U.S. lawmakers have introduced legislation that would expand federal oversight of cybersecurity at drinking water and wastewater utilities and provide hundreds of millions of dollars annually to help systems address vulnerabilities.
Senators Amy Klobuchar of Minnesota and Adam Schiff of California introduced the Water Cyber Shield Act on August 13, following a series of cyberattacks targeting U.S. water infrastructure, including coordinated attacks against more than 30 community water systems in Minnesota. The bill also follows a series of attacks that disrupted operations at facilities in at least seven states.
The proposed legislation would give the U.S. Environmental Protection Agency (EPA) explicit authority to conduct cybersecurity assessments of water systems and require corrective actions when significant vulnerabilities are identified.
According to the bill text, it would authorize an additional US$300 million annually for each of the Drinking Water State Revolving Fund and Clean Water State Revolving Fund. The combined US$600 million in funding would be dedicated to cybersecurity improvements at water and wastewater utilities.
Subscribe to our Newsletter!
The latest environmental engineering news direct to your inbox. You can unsubscribe at any time.
“The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure,” Klobuchar said in announcing the legislation. “Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats,” she added.
Under the bill, larger drinking water and wastewater systems would be required to assess cybersecurity risks as part of their existing risk and resilience planning. The EPA would also be directed to establish tiered cybersecurity standards in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), states and water sector stakeholders.
Smaller utilities and systems with fewer resources would receive additional flexibility and would be prioritized for federal financial assistance. The legislation would also establish a technical advisory committee intended to give utilities a role in developing practical cybersecurity standards.
“Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities,” Schiff said in a statement. “These threats are not hypothetical — they are happening right now,” he added. “This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers.”
Bill would expand incident reporting
The Water Cyber Shield Act would extend federal cyber incident reporting requirements to state and locally owned drinking water and wastewater systems that had previously been exempt.
It would also protect sensitive cybersecurity information submitted by utilities from public disclosure.
States with sufficient capacity could assume primary responsibility for enforcing the cybersecurity requirements, while the EPA would retain authority to oversee systems where states do not take on that role.
The legislation follows growing concern among federal officials about cyber threats to water infrastructure. In April, the EPA, FBI, CISA and National Security Agency issued a joint cybersecurity advisory warning water systems about increased threats.
Those concerns intensified in Minnesota in July, when more than 30 municipal water systems were targeted in a coordinated cyber campaign. Following the attacks, Klobuchar received a briefing from U.S. National Cyber Director Sean Cairncross and spoke with mayors from several affected communities.
Federal agencies have increasingly warned that operational technology used by water and wastewater utilities can provide an entry point for attackers, particularly when internet-connected equipment is left exposed or inadequately secured.
