White House to soon launch water provider cyber protection program

The White House will soon unveil a program designed to help protect water infrastructure providers from cyberattacks, which comes as multiple states face hacking attempts on their water systems that some officials suspect may be tied to Iran, according to a person with knowledge of the plans.

The program, led by the Office of the National Cyber Director, would enlist a slew of private firms to help states with few cyber resources bolster their defenses against digital attacks on platforms that manage areas like water and wastewater transmission, said the person, who spoke on the condition of anonymity to communicate the plans.

The program could be announced next week and may begin in Texas to serve as a testbed for other states that request services. Politico first reported the White House’s plans.

Since around May, the White House has been discussing a slew of pilot programs for various critical infrastructure domains with the private sector, according to a second person with knowledge of those discussions, who said that it made sense for the water sector to be among those categories that would get assistance.

An ONCD spokesperson did not immediately return a request for comment. It’s not clear how many companies, or which companies specifically, would be involved in the efforts.

More than 30 community water systems in Minnesota were targeted late last month, according to state officials. Around 12 states have reported similar activity, though state officials said they continued operating safely and experienced no known effects on public health. The FBI and Cybersecurity and Infrastructure Security Agency are working on incident response.

Water systems are often the most underresourced forms of critical infrastructure in the cyberdefense landscape. Some industry groups have stepped up to provide assistance.

“When policymakers used to ask what systems I was most concerned about, my answer was always water,” Cynthia Kaiser, the FBI’s former cyber deputy director, told Nextgov/FCW. “The incidents from this summer have shown how much the water industry needs the assistance,” she added.

“I think this is a great step; however, we need to ensure that systems integrators for rural water utilities are looped in on deployments,” she advised, referring to providers that install equipment allowing utilities to manage their systems remotely. Several current and former officials have decried lax management of remote systems as a pathway that has let hackers get inside water infrastructure over the last several weeks.