LEILA FADEL, HOST:
Chinese hackers recently spent nearly a year deep inside a public power utility in Littleton, Massachusetts. U.S. officials said it was part of a large-scale plan to destabilize American infrastructure in the event of a future conflict. Hackers linked to Iran previously breached several U.S. municipal water utilities as well. Now over 50,000 public water treatment plants across the United States are hoping to stop attacks like that from happening to them. NPR cybersecurity correspondent Jenna McLaughlin sends us this story from Vermont.
JENNA MCLAUGHLIN, BYLINE: It's August in Cavendish, Vermont. And I'm in the thick of things with Chris Hughes.
CHRIS HUGHES: So where we're going now is the beginning of the process. This is where it comes into the sewer plant.
MCLAUGHLIN: He's giving me a tour of the wastewater treatment plant, where he's the assistant operator.
HUGHES: There's a manhole right there.
MCLAUGHLIN: All right.
HUGHES: It's the beginning. That's where it comes off the street, goes into there.
MCLAUGHLIN: Some days he's raking through the muck.
HUGHES: What you see there are rags and things that don't belong that we have to screen out ourselves. Some places have automated machines that do that. We don't. We have a rake.
MCLAUGHLIN: Oh. Sounds like a fun job.
HUGHES: Yeah. Yeah. Again, either you love it or you don't. It's the nature of the beast.
MCLAUGHLIN: Hughes does love this work in all its technical, mathematical, chemical and, yes, dirty glory. And lately it's only gotten more complicated. Nowadays, Hughes also has to worry about the threat of cyberattacks.
HUGHES: It's gotten scary that I'm the only door between, you know, the Iranians and our water system, you know? It kind of makes me a little nervous. I don't really have a background to be fending off foreign entities, you know?
MCLAUGHLIN: The threat is real. To learn more about it, I went to the same man who testified on the subject before Congress last year.
ROBERT LEE: Hi, I'm Robert Lee. I'm the CEO of Dragos and cofounder.
MCLAUGHLIN: Lee used to work in government, including at the NSA. And then he founded Dragos, a company that focuses on protecting the critical industries that keep societies running. He says his company sees hackers burrowing into these systems all the time, hackers working for nation states like Russia and China, as well as cyber criminals, ransomware groups looking to make money. They understand that water is fundamental, something countries might go to war over or that companies would pay a steep price to get flowing again.
LEE: The reality is that they have a real influence on populations, not only the ability to hurt people but also scare people.
MCLAUGHLIN: Lee and Dragos are donating cyber tools to protect utilities like the ones in Cavendish. And they're not the only ones volunteering. There's a new effort underway called Project Franklin pairing cybersecurity experts with water operators like Hughes. And the Rural Water Association, another teammate on Project Franklin, is getting technical experts into rural water facilities to run threat assessments.
(SOUNDBITE OF MACHINERY HUMMING)
MCLAUGHLIN: During the tour in Cavendish, Hughes walked me through some of the ways these experts have already helped him start securing these systems, installing network monitoring tools, covering up the Wi-Fi password, saving multiple backups of key data. But more than that, helping him think differently about what could go wrong. We talked about worst-case scenarios as the pumps at the water treatment facility hummed.
HUGHES: If someone got into the system, they could just turn it off and even stop producing water. We'd be dead in the water, I guess.
MCLAUGHLIN: Dead in the water. It's serious stuff. Access to water is life and death. But if Hughes could make one final plea with the public, just please don't flush those flushable wipes.
Jenna McLaughlin, NPR News.
(SOUNDBITE OF MASSIVE ATTACK AND TRACEY THORN SONG, "PROTECTION") Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
