A Cyber War Game Starts at the Water Tap

WIRED observed a closed-door war game in a conference room above Times Square in Manhattan, where about 30 insurance executives confronted a simulated attack attributed to the China-linked Volt Typhoon group. The scenario imagined hackers disabling 5,000 US water utilities at once under a countdown clock. It did not document a new attack.

The distinction is essential because Volt Typhoon is associated with reported groundwork inside US infrastructure, while the burst mains, hospital evacuations and insulin shortages discussed in the exercise were possible consequences inside the scenario. A rehearsal can use an alarming premise without proving that the premise has occurred.

The case for rehearsing the failure

The strongest defense of the exercise is practical. Utilities and agencies do not want their first argument about authority, insurance, emergency supply and public messaging to begin after pumps stop. A compressed simulation can expose missing phone numbers, contradictory plans and decisions that no participant is clearly empowered to make.

Each actor has a reason to participate. Utilities want continuity and funding. Federal agencies want coordination and visibility. Insurers want losses they can estimate and price. Private contractors can sell monitoring, response and recovery tools. Chinese operators, if they possess latent access, benefit from uncertainty about what they can disrupt and who will respond. Those incentives overlap, but they are not identical.

What the countdown can hide

A dramatic cyber scenario can also make every failure look like a software problem. That framing favors dashboards, threat feeds and expanded authority. It can obscure neglected maintenance, thin staffing, weak spare-parts inventories and public communication systems that already fail during ordinary outages. A blinking dashboard photographs better than a practiced valve crew.

The useful budget question is therefore not whether cyber tools matter. They do. It is whether resilience money also buys manual controls, segmented systems, trained operators, repair crews, replacement equipment and a phone tree capable of telling residents what happened. The public experiences strategy as water pressure, hospital capacity and the credibility of the next update.

The exercise will have earned its urgency if subsequent budgets strengthen both digital defense and physical recovery. If spending concentrates on visible cyber products while utilities still lack manual options and repair capacity, the war game will have rehearsed institutional alarm more effectively than restoration. Watch the appropriations and contracts, not the countdown clock.