What a voluntary control systems memo could not give small water utilities

The week

On February 5, 2021, an operator at the water treatment plant in Oldsmar, Florida, a city of about 15,000 people near Tampa, watched someone else move the cursor on his screen. According to the Pinellas County sheriff, who announced the incident three days later, the remote user raised the setting for sodium hydroxide from 100 parts per million to 11,100. Sodium hydroxide, better known as lye, is added in small amounts to control the water’s acidity. The operator reversed the change at once, and officials said the public was never in danger.

The route in looked mundane. A joint advisory from CISA, the FBI and partner agencies said the intruders likely exploited poor password security and an outdated, unsupported operating system. It said desktop sharing software such as TeamViewer may have been used, though that could not be confirmed. Its advice was basic: strong, unique passwords, multi-factor authentication, remote access tools switched off when not in use, and supported software.

The story spread quickly. It was easy to understand, and it drew national attention to a question few people had asked: who is protecting the thousands of small utilities that keep tap water safe? Oldsmar was not the only case. In late March, federal prosecutors in Kansas announced the indictment of a former employee of the Post Rock Rural Water District. He was accused of logging in remotely in 2019, after he had resigned, and shutting down processes that affected the plant’s cleaning and disinfection. Part of his old job had been to monitor the plant remotely after hours.

The spring then made the threat national. In early May, a ransomware attack led Colonial Pipeline to shut down the largest fuel pipeline on the East Coast, and fuel shortages followed in several states. On May 12, President Biden signed an executive order on improving the nation’s cybersecurity, aimed mainly at federal agencies and their software suppliers. Later that month, and again in July, the Transportation Security Administration issued security directives to pipeline operators, the first mandatory cybersecurity requirements for that sector.

Water had its own federal deadline that summer. The America’s Water Infrastructure Act of 2018 required community water systems serving more than 3,300 people to assess their risks, including to electronic, computer and other automated systems. They then had to certify to the EPA that the assessment was done. The deadlines were staggered by size. The smallest covered systems, those serving 3,301 to 49,999 people, had to certify by June 30, 2021, with updated emergency response plans due six months later. The EPA received certifications, not the assessments themselves, and systems serving 3,300 people or fewer were outside the requirement altogether.

On July 28, 2021, President Biden signed a National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems. A national security memorandum is a formal presidential directive to federal agencies. It tells them what to do, but it does not, by itself, bind private companies or local governments.

The subject was control systems. These are the computers and devices that run physical equipment: opening valves, starting pumps, dosing chemicals, keeping the lights on. In industry they are often called industrial control systems, or operational technology. Ordinary office IT handles email and spreadsheets; control systems move water, gas and electricity.

The memorandum formally established the Industrial Control Systems Cybersecurity Initiative, a voluntary collaboration between government and infrastructure operators. It had begun in April with a 100-day plan for the electricity sector and had since extended to natural gas pipelines. The memorandum said the initiative would expand to further sectors, including water and wastewater.

It also directed the Department of Homeland Security, working with the Commerce Department through NIST, the National Institute of Standards and Technology, to develop baseline cybersecurity performance goals for critical infrastructure. Preliminary goals for control systems were due by late September, and final cross-sector goals within a year. A performance goal describes a security outcome, such as “remote access requires more than a password,” rather than imposing a legally binding rule.

The move was real and welcome. But for water, the word that mattered most was “voluntary.” A goal only helps if someone reads it, pays for it and acts on it. At most small water systems in 2021, it was not clear who that someone would be.

The memorandum relied on voluntary goals because federal agencies lacked authority to impose detailed cybersecurity standards on most infrastructure sectors. In electricity, that approach sat alongside mandatory reliability standards and large operators with security teams. Water is different.

The United States has roughly 50,000 community water systems, according to the EPA, and most of them are small. Many are owned by cities, counties, towns and special districts; others by rural cooperatives, homeowners’ associations or investor-owned companies. For those systems, a voluntary goal is a document that someone must read, fund and act on. Each of those steps needs something the memorandum could not provide: an owner, a person whose job includes control system security; a budget line that recurs; and a reason to act that a council or board will accept. Local officials could supply all three. Federal agencies could not.

The sections below take those three gaps in turn, after a short primer on what a plant’s control system is. They then follow one hypothetical district through a year of closing the gaps. They set out who bears the consequences when the gaps stay open, and they end with the modest target a governing body should hold its utility to.

What a water plant’s control system actually is

The layers, from valve to screen

A modern water treatment plant is run largely by software. Sensors measure flow, pressure, water levels and chemical concentrations. Small rugged computers called programmable logic controllers, or PLCs, read those sensors and operate the equipment: if the tank level drops, start the pump; if chlorine falls, add more. These devices are the hands of the system.

Above them is a supervisory layer, often called SCADA, short for supervisory control and data acquisition. This is the screen the operator watches: a map of the plant with readings, alarms and buttons. From it, an operator can change a setpoint, the target value a controller tries to maintain, such as a chemical dose. The Oldsmar operator reported seeing someone make exactly that kind of change remotely.

Between the layers run communication links. Inside the plant they are usually ordinary network cables. Out to remote pump stations, wells and storage tanks, which can be miles away, they may be radio, leased lines or cellular modems. Many plants also run a historian, a database that records readings over time for compliance reports. Because managers want those reports in the office, the historian is often the first bridge between the plant network and the office network.

How the outside world got in

For decades, these systems were largely isolated, running in a locked building with no connection to the outside world. That isolation was their security. Over time, convenience eroded it. Vendors wanted to fix problems without driving out. Managers wanted to see readings from the office. Operators wanted to check the plant at night from home. Each connection made sense on its own. Together, they meant the plant’s nervous system could be reached from the internet.

The connections took several forms. Some were remote desktop tools installed on an operator workstation, the same kind of software help desks use to fix laptops. Some were cellular modems added at a remote site so a vendor could dial in. Some were control screens published straight to the internet behind a login page. Each one went around whatever protection guarded the edge of the office network, and few of them appeared on any diagram the utility kept.

Remote access is the technical term for that reach: a way to control a computer from somewhere else. Done well, it requires strong identity checks, runs through one controlled entrance and is watched. Done casually, it is an open door with a cheap lock, often with one password shared by everyone who ever needed it.

Why the usual IT fixes do not transfer

Three features of control systems frustrate the habits of office IT. First, they are built to run for many years, so they often use older software that is hard to update without stopping the plant. Vendors may also need to certify that an update will not break their control logic, which adds months.

Second, many controllers were designed to trust anything on their network. They may accept new instructions without a password at all, and they cannot run antivirus software. Aggressive network scanning, routine in office IT, has been known to disrupt older control devices. Security work in a plant therefore has to be planned with the operators, not done to them.

Third, the consequences of a breach are physical. A compromised office network leaks data. A compromised control system can affect what comes out of the tap. Plants do have safeguards that software cannot easily override: alarms on water quality analyzers, routine laboratory sampling and, at many plants, chemical feed equipment with physical limits. Those safeguards depend on people noticing and acting. The operator’s ability to run the plant by hand, and to spot when something looks wrong, remains a vital safety net.

An owner: someone whose job it is

Why ownership falls between chairs

Many small utilities have no dedicated cybersecurity staff and often no dedicated IT staff. Control systems are typically installed and maintained by an integrator or equipment vendor and operated day to day by licensed treatment operators whose training is in chemistry and hydraulics. Remote access, which spread during the pandemic so that operators and vendors could check plants from home, was often set up by whoever needed it, sometimes with shared passwords and no monitoring.

Ownership is also split by public governance. In a typical municipal utility, the plant’s control systems belong to the utility, its office network to the city IT department, and its contracts to a central procurement office. When something looks wrong, it may not be clear who can disconnect a vendor’s remote access, call for help, or notify the state drinking water regulator. That ambiguity costs hours in exactly the situation where hours matter.

The shape of the split depends on who owns the system. In a city department, the utility director reports to a city manager, and city IT may control the firewall between plant and office. In a special district, an elected board employs a general manager directly, and there may be no IT function at all. A small rural water association may have a manager, a bookkeeper and a few operators, with the integrator as its only technical resource. Investor-owned utilities usually have corporate IT and security teams, though small systems they have acquired can keep legacy arrangements for years.

Suppose that at 2 a.m. an operator at a county water plant notices a setpoint has changed and he did not change it. He calls his supervisor, who is not sure whether the vendor is doing maintenance. The supervisor calls the county IT director, who says the plant network is not hers. Nobody is certain who is allowed to cut off the vendor’s connection, and nobody wants to be blamed for shutting down something important. By the time the right person is found, it is morning. Every individual acted reasonably, but the system had no owner.

What a useful ownership decision contains

A voluntary goal cannot assign that ownership. A city manager, utility general manager or board can, in a single resolution or job description change. The useful version is specific:

• A named owner and a deputy, with an after-hours call order that operators keep at the console.
• Written emergency authority to disconnect remote access, isolate the plant network from the office network, or move the plant to manual operation without further approval.
• A notification list saying who must be told, by whom and how fast: the governing body, the state drinking water program, law enforcement and the insurer.
• A written boundary with city or county IT that says who owns the firewall, who owns plant workstations and who approves any new connection.
• A standing duty to report to the governing body on a short list of measures each quarter.

The notification list deserves care. State drinking water programs set their own expectations for when a utility must report an event that could affect water quality. Cyber insurance policies often require prompt notice and the use of responders the insurer has approved. A utility that calls its own consultant first may find part of the response is not covered. Counsel and the insurer should review the list before it is ever needed.

The boundary with IT matters as much as the emergency power. Intruders commonly reach a plant through the office network or through vendor access rather than by walking onto the plant floor. If city IT approves a new connection for the billing system that happens to reach the historian, the utility owner needs to know. A simple rule helps: no new connection into or out of the plant network without the owner’s written sign-off.

The objection: an owner without resources is a scapegoat

A fair objection is that naming an owner changes nothing if that person has no time, training or money. A superintendent already responsible for compliance sampling, staffing and capital projects can absorb a new title and do little with it. Worse, the title can become a way to assign blame after an incident.

The objection identifies a real risk, and the remedy is to pair the appointment with resources rather than skip it. Ownership is the precondition for the other two gaps closing, because budget requests and policy reports need someone to write them. The appointment should come with protected hours, basic training and the budget line described below. The owner should be judged on whether the basics are in place and tested, not on whether an attack ever happens.

Where free help lands

Free help then has somewhere to land. CISA, the Cybersecurity and Infrastructure Security Agency, had regional advisers and offered free services such as vulnerability scanning of internet-facing systems. State agencies, the WaterISAC information-sharing center and state rural water associations offered assessments, checklists and training. All of it needed a counterpart at the utility. An offer of help addressed to “the utility” tends to languish in an inbox. One addressed to a named person gets a reply.

A budget line: competing with pipes

Water utilities are financed mainly by ratepayers, and their capital plans are dominated by pipes, pumps, treatment upgrades and water quality compliance. Cybersecurity competes with those needs for money and attention, and it usually loses unless it appears as its own line. A broken water main is visible and urgent. A missing security control is invisible until the day it is not.

What the recurring line pays for

The measures that matter most are recurring, not one-off. Three terms need defining. Patching means installing the software fixes vendors release when they find weaknesses. Monitoring means someone, or some service, is watching who connects and raising an alarm when something unusual happens. Offline backups are copies of the plant’s settings and control logic, the instructions loaded into the controllers, stored somewhere an attacker on the network cannot reach or erase.

A realistic annual line for a small system covers a handful of items:

• Remote access. A single gateway with multi-factor authentication, and the licenses and support that keep it running.
• Maintenance hours. Integrator or staff time to apply vendor-approved patches during planned windows.
• Monitoring. A service, ideally shared, that watches remote access and plant network traffic and calls someone when it sees something odd.
• Backups and restore tests. Periodic copies of controller logic and configurations, and at least one test that a copy actually loads.
• Training and drills. Operator time for a manual operation drill and a tabletop exercise with the governing body.

Every item on that list is ordinary. Most of the cost is people’s time, which is why it disappears when it is not written down. An assessment that produces a list of fixes nobody is paid to implement changes little.

Where the money can come from

The local remedy is to put security into the rate case and the operating budget. A rate case is the formal process by which a utility justifies what it charges customers. How rates are set depends on ownership. Investor-owned water utilities generally file rate cases with a state public utility commission. Many municipal and district utilities set rates through their own council or board, often after a cost-of-service study, though some states regulate them too.

In either setting, a recurring security cost must be written into the justification, or it will be squeezed out. A modest annual line, justified by the cost of a forced manual operation or a boil-water notice, is easier to defend than a one-off request after an incident. For investor-owned utilities, a commission will want to see that the spending is prudent; a documented risk assessment and a recognized framework make that case easier.

Grants help only at the margins. The infrastructure law signed in November 2021 created a State and Local Cybersecurity Grant Program of about $1 billion over four years. States had to pass most of the money through to local governments and build cybersecurity plans to qualify. The EPA has also said that some cybersecurity projects can be financed through the drinking water state revolving fund, which mainly offers loans.

Grants and loans suit one-time projects: an assessment, a remote access gateway, new network equipment. They suit recurring work poorly. A utility that funds its monitoring with a two-year grant needs a plan for year three before it signs.

Contracts as a budget tool

Utilities that contract with an integrator can also write security duties into that contract: multi-factor authentication for vendor remote access, notice before changes to control logic, and copies of configurations held by the utility. Multi-factor authentication means logging in with something you know, like a password, plus something you have, like a code on your phone. It is the single cheapest way to stop a stolen password from becoming a stolen plant.

A few further clauses cost the utility little and shift real work onto the party best placed to do it. The vendor should name the individuals who may connect and remove them promptly when they leave. It should tell the utility quickly if its own systems are compromised, since a breached vendor is a path into every client. And it should hand back all credentials and documentation when the contract ends, so the next vendor does not inherit unknown accounts.

These clauses will raise some vendors’ prices. Smaller integrators may push back or decline. The trade-off is usually worth it, because the alternative is a utility that cannot say who holds the keys to its own plant.

Pooling, and its trade-offs

Scale is the other lever. A utility serving a few thousand people cannot justify its own monitoring service, but a county, a regional water authority or a state program can buy one for many systems at once. Shared remote access gateways offer a single guarded entrance that all vendors must pass through. Pooled incident response retainers and cooperative purchasing of monitoring do the same for other costs. Together they turn a cost no single small utility can carry into one a group can. The trade-off is dependence on a shared provider, which the owner should manage like any other contract.

Some argue the deeper fix is consolidation: merging very small systems into larger ones that can afford professional staff. Consolidation has real advantages for water quality and finance as well as security. It is also slow, politically difficult and often resisted by communities that value local control. Shared services capture part of the scale benefit without a merger, and a county can start them within a budget year.

A reason to act: the missing mandate

The third gap is legal. Electric utilities face mandatory reliability standards for the bulk power system. Pipelines had just received TSA security directives. Drinking water systems serving more than 3,300 people had a duty under the America’s Water Infrastructure Act of 2018 to assess risks, including cybersecurity, and to update emergency response plans. They had no detailed federal cybersecurity standard.

What the existing federal duty did and did not do

The 2018 law was a real step. It made larger community water systems look at the security of their electronic and automated systems alongside physical threats and natural hazards. It required the assessment and the emergency response plan to be reviewed and recertified every five years.

Its limits were equally real. Utilities certified that the work was done; they did not submit it, so federal review of its quality was not part of the process. The law prescribed no particular controls, such as multi-factor authentication or offline backups. And the many systems serving 3,300 people or fewer, which are the majority by count, were not covered at all.

How other sectors and states compared

Electricity shows what a mandate looks like. Reliability standards enforced through the North American Electric Reliability Corporation apply to the bulk power system, with specific security requirements and audits. Even there, many local distribution utilities fall largely outside those standards, so the sector has its own version of the small-utility gap.

A few states moved ahead of Washington for water. New Jersey’s Water Quality Accountability Act of 2017 required water systems with more than 500 service connections to adopt a cybersecurity program aligned with a recognized framework. The state amended the law in November 2021 to tighten its cybersecurity provisions, including incident reporting. Other states relied on guidance and voluntary programs, so a utility’s obligations depended heavily on where it was.

Reasons a governing body can create for itself

Without a mandate, voluntary goals compete with every other demand on a council’s agenda. A requirement creates a floor that justifies spending to ratepayers. It gives a utility manager something to point to when a council member asks why the budget went up.

Locally, officials can create their own reason. A governing body can adopt a short security policy for its utility and require the owner to report against it. Cyber insurers supplied another reason: by 2021 many were asking about multi-factor authentication and remote access before renewing policies. The measures with the best return were well known in 2021:

• Remove internet exposure of control interfaces. If a plant’s control screen can be found by anyone searching the internet, take it off.
• Change default passwords. Many devices ship with factory passwords published in their manuals.
• Require multi-factor authentication on remote access.
• Keep offline copies of control logic and configurations, so the plant can be rebuilt if systems are wiped.
• Rehearse running the plant manually, so operators can keep water safe while the computers are untrusted.

None needed a federal rule. Each needed someone, some money and a reason. Local government, not Washington, controls all three.

The counter-argument: mandates without money

The strongest case against a water mandate is about capacity. Very small systems often struggle to keep a licensed operator, let alone hire security help. States, which enforce drinking water rules as primacy agencies, have limited inspection staff. A mandate without funding could produce paper compliance: forms filled in, controls unchanged, and inspectors stretched thinner across their other duties.

That case is serious, and the national tension between floor and capacity has never been resolved. It does not weaken the local argument. A council that adopts its own policy sets a floor sized to its own utility, funds it from its own budget and checks it at its own meetings. The capacity problem is real at the national level. At the level of one utility, it is a budgeting decision.

One small utility’s first year

Take a hypothetical water district serving a few thousand residents through its first year of taking control system security seriously.

In the first month, the district board passes a short resolution. The operations superintendent becomes the named owner of control system security, with the chief operator as deputy. The resolution gives them written authority to disconnect any remote access in an emergency without waiting for approval, and asks for a one-page report at every quarterly board meeting. The board also agrees that the superintendent may spend a few hours each week on this work, and moves a small compliance task elsewhere to make room.

In the second month, the superintendent takes up the free help that had been languishing in the inbox. A regional adviser walks the plant with her and checks whether any control screens can be reached from the internet. One can: a vendor had set it up years earlier so he could troubleshoot from his office. It is taken offline that week. Default passwords on two controllers are changed.

In the third month, she builds the district’s first list of every way into the plant. The list is longer than anyone expected. It includes a cellular modem at a booster station that a former contractor installed, a remote desktop tool on the night-shift workstation and a shared operator login. The modem is removed, the desktop tool is replaced by the vendor gateway, and each operator gets an individual account. One operator objects to the extra login at shift change; the chief operator explains why, and the objection fades.

Next comes the vendor contract. When it is renewed, the district adds three clauses: the vendor must use multi-factor authentication for any remote connection, must give notice before changing control logic, and must hand over current copies of configurations, which the district stores offline. The vendor grumbles about the extra step at login and then gets used to it.

By mid-year, the district has joined a county arrangement that buys monitoring for several small systems at once. Its share is a modest line in the operating budget, and the general manager explains it in the next rate discussion by comparing it with the cost of a single boil-water notice.

In the ninth month, the board holds a short tabletop exercise with the county emergency manager and a contact from the state drinking water program. The scenario is a vendor account used at night to change a chemical setpoint. The exercise exposes one gap: nobody knew the insurer’s claims number. It goes on the call list the next day.

Toward year end, the operators run a drill: for a full shift, they treat the computers as untrusted and run the plant by hand. They find two gaps in their written procedures and fix them. They also try loading the offline copy of one controller’s logic onto a spare unit, and confirm it works.

No single step is technically difficult or expensive. Together, they change the 2 a.m. scenario completely: there is now someone to call, someone allowed to act, fewer doors left open and a practiced way to keep water safe while the problem is sorted out.

The year also shows what the work does not achieve. The district still runs some older software it cannot yet replace, and its monitoring depends on a shared provider it does not control. Those are known, managed risks rather than unknown ones, and the board has seen them in writing.

When the plant fails, residents call the mayor

For elected officials and senior managers, control system security can feel like a technical niche. It is better understood as a public safety and governance issue.

Who bears which cost

The risk is to residents first. A water system exists to deliver safe water, and a manipulated treatment process, or a plant forced into manual operation, puts that mission under strain. The financial exposure follows: emergency contractors, overtime, possible boil-water notices and the cost of rebuilding systems. Regulators, especially the state drinking water program, will want to know what happened and when the utility knew. And the reputational cost lands on the people residents elected. When something goes wrong at the plant, residents do not call the vendor. They call the mayor.

How the first day unfolds

The early hours of a control system incident are mostly decisions, not technology. Operators must decide whether to keep the plant on automatic or take it to manual. The owner must decide whether to cut remote access and isolate the plant network, accepting that it may slow the investigation. The utility must decide, with the state program, whether water quality is in doubt and whether customers need a notice.

Each decision has a cost if made late. A plant left on automatic while untrusted can be manipulated again. A notice issued without evidence can damage confidence for months; one withheld when it was needed can harm people. The utility that has named its owner, agreed its notification list and practiced manual operation makes these decisions in minutes. The one that has not makes them by committee.

Governance differs by type of body

The shape of accountability varies. A city council answers for a municipal utility alongside every other city service, and its utility competes with police and parks for attention. A special district board exists only to run the utility, which gives it focus but often less professional staff. A county may run several small systems and can more easily share security services across them.

Transparency rules add another layer. Governing bodies conduct most business in public, and residents can request many records. Many states exempt detailed security plans from public records laws, but the rules vary. Counsel should confirm how a utility can discuss and store its security details before the board starts asking for reports.

A fairness problem as well as a security one

The large utilities serving big cities can afford security teams. Small systems serving towns and rural areas often cannot, yet their residents deserve the same safe water. Pooling, shared services and state programs are how local government closes that gap.

Modest, specific and recurring

The target is modest and specific. A small utility has a named owner and deputy for control system security. That person has written authority to cut remote access in an emergency. Vendor contracts require multi-factor authentication and notice before changes. The utility holds its own copies of configurations. Operators practice running the plant by hand. A recurring budget line pays for patching and monitoring, perhaps through a county or regional arrangement. And the board hears a short quarterly report on internet exposure, remote access and offline backups.

The quarterly report, on one page

The report works best when it uses the same few measures every time, so a board can see trends without technical knowledge:

• Internet exposure: how many plant devices or screens can be reached from the internet, from the latest scan. The target is zero.
• Remote access: how many people and vendors can connect remotely, and whether every one uses multi-factor authentication.
• Backups: the date of the last offline copy of controller logic and the date it was last tested.
• Readiness: the date of the last manual operation drill and what it found.
• Open items: findings from assessments or drills, with an owner and a date for each.

A report like this takes an hour to prepare once the habits exist. Its value is in the questions it prompts when a number moves the wrong way.

The failures to avoid

The failures are equally recognizable:

• Waiting for Washington. Treating voluntary federal goals as someone else’s job, and assuming a mandate will arrive with money attached.
• Assessment without follow-through. Paying for a report full of findings and funding none of the fixes.
• Letting the vendor own the keys. If only the integrator knows the passwords and holds the configurations, the utility does not control its own plant.
• Assuming IT has it covered. City IT may run the office network well and still have no authority over, or familiarity with, the plant’s control systems.
• Grant-only funding. Security work that depends on the next grant cycle stops when the grant does.

What we would tell a city manager today is that none of the target depends on a new law. It depends on a resolution, a budget line and a standing agenda item.

For the next board meeting

• Who, by name, is accountable for our water plant’s control system security, and who is their deputy?
• Does that person have written authority to cut off remote access at 2 a.m. without asking anyone?
• Can any of our control screens or devices be reached directly from the internet, and when did we last check?
• Who has remote access to the plant today, including vendors, and does every one of them use multi-factor authentication?
• Where does recurring security spending appear in our operating budget and our next rate case?

With hindsight

The federal outputs arrived roughly on schedule. CISA and NIST released preliminary control system goals in September 2021, grouped into nine categories with baseline and enhanced objectives. In January 2022, the EPA, the National Security Council and CISA announced a water sector action plan under the control systems initiative. It focused on actions that could be ramped up within 100 days, including pilots of control system monitoring. CISA published cross-sector cybersecurity performance goals in October 2022 and has revised them since. On paper, the federal side did what the memorandum promised.

The water sector’s gaps persisted. In March 2023 the EPA told states to evaluate cybersecurity during sanitary surveys of public water systems, the periodic inspections state regulators already carry out. Missouri, Arkansas and Iowa sued, water industry groups joined the challenge, and a federal appeals court paused the requirement. The EPA withdrew it in October 2023. The episode showed how hard it is to turn a voluntary expectation into a mandatory one for a sector made up largely of small public bodies. It also showed how much depends on state regulators, who would have carried the inspection load.

Meanwhile, the threat became concrete, and it used the paths the 2021 basics were meant to close. In late 2023, actors linked to Iran’s Islamic Revolutionary Guard Corps compromised internet-exposed controllers at several US water facilities, including a municipal water authority in Aliquippa, Pennsylvania. A joint advisory said the actors likely exploited poor password security and devices exposed to the internet. In January 2024, a tank at the water system in Muleshoe, Texas, overflowed after its remote control interface was manipulated, in an attack claimed by a pro-Russian hacktivist group. In February 2024, a joint advisory warned that Chinese state actors known as Volt Typhoon had gained access to IT networks of critical infrastructure, including drinking water.

Washington’s tone changed with it. In March 2024, the EPA administrator and the national security adviser wrote to the nation’s governors, warning that disabling cyberattacks were striking water and wastewater systems across the country. In May 2024 the EPA issued an enforcement alert. It said more than 70 percent of systems it had inspected since September 2023 violated basic requirements of the 2018 risk assessment law. It also said some systems had not changed default passwords, used a single login for all staff or had failed to cut off former employees. Those were the 2021 findings, three years on.

Incidents continued. In September 2024, Arkansas City, Kansas, switched its water treatment plant to manual operation after a cybersecurity incident, and said water quality and service were not affected. The following month, American Water Works, the largest regulated water and wastewater utility in the country, disclosed a cyberattack and temporarily paused customer billing. The manual fallback in Kansas, often treated as an old-fashioned skill, turned out to be a frontline defense. The attack on a large, well-resourced company showed that size did not remove exposure on the business side.

The Oldsmar incident itself was later disputed. In 2023, the city’s former manager attributed it to employee error rather than an outside intruder. The gaps it exposed were real either way: weak passwords, unsupported software and remote access tools left running. A story does not need to be exactly as first reported to point at a genuine weakness.

What held up from 2021 was the diagnosis. The attacks of 2023 and 2024 mostly used doors that an owner, a budget line and a board report would have closed: internet exposure, default passwords and unmanaged remote access. What did not hold up was any hope that voluntary goals and federal encouragement would, by themselves, move the long tail of small systems. The national argument over mandates and money for small water systems remains unsettled.

The clearest takeaway is about where responsibility actually rests. For any leader overseeing public infrastructure, the practical step is the same now as it was in 2021: decide who owns the problem, fund the unglamorous work every year, and ask for a short report on it every quarter.