America’s Water Systems Are Under Attack. We Are Not Ready.

On March 20, 2024, the East Bay Municipal Utility District Wastewater Treatment Plant in Oakland, California, was the subject of a cyberattack warning from the Biden Administration and the Environmental Protection Agency. Following reports of cyberattacks on water facilities from utility companies in at least seven U.S. states, the Federal Bureau of Investigation (FBI) received warnings of potential threats to the water supply.

In Braham, Minnesota, a city of around 1,800 people, a pump at a water treatment plant experienced issues, but public works crews swiftly isolated the system and restored power within 90 minutes. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a caution in April, stating that Iranian-backed groups are targeting America's critical infrastructure, including water systems.

China and Russia are also actively targeting critical infrastructure in the United States. Though President Donald Trump doubts Iran's involvement, unnamed U.S. officials suspect Iran-backed groups, although they acknowledge the findings are preliminary. The Trump Administration has reduced cybersecurity capabilities, cutting roughly a third of the federal cyber agency's workforce at a time when small utilities need them most.

A comprehensive, resilience-based approach is required to deter and defend against these growing hybrid threats to the American homeland. Learning from European allies, the U.S. could adopt a whole-of-society "total defense" strategy, which involves collaborating with partners and allies. Three specific steps could be taken: renewing the State and Local Cybersecurity Grant Program to fund water systems, setting a response standard for water municipalities to operate manually for 72 hours, and building a workforce of skilled water operators through existing authorities.

By fostering resilience, an adversary may reconsider launching a successful cyberattack on U.S. critical infrastructure.