What would happen if China hacked America’s water supply? I went into a Secret War game to find out

The second day of The simulation arrives, and Corman explains the new reality: several water pipes have been broken across the country. Human-caused drought has spread to hospitals, data centers, refrigeration and manufacturing.

Then Corman throws another curveball: He plays a pre-recorded video statement from a fictional military official imploring insurance companies to help respond to the geopolitical threat posed by China, the first time that country’s name has been mentioned in the game so far. “I am deeply concerned about our ability to protect our military mobility, which is an essential component of national security,” the official told them.

Corman hands over the assignment for day two: As the turmoil escalates outward, how will priorities be set? now Which water utilities are worth their resources? The “largest customers first” or “first come first served” answers in the previous round, which appeared only a few minutes ago, now seem hopelessly naive. Will they focus on restoring water in places where they can save the most lives, such as cities crowded with hospitals? Or will they seek to minimize economic damage? Or respond to the military’s request to focus on national security, essentially prioritizing the military’s response to China’s potential invasion of Taiwan?

Fortunately, no one in the room is a monster. After 15 minutes of breakout conversations, the teams in the room make the same judgment, that their first priority will be saving human lives — though none of them explain how they will make the endless impossible decisions that follow that answer.

Only one person, after all six teams had given the same answer, spoke up to raise an uncomfortable point. Prioritizing hurting people above all else may not be an option. “The easy answer is public safety, human life,” he says. “What’s more difficult is when you have regulators or someone calling you and shareholders asking questions.”

“If the Treasury Department calls and asks for numbers, and we say we’re focused on human lives, I don’t know if that’s the actual course of conversation,” he continues, using a sales term for a telephone script of talking points for client conversations. He adds that if an official tells a company it needs to focus on communications or “dual-use” infrastructure — that is, things that may have military importance — that could become “priority number one.”

In other words, taking the most direct action to protect people from harm in the midst of a catastrophic cyberattack might require canceling contracts, flouting the military’s demands, or directly contradicting a larger U.S. government strategy in the early days of an unfolding war.

“We didn’t agree on that as a table,” he says. ‘There will be no consensus’

At this point, suddenly and mercifully, Corman ended the game to begin a lessons learned session. During this tour, he placed a slide representing some of the infrastructure that was down due to the secondary effects of cyberattacks launched by hackers. Next to each is a long row of multi-colored dollar signs and outlines of people, representing financial and human loss.

There’s no point in calculating these things as if they were some consequence or defect, Korman assured me when I asked him next. It’s not a quantitative measure of losses so much as a qualitative confirmation that things have gotten very bad. He made his point: If this game has any winners, they’re not in the room.