Iran and Russia are cyberattacking US water systems, EPA warns - Hindustan Times
close_game
close_game

Iran and Russia are cyberattacking US water systems, EPA warns

AP | | Posted by Tuhin Das Mahapatra
May 21, 2024 07:46 AM IST

EPA warns of increasing cyberattacks on water utilities and urges immediate action to protect drinking water; about 70% of utilities inspected are in violation.

Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water.

Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday, May 20, 2024, as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water from electronic threats. (Municipal Water Authority of Aliquippa via AP, File)(AP)
Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday, May 20, 2024, as it issued an enforcement alert urging water systems to take immediate actions to protect the nation's drinking water from electronic threats. (Municipal Water Authority of Aliquippa via AP, File)(AP)

About 70% of utilities inspected by federal officials over the last year violated standards meant to prevent breaches or other intrusions, the agency said. Officials urged even small water systems to improve protections against hacks. Recent cyberattacks by groups affiliated with Russia and Iran have targeted smaller communities.

Some water systems are falling short in basic ways, the alert said, including failure to change default passwords or cut off system access to former employees. Because water utilities often rely on computer software to operate treatment plants and distribution systems, protecting information technology and process controls is crucial, the EPA said. Possible impacts of cyberattacks include interruptions to water treatment and storage; damage to pumps and valves; and alteration of chemical levels to hazardous amounts, the agency said.

ALSO READ| Russian theater director and playwright go on trial over a play authorities say justifies terrorism

EPA deputy says many US water systems lack adequate cybersecurity plan

“In many cases, systems are not doing what they are supposed to be doing, which is to have completed a risk assessment of their vulnerabilities that includes cybersecurity and to make sure that plan is available and informing the way they do business,” said EPA Deputy Administrator Janet McCabe.

Attempts by private groups or individuals to get into a water provider’s network and take down or deface websites aren’t new. More recently, however, attackers haven’t just gone after websites, they’ve targeted utilities’ operations instead.

Recent attacks are not just by private entities. Some recent hacks of water utilities are linked to geopolitical rivals, and could lead to the disruption of the supply of safe water to homes and businesses.

McCabe named China, Russia and Iran as the countries that are “actively seeking the capability to disable U.S. critical infrastructure, including water and wastewater.”

Late last year, an Iranian-linked group called “Cyber Av3ngers” targeted multiple organizations including a small Pennsylvania town's water provider, forcing it to switch from a remote pump to manual operations. They were going after an Israeli-made device used by the utility in the wake of Israel's war against Hamas.

Earlier this year, a Russian-linked “hacktivist” tried to disrupt operations at several Texas utilities.

A cyber group linked to China and known as Volt Typhoon has compromised information technology of multiple critical infrastructure systems, including drinking water, in the United States and its territories, U.S. officials said. Cybersecurity experts believe the China-aligned group is positioning itself for potential cyberattacks in the event of armed conflict or rising geopolitical tensions.

ALSO READ| Exclusive: Changing trends in US university admissions for Asian students, expert breaks community college stigma and…

Industry experts call for new cybersecurity policies for water utilities

“By working behind the scenes with these hacktivist groups, now these (nation states) have plausible deniability and they can let these groups carry out destructive attacks. And that to me is a game-changer,” said Dawn Cappelli, a cybersecurity expert with the industrial cybersecurity firm Dragos Inc.

The world’s cyberpowers are believed to have been infiltrating rivals’ critical infrastructure for years planting malware that could be triggered to disrupt basic services.

The enforcement alert is meant to emphasize the seriousness of cyberthreats and inform utilities the EPA will continue its inspections and pursue civil or criminal penalties if they find serious problems.

“We want to make sure that we get the word out to people that ‘Hey, we are finding a lot of problems here,’” McCabe said.

EPA did not say how many cyber incidents have occurred in recent years, and the number of attacks known to be successful so far is few. The agency has issued nearly 100 enforcement actions since 2020 regarding risk assessments and emergency response, but said that’s a small snapshot of the threats water systems face.

Preventing attacks against water providers is part of the Biden administration's broader effort to combat threats against critical infrastructure. In February, President Joe Biden signed an executive order to protect U.S. ports. Health care systems have been attacked. The White House has pushed electric utilities to increase their defenses, too. EPA Administrator Michael Regan and White House National Security Advisor Jake Sullivan have asked states to come up with a plan to combat cyberattacks on drinking water systems.

ALSO READ| Ukraine humanitarian aid falling while needs rise: UN

"Drinking water and wastewater systems are an attractive target for cyberattacks because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices,'' Regan and Sullivan wrote in a March 18 letter to all 50 U.S. governors.

Some of the fixes are straightforward, McCabe said. Water providers, for example, shouldn't use default passwords. They need to develop a risk assessment plan that addresses cybersecurity and set up backup systems. The EPA says they will train water utilities that need help for free. Larger utilities usually have more resources and the expertise to defend against attacks.

“In an ideal world ... we would like everybody to have a baseline level of cybersecurity and be able to confirm that they have that,” said Alan Roberson, executive director of the Association of State Drinking Water Administrators. “But that's a long ways away.”

Some barriers are foundational. The water sector is highly fragmented. There are roughly 50,000 community water providers, most of which serve small towns. Modest staffing and anemic budgets in many places make it hard enough to maintain the basics — providing clean water and keeping up with the latest regulations.

“Certainly, cybersecurity is part of that, but that's never been their primary expertise. So, now you're asking a water utility to develop this whole new sort of department" to handle cyberthreats, said Amy Hardberger, a water expert at Texas Tech University.

The EPA has faced setbacks. States periodically review the performance of water providers. In March 2023, the EPA instructed states to add cybersecurity evaluations to those reviews. If they found problems, the state was supposed to force improvements.

But Missouri, Arkansas and Iowa, joined by the American Water Works Association and another water industry group, challenged the instructions in court on the grounds that EPA didn’t have the authority under the Safe Drinking Water Act. After a court setback, the EPA withdrew its requirements but urged states to take voluntary actions anyway.

ALSO READ| Satellite images show Gazans' quick exodus from Rafah after Israeli invasion

Safe Drinking Water Act lacks authority for cybersecurity, experts say

The Safe Drinking Water Act requires certain water providers to develop plans for some threats and certify they’ve done so. But its power is limited.

“There's just no authority for (cybersecurity) in the law,” Roberson said.

Kevin Morley, manager of federal relations with the American Water Works Association, said some water utilities have components that are connected to the internet — a common, but significant vulnerability. Overhauling those systems can be a significant and costly job. And without substantial federal funding, water systems struggle to find resources.

The industry group has published guidance for utilities and advocates for establishing a new organization of cybersecurity and water experts that would develop new policies and enforce them, in partnership with the EPA.

“Let's bring everybody along in a reasonable manner,” Morley said, adding that small and large utilities have different needs and resources.

SHARE THIS ARTICLE ON
SHARE
Story Saved
Live Score
OPEN APP
Saved Articles
Following
My Reads
Sign out
New Delhi 0C
Saturday, June 15, 2024
Start 14 Days Free Trial Subscribe Now
Follow Us On