{"id":256592,"date":"2026-08-19T19:18:10","date_gmt":"2026-08-19T19:18:10","guid":{"rendered":"https:\/\/www.europesays.com\/iran\/256592\/"},"modified":"2026-08-19T19:18:10","modified_gmt":"2026-08-19T19:18:10","slug":"so-about-that-iranian-cyberattack-on-our-water-supply","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/iran\/256592\/","title":{"rendered":"So about that Iranian cyberattack on our water supply."},"content":{"rendered":"

Sign up for Executive Dysfunction<\/a>, a newsletter that highlights one under-the-radar story each week about how Trump is changing the law\u2014and how the law is pushing back. You\u2019ll also receive updates on the latest from Slate\u2019s Jurisprudence team.<\/p>\n

On July 30, the FBI, Environmental Protection Agency, and Cybersecurity and Infrastructure Security Agency issued a joint statement<\/a> confirming that \u201cmalicious cyber actors\u201d had successfully infiltrated municipal water facilities in at least seven states, a count that has since grown to a dozen, forcing many of them offline. The attacks were inconsequential in one sense\u2014there were no reports of contaminated water, though some systems suffered pressure drops and issued precautionary boil-water advisories<\/a>. James Wilson, co-host of the Srsly Risky Biz podcast<\/a>, likened the attacks to an \u201cendless amount of cyber mosquitoes,\u201d as opposed to a \u201ccyber Pearl Harbor.\u201d<\/p>\n

But the coordinated attacks also underscored the vulnerability of the United States\u2019 water facilities, prompting some obvious questions as to what the federal government has been doing, is presently doing, and perhaps should be doing. Water is critical to life, after all. Shouldn\u2019t its security be a top, if not the top, priority? The United States hasn\u2019t necessarily experienced a water cybersecurity disaster, but worst-case scenarios are more tangible than hypothetical. We\u2019ve had water treatment failures<\/a>, chemical imbalances<\/a> brought on by malfunction, E. coli contamination<\/a>, and the people of Flint, Michigan<\/a>, of course<\/a>, appreciate the criticality of clean water better than anyone in the country.<\/p>\n

With respect to this recent attack, experts\u2019 fears nearly played out in Clayton County, Georgia, when a pressure drop was noted but quickly addressed. The water that flows through the pipes to us is made safe in part by physics\u2014a pressure loss can lead to backflow<\/a> of groundwater, sewage, and soil contaminants.<\/p>\n

The attack echoed a previous campaign by CyberAv3ngers, an arm of Iran\u2019s Revolutionary Guard, which has led to a working presumption that Iran was responsible. President Donald Trump, to his continued discredit, blamed Minnesota Gov. Tim Walz<\/a>. In 2023, the CyberAv3ngers group broke into water utility controllers in Aliquippa, Pennsylvania<\/a>, with only default factory passwords, leading CISA to issue an advisory<\/a> with fundamental remedial steps:<\/p>\n

\u2022 Implement multifactor authentication<\/p>\n

\u2022 Use strong, unique passwords<\/p>\n

\u2022 Check [Programmable Logic Controllers] for default or no passwords<\/p>\n

If this familiar-looking advice seems like the barest minimum in modern cybersecurity hygiene, that\u2019s because it is. Three years later, the U.S. is at war with Iran, who it appears again simply strolled through dozens of still-unlocked front doors.<\/p>\n

CISA, the agency charged with the mandate of leading the nation\u2019s collective defense against cyber threats and coordinating national incident responses, appears unprepared to meet this moment. The sum total of its response to the 2023 threat was to provide some common-sense IT advice, which promptly went unfollowed in many quarters. Underfunded, understaffed state utilities can\u2019t be the first line of defense against coordinated cyberattacks by hostile foreign actors, right?<\/p>\n

One could point to CISA\u2019s reduced budget and staffing as a possible weak spot: Congress cut CISA\u2019s budget by $135 million<\/a> this year (Trump wanted a $495 million cut), and there are 1,000 fewer workers at CISA<\/a> than there were in early 2025.<\/p>\n

I asked Tatyana Bolton, executive director at the Operational Technology Cybersecurity Coalition<\/a>, what part budget and staffing cuts might have played in the recent attacks, and she downplayed the significance, pointing to an array of other factors, such as an absence of baseline controls and standards in the water infrastructure sector, unlike the energy and finance sectors. Bolton, who was at CISA from 2017\u201320, noted that CISA is chronically underfunded and spread too thin to meet its mandate, but that acting Director Nick Andersen<\/a> is focusing on the right things. She maintains that the problems for water security are broader than CISA has the capacity to handle. But she agreed that July\u2019s dozens-fold repeat of the 2023 attack pointed to a failure to implement and audit CISA\u2019s earlier guidance\u2014guidance that, again, merely amounted to \u201cSet better passwords.\u201d<\/p>\n

Naturally, water presents particular security challenges that the other infrastructure sectors don\u2019t have to wrestle with, beginning with the fact that there are approximately 148,000 relatively siloed public water systems<\/a> in the United States, many running different operational technologies. Our water system\u2019s decentralized, fragmented nature, perhaps a bit like our electoral system, is a double-edged sword, inasmuch as its vulnerabilities are atomized\u2014at least a single hacker can\u2019t contaminate all the water in the country. That said, one hacker can wreak no small amount of havoc, as one compromised water system might serve tens of thousands of people. Iran, of course, sent a team.<\/p>\n

A huge wrinkle is that larger cities and metro areas benefit from economies of scale that help insulate them: they can afford dedicated OT security staff and redundant control systems. Many communities, though, are served by water facilities staffed by only three people. Roughly 85 percent of water systems serve communities of fewer than 50,000, communities that together comprise less than 10 percent of the entire U.S. population. Still, both Plymouth, Minnesota<\/a> (population 80,000), and Clayton County, Georgia<\/a> (serving 300,000), were victims. Although rural communities require a disproportionate amount of attention, they\u2019re not the only communities that are vulnerable.<\/p>\n

If a holistic solution isn\u2019t coming from CISA, where then? House bill H.R. 7922<\/a>, introduced in 2024 by Reps. Rick Crawford, an Arkansas Republican, and John Duarte, a California Republican, called the Water Risk and Resilience Organization Establishment Act, would create an independent organization, certified by the EPA, to develop and enforce minimum cybersecurity standards for large and midsize utilities, essentially deputizing the experts to come up with solutions. One obvious blind spot is that it would exclude water facilities that serve fewer than 3,300 people, the communities least prepared, that indeed were<\/a> among<\/a> those likely targeted this time around. A slightly revised version (H.R. 2594<\/a>) has been stalled in committee since April 2025.<\/p>\n

In response to the attacks, Democratic Sens. Adam Schiff and Amy Klobuchar recently proposed the Water Cyber Shield Act of 2026, which would amend the Safe Drinking Water Act and Clean Water Act<\/a> to give the EPA explicit authority to perform cybersecurity assessments, enforce corrective measures, and establish security standards alongside CISA. The bill would authorize $300 million annually to help utilities pay for much-needed upgrades. In a call, a spokesperson from Schiff\u2019s office characterized the bill to me as giving the EPA the tools to impose a \u201cfloor\u201d in terms of standards all water utilities serving more than 3,300 people would need to follow. \u201cI\u2019m also continuing to push for strong federal, state, and local coordination to immediately investigate and stop these cyberattacks, as well as for updated technology to secure our critical infrastructure,\u201d Klobuchar said in a statement to Slate. The Democratic bill seems unlikely to pass for the obvious reason that the Democrats are out of power, though Schiff\u2019s camp suggested it could be passed through appropriations<\/a>. Klobuchar\u2019s co-sponsorship of the bill makes sense given that Minnesota was the primary target of the recent attacks, perhaps giving her an opportunity to implement something similar there if she\u2019s elected governor in November. \u201cAs Governor, I\u2019ll work to ensure that our public infrastructure and services are protected from cyber threats,\u201d her statement read.<\/p>\n

It\u2019s worth noting that the bill would empower the EPA to enforce safety standards only three years after the 8th Circuit blocked the agency from doing exactly that. Attorneys general from Iowa, Arkansas, and Missouri had sought an injunction against the EPA to stop them from ordering states to evaluate their water utilities\u2019 cybersecurity operational technology when they conducted inspections. The court agreed, finding that this modest, common-sense measure failed to complete the notice-and-comment dance, and the EPA, already reeling from a pair of Supreme Court<\/a> losses<\/a> limiting its authority, quietly withdrew the regulation.<\/p>\n

Despite the anti-regulatory headwinds in D.C., states like New York<\/a>, Indiana, and Maryland all mandate cybersecurity vulnerability assessments for their water systems. New York\u2019s regime is considered the national benchmark by the people I spoke with, and is relatively similar to what Schiff and Klobuchar are proposing nationally. It\u2019s a small sample size, but none of these states were issuing boil-water notices last month.<\/p>\n

Other states have been active as well, with wildly different approaches. From Leigh Ramsey at Bluefield Research<\/a> I learned about Texas outright prohibiting utilities from connecting to the internet, and establishing a \u201cCyber Command\u201d to identify weaknesses and coordinate responses. Idaho has no dedicated water cybersecurity mandate, but created a fund that rewards projects that build in \u201ccyber-informed design principles\u201d from the start.<\/p>\n

<\/p>\n

\"\"<\/p>\n

\n Jessica Pishko
\n If You Want to Know How Trump 2.0 Is Really Going, I Suggest a Visit to the Dying Trump \u201cSuperstore\u201d
\n Read More\n <\/p>\n

<\/a><\/p>\n

By far, the most daring approach has been Jake Braun\u2019s. The former acting principal deputy national cyber director under President Joe Biden, Braun brought his election security experience<\/a> to water security, heading up a philanthropy-funded<\/a> effort called DEF CON Franklin<\/a>, run in conjunction with the University of Chicago. DEF CON Franklin matched volunteer white-hat hackers with small water utilities across the country, helping them patch holes and advising them on basic security hygiene.<\/p>\n

Braun\u2019s brainchild ran into frustrating scalability problems, which led him to an even more ambitious idea: outsourcing the problem, as a small business might, to managed security service providers, which detect and respond to threats on behalf of water utilities serving fewer than 10,000 people. Only a week ago Braun unveiled the Water Watch Center<\/a>, a joint effort between DEF CON Franklin and the National Rural Water Association, along with five cybersecurity firms already familiar with the water sector. Braun told me that managed security service providers offer a two-way benefit: it helps his project get over the scalability hump by pooling resources, while the small utilities benefit from a shared information environment.<\/p>\n

Braun is already thinking bigger with plans to graduate from managed security service providers in five Federal Emergency Management Agency sectors to 10, which would cover the entire country, and service utilities for communities as large as 150,000. He\u2019s well aware that philanthropy wouldn\u2019t cover such a step up, which is why he believes the project could one day be funded by the federal government. His idea sounds less wild when you recall that we\u2019re really talking about small communities being targeted by hostile foreign actors, leading Braun to reason that the Department of Defense could possibly fund his effort. Braun\u2019s team is already working on an ambitious Defense Advanced Research Projects Agency\u2013funded project to test how A.I. solutions might be deployed in defense of water systems.<\/p>\n


\n This Content is Available for Slate Plus members only<\/p>\n

There Is Something Very Wrong With the U.S. Navy Right Now
\n <\/a><\/p>\n


\n This Content is Available for Slate Plus members only<\/p>\n

Donald Trump\u2019s Trickle-Down Misogyny
\n <\/a><\/p>\n


\n This Content is Available for Slate Plus members only<\/p>\n

We\u2019re Finally Learning How ICE Is Spending Its Unlimited Budget. It\u2019s Literally Shocking.
\n <\/a><\/p>\n

One can\u2019t help but admire Braun\u2019s effort, but his project\u2019s existence is also a damning commentary on the federal government\u2019s ability and willingness to protect its citizens from foreign threats. The energy and desire to address what everyone agrees is a gaping hole in our security infrastructure is there, but energy and desire are often no match for inertia and stagnation, which is the unfortunate reality when a particular threat falls short of a disaster measured in lives.<\/p>\n

Here, the goals are the same but the methods are scattershot: There\u2019s the top-down regulatory approach relying on the EPA, there\u2019s the independent committee approach favored by an acronym soup of trade groups whom the EPA certifies to figure it out, and finally Jake Braun\u2019s small-business approach of attempting to fix the problem from outside the government and then asking the government to foot the bill if it wants to scale fully up. The different approaches don\u2019t feel that far apart, or mutually exclusive even. Everyone agrees there should be higher standards\u2014they merely differ on who gets to set them. Until someone or something wins out, though, states, utilities, and elected officials remain unprepared for the worst.<\/p>\n","protected":false},"excerpt":{"rendered":"Sign up for Executive Dysfunction, a newsletter that highlights one under-the-radar story each week about how Trump is…\n","protected":false},"author":2,"featured_media":256593,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[3],"tags":[822,2383,38,34,44387,36],"class_list":["post-256592","post","type-post","status-publish","format-standard","has-post-thumbnail","category-iran","tag-cybersecurity","tag-cyberwar","tag-donald-trump","tag-iran","tag-jurisprudence","tag-war"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@iran\/117123791782913111","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/posts\/256592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/comments?post=256592"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/posts\/256592\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/media\/256593"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/media?parent=256592"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/categories?post=256592"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/iran\/wp-json\/wp\/v2\/tags?post=256592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}