content: Generally, States and Cities have more power than the next level up. Federal can mandate that all workers get paid 7.50, state can mandate 8.20, city can mandate 10.50, as a basic example. If the city has the highest amount of power at the closest level to civilians over utilities, hopefully it's classified as one, then they should have the power to enforce certain security measures that would hopefully not allow for the existence of a backdoor.  That said, if the federal government said that all public utilities required some safeguard in the case of a cyberattack that included a backdoor, their hands would be tied. At the very least you should expect these utilities to have a level of identifying where traffic is coming from, but not necessarily who is responsible for it.