Albany reviews water system security after nationwide cyber attacks

ALBANY — Albany Utilities reviewed its water system and implemented precautionary measures after receiving an urgent warning about cyber attacks targeting water and wastewater infrastructure, city officials said, as federal authorities continue to investigate a recent wave of attacks that has included systems in Georgia.

Kendall C. Hodge, Albany’s director of utility operations, said his team received the cyber security warning July 27 and immediately evaluated the city’s system from two perspectives: the security and operation of its computerized monitoring system and Albany’s ability to continue providing water if that system became unavailable.

“From an operational standpoint, we have not experienced any known cyber security incident that has impacted the operation of our water system or SCADA system,” Hodge said.

Albany uses a Supervisory Control and Data Acquisition system, commonly known as SCADA, to provide centralized, around-the-clock monitoring and supervisory control of its water infrastructure.

From the city’s Distribution Operations Control Center, employees can monitor wells, tanks, pumps, alarms and other equipment throughout the system.

The technology is significant because federal authorities have warned that cyber actors are increasingly targeting operational technology — computer systems that interact with physical infrastructure rather than simply storing information.

The FBI and U.S. Environmental Protection Agency issued a warning in late July following cyber incidents involving water and wastewater utilities in multiple states. Attackers targeted internet-facing programmable logic controllers used to operate equipment within water systems, according to federal authorities.

In some incidents, attackers changed network settings and passwords, causing utilities to lose monitoring or control of equipment. Federal authorities reported operational consequences including loss of water pressure and flooding.

At least two Georgia water utilities, Clayton County Water Authority and Columbus Water Works, have publicly reported cyber security incidents associated with the recent wave of attacks.

Hodge said Albany Utilities took the warnings seriously and reviewed its own environment in coordination with the city’s Technology and Communications Department.

The departments also implemented precautionary measures based on information contained in the warning, he said.

Hodge did not disclose details of those measures, and The Albany Herald is not seeking information about specific cyber security configurations that could compromise the city’s defenses.

One of the most consequential questions raised by the attacks is what happens if hackers successfully disrupt the centralized computer system used to monitor and control a city’s water infrastructure.

In Albany, Hodge said, losing SCADA would not mean losing the ability to operate the water system.

“The water system is not solely dependent on SCADA to operate,” he said.

If communications or supervisory control through SCADA became unavailable, trained water system operators could be dispatched to equipment throughout the system and operate it locally, he said.

Those employees would coordinate with the Distribution Operations Control Center while centralized monitoring and control were being restored.

“Personnel would be dispatched in a systematic manner to address emergent issues and physically operate the system to restore and maintain system stability,” Hodge said.

That type of backup capability has become increasingly important as federal agencies warn water utilities to prepare for attacks capable of crossing the line between computer-system disruption and physical infrastructure problems.

Federal authorities have recommended that utilities strengthen protections around remotely accessible industrial equipment, maintain backups and ensure critical processes can continue if centralized computerized controls become unavailable.

The recent incidents follow years of warnings about the vulnerability of the nation’s water infrastructure.

EPA inspections beginning in 2023 found widespread deficiencies in water-system risk and resilience practices. Federal watchdogs also have warned that water and wastewater utilities face particular cyber security challenges because of aging technology, staffing shortages and limited resources.

The latest attacks have brought those concerns closer to home.

Federal authorities separately warned in July that Iranian-affiliated cyber actors had been targeting internet-accessible industrial control equipment across water, municipal and energy infrastructure since at least March. Authorities have not publicly established that those actors were responsible for all of the water-system attacks reported later in July.

The attacks underscore a vulnerability increasingly confronting public utilities: The same technology that allows operators to monitor wells, pumps and tanks from a central location can also create new avenues for disruption.

For Albany, Hodge said the city’s defense includes preparing for the possibility that those computerized controls may not always be available.

“As is standard protocol for water distribution service providers in the state of Georgia, we maintain contingency plans, procedures and protocols that allow essential water operations to continue if centralized computerized controls become unavailable,” he said.

That means a successful disruption of Albany’s centralized monitoring system would not necessarily mean a loss of water service. Operators can be dispatched into the field to physically control equipment while the city works to restore its centralized system — providing a layer of resilience increasingly important as cyber threats move beyond computer networks and toward the infrastructure residents depend on every day.