EPA Drills Water Utilities on Internet Outage Scenarios
The EPA conducted a national cyber drill simulating a three-day internet outage to test water utilities' resilience and manual operational capabilities.
The U.S. Environmental Protection Agency (EPA) recently conducted a national cyber drill designed to test the preparedness of the nation's water and wastewater utilities against severe cyberattacks, specifically simulating a prolonged internet outage. The exercise, held via Zoom, presented a fictional scenario where a cyberattack by Chinese military hackers crippled a national telecommunications provider, cutting off internet connectivity for three days.
This simulated outage impacted the fictional Riverbend Public Utility, which serves 120,000 customers. The drill challenged the utility to maintain water supply and safety without its usual reliance on internet-based systems. This included the loss of SCADA connections to remote sites, telemetry, cloud services, email, and even basic cellular and landline communications, highlighting the critical dependence of operational technology (OT) on ubiquitous connectivity.
EPA Senior Cybersecurity Specialist Brandon Carter, who led the drill, noted that the scenario was based on intelligence regarding the threat group known as Salt Typhoon, emphasizing the realistic nature of the threat. Participants included emergency response planners, IT and OT security specialists, state and local partners, and utility managers from over 200 water and wastewater utilities across the country.
The drill aimed to prepare utilities for sophisticated adversarial tactics by mirroring a "complete loss of third-party communications" in a "worst-case scenario," according to EPA spokesperson Jacob Murphy. Discussions during the exercise focused on critical decision-making processes, such as declaring a "significant operational incident," opening an "investigative record" for post-incident analysis, and establishing alternate internal and external communication channels.
Participants also grappled with the logistical challenges of maintaining operations during an extended outage. This included discussions on changing staffing patterns, the necessity of 24-hour on-site personnel, and potential trade-offs between maintaining water quality and water pressure if manual treatment processes were required. One significant dilemma raised was whether to prioritize fully treating water or simply maintaining system pressure for essential services like firefighting.
While the EPA encouraged utilities to conduct live-action drills, the response indicated a gap in practical preparedness. Out of 390 participants on the Zoom call, only 67 opted for the more intensive manual operations module, and just one confirmed having already transitioned to manual operations. This suggests that while awareness is growing, the transition to true manual operations remains a significant challenge for many utilities, particularly larger and more complex organizations.
Andy Krapf, director of Cybersecurity for Loudoun Water, commented that the feasibility of manual operations depends heavily on the utility's size and technological dependence. Smaller, less dependent utilities might find it easier to revert to manual checks, whereas larger metropolitan utilities are more reliant on remote operational capabilities, making the transition more arduous.
The EPA's exercise underscores the growing vulnerability of essential infrastructure to cyber threats that target communication networks. As utilities become increasingly reliant on digital systems, the ability to operate effectively during an internet blackout is paramount to ensuring public safety and service continuity.