Local water systems have security measures in place

RUSSELLVILLE — As cyberattacks on U.S. water systems climb nationwide, local officials say a combination of rigorous safety protocols and old-fashioned manual controls is keeping the water supply safe.

As for Russellville Utilities, General Manager Eric Hill said his department uses a monitoring system that tracks tank levels, booster stations, chlorine readings and equipment status around the clock. In the event something goes wrong, the system will send voice calls, texts and emails to operators when something needs attention.

According to a weekly report Hill receives, which shows him how many alerts went out and the average response time from his staff, workers have been able to handle any issues within an average of two-and-ahalf minutes.

The system, which is built around remote terminal units, or RTUs, relays data every two minutes and includes battery backups that can keep monitoring for six to eight hours during a power outage.

The network’s cellular connections roam automatically among carriers, so an outage on one network — such as the widespread outage several years ago — would not cut off communication with the utility’ s remote sites, Hill said.

Employee access is also tracked electronically. Workers swipe into facilities, and the system logs how long they remain onsite. Supervisors are alerted if something unusual happens after entry, including chlorine gas alarms that trigger before a worker enters a building’s lower level.

Operator Darron Pounders, who has been with the department for almost 30 years, said the security system has developed significantly over the years and recent changes allow for workers like himself to react quickly in the event of a situation.

“It will tell you if a tank is low for whatever reason or if something has stopped pumping or whatever it may be,” Pounders said. “For instance, if we have a chlorine leak in the basement, we’ll know it before we even have to send someone down there to check it out, and that helps keep people safer for sure.”

Despite the sophistication of the monitoring network, Hill emphasized the most sensitive function that could be cause for concern — chemical dosing in the water supply — cannot be altered remotely.

Chlorine and other treatment chemicals are adjusted manually by employees onsite, meaning the utility’s monitoring system can only observe chemical residuals, not change them.

That distinction has become central to national conversations about water sector cybersecurity.

CONTRIBUTED/BRADY PETREE
Russellville Water and Sewer Board operator Darron Pounders, who has been with the department for almost 30 years, said the water security system has developed significantly over the years and recent changes allow for workers like himself to react quickly in the event of a situation.

Hill, who serves as a board member of the National Rural Water Association, said hackers have targeted programmable logic controllers, or PLCs, which are industrial devices that operate pumps and other equipment and are sometimes connected directly to the internet by third-party contractors during installation.

Those controllers are often left with no password or a default factory password, creating an opening for attackers who, in some documented cases, have altered IP address settings to lock operators out of their own equipment.

Federal investigators, including the FBI and the Cybersecurity and Infrastructure Security Agency, have been briefing utilities on the threat, Hill said.

He added that federal officials have described the activity as suspected, but not confirmed, Iranian involvement with attacks intensifying around tensions in the Strait of Hormuz.

New federal reporting requirements are set to take effect this fall. Under rules from the Environmental Protection Agency, utilities will be required to notify federal agencies of the Department of Homeland Security within 72 hours of a cyber intrusion, and within 24 hours in the event of a ransomware attack.

Utilities serving between 3,300 and 50,000 people were also required to complete risk and resilience assessments for the EPA by this summer. The Water Information Sharing and Analysis Center, a national resource for the sector, has expanded free services to utilities serving fewer than 10,000 people, up from a previous threshold of about 3,300. Officials also pointed to guidance urging utilities to avoid naming facilities in ways that make their function obvious, such as labeling a site “Water Pump Station 1,” which can help attackers quickly identify high-value targets.

“We’ve had cellular outages before, but because of how our system is set up, guys working here have never even noticed we had an outage because the backups are working like they’re supposed to ,” Hill said. “We utilize the system a lot and that’s to make sure we keep everything running like it’s supposed to and customers get their water safely.”

Hill said the layered approach — combining automated monitoring, manual chemical control and federal coordination — reflects lessons learned over nearly two years of briefings with federal agencies on the growing threat to water infrastructure nationwide.

“The biggest thing is that our chemicals are adjusted manually and even if we were hacked, it would still take someone physically going down there to do anything,” Hill said. “Anytime something happens, the alerts go out to so many of our people that it doesn’t take long for someone to notice and get it fixed quickly.”