Cold Open
Start with the water. The treatment plant, the power grid, the phone network. We tend to think of them as separate things. Different buildings. Different companies. Different people answering the phone when something goes wrong.
But the systems behind those services are interconnected. An attack on energy infrastructure can disrupt communications. Trouble in one network can become trouble in another.
So here is the question. If the connections cross the boundaries between organizations, how do you make the people protecting them work across those boundaries too?
Intro
I'm Jordan. This is The Battleground You Live In, adapted from Scott W. Waddell's doctoral study, published in twenty twenty-five. This episode uses a synthetic voice.
The study compares Estonia, Sweden, the United Kingdom, and the United States. It asks how American cyberspace policy can protect national security as artificial intelligence and Web three point oh develop.
The evidence comes from documents: national strategies, government reports, academic work, and industry papers. No interviews. That gives us a view of policy, with limits on how much we can see of its implementation.
And these are the policies and examples examined in that study. Think of it as a snapshot, not a live update. The technology moves quickly enough that the study itself warns some findings may become outdated.
The idea I want to follow is simple. Cyberspace connects ordinary life and national security. Protecting it takes more than technical capability. It also takes coordination.
Main Discussion
The history starts with physical things. During the Cold War, American infrastructure protection focused on potential sabotage targets: power plants, oil pipelines, defense facilities.
Protection meant planning for physical attacks, building in redundancy, and making systems resilient. After September eleventh, two thousand one, the focus expanded to cybersecurity as digital systems became embedded in essential services.
A presidential directive in twenty thirteen identified sixteen critical infrastructure sectors. It formally included information technology in that framework. The network itself had become part of what needed protecting.
The dissertation uses Systems Theory to explain the consequences. That sounds abstract. The useful part is this: you cannot understand the security of a connected system just by examining its pieces one at a time.
Its example is an attack on the energy sector that could cripple communications. It also describes how a breach in financial networks could disrupt global supply chains. The connections that carry useful activity can carry disruption too.
Now add ownership. Most American critical infrastructure is privately owned. Government has a national-security responsibility, while companies operate much of the infrastructure that responsibility depends on.
That makes cooperation a practical question. Who shares information? Who coordinates the response? How do rules written in different places work together across a connected system?
The Department of Defense designation described in the study puts cyberspace alongside land, sea, air, and space as an operational domain. Four familiar domains, plus cyberspace. Five.
But the phrase that holds this story together is the dissertation's own: a domain of power. Power as in states competing, deterring threats, and shaping the rules. All within infrastructure that supports economic and social life.
The study describes American policy through three pillars: deterrence, defense, and resilience. It also describes offensive and defensive capabilities. So the military dimension belongs in the story, alongside the civilian one.
And cyberspace lacks clear territorial boundaries. A national strategy has to contend with risks and relationships that cross borders. We will come back to that, because none of the four countries can do this alone.
Estonia
In two thousand seven, Estonia experienced that dependence in a very concrete way. Cyberattacks disrupted banks and government institutions. The study identifies distributed denial-of-service attacks among them.
The wider Estonian case includes a national digital identity system. The study describes how growing reliance on digital infrastructure also increased exposure to cyber threats. The benefits and the exposure came together.
The response brought government and private companies together. The dissertation describes coordination that included Swedbank. Protecting national services required resources and expertise from both sides.
In the study's account, those attacks helped move cybersecurity from a technical concern to a core national-defense priority. Keep that distinction in mind: a national-defense response does not require us to label the event a war.
One response is particularly easy to picture. Estonia keeps backups of critical state data beyond its borders, through what it calls a data embassy. The purpose is continuity: keeping that critical data secure and reachable during disruption.
Tallinn also hosts NATO's cyber defense center. The study describes an annual exercise that brings private technology companies and national security forces into a simulated large-scale cyberattack.
Notice the common thread. The data backup and the exercise do different jobs. Both belong to a wider effort to prepare for a disruption that crosses the boundaries of any one organization.
New Technologies
Then the network changes again. Artificial intelligence can help detect threats and respond in real time. It can also become another source of vulnerability.
The study discusses attackers manipulating the data an A I system receives. It also describes the possibility of failures in A I security spreading across energy, telecommunications, and finance.
So adding intelligence to the network does not remove the coordination problem. The study connects A I oversight with institutions, standards, and trained people who can manage these systems.
Web three point oh brings a different version of the problem. The term covers decentralized technologies, including blockchains. The study discusses digital identities and tokenized financial systems.
The policy question is how to oversee systems whose control is distributed. Decentralization can reduce dependence on one point of failure while making regulation harder.
There is a limit here that belongs right beside the claim. In the policy-adaptation theme, just five of a hundred and eighty-four coded references concern the impact of Web three point oh.
That is one theme's table, not a count for the entire dissertation. And a coded reference is a passage classified during the analysis. It is not a successful defense, a prevented attack, or a measure of national performance.
The topic matters to the research question. But the evidence on it is thin in that table. We should not let the technology's place in the title make those five references carry more weight than they can.
There is also a problem beyond keeping systems available. The study discusses cyber-enabled disinformation that can influence public debate and destabilize democratic institutions. The connected environment carries ideas as well as services.
Four Approaches
With that in mind, look at the four countries. The comparison offers different ways of organizing the work. It does not give us a single winner whose institutions everyone else should copy.
Estonia uses what the study calls a no-legacy principle. The idea is to replace outdated systems quickly. The study links that approach with the ability to adapt.
But Estonia also faces limited resources and a shortage of skilled people. Its experience suggests possibilities for a larger country. Its scale and centralized governance also make direct transfer difficult.
Sweden emphasizes a whole-of-society approach. Its Civil Contingencies Agency coordinates work across government, business, and civil society. Partnerships with telecommunications companies are part of that picture.
There is a recurring tension in the Swedish case: technology changes faster than regulation can keep up. The study describes continuing engagement between policymakers and industry as part of the response.
The United Kingdom's approach emphasizes long-term planning and the coordinating role of the National Cyber Security Centre. Its Cyber Essentials scheme gives smaller businesses an accessible baseline for security.
The workforce is part of that long view. The study describes CyberFirst, with scholarships and internships, alongside cybersecurity apprenticeships. It also records unequal access to cyber education across regions.
So each example comes with a qualification. Estonia has agility and resource constraints. Sweden has a strong emphasis on partnership and a moving regulatory target. Britain plans ahead and still faces gaps in access to training.
This is where the study's second theoretical lens becomes useful: Capacity Building Theory. Policies need institutions able to apply them, people with the skills to do the work, and organizations able to cooperate.
The dissertation makes the workforce point plainly. Without sustained investment in training, even well-designed policies risk becoming ineffective. A policy document can describe the job. It cannot do the job by itself.
The United States
Then we reach the United States. The study describes substantial strengths: leadership in A I innovation, technical expertise, and cybersecurity frameworks used beyond American borders.
The National Institute of Standards and Technology developed its cybersecurity framework with industry and academia. The study also discusses its framework for managing A I risks.
There are mechanisms for sharing information across critical industries. There are scholarships through CyberCorps, where cybersecurity education comes with a commitment to government service. The country has significant tools to work with.
The central difficulty in this comparison is coordination. Federal, state, and private-sector rules can diverge. A business operating in several states can face inconsistent requirements.
Healthcare provides an example in the study. Federal privacy requirements sit alongside varying state rules. The dissertation describes how that fragmented environment delayed comprehensive security protocols and left areas exposed.
Information sharing has its own friction. Companies worry about privacy, liability, and competition. The study describes continuing reluctance to share, even after a twenty-fifteen law intended to encourage it.
Put those findings together and the tension becomes clearer. Technical capability and the ability to coordinate it are different things. The study identifies difficulties in the second despite American strengths in the first.
It also describes a tendency for the United States to respond as threats arise, compared with Britain's emphasis on longer-term planning. That is a finding of this comparison, with the limits of its documentary evidence.
Across Borders
The same coordination problem appears internationally. All four countries participate in alliances and partnerships. No single country can address transnational cyber threats on its own.
The examples differ. Estonia contributes to cooperation through NATO and the European Union. Sweden works with European and Nordic partners. Britain participates in Five Eyes, the intelligence-sharing alliance that also includes the United States.
And the study describes American participation in international efforts to develop rules for state behavior in cyberspace. Those relationships are part of national security, alongside domestic institutions.
Different approaches to data protection complicate cooperation. The dissertation contrasts Europe's general data-protection framework with American sector-specific rules, and identifies difficulties for sharing information across borders.
Each country has to balance sovereignty and cooperation. Protecting sensitive information and enabling partners to work together can pull in different directions. The comparison leaves that trade-off visible.
Takeaways
The surprising finding is about size. The study challenges the assumption that a larger economy inherently leads in cybersecurity innovation. Estonia's experience suggests that agile governance and focused resources matter too.
Suggests is doing real work there. This is a comparative case study based on documents. It cannot give us complete access to how policies were implemented, and its author acknowledges the possibility of interpretive bias.
Countries differ in scale, institutions, and political context. Their policies also change over time. The dissertation explicitly rejects a universal blueprint. A useful lesson still needs translation before another country can apply it.
With those limits in view, three clusters of recommendations stand out. The first is clearer coordination: a unified national framework, better alignment between federal and state rules, and a central coordinating body.
The second is more durable public-private cooperation. The study proposes formal channels for sharing information, along with incentives such as grants, tax credits, and liability protections.
The third is sustained investment in people: cybersecurity education beginning in school, vocational training, and scholarships. Build a route into the workforce, and keep building the capacity to implement policy.
Those are among the study's recommendations. They are proposals informed by the comparison, with no promise that one package will work everywhere. Their common concern is how to turn separate capabilities into coordinated action.
Outro
So go back to the water, the power, and the phone network. Cyberspace supports everyday services while also serving as a domain where states compete. Those two roles exist together.
The question I would leave you with is this. When we think about protecting that network, are we giving enough attention to the relationships between the people responsible for its different parts?
The study suggests those relationships matter alongside the technology. That is the thread running from Estonia's experience to the American coordination problem. I'm Jordan. Thanks for listening.