Cyberattacks expose deeper vulnerabilities in U.S. water systems

Suspected Iran-linked cyberattacks re exposing long-standing vulnerabilities in fragmented U.S. drinking water systems facing aging infrastructure and intensifying climate threats.

Why it matters: Drinking water systems disruptions can threaten public health and essential services, while many utilities—especially smaller ones—lack the staff and resources to strengthen their defenses..

• Kevin Morley, federal relations manager for the American Water Works Association (AWWA), tells Axios utilities now have to manage acute cybersecurity threats alongside chronic challenges, including climate change and infrastructure deterioration.

The big picture: There are more than 144,000 public water systems in the U.S., including about 50,000 community water systems that provide drinking water to residents year-round, according to the EPA.

• That fragmentation across thousands of independently managed utilities makes it harder to modernize infrastructure and maintain consistent cybersecurity standards. It also complicates efforts to prepare for more frequent extreme weather.
• The biggest challenges aren't unique to the Trump administration, Andrew Whelton, a professor of civil and construction engineering and sustainability engineering at Purdue University, tells Axios.
• Instead, they reflect infrastructure and funding challenges that have accumulated across successive administrations.
• Morley says many investment decisions are ultimately made locally because utilities rely heavily on water rates set by municipalities, making politically difficult rate increases a major barrier to replacing aging infrastructure.

Between the lines: Much of America's drinking water infrastructure dates back decades. But Whelton says it's a mistake to think of the sector simply as "old."

• Many utilities are using replacement projects to redesign systems that can better withstand cyberattacks, wildfires and other disasters.
• Whelton points to Louisville, Colorado, which redesigned parts of its water system after the 2021 Marshall Fire contaminated the network and caused it to lose pressure.

State of play: Whelton says cybersecurity vulnerabilities have been recognized for decades, but governments have yet to make a sustained effort to strengthen the sector's defenses.

• Morley says many of today's digital control systems were originally designed for efficiency and reliability — not cybersecurity.
• The AWWA advocates for the development of nationwide minimum cybersecurity requirements for water utilities, and Morley notes some of the original configurations weren't designed for security.
• "There's a cultural shift in understanding the reality of the threat and the exposure that's possible," Morley says.
• AWWA sent a letter to Congress this week urging federal support for utilities as critical infrastructure.

Meanwhile, more frequent extreme weather is forcing utilities to rethink resilience.

• Whelton says recent wildfires in Washington underscore how utilities that once considered themselves low-risk are now having to prepare for disasters they never expected to face.

Zoom in: Utilities are increasingly balancing investment in cybersecurity with replacing aging pipes, pumps and treatment equipment, even as extreme heat, floods, drought and wildfires place additional stress on water infrastructure.

• Many community water systems are small operations with only a handful of employees, making it difficult to dedicate staff and funding to cybersecurity.
• Because most utilities are owned by local governments or special districts, investments in water infrastructure often compete with funding for schools, roads, police and other local priorities.
• Smaller utilities often depend on state agencies and industry associations for expertise because they lack the staff and resources to tackle cyber threats and climate resilience on their own, Whelton says.

The bottom line: Utilities can no longer afford to think about cyberattacks, climate change and aging infrastructure as separate problems.

• "Cybersecurity is an acute threat layered on top of chronic challenges," Morley says.