It sounds like the stuff of a summer thriller.
Using cyber tools, one of our adversaries- maybe Iran, maybe North Korea, or possibly a criminal enterprise- takes over the operations of a drinking water utility. The amount of purifying chemicals applied by automation is significantly increased or completely stopped. Before the change is caught, a dozen people in the area get sick. It is barely a news story outside of the community. Negligence, not sabotage, is assumed.
Two days later, in another part of the U.S., the same happens at three drinking water utilities. This time, several children are hospitalized. A coincidence, perhaps, but the Environmental Protection Agency (EPA) and the FBI send investigators to the affected communities to quietly ask questions. Again, it is a local story with no one connecting the dots.
But when it happens again two days later at five additional drinking water utilities, including in a midsize city, it becomes national news. A panic ensues. There is a run on bottled water in supermarkets, gas stations, and corner stores. There are reports of vending machines pried open for the water bottles.
Bottled water supplies run out nationally. The president addresses the nation, assuring everyone that there is no reason to worry, that nearly all water is safe to drink. Few people accept these explanations. Riots break out.
If the script sounds farfetched, consider that of America’s 16 categories of critical infrastructure—nuclear power plants, airports, hospitals, and so forth—all have vulnerabilities to cyberattack, but none are as widely exposed as drinking water facilities. Rogue states or cybercriminals will find a major investment bank or the power grid hardened against intrusion. Less so with our water system. Toward the end of last week, a few dozen small community drinking water systems in Minnesota and Michigan were taken over in what looked like a cyberattack believed to be the work of the Iranian government. Before anyone could get sick, the purification systems were switched from automated settings to manual ones. And within a day or so, all of the intruded systems were rebooted and back to operating as before.
It is unclear if we got lucky or if this was merely a warning shot by Iran. The Iranians may have been telegraphing, “You think you can hit our critical infrastructure with bombs? Well, we can hit yours from a keyboard on the other side of the world.” And because the deaths of Americans would have demanded a truly ferocious response, the Iranians may have been content, for now, to make clear their capabilities. But keep hitting us, the Iranians may be saying, and you don’t have enough bottled water to handle what will follow. Just in time for the midterms, everyone, everywhere will be begging for the war to end.
How is it that drinking water utilities, which provide a commodity essential for life, are so at risk?
A simple answer may lie in the vastness of the water-supply system, but the problem has been made far worse by a long-standing reluctance on the part of the EPA and a bipartisan Congressional consensus to ignore a problem that has not—perhaps until now—cried out for a solution.
“Keep hitting us,” the Iranians may be saying, “and you don’t have enough bottled water to handle what will follow.”
When my book on America’s drinking water quality was published in 2019, I played a game with audiences on the speaking tour that followed. I’d ask them to guess the correct number of U.S. drinking water utilities. “America has 50 states,” I would say. “Some are large, some very small.” To create misdirection, I’d add, “Some utilities could logically cover more than one state. Some states might need more than one.” Shouts from the audience would start at 30 or 35. I’d indicate a higher number with thumb gestures. And the numbers would keep going until around 300, when people in the audience would say, “No, it can’t be that high.”
In all, as my startled audiences learned, there are 148,000 public water systems in the U.S. Of those, more than 50,000 are what we think of as drinking water utilities. Any kind of unified response from this number of entities is impossible. And as the threat from bad actors grows, this weakness may become ever more glaring.
Some of these utilities have no full-time employees, and many don’t have a single person trained to protect against cyberattacks. Most can’t arrange financing for necessary equipment, software, and cyber-protection upgrades—and if they could, they wouldn’t be able to find the staff to handle those needs. You can provide oversight for a reasonable number of entities, but at some point, the government can’t do much more than send out notices and hope for the best.
Common sense suggests it would be very hard to protect that many separate systems from cyber intrusion. And that would be true.
Over the past few decades, these utilities have updated their manual systems, run by experienced water engineers, to automated ones, run largely by off-the-shelf, in-house networked computers. Most of these automated systems can be hacked by someone who can break through simple password protection. The automation can be overrun in one location or many, one at a time or in a group, and it is assumed that many have already been intruded upon, waiting for the right moment to attack.
Perhaps a legacy of the Iran war will be the understanding that America urgently needs to consolidate its drinking water utilities. But if history is a guide, after things quiet down, nothing will change. Mayors and governors of both parties don’t like spending money on problems that don’t make the news. Water pipes and control systems are out of sight, and short of an emergency, as the Iranians attackers understand, out of mind.
