At 5:12 AM, the Water Stopped. The Fire Didn't.
The standard story blames the earthquake...
At 5:12 am on April 18, 1906, a 7.9 magnitude earthquake struck San Francisco, becoming one of the worst natural disasters in U.S. history. The violent shaking lasted less than a minute. But the true catastrophe was the firestorm that destroyed 80% of the city over the next three days and ultimately left 200,000 people homeless. This wasn’t an act of God. A more honest story blames the water system.
It is a story about what a system does, what it fails to do, and why the gap between those two things is almost always a design problem. The 1906 disaster is one of the clearest examples in American history of what happens when we build a water system for normal times and then get surprised when abnormal times arrive. Or even worse, pretend like we were surprised when we darn well knew better.
This isn’t a story about incompetence, per se. The engineers who built the pre-1906 system weren’t stupid. They built the system the city needed for the conditions they could imagine. The problem was they optimized for normal operations and didn’t design for failure. The domestic water mains were made of rigid cast iron, perfectly fine for delivering drinking water on a Tuesday, but disastrously fragile when the ground moved in ways cast iron joints can’t absorb.
One man saw it coming: San Francisco Fire Chief Dennis Sullivan. For years leading up to the quake, Sullivan relentlessly lobbied city leaders to build a dedicated, earthquake-resistant water system. He warned that the existing pipes would snap during a major seismic event, leaving his firefighters defenseless. His warnings were largely dismissed as too expensive, too pessimistic, and too inefficient for a city booming with progress.
Tragically, Sullivan was mortally wounded when the initial quake hit. A lot of popular historical accounts claim he was killed instantly by a falling chimney, but the truth is far more grueling. He fell through the floor of his quarters at the Bush Street firehouse into the cellar, was badly burned by ruptured steam pipes, and died four days later on April 22 at the Army hospital. He never lived to see his worst nightmare come true. The gas lines ruptured, providing the fuel. The water mains snapped, removing the defense. When the firemen arrived at the blazes, the hydrants were completely dry.
This isn’t just an 1890s problem. That’s a human problem. I see it and I bet you see it every week. The online pump is old and the back up is out of service. An alarm that’s been acknowledged so many times nobody remembers what it originally meant. Letting a critical issue go through the weekend because they don’t want to pay OT.
The Ghosts in the Asphalt
If you walk through certain intersections in San Francisco today, you might notice a strange feature in the asphalt: a large, red brick circle. The first time I saw one, I didn’t think much of it.
If you spend enough time in the City, you collect a catalog of facts like this. The kind of thing locals drop to prove they’re OG San Francisco; that the Sunset was all sand dunes up to 19th Avenue, that down by Lake Merced you’re standing on the site of the last great duel in American history (1859), that Coit Tower was designed to resemble a fire hose nozzle (doubtful, IMO).
But when you learn what those brick circles actually are, you never look at the city the same way.
Beneath each one sits a 75,000-gallon underground concrete cistern, completely full of water, just waiting. Not connected to the drinking water system. Not used for street cleaning. It just sits there — an invisible lake beneath the traffic, waiting for the worst day in the city’s history to happen again.
San Francisco’s emergency water infrastructure defies every modern instinct about efficiency and lean operations. It is massive, expensive, and deliberately over-engineered for a disaster that might only happen once a century. And that is exactly what makes it beautiful. We messed up, and we said never again.
San Francisco’s Answer: Build a System That Assumes the Worst
After the ashes cooled in 1906, the city didn’t just rebuild the domestic water system with slightly thicker pipes, it built something that had never existed anywhere in the country at that scale. They recognized a fundamental truth: sometimes the best way to fix a critically vulnerable system is to build an entirely independent one next to it.
The system Sullivan proposed finally got built between 1909 and 1913. Originally named the Auxiliary Water Supply System (AWSS), you will often see it stamped as HPFS (High Pressure Fire System) on the city’s oversized hydrants. SFPUC brands it the Emergency Firefighting Water System (EFWS) today, but no matter what you call it, it is a dedicated, seismically hardened water system designed specifically for post-earthquake firefighting. It was a masterclass in designing for failure. The engineers of the 1910s built in redundancy at every layer:
Underground cisterns: There are 177 of these underground cisterns distributed across the city today, ranging from 75,000 to 200,000 gallons and providing roughly 11 million gallons of total storage. If the entire piped network fails, firefighters still have massive, localized ponds of water they can draft from directly. They are gravity-fed, have no pressure dependency, and are deliberately low-tech.
High-pressure dedicated mains: A separate pipe network, physically decoupled and independent of the domestic water system. It uses flexible couplings designed to move with the ground rather than snap. It doesn’t care if the drinking water lines are shattered. Furthermore, it’s heavily segmented with specialized gate valves, allowing operators to instantly isolate broken sections of pipe so the rest of the system maintains pressure.
Fredful, CC BY-SA 4.0 <https://creativecommons.org/licenses/by-sa/4.0>, via Wikimedia Commons Fireboats: Access to the Bay provides an essentially unlimited water source that no earthquake can disable. The legendary reserve boat Guardian could pump up to 28,000 gallons per minute directly to shore connections before she was retired in 2022. Today, the frontline “super pumper” is the St. Francis (Fireboat 3)—commissioned around the anniversary of the 1989 Loma Prieta quake—which is rated at 16,000 to 18,000 gallons per minute. If the freshwater runs out, the Pacific Ocean becomes the reservoir.
Photograph by Mike Peel (www.mikepeel.net) Salt water pumping stations: These can inject Bay water into the AWSS mains during an emergency.
By Sanfranman59 - Own work, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=4171429
The engineers who designed this system made a choice that I find quietly radical: they assumed the primary system would fail. They didn’t design for “what if things go wrong.” They designed for “when things go wrong, here’s your fallback.”
That is a fundamentally different engineering posture. It requires accepting that your main system is not enough. That’s uncomfortable. It costs money. It’s hard to justify to a budget committee when the main system is working fine.
Yet, this system is still operational 120 years later. SFPUC maintains it, tests it, and has continued to upgrade it. It’s one of the most unusual pieces of water infrastructure in the country, most cities don’t have anything like it and it exists because San Francisco paid a catastrophic tuition for the lesson. That tuition bought San Francisco a working system. It also, if we’re paying attention, bought the rest of us a lesson.
This Isn’t Really a History Lesson
The 1906 earthquake isn’t just a fascinating story about San Francisco. It’s a diagnostic tool for the pathologies of modern utility management. Three distinct patterns from 1906 still show up constantly in our industry:
1. Optimization for normal operations creates brittleness
The pre-1906 system was well-designed for typical daily demand. It just had no slack, no redundancy, and no ability to absorb a shock. We still build water infrastructure this way. We spec systems for average conditions and test against permit thresholds, but rarely design against failure scenarios or future growth. I touched on this recently when writing about securing our digital watersheds: we rely on a compliance-first mindset that checks boxes for normal operations while leaving the system completely exposed to anything unusual.
2. The right diagnosis doesn’t automatically become the right action
Fire Chief Sullivan had the exact right answer years before the earthquake. He just couldn’t get the money. The gap between “we know what needs to happen” and “we actually do it” is where most infrastructure disasters live. It isn’t a lack of knowledge. It is politics, budgets, competing priorities, and short-term thinking. We see the same dynamic playing out right now with changing surface water, ground water depletion, and PFAS. We have the treatment and distribution options for emerging challenges; we just don’t always deploy them before they become crises.
3. Catastrophe creates permission for what prudence couldn’t
The AWSS was a radical, expensive project, and it got built after 1906 because the political will finally matched the technical need. This is a depressing but undeniable pattern. We almost always need the disaster to justify the investment.
The Cisterns of the 21st Century
San Francisco built something genuinely impressive and maintained it across twelve decades, multiple administrations, budget cycles, and competing priorities. The cisterns are tested annually. The fireboats are operational. The system works.
That’s not common. Most emergency infrastructure degrades over time. It gets deferred, deprioritized, and cannibalized to cover the gaps in the operating budget. San Francisco didn’t let that happen.
But this system is a brilliant solution to the 1906 failure mode. Infrastructure threats in 2026 look fundamentally different. Seismic risk is still incredibly real, but now it’s layered with cybersecurity vulnerabilities, climate-driven demand fluctuations, aging distribution systems, and workforce succession challenges.
A system designed for one catastrophe scenario isn’t necessarily resilient against all catastrophe scenarios. Consider the Hayward Fault. It is geologically overdue and potentially more damaging to the Bay Area than the 1906 quake. A massive slip there would test these historic fail-safes in ways their designers never anticipated, particularly if it’s coupled with modern grid failures or digital disruptions.
The next catastrophic “fire” might look like the 2021 remote intrusion at the Oldsmar, Florida water plant, or the 2023 ransomware attack that shut down the municipal water authority in Aliquippa, Pennsylvania. Or it might be a mega-drought that turns our historical source waters into toxic, untreatable sludge.
Are we building our modern systems with the same radical foresight as the engineers of 1910?
If we’re being honest, and Pattern #3 is forcing the question, the answer is probably no. We likely won’t build the digital and physical cisterns of the 21st century. Not yet. Probably not until something burns. We know exactly what they look like: smart grids with AI-controlled automatic isolation valves, decentralized micro-treatment systems, and rigorously air-gapped data architectures. We have the technology. We just don’t have the catastrophe required to unlock the funding.
This raises a deeply uncomfortable question for those of us working inside these systems: If disaster is the only mechanism that reliably creates permission for radical investment, what exactly is our job right now?
Chief Sullivan didn’t get to build his system. He died in the ashes of the earthquake he predicted. But he had spent years designing the solution, arguing for it, and putting the blueprints on the desk. When the city finally woke up, they didn’t have to start from scratch. They knew what to build because Sullivan had already done the intellectual labor.
Maybe that is our job. If we can’t build the ultimate fail-safes today, our responsibility is to draw the blueprints. It is to know exactly what we will ask for on the day after the disaster, when the budget committees are finally terrified enough to approve it. And in the meantime, our job is to find quiet, subversive ways to build slack into the margins of our “normal operations.”
The earthquake will come, whether tectonic, digital, or climatic. The funding will follow. The question is whether we’ll be ready for the permission when it finally arrives.
If you know the funding won’t come until after the disaster, what are you doing with your operating budget today to make sure there’s a system left to rebuild?