When the Ostrogoths wanted to cripple Rome in 537, they destroyed its aqueducts. WATER IS A strategic vulnerability, a fact that is not news to military commanders. More recently, water infrastructure has been an important target in America’s conflict with Iran , despite international laws classifying such attacks as potential war crimes. Bahrain, Kuwait and the United Arab Emirates have had their own water plants struck by missiles, presumed to be from Iran.
In March Donald Trump threatened to “completely obliterate…possibly all” of Iran’s desalination facilities, which are essential to life in the country’s arid southern provinces. Iran says that one such facility was bombed on Qeshm island.
During the Biden administration the EPA sought to compel states to review and report cyber-threats to water systems. The Republican state attorneys-general in Missouri, Arkansas and Iowa, joined by the American Water Works Association (AWWA) and the National Rural Water Association (NRWA), a pair of industry groups, sued, citing federal overreach. After a federal court issued a stay on the EPA’s effort, the agency pulled back. When Congress has acted, measures have been minimal and slow to take effect. There may now be momentum to do more. This month DEF CON Franklin, a group of civic-minded hackers, teamed up with the NRWA to launch the Water Watch Centre, an initiative to provide private-sector cyber-security support to small utilities. Ms Klobuchar’s and Mr Schiff’s bill is not the only proposal under consideration. On August 5th the AWWA, which resisted the Biden administration’s proposals, endorsed the Water Risk and Resilience Organisation Establishment Act, sponsored by Rick Crawford, a Republican congressman from Arkansas. That bill would create an independent body to draft minimum cyber-security standards, under the EPA’s oversight, in a mirror of the requirement for electric utilities. The same day Tom Cotton, a Republican senator, wrote to Scott Bessent, the treasury secretary, urging changes to the tax code and other regulatory tweaks to encourage water plants to invest in better security. Whether Washington moves swiftly depends in no small part on Mr Trump. He has shown less interest in defending American water. The Cybersecurity and Infrastructure Security Agency, the main federal body tasked with cyber-defence, is in disarray, with leadership turmoil, low morale and a one-third cut in staff since Mr Trump returned to the White House. The Senate may push him to do more after it returns from recess. Hackers are not waiting.
The Cyber Incident Reporting for Critical Infrastructure Act was passed in 2022, obliging organisations in important sectors to report major cyber-attacks within 72 hours. The president’s proposed budget, which the Senate will take up in September, would increase the budget for the Department of War by 44%, to $1.5trn. His budget would cut the EPA’s biggest source of funds for water cyber-security by almost 90%.
Its rules are due to be finalised in September, more than four years on.
That includes money for the Iran war and a high-tech “Golden Dome”, to shield America from missiles. In July he suggested that fault for Minnesota’s attack lay with Tim Walz, the “corrupt” governor of the state—and that there had not been an Iranian attack at all. “Iran’s got bigger problems than worrying about Minnesota,” he offered.
Earlier efforts to impose cyber-security standards on this patchwork have largely failed.
