We're talking dependency on private sector contractors, who themselves then, in their products and services, are dependent upon these industrial control devices and these operational technology systems, which are vulnerable.

It's the Lawfare podcast.

I'm Justin Sherman, contributing editor at Lawfare and CEO of Global Cyber Strategies,

with Andy Grotto, founding director of the Stanford Program on Geopolitics, Technology, and governance, and Jim Dempsey, a senior policy advisor to that program and a lecturer at the UC Berkeley Law School.

If we want the utility to provide an extra level of resilience beyond what its business interests would support,

to meet a national policy need involving a higher degree of resilience for military installations

because they need to potentially project power overseas, well, that's a gap, right?

And that gap's not going to fill itself.

Today, we're talking about the U.S. military's domestic cyber security vulnerabilities

and operational

technology, how adversaries could exploit them, and what the future of this landscape holds.

We're going to speak today, as we heard in the introduction, about your excellent recent study,

which was published at the end of 2025 in the Cyber Defense Review, linked as always below this

episode, which is titled Ensuring the Cyber Resilience of Critical Infrastructure, Serving Domestic

Military Installations, Questions for Senior Leadership.

Since, of course, this is the Lawfare podcast.

I will also note that listeners can

find an excellent summary piece of said study published on Lawfare as well. So to jump right in,

start by framing for us, A, what motivated you to write this study in the first place, and then

B, some of the high-level questions you were seeking to address

by doing so. Thanks, Justin. It's really good to be here and looking forward to talking about a

topic that has certainly bothered me for well over a decade now. When I came to Stanford in 2017, I'd spent the previous several years

...