While a wave of cyberattacks against American water utilities hasn’t hit Wisconsin just yet, many of the state’s small water utilities are vulnerable.
Chris Groh, executive director of the Wisconsin Rural Water Association, said small utilities don’t have the resources to defend against sophisticated computer attacks.
“Small operations don’t have an IT person,” Groh told WPR’s “Wisconsin Today.” aid “They’ve probably got a clerk and one operator, maybe two, and neither one probably knows anything much about computers.”
Understanding Wisconsin, Together.
WPR’s “Wisconsin Today” newsletter keeps you connected to the state you love without feeling overwhelmed. No paywall. No agenda. No corporate filter.
At least 12 states around the country have seen local water systems targeted with cyberattacks, including Michigan and Minnesota.
Groh said the attacks are largely targeting internet-connected cellular nodes, which allow operators to remotely connect with and monitor water systems. The attacks lock out operators from the nodes, requiring hours or days of downtime. The attacks haven’t yet threatened public safety, but Groh said many of the communities go on boil orders to be safe while dealing with the attack.
Water utilities often charge relatively little for their services, Groh said. And rural communities have small tax bases, which means they don’t have the money to keep up with technology.
Groh said that water operators have generally been skeptical or doubtful that their specific communities could be hit or face danger from a cyberattack, comparing sentiments to those around the beginning of the COVID-19 pandemic. But he said attitudes are changing as the cyberattacks grow and affect more and more operators.
“They’re aware, but I think without the means to do anything about it, they don’t act right away like they should,” he said.
Last week, Washburn County reported a cyberattack to its county services. That attack appeared to affect county online services, not infrastructure like water research director at the Wisconsin Security Research Consortium
Schroeder said on “Wisconsin Today” that local utilities and government agencies are often “low-hanging fruit” for hackers due to their limited resources for cybersecurity.
“It’s worrying,” he said. “These attackers are going to look for targets that they’re able to get into and then start causing problems.”
Schroeder said that it’s often difficult to gather enough evidence to confidently point toward a specific bad actor when it comes to cyberattacks. But he said the type of attacks he’s seeing around the country are consistent with the Iranian government’s cyber strategy.
Both Schroeder and Groh said they’re concerned about the use of artificial intelligence to mount more targeted and sophisticated cyberattacks.
“That raises the threat level even more,” Schroeder said. “And a lot of these utilities that are really operating with a lower level of (funding) are going to be even more vulnerable.”
Groh said he’s not a fan of artificial intelligence, especially with reports how the latest large language models from developers like OpenAI and Anthropic have escaped into the internet and attacked other companies on their own.
“The guy that is in a really small town, with maybe 50 or 60 connections, has to have an extensive IT hardening to fight against something that is developed by a $1 billion-a-year industry that could use AI to do things a little bit worse than just turning a pump off,” Groh said.
For the foreseeable future, Groh said utilities might be forced to use AI to help defend against future attacks.
But as a last resort, Groh said that water utilities can always disconnect from the internet entirely. But that would force operators to travel dozens or hundreds of miles to maintain their systems.
