In 2021, an unidentified person hacked the computer controlling the water system in Oldsmar, Fla., and increased the concentration of sodium hydroxide 100 times the normal amount, in an attempt to poison people.
That same year, an unidentified hacker used a stolen password to delete certain programs from a water treatment program in the San Francisco Bay area.
Part of the reason attacks like these are increasing in number and sophistication is because there quite simply may not be a sufficient apparatus to prevent them. The United States has approximately 150,000 public water systems (“PWS”) across the 50 states, with varying sizes in constituency and even greater variance in technology. Further, the hallmark legislation empowering the government to protect drinking water in the first place — the 1974 Safe Drinking Water Act (“SDWA”) — simply could not have contemplated the advent of cybercrime.
The SDWA empowers the government to set minimum standards for drinking water. It further directs that PWS must go through regular ‘sanitary surveys,’ or audits, that evaluate their functionality. Understandably, all of these rules, as comprehensive as they were, were promulgated decades before anyone could anticipate computers would be programmed to do most of the work.
On March 3, the EPA took one of the first comprehensive steps toward dragging water security into the 21st century when it issued a memo ordering states to evaluate a PWS’ cybersecurity readiness, in addition to the regular battery of tests in the safety audit. The new, ‘enhanced’ audit is to include a “review of the cybersecurity practices and controls needed to maintain the integrity and continued functioning of operational technology of the [water system] that could impact the supply or safety of the water provided to customers.” Given the varying levels of sophistication of the PWS, the EPA will give states the choice to allow PWS self-assess, have state officials to do it, or have a third-party do the assessment and file a report. The EPA has also committed technical support and assistance to any PWS that requires it.