The governors’ water letter handed one problem to three state secretaries

The week

In the week of March 18, 2024, two of the most senior officials in the federal government wrote to every governor in the country to say that the computers running the nation’s water systems were under attack. Turn on a tap anywhere in the United States and you are relying on a chain of pumps, valves and chemical dosing equipment that, increasingly, is run by small computers.

The letter, dated March 18 and released by the Environmental Protection Agency (EPA), came from EPA Administrator Michael Regan and National Security Advisor Jake Sullivan. Its message was blunt: disabling cyberattacks were striking water and wastewater systems throughout the country.

It gave two examples. The first involved actors affiliated with Iran’s Islamic Revolutionary Guard Corps, a branch of Iran’s armed forces, attacking Unitronics controllers left with default passwords. A controller is a small, rugged industrial computer that directly operates equipment, for instance turning a pump on when a tank runs low. A default password is the one set at the factory, often printed in the manual and easy to find online; leaving it unchanged lets in anyone who bothers to look it up.

Those attacks had become public four months earlier. On November 25, 2023, the Municipal Water Authority of Aliquippa, in western Pennsylvania, found that a Unitronics controller at one of its booster stations had been tampered with. The intruders defaced its screen with an anti-Israel message, and operators switched the station to manual control. A joint advisory from the FBI, CISA, NSA, EPA and Israel’s National Cyber Directorate followed. It attributed the campaign to an IRGC-affiliated group calling itself CyberAv3ngers. It said the targeted controllers were likely reachable from the internet and still protected by the vendor’s default password.

The second example was Volt Typhoon, a Chinese state-sponsored hacking group, and its pre-positioning in critical infrastructure. Pre-positioning means getting inside systems and staying hidden, ready to cause damage later rather than now. A joint advisory in February 2024 had described the group’s access to the information technology of water, energy, transportation and communications organizations. The letter repeated its most serious line: federal agencies assessed with high confidence that the group was positioning itself to disrupt critical infrastructure in the event of a conflict with the United States.

The letter asked states to ensure that all water systems assess their cybersecurity, deploy controls and exercise incident plans, which meant checking where they were weak, fixing the most important things and practicing what to do if attacked. It noted that even basic precautions, such as resetting default passwords and updating software, were often missing.

It pointed states to help that already existed. CISA, the federal Cybersecurity and Infrastructure Security Agency, kept a list of actions for water utilities. EPA and CISA offered tools, training and technical assistance. The American Water Works Association, the National Rural Water Association and the Water Information Sharing and Analysis Center offered support from the private side. The letter described each state’s homeland security advisor as a resource with links into federal cybersecurity efforts.

It also said each state’s environmental, health and homeland security secretaries would be invited to a meeting with federal officials. And EPA would form a Water Sector Cybersecurity Task Force with the sector’s coordinating councils, the bodies through which industry and government already work together on infrastructure protection. The task force was to identify the most significant vulnerabilities, the obstacles utilities faced, and near-term and longer-term actions.

The closing paragraph carried a hint of pressure. The White House and EPA hoped these efforts would protect water systems and prevent the need to use other federal authorities. The letter did not say which authorities it meant.

There was an awkward backdrop. EPA had issued a memo in March 2023 telling states to evaluate cybersecurity during sanitary surveys, the routine inspections of drinking water systems. Missouri, Arkansas and Iowa challenged it in the Eighth Circuit in April 2023, and the American Water Works Association and the National Rural Water Association joined the fight. The court stayed the memo in July. EPA withdrew it on October 11, 2023, saying states could still review cybersecurity voluntarily. Five months later, the federal government was asking for help instead.

One federal requirement did remain in force. Under America’s Water Infrastructure Act of 2018, community water systems serving more than 3,300 people must assess their risks and resilience, including cyber risks, and certify emergency response plans to EPA. Those certifications go to EPA directly, not through the states. The letter did not mention them, but they would shape what came next.

Commentary on the letter focused on the federal side, an agency that had lost a legal fight asking for voluntary help, and on the municipal side, where small utilities lack people, money and mandates.

The letter’s address list pointed to a third layer, state government, and it is the one a governor could change fastest. By inviting three secretaries, Washington acknowledged that no single state office owned water cybersecurity. Each of the three holds a different lever. The regulator has routine contact with every system. The funder controls money utilities can spend on security. The responder acts when an attack lands.

The sections below start with what is actually at risk inside a water system. They then take the three levers in turn: the regulator, the funder and the responder. Two further sections follow the levers working together and set out what a governor has at stake. The last two describe the single owner the letter implied and the questions a state should be able to answer.

What is actually at risk in a water system

Most people think of cybersecurity as protecting information: emails, customer records, bank details. Water systems have that kind of computing too, in billing and office systems. But the more serious risk lies in what engineers call operational technology, or OT. This is the computing that controls physical things: pumps, valves, motors, chemical feeds.

At the bottom of an OT system are controllers, like the Unitronics devices named in the letter. Each one watches a few sensors and operates a few pieces of equipment according to a small program, its logic. Above them, operators use screens that show the state of the whole plant and let them adjust settings. Together, this is often called a control system.

The controllers are like a building’s thermostats, and the operator screens like the central panel in the building manager’s office. If a stranger can reach the thermostats from the street, they can make the building uncomfortably hot or cold. In a water plant, the equivalent can mean pumps stopping, tanks overflowing, or chemical levels drifting.

Three weaknesses come up again and again, especially at smaller utilities:

• Default passwords, never changed after installation, as in the Unitronics attacks.
• Devices reachable from the internet, often connected for convenience so a contractor or operator can check them remotely, and then forgotten.
• No offline backup of controller logic, so if an attacker wipes or alters a device’s program, the utility has nothing clean to restore from.

These weaknesses are ordinary, which is good news: the fixes are mostly cheap and well understood. The hard part is getting those fixes to thousands of small systems that have little money, few staff and no security specialist.

How the Unitronics intrusions worked

The attacks the letter described needed no advanced tools. The affected devices were Unitronics Vision Series controllers, which combine the controller and a small operator screen in one unit. Integrators often installed them with remote access enabled, so they could adjust settings without a site visit.

The sequence was short. An attacker found devices exposed to the internet, which public scanning services make easy. The attacker then connected using the vendor’s software and tried the default password. Where it worked, the attacker could change the screen, alter the program or stop the device.

At Aliquippa the visible damage was a defaced screen and a station run by hand for a time. The more serious lesson for operators was what the attackers could have done instead. Anyone able to deface the screen could also have changed set points, the target values a controller tries to maintain, such as a tank level or a chemical dose.

Why Volt Typhoon called for a different defense

Volt Typhoon worked differently. According to the February 2024 advisory, the group gained access to ordinary office networks, often through internet-facing network devices. It then used legitimate administrative tools already present on those systems, a technique known as living off the land. Because nothing malicious was installed, ordinary antivirus software had little to find.

The defense against that kind of intruder is visibility rather than a single fix. A utility needs logs of who signed in, from where and with what privileges, kept long enough to review. It also needs someone to look at them, and a clear boundary between the office network and the control network so that a foothold in one does not open the other. A small utility with no security staff can rarely provide any of these on its own. That is one reason the letter’s two threats pointed toward shared state services rather than utility-by-utility effort.

Water systems do not all face the same rules

The word “utility” covers very different organizations, and the rules differ with them. Community water systems serving more than 3,300 people fall under the federal risk and resilience requirement in the Safe Drinking Water Act. Smaller community systems, which are the large majority by count, do not. Schools, campgrounds and factories that run their own wells are regulated as public water systems but face no cyber assessment duty at all.

Wastewater is regulated under the Clean Water Act, which has no equivalent cyber assessment requirement. Yet a wastewater plant’s pumps and controllers are exposed in the same ways, and a failure there can foul rivers and drinking water intakes downstream.

Ownership varies too. Many systems are municipal departments that answer to a city council. Others are special districts or authorities, like Aliquippa’s, with their own boards. Investor-owned utilities answer to a state public utility commission on rates. Systems on tribal lands generally deal with EPA directly. Each type has a different budget process and a different person who can say yes to a security project.

The regulator: routine contact with every system

Every state but Wyoming has primacy for drinking water, so a state agency runs the federal program day to day. Primacy is the term for a state taking on primary responsibility for enforcing federal drinking water rules within its borders. In some states that agency sits in the environmental department. In others it sits in health. Either way, its staff visit water systems on a regular cycle for sanitary surveys, review operator certification and track compliance.

That contact is the most valuable asset in the whole system. It reaches the small systems that never call CISA, the federal Cybersecurity and Infrastructure Security Agency, or join an information-sharing center. A town of a few thousand people may never have heard from a cybersecurity agency, but it will certainly have met its state drinking water inspector.

EPA’s 2023 memo had tried to use that channel by requiring cybersecurity in sanitary surveys. After the memo was withdrawn, states remained free to add cybersecurity questions on their own authority.

A state regulator can act without new law in several ways. Inspectors can carry a short, nonbinding cybersecurity checklist:

• Default passwords changed.
• No controllers reachable from the internet.
• Remote access documented.
• Backups of controller logic held offline.

The results can feed a statewide register of exposed systems. Operator certification training can add a module on control-system security. Where state law allows, the regulator can make cyber findings a condition of follow-up visits.

The trade-off is staffing. Sanitary survey inspectors are engineers and scientists, not security specialists. A checklist they can complete during a routine visit is more useful than an assessment they cannot perform. Questions that need judgment should go to a state or shared-service specialist, with the inspector’s answers as the starting point.

One inspection at a two-operator utility

Take a rural utility serving a small town, with two operators and one part-time office manager. Its treatment plant was upgraded some years ago by an outside integrator, the contractor who installs and configures control equipment, and nobody on staff has logged into the controllers since.

On a routine sanitary survey, the state inspector works through the four-item checklist with the lead operator. They find that the controller passwords were never changed from the factory settings, that the integrator set up remote access so it could troubleshoot, and that there is no copy of the controller programs anywhere but on the controllers themselves. No rule has been broken, but the findings go into the state register, and the utility now knows what to fix. A short call with a shared-service specialist follows. The visit cost the state almost nothing extra.

What a state can require, and what it cannot

The 2023 litigation was largely about process. The challengers argued that EPA had imposed a new obligation through a memo, without the notice-and-comment rulemaking that federal law requires for binding rules. A state that wants inspectors to ask cybersecurity questions faces a similar choice under its own administrative law.

A nonbinding checklist, framed as technical assistance, generally needs no rulemaking. A finding that triggers a deficiency, a required corrective action plan or a penalty probably does. The difference matters for timing. A checklist can start next quarter. A binding requirement may take a year or more of drafting, comment and legislative review, and may draw the same opposition EPA met. Agencies should check their own authority with counsel before treating cyber findings as violations.

The federal requirement adds a useful hook without adding state work. Because larger systems certify risk and resilience assessments to EPA directly, an inspector can ask a simple question: has the system certified, and does its assessment cover the control system? A “no” is information the state can pass to EPA or to the funder. The inspector does not have to judge the quality of the assessment.

Handling the register

A statewide register of exposed control systems is valuable, and it is also a map for an attacker. Before collecting the data, the state should settle three things. It should decide who holds the register and who may read it. It should confirm whether its public records law shields security information of this kind, and seek an exemption if not. It should set how long entries are kept and how they are closed once a fix is confirmed.

The register also needs a small set of measures that a legislature can follow. The obvious ones are the share of systems that have completed the checklist, the number of internet-exposed controllers found, and the median time from finding to fix. Trends in those numbers tell a governor more than any single assessment.

The funder: money a utility can actually spend

Two federal streams reach water systems through state hands, and they sit in different offices.

The Drinking Water State Revolving Fund is run by the state environmental or health agency, sometimes with a separate finance authority. A revolving fund lends money for infrastructure, and as loans are repaid, the money is lent again. According to EPA, its set-asides, portions reserved for specific purposes, can pay for cybersecurity assessments and planning, and its loans can finance control-system upgrades.

The State and Local Cybersecurity Grant Program, created by the 2021 infrastructure law, is run through a state administrative agency, usually homeland security or emergency management. Utilities generally reach it through a city or county sub-award tied to the state’s cybersecurity plan. A sub-award is a portion of a grant passed on from the state to a local government.

Neither stream was designed with small water systems in mind. Revolving fund priority lists favor pipes and treatment, scored on public health criteria where cyber projects rarely rank. Cybersecurity grant committees often focus on county networks and election systems. A utility manager would need to know both programs exist, which office runs each, and how to apply. For the office manager at a utility like that one, already juggling billing and compliance paperwork, that is a lot to ask.

A governor can fix that with coordination rather than new money:

• The two program offices can agree on a common eligibility statement for water cyber projects, so a utility hears one consistent answer about what qualifies.
• The revolving fund can add a cybersecurity scoring factor, so cyber projects can compete on priority lists.
• The grant committee can reserve part of its local pass-through for shared services that utilities use, such as managed monitoring (an outside service that watches systems for signs of attack) or vulnerability scanning (automated checks for known weaknesses).
• Contracts funded this way should require that integrators remove default credentials and hand over configuration backups.

The last point is easy to overlook and especially valuable. It turns every publicly funded upgrade into a chance to close the most common weaknesses, at the moment when a contractor is already on site.

How the money actually moves

The revolving fund works through set-asides and loans. Federal law lets a state reserve parts of each capitalization grant for specific purposes, including technical assistance to small systems, state program management and local assistance. Those set-asides can pay for assessments, training and planning without a utility taking on debt. Loans, and principal forgiveness for disadvantaged communities, can pay for physical upgrades such as replacing controllers or segmenting networks. Wastewater systems reach comparable money through the Clean Water State Revolving Fund, usually in the same environmental agency.

The cybersecurity grant program works through planning. Each state had to form a cybersecurity planning committee and submit a cybersecurity plan for federal approval. The 2021 law authorized about $1 billion over four fiscal years, required states to pass most of it to local governments, set aside a share for rural areas and required a non-federal cost share. A water system that is a city department can benefit through its city. A special district or investor-owned utility may not qualify as a local government under the program at all.

Capital money for an operating problem

Both streams fit capital projects and one-time efforts better than ongoing costs. Much of what keeps a small utility safe is an ongoing cost: monitoring, patching, staff time and annual training. A grant that buys a monitoring subscription for two years leaves the utility with a bill it cannot pay in year three.

Shared services soften that problem. When a state or regional body runs monitoring for many utilities, the cost per utility falls, and the state can budget for it as a standing program. The trade-off is control. A municipal utility board may be reluctant to let a state agency watch its networks, and some states’ home-rule traditions make that a political question as well as a technical one.

Investor-owned utilities raise a different issue. Their security spending is recovered through rates set by the public utility commission. A commission that treats cybersecurity as a prudent expense makes it easier to fund. One that questions it in a rate case makes it harder. That makes the commission a fourth office in some states, worth bringing into the conversation even though the letter did not name it.

What the integrator contract should say

When public money pays for control-system work, the contract can require basic hygiene at handover:

• All factory and integrator passwords changed, with new credentials delivered to the utility and not retained by the contractor.
• No controller or operator screen reachable directly from the internet.
• Remote access, if needed, through a method the utility controls and can switch off.
• A current copy of every controller program and configuration, stored offline, plus a simple network diagram.
• A named contact and a commitment to notify the utility of security flaws in installed products.

The responder: who acts when an attack lands

The third lever rests with homeland security and emergency management. State homeland security advisors receive federal threat information, including classified briefings, that utilities do not see. Many states run fusion centers, hubs where federal, state and local agencies share threat information, and several have National Guard cyber units that can support local governments when the governor activates them.

For a small utility hit by an attack, the practical question is whom to call in the first hour. If the answer is the integrator who installed the controllers, the state has no visibility. If the answer is a state hotline that routes to an incident team, the state can help and can warn other systems running the same equipment.

The Unitronics attacks showed why that matters, because the same device and the same default password were exposed at many sites. One utility’s report, routed to the right place, can become a warning to dozens of others before they are hit.

States can make this concrete:

• Add water and wastewater to the state cyber incident response plan with named contacts.
• Include utilities in state exercises.
• Agree in advance with the regulator how a cyber incident that affects treatment will be handled, since it is both a security event and a public health event.
• Pre-arrange Guard support terms so activation is not negotiated during the incident.

The first hour at a small plant

For an operator who sees a controller behaving oddly, the first hour follows a short sequence. Safety comes first: switch affected processes to manual operation if staff can run them safely, and confirm water quality. Next, disconnect any remote access path the attacker might be using. Then preserve what the device shows, by photographing screens and noting times, before anyone wipes or reloads it.

Only after that should the utility restore the controller from a clean backup. Restoring too early destroys evidence that could help others. Waiting too long keeps the plant on manual operation, which strains a small staff.

The call list matters as much as the steps. A utility should know in advance whom it reports to: the state contact, CISA, the FBI field office and EPA. Many states also have a Water/Wastewater Agency Response Network, a mutual aid arrangement that can lend operators when a utility is stretched. If treatment is affected, drinking water rules on public notice apply, and the most urgent notices must go out within 24 hours.

Reporting lines that already exist

The responder’s job is partly to connect channels that already run in parallel. Utilities may report to CISA, the FBI, EPA, the Water ISAC or their state, and each recipient sees a fragment. Federal law was also moving. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 directed CISA to write mandatory reporting rules, and the proposed rule appeared in April 2024, weeks after the letter. A state that already collects reports from its utilities is better placed to fold in any federal requirement when it arrives.

Whole-of-state services

Some states had already built security services for local governments through the state chief information officer, such as shared monitoring, incident response retainers or vulnerability scanning. Extending those to water utilities is often cheaper than building something new. The obstacle is usually trust and governance rather than technology. A utility needs to know what the state will see, who can act on it, and whether participation could expose it to liability. A short written agreement covering those points tends to do more than another round of outreach.

How the three levers work together: a scenario

The case for connecting the three offices is easiest to see by following one hypothetical state through two versions of the same year.

Version one: three offices, no connection. The drinking water program, housed in the health department, adds a few cybersecurity questions to its inspections on its own initiative. Inspectors note problems at dozens of small systems, but the findings sit in inspection reports that nobody outside the program reads. The revolving fund, run from a separate finance office, keeps ranking projects on public health criteria, and no cyber project makes the cut. The homeland security office runs the cybersecurity grant through counties, which spend most of it on their own networks. When a small utility’s controllers are tampered with one weekend, its operators call the integrator who installed them. The state hears about it days later, from the news. Other utilities using the same equipment get no warning.

Version two: one person connecting the three. The governor names a senior official, perhaps in the governor’s office or the homeland security office, to coordinate water cybersecurity across all three departments. Inspectors use the same short checklist, but now the results go into a shared register. The register shows the funder which systems most need help, and the revolving fund adds a cyber scoring factor so those projects can compete. The grant committee sets aside part of its local pass-through for a shared monitoring service that small utilities can join. Every funded upgrade contract requires default passwords to be changed and backups handed over. Utilities are given one state number to call, written into the state incident plan.

When the same weekend tampering happens, the operator calls the state number. The incident team helps restore the controllers from the backup the integrator handed over. Because the register shows which other systems use the same device, the homeland security office warns them by Monday morning. The health department, already briefed under the pre-agreed arrangement, decides quickly whether any public notice is needed.

Nothing in version two required new legislation or a large new budget. Every step used authority and money the three offices already had. The difference was a person whose job was to make the pieces fit, and a few agreements written down in advance.

This is also why the letter’s address list was so revealing. Federal officials could invite three secretaries to a meeting. They could not make those secretaries work as one. Only a governor could do that.

Version two also changes what the state can measure. It can report how many systems were checked, how many exposures were closed, how long fixes took, and how many utilities have tested their incident contacts. Those are the figures a legislature or an inspector general would ask for after an incident. Version one could produce none of them, because no office held all the pieces.

The costs of version two are real, if modest. Someone has to own the register and keep it current. The funder has to rewrite scoring criteria and defend them to applicants who lose points. The responder has to answer the phone on weekends. Each of these costs something, but each draws on staff and programs the state already pays for. The largest new expense is usually the shared monitoring service, and even that replaces scattered spending that would otherwise happen utility by utility, with less to show for it.

What a governor has at stake

Water is not like most services government provides. If a permit office closes for a day, people are inconvenienced. If a water system cannot treat or pump water safely, the effects reach hospitals, schools, businesses and every household, and they arrive quickly.

For a governor and senior state officials, the stakes include:

Public health. Treatment failures can lead to boil-water notices or worse. The regulator and the health department are directly accountable.

Public trust. Few things shake confidence in government like doubts about whether tap water is safe. An attack that is handled quickly and openly is very different from one that leaves residents uncertain for days.

Money. Federal funds already flow through state offices. Spending them in a coordinated way costs little; spending them in silos leaves the most exposed systems unfunded.

Accountability. After any serious incident, legislators, the press and residents will ask who in state government was responsible. “Three different departments, none in charge” is a hard answer to defend.

The way to get there differs by state. Where the drinking water program is in the health department, the health secretary is both regulator and the official accountable for any boil-water notice. That makes health the natural partner for the responder. Where it is in an environmental department, health may be a step removed, and the coordinating official has to bring it in deliberately.

States with strong county governments may route funding and response through counties. States where municipalities hold most authority may need agreements with each large city. States with many investor-owned utilities need the public utility commission at the table. The structure of the solution should follow the structure of the state, not a federal template.

One official, three levers

Each lever works only if the others are connected. Inspectors find exposed controllers, the funder pays to fix them, and the responder knows which systems are weakest. Few states had one person with authority across all three. The letter could not appoint one. A governor could.

A well-organized state has a single named official coordinating the three offices, an inspector checklist feeding a statewide register, funding rules that let cyber projects compete and that require contractors to close basic gaps, and an incident plan in which every utility knows whom to call.

The usual failures:

• Waiting for a federal mandate that may not come, rather than using authority states already have.
• Turning inspectors into auditors, asking for assessments they are not trained to perform instead of a short checklist.
• Leaving funding in silos, so utilities face two offices, two sets of rules and no clear path.
• Paying for upgrades without contract conditions, so new equipment arrives with the same default passwords.
• Leaving utilities out of state incident plans, so the first call goes to a contractor and the state learns late, if at all.

The case against a single coordinator

There are serious objections to this approach, and they deserve an answer.

The first is that a coordinator without budget authority is a title, not a lever. That risk is real. A coordinator works when the governor makes clear that the three secretaries will report on shared measures, and when the coordinator can escalate disputes to the governor’s office. Without that backing, the role fades within a year.

The second is that this is a federal problem and should have a federal answer. A national mandate would be cleaner and would avoid fifty different approaches. But the 2023 memo showed how hard that was to deliver, and a state cannot wait for Congress to act. State action also reaches the small systems that federal rules exempt.

The third is that the real answer for very small systems is consolidation. Merging or regionalizing small utilities gives them shared staff and shared security. That is a sound long-term view, and many states encourage it. It takes years and depends on local politics, while the exposed controllers are online today.

The fourth is liability. A state that checks utilities and runs a register may be blamed if one of them is attacked. Counsel should look at this. A state that knows about exposures and does nothing is in a weaker position than one that asked, recorded and helped.

Evidence a legislature or auditor would ask for

After a serious incident, oversight bodies will ask for documents rather than assurances. A prepared state can produce the designation of the coordinating official and the agreement among the three departments. It can also produce the inspection checklist, the register with dates, the scoring criteria for cyber projects, sample contract clauses and the incident plan. Exercise records showing which utilities took part complete the set. Assembling that file before an incident costs little. Assembling it afterward, under scrutiny, is far harder. It also tends to reveal gaps, such as a utility nobody contacted or a contract signed without the clauses, while there is still time to fix them.

Where a state’s water defenses are thin

1. Who in state government is responsible for water cybersecurity, across regulation, funding and response? If the answer is three people, who brings them together?
2. Do our drinking water inspectors ask any cybersecurity questions on routine visits? What happens to the answers?
3. Can a small utility find out, in one place, which state funds it can use for cybersecurity and how to apply?
4. When we fund control-system upgrades, do contracts require default passwords to be changed and backups handed over?
5. If a small utility is attacked tonight, whom does it call first, and how quickly would the state know?

With hindsight

The warning proved accurate. In May 2024, EPA issued an enforcement alert on drinking water cybersecurity. It said more than 70 percent of systems inspected since September 2023 did not fully comply with the risk and resilience requirements in Section 1433 of the Safe Drinking Water Act. It also said EPA had taken more than 100 enforcement actions under that section since 2020, and that inspections would increase.

The alert described what inspectors kept finding. Default passwords had not been changed. Staff shared a single login. Former employees still had access. Many assessments left out the resilience of the system’s own cybersecurity. Those were the same basic gaps the letter had named, now found at systems already subject to a federal rule. EPA added that where vulnerabilities posed an imminent and substantial danger, it could use its emergency powers under the same law.

The federal framework shifted around the letter as well. In April 2024, a new national security memorandum on critical infrastructure replaced Presidential Policy Directive 21, the document the letter had cited for EPA’s role. EPA remained the lead federal agency for water. The basic arrangement, a federal agency with limited authority relying on states and utilities to act, did not change.

The incidents followed. In September 2024, Arkansas City, Kansas, moved its water treatment plant to manual operations after a cyber incident. Manual operation means staff running equipment by hand rather than through the control system: possible for a time, but slower and more demanding. In October 2024, American Water, the largest investor-owned water utility in the country, disclosed a cyberattack on its systems. Its securities filing said it had disconnected or deactivated certain systems, and that it did not believe its water or wastewater facilities had been harmed.

Together, the two cases covered both ends of the sector. One was a small city running its own plant. The other was a large company with professional security staff. Neither fit the comforting idea that only neglected systems were at risk. In December 2024, EPA and CISA published a fact sheet warning that internet-exposed operator screens could let unauthorized users view and change real-time settings. That was the Aliquippa problem again, a year on.

The most concrete state answer came from New York, where the health and environmental conservation departments developed cybersecurity rules for drinking water and wastewater systems, paired with state grant funding. The split between two departments mirrored the letter’s address list. It also showed that a state could act where federal authority had stalled.

The federal capacity the letter leaned on proved less stable than it looked in 2024. CISA’s workforce shrank substantially in 2025, and the original four-year authorization of the State and Local Cybersecurity Grant Program ran through fiscal 2025. States that had treated federal help as a permanent backstop had to plan around a thinner one. That strengthened the case for state ownership the letter implied.

Some of the argument held up less well. The letter, and this article’s reading of it, put weight on states using authority they already had. The most visible state responses, like New York’s, came from departments acting within their own remits rather than from a new owner across regulation, funding and response. A single owner was easier to recommend than to create.

The letter’s insight still holds. Water cybersecurity in a state does not belong to one office. It belongs to a regulator who visits every system, a funder who controls the money, and a responder who acts in a crisis. Each can do useful work alone, but the real gains come when someone with authority connects them: when an inspector’s finding leads to a funded fix, and a fix feeds a responder’s picture of where the weak points are.

A state need not wait for Washington. Most of the work requires a governor to name someone, and that someone to get three departments into the same room.