Last month, Iranian hackers attacked Minnesota water facilities. Then, other states confirmed that they had been targeted, as well. Iran cyber-attacked at least seven and up to a dozen states in August and likely penetrated them. This should not surprise anyone, and it is not nearly as bad as things could look.

Last year, the outgoing director of the FBI Christopher Wray said:

The Chinese government [has pre-positioned] on American civil critical infrastructure, to lie in wait on those networks, to be in a position to wreak havoc and inflict a real-world harm at a time and place of their choosing.

He listed water treatment plants, transportation systems, the electrical grid, natural gas pipelines, and telecommunications systems as the major concerns.

In layman’s terms, this means that Chinese hackers are already inside those systems and ready to turn them off if a war happens.

That is not the only scenario, they could use that leverage to deter U.S. government action. Which is to say, to blackmail the U.S. government. If China decides to invade Taiwan, the Chinese government could tell the U.S. president, “Feel free to stop us militarily, but, if you do, tens of millions of Americans will lose power, gas, water, cell service, and internet, and your major banks will stop working.” The best-case scenario is that Americans will lose access to everything for a day. For context, that is a fifth of our annual GDP growth. But that assumes the effects are contained to one day, and that traders will not stop investing out of fear of a repeat.

The worst-case—and likelier—scenario is that the crisis will overwhelm the U.S., state, and municipal governments, as well as the private sector, which will need coordination to secure and reboot their systems. That will take more than just a few days. Meanwhile, Americans will not be able to buy food, use power, work, or anything. Looting in the cities will begin, making the situation even worse. Remember the New Orleans riot after Hurricane Katrina? That will be everywhere.

China could use this leverage over the United States in many ways, from trade negotiations to war. Nobody is talking about it, and nobody wants to fix it.

Artificial intelligence is making this vulnerability worse. AI models have already shown capabilities to hack systems beyond what humans could have imagined. Here, Iran is not that much of a worry because it is impoverished and does not have advanced AI technology, meaning it lacks the knowledge, supercomputers, and necessary energy production to hack into U.S. systems. China does.

So we should ask ourselves: If Iran can penetrate American water facilities using humans, what can Chinese AI models do, and how can we stop them?

The U.S. government’s answer is, “Don’t worry, we could do it to them too.” As a rule, every time the government tells me not to worry, I get worried. I hope that we can do it to the Chinese—though I’m not sure that we can—but also, I’d rather not take the risk. Just because we can do it to them doesn’t mean that they won’t take the risk. I know there is a riot in our streets, but riots in Beijing will hardly make me feel better. We need to secure our country first.

Let us focus on government action.

The most important money governments can spend is on the security of their citizens, including securing critical infrastructure from hackers. This means that you should call and demand that your local and state representatives look into cyber vulnerabilities in your state and allocate the necessary resources to fix them. The federal government can also help by allocating money to states for this purpose.

Congress and the White House should do the same thing. Let’s face it: Politicians are not cyber-security experts. This means that Congress and the White House should appoint a commission to study our vulnerabilities and recommend action.

We might also need laws for major private institutions like banks and energy companies to meet cyber safety standards. This includes the state level for utility companies or regulation by state Corporate Commissions.

A major cyber attack on the United States could have a devastating effect nearly as bad as a nuclear war, and nobody is talking about it. Again, if Iran can do it, you can bet that China can too. But the good news is that, unlike a nuclear war, your local and state officials can do something about this. But they are hardly paying any attention.

The reason politicians are not doing anything about it is that they do not think that it can get them any votes. To change that narrative, call them and demand action. Or the next time you are at a town hall with a candidate or a legislator, ask them: After the attacks on the Minnesota water facilities, what is your plan to fix the cyber vulnerabilities in my state?

By: Chuck Warren