Old-fashioned safeguard protects city’s water supply
In an era when hospitals, pipelines and school districts have all fallen victim to cyberattacks, it’s reassuring to learn Russellville’s water supply is protected by something hackers can’t touch through a keyboard — a human being with a toolbox.
General Manager Eric Hill told the Franklin County Times last week that Russellville Utilities relies on a monitoring system tracking tank levels, booster stations, chlorine readings and equipment status around the clock, alerting staff via voice calls, texts and emails the moment something needs attention.
According to Hill’s own weekly reports, workers have responded to alerts in an average of two-anda- half minutes.
That’s an impressive number. But the most important detail in Hill’s explanation isn’t about speed — it’s about what the system can’t do.
“The biggest thing is that our chemicals are adjusted manually, and even if we were hacked, it would still take someone physically going down there to do anything,” Hill said.
In other words, no matter how sophisticated an attacker’s tools might be, Russellville’s actual water treatment — chlorine dosing and other chemical adjustments — happens by hand, on-site, by an employee.
There’s no digital door that might accidentally be left open. That distinction matters more than it might seem at first glance.
Nationally, cybersecurity officials have grown increasingly concerned about programmable logic controllers, industrial devices that operate pumps and equipment and are sometimes left connected to the internet with no password or a default one still in place.
Hackers have exploited exactly that kind of oversight elsewhere, in some cases locking operators out of their own systems.
Hill, who serves on the board of the National Rural Water Association, said federal officials have described suspected — though unconfirmed — Iranian involvement in some of these intrusions, with activity intensifying alongside tensions in the Strait of Hormuz.
It’s a sobering reminder that a small Alabama utility isn’t operating in a vacuum; geopolitics can, and does, reach all the way down to the tap.
Operator Darron Pounders, who has spent nearly three decades with the department, put the practical value of the system simply.
“If we have a chlorine leak in the basement, we’ll know it before we even have to send someone down there to check it out,” Pounders said. “That helps keep people safer for sure.”
New federal requirements taking effect this fall will require utilities to report cyber intrusions to federal agencies within 72 hours, and ransomware attacks within 24.
Russellville, like other utilities serving between 3,300 and 50,000 people, completed a required risk and resilience assessment for the EPA this summer.
It would be easy for a city utility department to treat these regulations as bureaucratic box-checking. Instead, Hill described a genuine, layered approach — automated monitoring paired deliberately with manual control, backed by nearly two years of federal briefings on a threat that isn’t slowing down.
“We utilize the system a lot, and that’s to make sure we keep everything running like it’s supposed to and customers get their water safely,” Hill said.
There’s no way to make any water system hacker-proof, and Hill doesn’t claim otherwise. But there’s something quietly reassuring about a utility that hasn’t over relied on convenience at the expense of security — one that keeps a human hand on the most sensitive controls, even as everything else gets faster and more automated.
In a threat landscape this uncertain, that oldfashioned safeguard might be Russellville’s smartest investment yet.
