WASHINGTON, November 15, 2026 – Looking at the blinking SCADA system in the municipal water control room at 3:14 am, Marcus Vance was not concerned with questions of jurisdiction. Instead, he was curious as to why the pressure sensors for southeast D.C. had suddenly lost twenty percent of their power.
For many years, critical infrastructure protection relied upon an isolating philosophy. The transit authority ran its own closed-circuit cameras, the regional electric companies kept their grid telemetry data safely behind firewalls, and the federal government tracked any aerial threats from remote control centers, without ever contacting the local water board.
Silos. Secrecy. Slow handoffs.
But contemporary analysis on security by Moody’s Ratings reveals that the new physical and cyber threats have rewritten this script. That’s because roughly 85 percent of America’s critical infrastructure is owned and run by the private sector, meaning it’s no longer possible to ensure safety in public areas through only government action at the city or federal defense level.
Here’s the rub: The creation of a threat-sharing system is more complicated than simply connecting computers to one another. It takes overcoming decades of skepticism within the corporate world and legal hassles. The executives at the private utilities are hesitant about providing their internal operational data to any government agency out of fear of public hysteria or fines for vulnerabilities.
To solve the problem of friction between public and private entities, the new methods discussed in the infrastructure security literature revolve around the idea of an anonymous threat-feed system rather than dumping data. Instead of giving their maps of systems to public agencies, the private transit companies and water utilities can provide encrypted anomaly alerts, which will be fed into a joint intelligence channel including the Cybersecurity and Infrastructure Security Agency.
It’s messy work, and frankly, nobody’s pretending the communication barriers have vanished entirely.
Tight municipal budget constraints, reluctance of legacy software systems to communicate with current encrypted streams, and insufficient cybersecurity staff at small water utilities may hinder establishing constant connections with federal agencies. However, when a timely warning helps to prevent a coordinated attack against a regional transit station or a substation, it becomes clear how effective such inter-agency collaboration could be.
It’s yet to be seen whether these collaborative models could keep up with automation and other security challenges such as drones flying below radar detection systems. Nevertheless, it becomes increasingly clear that operators in Washington and elsewhere are learning a hard lesson that city defense isn’t about building walls, but about having a common radar image of the city.
