RealClearWire—Refrigerators are probably the last thing anyone would consider a national security vulnerability, which is precisely why the unusual refrigeration failures at U.S. military commissaries deserve more attention than they are getting.
There is no public evidence that the incidents were caused by a cyberattack or a foreign adversary, and they may ultimately prove to be nothing more than equipment, software, or maintenance failures. But when refrigeration systems at multiple military installations experience problems within a relatively short period and at Fort Huachuca all of the commissary’s freezers reportedly went into defrost mode overnight, leaders at the Pentagon should be asking a larger question: If a sophisticated adversary wanted to test its ability to disrupt the infrastructure supporting America’s military without firing a shot, is this what it might look like?
That question matters because China and other U.S. adversaries are no longer thinking about cyberwarfare simply as stealing secrets or attacking classified networks. They are looking for ways to penetrate the infrastructure America depends upon and, when necessary, create disruption, confusion, and delay. It echoes the familiar warnings of a certain rail conductor from a beloved children’s television show about a talking train.
U.S. intelligence and cybersecurity agencies have already warned that Chinese state-sponsored actors have gained access to American critical infrastructure and, in some cases, appear to be positioning themselves for potential disruption during a future conflict. A coordinated attack against something as ordinary as refrigeration would therefore not have to cause catastrophic damage to be successful. The objective could be much simpler: get inside, disrupt operations, complicate the response, and watch how America responds.
That is what makes the recent commissary incidents worth examining beyond the immediate loss of food or inconvenience to military families. If an adversary wanted to probe U.S. military infrastructure, attacking a commissary would carry considerably less risk than shutting down an airfield, disrupting a command center, or interfering with a weapons system.
Yet it could still provide valuable intelligence about how quickly geographically dispersed incidents are identified, whether installations communicate with one another, when a maintenance problem becomes a cybersecurity investigation, which contractors and government agencies respond, and how long it takes the Pentagon to determine whether seemingly isolated failures are connected.
In other words, the purpose would not be the refrigerator, the purpose would be to learn how and when we would respond to the incidents.
That possibility becomes more important when viewed against what the U.S. government has already told us about China‘s cyber strategy. Federal cybersecurity and intelligence agencies have warned that the Chinese state-sponsored group known as Volt Typhoon has infiltrated communications, energy, transportation, water, and other critical infrastructure. The concern is not simply espionage. U.S. officials have assessed that these actors are positioning themselves inside American infrastructure so they could potentially disrupt operations during a crisis or conflict.
Consider what this could mean during a potential confrontation in the Indo-Pacific. An adversary would not necessarily need to launch a massive cyberattack that immediately announces the beginning of hostilities.
Communications through satellites could become unreliable. Ports could experience unexplained problems. Transportation networks and logistics facilities could slow, and building-control systems could begin malfunctioning. Military installations could begin dealing with what initially appear to be unrelated maintenance issues but in a compounded manner.
None of those events alone would cripple the United States, but together they could consume resources, complicate logistics, slow decision-making, and create uncertainty at precisely the moment when speed matters most.
That is the nature of the vulnerability Washington needs to confront. America’s military installations are filled with operational technology that most people would never consider part of the battlefield: heating and cooling systems, electrical controls, water systems, fuel distribution, warehouses, refrigeration, elevators, access controls, cameras, sensors, and building-management systems. Increasingly, these systems are digitally monitored, networked, automated, or remotely accessible. Those capabilities improve efficiency and reduce costs, but they also expand the potential attack surface.
We have appropriately spent billions protecting classified networks, weapons platforms, satellites, communications systems, and command-and-control capabilities. But those sophisticated systems still depend upon an enormous amount of ordinary infrastructure. A fifth-generation fighter needs fuel. A data center needs electricity and cooling capacities. A logistics hub needs functioning warehouses and access controls. Military installations need water, power, communications, and transportation.
An adversary does not necessarily have to defeat our most sophisticated weapons if it can create enough problems in the infrastructure surrounding them to slow our ability to use them.
Fort Huachuca makes the current incidents particularly noteworthy. The installation supports significant Army intelligence, communications, network, and cyber missions. There is no evidence that its commissary was deliberately targeted, and we should be careful not to suggest otherwise until the facts are analyzed. But that is exactly why the incident presents an opportunity to ask whether the Pentagon has sufficient visibility across the operational technology operating on its installations and whether it could quickly distinguish a routine equipment malfunction from coordinated malicious activity.
Congress should be asking those questions as well. As it considers the next National Defense Authorization Act, Intelligence Authorization Act, and defense appropriations bills, operational technology security should receive greater attention alongside traditional cybersecurity.
Congress should ask the Pentagon how much installation infrastructure can be remotely accessed, where the hardware and software originate, who maintains those systems, what networks they touch, and whether the Department of War has the ability to identify similar anomalies occurring simultaneously across multiple installations. Cybersecurity requirements for the systems supporting military installations should be viewed as part of readiness, not simply generic facility management.
There is also a broader industrial-base issue at play. We spend enormous amounts of time debating where the components in our weapons systems are manufactured, and rightly so. We should apply the same scrutiny to the digital and physical infrastructure supporting those weapons and the people who operate them. Supply-chain security cannot stop at the aircraft, missile, satellite, or autonomous system. It must extend to the connected infrastructure underneath the entire enterprise.
The refrigeration failures may ultimately have a completely innocent explanation. In fact, we should hope they do. But the more important lesson is that America’s adversaries are actively searching for ways to disrupt the United States below the threshold of traditional conflict, and the systems we overlook may be precisely the systems they find most attractive.
The next battle frontier may not begin with a missile launch or an attack on a satellite. It may begin with a series of small, seemingly unrelated failures designed to disrupt, complicate, and confuse us before we even realize we are under attack. And yes, that could include a simple refrigerator.
This article was originally published by RealClearDefense and made available via RealClearWire.
We publish a variety of perspectives. Nothing written here is to be construed as representing the views of the Daily Signal.
