Seth Cropsey wrote in his Wednesday Wall Street Journal op-ed that the US and Israel should fight an attrition war against Iran. He then disparaged the view of attrition war held by us and by Israel:

Attrition is a dirty word in American and Israeli strategic circles. In America, it evokes the Western Front’s brutal stalemate from 1914 to 1918, during which millions were sent to their deaths, and tens of thousands wounded and crippled, for no territorial gains. …

He omitted, though, that Israel is already in exactly that type of attrition war, the one inflicted by Hamas over the last decade and more, and an attrition exacerbated by Progressive-Democrat President Joe Biden’s incessant pressure on Israel to agree a ceasefire right damn now, and never mind that that would leave Hamas bloodied but unbowed—and undefeated.

Cropsey, though, wants a broader version of attrition war:

…cumulative effect of pressure applied over time and in many contexts. The North African, Sicilian, and Italian campaigns that preceded the invasion of Normandy are examples. The US has seldom fought wars it can win with a single maneuver campaign, making attrition a coherent strategy.

Those “attritive” campaigns, though, were possible only by a massively superior industrial power engaging a tightly circumscribed industrial power where the engagement flowed from one side being able to replace battlefield losses by far larger margins than could the other. That situation doesn’t obtain today for Israel or—shockingly—even for the US.

Cropsey fleshed out, some, his version of attrition strategy:

Israel and the US need to put Iran’s strengths at risk. …
Iran provides financial backing to its Axis partners, and in Syria and Lebanon to the states themselves. …
Israel and the US have the tools to strike Iranian military capacity in Syria and Lebanon.

Strike. Not destroy. On a limited field in a limited way. Never mind, either, that those kinetic means would not touch Iran’s financial capability.

On the contrary, it’s time to get out of Israel’s way and actually help them to destroy Hamas utterly.

Then, get after Hezbollah, and destroy that terrorist organization utterly.

In parallel with that, it’s time for the US to stop being timid in the Middle East, and destroy the Iranian proxies in Syria and Iraq, and in Houthi-occupied Yemen.

Stop responding to Iranian actions, and force Iran to respond to Israel’s and ours, shorn of its proxies.

That’s an attrition war worth supporting and executing.

The Federal government is warning States regarding a series of cyber attacks against water distribution networks that have been carried out, and that the primary attackers are the People’s Republic of China and Iran. EPA Administrator Michael Regan and National Security Advisor Jake Sullivan wrote a letter to all of our State Governors, in which they wrote in part,

Threat actors affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC) have carried out malicious cyberattacks against United States critical infrastructure entities, including drinking water systems.

And

The People’s Republic of China (PRC) state-sponsored cyber group known as Volt Typhoon has compromised information technology of multiple critical infrastructure systems, including drinking water, in the United States and its territories. Volt Typhoon’s choice of targets and pattern of behavior are not consistent with traditional cyber espionage. Federal departments and agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves to disrupt critical infrastructure operations in the event of geopolitical tensions and/or military conflicts.

They added by way of emphasis,

Drinking water and wastewater systems are an attractive target for cyberattacks because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices.

What particularly drew my eye in their letter, though, was this, which Regan and Sullivan also pointed out as one of the reasons for the IRGC’s choice of targets:

In many cases, even basic cybersecurity precautions—such as resetting default passwords or updating software to address known vulnerabilities—are not in place and can mean the difference between business as usual and a disruptive cyberattack.

Which brings me to my bit about culpability. [A] common type of operational technology used at water facilities where the facility had neglected to change a default manufacturer password. This has to be especially important given the number of lives that depend on reliable potable water. It’s also the case that there is no excuse whatsoever for IT types, or anyone else responsible for maintaining a computer network or any of its subnetworks, being so lazy they can’t even be bothered to do so basic a thing as changing passwords away from factory preset defaults, defaults that are, by design, widely publicized precisely so that those who’ve newly purchased such a device can gain access and change the default password to something else and thereby deny those not authorized easy access.

Thus: it’s time to start holding IT managers whose networks are penetrated because they affirmatively chose not to bother to replace default passwords with very strong passwords not just accountable, but culpable.

Current criminal negligence law centers on offenses that occur

primarily in situations involving the death of an innocent party as a result of the operation of a motor vehicle by a person who is under the influence of Drugs and Narcotics or alcohol.

The key is death of an innocent party, and that innocent party part includes all Americans using our potable water infrastructure or any other critical infrastructure: natural gas distribution, for instance, electricity distribution, heating oil pipelines, and so on. Those primary situations, though, should be easily enough modified to include the potential for death when something so central to life as access to water or to any of the other critical infrastructure deliverables is criminally disrupted. The presence or not of death should only inform the severity of the sanction, not the existence of the criminal negligence.

This criminal negligence culpability with its stern sanctions should apply to IT types responsible for subnet management as well as, not instead of, the overall IT head.

The problem extends beyond mere deaths of users of our water or other infrastructure systems. Prolonged disruption will—not can—severely and negatively impact our national security, our ability to defeat an infrastructure cyber attack or any other attacks done in concert with infrastructure disruption.