Cyber threats an immense and global challenge for New Hampshire’s water suppliers

A spate of cyberattacks on water systems in at least 12 states this July, which the U.S. government tentatively attributed to Iran, brought national attention to a growing concern for water operators in New Hampshire and across the country. 

The New Hampshire Department of Environmental Services is not aware of any impacts to New Hampshire systems from that particular spree of attacks, spokesperson James Martin said in an email to the Bulletin. But, he added, “systems are always being probed.”

Would-be hackers, in other words, are constantly testing the cyber doors and windows of New Hampshire’s many public water systems. It’s a constant and evolving threat, operators told the Bulletin, and the advent and evolution of advanced artificial intelligence is rapidly making bad actors more capable. 

Like their counterparts across the country, New Hampshire operators and officials are locked in a scramble to stay ahead of this constantly shifting issue, said Joshua Corman, a cybersecurity professional based in Dover who runs a nonprofit intended to help local governments and utilities prepare for cyberattacks. 

The threat is big, Corman said, and especially hard for small water operators, like those in New Hampshire, to defend against. Operators said they were taking steps and looking for help to stay ready.

Widespread connection, widespread risk

Cybersecurity efforts have long centered on protecting information, like identities and sensitive documents, from unwanted eyes, Corman said. But there’s another realm where internet connectivity is important to modern life, and it’s one that has long received less attention: operational technology. This is physical infrastructure and operating systems that are computer-automated and, increasingly, connected to the web.

Internet connectivity allows staff to tweak and monitor equipment from afar, making operations more efficient, said John Boisvert, chief executive officer of Nashua’s Pennichuck Water and president of the New England Water Works Association. It might, for example, let technicians turn a valve from afar to adjust water pressure throughout the distribution system or tweak the amounts of sanitizing chemicals added to water.

Internet connectivity isn’t inherent to water treatment systems. At their core, these processes are a balance of physical engineering and chemistry, Boisvert said. But it’s increasingly common in practice.

In Concord, remote and automated operations allow the water treatment facility to run with less than half the staff it would require to operate offline, according to Jackson Keane, water treatment superintendent for the city. That saves on payroll. But Keane knows that increased connection also increases opportunities for hackers. 

Because remote operations have pervaded American water infrastructure — and that of other essential utilities — without concurrent investment in cybersecurity, the systems are left with security gaps, Corman said. Those have attracted the kind of unwanted attention exemplified in the July cyberattacks and others before them, including a 2023 attack on public utilities in Littleton, Mass. 

The attacks we know about are likely only part of the full picture.

“It’s likely that there have been more that we just don’t know about,” Boisvert said.

Hackers take many forms, from individuals operating domestically to coordinated efforts that are either sanctioned or led by foreign governments. The U.S. government has tentatively attributed the recent spate of cyberattacks on water systems to Iran. And, Corman said, weak spots in U.S. utilities’ firewalls are also an area of interest for the Chinese government.

Corman, whose resume includes time with the U.S. Cybersecurity and Infrastructure Security Agency, told the Bulletin he believes China may attempt to create widespread disruptions in American utility services to distract from an attempt to invade and seize Taiwan, a theory he shares with colleagues and has also spoken to in testimony before Congress.

In this way, vulnerabilities in water system cybersecurity can bring matters of geopolitics to the front doors — or, more accurately, kitchen sinks — of Americans.

For a small New Hampshire water supply, the scope of these threats can be daunting, Corman and Boisvert said.

The majority of New Hampshire public water systems serve small, rural communities, many with a small team that may struggle to keep up with evolving cyber threats. Pennichuck Water, by comparison, is large for New Hampshire, with multiple staff members dedicated to information technology and cybersecurity. But even for Pennichuck, keeping up with the threats requires constant attention, Boisvert said. 

“The threats to (smaller operators) are no different than they are to us,” he said. “That’s where the real difficulty comes.”

The stakes

Talking about how cyberattacks could disrupt water service, and the consequences that would ensue, invariably gets “heavy,” Corman said. But it’s important, he believes, to consider worst-case scenarios in order to be best prepared.

The actual mechanics of an attack could see physical damage to the distribution system, whether from rapid pressure changes that could burst pipes or changes to pumps that make them quickly burn out, Corman said. Tampering with chemical additions or alarms that would ordinarily alert operators to system failures are other routes to harm.

A burst main or failed pump takes time to replace and can be extremely expensive, potentially creating a window where water could be restricted in the affected area.

To help frontline workers imagine what could follow a particularly catastrophic scenario, Corman runs crisis simulations as tabletop exercises, using a 20-sided die to introduce randomness. 

He ran one such exercise at Dartmouth College this spring, during a conference on cyber-resilient healthcare organized by the school’s Institute for Security, Technology, and Society. 

One participant, and an organizer of the event, was Institute Fellow Malcolm Schongalla, who is also employed as an emergency physician at Dartmouth Health-New London Hospital and teaches at the Dartmouth Geisel School of Medicine. (He spoke to the Bulletin about the event only in his capacity as a fellow with the institute, he said.)

The exercise simulated a loss of water to the Hanover and Lebanon area, asking participants — among them healthcare professionals, cybersecurity experts, emergency workers, and others — to problem-solve their step-by-step response. 

“What surprised me the most was how quickly decision-makers have to make consequential choices that have big impacts,” Schongalla said. “… It really forces you to confront stark choices. I was surprised at how quickly you have to make those decisions, and with how little information is available to you.”

A reliable water supply is crucial to the continued operations of a hospital, Schongalla said, for uses from the sterilization of instruments and patient rooms to food service, fire suppression, and even climate control. Without it, operations would rapidly become constrained.

At any hospital, and in any community, a sudden loss of water might lead to decisions like turning people away from the emergency department; postponing surgeries; and choosing how to prioritize services like dialysis centers, nursing homes, and the homes of local residents when there isn’t enough water available to go around.

“As an emergency physician, my patients and I would be on the front line of these attacks,” Schongalla said. 

What can be done

Pennichuck Water relies on help from the state and federal government in order to stay up-to-date on their cyber defenses, Boisvert said. 

They have particularly valued consultation with the New Hampshire Department of Environmental Services and the U.S. Cybersecurity and Infrastructure Security Agency, he said. 

The Overwatch Foundation, a New Hampshire nonprofit, also works with municipalities to improve cybersecurity, including for water system operations infrastructure. 

But Boisvert would like to see more resources made available to water systems for readiness work, and he is concerned about the Trump administration’s cuts to the Cybersecurity and Infrastructure Security Agency staff and programming, including cuts that have reduced the amount of help available to critical infrastructure providers. 

Aid from that agency can be crucial to small operators, Boisvert said. 

“Those are the last places that we should be diverting funds away for other activities,” Boisvert said. 

Corman recommends engineering physical solutions, especially when moving goalposts make true cybersecurity preparedness feel out of reach. 

That could look like a pressure-moderating valve, which mechanically prevents the kind of rapid pressure changes that could disrupt a system, or a locally controlled time-delay device to keep hackers from rapidly turning implements on and off in an attempt to burn them out. 

Through his nonprofits, such as UnDisruptable 27, Corman works with public water systems to help implement these protections — which can also be less expensive than cybersecurity protection, he said. 

The principles behind Corman’s recommendations echo an idea raised by Keane: to be truly safe from cyberattacks, a water system may have to be fully disconnected from the internet. 

“Depending on how bad things get in the future, I wouldn’t be surprised if it did get that way. … But it is a huge cost,” Keane said, adding that voters would have to decide what path they want to take. 

But the solid foundations of water treatment are a major advantage that makes the worst-case scenarios less scary to Boisvert, he said. 

“The beauty of water treatment is it’s hydraulics and chemistry at its heart,” he said. “… There’s a really solid operational and engineering foundation we can fall back on, to be able to make sure that we can operate systems. … There’s storage in the system, there is reaction time, and there are things that we try to set ourselves up for, by building redundancy.”

Boisvert called for more regulation to make water system cybersecurity more robust across New Hampshire, in addition to added support and funding.

This matter also came up before the New Hampshire Legislature earlier this year. 

In March, legislators rejected a bill that sought to make water operators liable for damages if they did not have a certain level of cybersecurity protections in place for their operations. But they would later pass Senate Bill 589, from prime sponsor and Dover Democrat Sen. David Watters, which included some requirements for water and energy system cybersecurity. 

The bill calls for drinking water and wastewater system operators to implement cybersecurity protection programs, and allows the New Hampshire Department of Environmental Services to make rules about cybersecurity programs for the systems. That rulemaking process is beginning this month, according to a department spokesperson.

On the ground, stakeholders need more government support to fully understand the scope of the risks they may be facing, Schongalla said. 

Public preparedness is also part of the challenge — though increasing knowledge of the threat without inciting panic is also a delicate balance, Schongalla added. He called for individuals to think about their own emergency preparedness plans, including by imagining how their community losing access to water might complicate things.

“The resources and the systems that we’ve built up, you know, could be fragile under many circumstances, and it’s important to study ways to prepare,” he said. “… We’ve lived our whole lives expecting these services to be available. It’s hard for us to imagine what it’s like to not have them.”