Hackers launch defense network for public water systems after attacks on US infrastructure

Hackers launch defense network for public water systems after attacks on US infrastructure Cybersecurity experts unveil national security program that ‘only the hacker community’ could come up with after latest attacks - Bookmark - CommentsGo to comments After a series of cyberattacks targeting America’s water infrastructure, a group of hackers have launched a program to help small, vulnerable water utilities across the country combat similar attacks. DEF CON Franklin, a project from the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy, has teamed up with the nonprofit group National Rural Water Association to open the Water Watch Center, which aims to provide direct support to water systems that routinely monitor and adjust safe drinking water across the country. In recent weeks, water systems in at least 12 states — including more than 30 community water systems in Minnesota alone — were compromised by cyberattacks potentially stemming from Iran. Cybersecurity experts told The Independent last week that the new wave of attacks could open a new, asymmetrical front in the U.S. war with Iran that cash-strapped and under-resourced public utilities are not prepared to face. DEF CON debuted its program at this month’s hacker conference in Las Vegas, following two years of work with roughly 450 volunteer hackers and cyber experts who paired up with water and wastewater utilities in seven states. That work helped strengthen defenses in those states, but it also laid bare what the program describes as the “intractable problem” of scaling a national security model for the roughly 150,000 water and wastewater systems across the country. The Water Watch Center is now expanding that test model to support water utilities that serve fewer than 10,000 residents, accounting for the vast majority of the nation’s water infrastructure. “DEF CON Franklin spent two years with volunteer hackers in the trenches with under-resourced water utilities analyzing data and testing hypotheses, many of which didn't work,” DEF CON founder Jeff Moss said in a statement. “The result is a truly innovative, grassroots public policy program that only the hacker community would have come up with,” he said. DEF CON Franklin, launched in 2024 and named after Benjamin Franklin, describes itself as a kind of cyber firefighting program that can address tech emergencies facing the nation’s critical infrastructure, including water systems and schools. The latest attacks have prompted an urgent public response from cybersecurity experts who have sounded the alarms about vulnerabilities in the nation’s infrastructure for years with little action from state and federal governments. Within recent weeks, “malicious cyber actors” infiltrated water systems and gained access to programs that monitor water pressure, chemicals and pumps, among other tasks, according to federal law enforcement agencies. Hackers appear to have remotely accessed “programmable logic controllers” that are connected to the internet. The FBI and Cybersecurity & Infrastructure Agency have urged utilities to disable internet access, set up strong passwords and revert to manual control, among other changes. The Operational Technology Cybersecurity Coalition said the attacks deserve more than a handful of alerts from federal agencies. “We must view this through a clear lens: an adversary has directly impacted a core American necessity,” the organization's executive director Tatyana Bolton wrote in an urgent appeal to members of Congress. In March 2023, the Environmental Protection Agency under then-President Joe Biden published a memo requiring states to work with local officials to identify potential weaknesses in their water systems that hackers could exploit. Attorneys general in three Republican-led states sued to block the policy, arguing that it exceeded the agency’s authority and unfairly placed the burden on improvements on cash-strapped states. The memo was later blocked by a federal appeals court, and the EPA then withdrew it. Since taking office, President Donald Trump’s administration has also gutted the cybersecurity agency tasked with responding to similar threats. The administration purged roughly one-third of the staff at the Cybersecurity & Infrastructure Agency, which has been villainized by the president and his allies over the agency’s past efforts to disrupt election disinformation. Sen. Adam Schiff of California, the top Democrat on a water panel inside the Senate’s Environmental and Public Works Committee, filed legislation this week that would authorize the EPA to work on water cybersecurity issues — an attempt to enshrine into law what the Biden administration tried to do three years ago. “These threats are not hypothetical — they are happening right now,” Schiff said in a statement Monday. “This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers,” he said. DEF CON Franklin’s program has meanwhile developed a “scalable cyber delivery model that has eluded water industry and national security officials to date,” according to Jake Braun, co-founder of DEF CON Franklin and former White House acting principal deputy National Cyber Director. With the program’s volunteer hacker army working alongside cybersecurity firms, “these folks walk in the door knowing the intricacies of cybersecurity in a water utility environment,” he said in a statement. Join our commenting forum Join thought-provoking conversations, follow other Independent readers and see their replies Comments [Image text:] mouth pPlymouth