Hackers are targeting US water systems. Here’s what that means.

By

Kelsey Vlamis

You're currently following this author! Want to unfollow? Unsubscribe via the link in your email.

Government officials are warning about a wave of cyberattacks on water utilities in the US.

At least seven states have reported incidents to the FBI since July 27. The agency hasn't identified the attackers' motivation or identity, calling them only "malicious cyber actors" and saying they were remotely accessing internet-facing computers used by water utilities. The hackers changed settings, IP addresses, and passwords, the FBI said. In some cases, the attacks weakened the plant operators' ability to monitor and control their equipment.

Cybersecurity experts have voiced concerns for years about cyber vulnerabilities in water systems and other critical infrastructure, such as energy and healthcare, including the possibility of attacks by foreign adversaries. In April, the FBI and other federal agencies warned about ongoing Iran-affiliated cyber threats, including those targeting water systems.

What a hacker can actually do when they access a water system varies widely depending on the device they hack. There's also a huge variety in how the roughly 148,000 public drinking water systems in the US operate, including the about 50,000 systems that supply drinking water to residents year-round.

"It really depends on the device and what that device is managing or controlling," Kevin Morley, federal relations manager for the American Water Works Association, told Business Insider.

"It could be a pump, it could be a motor, and it could be something as simple as a tank-level log that just says the tank is full or not full."

Some of the recent attacks have resulted in real-world impacts, such as loss of water pressure and flooding, according to the FBI, though the agency did not say where those incidents occurred.

City officials in Braham, Minnesota, said a cyberattack shut down the controls for its well and water treatment plant, temporarily causing the city to rely on its water tower stores. State officials said more than 30 community water systems in Minnesota were targeted last week, while officials in Michigan said nine water systems were targeted.

The hackers accessed devices with internet access

Joshua Corman, executive-in-residence for public safety and resilience at the Institute for Security and Technology, said that connecting the computers that control water equipment to the internet creates an additional avenue for attackers.

"With great connectivity comes great responsibility," Corman said, riffing on a famous line popularized by the Spider-Man comics.

In a notice issued to water utilities last week, the FBI and the EPA said the recent attacks targeted devices connected to the internet. The agencies advised water utilities to disconnect certain computers — called Programmable Logic Controllers, or PLCs — from the public-facing internet and to strictly control their network access, among other measures.

Corman said PLCs can be programmed with "if this happens, then that happens" functions. A utility might set one to keep water pressure within a certain range, to alert workers if it gets too high or too low, or to shut off a pump before equipment is damaged. Corman said a hacker could, for instance, disable an alert that would notify an employee that part of the system needs attention.

Disruptions to water service can have far-reaching effects, including on businesses, hospitals, and fire response. "No water is no hospital in two to four hours," said Corman, who runs an initiative called UnDisruptable27 focused in part on improving the resilience of water systems that support hospitals.

Improving cybersecurity at water utilities

Many cybersecurity experts agree that more could be done to shore up the cybersecurity of critical utilities.

Morley said that setting universal cybersecurity standards for water utilities in the US can be challenging because they vary widely in the populations they serve, the systems they use, and the extent of their existing cybersecurity measures. He said what's right for one utility might not be right for another.

The American Water Works Association has advocated for developing nationwide minimum cybersecurity requirements for water utilities, shaped by water and cybersecurity professionals.

Improving protections for water systems is also a matter of national security, said Corman, who advised on cybersecurity efforts for Operation Warp Speed during the pandemic.

He added that water utilities should strengthen their resilience before a more serious attack forces them to do so.

"You want to dig a well before you're thirsty."

Read next

Kelsey Vlamis

You're currently following this author! Want to unfollow? Unsubscribe via the link in your email.

Kelsey is a senior reporter for Business Insider, where she covers business and tech news as well as stories about travel, luxury, and consulting.Her feature story "Disaster at 18,200 feet" received awards from the New York Press Club and the North American Travel Journalists Association, as well as honorable mention from the Society of American Travel Writers. It was also included on Longreads' and Pocket's best of 2022 lists. She has also received an American Journalism Online Award for her coverage on missing and murdered Indigenous people in Wyoming.She's appeared on CBS, NPR, NBC, and other outlets to discuss her work. She previously worked on the world news desk at the BBC in London and received a master's in journalism from Northwestern University.She can be reached by email at [email protected] or via the encrypted-messaging app Signal @kelseyv.21.Popular storiesDisaster on Denali: Inside a 1,000-foot fall on America's highest peakThrifting is more popular than ever. It's also never been worse.Rolex wouldn't service the vintage watch my mom inherited. Watchmakers say it happens all the time.A tiny, invasive bug and the climate crisis are changing how guitars are made, and shifting the course of music historyThe tourism free-for-all is overGovernment-run boarding schools were founded to 'civilize' Native Americans. Hundreds of dead children remain buried in the schoolyard graves.Meet the Texas minister who helps fly dozens of women to New Mexico every month to get abortionsPeople are flocking to Colorado for the great outdoors, but the air pollution is so bad, it's forcing many to stay insideInside Kabul: An aid worker reveals the devastating chaos that erupted during the US exit from Afghanistan

• Cybersecurity