Why are public water and wastewater systems connected to the public internet if they are critical national infrastructure and why Minnesota and Michigan?

The Know Your H2O Team has 2 Answers

1. Because many of them have to be, but the implementation has been done very poorly and

2. Because the public takes for granted low-cost water utility services and the implementation cost is not something that can be easily seen as value added and the public and many NGOs demand platforms that are easy to use with access to the data.

A More Politically Correct Response

Water and wastewater facilities are highly distributed. Pumps, wells, reservoirs, treatment plants, and remote stations are often spread across large geographic areas, including rural or hard-to-reach locations. For thousands of small municipal utilities, staffing every site around the clock is expensive and often impractical.

"About 70% of water utilities inspected by federal regulators recently violated basic security standards, revealing a critical gap in capability. The EPA uses targeted enforcement alerts, sanitary surveys, and evaluation programs rather than a single public grading scorecard to measure and boost water system cyber defense capacity."

Remote connectivity—often through cellular modems, VPNs, or other internet links—lets operators:

- monitor pressure, flow rates, chemical levels, tank levels, and alarms in real time;

- respond to problems after hours without long drives;

- reduce labor and travel costs; and

- give vendors and contractors remote access for diagnostics, updates, and maintenance and sometimes gives the customers access to view system performance.

As SCADA and automation systems became more common, many utilities added internet-connected access for convenience, compliance reporting, data collection, and operational efficiency. In too many cases, this was done cheaply and quickly, sometimes exposing PLCs and other control devices directly to the internet instead of routing access through secure gateways, VPNs, or private networks. That is the core problem. The need for remote access is legitimate; the implementation is often not secure enough.

Federal agencies such as CISA, EPA, and NIST all recognize that remote access is often necessary for efficient operation of water infrastructure. Their consistent guidance is that control devices should not be directly reachable from the public internet. Remote access should terminate at a controlled intermediary with strong authentication, logging, and network segmentation.

As for why Minnesota and Michigan were hit so hard, the most likely answer is not that those states are uniquely vulnerable. More likely, they had the same conditions found across many small utilities: limited cybersecurity staffing, legacy equipment, weak network segmentation, default or reused credentials, and internet-exposed remote access.

In short, these systems are online because they need to be manageable, affordable, and responsive. If 70% of the systems are failing to meet basic security needs, this means it is more likely than not that your water authorities for your community are NOT Prepared. The risk comes when that necessity is implemented without enough security. In many cases, the real vulnerability is not technology alone, but the assumption that trusted operational access will remain safe without hard controls. Therefore, our trusted culture in many ways is a vulnerability that needs to be managed and requires a high investment to secure our lifestyle and systems.

Tools for Your Community and Water/Wastewater Authorities (Hold them to Account)

Assessment programs: Utilities can request a free evaluation via the EPA Water Sector Cybersecurity Evaluation Program to identify risk gaps.

Self-assessments: The EPA Vulnerability Self-Assessment Tool (VSAT) helps operators find cost-effective risk reduction measures.

Procurement guidelines: The EPA Cybersecurity Planning resources provide checklists for vetting third-party vendors and managed service providers.

Things you can do to prepare.

1. Maintain a stockpile of bottled water and perhaps some emergency water filters and disinfection tablets. This is one reason we work on projects that develop local spring water sources of bottled water. These become great resources during an emergency and most of the operational permits issued by the state require the water to be used for "emergency" purposes. We have gone one step further, we installed a series of rain water collection systems.
   
   
2. Purchase a Solid Go Bag, emergency radio, and an emergency generator. If you have the budget, you might want to consider a mobile off the grid water treatment system.
   
   
3. Update the software on your cellphone and home computer and consider installing a VPN (US Based).
   
   
4. Update all passwords on your cameras, security systems, phones, computers, and credit cards and perhaps get a small fireproof safe to store some cash.
   
   
5. Remove your information from databases. We recommend Incogni. This is a service we use.
   
   
6. Join or sign up for your state and local community and utility emergency notification services.

Other Articles - Cyberattacks

Article 1: How and Why Are Hackers Targeting U.S. Public Water Systems?

Article 3: Why Are Our Local Water and Wastewater Utilities Vulnerable to Cyberattack?

Get an In-Home DIY Water Screening Test

Safe Home Water Testing Kit — This water testing kit has everything you need to test your water at home! Includes 14 different tests.

The Know Your H20 Team partners with the Keystone Clean Water Team .  The Keystone Clean Water Team is a (501 c3) that focuses on Pennsylvania, but helps private well owners and small water systems worldwide. For more information about us, please visit our portal.  We have a new educational booklet on drinking water quality "Our Drinking Water".    

More Questions -visit us at KnowYourH20.com

If you can – give us a hand – all we ask, is you share, retweet, and help promote our social media platforms. If you can donate – GREAT ! Buying your testing supplies via our shop is another option to help this mission.

Affiliate Disclosure: This article contains affiliate links. If you purchase a product through one of these links, we may earn a small commission at no additional cost to you. We only recommend products we believe in. This helps support our mission to educate consumers about water quality.