OLDSMAR, FLORIDA, a small town of 14,000 or so people, is an unlikely site for an attempted cyber massacre. So when an operator at the city’s water treatment plant noticed someone briefly accessing its network early on February 5th, he assumed it was a supervisor checking in. In the middle of a pandemic, remote working would hardly be unusual. But complacency turned to alarm at lunchtime, when he noticed that someone had seized control of his cursor for several minutes and increased the level of sodium hydroxide—a caustic alkaline chemical used in small amounts to control the acidity of water, and in larger quantities in drain cleaner—more than a hundredfold.
The effort to poison Floridians failed when the watchful operator promptly reversed the move, long before the chemical composition of the water supply could change. Had he not, other monitoring systems at the plant would have noticed the change in pH level and sounded the alarm, according to the city’s mayor. “At no time was there a significant adverse effect on the water being treated,” said the local sheriff, at a press conference on February 8th. “Importantly, the public was never in danger.” The residents of Oldsmar may not be so sanguine. The attack is a reminder that the growing digitalisation of critical infrastructure has rendered it vulnerable as never before.
In the past, hackers have mounted daring assaults on the supervisory control and data acquisition (SCADA) systems used by power grids, oil pipelines and industrial facilities to monitor and control their operations—whether a pump is open or closed, for instance. The most famous example of such an assault is Stuxnet, a suspected American and Israeli cyber-attack on Iranian nuclear facilities discovered a little over a decade ago. In that attack, a computer worm targeting Siemens control systems tricked Iranian centrifuges into spinning themselves apart all while reassuring the monitoring systems that all was well.
Yet whereas Stuxnet was a raid of unprecedented sophistication, using rare and expensive digital tools to penetrate and bamboozle a facility that was cut off from the internet, the Oldsmar attack was the equivalent of jimmying open a loose window. The intruder gained access to the plant through an employee who had installed TeamViewer, a ubiquitous piece of software that allows someone to remotely view and control a computer (eg, to give tech assistance). A city official told Vice Motherboard, a website, that remote access would usually have required a password.
It may seem curious that a vital public utility should be connected to—and controllable from—the internet, but it is not unusual. In May 2020 Shodan, a specialised search engine that catalogues internet-connected devices, found more than 112,000 industrial control systems with open ports—essentially a virtual door to the wider world. The advantage of networking a water or power plant is that it can be remotely monitored, controlled and maintained. That is a particular boon during a period of pandemic-induced remote working.
Much of that networking, however, has been slapdash. “A lot of the smaller water utilities don’t have budgets and staff for cyber-security folks or for even their own control-systems engineers,” says Gus Serino of Dragos, a cyber-security firm, who previously worked at a large American water utility. “And so typically they rely on outside systems integrators who will design and build their systems—and historically cyber-security wasn’t any part of that calculus.” Although merely breaching a plant would be insufficient to cause a calamity—almost all include several redundancies to spot anomalies, and altering water supply can take days—more sophisticated attacks could override some of these safeguards.
In a report last year the Cyberspace Solarium Commission, a Congressionally-mandated group of lawmakers and experts, drew a cautionary comparison between America’s water supply, made up of nearly 70,000 separate utilities, and its similarly decentralised electoral system. Decentralised systems provide a measure of resilience, but make it harder to roll out uniform security standards. Water plants, the commission warned, were plugging into digital networks “with dramatic variations in capacity and sophistication”, and “remain[ed] largely ill-prepared to defend their networks.”
A striking example of this came in April 2020 when suspected Iranian hackers sought to alter the level of chlorine in a municipal water plant in central Israel, prompting an Israeli riposte against an Iranian port. Yigal Unna, the head of Israel’s National Cyber Directorate, framed the attempt in dramatic terms: “Cyber winter is coming and coming even faster than I suspected. We are just seeing the beginning. We will remember this as a changing point in the history of modern cyber warfare.” In fact, it was only the latest salvo.
Several cyber-attacks on water plants have gone unreported, says an expert familiar with those cases. One study of known cyber incidents in the water sector between 2000 and 2019 concluded that although these attacks had not caused human casualties, they had “led to the pollution of open water bodies, theft of irrigation water, data breach and manipulation of chemicals rates in potable water, to name a few.” Indeed, one of the first known breaches of a SCADA system was one of the messiest. Just over two decades ago a former contractor of Maroochy Water Services, a water plant in Australia, used a laptop, two-way radio and specialised equipment to release almost 1m litres of untreated sewage from pumping stations into local parks and rivers. “Marine life died, the creek water turned black and the stench was unbearable for residents,” noted an Australian official at the time.
Like many subsequent incidents, that was the relatively simple work of a disgruntled insider rather than foreign intelligence agencies with advanced malware. The Oldsmar incident may turn out to be a similarly amateurish effort. But over time, states have realised that they can penetrate the critical infrastructure of their rivals for a variety of reasons, and at relatively low cost. Often the aim is not to inflict damage but to “pre-position” malware that would enable an attack in the future, such as in a crisis or war. America and Russia have each probed one another’s power grids in this way for years—burrowing in and manoeuvring rather than blowing anything up.
Yet some attacks have gone further. The Tallinn Manual, an authoritative guide to the legality of cyber operations, notes that cyber-attacks intended to deprive civilians of vital sustenance—such as water, food or electricity—are illegal in most cases, in much the same way that bombing such facilities from the air would be prohibited. That judgment has not seemed to deter some states from making the attempt. In 2016 a suspected Russian attack, inspired partly by Stuxnet, disrupted Ukraine’s electricity grid and cut power to about a fifth of Kiev in the midst of a harsh winter. Two years later Ukraine said it had halted another suspected Russian attempt to disrupt a chlorine plant.
In an ideal world, such facilities would not allow remote access at all, warns Mr Serino. If that is not possible, he urges stronger security measures, such as authenticating the identity of those logging on remotely and channeling traffic through “jump box” servers—a sort of virtual buffer. “We have to continue to educate the engineers and integrators who are doing this work about the challenges and risks associated with securing these systems that, at this point, don’t have much in the way of inherent cyber-security controls.”