Two Sides of the Same Coin

When a military strike takes out a desalination plant, the first people managing the consequences aren't soldiers. They're water utility operators, public health officials, municipal emergency managers, and the communities that suddenly don't have clean water. When energy infrastructure gets targeted, the hospitals running on backup generators, the traffic systems going dark, the supply chains rerouting around the damage: none of that is a military problem. All of it is a crisis management problem.

Watch the targeting patterns in any active conflict right now. Energy infrastructure. Water systems. Transportation networks. Tourism economies. Communications. The targets aren't military installations. They're the civilian systems that populations depend on to function, and that military operations depend on to sustain themselves.

This isn't a new observation. NATO's baseline requirements for civil preparedness have said for years that military effectiveness depends on resilient civilian infrastructure, logistics, and governance. Strategic analysts have argued that resilience is not a supporting function but a critical pillar of credible deterrence, as fundamental to alliance security as military readiness itself. What's new is that we can watch it play out in real time and still pretend the lesson doesn't apply at home.

The United States has the luxury of two oceans and friendly borders. That geography has shaped how we think about defense and crisis management as fundamentally separate domains. We plan offensive operations with extraordinary precision. We invest in force projection, logistics chains that span continents, intelligence capabilities that operate globally. And we treat the civilian systems that all of it ultimately depends on as someone else's problem.

That separation has always been a fiction. It's just a fiction that geography let us afford. Until now.

The United States hasn't fought a war on its own soil in any living person's memory. That fact has shaped institutions, budgets, and assumptions in ways that most professionals in both defense and emergency management rarely examine.

Because we project force elsewhere, we've built planning assumptions around the idea that the homeland stays largely untouched. Defense planners focus outward. Emergency managers focus on natural disasters and domestic incidents. The two communities share conferences occasionally, cite each other's frameworks in footnotes, and operate in functionally separate worlds with separate funding streams, separate authorities, and separate cultures.

The organizational charts reflect this. The Department of Defense handles the military side. FEMA, now diminished and defunded, handled the domestic side. DHS was supposed to bridge them after 9/11, but in practice it became another layer of bureaucracy sitting on top of agencies that still operated in silos.

Somewhere in a government basement or on an agency shelf, there are older plans for what happens if water infrastructure gets attacked. How to manage mass casualties from a strike on a population center. What the coordination looks like when critical infrastructure goes down not from a hurricane but from deliberate targeting. Those plans exist. Most of them haven't been exercised meaningfully. Many haven't been updated in years. Almost none of them account for the current state of the civilian systems they assume will be functional.

The countries that don't have two oceans can't afford that assumption. And they're acting accordingly.

Sweden reintroduced Total Defence, a framework that eliminates the separation between military defense and civilian crisis management entirely. Their parliament approved the largest defense reinforcement since the Cold War: more than $16 billion for military defense and nearly $4 billion specifically for civil defense by 2030. Every municipality must maintain crisis management councils and demonstrate readiness. Critical infrastructure operators have legal preparedness obligations. The government distributed "If Crisis or War Comes" to 5.5 million households with the expectation that citizens maintain one week of self-sufficiency.

Before an American reader dismisses those numbers as small, consider the scale. Sweden has 10.6 million people and a GDP of roughly $660 billion. That's almost exactly the size of North Carolina (11.2 million people, $638 billion GDP). Imagine North Carolina, on its own initiative, committing $4 billion to civil defense over five years, requiring every county to maintain crisis management councils, imposing legal preparedness obligations on critical infrastructure operators, and mailing preparedness guides to every household in the state. That's what Sweden is doing. A country the size of a single American state is making this investment because geography forces it to take the threat seriously. Now ask what North Carolina, or any US state of comparable size, is spending on the civilian side of the coin.

Finland has operated under a similar model for decades. Its whole-of-society security framework integrates government, private corporations, and ordinary citizens into a unified structure organized around seven vital functions of society, from defense and internal security to psychological resilience. The approach isn't aspirational. It's backed by specialized national defense courses and legal obligations that make civilian preparedness a permanent governance function, not an emergency response add-on.

Poland is investing heavily in defense modernization precisely because proximity to conflict makes the theoretical distinction between military and civilian crisis management meaningless. Germany, after years of underinvestment, is rebuilding defense and civil protection capacity simultaneously because they recognized you can't have one without the other.

A 2025 Danish Institute for International Studies analysis of civil preparedness across the Baltic Sea region found that even among NATO allies increasing military spending to record levels, many still struggle with fragmented coordination and outdated physical infrastructure on the civilian side. The study highlighted Finland and Sweden as the leaders, precisely because they've built governance structures that treat civilian resilience and military defense as inseparable. The nations falling behind are the ones still treating them as separate domains.

The common thread isn't ideology or threat perception. It's geography. These nations understand that when conflict arrives at your borders, or when adversarial pressure targets your civilian systems, the line between defense and crisis management disappears. The water utility operator and the military planner are working the same problem. The hospital administrator running mass casualty protocols and the logistics officer managing supply chains are two sides of the same coin.

They're reorganizing governance to match that reality. I would argue that in the US, we haven't.

Anyone waiting for a foreign threat to prove the point doesn't need one. The civilian side of the coin is already failing under non-adversarial conditions.

Texas, February 2021. A winter storm overwhelmed a power grid that had been optimized for cost rather than resilience. Regulatory decisions traded redundancy for savings. The grid failed not because the storm was unprecedented but because the system had no margin. Over 200 people died. The economic damage exceeded $195 billion. And the cause wasn't an attack. It was weather hitting a system that decades of underinvestment and regulatory capture had made fragile.

If a cold snap can collapse the grid, what happens when the pressure is deliberate?

What happens when a system that failed in a cold snap is targeted, and doesn't just fail, but fails spectacularly?

Research on the US defense industrial base has found that wartime production rates for munitions and autonomous systems would concentrate extreme energy demands on specific clusters of titanium, aluminum, steel, and semiconductor facilities, all of which depend on regional electrical grid and natural gas delivery infrastructure with known bottlenecks. The defense supply chain itself runs on civilian infrastructure. Even the polished side of the coin depends on the neglected side to function.

The evidence extends beyond single events. Look at where the money goes in the United States and the picture is clear. Roads deteriorating. Bridges rated structurally deficient. Water systems running on infrastructure built generations ago. Communications networks with known vulnerabilities. Street lights that don't work. Potholes that don't get filled. These aren't abstractions. They're the visible indicators of a governance system that has been deferring maintenance on civilian infrastructure for decades.

The American Society of Civil Engineers gave US infrastructure a C- in its most recent report card. That grade reflects a $2.6 trillion investment gap. Every dollar of that gap represents a vulnerability. Not a theoretical vulnerability that requires a sophisticated adversary to exploit, but a real one that weather, aging, and ordinary wear are already exploiting every day.

This is the domestic evidence that the two-sides framing demands we take seriously. We don't need to imagine what happens when civilian systems fail under pressure. We can watch it happen every winter, every hurricane season, every time a water main breaks in a city that last replaced its pipes during the Eisenhower administration.

And this is where the conversation needs to move beyond the "either / or" equation of civil or military, emergency management and security. Because the vulnerability I'm describing doesn't live inside any single agency. It lives in the space between them.

Emergency management gets framed as the domain responsible for consequences: response, preparedness, communications, recovery. When something breaks, emergency managers coordinate the response. That framing is accurate as far as it goes. But it doesn't go far enough for the threat environment we're actually in.

The real vulnerability is in governance. Specifically, it's in the interstitial space where single-agency responsibility ends and interagency coordination is supposed to begin, in the space that falls below the threshold where wartime authorities activate. That space is where security governance lives. It's where institutional responsibilities become unclear, where legal authorities don't cleanly apply, where coordination depends on relationships and improvisation rather than structure and mandate.

It's also where decades of underinvestment across all of these "siloes" show up most visibly.

Within individual agencies, the US is often quite capable. The military plans and executes with precision. Fire departments respond, law enforcement investigates, public health tracks and monitors. Each agency, within its defined lane, generally functions.

The breakdown happens at the seams. When a crisis requires multiple agencies operating under ambiguous authority, sharing information across classification boundaries, coordinating resources that no single entity controls, and making decisions faster than hierarchical approval chains allow, the governance architecture doesn't hold. We saw this after 9/11. We saw it during Katrina. We saw it during COVID. Each time, the response was to add coordination mechanisms on top of the existing structure rather than address the structural gap itself.

The DHS experiment was supposed to solve this. Twenty-three years later, DHS houses agencies that still operate largely independently, FEMA has been diminished to a grants management office with uncertain future, and the interagency coordination function remains more aspiration than architecture.

The military itself has started recognizing the gap from its own side. The Center for Army Lessons Learned has proposed a Military Humanitarian Cell concept that would begin planning for civilian recovery while combat operations are still active, drawing directly on FEMA's emergency management frameworks. The concept shifts the military into a supporting role that prioritizes host nation leadership and cultural needs. It's a telling admission: even the Army's own lessons learned process has concluded that military operations can't succeed without integrating civilian crisis management from the start, not as an afterthought once the fighting stops.

But - and there's a big "but" here. It's still planning for outside the US, and not at home. One thing military planners don't really account for are simple things, like the role of the Mayor, the Sheriff, 911 (or 112) centers...essentially the areas where we work daily to build public trust.

I watch these two worlds operate as if they've each got their environment mapped and their plans in order. Defense professionals look over the fence at emergency management and assume someone over there has civilian resilience covered. Emergency managers look over the fence at the security community and assume the threat side is handled. Both communities carry on as if the other has figured out the piece that they haven't.

And the space between them, the governance gap where their responsibilities are supposed to meet, sits empty. I feel the clock ticking. The pressure is building. Not in one domain or the other, but in that space between them where no one is building anything. And systems that aren't built for the pressure they're about to face will break. That's not a prediction. It's what the evidence is already showing us in smaller doses every year.

The convergence happening right now makes the next five years particularly dangerous.

On one side, the federal government is actively withdrawing from domestic crisis management capacity. FEMA's workforce is being cut, mitigation grants canceled, disaster reimbursements frozen. The safety net is being pulled away.

On the other side, the threat environment is expanding. Active military conflicts are demonstrating in real time that adversaries target civilian infrastructure as strategy, not accident. Retaliatory cyber operations against critical infrastructure remain a credible risk. Extreme weather related disasters continue to arrive faster and hit harder than the systems built to manage them.

And in the middle, in that space where the response to all of this is supposed to be coordinated, the United States has done almost nothing to build the structures these conditions demand. We stand up, we exercise, we stand down. Up and down, on and off, watching our environment change shape while the same failures repeat.

It's a flashing red light telling us something is just. not. working.

European nations that recognized this gap five years ago are now well into their reorganization. Sweden's Total Defence framework is operational. Finland never dismantled theirs. Poland is investing at levels that would be unimaginable in US domestic preparedness. Germany rewrote its national security strategy. These aren't aspirational documents. They're funded mandates with legal force.

The United States is moving in the opposite direction. Cutting domestic capacity while the threat environment expands, broadly, at scale, and internationally. Maintaining the fiction that defense and crisis management are separate domains while every active conflict demonstrates they aren't. Governing as though two oceans still provide the insulation they provided in 1945.

They don't. And the evidence, both from overseas targeting patterns and from our own domestic infrastructure failures, says the gap between what we've built and what we need is getting wider, not narrower.

Are our hospitals ready for mass casualties that aren't from a natural disaster? Are our water systems prepared for deliberate disruption? Can our power grid sustain weeks of outage in winter from targeted attacks on the infrastructure that Texas showed can't even handle a cold front?

If the answer to any of those questions is yes, I'd argue the evidence says otherwise. And if the evidence you'd point to is a recent emergency or disaster where the system held, that response actually proves the concern. Those events stress-tested systems that were already stretched to breaking by underinvestment and deferred maintenance, not by deliberate adversarial pressure. The Texas grid didn't fail because of a sophisticated attack. It failed because the system had been allowed to become fragile. Every domestic example of infrastructure failure under natural conditions is a preview of what happens when the pressure is intentional and sustained.

The countries reorganizing their governance around this reality aren't doing so because they're more threatened than we are. They're doing it because geography forces them to take the threat seriously. The United States has the same vulnerabilities. We've just had the luxury of not looking at them.

That luxury is ending. And the gap between what we've built and what we need won't close in a crisis. It closes now, through deliberate investment and structural change, or it becomes the vulnerability that defines the next decade.

Two sides of the same coin. Each side doesn't see the other, and assumes everything is under control.

The governance gap between defense and civilian crisis management doesn't wait for a crisis to matter. Crisis Lab helps senior professionals see across domains and build the integrated thinking that modern threats demand, through applied learning, strategic analysis, and practitioner-led research. The Forum at Crisis Lab brings together senior leaders from emergency management, national security, business continuity, and governance for the ongoing peer exchange these challenges require. Learn more at crisislab.io.