14 Feb 2026 Search

The TIDALWAVE report from The Heritage Foundation is out.

TIDALWAVE is a progressive Artificial Intelligence–enabled model and computer simulation to simulate a protracted conflict between the U.S. and the People’s Republic of China (PRC). TIDALWAVE identifies gaps and deficiencies and corresponding solutions to resolve anticipated shortfalls in our ability to project and sustain the joint force and to exploit adversary vulnerabilities in order to deplete their ability to conduct military operations.

If we do get into a war, we run out of missiles and torpedoes, real fast.

U.S. munitions inventories, particularly for critical long-range precision-guided munitions (LR-PGMs) and heavyweight torpedoes, are almost certainly insufficient to meet the consumption rates projected for any high-intensity conflict.

Meanwhile, the PRC is rapidly growing manufacturing, but has to import more and more of their oil. So they’re building the biggest, cheapest electric grid they can, as fast as possible (using coal, solar, whatever) which will leave them with more fuel for ships and aircraft. The relative position of the two sides is shifting toward the PRC.

And the report leaves out an important vulnerability for the USA. TIDALWAVE was done using the big, famous LLMs, which might help explain that. A real weak point of LLMs seems to be in generating output about relationships between facts that are connected in some way, but that people talk about using different terminology. And the connection between privacy issues and national security is fundamental but, because defense writers and privacy writers use different words, the LLM is going to miss something.

The manufacturing and cargo handling workers responsible for making all that high-tech ordnance and getting it to where it’s needed are not numerous, and each person has a lot of hard-to-replace know-how. And usually each worker spends a significant fraction of their day in a vehicle with a mobile phone and a license plate.

An adversary can assemble cheap, lethal drones inside the USA, and target the key defense workers, on their commute or at home, using commercially available products and services, from location tracking to SIM cards. Or, if the adversary has a few agents working at certain companies, they get the targeting data free with no paper trail. Some adversary countries are probably trying both ways.

The report points out that Hydroxyl-Terminated Polybutadiene (HTPB) is a critical material for the rocket motors used in missiles. If a defense plant were able to hire a replacement for a manufacturing worker, would they know what to do with a shipment of HTPB if they were able to get one? Raytheon needed to bring back retirees to teach new workers how to build a Stinger missile. But instead of protecting key personnel from targeting, we have a whole industry based on collecting, selling, and sharing personal data. Technically we have a Protecting Americans’ Data from Foreign Adversaries Act (PADFA) and the FTC has been warning Data Brokers about complying with it, but it’s nowhere near enough.

  • Hiding company ownership is feasible. We don’t know which businesses here are really “entities controlled by a foreign adversary country.”

  • Employees and service providers of a data broker may be foreign adversary controlled even if, on paper, the data broker company is not. (How many employees of the Big Tech companies are non-official cover agents of the PRC?)

A drone raid (think Operation Spiderweb, but targeting individuals using mobile tracking data instead of targeting aircraft using airbase maps, and with more advanced drones) would be relatively easy to pull off in an unprepared USA on the first day of the war, and—for a while anyway—the attacker could keep it deniable. Yes, in the long run, historians will figure out who was responsible, but in today’s media environment the USA could be tricked into blaming someone else for long enough to confuse everybody.

  • Throw some money and realistic support at actual terrorist groups that would loudly claim responsibility. Rely on elected officials in the USA to brag on success and amplify the story.

  • Run a campaign of good fake videos and influencer content for fake stories.

  • Release bad, obvious AI, fakes similar to whatever real evidence gets out, rely on genuine well-intentioned debunkers to create and amplify the narrative that the real attack was fake.

What to do about it

Privacy laws, regulations, and private right of action are part of the survivability onion for defense assets. It is more important than ever to address the tension between the role claimed by US-based tech companies as “national champion” exporters, their roles as enablers of internal violence and data collection, and their role in adding to national security concerns. The same data processing that makes Big Tech so politically popular with the current administration, but less and less popular otherwise, is adding to national security risks that are harder and harder to address.

An expanded Daniel’s Law that covers military personnel and defense workers is going to be one step along the way. We also need more research and testing. The good news is that privacy tech is easier to adopt in a distributed way than other defensive measures. US Navy exercises successfully “destroyed” the fleet at Pearl Harbor in 1932 and 1938, but the knowledge didn’t prevent the real attack a few years later. Defending from a surveillance-enabled attack on defense workers is different, though, because the attack would rely on the same enabling technology as ordinary privacy violations. A strong private right of action for individuals, and a private right of action for employers to protect key personnel, would enable more incremental, case by case, upgrades to personal/national defense—without waiting for one large attack.