行业专家以及美国现任、前任官员表示，美国十多个州的供水系统遭遇网络攻击，暴露出关键基础设施多年来投入不足的问题，也反映出美国对手有能力威胁普通民众习以为常的公共服务。
美国联邦调查局称，部分网络入侵事件造成供水设施水压下降、设备淹水，但各州及地方政府表示，饮用水安全并未受到破坏。
此次攻击发生在酷暑热浪期间，美国官员如今不禁发问：黑客为何没有进一步对供水设施造成更大破坏。举例来说，如果黑客操控化学药剂投加监测设备，就有可能危及饮用水安全。
一名美国官员表示：“难道来袭的只是对手的二流技术团队，实力也就仅此而已？倘若对方派出顶尖主力团队对美国发起攻击，后果会不堪设想。”
伊朗被列为此次网络袭击的嫌疑方，但美国官员尚未证实德黑兰方面参与其中。
多年以来，美国官员多次发出警告：俄罗斯、中国，以及实力相对弱一些的伊朗，麾下具备破坏能力的黑客团队一直在获取美国境内大量敏感工业网络的访问权限，潜伏等待危机时刻制造混乱。美国基础设施的薄弱环节 —— 例如服务军事基地的地方供水、供电厂，早已成为攻击目标。
如今，多座中小城镇与郡县的供水运营机构，正投入调查这起多年来水务领域最为严重的网络攻击事件。受影响地区从南达科他州延伸至佐治亚州。
拜登政府白宫前国土安全副顾问凯特琳・杜尔科维奇表示：“水务机构资源匮乏、极易遭遇网络攻击，这早已不是秘密，我们的对手对此心知肚明。对手瞄准关键基础设施，无需耗费太多成本，就能打击民众对政府的信任，同时制造巨大损失。他们布局多年，就是为了发动这类破坏行动。”
佐治亚州中部克莱顿县水务局发言人艾琳・托马斯称，该局此前从未遭遇过大规模恶意网络事件。水务局正在调查一起 “未经授权的网络活动”，该事件疑似造成一处水泵站故障，7 月 27 日凌晨当地发布饮用水煮沸预警。
她周四接受美国有线电视新闻网采访时说：“事件发生后，我们首要任务就是恢复系统运转。”7 月 27 日，工作人员仅用数小时就完成系统修复。
南达科他州拉皮德城官方 7 月 31 日通报，当地污水处理系统的一处提升泵站遭遇 “网络安全事件”。
被问及战时有可能遭到境外对手袭击时，该市公共工程主管迈克・泰斯表示：“发生这类事，我们并不意外。” 他回忆不起拉皮德城此前发生过同类网络攻击。泰斯称，工作人员及时发现系统异常，迅速将涉事设备断开互联网，才化解危机。
接连发生的黑客袭击事件，推动美国联邦与各州出台应对政策。纽约州民主党州长凯茜・霍楚尔宣布，将投入约 900 万美元补助，用于提升全州供水系统的网络防御能力。
加州民主党联邦参议员亚当・希夫的发言人向美国有线电视新闻网透露，希夫计划下周提交法案，赋予美国环境保护局更大权限，助力强化水务系统网络防护。
除国家安全层面的担忧之外，水务行业从业人员与网络安全专家普遍感到无奈：还有大量基础设施设备可以直接通过互联网访问。
美国国土安全部工业控制系统网络应急响应小组前负责人马蒂・爱德华兹说：“过去 20 年间，专家反复提醒水务机构，务必避免工控系统直接暴露在互联网上。近期这一系列网络入侵，根源就在于行业麻痹大意，预算分配没有把网络安全放在优先位置。”
Why US water systems are vulnerable to foreign cyberattacks
Acyberattack on water systemsin a dozen states is exposing years of under-investment in critical infrastructure and how US adversaries can threaten services that everyday Americans take for granted， according to industry experts and current and former US officials．
The cyber intrusions in some cases led to water pressure drops and flooding at facilities，according to the FBI， but did not compromise the safety of drinking water， according to state and local officials．
US officials are now asking themselves why the hackers， who struck during a scorching heat wave， didn’t go further in causing damage at the water facilities． Manipulating devices that monitor chemical dosing， for example， could have jeopardized the safety of the drinking water．
“Do we have the C team and they couldn’t do worse？” one US official said． “How bad could it be if the A team turned to the US？”
Iran is a suspect in the hacks， but US officials have not yet confirmed Tehran’s involvement．
For years， US officials have warned that sabotage-capable hacking teams from Russia， China and， to a lesser extent， Iran， were developing access to sensitive industrial networks across the US and were lying in wait for a moment of crisis to cause disruptions． The soft underbelly of American infrastructure — local water and power plants that serve military facilities， for example — have been targeted．
Now， water system operators in modest-sized towns and counties are at the forefront of investigation into one of the most serious cyberattacks on the sector in years． States from South Dakota to Georgia have been affected．
“It’s no secret that water utilities are under-resourced and vulnerable to cyberattacks， and it’s no secret that our adversaries know it，” said Caitlin Durkovich， a former deputy homeland security adviser in the Biden White House． “By targeting critical infrastructure， they can undermine public confidence in our leaders and impose significant costs with relatively little effort． They’ve spent years positioning themselves for exactly this kind of disruption．”
Erin Thomas， a spokesperson for the Clayton County Water Authority in central Georgia， said her team hasn’t experienced a malicious cyber incident at scale before． The water authority is investigating “unauthorized cyber activity” that may have caused a water pump station to fail， triggering a boil-water notice in the early hours of July 27．
“Our main concern when this happened was to make sure that we got the system up and running，” she told CNN on Thursday． （They accomplished that in a matter of hours on July 27）．
In Rapid City， South Dakota， a “cyber incident” hit one of the lift stations that serves the city’s wastewater system， officialsannouncedJuly 31．
“We’re not surprised by it，” Mike Theis， Rapid City’s public works director， when asked about the possibility of being targeted by a foreign adversary in wartime． He couldn’t recall a time when Rapid City had experienced a similar cyberattack． Theis credited the “quick action from our employees who noticed abnormal behavior” on computer systems and isolated them from the internet．
The hacking incidents have triggered federal and state policy responses． New York Gov． Kathy Hochul， a Democrat， has announced about $9 million in grants to try to strengthen the cyber defenses of water systems across New York．
Democratic Sen． Adam Schiff of California plans to introduce legislation next week that would give the Environmental Protection Agency’s greater authorities to help boost water cyber defenses， Schiff’s spokesperson told CNN．
Coupled with national security concerns is a deep frustration among water-sector specialists and cyber experts that there is still so much infrastructure that is directly accessible from the internet．
“For the past 20 years， experts have been telling utilities to make sure their systems were not directly accessible from the internet，” said Marty Edwards， former head of the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team． “This recent set of intrusions is the result of complacency and a lack of budget prioritization．”
