Water utilities are warning of a recent increase in cyber attacks against their facilities that appear to be coming from foreign hackers.
Experts are now warning that cyber attacks are putting the water supply at risk as their frequency increases.
The tiny Aliquippa water authority in western Pennsylvania was perhaps the least-suspecting victim of an international cyber attack.
It had never had outside help in protecting its systems from a cyber attack, either at its existing plant that dates to the 1930s or the new $18.5 million one it is building.
Then it — along with several other water utilities — was struck by hackers targeting a piece of equipment.
Federal authorities say the hackers are Iranian-backed and targetted specific equipment because it is Israeli-made.
“If you told me to list 10 things that would go wrong with our water authority, this would not be on the list,” said Matthew Mottes, the chairman of the authority that handles water and wastewater for about 22,000 people in the woodsy exurbs around a one-time steel town outside Pittsburgh.
The hacking of the Municipal Water Authority of Aliquippa is prompting new warnings from U.S. security officials at a time when states and the federal government are wrestling with how to harden water utilities against cyber attacks.
The danger, officials say, is hackers gaining control of automated equipment to shut down pumps that supply drinking water or contaminate drinking water by reprogramming automated chemical treatments.
Besides Iran, other potentially hostile geopolitical rivals, including Communist China, are viewed by U.S. officials as a threat.
A number of states have sought to step up scrutiny to protect the water supply.
However, water authority advocates say the money and the expertise are what is really lacking for a sector of more than 50,000 water utilities.
Most water utilities are local authorities that, like Aliquippa’s, serve corners of the country where residents are of modest means and cybersecurity professionals are scarce.
Besides, utilities say, it’s difficult to invest in cybersecurity when the upkeep of pipes and other water infrastructure is already underfunded.
Some cybersecurity measures have been pushed by private water companies, sparking pushback from public authorities that it is being used as a back door to privatization.
Efforts took on new urgency in 2021 when the federal government’s leading cybersecurity agency reported five attacks on water authorities over two years.
Four of those attacks were ransomware and a fifth was done by a former employee.
At the Aliquippa authority, Iranian hackers shut down a remotely controlled device that monitors and regulates water pressure at a pumping station.
Customers weren’t affected because crews alerted by an alarm quickly switched to manual operation.
Not every water authority has a built-in manual backup system, however.
With inaction in Congress, a handful of states passed legislation to step up scrutiny of cybersecurity, including New Jersey and Tennessee.
Before 2021, Indiana and Missouri had passed similar laws.
A 2021 California law commissioned state security agencies to develop outreach and funding plans to improve cybersecurity in the agriculture and water sectors.
Legislation died in several states, including Pennsylvania and Maryland, where public water authorities fought bills backed by private water companies.
READ MORE – WEF: Pushing ‘Coming Water Crisis’ Will Advance Globalist Agenda
