A policy response to cyber attacks against key US infrastructure
The war with Iran has come for U.S. infrastructure. A cyberattack last month affected more than 30 Minnesota water systems and 11 other states, according to a government report. There are no reports of water contamination or human harm, but some utilities have reported pressure loss and flooding. It was sufficiently severe that several municipal utilities disabled digital controls and switched to manual operations. Intelligence agencies and federal authorities believe that Iran-backed hackers are behind the attack, and a hacking group closely tied to Iran has claimed responsibility.
TL;DR
- A cyberattack, believed to be Iran-backed, recently affected over 30 Minnesota water systems and utilities in 11 other states.
- Many US water systems have outdated cybersecurity controls, with about 70% failing basic standards, including issues like default passwords and active former employee accounts.
- Small, often rural, water utilities struggle with limited resources and staff to address complex cyber threats.
- Proposed policy solutions include contracting with private-sector partners, bundling cyber contracts among municipalities for economies of scale, and exploring value-capture arrangements to fund security upgrades.
- The article suggests that quasi-public entities, or "PPP Units," could help municipalities implement these large-scale security solutions.