Cyberattacks expose deeper vulnerabilities in U.S. water systems

A series of suspected Iran-linked cyberattacks has unveiled deep-seated weaknesses within the United States' fragmented drinking water infrastructure, which is grappling with aging systems, climate change, and staff shortages. Kevin Morley, federal relations manager for the American Water Works Association (AWWA), emphasizes that utilities now face the dual challenge of cybersecurity threats and long-standing infrastructure issues.

With over 144,000 public water systems across the country, many of which are small and lack the resources to bolster their defenses, the complexity of managing these systems has become increasingly difficult. The Environmental Protection Agency (EPA) has identified vulnerabilities in 277 water systems, highlighting the pressing need for improvement.

However, the biggest hurdles are not unique to the current administration but rather stem from decades of infrastructure evolution and funding challenges accumulated over time. Many utilities, particularly smaller ones, struggle with funding decisions that are ultimately made locally, often dictated by water rates set by municipalities.

This political obstacle makes it challenging to invest in infrastructure upgrades. Andrew Whelton, a professor at Purdue University, notes that while it's incorrect to view the sector simply as "old," many utilities are utilizing replacement projects to redesign systems capable of withstanding various disasters, including cyberattacks and wildfires.

Despite recognizing cybersecurity vulnerabilities for decades, governments have yet to implement sustained efforts to enhance the sector's defenses. The AWWA advocates for nationwide minimum cybersecurity requirements for water utilities, asserting that a cultural shift is necessary to understand the threat and expose potential vulnerabilities.

Utilities are now forced to simultaneously invest in cybersecurity and address the deterioration of aging pipes, pumps, and treatment equipment, all while facing the additional stress of extreme weather events like wildfires. Smaller utilities, often operated by local governments or special districts, face significant challenges in allocating staff and funding to combat cyber threats and climate resilience.

Consequently, utilities are compelled to balance cybersecurity investments with other critical infrastructure developments, such as replacing aging infrastructure and adapting to extreme weather conditions.