By Guy Page

A wave of suspected Iranian cyberattacks against U.S. water and wastewater systems is putting new attention on the vulnerability of Vermont’s small water utilities — and on what the state has, and has not, done to protect them.

The FBI warned July 30 that malicious cyber actors were targeting operational technology used by water and wastewater utilities, particularly internet-connected Rockwell Automation/Allen-Bradley programmable logic controllers, or PLCs. Since July 27, utilities in at least seven states had reported incidents to the FBI, with some attacks degrading water operations. 

Reports cited in information compiled on the threat indicate as many as 12 states have experienced likely Iranian cyberattacks. Most of the states are in the midwest, and New Jersey is the closest to Vermont.  Liz Royer of the Vermont Rural Water Association told VDC this morning: “I haven’t heard of any recent cyberattacks in Vermont.”

The attackers gained remote access to internet-facing equipment and changed IP addresses and passwords, causing operators to lose monitoring and control capabilities. The FBI recommended removing PLCs from direct internet exposure, using secure gateways and firewalls, adopting strong passwords and restricting communications to authorized control-system devices.

The potential consequences extend beyond computers. Operational problems reported to the FBI included loss of water pressure and flooding. A significant pressure loss can potentially allow untreated groundwater to enter drinking-water pipes. The severity of individual attacks depended on what equipment the compromised controller operated and whether the utility could switch to manual operation.

Vermont has taken steps to address the threat, particularly through voluntary technical assistance rather than new state mandates.

In 2024, the Vermont Rural Water Association was selected as one of only two state organizations nationwide to participate in the one-year Cybersecurity Circuit Rider pilot program. Through the initiative, the association helped 68 Vermont water systems with cybersecurity assessments, training and tabletop exercises designed to prepare operators for cyberattacks.

Under the program, which has now concluded, Circuit Riders provided technical assistance, training and day-to-day support primarily to small and rural water systems serving populations of 10,000 or fewer. The cybersecurity program was intended to identify vulnerabilities and help utilities implement risk-based protections and procedures.

“America’s critical infrastructure is at constant risk of a cyberattack and rural America can’t be an afterthought,” USDA Rural Utilities Service Administrator Andy Berke said when discussing the initiative. He warned that an unprepared cyberattack on a rural water system could “completely devastate the community.”

There’s talk the Circuit Rider program could be expanded nationwide, Royer told VDC today.

But Vermont has stopped short of requiring water systems to meet new cybersecurity standards through state law or regulation.

The Senate this year passed S.213, requiring (among other measures) the state Cybersecurity Advisory Council adopt non-binding guidance for protecting water sources for cyberthreats. The bill died in the House. 

By contrast, New York earlier this year enacted the nation’s first cybersecurity law specifically aimed at water infrastructure, including reporting requirements.

Vermont officials and water-industry representatives have resisted stronger regulatory requirements, favoring guidance, technical assistance and potentially additional financial support that would allow local systems to upgrade equipment and cybersecurity practices.

The national response is also expanding. This month, DEF CON Franklin and the National Rural Water Association announced the Water Watch Center, designed to give small utilities direct cybersecurity support following the suspected Iranian attacks. The program is aimed particularly at systems serving fewer than 10,000 people, which account for 91% of roughly 50,000 community water systems nationwide.

Vermont was among seven states involved in an earlier two-year DEF CON Franklin effort that paired volunteer cybersecurity experts with water and wastewater utilities. Organizers said that work improved security at individual systems but also demonstrated the difficulty of providing cybersecurity protection across the nation’s approximately 150,000 water and wastewater utilities.