The states of Missouri, Arkansas, and Iowa have filed a legal petition in the U.S. Court of Appeals for the Eighth Circuit challenging the U.S. Environmental Protection Agency's move to impose cybersecurity mandates on critical infrastructure.

The states claim that the measures constitute a federal intrusion on states and will impose significant costs on small and rural public water systems. While the administration argues that voluntary cybersecurity measures have been inadequate, the states believe the new rule intrudes on state sovereignty as primary enforcers under the Safe Drinking Water Act.

The EPA's mechanism for implementing the water rule, which requires states to assess the adequacy of cyber protections during sanitation surveys, has been controversial. Although some state and local officials have praised the EPA's approach, the petition argues that the rule creates new legal obligations without statutory or congressional support.

The American Water Works Association (AWWA) issued a statement agreeing with the states that filed the petition, saying that the EPA’s proposed cybersecurity approach is not only unwise, but legally flawed. “AWWA intends to ask for the court’s permission to participate in this case in order to share our members’ experience and knowledge. AWWA strongly supports efforts to strengthen cybersecurity in the water sector. In fact, AWWA is advocating for a regulatory model similar to that of the energy sector, with oversight from EPA. 

“The Sanitary Survey Program, however, is not the right tool for the job," the statement continues. "Many state primacy agencies lack both the resources and technical expertise to evaluate and address cybersecurity issues. Further, state laws do not protect sensitive information collected through sanitary surveys, and if publicly shared, that information could expose water system vulnerabilities.”