The Environmental Protection Agency has warned that cyberattacks against water utilities across the country are increasing in frequency and severity. About 70% of utilities inspected by federal officials violated standards meant to prevent breaches or other intrusions in the past year. The EPA is urging water systems to take immediate action to protect the nation’s drinking water, even small systems are being encouraged to improve their protections against hacks. Failure to change default passwords, cut off system access to former employees, and implement risk assessments are some of the basic ways in which water systems are falling short in security.
Recent cyberattacks by groups affiliated with Russia, Iran, and other geopolitical rivals are targeting water utilities’ operations, not just their websites. The potential impacts of cyberattacks on water utilities include interruptions to treatment and storage processes, damage to equipment, and alterations to chemical levels. The EPA Deputy Administrator Janet McCabe highlighted the importance of water utilities completing risk assessments that address cybersecurity issues. Part of the concern is that nations like China, Russia, and Iran are seeking the capability to disable critical U.S. infrastructure, including water and wastewater systems.
Several recent cyberattacks on water utilities have been linked to countries like Iran and Russia. For instance, a group called “Cyber Av3ngers” targeted a Pennsylvania town’s water provider, forcing it to switch to manual operations. Meanwhile, a Russian-linked “hacktivist” attempted to disrupt operations at several Texas utilities. Additionally, a China-aligned group known as Volt Typhoon has compromised critical infrastructure systems, including drinking water facilities in the U.S. and its territories. Cybersecurity experts believe these attacks could be a sign of preparation for potential cyberattacks during times of armed conflict or geopolitical tensions.
As the world’s cyberpowers have been infiltrating rivals’ critical infrastructure for years, the EPA is emphasizing the seriousness of cyberthreats to water providers through its enforcement alert. The EPA will continue inspections and may pursue penalties if serious issues are found. The Biden administration has also been working to combat threats against critical infrastructure, with President Biden signing an executive order to protect U.S. ports and pushing for increased defenses at electric utilities. The White House is pushing states to come up with plans to combat cyberattacks on drinking water systems.
The fragmented nature of the water sector, which includes approximately 50,000 community water providers, poses challenges to implementing cybersecurity measures effectively. With most providers serving small towns, staffing and budgets are often limited, making it difficult to maintain clean water and keep up with the latest regulations, let alone focus on cybersecurity. The Association of State Drinking Water Administrators offers training and support for water utilities to improve their cybersecurity measures. Larger utilities typically have more resources and expertise to defend against attacks, but smaller utilities may struggle to develop new departments to handle cybersecurity.
There are foundational barriers in the water sector, such as the lack of authority under the Safe Drinking Water Act to mandate cybersecurity evaluations for water providers. While some utilities have components connected to the internet, which poses vulnerabilities, overhauling these systems can be costly and challenging. Without substantial federal funding, water systems struggle to allocate resources to improve cybersecurity measures. The American Water Works Association advocates for establishing a new organization of cybersecurity and water experts to develop and enforce policies in collaboration with the EPA, with the goal of bringing utilities along in a reasonable manner and addressing the differing needs and resources of small and large utilities.
