Tribal Cybersecurity & Sovereignty Require Building Shared Digital Dikes

In 1999, Michael Day was the MIS Director for the Sault Ste. Marie Tribe of Chippewa Indians, in Michigan's Upper Peninsula. Every tribe that opened a casino was buying the same systems from the same handful of companies, facing the same regulators, and hitting the same problems, and each was doing it alone.

Day later explained what he did next in one sentence: "Understanding the absurdity of every tribe facing this challenge completely on their own is what led to my vision for TribalNet and eventually TribalHub." 

The first TribalNet, in 2000, had about 15 technology leaders in the room. I came home from my third TribalNet in Dallas last month, still thinking about that sentence, and about a rule from a country mostly below sea level.

Much of the western Netherlands sits below sea level. It is dry only because someone built a wall of earth against the water, and someone has kept it standing ever since. Around 1122, farmers near Wijk bij Duurstede banded together to build and maintain a dam on the Rhine.

 

In 1255, Count William II of Holland issued a commission to the local dike wardens of the Rhineland to protect the entire district from flooding. That body, the Hoogheemraadschap van Rijnland, still exists today.

The way the dike was kept is the mechanism that matters. The board did not maintain the dike. The farmers did. Each farmer was assigned a stretch to maintain, and the board's directors inspected each stretch. The rule that governed it all survives in Dutch: "Wie het water deert die het water keert." Whom the water harms stops the water.

Read that rule from the farmer's side. On his own ground, he is sovereign. But none of that survives the neighbor two farms down who didn't repair his section before the storm, because the water that comes through that gap doesn't stop at the property line. That is what made independent farmers accept inspection by their peers. Not because they liked it. Because the alternative was the sea.

575 federally recognized tribes exist in the United States. Each is a government, sovereign on its own land, with its own council, laws, systems, and stretch of dike. 

Nobody tells a tribe how to run its network. Nobody should. Yet every one of those tribes stands behind the same wall. The attackers who come for tribal governments, casinos, and clinics don't know or care which nation they belong to. In 2021, Tribal-ISAC's first year, news reports covered six Oklahoma casinos hit by ransomware in June and a California casino shut down for three weeks in September. Those attackers weren't studying treaties. 

They were running the same tools against the same gaming systems, hotel platforms, email, and vendors' remote access. A weakness in one tribe's stretch is a rehearsal for the same attack on the next one.

Tribal-ISAC is the board that walks the dike. It is a nonprofit for tribes, and it does what the Rijnland board did: it lets each member see the state of the others' sections without giving up their own ground. Members share what they are seeing, with their identity protected, so the rest of us can walk our own stretch that afternoon and look for the same crack. By FedTech Magazine's count last year, it had grown to more than 300 members across 106 tribes.

Day put the arithmetic plainly in that first year: "You've increased your capabilities ten-fold, a hundred-fold, just by being a part of the community.”

"Networking" has been emptied out by overuse. What it actually consists of is simpler. 

It consists of Tribal-ISAC's monthly member discussions, where peers compare what they are up against and what has worked. Toni Pepper, Tribal-ISAC's executive director, wrote this summer that more organizations are joining those discussions, and that a Sponsored Membership Program now covers the cost for tribes that want to participate but don't have the budget. 

That matters. A dike is only as strong as its poorest section. It consists of TribalHub's regional forums, seven across the country, in person and free for anyone who works for a tribe or a tribal enterprise. 

Mine is Northern California, where I serve as one of the regional ambassadors. Our room is for people who support casino floors, tribal governments, and clinics within a day's drive of each other. The question in that room is never "What does the vendor say?" It is "What did it do for you, and what did it cost?"

It consists of TribalHub's Cybersecurity Summit, where I have sat on the advisory board since November 2023. One of the most useful things the board did wasn't a session. It was a decision about who gets a badge. The sixth summit, in Jacksonville this past February, added a track called Executive Responsibility, built for the people who don't run technology but must fund it: council members, CEOs, general managers, and health directors. 

For five years, the summit had been the farmers walking the dike. In year six, it invited the people who decide what the dike is worth. The next summit is in March 2027 at Gila River's Wild Horse Pass in Arizona. Once a year, it's TribalNet, where the person who solved your problem in March stands by the coffee urn.

A tribal executive will have to defend the plane tickets and the membership dues, and "it was valuable" isn't a defense. A number is. In October 2025, Tribal-ISAC released the first edition of The Pulse, a survey on the state of cybersecurity in tribal nations. More than two-thirds of responding organizations reported zero or one dedicated cybersecurity staff member. More than 60% spent less than a fifth of their technology budget on cybersecurity. And 74% received no federal or state cybersecurity grant in 2025. TribalNet released the second edition this year, and it's shared only with members and sponsors.

An organization with one security person, or none, can't watch its own stretch and also learn what is happening on everyone else's. It doesn't have the hours. The community turns hundreds of lonely stretches into one dike with hundreds of sets of eyes on it. No vendor product delivers that, because the product would have to be other tribes.

The value for the large tribe is less obvious, and I think it matters more. The tribe with a twelve-person team is the strong section of the dike, standing next to a weak one. The attacker who learns a trick on the weak section will bring it to the strong one, polished. Every well-funded tribe that shares what it sees buys down the risk in its neighbor's stretch, where its own flood will come from.

A third value is the one I would put before any council. The people in these rooms are the only people in the profession who know what it is to keep records for a government whose records were once kept by others and kept wrong. Almost nobody at the big industry conferences has been asked by an elder where the data lives and who can see it. In our community, that is the ordinary question.

Now, the part of the Dutch story that flatters no one. In 1514, a storm broke the sluices and the dike at Spaarndam, where the Rijnland board met the sea. The city of Haarlem liked the free passage the break gave its ships and refused to repair the dike. When the court ordered the repairs anyway, Haarlem sent soldiers in 1517 to destroy the work while it was underway. Neighbors who had shared a dike for centuries put armed men on it against each other.

Anyone who has sat through a budget cycle will recognize the soldiers. The Dutch version had something ours lacks. The water boards didn't run on goodwill. They ran on compulsion: assigned duty, inspection, and fines. Our community has none of that. Nobody can compel a tribe to join Tribal-ISAC, to say on a call what it learned, or to show up at a forum, and the law is entirely on the tribe's side. Our community runs on something the Dutch didn't need: sovereign people's willingness to be seen. There is no fine for staying quiet. Only the arithmetic says every lesson kept at home is a lesson the next tribe has to buy again at full price.

One limit on the parallel itself. The Dutch story is a mechanism, not a claim about tribal history, which is far older than Rijnland and isn't mine to tell. The nations in our community have governed themselves much longer than there has been a Netherlands. What they didn't have until 26 years ago was a dike wall for the one threat that arrived after the treaties.

If I keep an accurate ledger, I have taken more from this community than I have given. I have asked more questions on the calls than I have answered. Before Dallas, I promised myself to answer more than I asked, and to give the number when I had it: how many months a rollout took versus how many were promised, and what the renewal came to. That is my section of the dike.

For the executives reading this: if your IT director is on the Tribal-ISAC calls or at a regional forum, do you know what they are hearing there, and will you be in the room to act on it? If you are not there yourself, who at your table has heard other tribes describe the crack before it reached you?

Whom the water harms stops the water.