Iran likely behind water-system attacks in Minnesota, but ‘surprising’ it hasn’t taken credit, expert says

Iranian hackers are likely behind a widening cyberattack campaign against U.S. water systems that has reached at least seven states, including more than 30 systems in Minnesota alone, and likely extends further, a cybersecurity expert told JNS on Friday.

“The working assumption is that it is Iranian threat actors,” Annie Fixler, director of the cyber and technology innovation center at Foundation for Defense of Democracies, told JNS. “The kind of behavior matches what we’ve seen out of Iran. The kind of targets and the systems that we’re talking about match.”

Fixler cautioned that no actor has publicly claimed responsibility.

“What we don’t have is anyone claiming responsibility, which is a little surprising,” she said. “Iranian hackers tend to claim responsibility for stuff because of that ‘perception-hacking’ component, because they want to let everyone know they did it and that they’re really scary and big and bad.”

Minnesota officials said on Tuesday that more than 30 community water systems in the state were targeted in coordinated attacks on July 26 and 27.

The FBI said on Thursday that water utilities in at least seven states reported similar cyber incidents. The other affected states have not yet been identified publicly.

Fixler told JNS that she doubts that seven will be the final number.

“It’s certainly an evolving situation,” she said. “If it’s seven, there’s no reason to think it stops there. The FBI is saying ‘at least seven.’ I’m sure it’s larger than that.”

U.S. President Donald Trump denied on Friday that Iran was responsible for the Minnesota attacks. Instead, he blamed the state’s “corrupt governor.”

“We heard in Minnesota there was a cyberattack, and they blame it on Iran. I don’t think so,” he stated. “I think I blame it on Minnesota, because they’re grossly incompetent.”

“There was a cyberattack of 30 water plants, and I would blame it on Minnesota and the governor, the corrupt governor of Minnesota,” the president said, during a cabinet meeting at Camp David.

“They like to say, ‘Oh, it was Iran,’” Trump said. “Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”

The hackers reportedly gained unauthorized access to systems that control water operations, changed passwords and caused disruptions, including losses in water pressure and flooding.

Fixler said that the hackers targeted programmable logic controllers, or PLCs, which control industrial equipment such as pumps, valves and switches. By accessing that equipment directly, hackers can interfere with physical operations without first moving through several layers of a utility’s computer network, she said.

“If you can go directly into what’s called ‘operational technology,’ as opposed to the business network, then you can cause an effect without having to go through all those layers where you might be spotted,” she told JNS.

“The threat may also extend beyond water utilities,” she said.

Federal agencies warned in April that Iranian hackers were targeting energy networks, government facilities and other critical infrastructure in addition to water and wastewater systems.

“This seems to be connected to earlier activity we were seeing this past spring that involved water, electricity or energy—maybe beyond electricity—and other critical infrastructure,” Fixler told JNS.

“So, it may be that there are other systems that are affected right now, because this seems to be an ongoing problem,” she said.

Officials have historically failed to take such threats seriously enough, she added.

“For too long, we’ve sort of downplayed these threats, because it didn’t cut off the water supply,” she said. “The systems were able to operate in manual mode, or they were just able to reboot systems. That is good. That’s not sufficient.”

The attacks do not currently appear to pose a direct danger to the public or indicate an attempt to poison America’s water system, according to Fixler. However, that threat could become more serious in the future, she said.

“People should be concerned,” she said. “At this stage, the authorities have been very cautious to reassure the public that there is no threat to water safety and there’s no threat of contamination.”

Still, exaggerating the threat could advance Iran’s “intimidation” goals by convincing the public that its hackers have greater capabilities than they actually possess, Fixler said.

“We should be very cautious to say that there is no indication the attackers are trying to poison the water system, because that sort of plays into what Iran might be trying to do, which is cause societal panic and make Americans think that Iran is such a significant threat that maybe we should back down,” she said.

Iran wants people to think that “they are 10 feet tall, they are really bad and we should be scared of them,” Fixler told JNS.

“We should conduct our foreign policy in a much more accommodating way because they are such a huge threat,” she said.

Get the latest updates in our WhatsApp group.