The Rutland Herald: Heads above water

It sounds like the plot of a movie. Maine Sen. Angus King urged government and private-sector officials to do more to be prepared because “the next Pearl Harbor, the next 9/11 will be cyber.”

The two-term Maine independent said this week at a hearing that the nation faces “an extremely dangerous situation” because so much of its critical infrastructure can be targeted by hackers and intruders.

One of the vulnerable areas is our water systems.

“We are facing a vulnerability in all of our systems, but water is one of the most critical, and I think one of the most vulnerable,” King said at the start of a hearing before the Senate’s Environment and Public Works Committee. In fact, U.S. Sen. Tom Carper, a Delaware Democrat and the committee chair, reiterated “we face threats from unscrupulous individuals, criminal enterprises and antagonistic state actors 24 hours a day and seven days a week. … It’s clear that many of our nation’s vital transportation and water systems face especially serious challenges in dealing with cybersecurity vulnerabilities.”

“There is an incipient nightmare here,” King warned. Cyber threats have soared in recent years, including recent ransomware attacks on critical infrastructure such as Colonial Pipeline. The water sector has not been immune.

It does not seem as if it could be an issue in rural New England and yet water systems of any size pose an especially tempting target for domestic terrorism.

A hacker unsuccessfully attempted to poison the water supply of Oldsmar, Fla., earlier this year by breaching city systems that control chemical balances. Another hacker breached a water treatment plant in San Francisco in January. The Justice Department in March indicted an individual on a charge of hacking into and tampering with water systems in a rural Kansas county.

Closer to home, John Sullivan, chief engineer of the Boston Water and Sewer Commission, testified Wednesday that his organization was hit by a ransomware attack last year. While it was able to recover without any operations being compromised, Sullivan stressed that many of the nation’s 50,000 drinking water systems and 16,000 wastewater systems lack the resources and knowledge to respond to a cyberattack.

“We have seen a growing number of these systems fall victim to these attacks, which can have significant implications on public health and safety,” said U.S. Sen. Shelley Moore Capito, a West Virginia Republican and vice chair of the committee. “These attacks are very scary for the public when they occur and can leave us questioning the safety of our water systems.”

A 2019 report by the American Water Works Association called the cyber risk the top threat facing the U.S. water sector after hearing the year before from the Department of Homeland Security and the FBI warning operators “that the Russian government was specifically targeting the water sector and other critical infrastructure as part of a multi-stage intrusion campaign.”

Lawmakers in the committee warned a major breach in our water infrastructure system could jeopardize the safety of our drinking water and impair communities’ ability to safely dispose of harmful waste.

For King, that is most definitely a threat to human health. He has been pushing for more attention to cybersecurity for years and remains unsatisfied with the nation’s progress toward beefing up its defenses.

“We’ve been a cheap date in cyber where we’ve been attacked repeatedly in a variety of ways and no real serious response,” King said, pointing to mild sanctions.

“Cyber is cheap,” King told the committee, adding that Russian President Vladimir Putin “can hire 8,000 hackers for the cost of one jet fighter. Think of that for a second, and that means cost is not really any kind of deterrent or disincentive.”

While this feels like a bigger issue, some of the testimony focused on the fact that smaller systems — like those found around Vermont and other smaller communities — are especially vulnerable because they have relatively small staffs, they do not have high-level safeguards and security, and even a minor incident could have a huge effect on people’s trust in something as basic as drinking water.

“This is why small communities believe that protecting our water supplies from any cyberattack is just as important as protecting large communities,” wrote Sophia Oberton, the special projects coordinator for the city of Delmar, which sits in Maryland and Delaware. It serves 4,500 citizens.

We commend Sen. King for defending rural communities at risk. And we condemn any movie producer who thinks this is a plot worth pursuing. And Bruce Willis ain’t interested.

This editorial first appeared in The Rutland Herald on July 23, 2021.