The National Reflex
The internet has no borders. Our defense of it has nothing but.
Let’s trace one internet packet.
It leaves your phone, hops to a cell tower, gets processed into the base station and passed to a gateway, slides into a regional carrier, gets handed up to a long-haul backbone, dives into a submarine cable somewhere off the coast, surfaces on another continent inside a company you have never heard of, and lands on a server a few thousand miles from where it started. Then some stuff happens to it (very technical, I know), and another packet makes the same journey in reverse. The round trip took far less time than the blink you just did. It happened a few billion more times while you read that sentence.
The same mesh that carried your packet from your phone also carries the signal that holds a grid substation below its trip threshold, the telemetry that keeps a floodgate where the operator left it, the dispatch that routes a freight car of chlorine through a rail yard, the load-balancing chatter between two data centers propping up a bank at close, and every bit of the most sensitive secrets held by governments the world over. Water, power, transportation, communications, finance, defense, and the compute under all of it. All of it rides one mesh, stitched across industries and across borders, indifferent to both. Your packet does not know it left the country. It does not know it crossed out of the power grid’s world and into the phone network’s. It just travels.
By the way, this is the core brilliance in the design principles of the internet. When David Clark, et al., invented this in the early 1970s, the idea of a completely agnostic and infinitely scalable global transport network was radical. But that’s another article.
One caveat, otherwise I will get letters: the internet isn’t one clean topology. It’s meshed in the core, trees out at the edges, rings around the cities, a handful of cables holding the continents together, a dude with a ponytail in Topeka. “Mesh” is just the least-wrong single word for the only property that matters here: all of it connects, eventually, to all the rest.
And the thing we built to defend it? A room, in one country, door shut, with a list of who gets a key, vetted one passport at a time, by a guy named Ron who drives his 2013 Ford Fusion between in-person security interviews across two states.
The threat lives in the mesh. The defense lives in the room. That gap is the whole problem.
The adversary already plays the board as it is
Salt Typhoon (AKA the hacking group affiliated with China’s Ministry of State Security AKA the boogie-man of the cyber world and one of the most sophisticated hacking groups out there) maneuvered systematically into the global telecom backbone and lived there, quietly, for years. By the time officials finished counting, they had confirmed at least nine US telecom and infrastructure companies compromised and more than 80 globally, with breaches reaching across dozens of countries through the carriers that connect them. Deputy National Security Advisor Anne Neuberger offered one detail in December 2024 that should keep you up at night: in one provider, a single administrator account had access to more than 100,000 routers. Compromise the account, inherit the network.
Volt Typhoon (AKA the hacking group affiliated with China’s Army Cyberspace Force AKA the Chinese military AKA the ones who are supposed to blow stuff up) is a more chilling story. CISA, the FBI, and the NSA assessed in February 2024 that the group had pre-positioned inside US critical infrastructure for disruption: living off the land, leaving no malware to find, sitting inside communications, energy, water, and transportation networks. They are waiting by the valves, like that sketchy guy smoking a cigarette standing in the shadows just outside the streetlight’s reach.
Those two campaigns and the packet we traced ride the same mesh, for the same reason the packet does. That is where the reach lives. The attack surface is everyone’s network added together. Every carrier, every handoff, every border crossing, every legal jurisdiction, every seam where one company’s responsibility ends and the next one’s has not quite started. The adversary gets all of it. We defend the part we own and can touch and quietly assume the seams belong to somebody else. They don’t belong to anybody. The adversary worked that out years ago.
The chair I’m sitting in
I have watched this mismatch from three seats.
Years on the watchfloors at the NSA and US Cyber Command, where the national frame was simply the air you breathed, and where you could watch an adversary cross multiple regions while your authority to do anything about it stopped cleanly at one. Then three years as an editor at N2K CyberWire, covering the sector-by-sector information-sharing groups, the federal agencies that fed them, and the security startups cashing in, watching institutions inherit their shape rather than choose it. And now coordinating security across a global carrier whose traffic crosses dozens of national borders before breakfast.
Operator, chronicler, carrier. Three different chairs, and from every one of them the defense keeps coming out the wrong shape.
Our collective reflex
Nobody builds the wrong defense on purpose. It’s a reflex repeated so many times that it’s beginning to look like a law of nature.
In May 1998, Presidential Decision Directive 63 asked each US critical-infrastructure sector to stand up a body that would share threat information with the federal government. The ISACs (Information Sharing and Analysis Centers) were born from that directive, one per sector, each one a US institution feeding a US agency. In 1998 this was exactly correct. The scariest thing on the network that year was a teenager with a war-dialer (literally just a modem that dialed a lot of phone numbers really fast), and the most transnational object in your house was the fax machine manufactured in Japan that would get called three times a day by the teenager with the war-dialer. Sound geometry for the world it was drawn in.
The world moved and the geometry stayed. I wrote in Who’s Minding the Store? about the federal coordinating hub thinning out, losing the people and the standing to play its part. The problem here sits one layer deeper. Resourcing is the smaller half of it; the shape is the rest. Add money to the wrong shape and all you buy is a better-funded room that’s still walled off from the things that matter.
The most recent version of the reflex arrived earlier this month. In June 2026 the US telecom sector announced its own independent private industry ISAC (the Communications Cybersecurity ISAC) with eight of the largest US carriers as founding members, a sensible and overdue answer to the fact that Salt Typhoon walked their networks for years. Its own leadership has said plainly that it will not be fully effective until membership grows. That is the right move for the people making it. Vet your circle. Share with people you can haul into a US courtroom if they leak. Legal safeharbor from anti-trust law. Draw the boundary where the clearances and the liability already stop. Every one of those calls is correct on its own, and the sum of them is a defense built around the map and the industry instead of around the network.
Say I’m building a defense for the Washington Commanders. I recruit the best players in college football: Alabama, Georgia, Michigan, THE Ohio State University, the Naval Academy (ha!). I hire the best coaches, the best trainers, the most famous nutritionists on TikTok. I’ve raised buttloads of money, so why not. And then on opening night my defensive line gets run over by a truck packed with high explosives, because I was supposed to build a security defense, not a defensive line. Every part was excellent. The shape was wrong.
The reflex to think in terms of geographic boundaries and industry verticals is nobody’s mistake. It is a hundred reasonable people each drawing the smallest circle they can trust, seeing where those circles overlap, and building on the margins.
We already go transnational. We just pick the wrong moments.
The same government that builds its standing defense one country wide goes transnational the second the task changes.
When the task is to name the threat, the border evaporates. The August 2025 advisory that exposed Salt Typhoon and named the Chinese supplier firms behind it was not a US document. CISA co-sealed it with twenty-six partner agencies across more than a dozen countries: the rest of the Five Eyes (the US, UK, Canada, Australia, New Zealand), then Germany, Italy, Japan, the Czech Republic, Finland, Spain, Sweden, and more. Somebody looked at that threat, decided it was transnational, and built the response to match.
When the task is to break something, the border evaporates again. Operation Endgame, May 2024: a dozen countries, more than a hundred servers seized in one coordinated week, the largest takedown of malware-delivery infrastructure ever run, national jurisdictions treated like chalk lines you can step over. We are, it turns out, world-class at getting a dozen nations to kick down the same door in the same morning. Be clear, though! This is offense, and it’s reactive. No less important. Just don’t confuse it with a good defense.
Ask those same nations to sit in a standing room and defend the door together, and suddenly everyone remembers they have a sovereignty thing that afternoon and, wouldn’t ya know it, look at the time.
We will choreograph twelve countries to break infrastructure in a week. We will not choreograph two to defend it as a standing posture.
We find the lawyers and the budget the moment we want a takedown. Which leaves habit. Plain institutional habit. The kind nobody remembers choosing.
Finance already built the thing. In 1999.
One sector never caught the reflex at all.
The first ISAC ever created, born from that same 1998 directive, was the financial-services one (FS-ISAC). It did not stay in the room. Today it runs more than 5,000 member firms, with users in around 75 countries and members holding something north of $100 trillion in assets, out of offices in The Hague, London, and Singapore. The bankers, of all people, built the internationalist institution. The bankers. The same guys who can’t sneeze without sixteen regulators jumping up their noses.
FS-ISAC removes the easy objection. Propose vetted cross-border defense out loud and our reflex responds that it sounds lovely but cannot be built: too sensitive, too tangled in law, too naive about who you can trust. Except it has been built. It is twenty-seven years old, it vets trust across seventy-five countries every day, and it clears its throat every time a bank gets hit. So the question stops being whether this can exist and becomes why finance is the only one who bothered to make it.
But even FS-ISAC solved only half the geometry. It crossed the national border and stopped at the industry one: banks talking to banks about bank problems. The mesh ignores that border too. The packet we traced never cared whether it carried a wire transfer or a grid setpoint, and Salt Typhoon sat in the same backbone every other sector rides on top of. A circle drawn tight around one industry has the same flaw as one drawn tight around one country. It owns its slice and leaves the seams to nobody.
We accept this shared responsibility for physical commons without blinking. When piracy made the Gulf of Aden ungovernable, no single navy tried to police the lane alone. A combined task force formed, many navies under one framework, because the sea lane belonged to everyone and to no one. To quote one of my favorite movies, “Nobody owns the water. It’s God’s water, man!” The global information network is the same kind of commons, but we haven’t gotten around to calling it one.
Which lets me extend a metaphor from The Impossible Seat, where I described an ally building its own fire department. The thing about a fire department is that it only fights fires inside the city limits. And this fire is actually a flood in the watershed, where the water crosses every line on the map and respects none of them. A town brigade is the right answer to a house fire. It’s the wrong tool entirely for a flood that started three counties upstream.
The strongest objection
Cyber defense trades in dangerous material: classified signals, zero-day detail, the actual playbook you would run to defend a network. You cannot hand that to foreign carriers whose own networks might already be owned by the adversary you are defending against. And Salt Typhoon was (is) inside telecom networks. Share your defensive hand with a compromised node and you have just briefed your opponent. Seen this way, a narrow, vetted, domestic-industry room is plain good tradecraft. We call this OpSec (Operations Security. No, not operational security. Pet peeve, that). The national border is the cheapest place on earth to verify trust, and the bigger you make a sharing body, the more it starts to look like one vault holding everyone’s secrets, which is to say a target.
All of that is real, and I will not pretend otherwise. The penetration risk is genuine and Salt Typhoon is the proof. Classification and liability really do stop at the border by default. A naively open global body would be a collection bonanza for the other side.
The trouble with the objection is what it actually protects, which is not the network. It protects the org chart, the clean lines of who holds which clearance, who carries which liability, whose courtroom you can haul a leaker into. None of that makes us safer. The bankers solved that problem a generation ago, and the allied frameworks already move classified data across exactly these borders. Meanwhile the tradeoff is the same: a national room defends only the slice of the network, while the adversary lives in the whole thing added together. Follow the OpSec argument to its logical end and it defends the smallest possible circle, which is also the smallest possible fraction of the attack surface. The seam you refuse to reach across is the exact seam Salt Typhoon already owns and uses to their advantage. The answer is vetted breadth, on the pattern finance has run for twenty-seven years.
What the right shape looks like
So what goes in the room’s place? Not a world government for packets. Nobody wants the UN running BGP.
BGP being the primary global routing protocol that decides how packets get routed between gargantuan slices of the network and, I am not making this up, was invented in 1989 and was designed to implicitly trust everything. Whatever security it now has got bolted on decades later, and most of the internet still hasn't bothered to turn those features on.
And we also don’t want one giant vault holding every nation’s secrets, because that vault is just a bigger, juicier version of the problem we started with.
What you want looks more like plumbing than diplomacy. The national ISACs stay exactly where they are, doing the domestic vetting they already do well. You run a thin pipe between them: a vetted channel where the US telecom body and an allied carrier body can hand each other a single indicator at machine speed, under rules written on a calm Tuesday instead of improvised at 3 a.m. with the building on fire. And the carriers actually moving the targeted traffic, most of them not American, stop being bystanders and start being sensors. Right now the providers sitting closest to the threat are the ones we wired in last.
The best smoke detectors in the building, unplugged, in the room nobody checks.
I know exactly how this sounds. Standards body. Working group. The phrase “cross-border coordination framework” has ended more careers by boredom than any adversary ever has. But none of the parts are hypothetical. The vetting model exists in finance. The legal scaffolding exists in the allied agreements that already move classified data. The muscle memory exists in Operation Endgame and in the attribution coalitions. The only thing missing is the decision to keep the door open on a normal day, instead of unlocking it only when we want to name a threat or break one.
Back to the packet
Trace it one more time. It leaves your phone, crosses the tower, the regional carrier, the cable, the foreign company you will never hear of, and lands a continent away, still not knowing it left home. Everything that matters rides that same mesh: the dam, the substation, the freight car, the bank at close. The adversary already organizes around that shape. It is the only player at the table treating the board as the thing it actually is, which is to say imaginary.
A defense should be the shape of the thing it defends. We already know the shape is reachable. We snap into it the moment the job is to name a threat or break one. And it scales fine, because the bankers have run it across seventy-five countries for almost thirty years. What is missing is smaller than any of that. It is the willingness to stop drawing the smallest circle we can vet, by nation and by industry, and to start drawing the circle the threat already lives in.
The watershed is flooding, and the flood has never once stopped to check a passport.
If you enjoy A Discipline of Seeing, it would mean the world to me if you shared it with others. Please use the button below to send my Substack to someone who might find my work interesting. Thanks!
— Brandon