A new Water Watch Center has launched to help small water utilities defend against cyberattacks, as recent incidents in multiple states raise concerns about threats to local water systems
A nationwide initiative called the Water Watch Center has been launched to help small water utilities strengthen their defenses against cyberattacks, following a series of attempted intrusions targeting water systems in several states. The program was announced at the DEF CON hacker convention in Las Vegas and is designed to provide direct cybersecurity support to utilities serving fewer than 10,000 people-a group that makes up the majority of community water systems across the United States.
The Water Watch Center is a collaboration between the National Rural Water Association and DEF CON Franklin, a project of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy. The effort comes as more than 30 community water systems in Minnesota were targeted by cyber incidents late last month, with similar activity reported in about a dozen other states. While officials say these systems have continued to operate safely and there have been no confirmed impacts on public health, the incidents have prompted a coordinated response from the FBI and the Cybersecurity and Infrastructure Security Agency.
As part of the new initiative, an initial group of five cybersecurity firms will work directly with small water utilities to deliver mitigation services and help prevent future attacks. According to Jake Braun, co-founder of DEF CON Franklin and a former White House acting principal deputy national cyber director, the program aims to create a scalable model for delivering cybersecurity assistance to the water sector-something that has proven challenging for both industry and national security officials in the past.
Retired Gen. Paul Nakasone, who led U.S. Cyber Command and the National Security Agency from 2018 to 2024, spoke at DEF CON about the vulnerability of water utilities nationwide. He emphasized the need for higher cybersecurity standards in the sector, specifically warning that programmable logic controllers-small computers used to operate pumps and valves-should not be exposed to the internet due to the risk of remote attacks.
Some U.S. officials suspect that Iran may be behind the recent cyber incidents, though there has been no public confirmation of attribution. Gen. Nakasone noted that the government is proceeding cautiously to ensure accurate identification of those responsible, citing Iran's history and capability in cyber operations as factors under consideration.
According to the National Rural Water Association, most community water systems in the U.S. serve small populations and often lack the resources to maintain robust cybersecurity programs. The Water Watch Center is intended to fill this gap by offering practical support and expertise to utilities that may otherwise be vulnerable to cyber threats.
Cybersecurity for water infrastructure has become a growing concern for local governments and utility operators, especially as digital controls become more common in managing water treatment and distribution. The Water Watch Center's launch reflects a broader push to protect essential public services from evolving cyber risks, with a focus on supporting the small utilities that form the backbone of water delivery in many American communities.
