What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out

It’s astir an hr and 10 minutes into the role-playing crippled I’ve been invited to observe, a simulated catastrophic cyberattack connected US h2o utilities, erstwhile the full happening begins to consciousness little similar a amusive day playing Dungeons & Dragons and much similar a plausible menace to civilization.

A afloat 24 hours of in-game clip person passed since hackers disrupted 5,000 h2o utilities crossed the United States successful this imagined scenario. Joshua Corman, the erstwhile Cybersecurity and Infrastructure Security Agency strategist serving arsenic our dungeon master, stands astatine the beforehand of a league abstraction successful an bureau operation precocious supra Times Square, narrating the latest updates to the game’s participants, a fewer twelve security executives acceptable up successful six teams. All of them person gone disturbingly silent.

“You ready? It’s astir to get harder,” Corman says. “I’m going to stock a fewer things, and it’s going to hurt.”

It is, of course, inactive the aforesaid April day arsenic erstwhile we started—but successful crippled time, the second-order effects of wide h2o outages person started to go clear. Food refrigeration systems are failing astatine acold retention warehouses. Water-dependent cause and chemic manufacturing has been bottlenecked, starring to insulin shortages. Data centers’ cooling systems are failing, causing outages of unreality services. Most critically, 2,000 hospitals are without water, hampering diligent attraction and successful immoderate cases starring to evacuations arsenic HVAC systems unopen down and the July heat—the crippled takes spot conscionable earlier Independence Day successful 2027—bakes facilities.

Worse yet, Corman is playing a looping video onscreen, astatine the beforehand of the room, showing a burst h2o main: The hackers person managed to trigger not conscionable IT disruption but also, successful astatine slightest immoderate cases, existent carnal demolition that volition instrumentality acold longer to fix. “Everyone downstream is without h2o pressure,” Corman says. “Everything depends connected water.”

(The hostility successful the country has besides peaked, successful part, owed to Corman’s determination to contradict participants immoderate organized restroom breaks. “There are nary breaks successful existent incidental response,” Corman explains conscionable earlier the elephantine h2o tube starts gushing onscreen. “If you person to spell to the bathroom, spell to the bathroom. But you mightiness miss thing vital.” No 1 goes to the bathroom.)

The cardinal task Corman has assigned for this circular to the teams of participants, each of whom are playing the amazingly pivotal relation of security companies, is to determine however they’ll dole retired their resources—contracted cybersecurity incidental responders and money—and which clients volition get priority.

Will their concern relationships with clients dictate their response? Or volition they absorption connected minimizing harm for the astir imaginable people? And fixed that immoderate clues successful the crippled are already suggesting this catastrophic cyberattack was carried retired by the Chinese subject to hamper a US effect to its penetration of Taiwan, volition the insurers beryllium required to absorption connected keeping subject facilities operational?

Left unspoken successful this question is different scope of disastrous possibilities for the insurers themselves: Will this catastrophe bankrupt them? Or volition they invoke an “act of war” exclusion successful their security policies—a modular clause that exempts carriers from each liability erstwhile an equipped struggle breaks out—and wage their clients nothing, frankincense risking that they’ll go the villains of the story?

The teams person 15 minutes to determine connected a policy. “OK?” Corman asks. “Let’s commencement the timepiece now.”

Most China-watchers in the cybersecurity satellite agree, successful fact, that this peculiar timepiece has already been ticking for years.

In May 2023, Microsoft, the National Security Agency, and CISA each announced the find of what they called Volt Typhoon, a radical of hackers moving successful work of the Chinese military. The intruders had breached into the networks of captious infrastructure facilities crossed the continental United States and the US territory of Guam, hitting targets related to everything from manufacturing to telecommunications to the electrical grid.

These breaches were particularly alarming due to the fact that the hackers seemed to beryllium going beyond the espionage that’s go modular signifier for Chinese authorities cyberspies. Instead, according to Microsoft, they were “pursuing improvement of capabilities that could disrupt captious communications infrastructure betwixt the United States and Asia portion during aboriginal crises.” Volt Typhoon was, successful different words, “pre-positioning,” arsenic different CISA and NSA advisory would enactment it successful aboriginal 2024, laying the groundwork for wide cyberattacks aimed astatine hampering the US subject astatine a important strategical moment—perhaps, immoderate cybersecurity analysts suggested, connected the eve of an penetration of Taiwan.

As the US authorities and cybersecurity manufacture continued to way Volt Typhoon, however, it became wide that the hackers’ people database wasn’t constricted to networks that would let the sabotage of US subject assets. They included the IT systems of a h2o inferior successful Hawaii, aggregate US ports, and astatine slightest 1 lipid and state pipeline that mightiness person subject relevance, but besides hundreds of different entities including h2o and electrical infrastructure arsenic small-scale arsenic the Littleton Electric Light & Water Departments successful Littleton, Massachusetts, a municipality with conscionable nether 10,500 residents. “The lone crushed to people that benignant of entity is to origin societal chaos successful the United States,” CISA’s erstwhile enforcement manager Brandon Wales told WIRED successful aboriginal 2025. Volt Typhoon, helium said, seemed to beryllium preparing to “cause chaos successful the homeland—to power our geopolitical state of action, our willingness to fight.”

Even now, 3 years aft Volt Typhoon’s archetypal discovery, menace quality analysts accidental China’s efforts to hole for US civilian infrastructure disruption continue. Joe Slowik, a erstwhile Los Alamos National Labs cybersecurity researcher moving connected declaration for the Department of Energy, says Volt Typhoon—or a related hacker radical it has evolved into—continues to people the US electrical grid and h2o utilities.

Some of these intrusions are caught, Slowik says. Others spell undetected, successful portion owed to the minimal information budgets of municipal utilities, and successful portion owed to the hackers’ stealthy mode of operating, known arsenic “living disconnected the land,” that hijacks morganatic functions successful a web alternatively of planting malware. “It’s beauteous bully tradecraft,” says Slowik, who present leads menace probe astatine cybersecurity steadfast Dataminr. “But it’s besides applying that tradecraft to areas that truly don't person the capableness to place it.”

The script modeled by Corman’s warfare game—5,000 hacked h2o utilities—would beryllium unprecedented. It besides isn’t the astir probable result of Volt Typhoon’s intrusions, cautions Jen Easterly, who served arsenic manager of the Cybersecurity and Infrastructure Security Agency erstwhile China’s hacking run was archetypal discovered. Yet Easterly, present CEO of the RSA cybersecurity conference, besides warns that AI could marque that mass-sabotage hypothetical acold much plausible, peculiarly implicit the adjacent fewer years, erstwhile its usage successful violative hacking whitethorn outpace its usage by defenders.

The standard of China’s preparations remains unknown, Easterly says, but its intent is clear. “What we recovered was truly conscionable the extremity of the iceberg,” she says of her clip moving the Volt Typhoon effect astatine CISA. “Do I judge there’s immoderate alteration to China's precise deliberate strategy to make entree points successful our astir important civilian infrastructure, to beryllium capable to motorboat disruptive attacks successful the lawsuit of a situation successful the Taiwan Strait? No, I don't.”

Just 2 months ago, erstwhile NSA manager of cybersecurity Rob Joyce spelled retired the informing adjacent much starkly successful an nonfiction for the Cyber Defense Review, arguing that the menace Volt Typhoon poses remains arsenic wide and contiguous arsenic ever.

“China has efficaciously strapped the integer equivalent of explosives to the backbone of American society,” Joyce wrote. “Quietly maintaining access. Waiting.”

Even arsenic it’s loomed implicit US cybersecurity for much than 3 years, Volt Typhoon—or immoderate it has present become—has ne'er successful a azygous confirmed incidental pulled the trigger and carried retired an existent disruptive cyberattack. Understanding the menace it represents remains an workout successful imagination.

Hence the warfare crippled that I’m present to witness. The event, convened by an security manufacture cybersecurity enactment called CyberAcuView, has invited 30 oregon truthful security execs. They’ve allowed maine to beryllium successful connected the information that nary of them oregon their employers are identified.

Corman, who has tally dozens of these types of warfare games, says helium asked maine to be this circumstantial workout for 2 reasons: First, fewer radical recognize the cardinal relation of security successful the midst of a cybersecurity emergency. Hacking victims’ archetypal telephone is often to their security company, who past o.k. and unlock instrumentality firms and cybersecurity incidental effect providers successful the hours that follow.

Second, Corman argues that security companies service arsenic illuminating crippled players: They person a beardown fiscal inducement to squarely measure risk—“skin successful the game,” arsenic Corman puts it—without hyping it up oregon downplaying it.

Around 1 pm, aft immoderate introductions and crushed rules (“Don’t combat the scenario”), Corman begins. He quotes the 1983 hacker classical movie WarGames, addressing the room: “Shall we play a game?”

Day 1 is July 1, 2027. The New York Times has published a header that greeting astir increasing fears of a Chinese penetration of Taiwan. A cybercriminal ransomware gang’s ongoing hacking spree has taken up astir a 3rd of the US’s cybersecurity incidental effect capacity. The cybersecurity manufacture is warning, meanwhile, of 3 vulnerabilities successful web borderline devices similar firewalls and VPNs—the benignant that Volt Typhoon has agelong utilized to get a foothold connected a unfortunate network—being exploited by unnamed hackers.

Then the participants perceive the existent starting gun: A restricted advisory from the US national authorities states that thousands of h2o utilities person been breached, their controls are unresponsive, and anecdotal reports suggest carnal damage. The execs’ archetypal duty is to find if and however they’ll pass this quality to customers, and then—given that this volition astir surely transcend their capableness to unlock funds for targeted victims—decide however they’ll take which clients to prioritize.

The breakout sessions start. At my table, an statement begins astir instantly connected the question of whether to alert the insurer’s wide scope of firm clients. Most of the array wants to stock the quality with each customers. One subordinate disagrees, arguing that the accustomed security exemplary is that it’s the lawsuit who archetypal reports an incidental to the insurer on with a claim—not the different mode around.

“So do? Don’t?” 1 subordinate asks the table.

“Don’t,” the holdout says. The naysayer is rapidly outvoted, and they take to alert each their customers.

Corman is walking astir the tables, handing retired surprises. He comes to my table, tells idiosyncratic to rotation a 20-sided die, past looks astatine the effect and tells the radical without mentation that each incidental responders astatine Dragos, CrowdStrike, and Mandiant—some of the biggest providers of those exigency cybersecurity responses for concern services similar h2o utilities—are unavailable, seemingly engaged with different victims. My array volition person to scrounge up incidental responders from other, smaller companies oregon beg for the assistance of authorities agencies. “Perfect,” 1 subordinate responds.

This scarcity makes the question of which customers to assistance archetypal each the much touchy. The array comes to a unsmooth statement that they’ll prioritize clients successful bid of size, biggest first, defined by revenue.

As each array takes turns presenting its decisions, different tables accidental they’ve opted to prioritize customers connected a first-come, first-serve basis, oregon to travel immoderate vaguely defined consciousness of “national security” arsenic defined by the government, though it’s not wide who successful the authorities is going to connection that definition.

One array asks wherever incidental responders from CISA, the nation’s premiere cybersecurity defence agency, person been during each of this. Corman notes that CISA has spent the past 15 months without a Senate-confirmed manager and has hemorrhaged staff. Some tables suggest they’ll inquire for assistance from cybersecurity experts successful academia oregon the National Guard.

None of that, it’s soon clear, volition beryllium enough.

Day 2 of the simulation arrives, and Corman lays retired the caller reality: Numerous h2o mains crossed the state person broken. The man-made drought has dispersed to hospitals, information centers, refrigeration, and manufacturing.

Then Corman throws different curveball: He plays a prerecorded video connection from a fictional subject authoritative appealing to the security companies’ assistance successful responding to the geopolitical menace posed by China, the archetypal clip that country’s sanction has been spoken successful the crippled truthful far. “I'm astir acrophobic astir our quality to support our subject mobility, a cardinal constituent of nationalist security,” the authoritative tells them.

Corman hands retired the day-two assignment: As the disruption spirals outward, however volition they prioritize now which of the h2o utilities merit their resources? The “biggest-customers-first” oregon “first-come, first-serve” answers from the anterior round, conscionable a fewer minutes earlier, present look hopelessly naive. Will they absorption connected restoring h2o successful places wherever they tin prevention the astir lives, specified arsenic hospital-dense cities? Or volition they question to minimize economical harm? Or heed the military’s petition to absorption connected nationalist security, fundamentally prioritizing the military’s effect to China’s imaginable penetration of Taiwan?

Fortunately, nary 1 successful the country is simply a monster. After 15 minutes of breakout conversations, the teams astir the country render the aforesaid verdict, that their archetypal precedence volition beryllium to prevention quality lives—though nary spells retired however they’ll marque the endless intolerable decisions that travel from that answer.

Only 1 person, aft each six teams person fixed that aforesaid answer, speaks up to rise an uncomfortable point. Prioritizing harm to radical supra each other whitethorn not beryllium an option. “The casual reply is nationalist safety, quality life,” helium says. “The much hard 1 is erstwhile you bash person regulators oregon idiosyncratic calling, shareholders asking questions.”

“If Treasury is calling and asking numbers, and we’re saying we’re focused connected quality life, I don’t cognize if that’s the existent speech track,” helium goes on, utilizing a income word for a telephone publication of talking points for lawsuit conversations. Or, helium adds, if an authoritative is telling the institution it needs to absorption connected telecommunications oregon “dual use” infrastructure—meaning things that mightiness person subject importance—that mightiness go “priority fig one,” helium says.

In different words, taking the astir nonstop enactment to support radical from harm successful the midst of a catastrophic cyberattack mightiness necessitate breaking contracts, flouting the military’s demands, oregon straight contradicting a larger US authorities strategy successful the aboriginal days of an unfolding war.

“We didn’t hold connected that arsenic a table,” helium says. “There’s not going to beryllium a consensus.”

At this point, abruptly and mercifully, Corman ends the crippled to commencement a lessons-learned session. During this round, he’s enactment up a descent that represents immoderate of the infrastructure disrupted by the second-order effects of the hackers’ cyberattacks. Next to each is simply a agelong enactment of multicolored dollar signs and outlines of people, representing fiscal nonaccomplishment and quality casualties.

There’s nary constituent successful counting these arsenic if they’re immoderate benignant of people oregon demerit, Corman assures maine erstwhile I inquire afterward. They’re little a quantified measurement of losses than a qualitative assurance that things person gotten precise bad. He’s gotten his constituent across: If this crippled has immoderate winners, they’re not successful the room.

In a postmortem telephone aboriginal on, I inquire Corman: Was it ever really imaginable to triumph his game? Or adjacent to alteration its outcome? Or was it a benignant of Kobayashi Maru, an intolerable trial designed to thatch immoderate different benignant of lesson?

Corman gets the Star Trek notation but disagrees with the analogy. There were moves the players could person made that mattered, helium says, specified arsenic prioritizing h2o betterment successful infirmary towns from the start. He was besides funny to spot if immoderate of the teams invoked exclusions to their security policies based connected acts of war—an statement that led to drawn-out ineligible battles pursuing the billions of dollars successful harm from Russia’s NotPetya cyberattack successful 2017—or planned to assertion reimbursement from the national authorities for their costs nether the Terrorism Risk Insurance Act, oregon TRIA. None of that came up successful my table’s game, however, owed successful portion to the deficiency of certainty connected time 2 of who was down the hacking campaign.

But yes, Corman adds: The extremity of the crippled was to not to make a contention to beryllium won. Instead, it was designed to “overwhelm”—to “surface and shatter assumptions.”

More specifically, Corman says, helium wants to amusement the manufacture that if adjacent a comparatively mild mentation of Volt Typhoon’s imaginable hacking occurred nether existent conditions—Corman argues the existent mentation could beryllium acold worse than 5,000 disabled h2o utilities—it would beryllium beyond the security industry’s capableness to grip it.

Mark Camillo, CyberAcuView’s CEO, who cohosted the warfare crippled with Corman, says the results amusement that a cataclysmic cyberattack whitethorn good beryllium “uninsurable”: that the costs of specified an lawsuit would surely bankrupt the manufacture if insurers don’t invoke act-of-war exclusions that would get them disconnected the hook—which would successful crook origin tremendous harm to the spot that American nine puts successful insurance. One acquisition of the game, Camillo contends, is that security companies mightiness request a authorities money similar the terrorism-focused TRIA to assistance screen its costs, to beryllium refilled with payments from argumentation holders successful the years pursuing a cyber disaster.

But Corman says the bigger acquisition is that the security industry, possibly adjacent much than the US government, has the unsocial powerfulness to alteration each of this—not by learning however to respond successful the midst of a hacking catastrophe but by focusing connected however to forestall one. It could, for instance, request via security policies that customers amended support themselves, compelling clients to reappraisal their networks for the unpatched, susceptible web devices that Volt Typhoon exploits, oregon requiring that they articulation cybersecurity accusation sharing groups. Currently, Corman says, conscionable 0.3 percent of the country’s 151,000 h2o utilities are portion of those organizations, an appallingly debased rank compared to akin groups successful industries similar concern oregon electrical utilities.

“The thought is to assistance insurers recognize that this is not going to play retired the mode they thought it would,” Corman says successful summary. “And marque them deliberation astir what they mightiness bash otherwise erstwhile they permission the room.”

As the last acquisition from WarGames goes, aft all, determination are games wherever the lone winning determination is not to play—or astatine slightest not connected the adversary’s terms.