Smart Cities or Soft Targets?

The Incident That Changed the Conversation

In February 2021, an operator at the Oldsmar, Florida water treatment facility noticed that someone had remotely accessed the plant's control system and adjusted the sodium hydroxide concentration to more than one hundred times the normal level. The intrusion was caught in time, but the event illuminated a structural failure that security professionals had been warning about for years: the most dangerous attack surface in modern critical infrastructure is not purely digital, and it is not purely physical. It occupies the space where those two worlds meet.

Since Oldsmar, the pattern has continued. Ransomware campaigns have disrupted operational technology at water utilities, caused traffic management systems to go dark, and in documented cases forced municipal governments into emergency manual operations of systems that were never designed to run without digital coordination. The City of Baltimore suffered a ransomware attack in 2019 that disabled city services for weeks and, according to city officials at the time, cost an estimated eighteen million dollars in recovery and lost productivity — a figure that included disruption to physical city operations, not merely data recovery. These are no longer edge cases. They represent an emergent class of kinetic consequence that flows directly from digital intrusion.

The thesis of this piece is direct: the organizational separation between cybersecurity teams and physical security forces is now a structural liability, and municipalities that continue to fund and administer those disciplines in separate silos are actively increasing their exposure to catastrophic, real-world harm.

Why the Perimeter Dissolved

For most of the twentieth century, the security perimeter of a critical facility was a physical concept. A water treatment plant was protected by fencing, guards, and locks. The operational technology inside — pumps, chemical dosing systems, pressure controls — was isolated from outside networks by the simple fact that it was not connected to any. That isolation, sometimes called an "air gap," was the dominant security model for industrial control systems for decades.

The smart city movement systematically dismantled the air gap in the name of operational efficiency, and it did so faster than security doctrine could adapt. Remote monitoring systems, cloud-connected SCADA platforms, IoT-enabled sensors at pumping stations, traffic signal controllers with wireless management interfaces, smart meters feeding data to utility back-ends — each of these represented a deliberate and often beneficial decision to connect previously isolated operational technology to broader networks. The operational gains were real. So were the attack surfaces they created.

NIST Special Publication 800-82, Revision 3, which provides federal guidance on securing industrial control systems, explicitly addresses the convergence of IT and OT environments and emphasizes that physical security of remote digital assets is a foundational component of any serious ICS security program — not an afterthought managed by a facilities department. The document recognizes that a network-connected field device located in an unsecured enclosure at a remote pumping station is simultaneously a cybersecurity problem and a physical security problem. Treating it as only one or the other leaves a category of risk entirely unaddressed.

CISA and the FBI have issued joint advisories warning that foreign state-sponsored actors are actively targeting operational technology systems in water, energy, and transportation sectors. Those advisories consistently note that threat actors are exploiting both network vulnerabilities and inadequate physical controls on remote OT hardware. The adversary does not distinguish between the digital and physical attack surfaces. The organizations defending against them frequently do.

The Physical Bridge Into the Network

One of the least discussed attack vectors in municipal cyber-physical security is the physical accessibility of street-level IoT hardware. Traffic sensors, environmental monitoring nodes, smart streetlight controllers, and parking management devices are typically mounted in publicly accessible locations with minimal physical hardening. Research published in the IEEE Internet of Things Journal has examined how unmonitored street-level IoT hardware can serve as a physical bridge into broader city-managed networks — a point of entry that bypasses the firewalls and intrusion detection systems protecting the city's core network infrastructure, because the attacker is inserting malicious hardware or firmware at a node that is trusted by the network.

This is not a theoretical concern. The technique of physically compromising a trusted network node to gain logical access to a larger system is well-documented in industrial security research and in post-incident analyses of actual breaches. An attacker who can spend ninety seconds at an unattended traffic control cabinet can potentially introduce a device that communicates laterally across a city's operational network. No amount of endpoint detection software protects against a compromise that occurs below the software layer.

For municipal governments, this creates an uncomfortable reality: the cybersecurity team responsible for the city's network may have no visibility into whether the physical enclosures housing network-connected field devices are being inspected, tested for tampering, or monitored. That responsibility often falls to public works departments or contractors who have no cybersecurity training and no mandate to report anomalies to the city's IT or security operations center. The organizational chart itself is the vulnerability.

Water Infrastructure and the Audit Gap

The water sector provides a particularly stark illustration of the problem. The Water Infrastructure Act introduced compliance frameworks that include security assessments for community water systems, but compliance audits have revealed persistent gaps in physical perimeter controls specifically around digital nodes at small-to-midsized municipal water facilities. According to source material referenced in the development of this piece, more than forty percent of such facilities have been found to have inadequate physical perimeter controls on the digital infrastructure managing their operations. USPA is unable to independently verify the precise figure from a single primary source and notes this in the generation notes accompanying this piece; however, the directional finding — that physical security of OT infrastructure at water facilities is systematically underfunded and underemphasized — is consistent with CISA advisories, NIST guidance, and widely reported audit findings across the sector.

The consequence of that gap is not abstract. A water treatment facility's chemical dosing system, connected to a remote monitoring platform through a field device housed in an unlocked outdoor enclosure, is simultaneously vulnerable to a ransomware attack delivered over the internet and to a physical manipulation that introduces an unauthorized device or alters configuration directly. Defending against one vector while ignoring the other is operationally incoherent.

Small and midsized water utilities face a genuine resource constraint. They do not have the budget to retain a full-time cybersecurity team, a physical security director, and the operational staff needed to run the facility. This reality is often used to explain the gap, and it is a legitimate explanation. It is not, however, an acceptable justification for continuing to treat physical security and cybersecurity as separate line items managed by separate vendors with no shared situational awareness. The integrated model is, in many cases, less expensive than the siloed model — and it is substantially more effective.

The Civil Liability Dimension

The City of Baltimore's 2019 ransomware experience introduced a dimension that municipal administrators increasingly cannot ignore: civil liability. The attack disrupted real estate transactions, city billing systems, and government communications for weeks. Subsequent legal discussions — including public litigation proceedings and city council inquiries — raised questions about whether the city had maintained a reasonable standard of care in securing its systems against foreseeable attack vectors. While the specific liability outcomes of Baltimore-related proceedings vary and USPA does not characterize any single case outcome as established precedent here, the broader legal trajectory is clear: courts and regulators are increasingly willing to examine whether organizations responsible for critical infrastructure took reasonable steps to protect against known, documented threat categories.

Known and documented threat categories now explicitly include cyber-physical attack vectors. CISA advisories name them. NIST SP 800-82 provides published guidance on mitigating them. A municipality that has been notified through federal advisories that foreign actors are targeting OT systems through physical access points, and that nonetheless maintains no physical security program for its remote digital infrastructure, is accumulating a liability profile that its legal counsel should find troubling.

The standard of care argument cuts both ways. It creates risk for organizations that ignore the convergence problem. It also creates a defensible record for organizations that can demonstrate integrated security programs with documented inspection protocols, physical access controls on OT hardware, and coordination between their network security teams and their physical security forces.

What an Integrated Program Actually Looks Like

The argument for merging physical security guard forces with digital network threat hunting is sometimes dismissed as impractical because the two disciplines require fundamentally different technical skills. That dismissal conflates integration with cross-training. The goal is not to turn security officers into network analysts or network analysts into security officers. The goal is to build a shared operational picture and a coordinated response protocol.

In practical terms, an integrated cyber-physical security program for a municipality or water utility involves several interconnected elements. Physical security personnel conducting scheduled and randomized inspections of remote OT enclosures — traffic control cabinets, pump station control panels, smart meter communication nodes — operate according to a checklist developed in coordination with the network security team. Anomalies observed during physical inspection, such as unfamiliar hardware, broken tamper seals, or unauthorized modifications to field device enclosures, are reported through the same incident management system used by the network security operations center. Alerts from the network side — unusual traffic patterns from a specific field device, unexpected authentication attempts from a remote node — trigger physical inspection of the relevant hardware location.

This coordination does not require a merged organizational structure, though in some municipal governments that may ultimately be the right answer. It requires shared protocols, shared communication channels, and a shared understanding that a physical anomaly at a field device location is a cybersecurity event, and a network anomaly originating from a field device location is a physical security event.

Municipal budget processes tend to fund these capabilities through separate departments with separate procurement cycles. The result is that a city may have a sophisticated network monitoring platform with no protocol for physical response to the alerts it generates, and a physical security contract with no scope of work that includes OT hardware inspection. Closing that gap requires deliberate program design, not simply more spending in either category.

The Counterargument and Its Limits

Some security administrators argue that the convergence problem is overstated — that well-configured network segmentation, robust authentication on OT systems, and encrypted remote access protocols substantially reduce the risk that a physical compromise of a field device translates into a broader network intrusion. This view has technical merit and should be taken seriously. Defense-in-depth network architecture does raise the cost and complexity of lateral movement from a compromised field device, and organizations that have implemented NIST SP 800-82 recommendations rigorously are meaningfully more resilient than those that have not.

The counterargument's limit is that it addresses only one half of the threat model. Even in a network environment with strong segmentation, a physically compromised field device can cause localized operational damage — altering the function of the device itself — without ever propagating through the broader network. A chemical dosing controller that has been physically manipulated does not need network access to dose incorrectly. A traffic signal controller that has been physically altered does not need to communicate with the city network to create dangerous intersection conditions. Physical security of OT hardware is not merely a backstop for inadequate network security. It is an independent operational requirement.

Furthermore, the actual OT security posture of most small and midsized municipal facilities falls well short of the idealized network architecture that makes the counterargument most compelling. For organizations operating legacy SCADA systems with limited segmentation capacity and constrained IT staff, the physical layer may be the most cost-effective and immediately actionable security investment available.

A Direct Recommendation

Municipal governments and utilities administering critical infrastructure should conduct an immediate inventory of all network-connected operational technology assets located outside secured primary facilities — including remote pump stations, traffic control infrastructure, environmental monitoring nodes, and smart grid endpoints. For each asset class, the inventory should document the physical access controls currently in place, the frequency of physical inspection, and the protocol, if any, for communicating physical anomalies to the network security function.

Where that protocol does not exist, building it is the first priority — ahead of new technology procurement and ahead of additional network security tooling. Technology investments are effective when they operate within a coherent security program. They are significantly less effective when they generate alerts that no one is operationally positioned to act upon at the physical layer.

The smart city is a worthwhile ambition. Connected infrastructure genuinely improves public services, reduces operational costs, and enables data-driven governance. Those benefits do not require accepting the cyber-physical vulnerabilities that have accumulated from a decade of connectivity expansion without corresponding security investment. The cities that will navigate this environment successfully are those that treat the digital and physical dimensions of infrastructure security as a single discipline, administered with a single operational picture, and funded as a single program.

The cities that do not will remain soft targets, regardless of how sophisticated their firewalls become.