Small water, sewer systems show vulnerablity to hackers

Nearly 70,000 small and mid-sized water and wastewater systems in the U.S. are vulnerable to hackers, according to interviews with security experts and water company operators, Blake Sobczak reports for Energy & Environment News.

For example, hackers hit the water and wastewater facilities of the Fort Collins-Loveland Water District last month, infecting the computer systems with ransomware. Ransomware encrypts a victim's computer files, refusing to unlock them until a ransom has been paid online, Sobczak notes.

"Some larger utilities are well-positioned to thwart an attack by hackers backed by a foreign government, said Michael Arceneaux, managing director for the Water Information Sharing and Analysis Center, the industry's clearinghouse for getting the word out about the latest hacking threats and vulnerabilities," Sobczak reports. "But in a sector that encompasses tens of thousands of local water systems, securing America's vast and disparate drinking water supply remains a significant challenge."

Cybersecurity for water utilities is only lightly monitored by the federal government and often ignored by state utility commissions. But water security is critical after a disaster: "In many emergency planning exercises, it isn't the lack of electricity that triggers chaos and widespread casualties. It's the lack of clean water that forces people from their homes," Sobczak reports.

"Sixty-three cyber vulnerabilities were uncovered in the 'water supply' sector in 2018, according to federal data, accounting for 15 percent of all industrial security problems. Only the energy and manufacturing sectors had more vulnerabilities in 2018," Sobczak reports. Power distributors use many of the same equipment providers and use similar computer systems as water utilities, and so may be vulnerable to the same kinds of cyberthreats.