<p class="wp-block-paragraph">A cyberattack last month affected more than 30 Minnesota water systems and 11 other states, according to a government report. There are no reports of water contamination or human harm, but some utilities have reported pressure loss and flooding. The attack was severe enough that several municipal utilities disabled digital controls and switched to manual operations. Intelligence agencies and federal authorities believe that Iran-backed hackers are behind the attack, and a hacking group closely tied to Iran has claimed responsibility.</p>
<p class="wp-block-paragraph">There is broad agreement that U.S. water utility security controls are outdated and cannot keep pace with rapidly evolving cyber threats. A recent inspection by the Environmental Protection Agency revealed that roughly 70% of U.S. water systems failed to meet basic cybersecurity standards. Specific identified problems include unchanged default passwords, reliance on factory-set credentials that hackers can quickly find online, single shared logins, former employee accounts that remain active, and failure to immediately cut off network access upon threat detection, among others.</p>
<p class="wp-block-paragraph">Local water utilities struggle to address such threats alone, given their small scale and limited resources. The Bureau of Labor Statistics estimates there are about 51,700 water and wastewater treatment plant and system operators in the United States. More than half have only one or two employees, while roughly 85% have three or fewer staff members, who must perform a variety of tasks. Many are also rural, rely on a single part-time certified operator, and are small enough to be viewed as “micro-systems.”</p>
<p class="wp-block-paragraph">Many municipal governments face serious budget shortfalls. With pandemic-era federal relief funds expiring, sluggish revenue growth, and rising operational costs, adequately confronting global cyber threats may seem challenging.</p>
<p class="wp-block-paragraph">A set of new policy approaches can help bring local governments’ cyber systems up to cutting-edge standards with minimal cash outlay. First, municipalities that own most U.S. water systems should contract with private-sector partners with the technology, capital, and expertise to confront evolving cybersecurity threats. Such contracts should include bringing security systems up to global standards and longer-term maintenance to ensure system protections remain effective.</p>
<p class="wp-block-paragraph">Owners must also be knowledgeable about future-proofing, which involves drafting contracts that recognize future risks and clearly assign responsibilities. A future-proofed cyber contract can place the risk of not adopting the latest cyber protections on a private partner better positioned to address it.</p>
<p class="wp-block-paragraph">Second, municipalities should seek opportunities to bundle cyber contracts with other similarly situated asset owners. Many municipalities are likely to face similar technological challenges, suggesting that dozens or even hundreds of systems can band together to secure services at scale.</p>
<p class="wp-block-paragraph">Larger-scale contracts can be better designed and will attract a larger set of skilled global bidders, making them more competitive. The Pennsylvania Rapid Bridge Replacement program, which bundled together and successfully replaced 558 structurally deficient, mostly rural bridges across the state, serves as a model. What would have taken years to bid out individually was consolidated into a $1.12 billion public-private partnership to replace Pennsylvania’s bridges more quickly.</p>
<p class="wp-block-paragraph">Third, municipalities should explore value-capture arrangements to help fund enhanced cybersecurity. Many U.S. water systems are old and inefficient, but there is potential for improvement. For example, many old water systems rely on settling ponds, which are large, man-made pools used to remove solid waste from water and wastewater. The ponds release natural gas, which can be captured in a modern digester and used to generate electricity. Such a value-capture deal, conducted with a private-sector partner, can convert waste gas into electricity while generating a new revenue stream for the municipality. The cost of installing and maintaining the technology can be covered by sharing that new revenue, which can be used to enhance cybersecurity.</p>
<p class="wp-block-paragraph">The thousands of small public entities that own and operate U.S. water systems may lack the expertise necessary to face cyber threats alone or to properly execute such innovative public-private arrangements. A new type of quasi-public entity, known as a public-private partnership unit, can assist numerous municipalities in executing these steps at scale.</p>
<p class="wp-block-paragraph">The damage from this wave of cyberattacks was minimal, but future attacks could leave millions of Americans vulnerable to threats against their water supply. It is important to adopt new policy approaches that will protect critical water systems from cyber threats.</p>
<p class="wp-block-paragraph"><em>R. Richard Geddes is a Nonresident Senior Fellow at the American Enterprise Institute, a professor in Cornell’s Jeb E. Brooks School of Public Policy and the Founding Director of the Brooks Center for Infrastructure Policy. His research focuses on infrastructure technology and policy.</em></p>