Recent cyberattacks on U.S. water utilities have prompted the FBI and Environmental Protection Agency to warn that hackers are trying to disrupt critical infrastructure.
Attacks on the utility sector are on the rise, and financially stressed water utilities are at higher risk, said Travis Atkison, associate professor of computer science and director of the cybersecurity program at the University of Alabama. Alabama’s largest water utility, Central Alabama Water, which serves the Birmingham area, slashed its budget and staff earlier this year due to financial challenges.
“Limited funding means fewer resources to harden infrastructure,” Atkison said, adding that well-funded utilities have security gaps, too.
The attacks that occurred in at least seven states last week targeted industrial computers that automate chemical treatment of water, control related equipment and monitor water quality. Some of those incidents resulted in boil-water notices or forced water utilities to revert to manual operation of systems that are typically automated and make water safe to drink, according to an alert from the federal Cybersecurity and Infrastructure Security Agency.
What a hacker does after gaining access to one of these controlling computers depends on their motivation, Atkison said.
“If they just want to make that demonstration that they can get a foothold on that infrastructure, maybe they're just going to deny service to it,” he said. “So that would maybe halt that water-treatment process.”
But if the goal is to create chaos or terror, it could mean injecting harmful levels of treatment chemicals while spoofing normal readings, he said.
“So the engineer is sitting there reading screens, reading monitors, doing exactly what they are supposed to do, seeing numbers that they're exactly supposed to see and thinking everything is OK, when that attacker is doing something nefarious on the back end.”
That could let contaminated water reach surrounding communities before anyone notices, he said.
After a mass layoff earlier this year, Central Alabama Water began outsourcing water testing it previously did in an in-house laboratory. Multiple ongoing lawsuits against the utility have raised concerns about how that move could affect drinking-water safety.
Atkison said outsourcing could delay recognition of unacceptable chemical levels.
“Anytime you move something, there's just delay,” he said. “I can't imagine this is a delay of weeks or months, but it's still delay.”
In general, U.S. utility providers are not prepared for cyberattacks, Atkison said. Too many systems are still exposed to the internet, which makes them vulnerable to hacking, and the engineers running them are trained to operate the systems, not secure them, he said.
“What they need is the ability to dedicate real time, real budget in upgrading those critical systems,” Atkison said. “Above all, they need more cybersecurity professionals.”
A spokesperson for Central Alabama Water didn’t answer specific questions about its preparation for cyberattacks, including one about the number of IT professionals it employs. The utility cut its staff by about a quarter earlier this year and said layoffs affected all divisions.
A statement the spokesperson provided says CAW continuously monitors emerging threats and evaluates its safeguards as part of a proactive cybersecurity program.
“Cybersecurity and service reliability are top priorities, and our team has already coordinated directly with the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency regarding the latest threat information and recommended precautions,” the statement reads.
It also said CAW takes advantage of resources and follows best practices from industry groups including the American Water Works Association.
That group released a statement Tuesday saying the ability of water utilities to defend against cyberattacks depends on several factors, including access to timely threat intelligence, technical expertise, continual training and the financial resources needed to secure critical systems.
AWWA and other industry associations CAW is a member of have been advocating for nationwide minimum cybersecurity requirements for water utilities and for a series of federal bills that would help fund the utilities’ cybersecurity efforts.
“This is just the beginning,” Atkinson said about last week’s cyberattacks. “I expect attacks like these to become more frequent, and I'd like to see security researchers step up and help build better defenses. This is not just for our critical infrastructure, but for the citizens who depend on it every day.”
