In brief: When a civic institution is breached, the named target is the institution, but the cost is absorbed by the residents, patients, and families who depend on it and have no backup system. State-sponsored actors target civic infrastructure because the damage is immediate and the recovery is slow. Cybersecurity has always been a social policy question, and the work now is about the people on the other side of the technology.
Key Takeaways
- The named target in a breach is the institution, but the people who pay are the residents, patients, and families who depend on it.
- For them there is no backup system. When the institution goes offline, the service is simply gone.
- Civic institutions are the preferred attack surface because the damage is immediate and the recovery is slow.
- What a well-resourced enterprise recovers from in hours can take a civic institution weeks.
- Securing the hospitals, government agencies, and social service organizations communities depend on is a form of civic leadership, alongside expanding transit and funding affordable housing.
Over the past several weeks, I have written about two developments that most cybersecurity commentary treats as separate stories. The first was the escalation between the United States, Israel, and Iran, following the documented pattern of state-sponsored actors pivoting to civilian infrastructure during kinetic conflict. The second was the White House National Cyber Strategy, which formally named state, local, tribal, and territorial organizations as critical nodes in the national cyber defense posture, and then declined to close the readiness gap those organizations have carried for years. Both pointed in the same direction: the threat is active, the federal acknowledgment is not an operational solution, and the organizations left holding that responsibility are the least equipped to carry it.
What neither post named directly is who absorbs the cost when those organizations fail. The named target in a breach is the institution, but the people who pay are the residents, patients, and families who depend on it: populations navigating public benefits systems, accessing care through community health clinics, relying on housing assistance that runs through a city or county network. For them there is no backup system. When the institution goes offline, the service is simply gone.
Thirty years at the intersection of technology and civic infrastructure has shown me this asymmetry in practice. A ransomware attack on a regional hospital does not just compromise data; it delays care, forces ambulance diversions, and erodes the institutional trust that takes decades to build. A network failure at a nonprofit serving vulnerable populations can suspend operations entirely, eliminating services that have no substitute. What a well-resourced enterprise recovers from in hours can take a civic institution weeks, and the people waiting on the other side of that window are already operating without reserve.
The current environment makes this more urgent. When nation-state actors and their proxies target civilian infrastructure, the selection logic is deliberate: disrupting local government, healthcare, and social services produces visible, cascading damage without requiring military precision. The goal is not destruction — it is to make the state appear unable to protect its own people. The organizations closest to daily civic life, and least equipped to defend themselves, are the preferred attack surface precisely because the damage is immediate and the recovery is slow.
There is a version of civic leadership that expands transit, funds affordable housing, and drives workforce development. There is another version that secures the hospitals, government agencies, and social service organizations those communities depend on. For most of my career those felt like different conversations happening in different rooms, and thus recognizing that they are not changes how the work feels and what it demands.
The populations are the same. The stakes are the same. And the through-line, that the people with the least margin are always the last to be protected, becomes impossible to unsee once you see it. Cybersecurity has always been a social policy question. It has just never been welcomed into that conversation. That is the work now. Not the technology. But the people on the other side of it.
Frequently Asked Questions
Why do nation-state actors target civic infrastructure?
Disrupting local government, healthcare, and social services produces visible, cascading damage without requiring military precision. The goal is not destruction but to make the state appear unable to protect its own people. The organizations closest to daily civic life, and least equipped to defend themselves, are the preferred attack surface because the damage is immediate and the recovery is slow.
What does a ransomware attack on a regional hospital actually do?
It does not just compromise data. It delays care, forces ambulance diversions, and erodes the institutional trust that takes decades to build.
Why does recovery take longer for civic institutions than for large enterprises?
What a well-resourced enterprise recovers from in hours can take a civic institution weeks, and the people waiting on the other side of that window are already operating without reserve.
What happens to the people a nonprofit serves when its network fails?
A network failure at a nonprofit serving vulnerable populations can suspend operations entirely, eliminating services that have no substitute.
Is cybersecurity a technology issue or a civic issue?
Cybersecurity has always been a social policy question. It has just never been welcomed into that conversation. The work is not the technology but the people on the other side of it.
About the Author
Cyrus J. Walker III is the founder and CEO of Data Defenders, a Chicago cybersecurity firm, with thirty years of managed and professional services across cybersecurity, network engineering, digital forensics, election security, and board governance.
Further Reading
- AI Is Lowering the Cost of Attacking the Communities That Can't Afford to Defend Themselvesthe same communities, and what is accelerating toward them.
- It's Not Time to Run for the Hillsautonomous AI cyberattacks and the operations approach that answers them.
- Speaking: Cybercrime Is a Civic Problemthe talk this argument comes from.
- The Cybersecurity Lifecyclehow governance, technical infrastructure management, and process stay in balance.