I grew up in an era when cyberattacks weren’t really a thing. We knew of the existential threat the Soviets supposedly posed, but cyberattacks were no more a threat than Ivan Drago. We all knew Rocky would win.
Today, it’s a far different story. If water connects us all, the internet is like our family group chat. And there’s always that family member who wants to stir up drama.
Last week I read about cyberattacks hitting water systems in dozens of Minnesota communities. The coordinated attack targeted more than 30 community utilities across Minnesota on July 26 and 27, triggering a statewide emergency response. In the city of Braham, a city of fewer than 2,000 people in the east-central part of the state, the attack successfully disabled computerized operating controls, forcing the local well and water treatment plant offline for nearly two hours.
Public works crews quickly regained manual control and water quality wasn’t affected, but the unprecedented scale of the attack prompted Minnesota IT Services to launch a multiagency investigation alongside the FBI and the Cybersecurity and Infrastructure Security Agency. In other communities, suspected attacks disrupted cellular communications at water towers and lift stations, and interfered with automated controls.
This morning, looking over some industry news and trying to figure out what to talk about in this space, I saw another story about cyberattacks on water utilities across five more states, including Michigan and South Dakota.
When I hear general reference to cyberattacks, my mind typically goes to banks, big corporations, big cities and the like — entities with more money, people and impact than the average small town. And that’s what’s so frightening about it. It’s not the Cold War. It’s hot, and getting hotter. Despite the reality of another ’80s classic, Red Dawn, the upper reaches of the rural Midwest were never really in danger of a Russian invasion. This threat is far more real.
Cybersecurity experts have pointed to Iran as a likely source of these recent attacks due to similarities with past attacks and ongoing tensions between Washington and Tehran. But the really scary thing is an attack on your utility could just as easily come from a guy in his mom’s basement right in your own town. It doesn’t take an army.
Cellular communications, network connectivity, SCADA systems and automated processes have made water and wastewater utilities far more effective and efficient, but they’ve also opened the door to intruders. These latest attacks haven’t resulted in water contamination, but the disruptions have rightly raised alarms about the vulnerability of our critical infrastructure.
The Cybersecurity and Infrastructure Security Agency and other federal agencies continue to urge water system operators to boost their security by disconnecting critical infrastructure from the internet, using strong password protocols, and limiting remote access.
When it comes to our critical infrastructure, the alarm bells should be ringing. Here’s hoping you’re listening.
Enjoy this month’s issue.
Continue reading for free
