In late July, more than 30 water and wastewater systems in Minnesota were hit in a coordinated cyberattack, part of a broader campaign affecting utilities in at least seven states. Federal investigators have not formally attributed the attacks, though Iranian-linked actors are among the suspects. The timing is difficult to ignore: the incidents came amid the five-month U.S.-Iran war, after federal agencies had warned of ongoing Iranian-affiliated cyber activity against Internet-connected operational technology.
The immediate damage was limited. No contamination of drinking water was reported, though some systems experienced operational disruptions, including pressure problems and loss of remote control. But the larger lesson is more consequential. A war can be started by political decision; its consequences cannot be confined by political decision. Washington can choose targets, timing, and intensity, but it cannot guarantee that an adversary will answer on the same battlefield or by the same rules. In an era of cyber operations and networked infrastructure, a conflict thousands of miles away can return home without a missile ever crossing the Atlantic.
America’s water sector illustrates the problem. The United States has more than 148,000 public water systems, many of them small and resource-constrained. Federal agencies have repeatedly warned that Internet-exposed operational technology, weak access controls, aging equipment, and limited cybersecurity capacity create openings for hostile actors. The point is not that every recent intrusion can be traced to Tehran. Rather, a foreign adversary does not need to defeat the U.S. military in order to impose costs on American society. It need only exploit vulnerabilities that already exist.
That changes how national security should be measured. Water, electricity, communications, transportation, and other public-service networks are not secondary to national defense. They are part of it. If an adversary can disrupt a pumping station, interfere with an industrial controller, or force a utility into manual operations, the frontline is no longer defined only by where American troops are deployed. It may be a small town where residents lose water pressure, a hospital that depends on uninterrupted power, or a local government with neither the staff nor the budget to defend its systems against a sophisticated attacker.
This is the boomerang effect of modern war. Military action abroad can generate incentives for retaliation in domains where the United States is more exposed and where the attacker’s costs are lower. American forces may be able to destroy military installations in Iran, but Iran or actors aligned with it can respond asymmetrically, through cyber operations, attacks on regional infrastructure, pressure on shipping, or other indirect means. Strategic superiority in one domain does not eliminate vulnerability in another.
That does not mean the United States should remain passive in the face of threats. A state has the right to defend itself, protect its forces, and deter attacks. Nor does every cyber incident prove that military action abroad is responsible for what happens at home. Attribution in cyberspace is difficult, and hostile cyber activity against U.S. infrastructure predates the current war. Those are important cautions.
But they do not resolve the central policy question. Deterrence is not simply the ability to strike harder than an adversary. It is the ability to reduce the likelihood that the adversary will impose unacceptable costs in return. If each new round of military escalation expands the number of American systems that must be defended, increases incentives for asymmetric retaliation, and consumes resources needed for domestic resilience, Washington must ask whether it is strengthening deterrence or merely widening the field of vulnerability.
The distinction matters because political leaders tend to describe war through metrics that favor the state: targets destroyed, weapons eliminated, bases damaged, operations completed. Citizens, however, experience war through different metrics. They notice whether basic services work, whether prices rise, whether public systems are reliable, and whether the government can protect them from risks created by decisions made abroad. A strategy can be tactically successful and still leave the public more exposed.
This is why the simplest test of the Iran war is not whether the United States can continue striking Iran. It plainly can. The more important test is whether continued military action makes Americans safer. Are critical systems more resilient than they were before the conflict? Are the incentives for retaliation lower? Is the economy better insulated from regional shocks? Does the United States have more, rather than less, capacity to deal with the next crisis? If the answers are uncertain or negative, military capability alone is not enough to justify continued escalation.
The strongest case for restraint, then, is not an argument against American power. It is an argument about what American power is for. Military force serves the national interest when it protects the population and improves the country’s security position. When the use of force creates new routes for adversaries to reach Americans at home, the domestic cost must be counted alongside battlefield gains.
The recent attacks on water systems are a warning precisely because their effects were limited. Washington cannot eliminate every cyber threat, and it cannot guarantee that foreign conflicts will remain geographically contained. But it can factor domestic exposure into decisions about escalation.
A government should judge war not only by the damage it can impose abroad, but by the security it preserves at home. If a foreign conflict makes American infrastructure a more attractive target and ordinary citizens more vulnerable to retaliation, that is not a peripheral cost. It is part of the strategic balance sheet.