Security Is Resilience

Summary

Security is resilience. A country is safe not only when it can project force but when it can take a punch and keep functioning: when its supply of essentials does not hang on a single point of failure, when its grid and networks can absorb an attack, when it can detect and contain a disease before it becomes a catastrophe, and when its communities can care for themselves through the first hours of a crisis. What has changed is that our principal adversary now agrees. CISA, the NSA, and the FBI jointly assess that Chinese state-sponsored actors known as Volt Typhoon have pre-positioned inside American water, power, communications, and transportation systems, not to spy, but to be able to disrupt them in a crisis.

This brief proposes seven planks at home: secure the supply chains we cannot live without at the layer where the dependence actually lives, build energy independence on clean domestic power and a grid that can take a hit, defend the lifelines and fund the defenders, rebuild biological defense, sustain alliances and defend democratic institutions, treat local resilience as national security, and exercise the whole system. Abroad, three principles: secure our own people first, no unconditional aid and one standard for every ally under the Leahy Law, and force as a last resort, for moral ends, decided in the open.

The most secure country is the most resilient

Security is resilience. A country is safe not only when it can project force but when it can take a punch and keep functioning: when its supply of essentials does not hang on a single point of failure, when its grid and networks can absorb an attack, when it can detect and contain a disease before it becomes a catastrophe, when its institutions can resist subversion, and when its communities can care for themselves through the first hours of a crisis. The most secure country, then, is not necessarily the most heavily armed one but the most resilient: the hardest to disrupt and the fastest to recover.

What has changed since this argument was first made is that our principal adversary now agrees with it. The documented posture of Chinese state cyber operations against the United States is aimed not at our military but at our lifelines, the water, power, communications, and transportation systems civilians depend on, precisely because disrupting civilian resilience is how you paralyze a modern country without firing a shot. When the other side has reorganized its strategy around attacking your resilience, treating resilience as the core of your defense stops being a reframe and becomes an accurate reading of the battlefield.

We armed up and left the lifelines exposed

We have spent enormous sums on military hardware while underinvesting in the resilience that determines whether people are actually safe, and the evidence of the gap is no longer hypothetical. It is documented, attributed, and sitting inside the walls.

Start with the intrusion. CISA, the NSA, and the FBI jointly assess, with high confidence, that Chinese state-sponsored actors known as Volt Typhoon have compromised the networks of American critical infrastructure organizations across communications, energy, transportation, and water systems, in the continental United States and in Guam. The agencies are explicit that this is not espionage. The pattern is pre-positioning: quiet, long-term persistence inside operational systems, using legitimate administrative tools to avoid detection, so that in a crisis or a conflict the intruder can disrupt the water, the power, and the ports at a time of its choosing. The FBI’s director called it the defining threat of our generation. These actors have held footholds for years, they have regained access after being evicted, and a parallel campaign, Salt Typhoon, burrowed into the major telecommunications carriers deeply enough to reach call records and the government’s own lawful-intercept systems.

Now notice where they went, because it vindicates this platform’s least glamorous argument. One documented Volt Typhoon intrusion sat for nearly a year inside a small municipal light and water department in Massachusetts, mapping how the local grid works. The adversary is not only targeting the marquee systems. It is targeting the small, local, under-defended utilities where the seams are, the exact layer of American infrastructure this platform has argued we starve. And the exposure is compounding: the average utility absorbed about 1,160 cyberattacks between January and August 2024, against roughly 690 in the same months a year earlier, while the grid’s own reliability authority warns that its points of susceptibility grow by roughly sixty a day as digitization outruns defense.¹ Russia showed the world what the end state looks like when it turned off power to hundreds of thousands of Ukrainians in 2015 and 2016. Meanwhile the civilian agency built to defend all of this has been cut, not grown, in the middle of the campaign against it. Weakening your own defender while the intruder is inside the house is not a policy disagreement. It is negligence with a signature on it.

The supply-chain exposure is the same failure in a different domain, and the concentration is stark. Taiwan accounts for more than 60 percent of global foundry revenue and over 90 percent of leading-edge chip manufacturing,² with a single company producing as many wafers a year as the entire United States. Everything advanced in the American economy and military runs through a strait the adversary has publicly committed to crossing. Medicine tells the same story with a subtler twist that honest policy has to respect: America’s dependence on China runs deepest not in finished drugs but in the earliest, least-regulated stages of ingredient production, which means onshoring the final pill accomplishes little if the raw materials underneath it are still single-sourced abroad. The pandemic already gave the country a live demonstration of what these dependencies cost when they snap, and drug shortages have stayed severe by historical standards since, peaking at a record 323 active shortages in early 2024 and still running above 200. And beneath all of it sits the brittleness this platform names everywhere: we centralized and globalized the systems people depend on, let local capacity wither, and left too little underneath to catch the fall.

Seven planks, in plain terms

Seven planks at home, three principles abroad.

1. Secure the supply chains we cannot live without, at the layer where the dependence actually lives. Identify the essentials the country cannot lose access to, medicine and its raw ingredients, semiconductors, critical minerals, key elements of the food supply, and build secure sources through domestic production and trusted allies, with strategic reserves where they make sense. Follow the dependence to its real depth: for medicine that means the raw materials and early chemistry, not just the finished drug, because onshoring the label while importing the substance is security theater. For chips it means sustaining the domestic fabrication build-out already underway and pairing it with the packaging, materials, and talent that make a fab more than a building. Diversification and trusted sourcing, not autarky.
2. Build energy independence and a grid that can take a hit. Treat clean, domestic energy as the security asset it is, and harden the grid against weather, physical attack, and cyber intrusion, with the redundancy and distributed generation that let parts of the system fail without taking down the whole. Energy a country produces itself, on a grid that can absorb a blow, is far harder to hold hostage, and a distributed grid is a harder target than a centralized one by design.
3. Defend the lifelines, and fund the defenders. Make the cyber defense of water, power, communications, and transportation a first-order national defense mission, funded like one. That means restoring and growing the civilian cyber defense agency rather than cutting it mid-campaign, mandatory baseline security standards for lifeline utilities with federal help to meet them, because a small municipal water department cannot out-spend a state intelligence service alone, and sustained threat-hunting that treats eviction as a process rather than a press release, since these actors demonstrably come back. Pair defense with consequence: attribution, indictment, and sanction, jointly with allies, so intruding on American lifelines carries a price.
4. Rebuild biological defense before the next test. The pandemic was a national-security failure no weapons system could have prevented, and the preparedness it exposed as thin has been allowed to thin further. Fund the disease surveillance, public-health workforce, and medical countermeasure capacity to detect and contain outbreaks, natural or engineered, before they become catastrophes, and connect it to the public-health infrastructure the foundations pillar rebuilds. Biological threats are among the most likely and most dangerous the country faces, and among the most neglected relative to their risk.
5. Sustain alliances and defend democratic institutions as security assets. Alliances multiply national strength, and the integrity of elections and public trust is a security perimeter in its own right, under documented attack from foreign interference and domestic subversion alike. Defend both, within the law and with full respect for civil liberties, because security measures that erode the freedoms they protect defeat their own purpose.
6. Treat local resilience as national security, because the adversary already does. A country whose communities can absorb shocks locally is fundamentally harder to destabilize, and the intrusion record shows the adversary probing exactly that local layer. Invest in it as defense: local emergency and public-health capacity, distributed energy and microgrids, local food systems, and the community institutions and mutual-aid networks that do the first work in any crisis. The resilience lives locally. The financing, standards, and coordination that get it to scale are the federal job.
7. Exercise the whole system. In emergency management, a plan that has never been exercised is a rumor. Run national-scale exercises that stress the seams these threats actually target, a grid-down week, a port disruption, a supply-chain snap, an outbreak, with states, localities, utilities, and communities in the room, and fix what the exercises find. The cheapest disaster is the one we prevent, and the second cheapest is the one we rehearsed.

Home first, one standard for allies, force last

Security is also how the country carries its weight in the world, and that requires a consistent posture rather than improvisation. Three principles govern it.

Secure our own people first. On an airplane you secure your own oxygen mask before helping the person next to you, and the same logic applies to a country. There is nothing wrong with helping our neighbors, and a strong America should. But we should not fund abroad what we refuse to fund at home, and foreign commitments should be weighed honestly against unmet needs here. Helping our own people is not isolationism. It is the foundation that makes a credible role abroad possible.

No unconditional aid, and one standard for every ally. Aid and support come with clear, consistent expectations. Not micromanagement of every operational decision, but a firm line: when a partner uses American weapons and resources to commit atrocities or target civilians, we stop, and the rule applies to every ally without exception. This is not a new idea but an old law we fail to enforce. The Leahy Law already bars assistance to foreign units credibly implicated in gross human-rights violations³, and it has been applied unevenly, with documented double standards for favored partners.⁴ Enforce it consistently, for everyone, because a standard that bends for friends is not a standard at all.

Force as a last resort, for moral ends, decided in the open. As the strongest military power in the world, the United States can sometimes be the difference between a massacre stopped and a massacre completed, and it should be willing to stand against the gravest crimes: genocide, ethnic cleansing, mass atrocity. That is the core of the Responsibility to Protect, grounded in the older just-war tradition. But the bar stays high and the rules strict: authorized democratically, not launched on one person’s say-so; specific objectives and a defined horizon, not open-ended occupation; and the people being helped taking part in their own liberation, with America providing support, training, and protection rather than fighting in their place. We should be willing to stand against slaughter. We should never again drift into open-ended wars without clear ends, public consent, or a moral purpose that survives daylight.

Water Security Is National Security

The Volt Typhoon finding earlier in this brief has an unfinished implication: adversaries prepositioned in civilian infrastructure attack water systems, hospitals, and utilities that mostly cannot defend themselves. Water is where that exposure is sharpest, and it deserves its own answer.

The battlefield of a modern conflict may be a municipal pump station before it is a military base. Treatment plants now depend on digital controls, remote connections, communications, chemicals, electricity, and specialized equipment, and a disruption in any one of them reaches drinking water, sanitation, firefighting, hospitals, agriculture, manufacturing, and military installations. The danger is not mainly the cinematic one. An attacker does not need to poison a reservoir; it is enough to disable monitoring, change control settings, lock operators out, interrupt pumps, force prolonged manual operation, or simply create enough uncertainty that people stop trusting the tap. Confidence in the water supply is itself infrastructure, and it can be attacked directly.

What July 2026 showed. On 26 and 27 July, a coordinated cyberattack targeted operational technology at more than thirty Minnesota community water systems, going after programmable logic controllers and changing passwords to lock operators out of their own equipment. Minnesota activated its statewide cyber incident response with federal, local, Tribal, and private partners, and federal authorities subsequently reported related disruptions across at least seven states.⁵ The instructive part is what varied. In Braham the treatment plant went offline and the city asked residents to minimize use; in Plymouth, communications failed at two water towers and multiple wastewater lift stations and the utility kept running by hand. Two utilities, one campaign, and the one that could still operate manually stayed in service. That is not an isolated case: when an Iran-affiliated group breached a Pennsylvania water system in November 2023, operators there also reverted to manual pumping.⁶ Automation is not the enemy. Automation without a tested fallback is what converts a cyber incident into a water outage.

Attribution deserves more care than the news cycle gave it. A federal advisory in force at the time, issued in April 2026 and last revised on 22 July, warned that Iranian-affiliated actors were targeting internet-exposed programmable logic controllers and reported that such activity had already disrupted controllers across several critical infrastructure sectors.⁷ That is context, not attribution. Preliminary assessments considered Iranian actors probably responsible while cautioning that the judgment could change, and it was publicly disputed at senior levels within days. A standing warning about a threat actor is not proof that the actor caused a particular incident, and a platform that demands evidence discipline of others holds the line here even when the inference is tempting.

The underlying exposure long predates any of it. The United States has nearly 170,000 increasingly automated water systems, and the Government Accountability Office found that EPA had not identified and prioritized the greatest risks sector-wide, relying instead on utilities volunteering to improve, a gap GAO was still reporting to Congress in May 2026.⁶ Most of those systems are small. Expecting a town of four thousand to defend itself against a foreign intelligence service out of local ratepayer revenue is not a security policy.

The position. A National Water and Natural Resource Security Strategy, refreshed every four years and coordinated across EPA, CISA, FEMA, USGS, USDA, Interior, HHS, and the intelligence community, treating water quantity, quality, and use as one problem rather than three, planning by watershed and aquifer where political boundaries do not match the resource, naming the communities, hospitals, farms, and installations that depend on a single point of failure, and carrying Tribal water rights, treaty responsibilities, and Indigenous data sovereignty from the first draft rather than in a consultation appended to a finished one. A Water Utility Defense Standard setting enforceable minimum cybersecurity and continuity requirements, paired with the money and technical support to meet them: inventories of internet-connected operational technology, business networks separated from treatment controls, secure remote access, no default or shared passwords, offline backups, rapid incident reporting, backup power and chemicals, the ability to run essential functions by hand, and recovery exercises with corrective actions tracked to completion. Regional cybersecurity and engineering teams that small, rural, and Tribal utilities share rather than each building a security department. And federal security appropriations carrying a real share of the cost, because if defending water against foreign intelligence services is a national defense responsibility, and it is, it should not arrive as an unfunded mandate on household water bills.

Protect the source, not only the utility. A perfectly secured plant cannot indefinitely compensate for a depleted aquifer, a contaminated river, a drained wetland, or a watershed burned and flooded in successive years. Drinking-water source areas, rivers and aquifers, the Great Lakes and other interstate waters, wetlands and floodplains, forests that hold water quality and slow runoff, and the soils that grow food are strategic infrastructure and should be assessed as such when federal infrastructure, industrial, computing, and agricultural decisions are made. This extends the innovation pillar’s rule that big new computing loads pay their own way from the grid to the watershed: large data centers and comparable industrial loads should disclose withdrawals and consumptive use, pay for the water infrastructure they require, and face tighter siting rules in stressed watersheds. A computing boom financed partly by other people’s water is a transfer, not an investment.

Permitting by risk, and the boundary that matters. The platform’s Voice-Not-Veto Test applies here in full, which means calibrating review to risk: permit-by-rule for low-risk repeatable work using certified designs, consolidated accelerated review for larger projects using established mitigation, and full review where there are major environmental, water, safety, displacement, cumulative-pollution, or tribal implications. One rule matters more than the tiering. A high-impact project is not approved because an agency missed a deadline. Deadline-triggered approval sounds like accountability and functions as a loophole, converting understaffing into a permit; a missed deadline should trigger escalation to a named decision-maker, added review capacity, a public explanation, and where appropriate a refund of fees. The applicant is entitled to a timely decision. Nobody is entitled to a decision made by default. And the boundary holds in the other direction too: civilian agencies stay in charge of domestic water governance. National-security framing should bring resources, standards, and sustained attention, not military control of utilities, indiscriminate surveillance, or secret environmental decision-making.

How we would know it worked. Systems meeting the security baseline; internet-exposed operational technology identified and secured; time to detect, isolate, and recover from an intrusion; utilities capable of sustained manual operation; backup power and communications readiness; operator vacancies and retention; corrective actions completed after exercises and after real incidents; water lost to leakage; drinking-water violations; groundwater and surface-water availability; households facing unaffordable or interrupted service; and the resource draw of large industrial and computing projects. The most telling number is the recovery one. A country that can be denied its water for a week is not defended, whatever it spends on aircraft.

Mostly budgets, laws, and machinery we already have

Supply-chain security runs through industrial policy, procurement, and coordination with allies, much of it begun and in need of follow-through that reaches the raw-material layer. Grid and energy resilience connect to the climate and build pillars through deployment, permitting, and standards. Lifeline cyber defense runs through the civilian cyber agency’s budget and authorities, through utility regulation at the state level, and through the federal standards and assistance that make small-utility defense possible. Biodefense runs through the public-health appropriations the foundations pillar carries. The Leahy enforcement commitment is executive-branch discipline under existing law, which is exactly why it is a test of seriousness: it requires no new statute, only the will to apply the one we have. The exercise regime runs through the emergency-management machinery the country already owns. The pattern throughout is the platform’s standard one: national coordination and financing supporting capacity that is often built and held locally.

Resilience is cheaper than catastrophe

Resilience is cheaper than catastrophe, and this pillar’s spending mostly does double duty. Clean energy lowers bills every day and hardens the country against coercion. Public-health capacity serves people in ordinary times and is the difference between an outbreak and a catastrophe. Local resilience investment pays out in every disaster, attack or storm alike, which is the quiet advantage of defending by resilience: the same dollar defends against the hurricane and the intrusion, because both are answered by communities and systems that can absorb a shock. Securing supply chains for essentials costs far less than losing access to them in a crisis, as the pandemic priced out in real time. And enforcing the Leahy Law costs nothing at all. It saves money, and something worth more than money.

Not retreat, and kept inside the law

Reframing security as resilience is not retreat, and the alliance commitments exist precisely to say so; trusted partners are part of resilience, not an alternative to it. Supply-chain security means diversification, not autarky, because making everything at home is neither possible nor wise, and the honest nuance stays in: onshoring that ignores the raw-material layer is theater. Cyber standards for small utilities must arrive with federal money and help, or they become an unfunded mandate that closes the local water department instead of defending it. The defense of democratic institutions stays inside the rule of law and civil liberties, because a security state that eats the freedoms it guards has lost the war by winning it. And the use-of-force principles are guardrails on ourselves: the memory of open-ended wars is exactly why the bar is written high, in public, in advance.

How we would know it worked

Judge the agenda on dependence, hardness, and recovery.

• Dependence on single or untrusted sources for critical goods, tracked at the true depth of the chain, raw ingredients and materials included, and the adequacy of strategic reserves.
• Lifeline-sector intrusions detected, dwell time, and re-intrusion rates, alongside the funding and staffing of the civilian cyber defense mission.
• Grid reliability and resilience to weather, physical, and cyber threats, and the share of distributed and domestic generation.
• Public-health readiness: detection speed, surge capacity, and countermeasure stockpiles, exercised and scored.
• Leahy Law enforcement applied uniformly, measured by its exceptions, which should be zero.
• Local resilience capacity in place, and recovery time after real shocks and national exercises alike.

The objections, answered

Some will say this weakens national defense by looking past military strength. It completes military strength. The documented adversary strategy is to paralyze America’s civilian lifelines in a crisis, precisely to blunt its military response. A powerful force sitting on a fragile grid, intruded utilities, and snapped supply chains is not secure, and the joint assessment of our own security agencies says the enemy is already inside those systems. Closing that gap is defense.

Some will say securing supply chains is protectionism. The aim is not to wall the country off but to ensure it is not dependent on a single distant or untrusted supplier for things it cannot do without, through domestic production and trusted allies together. Ninety percent of leading-edge chips crossing one strait is not a market outcome to defend. It is a single point of failure to fix.

Some will say conditioning aid abandons our allies. Enforcing an existing American law, evenly, is not abandonment. It is the difference between an alliance and a blank check, and allies who do not commit atrocities with American weapons have nothing to fear from it.

Some will say the intervention principles tie America’s hands. They tie America’s hands against exactly one thing: drifting into open-ended wars without public consent or clear ends, which is the failure mode of the last quarter century. A high bar, set democratically, makes the credible threat of action stronger, not weaker, because it is believed.

Some will say local resilience is not national security. The adversary’s own targeting says otherwise. When a foreign intelligence service spends a year inside a small-town water utility mapping the grid, the local layer has been designated a battlefield by the other side. Defending it is not sentiment. It is meeting the attack where it is aimed.

What Would Change Our Position

Resilience-first is a testable doctrine. If exercises and real shocks showed the locally-anchored model failing where centralized response succeeded, the balance shifts back toward federal capacity, and honestly. If supply-chain diversification produced costs wildly out of proportion to the risk it insures against, the pace changes. If conditioning security assistance on conduct demonstrably weakened alliances without improving conduct, the tool would be reweighed against the alternatives. The commitment is that security decisions get made on evidence about what actually protects people, not on which posture performs strength best.

The plain-language version

Put plainly, security is not mainly about how big our military is. It is about whether we can take a hit and keep going, and our adversaries have already figured that out: they are inside our water systems and our grid right now, not to spy, but to be able to turn things off if a crisis comes. So defend the lifelines and fund the defenders. Secure the supplies we cannot live without, down to the raw ingredients, because 90 percent of the world’s advanced chips coming from one island is a single point of failure with a flag on it. Build energy we control on a grid that can take a punch. Get ready for the next outbreak before it arrives. Hold every ally to one standard, the one already written in our law. Use force only as a last resort, for moral ends, decided in the open. And invest in communities that can look after themselves when the worst happens, because that is exactly the layer the other side is probing. Security is a form of resilience, and the cheapest disaster is the one we prevent.

Footnotes

1. E&E News (POLITICO) reporting NERC’s count of grid susceptibility points growing ~60/day ↩

2. U.S. International Trade Administration, Taiwan country commercial guide: semiconductors ↩

3. State Department, the Leahy Law ↩

4. Human Rights First on uneven Leahy Law application (advocacy source, flagged) ↩

5. Minnesota IT Services on the July 2026 water-system attacks Utility-level detail (Braham offline; Plymouth continuing manual operation) and the seven-state figure as reported by MPR News, NBC News and ABC News, late July 2026. ↩

6. GAO, EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems (GAO-24-106744) Restated to Congress in GAO-26-109159, 21 May 2026, which also records the November 2023 Pennsylvania breach and the reversion to manual pumping. ↩ ↩²

7. CISA, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) Issued April 2026, last revised 22 July 2026. Cited as context for the threat environment, not as attribution for the Minnesota attacks. ↩