▶ 0:15:45>> good morning. It is nice and bright and sunny outside. That is good. We will check on the snow removal later and see. Good morning and welcome to today's hearing. Today we will examine the challenges facing drinking water and wastewater systems to install, implement, and maintain cybersecurity as well as identify opportunities to address these challenges.
▶ 0:16:15I want to thank our excellent panel of witnesses for making the trip to share their perspective on this important topic. Your work to enhance the resilience on our wastewater systems is incredibly important to americans health and daily lives. 170 thousand water and wastewater utilities across the country.
▶ 0:16:41These utilities fill a vital role in ensuring communities across the country have access to safe and reliable water and sanitation services. In the audience we have several of our utility folks here. Shout out to my fellow west virginians. Accessible and reliable water and wastewater services are essential to protect public health and provide fundamental services to our constituents.
▶ 0:17:09It could be a foundational basis for a strong economy and america. Because of the role they play they are unfortunately a target for bad actors. We have seen a broad trend of entities linked to our geopolitical adversaries such as iran, china, russia using cyberattack's to target our critical water infrastructure. They may take various forms.
▶ 0:17:38Ransomware attacks could compromise business or customer information. Attackers could gain access and manipulate a systems operational technology disrupting the treatment or distribution of water with potentially dangerous amounts. Either way, a successful attack that disrupts safe and reliable water or exposes sensitive customer data could be debilitating.
▶ 0:18:07These threats must be acknowledged and challenged particularly as technological advances such as ai increase the speed and efficiency of these attacks. The rise of cyber attacks is occurring at the same time as our water and wastewater systems deploy new digital control technologies. I see some of them myself.
▶ 0:18:30As we look to upgrade and modernize our water systems it is more urgent for our utilities , federal agencies and cybersecurity experts to work together to increase that resiliency. It requires us to take a clear eyed look at the many challenges our utilities are facing.
▶ 0:18:59Workforce shortages limit in-house expertise and fulfill basic cybersecurity hygiene practices requires consistent monitoring and communication. In 2020 for the environmental protection agency identified instances were so water systems unified -- utilized a single login for all of their employees, failed to change default passwords entered not curtail former employees from accessing systems.
▶ 0:19:32Solutions to address cybersecurity must be deliberate and tailored to the challenges faced by utilities in different sizes and locations. A one-size-fits-all mandate will likely be overly burdensome and unworkable. Particularly for our smaller system and hinder the ability to take achievable steps towards meaningful progress.
▶ 0:19:57Water and wastewater systems are already grappling with how to prioritize limited resources while making federal and state requirements under the safe drinking water act. Costly requirements could distract from the core mission of reliable and affordable services to the american people. In addressing these challenges we must strike the right balance . To improve their cybersecurity at their own facilities.
▶ 0:20:29Due to the constantly evolving technological environment addressing this challenge will require innovative solutions. Building and maintaining resilience among cyber threats is not a one and doug event. It is ongoing and ever evolving. We should not rely on one solution or have blinders on when it comes to envisioning or preparing when it comes to threats.
▶ 0:20:59Looking forward to learning how we could be better partners with our water utilities to identify cybersecurity threats with a flexible toolkit going forward. I recognize ranking member white house for his opening statement.
▶ 0:21:17Sen. Whitehouse: Thank you chair cap enough -- capito. Cyber warfare are a reliably -- reality and have been for a while. I started the intelligence community cyberattack scores were we spent six months investigating cybersecurity threats to our country.
▶ 0:21:41Sen. Whitehouse: The water sector has modestly improved in coordination with epa and the cybersecurity agency and nonprofits and water sector trade groups have increased public awareness of cyber threats. This is insufficient.
▶ 0:21:59Sen. Whitehouse: Foreign bad actors enhance their capabilities state sponsored and aligned bad actors with countries like russia, china, iran, north korea have been relentless on their attacks on facilities. They have stolen information, extorted ransoms and disrupted sectors ranging from health care to as we hear about today, drinking water. Nearly 170 thousand water systems across our country.
▶ 0:22:32Sen. Whitehouse: As they modernize they incorporate technology that is more efficient yet more vulnerable to cyber attacks. Many of these facilities have already faced digital breaches but without more incident reports it is impossible to know the full scale of the threat they face.
▶ 0:22:50Sen. Whitehouse: Since 2023 chinese hackers have successfully attacked small municipal water systems in texas, pennsylvania, massachusetts and have tested security capabilities of countless other systems. Over the past six years rhode island municipal facilities have experienced at least six cyber attacks collectively resulting in hundreds of thousands of dollars in losses. These are just to get a sense.
▶ 0:23:23Sen. Whitehouse: All water utilities are at risk regardless of size while none of the previous attacks have caused major service disruptions, they all cost time and money. A cyberattack that incapacitated one water facility would not only be disastrous, it would spread clear across the country. According to an epa survey less than 25% of our wastewater utilities perform annual cyber risk assessments. Less than one in four.
▶ 0:23:55Sen. Whitehouse: Imagine the consequences of a coordinated nationwide it. Clearly we are not ready. The trump administration has forced out thousands of cybersecurity experts, cut funding and crippled our relationships with key international intelligence partners. We need to strengthen our cyber capabilities, not weaken them. We could change that.
▶ 0:24:22Sen. Whitehouse: Even when water utilities understand solutions, updating cybersecurity measures is often maintained with service levels. To meet the challenges of the 21st century we must repair or replace outdated infrastructure while updating our cybersecurity defenses. This is not either-or.
▶ 0:24:47Sen. Whitehouse: The infrastructure investment and jobs act provided more than $15 billion with some expanded eligibility for cybersecurity projects. This was a good start but not enough. I look forward to talk about how we can update physical and digital infrastructure across the country to keep water safe, available, and affordable. Thank you very much.
▶ 0:25:12Chair Capito: We will now turn to our witnesses. I'm very excited to welcome our first witness this morning. Marshall's institute for cybersecurity is working on several projects with water utilities in west virginia.
▶ 0:25:38Chair Capito: We are so excited to have the marshall university institute of cybersecurity. I look forward to learning more about this with his work today with Dr. simonton is his wife. Thank you for coming. And his son, who I just learned is a freshman year at george washington university when he is on an rotc scholarship.
▶ 0:26:06Chair Capito: Thank you for your service now and what it will be in the future. We also have the executive director of the marshall institute for cybersecurity for critical infrastructure. Thank you for being here. Is a professor and good friend for marshaling diversity. Welcome.
▶ 0:26:28Dr. Simonton: Good morning. Thanks for the opportunity to speak with you today. As the chair mentioned I am a civil and environmental engineer. A professional lens and in in kentucky and mississippi. A veteran and fellow at marshall university and professor in our college of engineering.
▶ 0:26:53Dr. Simonton: My workplace is the need between cybersecurity professionals and infrastructure operators helping translate cyber threats in real world engineering becoming safe with consequences so both sides could act on these risks. For more than 30 years I have worked with systems across idaho, west virginia, central appalachia and now cybersecurity. I want to offer a practical view from a region where small systems are.
▶ 0:27:23Dr. Simonton: The central lifelines and resource constraints. West virginia has several hundred community water systems and over 75% served fewer than 3300 people. These are rural systems with one or two operators who handle everything, treatment, distribution, reporting, digital oversight.
▶ 0:27:48Dr. Simonton: Even the smallest systems are relying on plc, internet connected control systems that they typically lack dedicated onto your cybersecurity staff. As outlined the vulnerabilities are common and well-documented. They include remote interfaces, plc credentials, flat networks that connect operational systems and legacy menards equipment that can't be used.
▶ 0:28:17Dr. Simonton: These issues show up consistently but not because operators like commitment but they lack capacity to deal with some of these issues. The water at, system serving more than 3300 people must complete risk and resilience assessment and emergency response plans that include cybersecurity.
▶ 0:28:40Dr. Simonton: In west virginia most of the systems fall below that threshold but they face the same cybersecurity threat but they don't have the mandate, staffing, or structure that they have to deal with cybersecurity risks. We leave or are left with a very significant gap in modern monitoring and control systems have reached even the smallest utilities but these cybersecurity utilities have not.
▶ 0:29:11Dr. Simonton: At marshall's institute for cybersecurity we are working directly with operators, utilities, to close that gap turning federal guidance into operational improvements and we have three examples illustrating this. They have helped prepare 14 national guard units that have since been deployed on real-world sovereign missions.
▶ 0:29:34Dr. Simonton: This expands the ability to access and secure infrastructure and it provides it where that local expertise is needed. Ics is guiding the town through its transition from paper-based processes that support billing, payroll, and a new wastewater treatment facility. Our work includes ot separation, secure remote access and staff training.
▶ 0:30:05Dr. Simonton: This provides a scalable model to rural communities. In the huntington water system, ics is conducting on-site ot assessments to upgrade to a digitally violent -- digitally controllable to violent system -- ultraviolet system. We help ensure it is integrated into the system and not added after the fact.
▶ 0:30:30Dr. Simonton: These engagements demonstrate what works, practical, repeatable assistance where they actually work. Long-term resilience is going to depend on people. Marshall has developed stackable credentials in the water sector for cybersecurity. Designed specifically for working operators that cannot leave systems to attend to extended training. They keep secure remote access, vendor oversight and response.
▶ 0:31:03Dr. Simonton: These are skills that reduce risk immediately. All of our fieldwork what we think is needed are pretty clear. We need targeted support that includes multifactor authentication, segmentation, secure remote access. Number two would be a circuit style cybersecurity program for utilities modeled after the usda's technical assistance program.
▶ 0:31:32Dr. Simonton: Number three would be to adopt the safe drinking water act requirements of the population threshold. And support for our university partnerships. It's exactly what marshall is currently doing statewide.
▶ 0:31:52Dr. Simonton: The operators who run america's small water systems are dedicated professionals who keep communities safe every day with the right partnerships between utilities, fiber units, federal agencies and universities like marshall, we can make small and rural systems some of the leading of the nation. I look forward to your questions.
▶ 0:32:14Chair Capito: Let me just ask you, ot stands for? Dr. simonton operational technology.
▶ 0:32:28Sen. Cramer: . Thank you for holding this very important and timely hearing. It is a pleasure for me to introduce matt alderman. He is here today in his capacity as an executive board member as the -- he has a big fan base. They are all here. Anyway.
▶ 0:32:56Sen. Cramer: He brings more than a decade of experience in cybersecurity security and critical infrastructure protection with a strong understanding of the unique protections facing rural water systems. It is a regional generation transmission and a number of distribution co-ops in the upper midwest. Securing data ot environment across a multistate utility footprint.
▶ 0:33:27Sen. Cramer: He has extensive experience in the rural water sector serving as a board member of the rural water district and as past president of the rural water association. I'm not sure what you do in your spare time. It is impressive. He's also a member of the cybersecurity agency and wastewater sector coordinating council.
▶ 0:33:52Sen. Cramer: He will provide valuable insight on cybersecurity challenges facing water systems and the rural system perspectives. Thank you for sharing your knowledge with us. >> good morning chairman o -- capito. Thank you for the opportunity to testify on this important issue.
▶ 0:34:17Sen. Cramer: I hail from the great state of north dakota where I serve as past president of the north dakota rural waters association. The rural water system has 282 members serving 92% of the states population. I'm especially proud to be a long term board member of the all seasons rural water district.
▶ 0:34:39Sen. Cramer: I'm here today on behalf of the national rural water association that represents 31,000 small and rural water utilities across the country. We provide a diverse range of services to our members including training, disaster planning and several affected technical assistance programs. Additionally on the water and wastewater center coordinating council.
▶ 0:35:06Sen. Cramer: I participated in a cybersecurity task force focused on developing a practical plan of action to help the sector advance its cybersecurity posture. For more than 20 years I have worked in I.t. And cybersecurity roles across sectors. I currently serve as the cybersecurity sector supervisor and have seen firsthand the cybersecurity challenges that play out in a converged I.t.
▶ 0:35:33Sen. Cramer: And ot environment. The vast majority of wastewater system serve communities of 10,000 people or less. We have the same responsibilities as large water utilities to deliver safe drinking water. The difference for us, small systems operate with limited staff, revenue, and technical capacity.
▶ 0:35:59Sen. Cramer: Most do not have in-house cybersecurity personnel. Cybersecurity is not a question of indifference, it is a question of capacity. Cybersecurity awareness through trusted nonregulatory partners, the state rural water association.
▶ 0:36:22Sen. Cramer: Through these efforts we are seeing a cultural shift more and more systems are moving to understanding that cyber risk is part of operating a modern utility. At the same time, how federal security efforts are delivered matters just as much as what is required from the sector perspective, the apa's first and foremost a regulator.
▶ 0:36:46Sen. Cramer: When cybersecurity became a part of it, many utilities felt they were being asked to suffer cyber weaknesses to an enforcement agency creating confusion and concern. For example, water system operators reporting and outdated firewall in an effort to be transparent warning that might lead to enforcement action. Even though they weren't meant to be punitive the regulatory power dynamic shapes how those actions are received.
▶ 0:37:15Sen. Cramer: Long-term improvements are built on collaboration and trusted technical assistance not fear of violations. There is also a cultural gap. When cybersecurity is framed as abstract I.t. Risk it feels disconnected. When it is framed as protecting systems and the ability to get water flowing 24/7 operators understand that. That translation is critical.
▶ 0:37:45Sen. Cramer: Organizations like the state rural water association's and others play a key role in bridging that gap. We offered five principles, first, lead with assistance not enforcement. Adoption is stronger when cybersecurity is delivered as support. Second, fun any mandate. Cybersecurity requires hardware, software, training, time.
▶ 0:38:16Sen. Cramer: Even a few thousand dollars could be a barrier. Focus on foundational controls. Many systems struggle with inefficient and weak passwords rather than threats. Rely on established, trusted partners. Organizations, utilities already rely on is more likely to be implemented. Recognized diversity. A system serving 800 people and to employees cannot be treated the same as a large utility.
▶ 0:38:48Sen. Cramer: Protecting small systems must be a national security priority. With the right balance of partnership, practical guidance, and resources we could strengthen cybersecurity across america's water infrastructure not through fear but through collaboration and resilience. Thank you for the opportunity to testify.
▶ 0:39:09Chair Capito: Thank you very much. Finally, thank you for coming. He is the deputy general manager of engineering and technology for fairfax water testifying on behalf of the association of metropolitan water agencies this morning. He has held various agencies. Welcome. You are recognized for five minutes.
▶ 0:39:39Chair Capito: >> thank you. Thank you for allowing me to testify. I am the deputy general manager at fairfax water. I'm here today on behalf of the association of metropolitan water agencies. The organization represent the large publicly traded utilities across the country. I also serve on the board of managers.
▶ 0:40:08Chair Capito: Which is the water sectors dedicated information sharing of four cyber, physical, natural threats. It is a growing issue that grows more by the day. Drinking water represent an attractive target and there have been insufficient federal resources dedicated to this topic.
▶ 0:40:30Chair Capito: A successful cyberattack on water quality and public health but would undermine safety and reliability of drinking water. Cyber threats have become more frequent, sophisticated, damaging. Addressing them requires sustained investment in people, technology, and planning.
▶ 0:40:50Chair Capito: According to the most recent survey, about 14% of systems reported at least one cyber incident during the quarter, up from 11.5% during the same period last year. Fairfax water employs a dedicated staff with response plans and the ability to leverage resources including the epa, the cybersecurity agency.
▶ 0:41:19Chair Capito: Fairfax water is not typical in terms of its water capabilities. Of the 50,000 systems, many lack the personnel or financial resources needed to utilize federal guidance, assess risk or implement actions.
▶ 0:41:36Chair Capito: There are many ways to strengthen cybersecurity across the sector including by increasing resources, authorizing targeted grant funding for resilience, ensuring the state and local governments are well resourced, and mapping out cybersecurity standards. It is critical existing resources are well funded and are being utilized across the industry.
▶ 0:42:03Chair Capito: It plays a unique role in the sector's by monitoring cyber threats and those affecting water utilities. It provides guidance on risk mitigation tools, best practices, and response actions that contribute to an all hazards resiliency posture. The waterice act receives no state or federal funding and places challenges in connecting with the thousands of systems across the country. It cites legislation that could expand access to these resources.
▶ 0:42:34Chair Capito: Congress also recognizes and must compete for water systems attention like infrastructure upkeep, compliance and mandates, keeping bills affordable. To help water systems invest in cyber defenses, in 2021 congress -- recognize the drinking water system and infrastructure resilience program for clean water agencies. The programs offered grant funding for cybersecurity enhancements.
▶ 0:43:05Chair Capito: These programs have received minimal funding. Helping water systems meaningfully invest in security personnel and enhance collective actions. Finally while guidance and tools are valuable there are currently no statutory requirements for systems. Making these best practices optional and leaving less resource utilities unprepared.
▶ 0:43:32Chair Capito: We recognize the danger in federal recognitions overly burdensome, complicated, especially in a rapidly evolving environment. Some level of federal guidance would help ensure all water systems are taking appropriate steps to protecting cyber threats. It is the establishment of a water risk that would be comprised as cyber experts and drinking water and wastewater system operators.
▶ 0:44:02Chair Capito: This could develop, recommend and oversee guidelines for drinking and wastewater systems tailored to the size of its profiles. Based on the model of the north american electric reliability corporation and energy sector, this organization will work in partnership with the epa to ensure water systems of all sizes insure themselves against cyber threats of all sizes.
▶ 0:44:27Chair Capito: While it is clear there is much more work to be done to strengthen our wider -- water system we are made ready to work with you towards meaningful solutions. Thank you for the opportunity to testify today. I look forward to your questions.
▶ 0:44:41Chair Capito: You can write in at the 0,= at the 0,.0 mark, very precise. I will begin the questions with Dr. simonson. You highlighted what marshall university's institute for cybersecurity is presently partnering with just to frame it for the audience, it is very small and the huntington water system, which I don't even know would be medium-size.
▶ 0:45:17Chair Capito: Larger. I was interested to hear and I heard this from the utilities that came to see me yesterday from west virginia, a cybersecurity circuit rider through the department of agriculture.
▶ 0:45:32Chair Capito: If you could print out briefly how valuable circuit riders are in general for this infrastructure and the smaller systems and how somebody dedicated fully to side -- cyber, would that be the best or somebody that has credentialing that could do both on the existing program?
▶ 0:45:52Dr. Simonton: Thank you for that question. The university is already able or we are moving towards supplying students to do these things for the utilities or others that don't have that in-house capacity.
▶ 0:46:15Dr. Simonton: Also with our national guard units that we are training and not just in water cyber but in infrastructure security in general. I would see or we would see these circuit riders as dedicated to cybersecurity because that is the need.
▶ 0:46:33Chair Capito: They could fill a day with that.
▶ 0:46:36Dr. Simonton: Absolutely. They provide that expertise. They become consultants to the various consultants that provide expertise that they already have. That's how we see those circuit riders ready to provide that capability that the utilities don't currently have.
▶ 0:46:59Chair Capito: Since you are dealing with the cybersecurity for critical infrastructure as a general rule, I said in my statement it can be one-size-fits-all. Would it be a parameters thing where you could then, technical assistance is what all three of you have said we really need.
▶ 0:47:20Chair Capito: You are not expecting the three-person utility to be able to beat this challenge on their own, what a framework for smaller systems that could then be a plug-and-play type of thing?
▶ 0:47:34Dr. Simonton: That's what we are trying to develop is this scalable plug-and-play framework . Every system is going to be different. The needs are going to be very similar. They will have similar systems, similar threats. We are developing this framework that could applied not just to water utilities but across infrastructure.
▶ 0:48:06Dr. Simonton: That again is providing that in-house expertise.
▶ 0:48:08Chair Capito: Thank you. Mr. overman, we are talking about rural water systems here and the unique challenges of the systems in rural areas. We all know if we could get into one system, a lot of times that could lead you to another system. How many different systems do you have in north dakota?
▶ 0:48:37Mr. Oderman: 282 members of the association. It is 97% of the state, it is significant.
▶ 0:48:49Chair Capito: How do you see that in terms of being able to serve where you are in north dakota?
▶ 0:48:55Mr. Oderman: The circuit rider program is the most successful built up program I have seen in our state. It is mature, it is well documented. The stuff is set up already. Those relationships between those systems and the state association are built.
▶ 0:49:19Mr. Oderman: If we are able to spin off cybersecurity I imagine the upkeep on that would be significant.
▶ 0:49:26Chair Capito: I want to talk about the workforce challenges. Several bills in the past putting availabilities for workforce development as I see in west virginia, those utilities are general managers or they do everything from fixing the leaky pipes, doing everything.
▶ 0:49:53Chair Capito: Trying to get young people interested in this as a career is I think difficult. The cyber aspect might have a little bit of a bump, the modernization of systems, you would be using all kinds of skill sets here. One of our systems uses an apprenticeship type thing where you start in high school, coming to the utility not even thinking it is something you want to do but make a little bit of money.
▶ 0:50:23Chair Capito: The next thing you know they are full-time employees working. Have you had any experience with that?
▶ 0:50:32Mr. Dewhurst: We take an aggressive approach with summer internships. The skill sets and types of jobs to run a utility. This gives students a chance to see what is involved even in the cyberspace. Whatever it may be. We get people introduced to the industry.
▶ 0:50:54Chair Capito: Senator whitehouse.
▶ 0:51:05Sen. Whitehouse: I'm pretty sure I remember west virginia supreme court justice richard neal he went to marshall university. I clerked for him years ago. If memory serves he was a very distinguished alumni and person there. [laughter] welcome and thank you to marshall university for your work on climate change.
▶ 0:51:36Sen. Whitehouse: Your research sustainability, the climate change advocacy, the armstead labs with operation climate resilience. You guys have done a lot of good work and I am grateful to you.
▶ 0:51:58Sen. Whitehouse: You mentioned the model, what is the nurk model and might -- why might it work for water utilities as opposed to electric utilities?
▶ 0:52:12Mr. Oderman: Where we shared utility and water I got to see it somewhat in action. Nurk is set up where my experience has been you have a mix of operators in the system as well as cyber experts that collaborate to develop standards and levels of compliance for different risks associated with each utility.
▶ 0:52:41Mr. Oderman: I think a model like that is work the conversation for how that could work with all of the different systems across the country. It doesn't prescript things. It is sort of an outcome based approach and gives risk-based requirements as a system that has more impact and more connectivity if you will across the space then one that is a little more isolated. We have baseline standards for everyone.
▶ 0:53:13Mr. Oderman: It will work its way across the entire sector. It is an important concept, we are not leaving anybody behind. One more aspect I will bring up is it gives a chance, you have heard in all of your comments, these threats are evolving. We have ai which just came out three years ago. The odds move quickly.
▶ 0:53:45Mr. Oderman: We could actually move more to address threats.
▶ 0:53:52Sen. Whitehouse: When I was first working on cyber and we were trying to do the big reform bill it got pretty close. Senators were all working with me on that. We were trying to figure out what the best way to have american businesses step up their defenses in this involving -- continually evolving environment.
▶ 0:54:20Sen. Whitehouse: We got to go back when things change. One of the things we are looking was to require cyber insurance. So that if you had general liability insurance you have to carve out cyber insurance that
▶ 0:54:53Sen. Whitehouse: Would then focus the insurance industry year-by-year in trying to look at how vulnerable you were and in particular with respect to liability whether you have the prevailing standard of adequate defense so that if something did go wrong you had done every reasonable thing that could be expected of you.
▶ 0:55:23Sen. Whitehouse: It's a lot to ask of all of you in one minute 30 seconds. I would be grateful if you would take a moment after the hearing is over to think about what role , requires a specific aspect of policy might have in terms of being that spur that continually drives forward and requires the
▶ 0:55:55Sen. Whitehouse: Insurance side and utility side to take a look at where they are on all of this. Is the question clear enough? My time is up so I will let that go. I look forward to hearing your written responses about that and the insurance element to this that could help solve the problem. Thanks.
▶ 0:56:18Sen. Cramer: Given that senator whitehouse's time ran out, I'm intrigued. I couldn't get past the first one. It made sense as a former regulator. You said provide assistance, not enforcement. And then I hear senator whitehouse talk about insurances.
▶ 0:56:49Sen. Cramer: As I'm listening to the first time talking about this, that is a better regulatory system than a government agency. There is a market. Maybe since he didn't have the time to listen, the time to chime in on his point and the point of not enforcement but assistance.
▶ 0:57:15Sen. Whitehouse: You could add senator cramer to your response to me.
▶ 0:57:24Mr. Oderman: The fiduciary responsibility of being on a board you typically look at the risk and cyber insurance is definitely a part of that. That is definitely dragging some organizations to strengthen cyber defenses. If you are a higher risk you pay higher insurance premiums. If you desire more coverage they will investigate you a little bit more.
▶ 0:57:54Mr. Oderman: This is somebody we can actually cover. It is happening already as far as dictating it in law or regulation, I'm not sure how that will play out. It is definitely moving the ball on the front lines.
▶ 0:58:15Sen. Cramer: The ability to collaborate, coordinate, particularly rural, some big municipalities. All my years in congress, probably more than any other thing. Even technical support. When you think about 280 services -- members, that is a lot of members.
▶ 0:58:47Sen. Cramer: Your members, while they like to collaborate and partner, they also protect our sovereignty and autonomy in some cases. A best practice that has worked for each of you, give us a little guidance.
▶ 0:59:04Mr. Dewhurst: I think we as a large system example want to work together with everyone, we engage with everyone across the state of virginia and share ideas and best practices. I think that is a great example, we can all collaborate together. That becomes a central clearinghouse for everyone in the country. He gives us a way to manage those threats.
▶ 0:59:34Mr. Dewhurst: It doesn't matter where you are in the country. I think it is a great tool to give us those standards. Thanks.
▶ 0:59:48Sen. Cramer: --
▶ 0:59:49Mr. Oderman: Definitely using trusted partners that have those relationships built out. The associations have a footprint in every community in north dakota for example. Probably on their cell phone, they probably know the kids names and things like that. That is a trusted relationship.
▶ 1:00:14Mr. Oderman: What doesn't work is a 15 page bulletin, information disclosure , that doesn't land with a small system. Definitely the trusted partners works the best.
▶ 1:00:33Dr. Simonton: I would add that I knew richard mealy personally and had cherished memories of spending time in his office. I can also address and is a former regulator and consulting engineer that dealt with regulatory agencies.
▶ 1:00:52Dr. Simonton: For the most part especially at the state level I found agencies to be valuable partners and very helpful in trying to help them comply with regulations. Actually providing what could become a very trusted resource for these utilities for example in this space.
▶ 1:01:18Dr. Simonton: That could be part of it and not just the punitive part of regulatory agencies. I find them to be very helpful.
▶ 1:01:33Sen. Blunt: Rochester -- Sen.
▶ 1:01:40Blunt-Rochester: For me, this hearing on cyber security and our nation's water and wastewater infrastructure is both critical and timely according to reports and these are public reports, one is even from my region.
▶ 1:02:01Blunt-Rochester: There is a quote that once a hacker gets into a water system they could potentially turn pumps and motors on and off, alter chemical levels in drinking water to dangerous levels and plant software bombs that could disrupt the water system later.
▶ 1:02:18Blunt-Rochester: That same report went on to say that there are risks associated with cyber hygiene as you mentioned two states and also cyber attackers, in many forms from disgruntled former employees to nationstates like china, north korea, iran, russia. This is the kind of stuff that could keep you up at night. You are all shaking your heads.
▶ 1:02:46Blunt-Rochester: One of the things I thought about when you add on to it in this moment is extreme weather. That is another risk. I want to start with you. I come from a state that is urban, suburban, rural, coastal. We have many small towns. Do water utilities account for extreme events when thinking about cyber attacks and what additional steps are needed?
▶ 1:03:13Dr. Simonton: I think that we have been blessed in this country with infrastructure that works. People don't give it a lot of thought. When they turned their tap on they get clean water. Whether it is chemical spills, extreme weather events, the weather infrastructure is fragile.
▶ 1:03:47Dr. Simonton: I could speak just across several environmental engineering in general, we are starting to take extreme weather events into account in design and maintenance and certainly that will applied to cyber systems within these utilities and therefore cyber security becomes an issue.
▶ 1:04:11Sen. Blunt-Rochester: The program run by epa is one of the few federal grant programs that helps reduce cyber security threats. It has never been funded near its authorized level of $50 million and is set to expire in fiscal year 2020 six.
▶ 1:04:37Sen. Blunt-Rochester: My republican colleague and I introduced the water infrastructure and sustainability act to reauthorize this critical program. Thank you for mentioning our bill in your written testimony. Why is reauthorizing this program so important right now and how do utilities use the resources to strengthen cyber security protections?
▶ 1:04:59Mr. Dewhurst: Thank you for the question and your sponsorship. That bill has such a wide range of uses that it could be used for. It allows a lot of the basic stuff to be done whether it is a simple assessment, employing software tactics, multifactor authentication. Firewall additions, those sorts of things.
▶ 1:05:30Mr. Dewhurst: I will echo your comments that it has not been funded to the level that it should. It is authorized but has not been appropriated. I think it touches all of the systems in various ways. We strongly echo your sentiments to fund it.
▶ 1:05:52Sen. Blunt-Rochester: You are shaking your head, I want you to -- I want to give you an opportunity to respond.
▶ 1:05:58Mr. Oderman: He nailed it. The only thing with grant applications for smaller systems , it could be an administrative workload that we simply don't have the capability to.
▶ 1:06:12Sen. Blunt-Rochester: It is back to the capacity.
▶ 1:06:16Mr. Oderman: That's were a circuit rider could assist with these types of applications.
▶ 1:06:21Sen. Blunt-Rochester: Thank you. When you also talk about the stackable water credentials, that is so important as a former personnel director, understanding that when you don't have that capacity, it might be to people or three people working. Making sure we have those.
▶ 1:06:47Sen. Blunt-Rochester: My time has expired but I will submit for the record questions on the use of ai tools and ai agents. This is something really important to me. I had another couple questions for the record. Thank you for this incredibly important and timely hearing. I yelled back. Several rickets -- Sen. rick
▶ 1:07:12Etts: Thank you for holding this important hearing today. What we could do to better secure our water systems against cyber security challenges we face. In nebraska, our wastewater utilities manage and protect our state's groundwater, they provide critical services to nebraskans and we have talked about how it impacts the states you are from.
▶ 1:07:41Etts: The security is increasingly at risk from foreign adversaries seeking to undermine critical infrastructure and threatened public safety through cyber attacks on our water systems. Communist china has actively been involved in targeting wastewater systems, critical infrastructure, every community across the U.S.
▶ 1:08:04Etts: Nearly 100 drinking water system serving 26 point 6 million people had critical or high risk vulnerabilities this includes open internet portals, default passwords, unpatched systems. They leave utilities exposed to criminals and foreign adversaries. It is important they have the tools, resources, and technical support necessary to defend against the cyber and foreign threats.
▶ 1:08:31Etts: There are many communities facing significant barriers in assessing these tools and resources. I met with the nebraska rural water association to share some of these challenges to protect our water systems and ultimately our national security, we must ensure rural communities are equipped to maintain resilient water infrastructure. In nebraska, they are doing just that.
▶ 1:09:02Etts: These platforms allow water utilities to monitor infrastructure from any location. What would be relevant advantage b of moving water operations to a more advanced automatic program like the cloud versus this?
▶ 1:09:20Mr. Oderman: There is definitive advantages to that model. Scalability, there is long-term cost savings. Typically you are not having to house as much technology equipment in-house. You get baked and security practices that they will not let you do certain things on the cloud platform. And then speak to the weather thing.
▶ 1:09:48Mr. Oderman: The location and diversity with some disaster recovery advantages as well. The one negative would be it takes some different technical set up and configuration to manage cloud services. Also you are dependent on internet connection so if you are somewhere without an internet connection you are stuck.
▶ 1:10:17Mr. Oderman: There is definitely a model that would work.
▶ 1:10:20Sen. Ricketts: With modern systems you have to upgrade more often, is that what your experience is?
▶ 1:10:27Mr. Oderman: Updates are all-consuming of my life right now. [laughter] that's what keeps me up at night. [laughter] it is a challenge and again that is where these smaller systems don't have the capacity to manage all of those I.t. And ot assets. Giving technical assistance to align with a trusted vendor that meets standards would be an avenue for them.
▶ 1:10:56Sen. Ricketts: Thank you. Dr. simonton, I was mentioning some of the cyber attacks, what documentation do we have on attacks against water infrastructure and what do we know about the sources or the actors behind these attacks.
▶ 1:11:16Dr. Simonton: I don't know that I could really speak to that. So much of what happens as you probably well know, the united states suffers a mind-boggling number of attacks every day. How many of those are directed specifically at the water sector , I could not answer that.
▶ 1:11:39Sen. Ricketts: Trying to get more documentation specifically on wastewater, we would know how much is being targeted as opposed to say hospitals with a high profile, everybody at the hospital can't get treatment. Right?
▶ 1:11:55Dr. Simonton: Absolutely, we are seeing across the board in infrastructure and what we are doing is not just focused on water cyber security, which is what we are talking about today. Where we started to build the framework, we are working in health care, finance, transportation, aviation because all of these areas are coming under more and more attack.
▶ 1:12:25Sen. Ricketts: I will note there are members of the nebraska rural water association. Thank you very much for your help with that.
▶ 1:12:34Sen. Husted: Thank you chairman capito. A lot of great comments. The lieutenant governor in ohio worked with cybersecurity in government all the time.
▶ 1:12:54Sen. Husted: I'm just curious if any of you would like to put in context how common -- how often a rural water system will receive an attempted cyberattack? Everybody is looking at me. How common is it?
▶ 1:13:22Mr. Oderman: I would say it happens probably daily whether there is impact from these cyber attacks, it could be just a fishing email or a port scan and nothing really occurs.
▶ 1:13:41Mr. Oderman: I do know we have had some in north dakota that we have risen to with the state and local information center to investigate and provide some technical assistance on investigating what happened there. A true number, it happens daily.
▶ 1:14:05Sen. Husted: Senator ricketts made a great point about migrating, in every case I know it is a preferable way to manage that, would you agree with that?
▶ 1:14:19Mr. Oderman: There is definitely advantages. Personally what I like the most --
▶ 1:14:26Sen Husted: It is just general advice. I have also learned of the past that despite the training, despite the systems and all that it is usually a human error that leads to this. That is thei see all of your he. If anyone wants to make a point about the importance of that.
▶ 1:14:51Sen Husted: >> in developing our micro credentials, we work closely with water utilities, small water utilities, and they do kind of throw their hands up when it come to the cybersecurity aspect. They know they are vulnerable. They know what they don't know. They know they need the training, they know they need the expertise to help at least from an awareness standpoint. The industry is quite aware of the need for training.
▶ 1:15:24Sen Husted: I think that is what's important. >> I would echo that. The vision campaigns out there are more sophisticated. We all get 1000 emails sometimes. You can scroll through and hit the wrong button and it can cause a lot of problem, a lot of harm. But again, it takes the culture, awareness, takes people to take a minute before they think about it. Often you are in such a hurry to get things done, you don't do that.
▶ 1:15:51Sen. Husted: Where our rural water systems, do you think they know that, do you think they are aware of that? I want to add, what should they do if there is a breach? What is it they are supposed to do? What is the first thing they are supposed to do?
▶ 1:16:15Mr. Odermann: Generally, they are aware there are phishing attacks and things of that nature. The first thing they should do if they are under attack is reach out to the trusted resource. For most people in north dakota, that would probably be their membership's system's I.t. Group that they were with. After that would be north dakota state and local information center.
▶ 1:16:47Mr. Odermann: Hopefully, the state and local information center can direct them to the resources they would need.
▶ 1:16:57Mr. Dewhirst: Utilities pride themselves on the prepared and having a plan. Having a cyber response plan. You know what to do if and when it happens. You were ill prepared to think clearly in that moment, so to know what you need to do to address that is something we should all be aware of, have.
▶ 1:17:16Sen. Husted: Is there a federal agency would inform, and if so, who?
▶ 1:17:23Mr. Dewhirst: Cisa would be the obvious choice. I want to echo my comments earlier about connecting utilities so that when instances occur, no matter where they are, they can be brought to light and shared with us across the country in a very expeditious way so we can guard against that happening somewhere else for the same vulnerability.
▶ 1:17:44Sen. Husted: I know my time is running out. From my research, most of the attacks come from north korea, iran, russia, and china. They don't come from ukraine or israel. I just want to note that. Thank you, madam chair.
▶ 1:18:03Chair Capito: Thank you. Senator schiff.
▶ 1:18:09Sen. Schiff: Thank you, madam chair, for calling this hearing on this important but overlooked topic. I share many of the concerns that I think you have about making sure water and wastewater systems are protected from cyber attacks. This is a critical issue, the nexus of water affordability, environmental quality, national security.
▶ 1:18:29Sen. Schiff: I've been working on a bill to provide eva more tools to address the issue and provide water systems with the resources they need to properly fortify their cyber systems without impacting the water and sewage bills paid by american households. I'm hopeful this committee can work together to work on addressing this problem. I have a couple questions for anyone on the panel who would like to weigh in. How prevalent do we believe the ransomware attacks are?
▶ 1:19:05Sen. Schiff: I know, particularly in corporate america, there is a reluctance to notify the bureau or anyone else when there is a cyberattack for fear of it becoming public, reputational harm. Do we have a sense of how often water systems are under ransomware attacks?
▶ 1:19:27Mr. Odermann: I don't think we have a clear understanding of what it is but ransomware attacks are definitely more prevalent than nationstate attacks. A nation sponsored threat tend to lie and wait, x filtrate data. Ransomware is more of a criminal mindset, we are going to try to leverage and get money out of these people. It is devastating to members.
▶ 1:19:59Mr. Odermann: I know in north dakota, there's been a few hospital systems that suffered ransomware attacks. It has been particularly hard for them. They had had to get short-term financing just to get their billing enabled. It's a very serious thing.
▶ 1:20:14Sen. Schiff: I remember a hospital in my district, eight or 10 years ago, locked up all the hospital's data. The hospital went to the fbi and said, what do we do? They were demanding I think $17,000 in cryptocurrency. The fbi said do you want your data back? They said we need the data. The fbi said pay them.
▶ 1:20:43Sen. Schiff: I am sure they wouldn't demand 17,000 anymore. But there is no requirement that water systems report when they are victims of cyber attacks. Do we not have much of a sense of it all, how much it happens?
▶ 1:21:00Mr. Dewhirst: We try to be the central repository but we don't say a certain city or county, we try to make it, make awareness of this ransomware attack did occur. Here is the avenue by which they access their system. Make sure to address this vulnerability. That is how I think we can learn together, by that central repository.
▶ 1:21:24Sen. Schiff: How many have you been notified by in the last year?
▶ 1:21:28Mr. Dewhirst: Ransomware attacks? I don't think that many, maybe a handful. For the water specifically.
▶ 1:21:39Sen. Schiff: Some of the destructive attacks that we have become aware of have targeted smaller water systems in kind of random locations.
▶ 1:21:54Sen. Schiff: Do we think they were targets of opportunity, formalized actors -- iran, whoever -- are looking to punish the united states, have identified this motor system is using a dated software system? Do we think that is what is going on with these kind of strange target selection?
▶ 1:22:20Dr. Simonton: I believe what is happening is they are attacking many systems at all time and looking for the vulnerabilities. Some of those systems will provide those were abilities. I think it is a wildly cast net, and just the unlucky few are actually getting hit.
▶ 1:22:37Sen. Schiff: Is the net cast by a spearfishing email that is blasted out, how do they cast the net?
▶ 1:22:48Mr. Odermann: It can be. In my current occupation, we see that weekly, that spearfishing campaign. Generally speaking when it comes to ot networks, I.t. Networks live on the internet, through a random port scan, scanning a whole list and they get return values. We have the sport open. Let's see if we can go further here.
▶ 1:23:15Sen. Schiff: That kind of search is done for not just water agencies but a broadsword for someone using an unpatched software?
▶ 1:23:24Mr. Odermann: There is really no way to tell from a port scan, small, rural water system or large utility, it is just a wide net. As soon as they see that poor or service is open, they dig further to see if they can exploit the vulnerability.
▶ 1:23:41Sen. Schiff: Last question. The major infiltrations like the chinese typhoon, do we know whether we are having any success in excising that? That may be beyond the scope of what we can discuss in the hearing, but how much do we know about what may be lying in wait?
▶ 1:24:14Mr. Odermann: I will do my best to answer the question. That is a very serious concern in the cybersecurity community. Have we made headway? I think there is a little more information sharing come down from fbi in regard to some of those things. We get that information faster through the information sharing, so that information does get to us faster.
▶ 1:24:44Mr. Odermann: Whether it is acted on, I don't know if I can provide any details on that. It is definitely a concern.
▶ 1:24:50Sen. Schiff: Thank you, madam chair.
▶ 1:24:53Chair Capito: Senator markey.
▶ 1:24:58Sen. Markey: Thank you, madam chair. Mr. dewhirst, your testimony outlines recommended legislative solutions to address the cybersecurity challenges facing the water sector including my bill, the water intelligence security and cyber threat protection act. I was proud to develop that legislation with the association of metropolitan water agencies. Boston water and sewer played a central in establishing the water sharing, analysis center which is known as water isac.
▶ 1:25:33Sen. Markey: Water infrastructure security is a point of pride in our state. In 2024, boston water and sewer experienced a ransomware attack that water isac assisted them in navigating avoiding widespread damage to our system. Mr. dewhirst, are there any other organizations that compare with water isac in terms of services and real-time assistance to water utilities?
▶ 1:25:58Mr. Dewhirst: Thank you for the question and thank you for your support of that bill. That's a wonderful avenue for all utilities to take advantage of, really to make water isac an important pillar in our sponsor cyber security threats. I would say many utilities had to have third-party assistance at the ready. We have contracts that are typically a zero retainer contract with different firms to be ready to respond to a cyber instance should that occur.
▶ 1:26:27Mr. Dewhirst: I think water ice that can provide some initial support and guidance if something were to occur but I go back to the need to have a cyber plan in place, response plan in place to know how to respond.
▶ 1:26:38Sen. Markey: Right now there are no other organizations that are comparable?
▶ 1:26:41Mr. Dewhirst: Not that I'm aware of.
▶ 1:26:44Sen. Markey: It is clear that if we want to support our water systems and deal with cyber threats, we need to support this water cybersecurity organization. Mr. dewhirst, do you agree the primary barrier for water utilities to access these vital cybersecurity services is simply funding?
▶ 1:27:02Mr. Dewhirst: I think it is funding and also time. We have heard a lot about what rural systems, they have a lot of things they are doing. They don't have dedicated staff to certain things, so that's an aspect.
▶ 1:27:14Sen. Markey: Is funding the principal --
▶ 1:27:17Mr. Dewhirst: Funding is a big deal.
▶ 1:27:19Sen. Markey: Vision without funding is a hallucination.
▶ 1:27:23Mr. Dewhirst: Absolutely. We need money. We need funding, yes.
▶ 1:27:27Sen. Markey: Thank you. That is why I introduced my legislation which would provide the funding to water utilities to access the cybersecurity services offered by waterisac. I look forward to working with my colleagues on that. The reason I'm really apprehensive about this, there was a cyber incident called stuxnet back in 2010, really drew a lot of attention to this entire area.
▶ 1:27:57Sen. Markey: The cia, national security apparatus of the united states came to me as the chairman of the energy subcommittee, to ask me if I would pass legislation that would mandate that electric utilities in america upgrade their cybersecurity.
▶ 1:28:20Sen. Markey: I took my counterpart, fred upton, the ranking member of the committee, we went down, we saw how dangerous it was, you brought all the members down to get the secret briefing. They were terrified at the fact that the iranians and north koreans and the russians and the chinese were all attacking our electric grid system every single day, trying to find vulnerabilities, getting ready for when they could do it.
▶ 1:28:48Sen. Markey: Thomas edison would identify our electric system, the levels of protection. We had a piece of legislation, we drafted it, passed it on a bipartisan basis. What happened was, it came over to the senate, this wonderful institution. Senator kyle from arizona got lobbied by his electric utility.
▶ 1:29:15Sen. Markey: They didn't want to spend the money even though the fort in arizona is on the public grid, making it easy access into that incredibly important military facility in our country. And it died over here in the senate. Andy has died year after year, even though we passed it unanimously in the house, because electric utilities did not want to spend the money. But it is a game of cat and mouse, right?
▶ 1:29:45Sen. Markey: The cat, all of these powerful, super sophisticated cyber giants around the world, and the mouse is our electric grid and water systems. They are unprotected. They still have not had the upgrade in a cybersecurity productions in which they need, waiting for the inevitable, inexorable successful catastrophic attack.
▶ 1:30:16Sen. Markey: It is time for us to get real about this issue. It is no only 100 times worse because of ai, in terms of the sophistication of the technology that can be used. It's time for us to put the mandate and the funding in place for companies, so that all of these horrible infrastructure systems are able to protect themselves against the attack which is coming. The only question is are we going to protect against them?
▶ 1:30:43Chair Capito: Thank you. We don't have any further questions. I would like to thank the witnesses. Senator whitehouse.
▶ 1:30:54Sen. Whitehouse: I just want to make one brief point about the distinction between nationstates, cyber attacks, and ones that are done more by criminal organizations. To be clear, there is not a clear dividing line between the two.
▶ 1:31:13Sen. Whitehouse: It is quite apparent that russia, while it may engage in some specific cyber attacks on its own account through the fsb and other official organs of putin's thug oligarch government, also encourages, supports, and funds all sorts of organizations that are driving hacks out of moldova, lithuania,
▶ 1:31:46Sen. Whitehouse: Wherever. While those are not purely nationstate attacks, they are subsidized and authorized, and they are constantly probing for weaknesses so that, while they may get a hit at putting the target's equipment into a lockbox and extracting ransom, they are also providing information to russia about where vulnerabilities are so
▶ 1:32:19Sen. Whitehouse: That when they want to move as a nationstate to attack our resources, they can do so. Maybe even let these groups do it on their behalf so they can keep a veneer of deniability, the same way that putin is keeping a veneer of deniability on the destruction of infrastructure through the baltic by pretending that these ships that are dragging their anchors through cables and disrupting them are somehow not anything he has to do with.
▶ 1:32:50Sen. Whitehouse: I just want to make sure in the record of this proceeding it is clear that the difference between a direct nationstate cyberattack and the sort of gray zone of nationstate-supported semi-deniable, partly gangster, criminal stuff, it's not that clear.
▶ 1:33:07Chair Capito: I like to make an additional point, as somebody who lives in a committee who lost their water source through a chemical spill for many weeks. There's a couple of things beyond what happens to the destruction of the system. It becomes a very emotional response. It can really grow. You begin to lose trust.
▶ 1:33:30Chair Capito: Your authorities -- the health authorities and otherwise, unless they are crystal clear, and we have gone through this with the cdc because they were not in this case -- begin to take on a greater role, and they have to be prepared, whether it's is cyberattack or chemical spill.
▶ 1:33:49Chair Capito: If you are able to infiltrate successfully a cyberattack on one of your smaller systems, there might be people who say that only serves 2500 people, that doesn't really matter. What matters is the lack of trust and the cascading effect that it has on every rule community. This could be me. How do I know?
▶ 1:34:13Chair Capito: That is why, at every level, we need to make sure the protections that we afford a larger systems are the same protections that we can provide for the smaller systems. I was also thinking, if, let's say, you have the same I.t. Person, they get into a system and then maybe that same I.t. System does fayetteville. Is there a way in? Then you're into the bigger system because it is the whole I.t. System.
▶ 1:34:48Chair Capito: I think there's a lot more connectivity here and a lot more emotional part of protecting our rural water systems then we really got into today. I would identify also a gap. I think we need better data on how many attacks. Nobody really had the answer to that question. How many, where are they occurring, how they occurred. That will always be best or best practices to try and prevent. Those are my little commentaries.
▶ 1:35:15Chair Capito: I want to thank all the rural water people in the audience today for coming. Senators who wish to submit written questions -- we heard from senator whitehouse, senator blunt rochester who will submit questions going maybe senator ricketts. Until 5:00 wednesday february 18 to submit their questions. Given his sponsor these questions are back to the committee no later than 5:00 p.m. Wednesday, march 4, and will be submit it for the record. With that, this hearing his return. This hearing was very interesting.