White House To Unveil Program To Protect Water Systems Against Hackers

The Trump administration will soon announce a program to provide free cybersecurity services to vulnerable U.S. water facilities, following a cascade of cyberattacks across at least a dozen states that many experts suspect are linked to Iran.

The initiative is being led by the Office of the National Cyber Director and has gained momentum over the last several months, according to two people with knowledge of the program. A third person with knowledge of the program said it will begin with facilities in Texas and described it as a “proof of concept” that could expand to other states.

All three people were granted anonymity to discuss plans not yet made public.

The program will offer water utility providers in the state access to free services, such as tools for scanning their networks for security vulnerabilities, to help them better protect against future attacks, according to the three people. Water facilities have long been attractive targets for hackers because they often lack robust funding or staffing to prioritize their cyber defenses.

It’s unclear how many private cybersecurity companies have been enlisted to provide free services for the program. The three people estimated that the initiative will be announced sometime next week.

Protecting U.S. critical infrastructure is “something everyone should contribute to, certainly including the government,” said the first person, who criticized the program for relying on private companies to fill government gaps.

“It’s basically a shakedown of the companies, asking them to step in,” the first person said.

A person familiar with discussions at the White House, granted anonymity to discuss private conversations, told POLITICO on Tuesday that “this program has been in the works since last year.” They added that “strengthening the cybersecurity of critical infrastructure, like water utilities, was a key priority” in the Trump administration’s National Cyber Strategy, which was released earlier this year. 

Spokespeople for the White House did not respond to questions on when the program will be formally announced or which companies are involved.

National Cyber Director Sean Cairncross discussed the government’s plans to strengthen the cybersecurity of U.S. critical infrastructure at a March event, where he told attendees that his office was “launching a series of pilot programs” to support various states, including a water-focused program in Texas.

Spokespeople for Texas Cyber Command, the state agency that leads cyber defense and incident response efforts, did not immediately respond to a request for comment on whether the agency is involved in the program.

Water systems across the U.S., including in Minnesota, Michigan, Georgia and New Jersey, have been hit by attacks targeting both IT and operational systems in recent weeks. In several cases, hackers changed passwords on IT systems, forcing operators to rely on manual controls to keep the facilities running, and in at least one Georgia county, officials issued a boil water notice after a cyberattack caused a pump station to fail, lowering water pressure.

While the Trump administration has not formally attributed the recent attacks to any nation or criminal group, federal and state officials believe Iran is behind the attacks, citing this campaign’s similarities to past operations carried out by Iranian hackers.

Lawmakers in both the House and Senate have introduced bills in response to these attacks, including bipartisan legislation led by Rep. Josh Gottheimer (D-N.J.) that would provide water utilities with access to advanced AI models to detect and mitigate hacking attempts.

Several agencies involved in protecting critical infrastructure systems, including the Cybersecurity and Infrastructure Security Agency, the FBI and the Environmental Protection Agency, warned in late July that they were tracking a “significant increase” in digital attacks on U.S. water facilities. Hackers were specifically targeting programmable logic controllers, which control machinery at water and wastewater plants.

TJ Sayers, senior director of threat intelligence at the Center for Internet Security, which runs the Multi-State Information Sharing and Analysis Center — a hub for sharing cyber threat information between state leaders — said Tuesday that CIS had received “record-high requests” from U.S. water facilities for access to greater cybersecurity services since July. He said he supports “an executive-led program at the federal level” to accomplish this.

The third person with knowledge of the soon-to-be-announced White House program said it would be “helpful” to have a unifying office running a program like this.

“We need to put all the pieces of the puzzle together to really fortify these systems,” the person said.