Cyber Siege: How Iran and China Threaten America’s Water Security
The Biden administration has issued a stark warning regarding the risk of cyberattacks targeting the United States’ water supply systems, highlighting the continuous threats posed by hackers affiliated with the governments of Iran and China.
In a letter addressed to governors on March 19, Environmental Protection Agency Administrator Michael Regan and National Security Advisor Jake Sullivan voiced their concerns over targeted cyberattacks potentially disrupting the vital function of providing clean and safe drinking water to the populace, in addition to inflicting substantial financial harm on communities affected by any disruption.
It has been specified that hackers associated with the Islamic Revolutionary Guard Corps of Iran have recently targeted the U.S. drinking water systems, while the China-sponsored group Volt Typhoon has compromised the information technologies of drinking water supply and other critical infrastructure systems.
The letter articulates that federal departments and agencies assess, with a high degree of confidence, the actions of Volt Typhoon actors as preparations for possible disruptions of critical infrastructure operations in the event of geopolitical tensions and/or military conflicts.
The U.S. water supply system represents a particularly vulnerable segment of the nation’s infrastructure due to inadequate control mechanisms, insufficient funding, and a shortage of personnel. The Environmental Protection Agency is the leading federal agency responsible for ensuring the resilience of the nation’s water sector against all threats and hazards, including cyberattacks.
In late November, a hacking group supported by Iran attacked digital control systems of Israeli manufacture, which are widely used in the water supply and wastewater industries in the U.S. The attack affected several organizations across different states. Although these incidents did not impact water supplies, they highlighted the complexity of dialogue between the federal government and municipal water associations regarding the best methods to protect water resources.
The letter emphasizes that drinking water supply and wastewater systems are attractive targets for cyberattacks as they constitute critical infrastructure but often lack the necessary resources or technical expertise to implement stringent cybersecurity practices.
The document also points out that in many cases, even basic precautions, such as changing default passwords or updating software to fix known vulnerabilities, are not taken, which could be the deciding factor between business as usual and a devastating cyberattack.
State officials are invited to a meeting on March 21 to discuss this threat and develop protection strategies. This underscores the federal government’s serious intentions to prevent potential security threats to water supply and highlights the importance of collaborative efforts at all levels of government to ensure the protection of vital infrastructure.
Thus, the cybersecurity situation concerning the U.S. water supply is under the highest level of scrutiny. Authorities call for vigilance and enhanced security measures to counter potential threats from foreign state actors and others seeking to disrupt the functioning of critical infrastructures.
