Filed under critical-infrastructure.

Iron Does Not Take Orders

Executive Order 14421 draws a security perimeter at the substation fence but does not distinguish between a thousand-tonne transformer and the firmware-updatable controller bolted to its side. The threat model for laminated steel requires ownership checks and teardowns; for a device that receives commands, it requires authenticated updates and a hardware bill of materials. One rule covering both does not double the protection—it obscures the part that matters.