Cyberattacks on MN Water Systems Probed07/31 06:21

   

   (AP) -- Authorities were working Thursday to find the source of cyberattacks 
that targeted over 30 water systems in Minnesota and came amid warnings that 
Iranian hackers have been focused on such systems.

   Minnesota IT Services said state officials had yet to identify who was 
behind the attacks that took place Sunday and Monday. There were no reports 
that residents had been impacted by the attacks, though one city asked 
residents to conserve water for a couple hours while they tried to determine 
what was wrong.

   The FBI, which is investigating, has not publicly identified a culprit and a 
spokesperson declined to say Thursday who the bureau thought might be 
responsible. The FBI, Cybersecurity and Infrastructure Security Agency and 
other agencies warned in an advisory last week that Iranian hackers have been 
targeting water and wastewater systems and the operational controls other 
critical infrastructure sectors.

   Digital warfare has become ingrained in military conflict, and local water 
plants or healthcare facilities often lack the funds and know-how to install 
the latest software patches or take other security steps. That has made them a 
favorite target, both because of the relative ease of penetrating them and 
because of the panic such disruptions can cause.

   Iran has the "geopolitical motivations" and a recent history of targeting 
water systems, said Cynthia Kaiser, the former deputy assistant director of the 
FBI's cyber division who has been closely monitoring threats to critical 
infrastructure from hackers linked to the country.

   "I think most credible researchers and responders would be right to treat it 
like it's Iran until proven otherwise," added Kaiser, who is now the senior 
vice president of Halcyon's Ransomware Research Center. "When it walks like a 
duck and talks like a duck, it's really important to call it out."

   Iran's interest in the operations of water systems inside the U.S. dates 
back years. In 2016, the Justice Department charged a group of Iranian hackers 
in connection with a cyberattack targeting a small dam near New York City.

   Minnesota IT Services said that as of Thursday, there were no active 
requests from Minnesota communities for residents to modify usage of their 
drinking water. The state agency said most of the confirmed attacks involved 
technology that water systems use to remotely monitor and control equipment. It 
said that being impacted meant investigators confirmed there was malicious 
activity involving the system's technology and didn't mean every impacted 
community had their water service disrupted.

   The state agency said there are similarities among the incidents, including 
timing and the types of technology used, but investigators haven't determined 
if the same culprit was behind each one.

   For a few hours on Monday, the city of Braham asked residents to minimize 
water use as they tried to determine why the water plant was offline. The city 
of about 1,700 people, located about 70 miles (113 kilometers) north of 
Minneapolis, said in a news release that the water plant outage was due to a 
cyberattack, but it didn't cause any issue with water quality.

   The city said the attackers shut down the operating controls that shut down 
the well and water treatment plant. That left the city for a time only able to 
provide residents with the water held in the water tower.

   In Plymouth, a city of about 80,000 located outside of Minneapolis, 
officials said on social media that their water infrastructure communications 
had been restored by Tuesday afternoon following a cyberattack. The city said 
crews were able to continue operating the system during the outage and it 
didn't have any impact on water levels or quality.