UNITED STATES NEWS

States and Congress wrestle with cybersecurity at water utilities amid renewed federal warnings

Jan 1, 2024, 10:03 PM

FILE - This photo provided by the Municipal Water Authority of Aliquippa shows the screen of a Unit...

FILE - This photo provided by the Municipal Water Authority of Aliquippa shows the screen of a Unitronics device that was hacked in Aliquippa, Pa., Saturday, Nov. 25, 2023. The hacked device was in a pumping booster station owned by the Municipal Water Authority of Aliquippa. An electronic calling card left by the hackers suggests they picked their target because it uses components made by an Israeli company. (Municipal Water Authority of Aliquippa via AP)
Credit: ASSOCIATED PRESS

(Municipal Water Authority of Aliquippa via AP)

HARRISBURG, Pa. (AP) — The tiny Aliquippa water authority in western Pennsylvania was perhaps the least-suspecting victim of an international cyberattack.

It had never had outside help in protecting its systems from a cyberattack, either at its existing plant that dates to the 1930s or the new $18.5 million one it is building.

Then it — along with several other water utilities — was struck by what federal authorities say are Iranian-backed hackers targeting a piece of equipment specifically because it was Israeli-made.

“If you told me to list 10 things that would go wrong with our water authority, this would not be on the list,” said Matthew Mottes, the chairman of the authority that handles water and wastewater for about 22,000 people in the woodsy exurbs around a one-time steel town outside Pittsburgh.

The hacking of the Municipal Water Authority of Aliquippa is prompting new warnings from U.S. security officials at a time when states and the federal government are wrestling with how to harden water utilities against cyberattacks.

The danger, officials say, is hackers gaining control of automated equipment to shut down pumps that supply drinking water or contaminate drinking water by reprogramming automated chemical treatments. Besides Iran, other potentially hostile geopolitical rivals, including China, are viewed by U.S. officials as a threat.

A number of states have sought to step up scrutiny, although water authority advocates say the money and the expertise are what is really lacking for a sector of more than 50,000 water utilities, most of which are local authorities that, like Aliquippa’s, serve corners of the country where residents are of modest means and cybersecurity professionals are scarce.

Besides, utilities say, it’s difficult to invest in cybersecurity when upkeep of pipes and other water infrastructure is already underfunded, and some cybersecurity measures have been pushed by private water companies, sparking pushback from public authorities that it is being used as a back door to privatization.

Efforts took on new urgency in 2021 when the federal government’s leading cybersecurity agency reported five attacks on water authorities over two years, four of them ransomware and a fifth by a former employee.

At the Aliquippa authority, Iranian hackers shut down a remotely controlled device that monitors and regulates water pressure at a pumping station. Customers weren’t affected because crews alerted by an alarm quickly switched to manual operation — but not every water authority has a built-in manual backup system.

With inaction in Congress, a handful of states passed legislation to step up scrutiny of cybersecurity, including New Jersey and Tennessee. Before 2021, Indiana and Missouri had passed similar laws. A 2021 California law commissioned state security agencies to develop outreach and funding plans to improve cybersecurity in the agriculture and water sectors.

Legislation died in several states, including Pennsylvania and Maryland, where public water authorities fought bills backed by private water companies.

Private water companies say the bills would force their public counterparts to abide by the stricter regulatory standards that private companies face from utility commissions and, as a result, boost public confidence in the safety of tap water.

“It’s protecting the nation’s tap water,” said Jennifer Kocher, a spokesperson for the National Association of Water Companies. “It is the most economical choice for most families, but it also has a lack of confidence from a lot of people who think they can drink it and every time there’s one of these issues it undercuts the confidence in water and it undercuts people’s willingness and trust in drinking it.”

Opponents said the legislation is designed to foist burdensome costs onto public authorities and encourage their boards and ratepayers to sell out to private companies that can persuade state utility commissions to raise rates to cover the costs.

“This is a privatization bill,” Justin Fiore of the Maryland Municipal League told Maryland lawmakers during a hearing last spring. “They’re seeking to take public water companies, privatize them by expanding the burden, cutting out public funding.”

For many authorities, the demands of cybersecurity tend to fade into the background of more pressing needs for residents wary of rate increases: aging pipes and increasing costs to comply with clean water regulations.

One critic, Pennsylvania state Sen. Katie Muth, a Democrat from suburban Philadelphia’s Montgomery County, criticized a GOP-penned bill for lacking funding.

“People are drinking water that is below standards, but selling out to corporations who are going to raise rates on families across our state who cannot afford it is not a solution,” Muth told colleagues during floor debate on a 2022 bill.

Pennsylvania state Rep. Rob Matzie, a Democrat whose district includes the Aliquippa water authority, is working on legislation to create a funding stream to help water and electric utilities pay for cybersecurity upgrades after he looked for an existing funding source and found none.

“The Aliquippa water and sewer authority? They don’t have the money,” Matzie said in an interview.

In March, the U.S. Environmental Protection Agency proposed a new rule to require states to audit the cybersecurity of water systems.

It was short-lived.

Three states — Arkansas, Missouri and Iowa — sued, accusing the agency of overstepping its authority and a federal appeals court promptly suspended the rule. The EPA withdrew the rule in October, although a deputy national security adviser, Anne Neuberger, told The Associated Press that it could have “identified vulnerabilities that were targeted in recent weeks.”

Two groups that represent public water authorities, the American Water Works Association and the National Rural Water Association, opposed the EPA rule and now are backing bills in Congress to address the issue in different ways.

One bill would roll out a tiered approach to regulation: more requirements for bigger or more complex water utilities. The other is an amendment to Farm Bill legislation to send federal employees called “circuit riders” into the field to help smaller and rural water systems detect cybersecurity weaknesses and address them.

If Congress does nothing, 6-year-old Safe Drinking Water Act standards will still be in place — a largely voluntary regime that both the EPA and cybersecurity analysts say has yielded minimal progress.

Meanwhile, states are in the midst of applying for grants from a $1 billion federal cybersecurity program, money from the 2021 federal infrastructure law.

But water utilities will have to compete for the money with other utilities, hospitals, police departments, courts, schools, local governments and others.

Robert M. Lee, CEO of Dragos Inc., which specializes in cybersecurity for industrial-control systems, said the Aliquippa water authority’s story — that it had no cybersecurity help — is common.

“That story is tens of thousands of utilities across the country,” Lee said.

Because of that, Dragos has begun offering free access to its online support and software that helps detect vulnerabilities and threats for water and electric utilities that draw under $100 million in revenue.

After Russia attacked Ukraine in 2022, Dragos tested the idea by rolling out software, hardware and installation at a cost of a couple million bucks for 30 utilities.

“It was amazing, the feedback,” Lee said. “You wonder, ‘Hey I think I can move the needle in this way’ … and those 30 were like, ‘Holy crap, no one’s ever paid attention to us. No one’s ever tried to get us help.'”

___

Follow Marc Levy at www.twitter.com/timelywriter.

United States News

FILE - Former U.S. President Donald Trump, with lawyers Christopher Kise and Alina Habba, attends t...

Associated Press

Donald Trump appeals $454 million judgment in New York civil fraud case

NEW YORK (AP) — Donald Trump has appealed his $454 million New York civil fraud judgment, challenging a Trump lied about his wealth as he grew the real estate empire that launched him to stardom and the presidency. The former president’s lawyers filed a notice of appeal Monday asking the state’s mid-level appeals court to […]

15 minutes ago

FILE - Members of The Eagles, from left, Timothy B. Schmit, Don Henley, Glenn Frey and Joe Walsh po...

Associated Press

Eagles’ Don Henley set to take the stand at ‘Hotel California’ lyrics trial

NEW YORK (AP) — The trial surrounding handwritten draft lyrics to “Hotel California” and other Eagles hits is set to feature a star witness: Don Henley. The Eagles co-founder on Monday was expected to tell his version of how handwritten pages from the development of the band’s blockbuster 1976 album made their way from his […]

19 minutes ago

Associated Press

New York City honors victims of 1993 World Trade Center bombing

NEW YORK (AP) — New York City is marking the anniversary of the 1993 bombing at the old World Trade Center that blew apart a van parked in an underground garage, killing six people and injured more than 1,000. The Port Authority of New York and New Jersey is holding a memorial Mass on Monday […]

34 minutes ago

Associated Press

2 officers shot and killed a man who discharged a shotgun, police say

BUFFALO, N.Y. (AP) — Two officers in New York shot and killed a man over the weekend, prompting authorities to launch an investigation and his family to demand answers. Edward Holmes, 58, was fatally shot Saturday morning in Buffalo after police say he discharged his shotgun and officers returned fire. Buffalo Police Commissioner Joseph Gramaglia […]

2 hours ago

Associated Press

Air Force member has died after setting himself on fire outside the Israeli embassy in DC

WASHINGTON (AP) — An active-duty member of the U.S. Air Force has died after he set himself ablaze outside the Israeli Embassy in Washington, D.C., while declaring that he “will no longer be complicit in genocide.” The 25-year-old airman, Aaron Bushnell, of San Antonio, Texas, died from his injuries, the Metropolitan Police Department said Monday. […]

2 hours ago

Associated Press

A fellow student is charged with killing a Christian college wrestler in Kentucky

CAMPBELLSVILLE, Ky. (AP) — A college wrestler in Kentucky was killed by a fellow student at a private Christian university over the weekend, authorities said. Josiah Kilman, 18, was pronounced dead at a hospital after police officers were called early Saturday to Campbellsville University in central Kentucky, city police said in a news release. He […]

2 hours ago

Sponsored Articles

...

Midwestern University

Midwestern University Clinics: transforming health care in the valley

Midwestern University, long a fixture of comprehensive health care education in the West Valley, is also a recognized leader in community health care.

...

Collins Comfort Masters

Here’s 1 way to ensure your family is drinking safe water

Water is maybe one of the most important resources in our lives, and especially if you have kids, you want them to have access to safe water.

...

Canvas Annuity

Interest rates may have peaked. Should you buy a CD, high-yield savings account, or a fixed annuity?

Interest rates are the highest they’ve been in decades, and it looks like the Fed has paused hikes. This may be the best time to lock in rates for long-term, low-risk financial products like fixed annuities.

States and Congress wrestle with cybersecurity at water utilities amid renewed federal warnings