Two Democratic senators have introduced legislation aimed at bolstering the cybersecurity of the nation's water and wastewater systems, proposing an annual allocation of $300 million for improvements. Senators Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) unveiled the Water Cyber Shield Act, which seeks to grant the Environmental Protection Agency (EPA) enhanced authority to regulate cybersecurity within this critical infrastructure sector.
The proposed legislation follows a series of recent cyberattacks targeting at least 30 water and wastewater systems across approximately 12 states. These incidents are widely believed to be linked to groups associated with Iran’s military. The bill would authorize $300 million annually from the Drinking Water and Clean Water State Revolving Funds specifically for cybersecurity enhancements.
Under the Water Cyber Shield Act, the Safe Drinking Water Act and the Clean Water Act would be amended to empower the EPA to conduct cybersecurity assessments and mandate corrective actions for identified vulnerabilities. Water and wastewater systems would be required to integrate cybersecurity risk assessments into their resilience planning and comply with incident reporting requirements outlined in the forthcoming Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).
The act outlines differentiated rules for water systems based on their size, allowing states to determine whether they will manage cybersecurity regulations independently or seek EPA assistance. The EPA would also collaborate with the Cybersecurity and Infrastructure Security Agency (CISA) to share threat intelligence and develop cybersecurity standards, with a technical advisory committee tasked with creating these standards.
To encourage participation and protect sensitive information, cybersecurity data submitted by utilities would be exempt from public disclosure. Smaller water systems would receive greater flexibility and be prioritized for federal financial aid. The EPA would also be mandated to develop cybersecurity metrics to track progress within the water sector and publish regular reports on the issue.
Senator Klobuchar highlighted the urgency, stating that recent cyberattacks in Minnesota underscore the need to secure water systems and critical infrastructure. The legislation aims to direct the EPA to assess water infrastructure cybersecurity, identify vulnerabilities, and assist municipal water systems in defending against cyber threats.
Currently, the EPA is responsible for managing the water sector but lacks the direct authority to institute cybersecurity regulations. A previous attempt by the Biden administration to incorporate cybersecurity checks into annual water system assessments was met with legal challenges from water industry groups and several states, who argued that such improvements would lead to increased costs for consumers. This effort was ultimately abandoned, leading to continued attacks by state-backed groups and ransomware gangs, which have forced some systems to shut down tools or operate manually.
A spokesperson for Senator Schiff indicated that his office consulted with various stakeholders, including water industry groups, state regulators, cybersecurity experts, and federal agencies, to address potential concerns. Feedback was also gathered from the EPA and other federal agencies. Senator Schiff emphasized that all Americans rely on safe, reliable drinking water and that recent events have exposed the vulnerability of these systems to cyberattacks from foreign adversaries and criminal entities. He stated that these threats are not hypothetical and are occurring now, and the legislation would provide the EPA with necessary tools to protect critical infrastructure while offering resources to local water and wastewater systems without burdening ratepayers with additional costs.
