Real problems worth solving

NATO nations have drawn down their ammunition stockpiles to provide military aid to Ukraine, and replenishing those reserves will take years at current production rates. Admiral Rob Bauer, NATO's most senior military official, warned that 'the bottom of the barrel is now visible,' noting that Western countries began supplying Ukraine from warehouses that were already half-full or less. In 2024, Europe and the U.S. combined produced an estimated 1.2 million artillery shells per year, while Russia produced 4.5 million, a nearly four-to-one advantage. The immediate consequence is that NATO member states are less prepared for their own defense than at any point since the end of the Cold War. If a second contingency arose, whether in the Baltics, the Pacific, or the Middle East, allied nations would face the choice of continuing to supply Ukraine or retaining stocks for their own forces. Several nations have reportedly already refused further transfers because their own reserves have fallen below minimum readiness thresholds. The replenishment math is unforgiving. Even if the EU meets its 2025 target of 2 million rounds per year, and the U.S. reaches 1.2 million, the combined 3.2 million rounds must simultaneously supply Ukraine's ongoing consumption (2-4 million rounds per year depending on intensity), replenish depleted NATO stockpiles, and build reserves for future contingencies. At best, stockpile recovery will take 5-10 years, during which NATO's deterrence posture depends on ammunition it does not have. This depletion persists as an unresolved crisis because NATO members systematically underinvested in ammunition stockpiles for two decades. The 2 percent of GDP defense spending guideline was met by few members, and among those who met it, procurement budgets favored expensive platforms like aircraft and ships over unglamorous consumables like artillery shells. The assumption was that a major land war in Europe was obsolete. That assumption was wrong, and the cost of rebuilding stockpiles now runs into tens of billions of euros that must be sustained over a decade, a commitment that faces constant political pressure from competing domestic spending priorities.

The military and civilian ammunition markets in the United States are not separate supply chains; they share the same upstream inputs of nitrocellulose, smokeless powder, primers, brass, and lead. When military demand surges, it directly starves the civilian market. In May 2024, Alliant Powders suspended all commercial smokeless powder shipments because the sole domestic nitrocellulose producer at Radford was fully allocated to military contracts. Powder costs rose approximately 15 percent in 2025, and major ammunition brands implemented price hikes of 3 to 12 percent starting in early 2026. This matters because the civilian ammunition market serves not just recreational shooters but law enforcement agencies, federal agencies, private security companies, and the 20+ million Americans who purchased firearms for self-defense between 2020 and 2024. When the shared supply chain tightens, police departments compete with the military and civilian buyers for the same primer and powder allocations. During the 2020-2022 shortage, some departments reduced training ammunition by 50 percent or more, directly degrading officer readiness and public safety. Tariffs compound the problem. In 2025-2026, tariffs on imported brass and copper increased ammunition input costs by 8 to 15 percent, while simultaneously choking off imports that had previously provided a relief valve during domestic shortages. The U.S. imports significant quantities of commercial ammunition from countries like Italy (Fiocchi), Czech Republic (Sellier & Bellot), and Serbia (Prvi Partizan), and tariffs on these finished goods further restricted supply. The structural reason the supply chains are intertwined is economic: it would be prohibitively expensive to maintain separate military and civilian production infrastructure for identical chemical and metallurgical inputs. The same nitrocellulose goes into both military propellant charges and commercial hunting cartridges. The same brass alloys feed both 5.56 NATO and .223 Remington. No policy mechanism exists to manage the allocation between military and civilian demand during a surge, so the military's contracting power simply outbids the commercial market, and civilians absorb the shortage.

Outdoor firing ranges deposit more lead into the environment than nearly any other major industrial sector in the United States, yet they remain almost entirely unregulated for lead contamination. Across approximately 9,000 non-military outdoor shooting ranges and an estimated 700 military ranges, millions of pounds of lead bullets and fragments accumulate in soil and leach into groundwater every year. The EPA estimates that 80,000 tons of lead are deposited at outdoor ranges annually. The health consequences are severe and well-documented. Lead is a potent neurotoxin with no safe level of exposure. It accumulates in soil, contaminates surface water through runoff, and enters groundwater through leaching. Communities near firing ranges face elevated blood lead levels, particularly among children, who are most vulnerable to neurological damage. Range workers, military personnel who train regularly, and competitive shooters face chronic occupational exposure through both ingestion of lead-contaminated dust and inhalation of lead vapor from indoor ranges. Cleanup costs are staggering. A single range remediation can exceed $4 million, and under CERCLA (Superfund law), responsible parties face strict, joint, and several liability for all contamination. Multiply that across thousands of ranges that have operated for decades, and the aggregate unfunded liability runs into the billions. Military ranges on bases slated for closure under BRAC have become particularly expensive Superfund sites, with the Department of Defense spending hundreds of millions on remediation at former installations. The problem persists because there is no federal regulatory framework specifically governing lead management at shooting ranges. The EPA published Best Management Practices in 2001 but they are voluntary guidelines, not enforceable standards. Range operators, both military and civilian, have little financial incentive to implement lead reclamation programs when the contamination costs can be externalized or deferred to future owners. The political dynamics are also unfavorable: any proposal to regulate firing ranges encounters opposition from Second Amendment advocacy groups, creating a regulatory vacuum that allows the contamination to accumulate unchecked.

Winchester, Remington, Federal, and CCI are the only four companies that manufacture primers for the U.S. civilian, law enforcement, and military ammunition markets. Primers are tiny cups containing a shock-sensitive explosive compound that ignites the propellant charge when struck by a firing pin. Without primers, no cartridge-based ammunition can function. This four-company oligopoly means that the entire American ammunition supply, military and civilian combined, depends on a handful of production lines. When demand surges, as it did during COVID-19, the 2020 social unrest, and the Ukraine-driven military ramp-up, primer production becomes the binding constraint on all ammunition output. Bullet casings, projectiles, and powder can all scale faster because their manufacturing processes are less specialized. Primer production requires handling primary explosives like lead styphnate and barium nitrate under strict safety protocols, in facilities purpose-built for energetics work. You cannot convert a general manufacturing plant to primer production; it requires dedicated infrastructure with blast walls, bunker-style architecture, and specialized environmental controls. The impact cascades in both directions. When military contracts absorb primer capacity, the civilian market experiences shortages and price spikes. When civilian panic-buying surges, it pulls capacity from law enforcement supply. During the 2020-2022 shortage, many police departments could not obtain training ammunition, leading to reduced qualification standards and fewer range hours. Recreational shooters and competitive athletes saw 9mm ammunition prices triple from $0.18 to over $0.60 per round. The oligopoly persists because the primer market is small in dollar terms relative to the capital required to enter it. A new primer factory requires a multi-hundred-million-dollar investment in a highly regulated energetics facility, with environmental permits that can take years to obtain. The customer base is price-sensitive and the margins are thin in peacetime. No rational private investor would build a fifth primer factory when four existing ones can meet peacetime demand. The market failure is classic: the social cost of primer shortages during crises far exceeds the private cost, but no mechanism exists to compensate a producer for maintaining excess capacity.

Military ammunition deteriorates with age as propellants break down, explosive compounds become chemically unstable, and seals degrade from temperature cycling and humidity exposure. Between 1979 and 2019, more than 623 ammunition storage area explosions were recorded across 106 countries and territories. These are not combat losses; they are spontaneous detonations of stockpiled munitions that killed hundreds of people and destroyed billions of dollars in materiel. The consequences extend beyond the immediate blast. When stockpiled rounds become unreliable, military units cannot trust that their ammunition will function as intended. A misfired artillery round does not just waste a shell; it reveals a firing position without delivering effects, potentially getting the crew killed. Degraded propellant charges produce inconsistent muzzle velocities, making precision fire impossible. At a strategic level, a nation that discovers its stockpile has deteriorated has zero ammunition rather than the thousands of rounds its logistics systems show on paper. The United States is not immune. A 1996 GAO report found that over 56 percent of lots in the wholesale ammunition stockpile had unknown manufacture dates because the information was either not recorded or recorded incorrectly in the database. This means the military could not even determine which ammunition was safe to use and which had aged beyond reliability. The report warned that significant problems left unattended would get worse, and in the three decades since, stockpile management has improved in some areas but the fundamental challenge of maintaining aging munitions across hundreds of storage facilities remains. The problem persists because ammunition surveillance and testing is expensive, unglamorous, and competes for funding with new weapons programs. Every dollar spent testing old rounds is a dollar not spent buying new ones. Storage facility maintenance and climate control require sustained investment with no visible return. Politically, no one gets credit for confirming that 30-year-old shells are still functional, but everyone notices when a new weapons system is delayed.

The U.S. defense munitions industrial base has lost the ability to rapidly scale production in response to a crisis. A 2023 Army Science Board study found that the Army lacks surge capacity for several critical munitions systems, and that general capacity has declined over the past thirty years. CSIS analysis concluded bluntly that it is no longer a question of whether the U.S. industrial base is prepared to surge; it is clear that it is not. This inability to surge means that in a high-intensity conflict with a peer adversary, the U.S. and its allies would fight with whatever is already in stockpiles and on production lines. Once those are exhausted, there is no mechanism to rapidly replenish. The Ukraine war demonstrated this concretely: two years into the conflict, Western nations had depleted stockpiles to dangerous levels while production had barely tripled. A Pacific theater conflict would consume munitions at rates far exceeding Ukraine, with longer supply lines and fewer options for allied contribution. The workforce dimension compounds the problem. Key munitions manufacturers like Rheinmetall, General Dynamics, and Nammo are receiving multi-billion-dollar orders but cannot hire fast enough. The broader U.S. manufacturing sector faces 415,000 unfilled positions, and 26 percent of the existing workforce is approaching retirement. Munitions work requires specialized skills in energetics handling, quality assurance, and safety protocols that take years to develop. You cannot post a job listing and have a trained explosive ordnance worker in 90 days. The structural cause is the post-Cold War "peace dividend" and the shift to just-in-time, single-source contracting. The government closed, mothballed, or sold ammunition plants throughout the 1990s and 2000s. Over fifty mergers consolidated the industrial base. Remaining facilities were optimized for peacetime production rates with no contractual obligation or financial incentive to maintain warm surge lines. Rebuilding this capacity requires not just money but time: new ammunition plants take 3-7 years to build, permit, and qualify.

Precision-guided munitions like the Joint Direct Attack Munition (JDAM), Excalibur GPS-guided shells, and Small Diameter Bombs depend on samarium-cobalt (SmCo) and neodymium-iron-boron (NdFeB) rare earth magnets for their guidance systems, fin actuators, and sensor motors. China refines over 85 percent of the world's rare earths and produces nearly 90 percent of high-performance rare earth permanent magnets. Approximately 78 percent of U.S. weapons programs contain components that depend on rare earth magnets sourced from or through China. This dependency means that in any conflict scenario involving China, the adversary could cut off the materials needed to build the weapons intended to fight it. Without SmCo magnets, the compact motors that manipulate flight control surfaces in smart bombs would require hydraulic systems that are three times as large, heavier, and more expensive, effectively making many precision munitions designs unbuildable. The U.S. military's entire shift toward precision strike over the past 30 years assumed a globalized supply chain that a peer adversary could sever. China has already demonstrated willingness to weaponize this leverage. In late 2023 and 2024, China imposed new export restrictions on gallium, germanium, and rare earth processing technologies. These restrictions do not just affect raw materials but target the mid-stream refining and magnet manufacturing steps where China's dominance is most absolute. Even if the U.S. mines rare earth ore domestically, it must send it to China for processing because no domestic refining capacity exists at scale. The root cause is decades of underinvestment in domestic rare earth processing. China built its monopoly through sustained industrial policy, subsidies, and willingness to absorb the environmental costs of rare earth refining. Western companies could not compete on price and exited the market. The Mountain Pass mine in California resumed operations under MP Materials, but it ships concentrate to China for refining. Building a complete domestic supply chain from mine to magnet is estimated to require 10-15 years and billions of dollars in investment that the private sector will not make without guaranteed defense procurement contracts.

The Radford Army Ammunition Plant in Virginia is the only facility in the United States that produces military-grade nitrocellulose, the base material for all smokeless powder and solid rocket propellant. Built in 1941, this single plant underpins every bullet, artillery charge, missile motor, and tank round manufactured in the country. All U.S. 155mm artillery charges are manufactured using propellant from General Dynamics' Valleyfield facility near Montreal, Canada, which itself depends on nitrocellulose feedstock. The consequence of this concentration is absolute: if Radford goes offline for any reason, whether accident, natural disaster, or adversary action, the entire U.S. ammunition production chain stops. There is no backup, no second source, and no allied facility that could absorb the shortfall at scale. This is not a hypothetical concern; Radford has experienced environmental compliance issues, aging infrastructure problems, and capacity limitations that already constrain production rates. The civilian ammunition market feels this bottleneck directly. In 2024, Alliant Powders suspended commercial smokeless powder shipments because nitrocellulose production was fully allocated to military contracts. Reloaders and commercial ammunition manufacturers were cut off, driving price spikes and shortages in the consumer market. The military and civilian supply chains share the same upstream chokepoint, so any increase in military demand immediately starves the commercial market. This single-source dependency persists because nitrocellulose manufacturing is capital-intensive, heavily regulated, and environmentally sensitive. The chemicals involved are hazardous, the process generates toxic waste, and the facilities require specialized safety infrastructure. No private company will build a second plant without guaranteed long-term government contracts, and the government has historically been unwilling to pay the premium required to maintain redundant capacity. The Ammunition Supply Chain Act (S.4163) introduced in the 118th Congress attempted to address this, but structural funding commitments remain insufficient.

Poland's Nitro-Chem plant is the only military-grade TNT production facility in NATO. The United States shut its last TNT plant in the 1980s. The United Kingdom closed its final facility in 2008. Every NATO artillery shell, bomb, and warhead larger than a bullet requires TNT or a TNT-based explosive fill, and nearly all of it flows through a single factory in Bydgoszcz, Poland, which supplies 90 percent of the TNT that the U.S. imports. This single point of failure means that one factory fire, one successful sabotage operation, or one supply-chain disruption to the chemical precursors could halt Western munitions production across multiple countries simultaneously. The concentration risk is not theoretical: the factory is operating at maximum capacity and cannot meet current demand, let alone wartime surge requirements. The EU's promise to deliver one million shells to Ukraine in 2023 fell short in part because there was simply not enough explosive fill available. The reason this monopoly exists is that TNT manufacturing is extraordinarily polluting. The process generates toxic red water and pink water waste streams that are expensive to treat and environmentally hazardous. Western countries chose to offshore this dirty production rather than invest in cleaner manufacturing processes, and commercial incentives never justified building new capacity during decades of low demand. Now that demand has surged, it takes 3-5 years to site, permit, and construct a new energetics facility. Sweden's Swebal is attempting to build a new TNT plant near Nora, which would increase European capacity by 75 percent, but it is not expected to be operational before 2027 at the earliest. The structural cause is a misalignment between environmental regulation and national security planning. No government agency was tasked with ensuring that explosives production capacity remained distributed and resilient, so market forces concentrated it in the single lowest-cost producer.

The United States produces approximately 40,000 155mm artillery rounds per month as of mid-2025, despite a target of 100,000 rounds per month set for October 2025. Before the Ukraine war, U.S. monthly output was just 14,400 rounds. Even with a nearly threefold increase, production remains far below what a single theater of conflict consumes: Ukraine alone requires 200,000 to 356,000 rounds per month to hold its front lines. This matters because artillery remains the dominant killer on the modern battlefield. When shell supply falls short, defenders cede territory and attackers stall. The gap between production and consumption means that any NATO member drawn into a high-intensity conflict would exhaust national stockpiles in weeks, not months, and resupply would take years to catch up. The U.S. Army moved from one shell-body production facility to four, but the constraint is not steel casings; it is propellant charges, fuzes, and explosives fill, each of which has its own bottleneck. The problem persists because Western defense procurement was optimized for low-rate peacetime production over three decades of counterinsurgency wars. Contracts rewarded efficiency and just-in-time delivery, not surge capacity. Over fifty mergers and acquisitions consolidated the munitions industrial base into a handful of primes, eliminating redundant production lines that would now be essential. Rebuilding those lines requires not just capital but regulatory approvals, environmental permits for energetics handling, and a trained workforce that does not currently exist at scale. Russia, by contrast, produces an estimated 4.5 million shells per year, roughly four times the combined NATO output of 1.2 million. This asymmetry is not a temporary gap but a structural one rooted in the West's post-Cold War decision to treat ammunition as a commodity rather than a strategic reserve.

Generative AI has dramatically lowered the cost and increased the quality of disinformation content used in state-sponsored influence operations. In 2024, AI-generated deepfake videos, synthetic audio, and fabricated news articles were deployed in influence campaigns targeting elections in the U.S., EU, Taiwan, India, and dozens of other countries. A single operator can now produce thousands of unique, contextually tailored disinformation pieces per day across multiple languages, overwhelming the capacity of platforms and fact-checkers to respond. The convergence of cyber operations and AI-generated content creates a threat qualitatively different from traditional propaganda. When a state actor compromises a legitimate news outlet's social media account (a cyber operation) and posts a deepfake video of a political leader (an AI-generated product), the combination of a trusted source and convincing content can move markets, incite violence, or shift election outcomes before corrections can propagate. The window between publication and debunking is measured in hours, but the damage from viral disinformation occurs in minutes. Audiences who see the original deepfake outnumber those who see the correction by orders of magnitude, and repeated exposure to fabricated content erodes baseline trust in all media, including authentic reporting. This problem persists and worsens because AI model capabilities improve faster than detection capabilities. Each generation of generative AI produces more realistic output that is harder to distinguish from authentic content. Watermarking and provenance standards (like C2PA) exist but adoption is voluntary and adversaries can strip metadata. Social media platforms face economic incentives to maximize engagement, which sensational (including fabricated) content provides. Detection tools suffer from an inherent asymmetry: they must work perfectly every time, while attackers need only evade detection once to succeed. The open-source availability of powerful generative models means that even if leading AI companies implement safeguards, the underlying capability is permanently accessible to state actors willing to fine-tune their own models.

Global ransomware payments exceeded $1.1 billion in 2023 according to Chainalysis, funding a criminal ecosystem that reinvests profits into more sophisticated tools, zero-day exploits, and recruitment. Each ransom paid directly finances the next attack. Ransomware-as-a-service (RaaS) platforms like LockBit, BlackCat/ALPHV, and Cl0p operate as businesses with affiliate programs, customer support, and revenue-sharing models. An aspiring cybercriminal with minimal technical skill can lease ransomware infrastructure and launch attacks, keeping 70-80% of any ransom collected. The economic logic for victims is rational but collectively destructive. When a hospital's systems are encrypted and patient lives are at risk, paying a $2 million ransom to restore operations within hours can seem preferable to spending weeks rebuilding from backups (if backups even exist and are intact). When a company faces $10 million per day in lost revenue, a $5 million ransom looks like a bargain. Insurance policies that cover ransom payments further reduce the perceived cost of paying. But each payment validates the business model and funds capability improvements. LockBit used its profits to offer $50,000 bug bounties for vulnerabilities in its own ransomware, professionalizing its development process. This self-sustaining cycle persists because of the intersection of cryptocurrency anonymity, jurisdictional safe havens, and misaligned incentives. Most major ransomware groups operate from Russia or CIS countries where they face no prosecution as long as they do not target domestic systems. Cryptocurrency mixers and chain-hopping techniques make payment tracing difficult. Banning ransom payments is politically untenable because it would effectively tell hospitals and utilities to accept weeks of downtime and potential loss of life rather than pay. International law enforcement operations like the takedown of LockBit in 2024 temporarily disrupt groups but the operators reconstitute under new names within months. The fundamental economic incentive remains intact.

In early 2024, U.S. intelligence agencies and Microsoft disclosed that a Chinese state-sponsored group known as Volt Typhoon had systematically compromised U.S. critical infrastructure networks, including water utilities, power grids, telecommunications systems, and transportation networks. Unlike typical espionage operations designed to steal data, Volt Typhoon's activity pattern suggested pre-positioning for disruptive or destructive attacks that could be activated during a future conflict, such as a crisis over Taiwan. The implications are strategically terrifying. If China can disrupt water treatment, electrical distribution, or port operations on the U.S. mainland during a military confrontation in the Pacific, it gains enormous coercive leverage. Military operations depend on civilian infrastructure: troops deploy from bases that need electricity and water, equipment ships from ports that need functioning logistics systems, and the public's willingness to sustain a distant conflict depends on their own sense of security at home. Pre-positioned cyber capabilities transform domestic infrastructure into a hostage. This is not theoretical; CISA Director Jen Easterly testified to Congress that Volt Typhoon activity had been detected in networks supporting every branch of the U.S. military. The reason these intrusions succeed and persist is that Volt Typhoon uses "living off the land" techniques, meaning they use legitimate system administration tools already present on victim networks rather than deploying custom malware that antivirus software might detect. They route traffic through compromised small-office routers and IoT devices to blend with normal network activity. Traditional signature-based security tools are nearly blind to this approach. Detecting these intrusions requires behavioral analysis and network traffic anomaly detection capabilities that most small utilities and local infrastructure operators simply do not have. The attacker can afford to be patient, maintaining access for years while defenders must be vigilant every day.

A growing industry of private companies develops and sells sophisticated cyber weapons, including zero-day exploits and spyware, to government clients worldwide. NSO Group's Pegasus spyware, Candiru's surveillance tools, Intellexa's Predator spyware, and others have been found on the devices of journalists, human rights activists, political dissidents, and opposition politicians across dozens of countries. These tools provide capabilities that were once available only to the most advanced intelligence agencies, now accessible to any government willing to pay. The human cost is direct and documented. Saudi journalist Jamal Khashoggi's associates were targeted with Pegasus before his assassination. Mexican journalists investigating drug cartels were surveilled. Thai pro-democracy activists were monitored. When a government can silently compromise any smartphone, read every message, activate the camera and microphone, and track location in real time, the chilling effect on press freedom, political opposition, and civil society is profound. Sources stop talking to journalists. Activists self-censor. Opposition politicians cannot communicate securely. The asymmetry is total: the target has no way to detect or prevent the intrusion because these tools exploit zero-day vulnerabilities unknown to device manufacturers. This market persists because the economics are overwhelmingly favorable for vendors and buyers, while regulation is fragmented and toothless. A single zero-day exploit for iOS can sell for $2-5 million. Governments are willing to pay because the intelligence value far exceeds the cost. Export controls like the Wassenaar Arrangement technically cover intrusion software, but enforcement is inconsistent and vendors restructure across jurisdictions to avoid restrictions. The U.S. blacklisted NSO Group in 2021, but competitors immediately filled the gap. Israel, where many of these companies are based, has historically treated cyber exports as a diplomatic tool. Until there is an enforceable international framework equivalent to arms control treaties, the proliferation of offensive cyber capabilities to abusive governments will continue.

Since the Russian interference campaigns of 2016, the United States has spent over $1 billion on election security upgrades, yet fundamental vulnerabilities persist. Voting machines in many jurisdictions still run on end-of-life operating systems. Voter registration databases remain attractive targets for manipulation. County election offices, which actually administer elections, often have IT budgets smaller than a single mid-size company's security team. The decentralized nature of U.S. elections (administered by over 8,000 jurisdictions) makes it impossible to enforce uniform security standards. The stakes could not be higher. If an adversary can manipulate voter rolls to prevent legitimate voters from casting ballots, alter vote tallies in even a few key precincts, or simply create enough doubt about election integrity to undermine public confidence, they achieve a strategic objective without firing a shot. The 2020 election saw no evidence of successful vote manipulation, but the information operations surrounding it demonstrated how effective sowing doubt can be. Russia, China, and Iran all conducted influence operations targeting the 2024 election according to U.S. intelligence assessments. The mere perception that elections could be hacked is itself a weapon. This vulnerability persists because of the structural fragmentation of U.S. election administration. There is no single entity responsible for securing all elections. CISA provides guidance and voluntary services, but cannot compel adoption. State and county officials often resist federal involvement as an encroachment on state sovereignty. Voting machine vendors are a concentrated market (three companies control over 90% of U.S. voting equipment) but face limited security certification requirements compared to, say, financial systems. The Help America Vote Act funding was a one-time infusion, not sustained investment, and many jurisdictions spent it on equipment that is now aging. Meanwhile, the threat evolves faster than procurement cycles, creating a permanent gap between current defenses and current threats.

The United States faces a cybersecurity workforce shortage that has grown every year for over a decade. As of 2024, there were approximately 500,000 unfilled cybersecurity positions in the U.S. alone, and 3.5 million globally according to ISC2. This is not merely a hiring inconvenience; it means that hospitals, utilities, local governments, and defense contractors literally do not have enough people to monitor their networks, respond to incidents, or implement basic security controls. The consequences cascade in predictable ways. When a small water utility has zero dedicated cybersecurity staff, default passwords remain unchanged, patches go unapplied, and intrusion detection systems go unmonitored. When a mid-size hospital has one overworked security analyst covering a network of 10,000 endpoints, alert fatigue sets in and real threats get buried under false positives. When the Department of Defense cannot compete with private sector salaries for top talent, offensive and defensive capabilities suffer. Every unpatched vulnerability, every unmonitored alert, and every incident response delay traces back to this shortage. The workforce gap persists because of structural misalignments in how cybersecurity talent is developed and recruited. University computer science programs produce far fewer cybersecurity-focused graduates than the market demands. Certification requirements (CISSP, etc.) create barriers that exclude capable people from non-traditional backgrounds. Federal pay scales (GS system) cap salaries well below private sector rates, making it impossible for government agencies to retain experienced practitioners. The security clearance process takes 6-18 months, during which candidates accept other offers. Community colleges and bootcamps could help but lack standardized curricula aligned to actual job requirements. Meanwhile, the attack surface expands faster than the workforce grows, as every new IoT device, cloud migration, and AI deployment creates new security demands.

When a cyberattack hits critical infrastructure or steals sensitive government data, one of the first questions is: who did it? Unlike a missile launch with a visible trajectory, cyberattacks are routed through compromised servers across multiple countries, use shared toolkits, and employ false flags designed to implicate other actors. The U.S. intelligence community took months to formally attribute the SolarWinds attack to Russia and years to build the evidentiary case for indictments related to Chinese hacking campaigns. During that delay, the attackers continue operating. The inability to quickly and confidently attribute attacks fundamentally undermines deterrence. In conventional warfare, deterrence works because an adversary knows that an attack will be traced back to them and met with a proportional response. In cyberspace, the attacker can maintain plausible deniability long enough to achieve their objectives and prepare for any eventual response. Even when attribution is eventually established, the consequences are typically limited to sanctions, indictments of intelligence officers who will never stand trial, or diplomatic protests. No nation-state actor has been meaningfully deterred from cyber operations by these responses. This problem persists because of the fundamental asymmetry between offense and defense in cyberspace. Attackers can invest heavily in obfuscation and misdirection at relatively low cost. They route operations through commercial VPNs, compromised third-country infrastructure, and shared malware frameworks that multiple groups use. Intelligence agencies may have classified capabilities to attribute attacks faster, but sharing that evidence publicly would reveal collection methods. This creates a structural tension between the need for public accountability and the need to protect intelligence sources. Until this tension is resolved, or until the cost-benefit calculus of launching cyberattacks fundamentally shifts, attribution will remain too slow and consequences too mild to deter state-sponsored hacking.

The SolarWinds Orion compromise, discovered in December 2020, revealed that a Russian intelligence service had embedded malicious code into a trusted software update mechanism, giving them access to approximately 18,000 organizations including the U.S. Treasury, Department of Homeland Security, and multiple Fortune 500 companies. The attackers had been inside these networks for at least nine months before detection. This was not an anomaly; supply chain attacks have become a preferred vector precisely because they exploit trust relationships that defenders cannot easily verify. The reason this matters goes far beyond data theft. When an adversary sits inside government networks for months, they can map decision-making processes, read diplomatic communications, understand military readiness assessments, and position themselves for future destructive attacks. The intelligence value compounds over time. For private sector victims, the cost includes not just incident response (estimated at $100 million for SolarWinds itself) but the permanent uncertainty about what was taken and what backdoors might remain. Organizations that were compromised cannot ever be fully confident their networks are clean without a ground-up rebuild, which most cannot afford. Supply chain attacks persist structurally because modern software depends on vast, opaque dependency chains. A typical enterprise application pulls in thousands of third-party libraries, and each library has its own dependencies. No organization has the resources to audit every line of code in every dependency. The software industry's build and distribution systems were designed for efficiency, not integrity verification. Code signing helps but only proves who built the software, not that the build environment itself wasn't compromised. Until the industry develops practical, scalable mechanisms for verifying software provenance at every layer of the stack, supply chain attacks will remain the most cost-effective way for sophisticated adversaries to achieve broad access.

The industrial control systems (ICS) and SCADA systems that operate water treatment plants, dams, and wastewater facilities across the United States are among the most vulnerable pieces of critical infrastructure to cyber attack. Many of these systems run on Windows XP or even older operating systems that no longer receive security patches, connected to the internet through configurations that were never designed with adversarial threat models in mind. When an attacker gains access to a water treatment plant's control system, the consequences can be immediately dangerous. In the 2021 Oldsmar, Florida incident, an attacker briefly increased sodium hydroxide (lye) levels to 100 times the normal amount. Had an operator not noticed and reversed the change within minutes, the water supply for 15,000 people could have been poisoned. This was not a sophisticated nation-state operation; it exploited TeamViewer remote access software with a shared password. The fact that a low-sophistication attack came this close to poisoning a town's water supply reveals how thin the safety margins are. The structural reason this persists is that water utilities in the U.S. are overwhelmingly small and underfunded. Of the roughly 50,000 community water systems, the vast majority serve fewer than 10,000 people and lack dedicated IT staff, let alone cybersecurity specialists. The EPA has limited enforcement authority for cyber standards, and unlike the electricity sector (which has NERC CIP mandates), the water sector has no binding federal cybersecurity regulations. Upgrading SCADA systems is expensive and operationally risky because taking systems offline for upgrades can itself disrupt service. This creates a perpetual deferral cycle where upgrades are always "next year's budget item" until an incident forces action.

Ransomware attacks against hospitals and healthcare systems have escalated from nuisance-level disruptions to genuine threats to human life. In 2024 alone, the Change Healthcare attack disrupted billing and pharmacy services for thousands of providers across the United States for weeks. Ascension Health, one of the largest U.S. hospital systems, was forced to divert ambulances, cancel surgeries, and revert to paper records after a ransomware attack took down its electronic health record systems. The downstream consequences are not abstract. When a hospital's IT systems go dark, clinicians lose access to medication histories, lab results, and imaging. Nurses must hand-transcribe orders, increasing the risk of dosing errors. Emergency departments divert patients to already-strained neighboring facilities, extending transport times for stroke and cardiac patients where every minute of delay worsens outcomes. A 2023 University of Minnesota study found that ransomware attacks on hospitals were associated with a measurable increase in in-hospital mortality rates. This problem persists because healthcare IT infrastructure is chronically underfunded relative to its criticality. Hospitals operate on thin margins (averaging 2-3% for U.S. hospitals), and cybersecurity competes for budget against direct patient care. Legacy medical devices running outdated operating systems cannot be easily patched without recertification. Meanwhile, ransomware-as-a-service has lowered the barrier to entry for attackers, and cryptocurrency makes ransom payments difficult to trace. The combination of high-value targets, weak defenses, and profitable attack economics creates a structurally persistent vulnerability that no single hospital can solve alone.

The United States faces a critical drone production gap. Ukraine manufactures 200,000 FPV drones per month and is scaling to 500,000, with approximately 500 domestic drone manufacturers. The U.S. has no comparable production capacity for small tactical drones. The Pentagon's Replicator program aimed to field thousands of autonomous drones, but the initiative has been hampered by dependence on Chinese components and the inability of the domestic industrial base to scale. The Defense Innovation Unit's Blue UAS certification program approved only 23 of 300 drone submissions in 2025. This matters because in a conflict with a peer adversary, the U.S. would need to replace drones at a rate of thousands per week. Ukraine loses drones constantly; they are expendable by design. The American defense industrial base is optimized for producing small numbers of exquisite, expensive platforms like Predators and Reapers that cost millions each. It is structurally incapable of producing the cheap, expendable drones that dominate modern battlefields at the volume and speed required. A $20 million Reaper cannot do what 40,000 $500 FPV drones can do, and the U.S. cannot build 40,000 of anything quickly. The procurement system compounds the production problem. Defense acquisition timelines run 5-10 years from requirement to fielding. FPV drone designs iterate monthly. By the time the Pentagon certifies, contracts, and produces a drone design, it is obsolete. Ukraine's drone manufacturers operate on commercial timelines with minimal bureaucracy, iterating designs based on frontline feedback in days, not years. The structural reason this persists is that the U.S. defense-industrial complex was built for the Cold War model of small numbers of supremely capable platforms. The institutional incentives of defense contractors favor expensive programs with large margins over high-volume, low-cost production. Congressional district politics protect legacy programs. And the Pentagon's risk-averse testing and certification processes, designed to ensure the reliability of a $100 million fighter jet, are catastrophically mismatched to a $500 disposable drone that is designed to be lost on its first mission.

Drone attacks in conflict settings increased by 4,000% between 2020 and 2024, rising from an estimated 4,525 attacks in 2023 to 19,704 in 2024. Civilian casualties in Ukraine rose 40% in the first eight months of 2025 compared to 2024, with civilian injuries surging 46%. For several months in 2025, FPV drones were the single leading cause of civilian casualties in the conflict. UN investigators documented over 3,000 civilian deaths from drone attacks in Ukraine between February 2022 and April 2025. This matters because the precision that drones supposedly enable has not translated into civilian protection. Russian forces use FPV drones to deliberately target civilians in private vehicles and on public transport. Retrieved drone cameras contain footage showing operators manually targeting civilians, providing unprecedented evidence of possible war crimes. Yet despite this evidence, no prosecutions have resulted. The lack of ICC jurisdiction over Russia and Security Council vetoes prevent formal accountability. The problem extends beyond Ukraine. The U.S. drone program has its own accountability crisis. Investigations have repeatedly shown significant undercounting of civilian casualties, with the government's own assessments diverging dramatically from independent monitoring. The single greatest obstacle to evaluating the civilian impact of drone strikes remains lack of transparency, making it impossible to assess claims of precision targeting. The structural reason this persists is that drones create a political permission structure for violence without accountability. Because no pilot is at risk, the political cost of a strike is near zero. Because operations happen in remote areas or contested war zones, independent verification is difficult. Because the technology enables plausible deniability about targeting decisions, particularly with increasing autonomy, assigning legal responsibility to a specific individual in a specific chain of command becomes nearly impossible. The very attributes that make drones attractive to militaries, low risk, low cost, and operational distance, are precisely what make accountability elusive.

Most military and commercial drones rely on GPS for navigation, and GPS signals are inherently weak and trivially jammed or spoofed. Electronic warfare systems can create noise on drone communication frequencies to sever operator control, or manipulate GPS signals to send drones off course, force landings, or even redirect them back toward friendly forces. Russia has deployed extensive GPS jamming across the Ukrainian front, and the June 2025 'Twelve-Day War' between Israel and Iran revealed that intense electronic warfare disrupted GPS signals guiding precision munitions. This matters because a military that builds its doctrine around drone-centric warfare is building on a foundation that can be knocked out by a $50,000 jammer. GPS interference is now 'endemic' in the Baltic Sea, Black Sea, and parts of the Middle East, affecting not just military drones but commercial shipping and aviation. RF jamming is growing more complex as drone platforms shift frequencies, with some systems operating across the 150 MHz to 12 GHz range, requiring defenders to jam an ever-wider spectrum. Drones are adapting but not fast enough. Some Ukrainian drones have switched to inertial navigation systems that allow continued flight on pre-programmed routes when GPS is denied, but INS drifts over time and cannot support the precision targeting that makes FPV drones effective. Fiber-optic tethered drones eliminate the RF link entirely but are limited in range. Visual navigation using AI-based terrain matching is emerging but remains unreliable in featureless terrain or at night. The structural reason this persists is that GPS was designed as a peacetime utility, not a contested military system. Its signal structure, published openly, makes jamming and spoofing straightforward for any technically competent adversary. Replacing GPS with a hardened alternative would require a new constellation of satellites and new receivers in every platform, a multi-decade, multi-billion-dollar effort. In the meantime, every drone fleet in the world carries this vulnerability as an inherent design constraint.

Between 50% and 80% of key components used in U.S. military drones come from China, including motors, electronic speed controllers, lithium-ion batteries, flight controllers, sensors, cameras, and carbon fiber structural parts. DJI holds 90% of the U.S. commercial drone market and 80% of the global consumer market. Chinese government-subsidized manufacturers control 70% or more of the enterprise drone market and 92% of the U.S. state and local first responder drone market. This is a national security crisis hiding in plain sight. In a conflict with China, the supply of drone components that U.S. forces and allies depend on could be cut overnight. Ukraine has already experienced this: China's UAV supply chain restrictions have weakened Ukraine's negotiating position and constrained its drone production. The U.S. Defense Innovation Unit's Blue UAS program, which certifies China-free drones, received 300 submissions in 2025 but approved only 23. The gap between demand for secure drones and the supply of verified alternatives is enormous. The economic barriers to reshoring are steep. The U.S. enacted 170% combined import duties on Chinese drones and components as of April 2025, and the FY2025 NDAA set a deadline for banning DJI products. But American and allied manufacturers cannot match Chinese prices because China built its drone component ecosystem over a decade with massive state subsidies, vertically integrated supply chains, and economies of scale that Western startups cannot replicate quickly. Every China-free drone costs more and takes longer to produce. The structural reason this persists is that the commercial drone industry was allowed to develop with no strategic supply chain oversight. Unlike semiconductors, which eventually triggered the CHIPS Act, drone components were treated as generic consumer electronics. By the time the national security implications became obvious, Chinese dominance was so entrenched that decoupling requires rebuilding an entire industrial ecosystem from raw materials to finished platforms.

Consumer drones available for a few hundred dollars online can be converted into weapon delivery platforms with minimal technical skill. Ukraine's entire FPV drone fleet is built largely from commercial components: hobby-grade motors, consumer camera modules, off-the-shelf flight controllers, and 3D-printed munition release mechanisms. The same drones used for wedding photography and agricultural surveying are being used to drop grenades and conduct kamikaze attacks on armored vehicles. This matters because the barrier to entry for aerial attack capability has collapsed from billions of dollars (for an air force) to hundreds of dollars (for a weaponized quadcopter). Kataib Hezbollah used a drone to kill U.S. soldiers at a military outpost in Jordan in January 2024, the first such American fatalities from an enemy drone. The Houthis conduct 'long-range stand-off terrorism' with modified commercial platforms capable of striking targets hundreds of miles away. Iran demonstrated coordinated barrage capability with 170 drones in its April 2024 attack on Israel. The proliferation risk to domestic security is particularly acute. A drone capable of carrying a 2-kilogram payload can be purchased, modified, and deployed by a single individual with no military training. Current regulations focus on airspace management and licensing, not on preventing weaponization. Law enforcement agencies in most countries have neither the legal authority nor the technical capability to detect and neutralize a weaponized commercial drone approaching a crowded venue, critical infrastructure, or government building. The structural reason this persists is the dual-use nature of the technology. Every component in a weaponized drone has a legitimate civilian application. Banning or restricting commercial drone components would cripple a multi-billion-dollar industry that includes agricultural monitoring, infrastructure inspection, filmmaking, and emergency response. No government has found a regulatory approach that prevents weaponization without destroying the commercial drone ecosystem.

Controlling a swarm of dozens or hundreds of drones in a contested battlefield environment exceeds human cognitive capacity and outstrips existing command-and-control software. Defense researchers have found that swarm coordination algorithms are far more complex than single-drone control programs, and existing UAV swarm control systems focus on low-level autonomy while neglecting operator cognition and human factors, leading to high cognitive load and reduced control efficiency. This matters because swarms are the future of drone warfare, and whoever solves coordination first gains decisive advantage. The Pentagon's Replicator program aims to deploy thousands of autonomous drones, and Sweden's Saab is testing systems that let one soldier control 100 drones simultaneously. China's PLA has published extensive doctrinal concepts for UAV swarm operations. But in practice, managing real-time sensor fusion, target deconfliction, obstacle avoidance, communications relay, and dynamic retasking across a swarm in an electronically contested environment remains unsolved at militarily relevant scale. The logistical burden compounds the control problem. Deploying hundreds of drones requires continuous charging or battery swaps, physical storage, rapid field repairs, frequency management to avoid self-interference, and coordination with manned aircraft operating in the same airspace. Each added drone increases complexity non-linearly. A swarm that works in a controlled test range with perfect communications degrades rapidly when GPS is jammed, radio links are contested, and drones are being shot down mid-mission. The structural reason this persists is that swarm intelligence is fundamentally a harder computer science problem than individual autonomy. Biological swarms like bees or starlings use simple local rules that produce emergent group behavior, but military swarms need to accomplish specific tactical objectives with heterogeneous platforms carrying different payloads in adversarial conditions. The gap between research demonstrations and battlefield-ready systems remains years wide, while adversaries are already deploying crude but effective mass drone attacks that do not require sophisticated coordination.

Autonomous weapon systems that can select and engage targets without human intervention are already being deployed, yet there is no binding international law governing their use. Russia deploys 30-50 autonomous strike drones daily in Ukraine. The V2U drone, first observed in 2024, autonomously navigates GPS-denied environments and identifies targets. Multiple nations are developing systems where the decision to kill is delegated partly or fully to algorithms, and U.S. policy explicitly does not prohibit lethal autonomous weapons. This matters because without a legal framework, there is no enforceable standard for when a machine may take a human life. Human Rights Watch documented that autonomous systems lack the contextual awareness to reliably distinguish between combatants and civilians, with people using wheelchairs particularly at risk because their mobility aids can be misidentified as weapons by computer vision systems. When a drone kills the wrong person, existing international humanitarian law cannot clearly assign criminal responsibility: the programmer, the commander who deployed it, the procurement officer who approved it, or the algorithm itself. The arms race dynamic makes restraint irrational for any single nation. Senior U.S. military leaders have stated that the United States may be compelled to develop autonomous weapons if competitors do so. China, Russia, Israel, Turkey, and Iran are all advancing autonomous capabilities. The UN Secretary-General has called for banning machines with fully delegated lethal authority, but the nations building these systems have blocked binding resolutions. The structural reason this persists is the same dynamic that delayed nuclear arms control: the technology provides such decisive military advantage that no major power will voluntarily constrain itself before its rivals do. But unlike nuclear weapons, autonomous drones are cheap, proliferating rapidly to non-state actors, and do not require massive industrial infrastructure. By the time a treaty is negotiated, the technology may be too widespread to regulate.

Military drone operators experience psychiatric symptoms at rates that rival or exceed those of deployed combat troops, yet the military's mental health infrastructure treats them as rear-echelon personnel who never saw combat. Studies show 46-48% of weaponized Reaper and Global Hawk operators report psychiatric symptoms severe enough to affect job performance or family life. A study of over 1,000 USAF drone operators found 4.3% met PTSD criteria, and 8.2% received a first mental health diagnosis within 24 months of starting drone operations. The psychological mechanism is uniquely cruel. Unlike a fighter pilot who drops a bomb and flies away, drone operators watch their targets for weeks, studying daily routines, seeing family members, and developing what psychologists call inadvertent psychological connection with the people they will kill. After a strike, they continue observation to assess damage, watching the aftermath in high-definition video that can be replayed. Then they drive home and eat dinner with their families. This whiplash between intimate killing and suburban normalcy creates what clinicians describe as 'moral injury,' an inner wound from actions that violate deeply held values, distinct from but compounding PTSD. The military has been slow to recognize this problem. Congress only recently ordered the Department of Defense to formally study the prevalence of PTSD, depression, anxiety, burnout, and moral injury among drone pilots and imagery analysts. The study was mandated in January 2026, more than two decades after the U.S. began conducting armed drone operations. Most drone operators who seek help report stigma and career consequences. The structural reason this persists is that the military's mental health model was built for troops who deploy to a war zone and return home. Drone operators never leave home, so they do not fit the deployment-triggered screening and support pipeline. There is no 'reintegration' program for someone who commutes to war. The very efficiency that makes drones attractive, allowing fewer personnel to project more lethal force, means fewer people absorb more psychological damage with less institutional recognition.

Military counter-drone (C-UAS) technology has a fundamental scaling problem: systems designed to detect and neutralize a single small drone fail catastrophically when facing dozens or hundreds simultaneously. The Pentagon has begun purchasing some defenses designed for small drones, but stockpiles of cost-effective interceptors remain far too small. There is no integrated architecture that ties sensors, effectors, and battle management into a single defensive system that can flex from a lone reconnaissance drone to a coordinated swarm attack. This matters because adversaries are already deploying drone swarms operationally. Iran launched 170 drones in its April 2024 attack on Israel. Russia deploys 30-50 autonomous strike drones daily. The cost asymmetry is devastating: an attacker can saturate defenses with $500 FPV drones while defenders spend $100,000+ per interceptor missile. If you cannot defeat swarms cheaply, you cannot defend fixed military installations, ships, or forward operating bases against the most common weapon on the modern battlefield. The problem extends beyond technology to training and authority. The Joint C-sUAS University at Fort Sill is undermanned and cannot train all personnel who need it. The Pentagon Inspector General found that confused DOD policies meant some U.S. military bases could not adequately respond to drone incursions over their own facilities. Drone overflights of American military installations have jumped considerably in recent years, and base commanders lacked clear guidance on what they were authorized to do. The structural reason this persists is bureaucratic fragmentation. Counter-drone responsibility is split across services, agencies, and commands with no single authority. The FY2025 NDAA finally created a new counter-drone office with veto power over service programs, but the office is still standing up. Meanwhile, the threat evolves monthly while procurement cycles take years.

First-person-view kamikaze drones have become the dominant killing instrument in the Ukraine-Russia war. Ukrainian FPV and bomber drones carried out 819,737 confirmed strikes in 2025 alone, killing or seriously injuring over 240,000 Russian soldiers that year. By December 2025, drones were killing and wounding more Russian soldiers per month than Moscow could recruit. Drones now account for roughly 80% of all battlefield casualties on both sides. This matters because a $400-$500 weapon that any country can mass-produce has fundamentally altered the economics of warfare. Ukraine scaled from 1,200 drones in 2022 to 1.7 million in 2024 and aims for 4 million per year at full capacity. When the cost of inflicting a casualty drops below $500, the calculus of deterrence, defense budgets, and military procurement built around expensive precision munitions collapses entirely. Every nation's defense planning is now obsolete if it assumes conventional force-on-force engagements. The civilian toll is equally alarming. In January 2025, short-range drones became the leading cause of civilian casualties in Ukraine, responsible for 27% of civilian deaths and 30% of civilian injuries that month. FPV drones are being dropped on private vehicles, public transport, and residential areas. Between February 2022 and April 2025, UN investigators documented over 3,000 civilian deaths from drone attacks in Ukraine. Yet there is no international legal framework specifically governing the use of FPV drones in warfare. Existing international humanitarian law was written for missiles, artillery, and manned aircraft with clear chains of command. FPV drones blur every line: they are cheap enough for non-state actors, simple enough for minimally trained operators, and numerous enough that individual strike accountability becomes impractical. The structural reason this gap persists is that the technology proliferated faster than any diplomatic process can move, and the nations most actively using drones have no incentive to restrict themselves while at war.