Emmanuel Macron wants to build a wall around the twenty-first century using nineteenth-century tools.
When the French president announced emergency orders to harden critical infrastructure against Russian sabotage, national security pundits cheered. They pointed to severed undersea data cables, mysterious drone sightings near nuclear facilities, and the ghost of the Nord Stream explosions. They called it a necessary wake-up call for a continent lulled into peacetime complacency. If you enjoyed this article, you should read: this related article.
They are completely wrong.
Fortifying electrical grids, telecommunication hubs, and water treatment plants with more concrete, barbed wire, perimeter sensors, and armed military patrols is not a defense strategy. It is a multi-billion-euro security theater production designed to soothe public anxiety while missing the actual threat vector entirely. For another look on this event, see the recent coverage from NBC News.
If you think a foreign adversary is going to send a squad of operatives to cut a power line in rural France in 2026, you are fighting the last war. Modern critical infrastructure does not fall to a pair of wire cutters or a backpack explosive. It collapses because we built an advanced technological civilization on top of fragile, centralized digital codebases controlled by a handful of entities that nobody audits, maintained by contractors who patch systems on Friday afternoons, and connected to networks that invite systemic failure.
By obsessing over physical protection against a conventional geopolitical boogeyman, European leadership is treating a visible symptom while ignoring the structural disease.
The Physical Fallacy
Let us look at the data. State-sponsored physical sabotage against core industrial assets is statistically rare, incredibly noisy, and notoriously difficult to execute without immediate attribution and severe political escalation. Dropping explosives on a pipeline or cutting a fiber optic line on the seabed creates an unmistakable paper trail. It triggers immediate mutual defense clauses, severe economic retaliation, and a mobilization of intelligence assets that few nations undertake lightly outside of active total war.
Governments love physical threats because physical threats give politicians something to point at. A concrete barrier looks decisive on the evening news. An armed soldier standing outside a transformer station provides a reassuring visual for taxpayers.
It is all a distraction.
I have watched public sector budgets hemorrhage millions into perimeter security upgrades while the core IT infrastructure running those exact same facilities relies on default administrator passwords, outdated firmware, and remote-access software routed through third-party vendors with zero security clearances. You can line every nuclear plant in Europe with triple-stacked chain-link fences, but if an attacker can pivot through a compromised HVAC vendor's billing portal to access the turbine control plane, your fence is nothing more than an expensive decoration.
Physical hardening addresses the vulnerabilities of 1914. We are currently living through 2026.
The Software Blind Spot
Consider how modern power generation, water distribution, and mass transit actually operate. They run on Supervisory Control and Data Acquisition systems—industrial control software designed decades ago when operational security meant keeping the door to the control room locked. These systems were never built to withstand a connected world. They were built for reliability and uptime in isolated environments.
When utilities were digitized to save costs and increase efficiency, engineers bridged the air gap. They connected operational technology to enterprise IT networks, and enterprise IT networks to the open internet.
That single architectural shortcut created an attack surface so vast that physical walls are utterly meaningless. An adversary does not need to cross a border to disable a substation. They do not need to bribe a security guard or swim across a reservoir. They need a zero-day exploit in a proprietary protocol parser, a phishing credential harvested from a mid-level manager on LinkedIn, or a compromised software update from an upstream vendor.
In 2015 and 2016, hackers demonstrated this reality in Ukraine by plunging hundreds of thousands of people into darkness not by blowing up power plants, but by logging into the control center remotely and opening the breakers themselves. No commandos crossed the frontier. No physical guards were overpowered. They simply used keyboard strokes.
When Macron orders increased physical surveillance to counter Russian threats, he is locking the front door while leaving the digital back door wide open, unlatched, and illuminated by a neon sign.
The Architecture of Fragility
The deeper issue with Europe's infrastructure vulnerability is not malicious foreign intent; it is centralized consolidation.
Over the past two decades, continental infrastructure has undergone a quiet consolidation. Municipalities and regional utilities surrendered local autonomy to mega-corporations and centralized cloud providers in the name of efficiency. Instead of thousands of distinct, localized, analog-capable micro-systems, Europe now relies on tightly integrated, highly centralized national grids managed by a small oligopoly of contractors and software suites.
This creates a terrifying single point of failure.
When you centralize infrastructure, you concentrate risk. If an adversary compromises a decentralized network of five thousand independent water treatment plants, they achieve almost nothing. If they compromise the single centralized cloud control system managing regional water distribution for millions of citizens, they can paralyze an entire state in minutes.
European leaders champion integration because it looks clean on bureaucratic spreadsheets. It lowers overhead. It allows central ministries to exert top-down control. But in engineering, efficiency is the direct enemy of resilience. Redundancy, friction, decentralization, and localized autonomy are messy, expensive, and inefficient—and they are the only things that keep a system alive when catastrophe strikes.
By focusing on physical defense, Macron is reinforcing the very centralized architecture that makes the infrastructure fragile in the first place.
The Bureaucratic Addiction to Theater
Why do smart leaders make such baffling strategic errors? Because security theater is politically frictionless.
When a government announces a new directive for infrastructure protection, the incentives align perfectly across every stakeholder. The executive branch looks proactive and strong. Defense contractors secure multi-million-euro procurement contracts for cameras, drones, and sensors. Bureaucrats generate reports confirming that action was taken.
Nobody loses an election by putting more guards around a power station.
Conversely, attempting to reform the deep, boring, unsexy fundamentals of national cybersecurity and software supply chain integrity is a political nightmare. Telling a major industrial conglomerate that they must completely rewrite their legacy codebases, eliminate third-party software dependencies, and maintain expensive analog analog backups triggers intense lobbying, massive pushback, and years of legislative gridlock. There are no dramatic ribbon-cutting ceremonies for secure code audits.
So politicians choose the concrete. They choose the visible deterrent. They invest in the illusion of control.
I have sat in rooms where corporate risk officers openly admitted that their physical security audits were entirely performative, designed solely to satisfy insurance underwriters and government regulators while their actual network logs showed ongoing unauthorized scanning from known threat actors. The system is rigged to reward looking safe over being safe.
True Resilience Requires Anarchy
If we want actual protection against sophisticated state-sponsored disruption, we have to abandon the fantasy of absolute state control and embrace radical operational decentralization.
First, every critical infrastructure asset must maintain a mandatory, non-networked analog fallback. If the digital control plane goes dark—whether from malware, a severed cable, or a software update gone wrong—operators must be able to switch to manual, mechanical control within minutes. If a power grid cannot be operated with clipboards and physical switches when the computers die, it is not an infrastructure network; it is a glass house waiting for a stone.
Second, we must aggressively decentralize energy and resource generation. Massive national grids connected by long-distance transmission lines are high-value targets. Distributed microgrids powered by local renewables, backed by local storage, and managed by localized logic are nearly impossible to knock out on a systemic level. You cannot plunge a country into darkness if the country runs on ten thousand independent energy cells instead of three massive centralized distribution nodes.
Third, we need to stop outsourcing critical software architecture to commercial vendors whose primary incentive is profit margin, not national survival. Open-source auditing, mandatory code verification, and rigorous liability laws for software negligence would do more to secure European infrastructure in one month than a decade of military patrols around nuclear reactors.
Macron wants to guard the borders of the state against an invading army. But the invader is already inside the terminal, sitting quietly in the firmware, waiting for the command to execute.
Building a thicker wall around a rotten foundation does not save the house. It just makes the eventual collapse heavier. Stop paying for concrete. Start fixing the code.
