Is America’s Drinking Water the Next Front in the Iran War?

Key takeaways

Cyberattacks on U.S. water systems are increasing and are likely orchestrated by Iran, exposing critical vulnerabilities.
Many U.S. infrastructure systems are poorly protected due to outdated technology, lack of funding, and political disagreements.
Federal agencies like CISA are tasked with improving cybersecurity but face resource constraints and political challenges that hamper their effectiveness.
Historical incidents and warnings underscore the persistent danger posed by foreign adversaries seeking strategic advantages through cyber warfare.
Despite known risks, there is insufficient action and investment to safeguard vital infrastructure from potential future attacks.

Summary

U.S. Water Systems Hacked by Suspected Iranian Actors

This section discusses the recent surge in cyberattacks targeting municipal water systems across various U.S. states, likely by Iran. The attacks began to surface prominently in July, with hackers gaining access through internet-facing computers that allow remote management of water infrastructure. These cyber intrusions have led to disruptions like flooding, loss of water pressure, or shutdowns, although no contamination of drinking water has been publicly confirmed yet. Federal agencies, including the FBI and EPA, have issued warnings advising utilities to disconnect from the internet or revert to manual controls to prevent further tampering. The discussion emphasizes the vulnerability of critical infrastructure, which has been a longstanding concern, and highlights how geopolitical tensions, notably the ongoing conflict with Iran, are intensifying these cyber threats.

Historical Context and Government Responses to Infrastructure Cybersecurity

This section provides a historical overview of cybersecurity efforts related to U.S. critical infrastructure, including water systems. It references a 2013 incident involving Iranian hackers attempting to infiltrate a dam near New York City, which was only avoided due to routine maintenance. The podcast explores past legislative efforts to create cybersecurity standards, such as the 2008 legislation proposed by Senators Collins and Lieberman, and recent initiatives during the Biden administration to improve water security. The role of the Department of Homeland Security’s CISA agency is highlighted as pivotal in sharing intelligence and helping states implement security practices. However, recent political upheavals and funding cuts have hampered these efforts, leaving infrastructure vulnerable.

Political Challenges and Under-Resourcing of Cybersecurity Measures

This section discusses the challenges faced in bolstering cybersecurity for critical infrastructure, primarily due to political and resource limitations. It covers the downsizing of CISA during the Trump administration, reduced funding, and the lack of confirmed leadership, which weaken the federal response capabilities. Additionally, the section touches on the politicization of cybersecurity issues, exemplified by President Trump’s dismissive comments about the Iranian hacks and blame-shifting onto Minnesota’s governor. The overall message underscores that despite the known vulnerabilities and warnings, political will and funding remain insufficient to effectively guard against these cyber threats.

Potential Threats and Iran’s Strategic Motivations

The final section explores the broader implications of Iran’s suspected involvement in these cyberattacks. While no water contamination has occurred, the attacks serve as a form of leverage that could be used in wider geopolitical conflicts. The discussion notes that Iran might prefer to keep its options open, potentially allowing future attacks that could cause widespread harm, similar to tactics used by China with infiltration efforts aimed at critical infrastructure. It also highlights how these vulnerabilities could escalate tensions or be exploited in a new front of warfare, emphasizing the pressing need for improved cybersecurity.

Show notes

Over the past week, a growing number of municipalities across the United States have reported that their water systems were hacked. The Times has found that the attacks were most likely perpetrated by Iran.

Today, Dustin Volz, a cybersecurity and intelligence correspondent for The New York Times, explains how the hacking exposes yearslong failed efforts to shore up vulnerabilities in U.S. infrastructure, and how Iran may be seeking a new kind of leverage that could extend the war’s reach to within U.S. borders and affect something as elemental as the water we drink.

Guest: Dustin Volz, a cybersecurity and intelligence correspondent for The New York Times.

Background reading:

Federal and state officials are racing to address an assault on the nation’s water supply.
Cyberattacks on water systems nationwide that affected Michigan and Minnesota also included at least five more states. Evidence points to Iranian involvement.

Photo: Jenn Ackerman for The New York Times

For more information on today’s episode, visit nytimes.com/thedaily. Transcripts of each episode will be made available by the next workday.

For more information on today’s episode, visit nytimes.com/thedaily. Transcripts of each episode will be made available by the next workday.

Subscribe today at nytimes.com/podcasts or on Apple Podcasts, Spotify and Amazon Music. You can also subscribe via your favorite podcast app here https://www.nytimes.com/activate-access/audio?source=podcatcher. For more podcasts and narrated articles, download The New York Times app at nytimes.com/app.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.