Watering Down Security: The Growing Threat to America’s Critical Infrastructure

The recent revelation that over 100 US water systems were targeted by hackers in July should come as no surprise. Cyberattacks on critical infrastructure have been a growing concern for years, with this latest development being the latest chapter in a long-running saga of vulnerabilities exposed by malicious actors.

Programmable logic controllers (PLCs) are at the center of these attacks, controlling physical machinery across water providers, energy grids, and other critical infrastructure. The compromise of PLCs can have far-reaching consequences. Hackers have been using AI-powered tools to target these systems, which is particularly troubling given their sophistication and adaptability.

Multiple manufacturers, including Rockwell, Schneider Electric, and Siemens, are involved in the problem. This raises questions about security protocols across the sector and the preparedness of operators to respond to such attacks. The fact that multiple vendors are vulnerable suggests a systemic issue rather than isolated problems with individual companies.

The relatively low impact of these recent intrusions on water and wastewater supplies may seem like a silver lining, but it’s precisely this complacency that we should be worried about. Hackers can probe our critical infrastructure without causing immediate harm, but they won’t hesitate to exploit vulnerabilities for maximum impact if given the opportunity.

Attribution of the attacks has been predictable, with some officials pointing to Iran and others citing China’s previous attempts to compromise US infrastructure. Russia’s own history of cyberattacks on European water providers and energy grids should also be taken into account in this context. The truth is that attribution can often be a tricky business, and we may never know for certain who initiated these attacks.

The ongoing saga of hacking attempts on water providers highlights our collective vulnerability to malicious actors. With multiple states affected, including Michigan, Minnesota, and at least five others, it’s clear that this is no longer just a localized issue.

As operators move forward, they must prioritize cybersecurity and take proactive steps to address vulnerabilities. Manufacturers must ensure their products are secure by default rather than relying on patchwork fixes after the fact. Transparency and accountability will also be crucial in addressing this problem.

Ultimately, there’s a more fundamental question at play: who is responsible for safeguarding America’s critical infrastructure? Is it the operators themselves or the governments that oversee them? As the stakes continue to rise, so too must our expectations for transparency and accountability.