Every news cycle follows the exact same pathetic script. A bunch of small-town municipal water plants get compromised because they left internet-exposed industrial controllers wide open with factory-default passwords. The media runs breathless warnings about foreign adversaries. The finger-pointers scream about Tehran, shouting that state-sponsored actors are coming for our taps.
Stop buying the theater.
The threat is not an elite cell of foreign super-hackers executing a masterclass in geopolitical cyber warfare. The threat is structural negligence, institutional cheapness, and a municipal water sector that treats cybersecurity like an optional software update.
The Myth Of The Sophisticated Foreign Threat
When reports flood in about water systems taking hits across a dozen states—from Minnesota down to Georgia—the knee-jerk reflex is to marvel at the reach of foreign intelligence agencies. Mention groups like CyberAv3ngers or hint at Iranian Revolutionary Guard affiliations, and suddenly everyone forgets how basic these intrusions actually are.
Let us look at the mechanics. We are not talking about zero-day exploits ripping through custom-coded defense architectures. We are talking about threat actors running automated scripts across the global IP space, scanning for Programmable Logic Controllers (PLCs) left naked on the public internet, and trying admin/admin for a password.
That is not espionage. That is digital dumpster diving.
If a burglar walks down a suburban street trying every front door handle and finds one unlocked, you do not blame an international crime syndicate for the open door. You blame the homeowner who couldn't be bothered to turn the deadbolt. Yet when municipal utilities—running critical infrastructure, mind you—leave their operational technology exposed to the open web with zero multi-factor authentication, we pretend we are victims of a sophisticated geopolitical chess match.
Why The Infrastructure Is Rotting From Within
I have consulted with industrial control systems operators who wouldn't know a firewall from a firewall tile. They are municipal workers, water treatment specialists, and civil servants doing heroic work keeping water flowing, but they are entirely unequipped to fight a digital war.
The structural failure here comes down to three fatal flaws:
- Outsourced Blindness: Water boards routinely hand off the installation of cellular modems, remote telemetry units, and remote-access ports to third-party integrators who prioritize convenience over containment. They open up direct port forwards so they can troubleshoot a pressure valve from a golf course, completely bypassing central IT oversight.
- The Budget Desert: Try telling a rural county water authority that they need to allocate fifty thousand dollars for air-gapped monitoring software and network segmentation. They will laugh you out of the room. They are operating on budgets that look like they were written in 1994, running legacy operational technology (OT) that lacks basic secure-by-design principles.
- Regulatory Vacuum: We regulate the aviation industry down to the millimeter. We mandate security standards for financial institutions that make compliance a full-time profession. But water? There are over 170,000 drinking water and wastewater systems in the United States, fragmented into tiny, decentralized districts where oversight is a patchwork joke.
When you combine lazy security hygiene with an atomized utility landscape, you get a sprawling digital attack surface. Foreign actors don't need cyber-weapons. They just need a search engine designed for finding connected devices, like Shodan, and a willingness to exploit systemic apathy.
The Counter-Intuitive Fix Nobody Wants To Fund
The federal government responds to these incidents with sternly worded advisories from CISA and the FBI, begging utilities to take their programmable logic controllers offline and switch back to manual operations.
That is a band-aid on a gushing wound. Manual operations are a temporary triage, not a strategy.
Imagine a scenario where the federal government cut off every single non-compliant municipal water utility from federal disaster relief and infrastructure grants unless they air-gapped their operational networks by the end of the fiscal year. Chaos would ensue. Local politicians would scream bloody murder about unfunded mandates. Bureaucrats would stall.
It would be brutal, unpopular, and entirely effective.
Security cannot be solved by sending out PDF advisories telling overworked water operators to change their default passwords. It requires an aggressive, top-down mandate: if your water system touches the public internet without enterprise-grade security layers, zero-trust architecture, and strict physical isolation, you lose your operating license. Period.
Until we stop hiding behind the geopolitical boogeyman of the week and look squarely at our own domestic refusal to fund and enforce basic infrastructure hygiene, these hacks will keep happening. The enemy isn't overseas. The enemy is our own commitment to doing the bare minimum.
