Tap Water, a New Front in Cyber Warfare

The recent spate of cyberattacks on America’s tap water systems has left many wondering if their drinking water is more vulnerable than their credit card information. Unfortunately, the answer is yes. In Minnesota’s rural town of Braham, hackers broke into the computer system controlling the local water supply, forcing dozens of other cities in the state to scramble and deal with the aftermath.

This was just one part of a larger Iranian cyberattack that has affected at least a dozen states. The fact that water systems are being targeted by state-sponsored actors is alarming. What’s even more disturbing, however, is the level of vulnerability exposed by these attacks. Many local water agencies lack the resources and expertise to properly secure their computer systems, making them easy prey for hackers.

Historically, water treatment plants have been slow to adapt to modern technology, leaving them vulnerable to cyber threats. The shift towards connecting these plants to the internet was supposed to make operations more efficient, but it has also exposed a critical weakness in our infrastructure. Joshua Corman, founder of I Am The Cavalry, a nonprofit focused on securing critical infrastructure, likens water treatment plants to “an expensive heirloom bicycle left on a busy street.” We’ve got a beautiful system that’s been around for centuries, and we’re connecting it to the internet without thinking about how vulnerable it makes us.

Water treatment plants were once manual operations, relying on human technicians to monitor and control the systems. But as technology has improved, these controls have become increasingly digital, allowing hackers to remotely access and manipulate the systems. The risks are far-reaching: a malicious actor could poison tap water by dialing up levels of sodium hydroxide or even open the floodgates by manipulating valves controlling water flow.

In a worst-case scenario, hackers could cut off access to all water entirely, forcing hospitals to suspend dialysis treatment and potentially leading to the collapse of critical infrastructure. While there’s no need to panic just yet – the attacks were largely contained and no one was harmed – it’s clear that our water systems are woefully unprepared for a cyber threat.

Some municipalities have only recently begun to take steps to secure their computer systems, but many lack basic cybersecurity measures. Basic hygiene isn’t enough when dealing with hackers who can breach even the most secure systems. It’s time for regulators and policymakers to step up and address this issue before it’s too late. The consequences of inaction will be dire.

The attacks last week demonstrate that our water supply is a new front in cyber warfare – one that requires urgent attention and investment from government and industry leaders.