracked, incorporated into plans, and publicly discussed. Allied nations like Estonia have demonstrated both the vulnerability and the solution. The problem has never been recognizing the danger. It has been sustaining the political will, institutional continuity, and long-term investment necessary to build resilience before a crisis forces our attention.

It’s an old military adage that generals often prepare to fight the last war. The greater danger today may be that democratic societies remember the last cyber attack only until the next crisis arrives. Strategic documents are written, conferences are held, after-action reports are published, and warnings are issued. But then budgets tighten, institutions are reorganized, priorities shift, and the urgency gradually fades. The result is strategic amnesia.

This reported attack—no matter who conducted it—should remind us that cyberwarfare is not a future threat. It is part of the operational environment in which every modern democracy must function. Professionals in the military, intelligence agencies, and national security have long understood this reality. The question is whether we as a nation possess the strategic discipline to defend and protect the approach that we must take. That, more than the identity of this week’s attackers, will determine how well prepared we are for the next campaign that arrives not with bombs or missiles, but through the networks that sustain our daily lives.