America is ready to fight a cyber war. It isn’t ready to survive one

Washington is reorganizing for cyber conflict in real time. In June, a proposal to create a separate U.S. Cyber Force was defeated 14-13 in the Senate Armed Services Committee. Now the National Security Agency is preparing what news reports describe as one of its most significant internal reorganizations in a decade, with five mission centers focused on China, cybersecurity, artificial intelligence, combat support, and global intelligence. Those moves address real military and intelligence problems. President Donald Trump’s “Cyber Strategy for America” also calls for an unprecedented, coordinated, and sustained government effort and says private-sector partners must be able to respond and recover quickly. But one question remains unusually hard to assign: Who is accountable for keeping the civilian state functioning when a sustained cyber conflict crosses agencies, companies, sectors, and jurisdictions at once?That is the case when Congress should begin testing for a Department of Cyber War — not a new military service and not an agency empowered to wage war, but a civilian institution whose central mission would be national continuity during severe cyber conflict. The threat is concrete enough to justify preparation without catastrophe rhetoric. In 2024, U.S. and allied agencies reported that the China-linked Volt Typhoon group had compromised critical infrastructure in communications, energy, transportation, and water systems and assessed that the actors were positioning themselves for disruptive effects during a future crisis. The point is not that such a campaign is inevitable. It is that an adversary has already shown interest in the dependencies that keep American society and military power connected.Imagine several of those dependencies failing together. Electricity is intermittent. Government identity services are suspect. Ports cannot clear cargo normally. Payment or scheduling systems are degraded. A hospital can keep treating patients only if fuel, communications, and supply deliveries continue. Every agency may still be performing its statutory job while the national system fails at the seams.Artificial intelligence raises the stakes because software agents increasingly hold credentials, tools, and permission to change configurations or issue instructions. During an incident, detecting a compromised agent is only the first decision. Someone must know how to restrict its authority without disabling the underlying service, how to keep operating in a degraded mode, and what evidence permits consequential permissions to return.The United States is not starting from zero. The Office of the National Cyber Director already coordinates national cyber policy and strategy. CISA, the FBI, NSA, sector agencies, state and local governments, regulators, infrastructure operators, and private companies all hold real authorities and capabilities. Any Department of Cyber War proposal that pretends this machinery does not exist should be rejected.The narrower question is whether the existing architecture produces one accountable owner for cross-sector continuity and recovery when normal coordination itself becomes unreliable.A Department of Cyber War should therefore be federated, not imperial. It should not automatically absorb NSA, CISA, or the FBI. Its secretary should not enter the military chain of command. A hospital, utility, or company should not need Washington’s permission to take lawful emergency action inside its own systems. The department’s job would be to make the seams visible, exercise them, and assign responsibility for what happens between institutions.Its first mission should be brutally practical. Can officials authenticate emergency instructions after a shared identity provider is compromised? Can agencies communicate when normal networks are unavailable? Can fuel reach hospitals when transport scheduling and payments are both degraded? Which services must recover first because others depend on them? Through what surviving channel is that priority communicated and challenged?The department’s own powers would need hard limits. It should hold no universal administrative credential capable of controlling participating networks. Information sharing should be purpose-limited and auditable. A cyber emergency should not become a standing excuse for domestic surveillance, control of lawful speech, or open-ended emergency authority.The obvious objection is that Washington may not need another department at all. A new bureaucracy could duplicate existing offices, drain scarce specialists, and make decisions slower.That objection should determine the design of the experiment. Congress should authorize a comparative pilot before creating the department. Test four models against the same scenarios: today’s arrangements; strengthened existing institutions; a federated interagency continuity model; and a Cabinet-level Department of Cyber War. Measure restoration time, decision quality, operator burden, unsafe actions, civil-liberties effects, and cost.That approach follows a lesson the Government Accountability Office has already pressed on national cyber strategy: Government needs outcome-oriented performance measures and credible cost estimates, not merely activity counts and ambitious plans.The department should earn its mandate. If strengthened existing institutions close the gaps faster, more cheaply, and with less concentration of power, use them. If repeated exercises show that cross-agency responsibility still fails under realistic disruption, then a dedicated civilian institution has a much stronger case.The name Department of Cyber War would confer no new war powers. Ordinary cybercrime would not become an act of war by declaration. The purpose is almost the opposite: to make sure that civilian authority, essential services, and lawful human decision-making survive when cyber conflict attacks the systems on which all three depend.TWENTY YEARS IN PRISON FOR WRITING CODE: BERNIE SANDERS WAGES NUCLEAR WAR ON AIAmerica does not need another cyber organization simply because cyberspace is dangerous. It needs evidence about whether lawful government can still decide and essential services can still function when the networks and dependencies they normally trust begin failing together.We should run that test before an adversary runs it for us.Burak Oktenli is based in Washington and studies applied intelligence at Georgetown University. The views expressed are his own.