The Espionage–Covert Action Continuum in Cyber Operations Against Water Infrastructure

The distinction between espionage and covert action, central to intelligence doctrine and cyber law, rests on separating observing a system from altering it. Cyber operations against control systems acting on the physical world destabilize that separation, and water is the sharpest case: the medium can amplify small digital interventions through nonlinear hydraulic and chemical effects, so the consequences depend on the medium’s state, not the intrusion’s sophistication. Drawing on the 2025 cyberattack on a Norwegian dam, operations against Polish water utilities, and the 2015 Ukrainian grid operation, the article replaces a single verdict with four criteria: access scope, functional capability, physical consequence chain, and environmental specificity. Applying them depends on environmental baselines existing intelligence disciplines do not supply, a gap requiring climate and environmental intelligence.