America’s water infrastructure is facing a new kind of modernization challenge. Cyberattacks this year have targeted more than 100 drinking water and wastewater systems across 12 states, and some intrusions have already disrupted physical operations. Attackers have manipulated the programmable controllers that help utilities operate pumps and other equipment, causing incidents that included loss of water pressure and flooding.
Federal and state officials are responding, but their actions point to something larger than an immediate cybersecurity problem. They signal a fundamental change in the definition of water infrastructure. Pumps, pipes and treatment plants increasingly depend on connected control systems, sensors, communication networks and software, making digital security inseparable from physical infrastructure.
The threat became particularly apparent this summer. On July 30, the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) warned that malicious cyber actors were targeting internet-connected programmable logic controllers, commonly known as PLCs, at water and wastewater facilities. Utilities in at least seven states have reported incidents to the FBI since July 27.
Attackers gained remote access to PLCs and changed internet protocol addresses and passwords, leaving some utilities unable to monitor or control equipment remotely. Federal officials subsequently warned water utilities to remove publicly exposed operational technology from the internet and strengthen protections for systems that control physical operations.
The response is beginning to create a new category of infrastructure investment.
On Aug. 31, the Environmental Protection Agency announced $11.75 million for 10 projects designed to strengthen midsize and large drinking-water systems against cyberattacks, natural hazards and other threats. Although the federal grants are relatively modest, the projects illustrate the types of investments that water utilities throughout the country are likely to make.
San Diego was awarded $2.375 million to replace programmable logic controllers and related equipment to reduce cyber and natural-hazard vulnerabilities. Bloomington, Indiana, received the same amount for facility improvements that include backup generators and upgrades to its supervisory control and data acquisition, or SCADA, system.
Anderson, California, received approximately $805,000 for a project that includes replacement of a water tank along with smart monitoring devices and security cameras. Lake City, Florida, received funding to modernize SCADA and pump-control systems.
Other awards will support generators, wells, dams, storage tanks, transmission mains, treatment facilities and stormwater infrastructure. Collectively, the projects demonstrate how closely digital resilience and traditional infrastructure have become intertwined.
Another initiative launched the same day may be even more significant.
The White House Office of the National Cyber Director, Texas officials and private-sector technology companies announced Project Watershed 250, a new cybersecurity initiative focused on water and wastewater infrastructure. Texas was selected as the first state for the pilot.
The scale of the challenge is substantial. Texas has more than 7,400 public water systems and approximately 3,000 wastewater treatment facilities serving a population of about 31 million.
Project Watershed 250 will provide participating utilities with cybersecurity assessments, assistance addressing identified vulnerabilities and access to defensive technologies. The initiative brings together federal and state resources with private-sector companies, and the results are intended to help develop a model that can eventually be replicated elsewhere.
Water and wastewater utilities are increasingly dependent on operational technology that monitors and controls pumps, valves, treatment processes, lift stations, storage facilities and distribution networks. Protecting those operations can require replacement of obsolete PLCs, modernization of SCADA systems, new sensors and communications equipment, network segmentation, backup power, physical-security improvements and redundant operating systems.
Austin Water launched a modernization project to monitor and control portions of the city’s water distribution, wastewater collection and lift-station systems. Current funding identified for the contract totals $750,000, with additional expenditures dependent on future budgets.
Columbus, Ohio, also is advancing an improvement project focused on water distribution system improvements. City officials authorized approximately $773,000 this summer for additional engineering services during construction, illustrating that these modernization programs create opportunities not only for technology providers but also for engineering and professional-services firms.
Warner Robins, Georgia, recently sought private-sector assistance through a master services agreement covering control-system integration, maintenance, technical support and capital improvements throughout its water and wastewater systems.
Waco, Texas, has similarly sought support and maintenance services involving PLC and human-machine-interface programming, industrial networks, equipment replacement, commissioning and development of a longer-term technology roadmap.
Federal officials are also providing utilities with guidance on how these systems should be protected.
In June, the National Institute of Standards and Technology released final cybersecurity guidance specifically for the water and wastewater sectors. The agency noted that utilities increasingly use connected sensors, network devices, data collection, analytics and automation to improve operations. Those technologies also create additional points of vulnerability.
The Government Accountability Office made a similar observation earlier this year, warning that growing connections between operational technology controlling pumps, valves and other physical equipment and internet-enabled systems are increasing cybersecurity risks for water utilities.
That convergence will have significant implications for the government-contracting marketplace.
Modernizing a water system can no longer be viewed simply as replacing pipes, pumps and treatment equipment. Increasingly, the work will involve protecting and modernizing the digital infrastructure that controls those physical assets.
That will result in future projects requiring a much broader range of private-sector expertise. Engineering firms, systems integrators, cybersecurity companies, SCADA specialists, electrical contractors, communications firms, equipment manufacturers, cloud providers and traditional water-infrastructure contractors all have roles to play.
The federal grants announced in August are small compared with the billions of dollars spent annually on water infrastructure, but they point to a larger trend. Thousands of public water and wastewater systems operate across the country, many with aging physical infrastructure and increasingly interconnected technology.
That creates an emerging marketplace worth watching closely. Cybersecurity is no longer simply an information technology issue for public utilities. It is quickly becoming part of capital planning, operational resilience and infrastructure modernization.
The next generation of water infrastructure projects will still involve pipes, pumps, wells and treatment plants. But the systems that monitor, communicate with, and control those assets will be just as critical. And protecting both sides of that infrastructure will require public officials and private-sector partners to think about water systems in an entirely new way.
