WHO CONTROLS OUR CYBERSECURITY?

Critical infrastructure cybersecurity is the defense of the computer systems, industrial controllers, and networks that keep essential services physically running - water treatment, electricity, fuel pipelines, food processing, hospital operations, transportation signaling, and communications. It differs from the cybersecurity most people know. Consumer cybersecurity protects accounts, identities, and data. Infrastructure cybersecurity protects the continuity of the physical services a society cannot live without, and the safety of the people who depend on them.

The United States designates sixteen critical infrastructure sectors, from water and wastewater systems to energy, food and agriculture, healthcare and public health, transportation, communications, and emergency services. Other countries maintain their own lists, but the underlying reality is the same everywhere: the machinery of daily life now runs on software, and the software was not designed for an adversary.

In the United States, the great majority of critical infrastructure is privately owned - a fact federal authorities have stated consistently across administrations. Municipal water systems are typically owned by cities and special districts. The grid is owned by investor-owned utilities, cooperatives, and public power authorities. The consequence is structural: the public depends on systems it does not operate, secured by institutions it does not direct, at standards no single authority can impose.

The distinctive engineering problem of infrastructure cybersecurity is operational technology: programmable logic controllers read sensors and command pumps, valves, and breakers; supervisory control and data acquisition (SCADA) systems let operators monitor and steer whole facilities; historians record what happened so it can be reconstructed. This equipment was engineered for reliability and safety across decades of continuous service - not for resistance to a patient adversary with time, money, and expertise.

A water plant controller or a substation relay may run for twenty or thirty years. Replacement requires planned outages, re-validation, and budgets that compete with the actual service the utility exists to provide. Remote access, meanwhile, was added over time because vendors and engineers need it to keep systems running. The result is a surface where very old protocols meet very new attack tooling.

The practical consequence is that control-system defense is primarily architectural and procedural - segmentation between corporate and operational networks, controlled and monitored remote access, allowlisting of what may change controller state, monitoring for behavior that should not occur, and the drilled ability to operate the service manually. Software patches matter, but in operational technology they are one layer of a defense that must also assume patches arrive late or not at all.

The American water sector is a lattice of small institutions. Federal figures count roughly one hundred fifty thousand public water systems, most serving communities of fewer than ten thousand people. A typical small utility operates with a handful of staff, a part-time IT arrangement, and control equipment spanning generations. Wastewater treatment is its quieter twin - less visible, equally dependent on pumps and dosing, and equally connected to networks.

Three incidents define the sector documented exposure, and they are three different failure modes. At Oldsmar, Florida (2021), an intruder reached a treatment computer over remote access and changed a chemical dosing setpoint; a second operator noticed and reversed it within minutes (registry entry R-09). At Aliquippa, Pennsylvania (2023), actors assessed by U.S. agencies as linked to Iran Islamic Revolutionary Guard Corps used a manufacturer default password to alter a controller display at a booster station that was not in service (R-16). At Maroochy, Australia (2000), a former contractor used radio equipment to manipulate sewage pumping for months, releasing hundreds of thousands of liters of wastewater (R-01). None of the three produced verified harm to the public - and each demonstrated how close the distance is.

The institutional response has been advisory rather than coercive. CISA publishes advisories and runs assessments; the Environmental Protection Agency has sought to fold cybersecurity into its existing inspection regime and met sustained legal and political challenge. The open question is not whether the threat is understood - it is whether any institution can require a small utility to act, and whether the public would know if it did not.

The electric grid is the reference case for what state-directed cyber operations against infrastructure look like when they succeed. On December 23, 2015, intruders using spearphishing and the BlackEnergy3 malware family opened breakers at roughly thirty substations in Ukraine, cutting power to approximately 230,000 customers for one to six winter hours (R-04). A year later, custom malware called Industroyer de-energized a transmission substation near Kyiv (R-05). Operators restored service manually - which is precisely why the attack was survivable, and precisely what a future attacker would study. U.S. prosecutors charged Russian military intelligence officers for the 2015 attack in October 2020.

The largest documented energy-sector disruption in the United States came not through the grid control systems but through its business systems. The Colonial Pipeline ransomware incident (May 2021) prompted the operator to shut roughly five thousand five hundred miles of pipeline as a precaution; the company stated its operational-technology systems were not compromised (R-11). For the East Coast, the fuel-distribution consequences were real - shortages, price effects, emergency transport declarations - even though no physical destruction was ever documented. The lesson cuts two ways: prudent segregation worked, and the interdependency still produced a regional crisis.

The renewable transition adds new surface area. When the service operator Deutsche Windtechnik was hit by ransomware in April 2022, remote monitoring of some one hundred fifty wind turbines was suspended for days (R-14). Inverter-based generation depends on communications in ways traditional rotating machinery did not - a structural shift with a security ledger still being written.

The food system cyber exposure is concentrated where its economics are concentrated. A small number of firms process a large share of American meat production - a concentration documented by the Department of Agriculture own studies. When ransomware struck JBS Foods at the end of May 2021, plants in the United States, Canada, and Australia shut for days, workers were temporarily idled, and wholesale prices moved (R-12). The company confirmed paying an eleven-million-dollar ransom. No consumer food-safety effect was ever documented - the disruption was logistical and economic, which is exactly how the sector analysts describe its vulnerability: not poisoned food, but food that does not arrive.

Refrigeration is the quiet dependency. Cold storage, supermarket refrigeration, and the cold chain for pharmaceuticals run on controllers and monitoring software whose failure is a spoilage event measured in hours. Dairy operations, irrigation systems, and greenhouse controls have joined the networked world the way every other sector did - piecemeal, with convenience first.

Healthcare is where infrastructure cybersecurity stops being abstract. The WannaCry outbreak of May 2017 shut down hospital IT across the United Kingdom National Health Service - the National Audit Office documented roughly nineteen thousand canceled appointments and operations, patients diverted, and imaging equipment offline (R-06). In May 2021, the Irish Health Service Executive lost an estimated eighty percent of its IT to Conti ransomware: COVID test referrals stopped, thousands of appointments were canceled, and recovery took months (R-10). In February 2024, ransomware at Change Healthcare - the largest American health-payment clearinghouse - interrupted pharmacy claims and clinician payments nationwide for weeks (R-17).

Three incidents, three failure modes: an unpatched vulnerability, a sector-wide encryption event, and a single point of failure in the payment plumbing. In each, the physical consequence took the form of delayed care rather than destroyed equipment - and delayed care is a measurable harm. The sector own reviews document patient-safety incidents under the Irish post-incident processes; UK inquiries established cancellations and diversion but did not establish deaths caused by the attack, and this investigation does not claim them.

Transportation systems are controlled by software whose failure modes are physical: interlockings route trains, air-traffic data systems sequence aircraft, port logistics stack containers. The documented record here is thinner and more cautious than the popular image. The NotPetya attack reached the global shipping giant Maersk and disrupted booking and operations for weeks (R-07) - corporate IT, not vessel controls. In Denmark in May 2022, rail operator DSB suspended train operations after a software update from a supplier failed - a documented national-scale stoppage caused by a non-malicious software fault, which this investigation records as evidence of dependency, not of attack.

Communications infrastructure carries the same duality. Subsea fiber optic cables carry the overwhelming majority of intercontinental data traffic. Episodes of cable damage in the Baltic Sea and elsewhere from 2023 onward prompted investigations into possible sabotage; publicly available findings through this investigation review date attribute some damage to anchors and weather, with several investigations unresolved. This investigation reports them as under investigation, not as confirmed attacks - the discipline the record requires. Aviation authorities, meanwhile, have documented GPS interference reports near conflict zones in official safety bulletins.

Two criminal industries dominate the incident record. Ransomware encrypts systems, steals data, and extorts payment - Colonial Pipeline, JBS Foods, the Irish HSE, Change Healthcare, and Deutsche Windtechnik all belong to this pattern (R-10 through R-14, R-17). Supply-chain attacks insert compromise into the software-update mechanisms that infrastructure trusts: the SolarWinds Orion platform delivered a backdoor to roughly eighteen thousand customers (R-08); Kaseya remote-management software carried encryption to an estimated fifteen hundred downstream businesses through their service providers (R-13); the MOVEit file-transfer vulnerability exposed data from hundreds of organizations (R-15).

NotPetya remains the case that shows how the two worlds combine. It presented itself as ransomware, collected payments, and never returned data; it was a wiper that spread through a trusted Ukrainian software-update mechanism and rolled outward through corporate networks worldwide, causing damage the U.S. government estimated at up to ten billion dollars (R-07). An attack aimed at one country logistics and government ran through the trust chains of global commerce - including the companies that keep food, fuel, and medicine moving.

State involvement in infrastructure cyber operations is documented, and it takes distinguishable forms. Espionage: the SolarWinds campaign collected information from government agencies and companies through a trojanized software update, attributed by the U.S. government to Russia foreign intelligence service, with no destruction documented (R-08). Pre-positioning: the February 2024 CISA advisory on Volt Typhoon described People's Republic of China state-sponsored actors maintaining persistent access to U.S. critical infrastructure - with officials describing actors living off the land inside water, energy, and communications networks, and cautioning that the access observed was consistent with preparation rather than execution. Sabotage: the Sandworm operations against Ukraine grid (R-04, R-05) and NotPetya (R-07) demonstrate that some state actors will destroy, not merely observe.

Criminal and state activity also interlock. The actors CISA assessed as IRGC-linked behind the Aliquippa controller manipulation (R-16) used the tools and aesthetics of hacktivism while U.S. agencies attributed them to a state apparatus. Distinguishing a criminal business from a state instrument - or a state instrument dressed as criminals - is a standing analytical problem, and misreading it has consequences in both directions: overreacting to vandals as war, and underestimating state planning as crime.

For civilian infrastructure, the implication is uncomfortable: a municipal utility control network may be hosting decisions of geopolitics without its operators knowledge. The defenders of a water plant are not defending against a neighbor vandalism; they are holding ground in an environment where the adversaries are professional, patient, and funded by states.

Industrial control-system security has a settled technical baseline, described in standards and advisories that have barely changed in their essentials for a decade: know what controllers you have; separate the operational network from the business network; control and log every remote connection; verify what may change a controller state; monitor for behavior that should not happen; rehearse recovery. The gap is not knowledge. It is adoption - across tens of thousands of small institutions for whom every item on that list costs money they have not budgeted.

Two registry entries bracket what is technically possible. Stuxnet (R-02) demonstrated that an air gap is a design assumption, not a guarantee: malicious code reached centrifuge controllers at an Iranian enrichment facility and physically destroyed equipment while showing operators normal readings. Aliquippa (R-16) demonstrated the opposite pole: a state-linked actor walked through a manufacturer default password. Between those poles sits the entire problem - attackers engineer around whatever isolation an operator believes in, and the baseline only works when it is actually implemented and verified.

In the United States, defense responsibility is distributed across a lattice of institutions that no single authority directs. CISA coordinates, publishes advisories, and offers voluntary assessments. Sector agencies hold varying regulatory power - the Federal Energy Regulatory Commission framework backs mandatory standards for the bulk electric system, while water relies on the EPA, pipelines on the TSA, food on the FDA and USDA, healthcare on HHS. The FBI and Secret Service investigate. States and municipalities own budgets. Private owners operate the assets. Vendors ship the software. Insurers price the risk. No one can compel the weakest link to be stronger.

This is the structural finding of the investigation, and it applies with variations in other democracies: defense of critical infrastructure is a negotiated outcome among owners, regulators, insurers, and national security agencies - negotiated continuously, with the balance of power favoring whoever is least compelled. The public owns none of the levers and inherits all of the consequences.

The matchup is structurally unfair. A small water utility may share one IT contractor among several towns, run controllers purchased in different decades, and face adversaries that are national intelligence services or industrial criminal enterprises with revenue in the hundreds of millions. Ransomware groups select targets precisely because a small municipality downtime is intolerable and its defenses are thin. The threat model is professional; the defense is often a part-time budget line.

The funding mechanics compound the problem. Federal grant programs - including the State and Local Cybersecurity Grant Program - exist but are episodic and competitive. Cyber insurance premiums have risen sharply while covering less. For a municipal utility, real security spending means raising rates, and raising rates requires regulatory commission approval - which means the cybersecurity posture of a drinking-water system is ultimately decided in rate proceedings most residents never attend. The political economy of a water bill is the defense budget of the water system.

Every documented recovery in this investigation registry ran through people. Ukrainian grid operators restored power manually within hours in 2015, switching to paper procedures and physical switching after the malware destroyed their software (R-04). Colonial Pipeline operators moved to manual scheduling and delivery management while billing systems were down (R-11). At Oldsmar, the operator who noticed an impossible setpoint change and reversed it within minutes was the entire defense (R-09). The human layer is not a soft fallback; in the record, it is the layer that worked.

But manual capability is a perishable skill attached to organizational memory. It must be documented in procedures that assume the network is unavailable, rehearsed in exercises that assume degradation, and staffed with alternates who have physically performed the task. A manual recovery plan that has never been drilled is a document, not a capability - and capabilities that are never exercised are exactly what a resilient society thinks it has until the day it needs them.

Cybersecurity spending on physical infrastructure arrives with a civil-liberties ledger. The same sensor networks that detect intrusion into a water plant can instrument the people around it. Securing systems is a public good; monitoring the public is a policy choice that requires its own justification. The distinction must be argued in each procurement, not assumed in the category name - infrastructure security, once funded, becomes a budget with momentum, and budgets rarely ask whether the cameras should come back down.

Transparency has its own tension. Incident reporting to government - expanded in the United States by the Cyber Incident Reporting for Critical Infrastructure Act of 2022, with implementing rules in progress at this investigation review date - creates the shared picture defenders need. But the same reporting can be sealed, and vendor nondisclosure agreements can keep the details of failures private even when the public was the stakeholder. Too much secrecy prevents the sector from learning; too much detail hands adversaries a map. Deciding where that line sits - and who decides it - is itself a governance question this investigation poses rather than resolves.

Resilience is a layered claim: architecture that limits blast radius, procedure that works when software does not, people who have rehearsed, and institutions that report and learn. It is testable - a utility that has never manually operated its plant, or restored from its backups, or table-topped a ransomware incident, holds resilience as an article of faith rather than a capability. The registry entries in this investigation that ended well ended well because of architecture (segmentation at Colonial), procedure (manual restoration in Ukraine), or people (the second operator at Oldsmar). Those are purchasable and drillable. Most small institutions have bought none of them in full.

DSC proposed response treats resilience as a civic architecture question, not only a procurement question. Civic Machina is introduced here as a proposed civic AI architecture - not a deployed or proven security system - with research directions that include public-interest information verification, accountable civic intelligence, resilience mapping, and citizen-controlled digital infrastructure. Its premise is that a public which cannot see the state of its own infrastructure cannot hold anyone accountable for it. This connects to the broader principle of Plurality of Digital Sovereignty: resilience that rests on a single vendor, a single integrator, or a single agency is not resilience; it is concentration with better manners.

A society is not digitally sovereign if it cannot protect its essential systems, independently verify information, or preserve the rights of its people when those systems are threatened.