America’s Water Systems Are Under Attack. We Are Not Ready.

The East Bay Municipal Utility District Wastewater Treatment Plant on March 20, 2024 in Oakland, California.

The Biden Administration and the Environmental Protection Agency had warned states of possible cyberattacks on water systems. —Justin Sullivan-Getty Images In late July, the Federal Bureau of Investigation received reports of cyberattacks on water facilities from utility companies in at least seven states in the United States.

One of those attacks, in Braham, Minnesota, a city of around 1,800 people, affected the functioning of a pump at a water treatment plant and threatened the water supply.

Public works crews in the city quickly and impressively isolated the system, restored a backup, and had the water plant back up and running in around 90 minutes, according to Nate George , the mayor of Braham.

While this ad hoc response worked this time, much more is needed to make America truly resilient to hybrid attacks by malicious actors on the critical infrastructure that Americans depend on every day for water, power, healthcare, and financial transactions.

In April, the U.S.

Cybersecurity and Infrastructure Security Agency issued a warning saying that Iranian-backed groups are targeting America’s critical infrastructure, including water systems.

More capable adversaries of America, China and Russia , are also actively targeting critical infrastructure in the United States, according to U.S. officials.

President Donald Trump said he does not believe that Iran is behind these most recent cyberattacks.

Unnamed U.S. officials reportedly believe that Iran-backed groups are the likely culprits but also caution that the findings are preliminary and that there is a chance that the attackers may be impersonating Iran to stoke tensions.

Meanwhile. the Trump Administration has been gutting U.S. cybersecurity capabilities, cutting roughly a third of the federal cyber agency’s workforce at exactly the moment small utilities need it most.

A new approach is needed.

Washington needs a whole-of-society, resilience-based approach to deter and defend against these increasing hybrid threats to the American homeland.

Washington can learn a lot from its European allies.