FORTRESS America and the adversary inside the dependencies

FORTRESS America was announced on September 30, 2026, with an implementation memorandum dated October 6 and further reporting October 7. Its five pillars are energy independence, supply-chain and defense industrial base resilience, strategic reserves, installation hardening and cyber resilience, and space/spectrum resilience. A defense official identified resilient energy as an early priority on October 20. That is the documented program chronology, not evidence of a newly discovered joint adversary campaign.

The structural insight is important: a base that cannot obtain power, parts, communications, or operational telemetry is not resilient merely because its endpoint tools report green. Facilities should be able to operate with compromised external assumptions. The equivalent private-sector question is whether payment processing, water control, clinical operations, logistics, and communications can continue when their upstream utilities or identity providers cannot.

A useful assurance model combines asset criticality + dependency graph + verifiable recovery outcome. Map OT and IT management paths; validate energy islanding or alternatives; test backup communications and failover; measure restoration times from actual exercises; and retain evidence of supplier provenance and critical-asset access. OpenTelemetry/Elastic can correlate incidents and deviations, but telemetry alone cannot establish the physical independence of a power system.

What the program does not establish: a published procurement commitment to every named supplier, a new binding civilian security standard, or proof that a particular cyber operation caused the decision. Interpret it as a policy-level response to a documented class of strategic vulnerabilities, with deployment details still developing.

Assurance question: Could our most important business process continue when the grid, identity provider and primary network carrier fail together—and what tested evidence would persuade a director or regulator?

Established public record. MITRE ATT&CK identifies Volt Typhoon (G1017) as a PRC state-sponsored group active against US critical infrastructure, associated with long-term footholds, valid credentials and living-off-the-land behavior. MITRE separately identifies Salt Typhoon (G1045) as a PRC state-backed campaign focused on network infrastructure and telecom/ISP compromises. The FBI reported Salt Typhoon-linked theft of call-data logs and limited private communications; NSA-led guidance documents related global espionage targeting. These are distinct tracking clusters and mission profiles, not aliases for a single organization.

Iranian capabilities also exist independently. MITRE identifies MuddyWater as a MOIS-associated Iranian espionage group active against telecommunications and other sectors. Check Point’s March 2026 analysis reports Iranian state-linked actors increasingly making use of cybercriminal tools, infrastructure and services. This supports the general proposition that access and operational capabilities can move across organizational boundaries—not that Iranian operators have been proven to receive access from Volt Typhoon or Salt Typhoon.

Analytical hypothesis (Richard E. Davis; low confidence, unverified). Given overlapping strategic interests, the practical market for stolen access, and the demonstrated use of proxy infrastructure and intermediaries, one plausible scenario is syndication: an access broker or operator provides an asset, toolchain, or logistics service subsequently used by actors aligned with a different nation-state. Under that scenario a Chinese-linked foothold could conceivably be repurposed, leased or handed off to an Iranian-linked operator for a separate operation. No publicly verified case tying Volt Typhoon or Salt Typhoon to such a PRC–Iran transaction was established in the sources reviewed.

Competing explanations matter. Similar tactics may reflect commodity tooling, the same vulnerable edge products, common hosting providers, independent convergence on high-value targets, or erroneous attribution. Shared infrastructure is weaker evidence than a documented authenticated handoff. Strategic alignment is not command-and-control linkage. Even a correlated attack timeline would be insufficient by itself.

What would change confidence? Independently authenticated transfer records, shared actor-controlled credentials, a documented seller/buyer chain, coincident access to the same victim with handoff artifacts, overlapping operational command infrastructure, or corroborated governmental attribution would materially strengthen the hypothesis. Absence of those discriminators warrants low confidence. The defensive control priority does not depend on resolving the hypothesis: instrument edge devices, detect account-abuse behavior, correlate identity-to-OT reachability, and exercise coordinated-denial scenarios.

Assurance question: Can our telemetry distinguish a routine legitimate administrative action from long-lived attacker pre-positioning, and can we trace a cross-domain identity or edge-device handoff without assuming who controlled it?

Connecticut’s Attorney General announced that an initial wave of amendments and related protections began October 1, 2026. The package addresses facial recognition, surveillance pricing, genetic information, data brokers and amended privacy duties. Applicability turns on the processing activity, controller role, thresholds and exceptions—not the presence of a chatbot logo.

Start with actual data flows: identification, personalization, scoring, data enrichment, AI recommendations and vendor transfers. The evidence that counts is a readable notice, lawful processing basis where required, an operative rights process and tested vendor instructions. Calendar subsequent effective provisions separately.

Assurance question: Could the organization show which Connecticut data-driven decision features fall within the amended law, and produce their notice and rights-handling evidence?