Ask the controls group at any water utility how they replace a failed PLC.
A fair number of them will tell you about a saved search on eBay.
Not as a confession. As a procedure.
I want to be careful here, because the obvious reaction is that somebody is cutting corners. That is not what is happening. Buying a discontinued controller from an anonymous seller is compliance with the replacement rule, and it is the last step in a chain of decisions that nobody at the plant made.
Start with a question nobody asked
In late July 2026, more than thirty Minnesota water and wastewater systems were disrupted in a coordinated attack on their operational technology. Within days the FBI and EPA reported incidents in at least seven states. A plant went offline. A city declared a local state of emergency.
In the coverage that followed, a security researcher made an observation and then everybody moved on. He noted that in industrial control networks the infrastructure is largely built out by the integrator, which raises the odds that remote connections get overlooked.
That is exactly right. And it stops one question short.
Why was it built that way? Not by whom. Why.
The answer is not that an integrator was careless. The answer is that the way this country buys control systems for public water utilities produces that outcome reliably, from competent people, working in good faith, following the rules.
The asymmetry that explains it
Walk into a municipal utility and ask the IT director what they run. You will get a straight answer. We are a Cisco shop. We standardized on that endpoint agent three years ago.
Walk down the hall and ask the operations group what platform the plant runs, and you will get a pained look and a list.
The reflexive explanation is that IT is disciplined and operations is a collection of people with screwdrivers and multimeters. That explanation insults the people who keep production running, and it is wrong.
Here is the actual difference. The IT department holds a budget, selects from a purchasing vehicle, issues a requisition, and takes delivery. It is a party to its own transaction.
The operations group is not a party to anything. Its equipment arrives as scope inside a construction contract that somebody else wrote, somebody else bid, and somebody else administers.
Operational Technology does not buy construction. Operational Technology is bought with construction.
You cannot standardize what you do not purchase. And once you understand that sentence, the eBay account stops looking like a shortcut and starts looking like the only move available.
Where this goes
Over the next several posts I am going to walk that chain all the way down. The statutes that make the asymmetry legal rather than accidental. The contract language under which a utility never owns the drawings that document its own plant. Why a five-minute password change takes four weeks to execute. Why every plant has one person who knows where everything is, and why that is a failure of management rather than a strength. And where a utility’s money actually comes from, which is the constraint nobody outside the sector understands.
A caveat worth stating up front, because it matters. None of this is a claim that utilities are incompetent or that the people running them do not care. Many have found ways to navigate parts of it. I have worked with utilities that hold their own tag register, that write owner-furnished equipment into their specifications, that fund real document control. Those are real accomplishments, achieved against the grain, usually by one determined person who decided it mattered.
I have never encountered a utility that has solved all of it. Not one.
The good news, and there is some, is that most of what needs to change costs nothing. Of the twenty-nine recommendations in the longer paper behind this series, eighteen require no new money at all. They are decisions, contract clauses, or data the utility already holds. Zero of them are technology purchases.
That is the argument. The rest is showing the work.