Image credits - MIT Technology Review
The Municipal Water Authority of Aliquippa, a seemingly unsuspecting victim in the realm of international cyber warfare, recently faced a cyberattack orchestrated by Iranian-backed hackers. The attack, which targeted Israeli-made equipment, emphasizes the growing challenges water utilities encounter in defending against sophisticated cyber threats.
The Aliquippa Water Authority, serving around 22,000 residents in western Pennsylvania, had never enlisted external help to fortify its systems against cyberattacks. The incident underscores the broader risks faced by water utilities across the United States, with hackers potentially gaining control over automated equipment critical to water supply and treatment processes.
The danger, as highlighted by U.S. security officials, includes the possibility of hackers manipulating automated equipment to disrupt pumping systems or, more critically, contaminating drinking water by reprogramming chemical treatments. While Iranian-backed hackers were identified in this instance, concerns extend to other geopolitical rivals, including China, posing a multifaceted threat landscape.
Several states and the federal government are grappling with how to fortify water utilities against cyber threats. The urgency increased in 2021 when the federal government’s cybersecurity agency reported five attacks on water authorities over two years. While some states, including New Jersey and Tennessee, have taken legislative steps to bolster cybersecurity, challenges persist.
The water utility sector, comprising over 50,000 local authorities like Aliquippa’s, faces hurdles in terms of funding and expertise for robust cybersecurity measures. Striking a balance between addressing cybersecurity concerns and maintaining necessary infrastructure upkeep poses a significant challenge, with ageing pipes and compliance costs already straining resources.
In the realm of legislation, attempts to address cybersecurity disparities have seen mixed results. Efforts to enact comprehensive cybersecurity measures in Congress have faced hurdles, leaving some states to pass individual laws. The contentious nature of proposed legislation, particularly in states like Pennsylvania and Maryland, has sparked debates between public and private water authorities.
The private sector argues for stricter regulatory standards to enhance public confidence in tap water safety, while critics view such measures as potential precursors to privatization, burdening public authorities with additional costs. Striking the right balance becomes essential to ensure both cybersecurity preparedness and public trust.
Despite the pressing need for cybersecurity upgrades, funding gaps and limited resources remain significant barriers. Pennsylvania state Rep. Rob Matzie is actively working on legislation to create a funding stream for water and electric utilities to enhance their cybersecurity measures.
As the federal government seeks to address cybersecurity at a broader level, recent legal challenges, such as the suspension of a proposed EPA rule to audit water system cybersecurity, underscore the complexities in navigating regulatory frameworks.
In the absence of comprehensive federal action, the water utility sector is left to compete for grants from a $1 billion federal cybersecurity program, creating a scenario where utilities must vie for resources against a spectrum of entities, including hospitals, police departments, and local governments.
The urgency of cybersecurity in the water sector has prompted organizations like Dragos Inc. to offer support. The company provides free access to its online support and software for detecting vulnerabilities and threats, recognizing the widespread need for assistance among utilities.
The story of the Aliquippa Water Authority serves as a stark reminder of the broader challenges faced by utilities across the country. As the nation grapples with the evolving landscape of cybersecurity threats, the need for collaborative efforts, legislative solutions, and dedicated funding to fortify critical infrastructure becomes increasingly apparent.