Attacks on America’s ‘super vulnerable’ water systems should be a wake up call after years of warnings, cybersecurity experts say
Hackers have broken into water systems in at least a dozen states in recent weeks, what cybersecurity experts say should be an urgent wake up call to immense vulnerabilities in American infrastructure.
“Malicious cyber actors” have infiltrated internet-connected water systems that routinely monitor and adjust safe drinking water across the country, according to federal law enforcement agencies.
Officials have not reported any widespread disruptions to America’s drinking water supplies, but analysts who have sounded alarms to governments and utilities for years about national security threats to critical infrastructure say the attacks should spark a nationwide reckoning.
“I’ve spent my 15-year career really trying to avoid being the person that runs around and tries to scare the s*** out of everybody,” Craig Jackson, deputy director of the Center for Long-Term Cybersecurity at the University of California, Berkeley, told The Independent. “That said, I think it’s really, really, really bad, dude.”
President Donald Trump’s own intelligence agencies have suspected Iranian-linked actors were responsible for the latest wave of attacks, but the president has dismissed breaches in Minnesota as the fault of the state’s own government. If the regime is unable to target the U.S. with its own rockets and drones, experts fear the attacks could open a new, asymmetrical front in the administration’s war with Iran.
“I blame it on Minnesota because they’re grossly incompetent,” the president told reporters at Camp David on July 31 without providing any evidence.
“I would blame it on Minnesota and the governor, the corrupt governor of Minnesota,” he added. “Iran’s got bigger problems than worrying about Minnesota.”
In a statement on social media, the state’s Governor Tim Walz said that “Trump knows exactly who is responsible for this attack, and knows that other states were hit too.”
“This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran,” Walz said.
“The reason that we’re not seeing successful attacks at scale against other critical infrastructure in the way that we’re seeing it right now with water — it’s not because all these other sectors are super secure and water is especially vulnerable,” Jackson told The Independent. “It’s because some of our adversaries have decided to screw with our water, because it’s scary.”
The U.S. is made up of roughly 16,000 wastewater treatment plants and 152,000 public drinking water systems.
That process is controlled by programmable logic controllers, which measure water pressure and chemicals and operate pumps, among other tasks. Hackers appear to have remotely accessed programmable logic controllers that are connected to the internet.
The FBI and Cybersecurity & Infrastructure Agency have urged utilities to disable internet access, set up strong passwords and revert to manual control, among other changes.
The Operational Technology Cybersecurity Coalition said the attacks deserve more than a handful of alerts from federal agencies. “We must view this through a clear lens: an adversary has directly impacted a core American necessity,” the organization’s executive director Tatyana Bolton wrote in an urgent appeal to members of Congress.
