Mapping Iran’s Cyberattack on American Water Infrastructure | CSIS
CSIS’ report “Mapping Iranian Cyberattacks on U.S. Water Systems” is a useful, detailed summarization and corroboration of publicly available coverage of the recent Iranian attacks. In this Discourse we underline the key findings and lay out some strategic questions as the event dissolves into the media’s rear-view mirror.
Table: Attacks by state and type of attack
State: # : Type
Minnesota : 36 : ICS (Industrial control system)
Michigan : 9 : OT (Operating technology)
Georgia : 3 : ICS
New Jersey : 2 : OT
Alabama : 1 : ICS/Supervisory control and data acquisition (SCADA)
South Dakota : 1 : OT
Oregon : 1 : OT
Arkansas : 1 : OT
Utah : 1 : OT
Findings
The attacks were fairly distributed and low in intensity, although Minnesota experience the most attacks by far. The most damaging was in Georgia, where attackers locked out operators and shut down a pump station, causing a drop in water pressure and increased risk of contamination (CSIS deemed that attack of medium grade. Every other received either a “medium-low” or “low” grade). Most problems only led to limited disruption.
What it means
The low-grade nature of the attacks raises questions about their strategic intent. Analysts have expressed two differing takeaways:
- Iran could have been seeking to send a clear message of their capability as a deterrent against future or ongoing U.S. operations against Iran, without pulling out all the stops; or
- This actually represents an escalation from previous attacks that is more in line with the extent of Iranian capabilities.
Either way, the attacks showed how vulnerable U.S. water systems are to cyber attacks. CSIS notes how the U.S. has over 150,000 separate water systems, many of which are managed at the local level and very few of which are seeing increased funding for defensive buttressing.
CSIS does not address the concentration of attacks in Minnesota. As we said in a previous Discourse on the subject called “Iran, the Blame Game, and America’s Fragile Water Infrastructure,” the prominence of Minnesota in U.S. domestic elections this year– and Trump’s proclivity to blame Minnesota’s democratic government for that state’s ills– suggests that this concentration is not a coincidence. If Iranian hackers lack any technical capabilities, they do seem to know how to poke the American interior where it could sow the most possible tension.
