New bills look to help small water systems tap cybersecurity help

House and Senate lawmakers touted a pair of bills Wednesday tied to strengthening the security of clean water and wastewater utilities from cyber threats. 

The Water System Threat Preparedness and Resilience Act—sponsored by Rep. Jan Schakowsky (D-Ill.) and by Sen. Ed Markey (D-Mass.)—aims to make it easier for utilities to get details about potential cyberattacks or natural disasters that could dramatically affect operations.

The legislation plans to do this by helping small utilities join a security information source dubbed the Water Information Sharing and Analysis Center, or WaterISAC, through a proposed grant program run by the Environmental Protection Agency. The bill seeks $10 million in federal funding to support the effort.

Established in 2002, WaterISAC is a nonprofit overseen by a board of managers "comprising water and wastewater utility managers and state drinking water administrators," and provides critical infrastructure threat intelligence for members paying dues ranging from $100 per year to $7,700 per year, according to its website. 

WaterISAC maintains relationships with both federal and state agencies to receive security information and resources to help mitigate any potential threats. 

But Schakowsky and Markey noted in a statement that while roughly half of the nation's large water utilities have joined the nonprofit, "less than one-tenth of one percent of smaller utilities" are WaterISAC members.

"The water that we use to drink, take a shower, wash our dishes and cook our meals is essential to life for communities across our nation," Markey said in a statement. "Yet, from extreme weather to terrorism to cyberattacks, our water systems face increasingly complicated threats." 

Water and wastewater systems are among the 16 sectors the Department of Homeland Security has designated as vital to the nation's security, national economic security, national public health and safety. 

They are also increasing under the threat of cyberattack, most notably in 2021, when a potentially lethal breach occurred at a water treatment plant in Oldsmar, Florida.

WaterISAC Board of Managers Chairman John P. Sullivan said in a statement that while current members serve 60% of the total U.S. population, "only about 400 of the nation's nearly 50,000 community water systems and 16,000 wastewater systems are paying WaterISAC members that enjoy full access to all of the nonprofit's threat and vulnerability alerts, subject matter expertise, and other information."