Suspected Iran-linked cyberattacks are highlighting vulnerabilities in U.S. drinking water systems, which are facing challenges from aging infrastructure and climate change. Disruptions to these systems can threaten public health and essential services, and many utilities, particularly smaller ones, lack the resources to enhance their cybersecurity measures.
Kevin Morley, federal relations manager for the American Water Works Association (AWWA), stated that utilities must now address both acute cybersecurity threats and ongoing issues such as climate change and infrastructure deterioration. According to the Environmental Protection Agency (EPA), there are over 144,000 public water systems in the U.S., including approximately 50,000 community water systems that provide year-round drinking water.
The fragmentation of these systems complicates efforts to modernize infrastructure and maintain consistent cybersecurity standards. Andrew Whelton, a professor at Purdue University, noted that the challenges are not unique to any single administration but have built up over time due to infrastructure and funding issues.
Morley explained that local municipalities often set water rates, which can hinder necessary investment in infrastructure upgrades. While much of the drinking water infrastructure is decades old, Whelton emphasized that it is important to view the sector as evolving rather than simply outdated. Some utilities are redesigning systems to better withstand cyberattacks and other disasters, as seen in Louisville, Colorado, which updated its water system following the 2021 Marshall Fire.
Despite recognizing cybersecurity vulnerabilities for decades, there has been insufficient government action to bolster defenses in the sector. Morley mentioned that many digital control systems were initially designed for efficiency rather than security. The AWWA is advocating for nationwide minimum cybersecurity standards for water utilities and has urged Congress to provide federal support for these critical infrastructures.
The EPA reported identifying vulnerabilities at 277 water systems last year and is working with utilities to address these issues. Increasingly severe weather events are prompting utilities to reconsider their resilience strategies. Whelton noted that recent wildfires in Washington have forced utilities to prepare for unexpected disasters.
Utilities are now trying to balance investments in cybersecurity with the need to replace aging infrastructure, as extreme weather events place additional stress on water systems. Many smaller community water systems struggle to allocate staff and funding for cybersecurity due to limited resources. As these utilities are often owned by local governments, funding for water infrastructure competes with other local priorities such as education and public safety. Whelton indicated that smaller utilities frequently rely on state agencies and industry associations for guidance on cybersecurity and climate resilience.
In conclusion, utilities must address cyberattacks, climate change, and aging infrastructure as interconnected challenges.