What Happens if China Hacks the US Water Supply?

0:00Brian:I recently chatted with McKinsey's Dan Swan about how businesses successfully transitioned to AI, the coming agentic wave, and even the sad loss of tennis line judges. Here's a sneak peek. Some people are buying software and calling it a transformation. The people that are really getting the most value from it are fundamentally doing something very different, which is they're taking that technology and they're incorporating it with changing the capabilities of their people, fundamentally redesigning their processes, and tracking the impact through the bottom line. There's much more in the full interview with Dan Swan, which can be found in its entirety on Wired.com.

0:37Brian:Also, check out McKinsey's playbook, Rewired, available at your favorite bookseller. Every company says AI will make employees more productive, but most employees are still stuck waiting on IT. Waiting for app access, waiting for password resets, waiting for someone to fix a laptop issue so they can get back to work. That operational drag adds up fast, and IT teams are overwhelmed trying to keep up. Serval was built to automate that work. You describe what you want automated in plain English, and Serval builds it for you. No complicated workflow builders, no consultants, just faster support and fewer tickets slowing everyone down.

1:11Brian:Unlike traditional automation tools, Serval doesn't require consultants or long implementation cycles. The platform is designed to eliminate repetitive tickets so IT can focus on strategic work instead of constantly firefighting. Serval positions IT as the AI-powered operational backbone of the company, not just a support function. Learn more or start a free four-week pilot at serval.com slash uncanny. That's S-E-R-V-A-L dot com slash uncanny. Serval dot com slash uncanny.

1:48Brian:This is Wired's Uncanny Valley. I'm Brian Barrett, executive editor. We're on a short break from our usual roundtable for the rest of August. Everybody needs some time off sometimes. But we prepared two special conversations for you. This week, we're diving into something alarming that hasn't happened yet, but could. Earlier this year, about 30 insurance executives stepped into a conference room high above Times Square in Manhattan to simulate what would happen if a group of hackers from China attacked the U.S. water supply. Specifically, the idea was to simulate a Chinese cyber attack that would knock out 5 ,000 water utilities in the U.S.

2:22Brian:all at once, and to do it under a countdown clock. Wired senior correspondent Andy Greenberg got a rare invite to this closed-door war game, and call it Dungeons and Dragons for a national security nightmare. It was designed by a former cybersecurity strategist to test what would happen if and when hackers linked to an infamous Chinese operation called Volt Typhoon finally decide to follow through on groundwork that they've been laying for three years. This group that's known as Volt Typhoon, this is a state-sponsored Chinese hacking group. China has secretly stepped up its electronic warfare, deploying what is being called the Volt Typhoon malware throughout the U.S.

2:59Brian:ecosystem. The result could include burst water mains, evacuated hospitals, insulin shortages. Andy's here to tell us more about what he saw and heard, and why the scariest part might not quite be the hack itself, but what it revealed about who's actually in charge when the water stops. Andy, thanks so much for being here. Glad to do it, Brian. Before we get any deeper into the game itself, could you tell us what Volt Typhoon is and how worried people should be in general about this group? Well, Voltifoon is a hacker group that I think represents some of the worst nightmares of the cybersecurity community and the U.S.

3:34government, those who have to plan for catastrophic national security scenarios. This is a Chinese state-sponsored hacker group that does not, like most Chinese state hackers, focus on espionage, but rather has been, it appears, for the last three years, planting malware inside of U.S. critical infrastructure, pre-positioning, as people put it, sort of laying the groundwork for the ability to disrupt these systems, to turn off the power, to cause blackouts, to disrupt telecommunications. And, you know, as I delved into in this story, potentially to affect the water supply. When Volt Typhoon first came to light in 2023, it's been three years now, the headlines said that they were targeting electric grids and telecommunication networks in the continental U.S.

4:25and in Guam specifically. And it seemed like they were probably targeting U.S. military facilities and the surrounding infrastructure. We were kind of trying to figure out their motives for this. And the theory that I think all of us have been working under is that perhaps China is laying the groundwork, preparing for an invasion of Taiwan, perhaps. And they want to be able to disrupt these U.S. military facilities to delay a U.S. response to an invasion of Taiwan. But then it began to become clear that they were actually breaking into U.S. electric and water utilities and other civilian critical infrastructure, not just military, but U.S.

5:05civilian infrastructure across the whole U.S., including, it seems, towns as small as like Littleton, Massachusetts. I spoke, in fact, to the chief information security officer of the water and electric utility in Littleton, who just had no idea why Chinese hackers would be targeting his town of 10 ,000 people. But, you know, what that suggests is that China is trying to gain the ability not just to disrupt the U.S. military, but to actually cause widespread societal chaos in the U.S. as another perhaps diversionary distraction tactic, maybe in the midst of this crisis when they invade Taiwan.

5:45This is all just a theory, but the pieces are there. The fact is that China really is breaking into U.S. civilian critical infrastructure. And I don't want to sound overdramatic here, but like laying what Rob Joyce, the former NSA director of cybersecurity, describes as like digital bombs strapped to our infrastructure.

6:02Brian:It's a theory that's at the heart of this war game exercise that you went to, right? The theory is what if they do pull the trigger on this? How do people react? Do you mind setting the scene, even just how you got there in the first place? Because this is not the kind of thing that people are normally invited to. You normally don't get a look into something like this. So how'd you get invited? Who's there? I have been trying to find a way into this story about Volt Typhoon for years because I feel like this actually is one of the most important things happening in cybersecurity today. And it's gone under the radar in part because China has this incredible restraint that they've never actually pulled the trigger and caused a disruptive cyber attack.

6:39So I was talking a lot to Joshua Corman about this. Joshua is a former strategist for CISA, the Cybersecurity and Infrastructure Security Agency. And so he mentioned to me that he runs these war games, actually dozens of them for different groups. And he invited me to one in particular that he was doing with insurance executives. I thought this sounded like maybe the most boring approach to this very dramatic cyber war story. But Josh explained, and I have now persuaded, that insurance plays such an important role in the response to an event like this. It turns out that when a company gets hacked or hit with a cyber attack like this, their first call is very often to their insurance agency, who then are the ones who unlock the lawyers and the cybersecurity incident responders who they have already pre-approved and are now willing to pay for.

7:35So cyber insurance actually controls on this kind of surprising level our whole national response to an event like this. They are the first call. They want to actually know exactly what is going to happen because they are the ones who will be financially on the hook. And that, to me, sounded actually like a kind of counterintuitively very interesting perspective.

7:55Brian:And it makes sense. I mean, when you think about who knows the most about recovery from a hurricane, it's probably all state and state farm, right? It's home insurers who are there for every step of the process. And when you think about these large scale disasters, which is what we're describing here, a large scale cybersecurity disaster, that's exactly who that's the equivalent, right? It's the equivalent of the all states or the state farms. Absolutely. And, you know, the fact is like they were doing this internally for their own benefit. And in fact, like I was kind of sworn to secrecy in a sense, I'm not allowed to identify anybody in the room.

8:29They didn't, you know, want this to be public. So I felt like this is maybe the closest thing to ground truth of an estimate of what this would be like that I was going to be able to find. So you're in the conference room in your Times Square.

8:43Brian:You've got a bunch of the executives. What is the scenario that they're playing? And what were your sort of first impressions as the exercise began? So Joshua, he gives us some ground rules first, like don't fight the scenario, which is, you know, Brian, you understand that as a former improv comedian. Yes, and. Yes, and your way through the apocalypse. Yes, that's true of Dungeons and Dragons, and it's true of, like, cyber-screting role-playing as well. So it turns out that his scenario was that 5 ,000 water utilities across the U.S. appear to have been hacked and disrupted, and in some cases, the hackers have even caused physical destruction of equipment.

9:24Like, change the water pressure to the degree that water mains have burst. Nobody knows who has done this. Nobody knows exactly what the effects have been. But everybody downstream of these water utilities has lost water. And all of this is unfolding in July of 2027, just a year from now. And Josh, you know, he did read us a New York Times headline from that morning that he invented, which was something like, as the United States prepares to celebrate its independence, Taiwan fears for its own. Meaning tension is building between China and Taiwan, and that was laying the groundwork for this notion that that's when this kind of catastrophic cyber attack might come.

10:06So after laying out this day one scenario, 5 ,000 water utilities hacked, these groups of insurance executives who were actually like set up at tables role-playing are told, you have just received a kind of restricted memo from the U.S. government. The two questions that Josh initially put to them, their kind of first assignment in the game is to decide who are they going to tell about this? Do they tell all of their customers? Do they tell just the ones that they think have been affected? Do they say nothing and wait for their customers who are affected to come to them? And then probably the more important of these two questions, when they do start to get claims from affected water utilities who are their customers, how do they prioritize who to dole out resources to?

10:54Because it's already going to start to become clear that there is real resource scarcity here.

11:01Brian:Then Joshua, who's acting as the guide for this exercise, starts making things gradually worse and worse, right? As soon as he's given them this assignment, he's like wandering around the room, comes over to our table, and he says, okay, actually, you all don't get any incident responders. The main companies that do kind of infrastructure security, like Dragos and CrowdStrike and Mandiant, they're completely at capacity already. So sorry, you don't get any incident responders. You have to figure out like how to deal with this on your own. What do you think Josh was going for in that moment? Josh told me, you know, before it began, actually, that his entire goal with this was to, as he says, surface and shatter assumptions.

11:39Like he wants to shock people out of complacency about like, like thinking that they might know how this is going to unfold and know how to deal with it. I think 5 ,000 water utilities is enough that that makes sense. I think that there are not enough incident responders in the country for all of those victims to get professionals in the room looking at their network. So the insurance companies, they're going to have to figure out, like, who do they prioritize? And that was really the question that Josh was posing to them. In fact, my table was already trying to brainstorm about like, well, maybe we can get people from academia to help.

12:15Maybe we can beg for help from the U.S. government. Maybe we can get like a National Guard to help us. I mean, it was kind of a desperate situation from the very beginning. What the table I was sitting at came up with was let's just say like the biggest customers first. And Josh was like, well, biggest by what metric? And the kind of spokesperson for the table just off the cuff was like, well, biggest by revenue. And that, I think, was just like their, you know, kind of knee-jerk insurance industry answer. And it turned out to be, I think, like a...

12:45Brian:With a national cybersecurity emergency.

12:53Brian:AI is everywhere in the workplace, but which companies are really making it work? That's the question at the heart of Rewired, McKinsey's playbook for winning with technology and AI. When you think about it from a company or a CEO perspective, it's actually not any harder than it is when you've done any transformation in the past, right? You've got to go and understand what's the opportunity, how much is it worth, what's the investment required to get there, and is it going to be important for me to transform my business in that regard? But a lot of people don't actually go through that process of then understanding what are those two or three areas and then making the hard call.

13:30Brian:sometimes it's actually more difficult to say we're not doing four through six than it is to say we are doing one through three. There's much more in the full interview with Dan Swan, which can be found in its entirety on Wired.com. Also, check out McKinsey's playbook, Rewired, available at your favorite bookseller. You know that feeling when you open your laptop in the morning and before you've even had coffee, you've already got 40 new emails, six new pings, and a browser with, honestly, I've stopped counting the tabs. I used to think that was just what work was supposed to feel like. Faster, louder, more.

14:02Brian:And everyone kept telling me AI was going to fix it. But every AI tool I tried just became one more tab. One more app to explain myself to. One more thing slowing me down. Then I found Superhuman Go. It's an AI chat that just lives on the side of your browser. It already knows what you're working on, so you're not starting from zero every time. You can draft an email, summarize a huge thread, even search across your other apps without ever leaving the page you're on. No new tabs, no context switching, no losing your place. That's AI that actually works with you, not on top of you. Check it out.

14:42Brian:Find out more at superhuman.com.

14:48Brian:This week on the political scene from The New Yorker, Gina Raimondo on AI and the future of work. If we have the best chips and the best models and the biggest data centers and a 15 % unemployment rate in this country, we will not win this AI global competition. Everyone is, oh, we can't have regulation. We have to beat China. Let me tell you, you know who would be the happiest man if we have double digit unemployment rate? Yeah, Xi Jinping would love us to be eating ourselves a lot. So let's not be so stupid. Join me, Evan Osnos, and my colleagues Jane Mayer and Susan Glasser every Friday on The Political Scene.

15:24Brian:Available wherever you get your podcasts.

15:33Brian:I recently chatted with McKinsey's Dan Swan about how businesses successfully transitioned to AI, the coming agentic wave, and even the sad loss of tennis line judges. Here's a sneak peek. Some people are buying software and calling it a transformation. The people that are really getting the most value from it are fundamentally doing something very different, which is they're taking that technology and they're incorporating it with changing the capabilities of their people, fundamentally redesigning their processes, and tracking the impact through the bottom line. There's much more in the full interview with Dan Swan, which can be found in its entirety on Wired.com.

16:10Brian:Also, check out McKinsey's playbook, Rewired, available at your favorite bookseller. You know that feeling when you open your laptop in the morning, and before you've even had coffee, you've already got 40 new emails, six new pings, and a browser with... Honestly, I've stopped counting the tabs. I used to think that was just what work was supposed to feel like. Faster, louder, more. And everyone kept telling me AI was going to fix it. But every AI tool I tried just became one more tab. One more app to explain myself to. One more thing slowing me down. Then I found Superhuman Go. It's an AI chat that just lives on the side of your browser.

16:50Brian:It already knows what you're working on, so you're not starting from zero every time. You can draft an email, summarize a huge thread, even search across your other apps without ever leaving the page you're on. No new tabs, no context switching, no losing your place. That's AI that actually works with you, not on top of you. Check it out. Find out more at superhuman.com.

17:17Brian:This week on the political scene from The New Yorker, Gina Raimondo on AI and the future of work. If we have the best chips and the best models and the biggest data centers and a 15 % unemployment rate in this country, we will not win this AI global competition. Everyone is all, oh, we can't have regulation. We have to beat China. Let me tell you, you know who would be the happiest man if we have double-digit unemployment rate? Yeah, Xi Jinping would love us to be eating ourselves a lot. So let's not be so stupid. Join me, Evan Osnos, and my colleagues Jane Mayer and Susan Glasser every Friday on The Political Scene, available wherever you get your podcasts.

18:07Brian:So tell me why. I mean, other than that, it sort of feels callous. What's the rationale? What are the repercussions of prioritizing revenue when you're dealing with a cybersecurity emergency like Volt Typhoon could cause? Well, that started to become clear on day two of the game. On day two was when it started to hit the fan, so to speak. Like, things got very real and disturbing. So Josh kind of announces, okay, 24 hours have passed. Now, the second order effects of all of those water utility outages and destructions and burst water means is starting to become clear. Data centers can't get water, can't cool their computers.

18:45All kinds of cloud services are going down. Manufacturing is extremely water dependent, drug manufacturing especially. So there's a shortage of insulin. Even electrical generation, most of it requires water in some form. But maybe the most critical of all of these things is that hospitals definitely need water. There are HVAC systems in particular. So thousands of hospitals across the U.S. are facing HVAC outages and may have to be evacuated in the hottest parts of the country. So, OK, now Josh is asking this same question again for round two. How do you prioritize your response now? And he kind of ups the pressure by introducing different figures in the story who are making different demands of the insurance companies.

19:33The public and the media are asking, like, what are insurance companies doing to protect human life in this scenario? Treasury is asking them to focus on economic concerns. And then the U.S. military is actually asking them to focus on protecting U.S. military infrastructure. So now the stakes have kind of become clear and the insurance companies have a sense of like, well, which of these things do we value? Human life, the economy, or like kind of U.S. national security and military priorities?

20:08Brian:and it's a remarkable moment in the story i thought because almost everyone in that room says saving human lives are the priority but not everyone one person pushes back pretty hard yeah i mean i think the easy answer in a role-playing game especially is to say well of course we'll protect human life we'll prioritize that but there was like kind of just one person at one table who brought up this very uncomfortable arguments that, you know, we all want to say we're going to protect human life, but we have contracts with customers. We have U.S. government officials telling us to focus on other things.

20:48I just don't know if we'll really be able to focus on human life. Also, it started to become clear quite quickly that simply saying like we're going to protect human life is not a simple answer you know which towns do you try to protect that like do you kind of go for the most hospital dense ones do you go for protecting the ones that are in the hottest climate like how do you figure out where the most life-threatening cyber attack second order effects are actually happening it's just an incredibly complex answer and one that the insurance companies really did not actually seem prepared to figure out.

21:29Brian:I wonder about another question and whether they were prepared to think it out. Did it ever come up, the idea of potentially refusing to pay out claims at all? Josh talked to me about that before and after, that he was kind of trying in part to test whether these insurance companies would claim this exclusion as you're getting at. So insurance policies, cyber insurance policies do not pay out for cyber attacks that are considered an act of war. They have this exception in them. And that became like a huge legal argument after the Not Petya cyber attack, the biggest cyber attack in history in 2017.

22:02Brian:The cyber weapon Not Petya started in Ukraine in June of 2017. It quickly spread, paralyzing major companies and causing more than$10 billion in damage. A lot of victims lost like more than a billion dollars. This was an act of war, but they wanted to claim that it wasn't because they wanted their insurance companies to cover those losses. So Josh wanted to probe whether that would come up here too, but it didn't actually because we were kind of still too much in the fog of war to know whether this was a war, to know who the adversary was. But in the discussion I had with Josh and other of these insurance company executives afterwards, it became clear that, you know, I think this is like maybe the biggest takeaway of the entire game, and it was not sort of spoken out loud in the room, that this event was uninsurable.