How Safe Is America’s Drinking Water Supply?

The US Environmental Protection Agency warned this week that the US drinking water supply is increasingly at risk. Hackers linked to the Chinese, Iranian and Russian governments attacked the infrastructure. Is our water safe?

The May 20 warning said that more than 70 percent of water systems inspected by the EPA did not meet the basic safety requirements of the Safe Drinking Water Act. In addition, inspectors found “alarming vulnerabilities in the cybersecurity of drinking water systems across the country.”

Professor Blair Feltmate, a water systems expert at the University of Waterloo in Canada, told Newsweek that cyber threats to the U.S. water supply are “becoming more sophisticated” and pose a particularly big threat to the southwest of the country, which is already “on the verge of running out of water.”

The Cybersecurity and Infrastructure Security Agency (CISA), which is part of the Department of Homeland Security, had specifically warned of the threat to America's water supply from foreign powers in alerts dated December 1, 2023, and February 7 and May 1 of this year.

According to US authorities, hackers with links to Iran, Russia and China are launching cyberattacks on the US water supply system. The attacks are becoming increasingly sophisticated.

Photo illustration by Newsweek

In its May 20 enforcement alert, the EPA said its inspectors had “identified alarming vulnerabilities in the cybersecurity of drinking water systems across the country.”

It continues: “For example, some water systems have not changed default passwords, used consistent logins for all employees, or restricted access to former employees.”

On March 19, EPA Administrator Michael Regan and National Security Advisor Jake Sullivan sent a joint letter to all 50 U.S. governors urging them to convene local authorities to “discuss the urgent need to protect critical water sector infrastructure from cyber threats.”

Regan commented, “Drinking water and wastewater systems are a lifeline for communities, but many systems have not implemented important cybersecurity practices to mitigate potential cyberattacks.”

Speaking to Newsweek, Professor Feltmate warned that hostile actors could amplify the impact of their attacks by targeting water systems in parts of the US that are already suffering from water shortages.

He said: “Cyberattacks threatening water supplies are becoming increasingly sophisticated, and in theory, so is the ability to defend against these attacks. As challenging as cyberattacks may be, there is a growing pressure – climate change – that could guide cyberattackers in their choice of targets.

“The U.S. Southwest is on the brink of running out of water due to a combination of extreme heat caused by climate change, increasing drought, and excessive demand. Yet survival in the Southwest depends on this increasingly precarious water supply – so cybercriminals are likely to target this region with a 'kick 'em while they're down' approach.”

“Given this threat, the United States should rapidly redouble its water security efforts in the Southwest if the worst cyberattacks on water supplies are to be prevented.”

Attacks on the United States water supply

  • According to the EPA's December 1 alert, hackers affiliated with the Iranian Revolutionary Guard and operating under the name “CyberAv3ngers” targeted a number of Israeli-made Unitronics Vision series programmable logic controllers (PLCs) used in the water industry.
  • It warned that IRGC cyber actors “accessed several US-based WWS (water and sewerage system) facilities” by compromising internet-connected devices with default passwords. The system displayed the message: “You have been hacked, down with Israel. Any device 'made in Israel' is a legitimate target for cyberattacks.”
  • In November 2023, the Cyber ​​​​Av3ngers claimed responsibility for the hacking of the Aliquippa Municipal Water Authority in Pittsburgh, Pennsylvania, which resulted in the automated system being shut down and operations being performed manually.
  • The February 7 alert said a Chinese state-sponsored cyber group called Volt Typhoon had “compromised the IT environments of several organizations with critical infrastructure,” including water management systems.
  • In December, the Washington Post reported that the computer system of a water company in Hawaii had been infiltrated by “hackers with ties to the Chinese People’s Liberation Army.”
  • On May 1, the CISA warned, citing intelligence from multiple agencies including the FBI and the National Security Agency (NSA), that “pro-Russian hacktivists” had targeted water systems in the United States, but said the techniques were “mostly simple.”
  • A cyberattack on the water supply of the remote Texas town of Hale Center in January that led to the shutdown of the operating system was linked to Internet addresses in St. Petersburg, Russia, according to the Insurance Journal.

Professor David Reckhow, a water treatment expert who formerly taught at the University of Massachusetts Amherst, agreed that cyberattacks posed a threat to America's drinking water network, but expressed doubts that they would have a major health impact.

In an interview with Newsweek, he said, “All municipal water systems are vulnerable to intentional pollution to some degree, but it is unlikely that a cyberattack would result in a serious impact on water quality or public health. On the other hand, a cyberattack could result in financial hardship.”

When asked by Newsweek for comment, an EPA spokesperson said, “Water and wastewater systems across the United States are falling victim to cyberattacks. The number of cyberattacks on water utilities has increased significantly in recent years, and this risk is growing with rapid advances in artificial intelligence.”

“Rapid advances in artificial intelligence are enabling cyber threats to use increasingly sophisticated tactics, techniques and procedures to penetrate the operational technology that controls critical infrastructure facilities… All water and wastewater systems are at risk – large and small, urban and rural.”

The spokesman said all water management system operators should “reduce their use of the public internet,” “immediately change default passwords” and “undertake cybersecurity training.”

Internal problems in the USA with water supply

Academic experts agreed that the quality of drinking water in the U.S. is generally high, but Heather Murphy, an associate professor and water quality expert at the University of Guelph, warned that the infrastructure is outdated. Newsweek created a map showing the number of contamination and safety violations by state, based on data from the EPA's Safe Drinking Water Enforcement and Compliance History Online.

She said: “In general, I believe that drinking water in the United States is of high quality and comparable to that of many other industrialized countries. The problem in the United States and other industrialized countries is the deteriorating infrastructure for water distribution (i.e. the pipes).

“These are aging rapidly and are not being replaced as quickly as necessary. As a result, the quality of the water could be compromised through the distribution systems as it travels from the treatment plant to the consumer's home.”

Murphy also said that there are still communities in the United States that rely on private wells of questionable quality and are independent of public water supplies.

The scientist commented: “A large portion of the United States is supplied by private wells, where it is the responsibility of the homeowner to test and treat their own water. Many of these populations do not have access to reclaimed water (i.e., they do not treat their water).

“In North Carolina, for example, there are groups of racially discriminated populations living on the outskirts of cities that could easily be connected to the public water supply. Yet the water supply is provided from private wells of inferior quality.”

Professor Reckhow was more optimistic, saying there was “little regional variation” in water quality in the United States.

He commented: “Public drinking water in the United States, especially municipal water, is very safe compared to other developed countries. Strict national standards and close cooperation between water utilities and the research community help to ensure this. With only a few exceptions, there are few regional differences.”

In April, as part of a broader effort by the Biden administration to curb PFAS pollution, the EPA introduced legally enforceable limits on certain PFAS compounds, also known as “forever chemicals,” in U.S. drinking water.

Unusual knowledge

Newsweek's goal is to challenge conventional wisdom and find connections while searching for common ground.

Newsweek's goal is to challenge conventional wisdom and make connections while searching for common ground.

You might also like

Comments are closed.