In late July, the Federal Bureau of Investigation received reports of cyberattacks on water facilities from utility companies in at least seven states in the United States.
One of those attacks, in Braham, Minnesota, a city of around 1,800 people, affected the functioning of a pump at a water treatment plant and threatened the water supply. Public works crews in the city quickly and impressively isolated the system, restored a backup, and had the water plant back up and running in around 90 minutes, according to Nate George, the mayor of Braham.
While this ad hoc response worked this time, much more is needed to make America truly resilient to hybrid attacks by malicious actors on the critical infrastructure that Americans depend on every day for water, power, healthcare, and financial transactions.
In April, the U.S. Cybersecurity and Infrastructure Security Agency issued a warning saying that Iranian-backed groups are targeting America’s critical infrastructure, including water systems. More capable adversaries of America, China and Russia, are also actively targeting critical infrastructure in the United States, according to U.S. officials.
President Donald Trump said he does not believe that Iran is behind these most recent cyberattacks. Unnamed U.S. officials reportedly believe that Iran-backed groups are the likely culprits but also caution that the findings are preliminary and that there is a chance that the attackers may be impersonating Iran to stoke tensions.
Meanwhile. the Trump Administration has been gutting U.S. cybersecurity capabilities, cutting roughly a third of the federal cyber agency’s workforce at exactly the moment small utilities need it most. A new approach is needed. Washington needs a whole-of-society, resilience-based approach to deter and defend against these increasing hybrid threats to the American homeland.
Washington can learn a lot from its European allies. Europe has spent decades hardening its systems through a whole-of-society effort it calls “total defense.” Finland and Estonia are especially instructive examples. Finland runs a national supply agency that holds reserves of fuel, grain, and medicine and rehearses shortages alongside the private companies that would actually have to manage them.
Estonia fields a volunteer cyber unit within its Defense League, a militia under the command of its defense ministry. The volunteers are civilians with day jobs who train with the state and show up when attackers strike. They run exercise programs built around cyber resilience, information sharing, and public-private partnerships.
So what does Washington need to do to harden America’s water systems and other critical infrastructure? First, America needs to broadly embrace a whole-of-society “total defense” approach to homeland security, adopting and adapting innovative ideas from partners and allies.
More specifically, policymakers can take three specific steps now that will help prepare for, and perhaps deter, the next attack. First, they should renew the State and Local Cybersecurity Grant Program, a small grants program for states that helps build state and local level cyber defenses. The program has already lapsed once and now runs on year-to-year extensions, which is no way to fund a defense. Make it permanent and carve out a sizable share for water.
Second, Washington should set a response floor for water municipalities and measure it in hours. Electric utilities operate under binding federal cyber standards backed by real financial penalties. Water utilities have no equivalent, and the Environmental Protection Agency currently has no authority to impose one. Congress should give it a narrow version: every system above a modest size must be able to run manually for 72 hours and must prove it in an annual drill. This is not a technology mandate; it is a time standard, and it is the only number that matters once the pumps stop. Braham did it in 90 minutes. That should be the benchmark.
Finally, the U.S. needs to build the bench. There are roughly 50,000 small water systems in this country, and most have no dedicated IT staff at all. No grant program can hire its way out of that. Governors can act tomorrow with authorities they already have: cyber teams in the National Guard on standing state active duty orders, tied to a water mutual aid compact modeled on the one power companies use to restore each other’s lines after hurricanes. When a plant serving 1,800 people gets hit at two in the morning, somebody should already have the phone number.
A country that can afford 11 aircraft carriers can afford to teach 50,000 water operators to turn a valve by hand. Resilience is not a consolation prize for failed deterrence. By forcing an adversary to think twice about whether an operation will succeed, resilience is deterrence.
