Did Iran hack U.S. water systems? / Cyberwarfare abroad / Ukraine’s air defense gap

Summary

---

Podcast Summary: SOURCES & METHODS (NPR)

Episode: Did Iran hack U.S. water systems? / Cyberwarfare abroad / Ukraine’s air defense gap

Date: August 6, 2026
Host: Mary Louise Kelly
Guests: Jenna McLaughlin (NPR CyberSecurity Correspondent), Greg Myre (NPR National Security Correspondent, in Ukraine)

Episode Overview

This episode explores three pressing national security topics:

1. The recent Iranian-linked cyberattacks on U.S. water systems and the ongoing vulnerability of critical infrastructure.
2. Cyberwarfare’s evolving role in modern conflicts, focusing on lessons from Ukraine’s experience and growing global threats, particularly from China.
3. Ukraine’s acute air defense gap in the face of dwindling Patriot missile supplies and shifting U.S. support. The NPR team discusses both the technical and strategic dimensions of these issues, drawing on exclusive reporting, expert interviews, and on-the-ground insights.

---

1. Iranian Cyber Attacks on U.S. Water Systems

What Happened? [02:03–04:40]

• Fact Pattern:

  • The FBI confirmed cyberattacks on water, wastewater, and utility systems in at least seven U.S. states.
  • These attacks targeted programmable logic controllers (PLCs)—devices that monitor and control water levels, pressure, and chemical dosing.

• Initial Response:

  • For example, in Bram, Minnesota, Mayor Nate George learned of the attack the morning after it occurred (July 28th).
  • Local authorities quickly issued advisories and restored services within hours.
  • Jenna McLaughlin: “They [hackers] locked people out of their connection to the water pumps. They caused some flooding, changes in pressure—and that immediately inspired a fair amount of panic in these local communities…” [03:08]

• Scope:

  • With over 50,000 water facilities in the U.S., this is potentially a much broader threat.

• No Immediate Harm:

  • As of recording, no water quality issues or injuries were reported:
    Mary Louise Kelly: "Stay with that with the do not panic piece of this podcast...nobody's been hurt by this. It's...an issue of trying to figure out what happened." [04:05]

Attribution and Iranian Intentions [04:40–07:00]

• Attribution:

  • Intelligence points to the Iranian Revolutionary Guard Corps (IRGC), but public technical evidence remains inconclusive.
  • Industry experts (e.g., Rob Lee of Dragos) caution against immediate attribution—as “no one's actually taken credit for it yet, which is kind of weird.” [05:25]

• Pattern of Behavior:

  • Iran has a history of low-level, disruptive cyber tactics against U.S. infrastructure—but not the ability for lasting, large-scale sabotage.
  • Jenna: “Iranian actors have for several years been trying to find vulnerable systems...not super sophisticated...they have a history of exaggerating their impact.” [06:07]

• Motivations:

  • “These kinds of attacks can create fear. Whether we’re in the middle of an active war or it’s a peace time.” —paraphrasing Michael Crean, cybersecurity expert [07:17]
  • Water is uniquely sensitive: “It's a necessity of life.” —Mary Louise Kelly [07:41]

Notable Quote:

"It's kind of scary that I am the only door between, you know, the Iranians and...their water system. You know, it kind of makes me a little nervous. I don't really have the background to be fending off foreign entities."
—Chris Hughes, Cavendish, VT water operator [08:42]

Broader Context [07:48–09:48]

• The U.S. government had issued advisories about PLC vulnerabilities as early as spring; the attacks came just after an updated warning (July 26th–27th).

---

2. Cyberwarfare and the Ukraine Lesson

Russian Cyber Attacks on Ukraine [09:48–13:58]

• Historical Precedent:

  • Russia used cyberattacks against Ukraine’s power grid as early as 2015, briefly cutting power to 250,000 people—setting global alarm bells ringing.

  "This was the first time...we became aware of something like this. So it did scare a lot of people." —Greg Myre [10:11]

• Recent Conflict:

  • In the full-scale invasion of 2022, anticipated catastrophic Russian cyberattacks did not materialize.
  • "Good cyber defense is the answer to that." —Greg Myre [13:58]
  • U.S. government (NSA, CIA), tech giants (Google, Microsoft, Palantir, Starlink), and Ukrainian expertise played collective defensive roles.

  "It wasn't just Russia against Ukraine, it was Russia against Ukraine and the CIA and the NSA and Google and Microsoft and Starlink and Palantir." [15:00]

• Takeaway:

  • The real “intelligence breakthrough” was U.S. advance knowledge of Russia’s invasion plans, not just cyber defense.

Ongoing Evolution [16:20–20:45]

• Defense and Resilience:

  • Ukraine’s ability to bounce back (“resilience”) is as valuable as hardening defenses.
  • Evidence is being gathered for The Hague on whether Russia’s cyberattacks constitute acts of war.

• Blending Old and New Warfare:

  • Kinetic (physical) and cyberattacks now run in parallel.
  • "Warfare from now into the future is going to be parallel tracks where you’re going at it through cyber, through actual bombs at the same time." —Mary Louise Kelly [17:53]
  • Ukraine’s “IT army” shifted focus toward drone warfare but still leverages top technical talent for both offense and defense. [18:41]

China’s Cyber Ambitions [19:28–20:45]

• **China identified as the most sophisticated adversary, especially with “Volt Typhoon”—a stealthy group burrowing into U.S. critical infrastructure, poised to disrupt major systems in a future Taiwan conflict scenario.

• Jenna: "Volt Typhoon...China infiltrating...environments, trying to be really sneaky, get deep-level access so that in the event of a conflict...they could activate that access and shut off power, shut off water, cause mass panic..." [19:39]

• U.S. and Israel both engage in offensive cyber operations as well—highlighted by Israeli hacks of Tehran’s traffic cameras during recent military operations. [20:45–21:27]

---

3. Ukraine’s Air Defense Crisis

Patriot Missile Shortage [23:27–28:28]

• Crisis:

  • Russia is launching about 100 ballistic missiles per month; Ukraine's stock of U.S.-made Patriot interceptor missiles is nearly depleted.
  • On a recent Russian salvo (28 missiles), Ukraine shot down none.

  "Russia is making more ballistic missiles...Ukraine’s supply...has dwindled, and the [U.S.] administration has essentially cut off fresh aid." —Greg Myre [23:57]

  • Civilian facilities are increasingly targeted, such as a Kyiv warehouse (food, water, schoolbooks) destroyed overnight.

• Aid Limbo:

  • Pres. Trump initially agreed to let Ukraine produce Patriots, but quickly reversed, citing tech transfer concerns.
  • Quote from Trump:

    “We have not agreed to that. We're talking about it, but it's a hard thing to give away that kind of technology...there's people that...can someday turn on you.” [28:28]

---

4. OSINT Segment: Open Source Intelligence & Insights [28:59–34:32]

• Greg Myre:

  • Reports 8 million books—mostly schoolbooks—destroyed in warehouse attacks; also an ice cream plant lost. Emphasizes how civilian life is targeted indirectly.

• Jenna McLaughlin:

  • Notes the rising security risks of data centers with the AI boom—these “critical infrastructure” facilities now use vast amounts of water and energy, but lack clear protection or response structures. [31:11]
    • "With this huge AI boom, now we’re building all these data centers that are sucking up tons of water, tons of energy...And what happens if data centers get targeted...?"

• Mary Louise Kelly:

  • Shares a cultural/political insight from recent reporting in Iceland:
    • Iceland will vote this month on whether to reopen talks to join the EU, prompting debates over national security, defense, and economic autonomy. [32:31–34:32]

---

Notable Quotes and Memorable Segments

• Local operator's anxiety:

  "It's kind of scary that I am the only door between, you know, the Iranians and...their water system." —Chris Hughes [08:42]

• Collective cyber defense:

  "It wasn't just Russia against Ukraine, it was Russia against Ukraine and the CIA and the NSA and Google and Microsoft and Starlink and Palantir." —Greg Myre [15:00]

• On defense vs. offense:

  “I learned to appreciate the defense the way an underdog in a soccer game might try to keep it to a 0–0 tie.” —Chris Inglis, as retold by Greg Myre [14:34]

• On the new normal in warfare:

  "Warfare from now into the future is going to be parallel tracks where you're going at it through cyber, through actual bombs at the same time."
  —Mary Louise Kelly [17:53]

• Patriot missile confusion:

  "We have not agreed to that. We're talking about it, but it's a hard thing to give away that kind of technology..."
  —Donald Trump [28:28]

---

Key Timestamps

| Topic | Timestamp | |-----------------------------------------------------|-------------| | Iranian water system hacks—overview | 02:03–04:40 | | Attribution & Iran’s tactics | 04:40–07:00 | | Local operator’s perspective | 08:42 | | Government awareness & prior advisories | 09:23–09:48 | | Russia–Ukraine cyber history | 09:48–13:58 | | Good defense & global tech partnerships in Ukraine | 13:58–16:20 | | Parallel tracks: kinetic & cyber warfare | 17:53–18:41 | | China's cyber infiltration (“Volt Typhoon”) | 19:39–20:45 | | U.S./Israel cyber operations in modern conflict | 20:45–21:27 | | Ukraine’s Patriot missile shortage | 23:27–28:28 | | Trump’s shifting position on missile tech | 27:53–28:42 | | OSINT: books/ice cream destroyed in Ukraine | 29:12–30:47 | | OSINT: Data centers as critical infrastructure | 31:11–32:15 | | Mary Louise Kelly in Iceland: EU/NATO debate | 32:31–34:32 |

---

Tone & Takeaways

• The discussion is pragmatic, anchored in detailed reporting and firsthand accounts, with an undercurrent of urgency and vulnerability—whether talking supply chain weaknesses, the everyday anxiety of local operators, or the shifting sands of international alliances.
• Technology (AI, cyber, drones) is both a lever and a liability in today’s national security landscape.
• The defense—whether cyber or military—is often “just good enough,” and may lag innovation.
• Evolving adversaries are not just “out there”: the threats may already be “quietly, stealthily lying in wait.”

---

This summary provides a structured overview of the episode’s core topics and insights, enabling listeners to understand the episode’s depth and urgency.

Transcript

[NPR Sponsor Announcer]

This message comes from NPR sponsor Carvana. Carvana believes selling your car should be easy. Get a real offer down to the penny picked up from your driveway. You may keep waiting for a catch. There isn't one sell [e-mail] Pickup fees may apply.

[Jenna McLaughlin]

Iranian actors have for several years been trying to find vulnerable systems in US

[Mary Louise Kelly]

Critical infrastructure, another front in the war between Iran and the US Cyber attacks. Are the system systems that power US Daily life secure and why Ukraine is struggling to stop Russia's missiles. This is SOURCES and methods from NPR. I'm Mary Louise Kelly, and it is Thursday, August 6th. It is sources and Methods Day, which means we're diving into the week's biggest national security stories with NPR reporters out covering them. Joining me in the studio this week, making her debut here on the podcast, NPR CyberSecurity Correspondent Jenna McLean Laughlin. So good to have you with us. Welcome.

[Jenna McLaughlin]

Thanks. It's great to be here.

[Mary Louise Kelly]

And from Ukraine, NPR national security correspondent Greg Myrie. Hello, my friend.

[Greg Myre]

Hi, Mary Louise.

[Mary Louise Kelly]

A quick note before we dive into this week. We have got a live event coming up here in Washington, D.C. if you're in the area and you want to join us for a live taping of the show, stick around. We've got details at the end of this episode. Sharing them here with you first, if you're not in the D.C. region, don't worry. We've got you covered, too. More on that later. All right, timestamping this, cause we love a good timestamp on sources and methods. It is noon exactly noon on the dot here in Washington, D.C. which means it's 7pm in Kiev. And today we're gonna talk about the war with Iran, but we're gonna talk about that conflict in a different way because, Jenna, you are bringing us fresh reporting on cyber attacks, alleged cyber attacks by Iran on US Infrastructure. What do we know?

[Jenna McLaughlin]

Yes, there's still a lot we don't know, so I'll preface with that. But essentially what we do know is that the FBI has revealed that there are at least seven states where we've seen attacks on the water sector. So water, wastewater, public utilities, okay. There's 50,000 of these across the United States. So utilities, 50,000 water facilities.

[Mary Louise Kelly]

Okay.

[Jenna McLaughlin]

So we could hear of a lot more down the line, but that's what we know so far. So what happened at these water facilities is there were cyber attacks on what are called programmable logic controllers, basically a fancy term for a simple machine in industrial systems that monitors and controls things that those machines do. So in Water, it's going to keep track of levels, pressure, etc. And it might control that pressure. So these hackers targeted those systems, and in some cases, they locked people out of their connection to the water pumps. They caused some flooding, they caused some changes in pressure, and that immediately inspired a fair amount of panic in these local communities that don't know what's happening with our systems.

[Mary Louise Kelly]

Okay, you said at least seven states that we know of. And I was starting to look. I saw reports Georgia, New Jersey, Minnesota. So this is like, all over.

[Jenna McLaughlin]

Yes. Minnesota was the first to come out and talk about this. They've been really transparent. I actually spoke to the mayor of Bram, Minnesota, Nate George, and he's been really transparent about this. He's talked a lot about it. When he sort of first learned that this was going on, when did he,

[Mary Louise Kelly]

like, what's the timeline on this?

[Jenna McLaughlin]

He said around Monday morning. I think that was the 28th, the 27th or the 28th of July.

[Nate George]

Okay.

[Jenna McLaughlin]

And the attacks took place over the weekend in the middle of the night. So that's when he first learned about it. And his teams took a couple of hours, they put out an advisory and said, hey, everybody, please conserve water while we figure out what's happening. We've got the backups in our water tank. We're going to be fine. But, you know, something wrong happened here and we're going to investigate it. So they managed to get those systems back online pretty quickly.

[Mary Louise Kelly]

So, yeah, stay with that with the do not panic piece of this podcast, as far as we know. No, like, issues with water quality. Nobody's been hurt by this. It's. It's an issue of trying to figure out something happened. What. What happened?

[Jenna McLaughlin]

Correct. Yeah. There's no reason to panic that the well has been poisoned.

[Podcast Sponsor Announcer]

Right.

[Jenna McLaughlin]

Actually, in conversations with a lot of these water operators, there's only so much you can do remotely. You can mess with the levels, the pressure. You can adjust the levels of chlorine maybe, but there's. There's not a lot can do unless you're physically on site, so people don't have to panic about that.

[Mary Louise Kelly]

Okay, to the who, we said the thinking is this is Iran, that the FBI is thinking this is Iran. Like, tell me more in terms of attribution.

[Jenna McLaughlin]

Yeah, so my reporting right now indicates I have one anonymous source who requested anonymity to speak about sensitive issues, and they said that there is some intelligence indicating that this is connected to the irgc. So the Iranian.

[Mary Louise Kelly]

The Revolutionary Guard Corps.

[Jenna McLaughlin]

Exactly. However, I also spoke with Rob Lee he's the CEO and co founder of Dragos, which is, you know, one of the biggest names in the game as far as industrial cybersecurity. He's been doing this for 20 years. He testified before Congress a couple of years ago about exactly these concerns that are playing out right now.

[Mary Louise Kelly]

He's good. I used to interview him when I was covering national security.

[Jenna McLaughlin]

He took my call in Germany on a family vacation. So that was great of him. Thank you, Rob. And he essentially told me that this is still ongoing. But from what he can see, there's a little bit of hesitation to immediately attribute this. And Dragos doesn't do attribution, but there's hesitation in the community to definitively say that this is Iran because no one's actually taken credit for it yet, which is kind of weird. And there's still that possibility that it's another actor who's trying to take advantage of the tension between the US and Iran to drum up this fear and concern.

[Mary Louise Kelly]

Would this square with what we know Iran's cyber capabilities and ambitions to be?

[Jenna McLaughlin]

Yes. So Iranian actors have for several years been trying to find vulnerable systems, particularly in industrial controls, in US critical infrastructure, to sort of mess around with them. Low level stuff, not super sophisticated. They might get in, they might log somebody out of their system, they might deface the display. They've done that before. I think that was with the Unitronic systems in Aliquippa, Pennsylvania. So they have a history of this behavior. But I think as far as actually, you know, wiping out the power, the water, etc, that is not something that Iran is capable of. They also have a history of exaggerating their impact, saying we've reached and touched the Great Satan and we've influenced their water. And that was a big win and we're so powerful. You know, go to the.

[Mary Louise Kelly]

Why, Jenna? I mean, is this, you know, we're at war with Iran, so, you know, if Iran can't shoot a missile that can reach all the way to, I don't know, DC, LA, New Orleans, wherever this is a way of hitting us,

[Jenna McLaughlin]

certainly, I think they maybe wouldn't want to do that because the US can certainly respond with force. But I talked to Michael Crean, he's a cybersecurity expert at Secretary Sonic Wall, and he said that these kinds of attacks can create fear. Whether we're in the middle of an active war or it's a peace time.

[Greg Myre]

What is it that you can do

[Mary Louise Kelly]

to potentially, quote, unquote, scare the American people?

[Jake Kalik]

Well, water is one of those things.

[Mary Louise Kelly]

It's a necessity of life.

[Jenna McLaughlin]

So I think that puts it pretty well.

[Podcast Promo Announcer]

You.

[Jenna McLaughlin]

You want to create panic, essentially.

[Mary Louise Kelly]

One more thing. I mean, we're talking about this again in the context of the US Is currently at war with Iran, has been officially since the end of February. Cyber threat didn't suddenly materialize at the end of February. You had reporting, am I remembering this right from last year? You were out at a water treatment plant in of all places, a little Vermont town.

[Jenna McLaughlin]

Yeah, I was in Cavendish, Vermont, and I essentially just was talking about this theoretical concern. I was with Chris Hughes. He's the local water and wastewater operator in Cavendish, Vermont, and he was just talking about how he's in this pilot program where essentially he's partnered up with cybersecurity experts who are walk walking him through these concerns. And he essentially said, I never expected to be the guy who is, you know, protecting our critical infrastructure from hackers. And yet here I am.

[Nate George]

It's kind of scary that I am the only door between, you know, the Iranians and. And their water system. You know, it kind of makes me a little nervous. I don't really have the background to be fending off foreign entities.

[Mary Louise Kelly]

You know, it is kind of scary.

[Jenna McLaughlin]

It really is. And he's got a whole day job where, when I was there, the lightning took out a water pump. There was a missing manhole cover in a sea of moss. He's just got a lot to think about. And this is just another thing.

[Mary Louise Kelly]

He's trained for the mossy manhole covers, but less so for Iranian hackers. What made you go up there? Like, what was raising your eyebrows to make you want to go up and see what was happening?

[Jenna McLaughlin]

So cybersecurity experts and American government officials have been talking about this concern for a while, actually, this specific concern about Iran targeting these programmable logic controllers. The US Government put out an advisory about that way back in the spring, and they just updated it actually a couple of days before this series of attacks took place on the water sector in the US on the 26th, 27th.

[Mary Louise Kelly]

Greg, you're sitting there listening to all this in Kiev, Ukraine, and I'm thinking there must be parts of what Jenna is telling me that resonate with you. You know, people in Ukraine are certain, no stranger to cyber attacks, to put it mildly. Go back to like a decade ago when we saw Russian hackers, Russians, attacking the Ukrainian power grid.

[Greg Myre]

Yeah, let's rewind to 2014. Russia invades Ukraine. The following year, 2015, the Russians carry out a cyber attack on the power grid in the far west of Ukraine, hundreds of miles from where the fighting had been taking place, they cut the power to a town in the western part of the country. You know, looking back, okay, it only lasted a few hours, about a quarter million people lost power. But it really set off alarm bells because this was the first time, at least publicly, we became aware of something like this. So it did scare a lot of people. The following year, the Russians did something kind of similar in Kyiv, the capital to a small part of the capital. So this was when some of the alarms really started to go off about what could happen, even though it didn't really cause any long term disruption.

[Mary Louise Kelly]

But that circles back to the point of it doesn't need to cause a long term disruption to be successful. If your point is just to scare the bejesus out of everybody, absolutely. Okay, time for our first break. But indulge me for a quick plug for our episode earlier this week. Our guest was Hannah Lucinda Smith, longtime foreign correspondent. We were talking about her new book. It's called the New Cold War Brewing at the Peripheries of the West. Hannah lays out a fascinating argument about how small, barely noticed conflicts smoldering on the fringes of superpowers are exploited by authoritarian leaders. Hello, Vladimir Putin, hello, Recep Tayyip Erdogan. And she says if you know where to look, you can spot the seeds of what are going to become bigger conflicts. It was really interesting idea. Great conversation. Please check it out before it goes into our archives where only NPR supporters can hear it. All right. When we come back, a broader look at cyber attacks and war. That is ahead on Sources and Methods from npr.

[NPR Sponsor Announcer]

This message comes from NPR sponsor Carvana. Carvana makes car buying easy 100 online prices down to the penny, delivered to your door. Why make car buying when it could be easy? Visit Carvana.com today.

[Podcast Sponsor Announcer]

Terms may apply support for this podcast and the following message come from Made in Cookware President and co founder Jake Kalik shares the key ingredients that go into made in products.

[Jake Kalik]

We try to design products that are going to last you an incredibly long time and to know that we're making this in places that take the raw material seriously, take the manufacturing processes seriously, that's ultimately what's going to allow us to sleep better at night selling this product to you.

[Podcast Sponsor Announcer]

Learn more about Made in Cookware at M a d e I-n cookware.com this message comes from Lisa Leesa isn't just about sleep, it's about impact. They're committed to eco friendly materials and sustainable manufacturing practices and partners with organizations like CleanHub to help remove harmful plastic waste from the environment. Visit Lisa.com for 25% off today and to learn more. Plus, get an extra $50 off with promo code NPR. That's L E E S A.com promo code NPR.

[Mary Louise Kelly]

We're back. I want to ask you both about the start of the full scale invasion of Ukraine by Russia. So we're talking 2022. Greg, you take this one first. There were fears, as you remember, that Russia would unleash devastating cyber attacks like ones that really did have consequences that didn't really come to pass. Do we know why?

[Greg Myre]

Well, I think good cyber defense is the answer to that. Yeah. There was absolute concern that the Russians could do all kinds of things, major power outages, you know, just shut down Ukrainian data and computers all over the country and cause just all kinds of havoc. And the Ukrainians tried and did some things to Russia as well, but not nearly as bad as people had anticipated. And several months into this, I specifically remember a talk by Chris Inglis. He was the White House cyber czar the first couple years of the Biden administration. And at that time in 22, and he said something really, really interesting. He said he had and he had been a career NSA official. You know, he was incredibly well versed in all this. And he said he'd always considered cyber operations to be about offense. You had to have a really powerful offense. Think of it like a basketball game. You're going to have to score 100 points to win. So you need a lot of offensive firepower that's going to determine the winner. But then as this war started to play out and you didn't see a whole lot of damaging stuff happening, despite a lot of attempts on both sides, he said he learned to appreciate the defense the way an underdog in a soccer game might try to keep it to a 00 tie. And he said what he learned was it wasn't just Russia against Ukraine, it was Russia against Ukraine and the CIA and the NSA and Google and Microsoft and Starlink and Palantir. So all of these different organizations, inside government and outside, were playing a role and they could fill a gap. They might detect something or they might have a solution for something. And that really helped protect Ukraine in the early days. And as it turned out, from what I've been able to see or my perspective, the big sort of intelligence piece of all this was the precision and the detail that the US had on the Russian invasion that they knew so much that was actually about to happen that it wasn't just a bluff by Putin and that they actually spent a lot of time and effort to convince Volodymyr Zelenskyy and the Ukrainians that this was a real invasion and not a bluff. So sort of good old fashioned spying was, was what turned out to be very critical here.

[Mary Louise Kelly]

Dunno. I've now got the image in my head of Russia, Ukraine as a nil, nil soccer game on the cyber battlefield. Pick up the thread.

[Jenna McLaughlin]

I'm a big soccer fan, so I appreciate that. Plug to the women's team here in dc, the Washington spirit. She's the ticket holder. I think Greg is right in saying that defense and resilience, the ability to recover from cyber attacks, has been really key to Ukraine being able to sort of sustain that ongoing pressure. I think that we might see more about that after the war. There are investigators, there are lawyers who are constantly gathering evidence about Russia's attacks, in particular on the power grid, that they're going to bring that case to the Hague. They're going to make one of the first cases that Russia's cyber attacks constitute acts of war. So I think that there will be a lot more to uncover about this in the future and I'm really interested in reporting on that. It's been something I've asked a lot about when I was in Ukraine as well, talking to a lot of these cyber experts. And we know from all the reporting on the drones, the innovation, the new technology, how much technical skill there is in Ukraine. And I think that's going to be an interesting conversation to have once the dust settles. But I think what Greg can speak to really well is that if you are in a situation of an active war, you can hit the power with a cyber attack, but you can also just bomb it. And that turns out has a lot more impacts in real time when we are in a kinetic war.

[Mary Louise Kelly]

I guess the interesting thing is just, and this is maybe Captain Obvious to someone who covers your beat, but just it's not an either or. Certainly that warfare from now into the future is going to be parallel tracks where you're going at it through cyber, through actual bombs at the same time and in time.

[Jenna McLaughlin]

Yeah, I think the way to think about it is that cyber is a tool in the arsenal of these actors. They use it to gather intelligence all the time. They can use it to interfere, they can use it to disrupt, they can pair it with their military strikes. I think just similar to the conversation we're having about AI right now, AI is not changing the Entire landscape of cyber security as we know it, but it is a tool in the hands of competent attackers and defenders.

[Greg Myre]

Yeah, I'll just jump in there. I mean, Ukraine has something called the IT army, and that was very cyber focused, it seemed, at the beginning. I think a lot of those people are now more drone focused. So they're developing new technologies and techniques with drones. Every few months they're learning how to try to jam Russian drones as Russia is trying to do the same to them, come up with more and more sophisticated ways. So these people with these very exceptional technical skills are still being put to good use, but just it's in peacetime, they might be trying to wipe out Russian data. Now they're trying to figure out how their drones can more effectively attack Russia.

[Jenna McLaughlin]

Yeah, I actually interviewed one of the top people in the Ukrainian IT army. I'll have to shoot them a note on signal and see what they're up to.

[Mary Louise Kelly]

Yeah. Just to tick through a few other players that have ambitions on this particular stage. China, where are they in terms of their cyber capabilities and cyber warfare?

[Jenna McLaughlin]

China's one of the most sophisticated actors out there as far as cyber. And I think when we were thinking about these water attacks, it could have been a lot worse. And something that US Officials have been speaking about pretty openly for the last couple years is this actor called Volt Typhoon. Volt Typhoon is this actor that was discovered a couple of years ago in a critical infrastructure utility. And essentially it's China infiltrating into these environments, trying to be really sneaky, trying to hide, get deep level access so that in the event of a conflict, perhaps an invasion of Taiwan, they could activate those tools. They could activate that access and shut off power, shut off water, cause mass panic and fear across the U.S. so those actors are a lot harder to

[Mary Louise Kelly]

find because they're just stealthily, quietly lying in wait.

[Jenna McLaughlin]

You don't even know that. Deeply embedded. Exactly. So a lot of the people that I've been talking to about this current incident say, hey, this is an opportunity for everybody to get their defense in order because we are up against bigger foes here.

[Greg Myre]

Yeah.

[Mary Louise Kelly]

I would also be remiss to your point, Greg, about offensive and defensive happening at the same time. If I didn't point out, you know, the US Is doing stuff too, Israel is doing stuff too. If you look at the war in Iran, our colleague Daniel Estrin was reporting early in the war back this past March on how Israel was hacking Tehran traffic cameras trying to track the supreme Leader before the US And Israel tried to target him and did in fact target and kill him. That was I remember Daniel got a senior Israeli defense official to speak on condition of anonymity about Israel's cyber tactics. So this is going in both directions. Greg?

[Greg Myre]

Oh, absolutely. And even though the US has effectively cut off weapons to Ukraine, the US Is still believed to be providing intelligence and targeting information. And the fact that these drones are hitting vulnerable places inside Russia, probably getting an assist from the U.S. time for another break.

[Mary Louise Kelly]

When we come back, why Ukraine is running out of air defense weapons plus OSINT open source intelligence. That's ahead on Sources and Methods for from npr.

[NPR Sponsor Announcer]

This message comes from Progressive Insurance. You're listening to this podcast, so you've got a curious mind. Did you know that drivers who switch and save with Progressive save over $900 on average? Visit progressive.com and get a quick quote with discounts that are easy to come by Progressive Casualty Insurance Company and affiliates. National average 12 month savings of $946 by new customers surveyed who save with Progressive between June 2024 and May. Potential savings will vary.

[Podcast Sponsor Announcer]

This message comes from Leesa. Leesa mattresses are meticulously designed and assembled in the USA for exceptional quality and they back it all up with free shipping, easy returns and a 120 night sleep trial. Beautifully crafted mattresses tailored to how you sleep. Feel the difference from night one. Visit Leesa.com for 25% off today, plus get an extra $50 off with promo code, NPR. That's Leesa.com, promo code, NPR.

[NPR Politics Announcer]

This week on the NPR Politics podcast, another progressive Democrat edges out an establishment candidate. Abdul El Sayed won Michigan's Senate primary campaigning on affordability, health care and ending U.S. military aid to Israel. Join us as we break down his victory and what it could signal for November's midterms on the NPR Politics podcast. Listen on the NPR app or wherever you get podcasts podcasts.

[Mary Louise Kelly]

We're back with Jenna McLaughlin and Greg Myrey. Greg, last week on this podcast, we heard about concerns over the dwindling supply of US Made Patriot missiles, concerns that I gather are feeling pretty acute where you are in Ukraine because they are desperately needed to defend against incoming Russian missiles and Ukraine doesn't have them. What does that look like where you are?

[Greg Myre]

Well, it means I don't get a lot of sleep at night because the Russians have been hitting here. Not every night. The Ukrainians begged for these Patriot systems at the beginning of the war. It took about a year before the US and some European allies provided them. They've been pretty Effective. The Patriots is considered really one of the premier systems in the world, if not the premier, dating back decades, to take out ballistic missiles. And it's done that. It's probably taken out roughly half the Russian missiles. But two trend lines have gone in the wrong direction for Ukraine. Russia is making more ballistic missiles, roughly making and shooting 100amonth or so. And Ukraine's supply of these missiles has dwindled, and the Trump administration has essentially cut off fresh aid. And even if the administration was willing to provide those missiles, it would be facing a problem because the US Stockpiles have dwindled dramatically because of the war in Iran. So Ukraine has gone from shooting down a fair number of these missiles to almost zero. On yesterday or Wednesday morning, early hours of Wednesday, Russia fired 28 ballistic and hypersonic missiles. Ukraine didn't shoot down a single one of them. And it just showed how vulnerable they are. Russia knows this. Every several days, as fast as Russia seemingly can put together a batch of 20 or 25 of these missiles, it

[Mary Louise Kelly]

must be unbearable if you're a Ukrainian military official to be able to track these things coming right at you and think, there's nothing I can do.

[Greg Myre]

Yeah, we get the alarms go off, the air raid alarms go off, just the actual ones outside that you can hear. And you get an app on your phone. And now within two or three minutes, you start hearing some booms. And these go on for. Can go on for a couple hours. Just yesterday morning, we went and talked with a guy. His name is Andrey Hyrchenko. He's a manager of a very large warehouse in Kyiv. And it just got slammed. Four Russian missiles hit this place. It's 6,6000 square meters, huge, huge facility. It had civilian stuff, water, printing supplies, food. And he and the rest of his staff came to work, showed up for work. Just hours after this happened. The ruins were still smoldering. There was a hazy smoke in the air, this acrid smell. And he just spoke about how sad and frustrating it was. So he's saying that back in 2022, we were thinking that we could come under fire when the Russian offensive begin, but not now. We're completely civilian. There's nothing that can be a military target here. So this also shows another thing that's happened. Ukraine has been going after these big Russian retailers, Wild Berries, And Russia seems to be responding in kind and going after some targets they haven't hit before. Now, Russia certainly hit lots of civilian targets throughout this war, but it seems to be specifically going after Ukrainian warehouses. And this place had thought it was not going to be targeted. Clearly it was.

[Mary Louise Kelly]

Okay, so Ukraine clearly needs Patriot missiles. Wasn't it just last month that President Trump said, fine, you can have them. We're going to allow Ukraine to make them. What happened to that?

[Greg Myre]

Yeah. So at the NATO summit in Turkey, President Trump told Ukraine's President Zelensky that he would give Ukraine the license to make their own. So that would be a huge step. Now, the couple problems there, it takes a while. This is a very complex system to put together.

[Mary Louise Kelly]

You can't slam one together by next week.

[Greg Myre]

But absolutely, yeah.

[Mary Louise Kelly]

At least it would have been a start.

[Greg Myre]

Might be a year or two down the road, but again, moving in the right direction. But then just last week, the President backpedaled on that. Well, in fact, he had met with Zelensky last week and it seemed to be moving in the right direction. In fact, Zelensky left his meeting with Trump at the White House, went straight to Lockheed Martin, which makes these Patriot missiles, to talk about moving the process along. But then a couple days later, last Friday, Trump said, we've got some concerns here. Not so fast.

[Donald Trump]

We have not agree to that. We're talking about it, but it's a hard thing to give away that kind of technology, and I don't think this would ever happen. But, you know, there's people that you give that technology, they can someday turn on you.

[Greg Myre]

So now we don't know where it stands. It seems like it's still under consideration, but it's not clear. So again, it just, it's creating this atmosphere, that Ukraine feeling that it's not going to be helped, even if, if a move like this would be an assistance down the road.

[Mary Louise Kelly]

Okay, let me shift us to the last section of this podcast. Osint open source intelligence, not so secret yet, telling details that we stumble across in our reporting.

[Greg Myre]

Greg, kick us off 8 million books. That's how many books in Ukraine have been destroyed in the past month. And a bit by these Russian attacks. Again, the Russians seem to be targeting warehouses and they've hit warehouses in Kiev and elsewhere that were just packed with books. A lot of them were school books and were needed for the upcoming school year. They're not going to be available again. It just shows how this war is broadening and going beyond military targets. And both sides are hitting warehouses and other places. A big warehouse from a Ukrainian ice cream manufacturer got hit and wiped out and said their ice cream is probably not going to be on your shelf in the coming weeks and perhaps months ahead. So we don't Hear about this every day in the reporting, but you're seeing a lot more attacks on things that are just. Just purely civilian here.

[Mary Louise Kelly]

And do we know Russia presumably isn't deliberately trying to target Ukrainian children's schoolbooks? It's just they're hitting warehouses and that's what's in them.

[Greg Myre]

That seems to be the thinking on it. They're looking for industrial sites or places where large volumes of economic goods are stored. Maybe again, perhaps a response to the kinds of attacks Ukraine is tearing out on the wild berries, which it says does have military items in addition to civilian items.

[Mary Louise Kelly]

All right. Tough times to be a Ukrainian kid. No ice cream, no school books. Jenna.

[Jenna McLaughlin]

Yeah, Speaking of kids, I've actually been away for the last six months raising my first baby.

[Greg Myre]

Welcome back.

[Jenna McLaughlin]

Thank you. So I have not been in as many rooms as I might otherwise have, picking up bits of. Of intelligence, but reporting.

[Mary Louise Kelly]

But you've been doing the important stuff.

[Jenna McLaughlin]

Yeah, yes, absolutely. And it's amazing and exhausting and all the things.

[Nate George]

Oh, yeah.

[Jenna McLaughlin]

But I think reporting on water and critical infrastructure got me thinking about other things that use a lot of water, and that's data centers. A lot of the conversations I've been having with some of my sources to just catch back up into this world is talking about we've got this idea in our head of what critical infrastructure is areas that's water, power, transportation, hospitals, et cetera. But with this huge AI boom, now we're building all these data centers that are sucking up tons of water, tons of energy and powering these frontier models. And data centers might become critical infrastructure. And what happens if data centers get targeted either in any kind of physical attack, a cyber attack, perhaps? Who's responsible for that? Who's going to protect them? Who's going to respond? What do we do about that? Because as is the theme in this country, I think we're constantly just building, building, building, and maybe not thinking about how to secure it.

[Mary Louise Kelly]

The defense. Fascinating. And probably something that was less on the radar even half a year ago when you were, you know, stepping away from your beat for a little while to bring a baby into the world.

[Jenna McLaughlin]

Yeah, AI was in a different place then. It's really exploded.

[Mary Louise Kelly]

All right. Mine is I want to put a country on Yalls radar and a date. The country is Iceland, where I spent last week, this glorious week with my mom. It was a mother daughter trip. And we were both gobsmacked by how stunning it is. Just glorious volcanoes and sea. They have no trees, so very few trees. Very small, short trees so you can just see for miles and miles and miles and miles. The date is this month, August 29th. And that is the date that Iceland is going to vote on whether to reopen talks to join the eu. Iceland is in NATO. They're actually a founding member of NATO, the only NATO member that has no standing army. So they've been heavily reliant on NATO and the US for their defense. They never joined the eu. If you, you go to Iceland, if you buy a Viking beer, which I highly recommend you do, you're going to be paying in Icelandic krona, not the euro. So the debate is do they want to change that? And I was fascinated at how wide a range of views there is on this, how controversial this is. They have all kinds of thoughts on the fishing industry and how it would be impacted. Fishing is huge in Iceland. They also catch kept talking about Greenland. They have watched, as you can imagine, with rapt interest as their Arctic neighbor has come under scrutiny and under designs from the White House and the president of the United States. And it resonates in Iceland, which as I say, has no standing army and which has only been fully independent since 1944. And they would like to keep it that way. So they are looking for friends and they're gonna figure out what they wanna do about that August 29th referendum on whether Iceland should start talking to the EU again.

[Jenna McLaughlin]

Now I'm dreaming about bathing in hot springs in Iceland.

[Mary Louise Kelly]

It was glorious and I highly recommend it. Whatever currency you pay for that in when you next go. I've been speaking with NPR CyberSecurity Correspondent Jenna McLaughlin. Welcome again and thank you.

[Jenna McLaughlin]

Thank you.

[Mary Louise Kelly]

And NPR national security correspondent Greg Myrey in Ukraine for us this month. Thank you, Greg.

[Greg Myre]

My pleasure.

[Mary Louise Kelly]

Okay, about that live show that we mentioned at the top, Wednesday, September 9, 9:30am you, yes, you are invited to a taping of this show right here at NPR headquarters in Washington, D.C. this will be a special edition of the show marking the 25th anniversary of 9 11. And we have some fascinating guests lined up, former high ranking intelligence officials. We're going to talk about that day and how all these years later it's still shaping global events. A limited number of tickets will go on sale next week on Tuesday at the link to take down npr.org sourcesliveshow. That's sources live show. All one work npr.org sourceslivesHow you can find the link in the notes of this episode. Go there next Tuesday for tickets if you would like to join us. And if you can't join us in person. We also plan to stream the show live on YouTube. We will make sure to keep you posted on those details as we have them. That's it for today's episode. Thanks for listening. I'm Mary Louise Kelly. And we are back next week with another episode of Sources and Methods from npr.

[Shopify Announcer]

This message comes from NPR's sponsor, Shopify.

[Podcast Sponsor Announcer]

No idea where to sell?

[Shopify Announcer]

Shopify puts you in control of every sales channel. It is the commerce platform revolutionizing millions of businesses worldwide. Whether you're a garage entrepreneur or IPO ready, Shopify is the only tool you need to start, run and grow your business without the struggle. Once you've reached your audience, Shopify has the Internet's best converting checkout to help you turn them from browsers to buyers. Shopify.com NPR to take your business to the next level today.

[Podcast Promo Announcer]

This week on Consider this. Virginia thought her criminal record would follow her forever until a few minutes with an AI app that told her she could clear her felonies.

[Podcast Sponsor Announcer]

You'll never find a harder worker than

[Jenna McLaughlin]

someone who has something to prove to

[Podcast Promo Announcer]

themselves how AI could help millions of Americans with criminal records find work. This week on Consider this from NPR.