In the wake of a spate of cyberattacks against municipal water systems in multiple US states, suspected to have been perpetrated by Iran, US officials are pushing to pass legislation aimed at fixing vulnerabilities that leave the infrastructure vulnerable to hacks.
California Senator Adam Schiff, the top Democrat on the Environmental Protection Agency’s (EPA) water panel, and Minnesota Senator Amy Klobuchar on Monday unveiled the Water Cyber Shield Act, a bill intended to fortify drinking water and wastewater systems.
The proposed legislation follows numerous warnings from the EPA itself in addition to the US Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Government Accountability Office (GAO).
On July 22, days before a suspected Iranian cyberattack targeted over 30 municipal water systems in multiple states, US government agencies updated an April advisory emphasizing the growing threat of Iran-affiliated hacks on internet-connected systems.
In the advisory, the FBI, CISA, and US National Security Agency (NSA) noted previous incidents in which cyber threat actors linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) similarly targeted US infrastructure, drawing a connection between the water systems hacks and earlier cyberattacks.
The FBI posited that Iran-affiliated cyberattacks increased, likely in response to ongoing hostilities between Washington and Tehran.
Cyberattack could tamper with drinking water, cause contamination
The consequences of a mass cyberattack on drinking and wastewater infrastructure could be significantly harmful to public health, according to a GAO report on the matter. If systems that monitor and control water treatment were tampered with by malicious actors, drinking water could be contaminated with unsafe levels of bacteria or chemicals.
Aging water infrastructure paired with a lack of federal cybersecurity oversight, according to Schiff and Klobuchar, exacerbate vulnerabilities in increasingly automated, internet-connected water systems.
The Water Cyber Shield Act, if passed, would expand the EPA’s authority to conduct cybersecurity assessments and mandate corrective action when cybersecurity gaps are found.
It would also allow the EPA to establish enforceable baseline standards for the cybersecurity of drinking water and wastewater systems, with $300 million in funding allocated to bringing vulnerable systems into compliance with the standards.
Under the proposed bill, large drinking water and wastewater systems would additionally be required to integrate cybersecurity threats into their already existing risk and resilience planning.
EPA previously prevented from mandating cybersecurity measures
While the EPA is the federal body responsible for risk management in the water sector, it was previously prevented from mandating cybersecurity measures.
In 2023, the EPA was forced to withdraw a memorandum addressing cybersecurity issues after multiple US states sued the agency, arguing that the EPA did not have the authority to enforce the proposed guidelines.
Click Here For The Original Source.
