Braham restored service as officials confronted infrastructure security costs
The incidents have drawn attention to the vulnerabilities of small utilities that use internet-connected automation to operate wells, pumps and water towers. Federal agencies contacted local officials as the FBI, the Department of Homeland Security and other agencies investigated incidents reported by utilities in at least seven states, including Michigan, New Jersey and Georgia.
In Braham, a town of 1,800 people, a public works operator noticed at 8:42 a.m. on July 27 that the water tower level was falling while the well meant to refill it was not responding. An outside specialist traveled to the town as officials urged residents to reduce water use during a day when the heat index neared 100 degrees.
A mass text message told residents that the water plant was offline for an unknown reason and that the water in the tower was limited. Braham restored a backup and restarted the system within roughly 90 minutes. The attacks caused no known lasting damage.
George said the routine check detected the problem early. “You’re like, ‘That’s a thing that can happen?’ I was trying to wrap my head around it,” he said. “You could run out of water before you notice anything was wrong.”
Braham uses controllers made by Rockwell Automation. Four days before the incidents, a group of federal agencies including the FBI and the Cybersecurity and Infrastructure Security Agency updated an advisory warning that Iran-affiliated hackers were targeting internet-connected industrial controllers “to cause disruptive effects within the United States.”
The U.S. government has not formally attributed the incidents to a particular malicious actor. President Trump rejected the suggestion that Iran was responsible, saying, “I don’t think so,” and adding, “Iran’s got bigger problems than worrying about Minnesota.” The White House referred questions to the FBI.
Former national security officials and cyber experts have said the attacks are consistent with Iran-linked activity. Cynthia Kaiser, a former deputy assistant director of the FBI’s cyber division, said, “I’d be shocked if it was not Iran.” She said the attacks appeared “aimed at stoking chaos, confusion, and fear” rather than financial gain.
Kaiser said Iran has a geopolitical motive and a history of targeting the water sector. She also said the attacks were readily detected, making a stealthier adversary such as China less likely. Those assessments have not produced a formal government attribution.
Kaiser said small utilities often have limited budgets and little technical staff. “The utilities getting hit are often the ones that can least afford to defend themselves with tiny budgets, sometimes no full-time IT at all,” she said.
Braham has no in-house information-technology department and relies on outside contractors. George estimated that creating and staffing such a department, along with installing the necessary cybersecurity infrastructure, would require roughly a 24% property-tax increase in the first year. “That’s unaffordable,” he said.
Congress is considering whether to extend a federal cybersecurity grant program that has provided assistance to cash-strapped local governments. Funding from the program can be used to protect water systems.
Kevin Stahl, Braham’s city administrator and police chief, said officials could not yet estimate the cost of mitigating the incident. “There may be costs associated with mitigating these issues,” Stahl said, “however, at this time I cannot even estimate a cost.”
Federal agencies have warned that intruders who gain access to similar online controls could manipulate water pressure, rupture pipes, allow contaminants to seep into a system or burn out pumps that could take months to replace. The Environmental Protection Agency has also warned that hackers could alter treatment chemicals to hazardous levels.
Joshua Corman, a cybersecurity expert at the Institute for Security and Technology, said Tehran tends to favor attacks that signal it can inflict harm inside the United States. “We’ve always been prey,” Corman said. “We just lacked predators with appetite. But that’s over.”
Corman said hospitals that lose water can operate for only two to four hours before they must close and evacuate patients. He said that period shortens to one hour if air conditioning fails during summer heat.
George, who serves in the Air Force Reserve, said the possibility that a conflict more than 6,000 miles away could affect Braham through the electronic connection between its water tower and well felt close to home. “It was a little bit too close to home for me,” he said. “I get regular intelligence briefs about Iran and China all the time, and then this hits, and it’s like, ‘Whoa, OK.’”
MSI previously reported that hackers attempted to breach at least 30 Minnesota water systems and that cyberattacks hit water systems in Michigan and Minnesota. The latest reporting adds details about the Braham disruption, the federal investigation and the unresolved question of attribution.