Cyber threats to water sector infrastructure - White House issues urgent warning to US States

The White House has issued an urgent warning to all US states of continuing cyber threats to water sector infrastructure.

U.S. Environmental Protection Agency Administrator Michael Regan and National Security Advisor Jake Sullivan have sent a letter to all U.S. Governors inviting state environmental, health and homeland security Secretaries to a convening by their deputies to discuss the urgent need to safeguard water sector critical infrastructure against cyber threats.

The meeting, which took place on Wednesday this week, highlighted current federal and state efforts to promote cybersecurity practices in the water sector, discuss priority gaps in these efforts, and emphasize the need for states and water systems to take immediate action.

EPA Administrator Michael S. Regan said:

“Drinking water and wastewater systems are a lifeline for communities, but many systems have not adopted important cybersecurity practices to thwart potential cyberattacks.

“EPA and NSC take these threats very seriously and will continue to partner with state environmental, health, and homeland security leaders to address the pervasive and challenging risk of cyberattacks on water systems.”

National Security Advisory Jake Sullivan commented:

“The Biden Administration has built our national security approach on the foundational integration of foreign and domestic policy, which means elevating our focus on cross-cutting challenges like cybersecurity.”

“We’ve worked across government to implement significant cybersecurity standards in our nation’s critical infrastructure, including in the water sector, as we remain vigilant to the risks and costs of cyber threats. We look forward to continuing our partnership with the EPA to bolster the cybersecurity of America’s water and wastewater systems.”

The National Security Council (NSC) and EPA are encouraging all states to join the dialogue to drive rapid improvements to water cybersecurity and reinforce collaboration between state and federal entities and water systems.

Additionally, EPA said it will strive to collaborate with the water sector and Water Government Coordinating Councils in forming a Water Sector Cybersecurity Task Force to identify near-term actions and strategies to reduce the risk of water systems nationwide to cyberattacks.

In addition to considering the prevalent vulnerabilities of water systems to cyberattacks and the challenges experienced by some systems in adopting best practices, the Task Force will also seek to build upon existing collaborative products, such as the 2023 Roadmap to a Secure and Resilient Water and Wastewater Sector and recommendations stemming from the meeting with Environmental, Health and Homeland Security Secretaries.

Disabling cyberattacks are striking water and wastewater systems throughout the United States. The attacks, carried out by countries and criminals, have the potential to disrupt the critical lifeline of clean and safe drinking water, as well as impose significant costs on affected communities.

EPA is the lead federal agency for ensuring the nation’s water sector is resilient to all threats and hazards.

EPA and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) offer guidance, tools, training, resources, and technical assistance.

Cybersecurity support and technical assistance are also available from state programs as well as private sector associations like the American Water Works Association, the National Rural Water Association, and the Water Information Sharing and Analysis Center.