Dmitri Drobnitsky
America’s water infrastructure has become the latest reminder that in cyberspace, the greatest vulnerability is often not an adversary’s sophistication but one’s own complacency.
A cyber incident affecting water and wastewater facilities in seven states has exposed weaknesses in the digital systems that underpin essential public services. Although speculation quickly turned to Iranian hackers, the evidence released so far points more clearly to poor cybersecurity practices than to any particular foreign government.
Minnesota appears to have suffered the most serious disruption. Preliminary findings from a joint FBI and Environmental Protection Agency investigation indicate that the attackers targeted Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, industrial devices manufactured by Rockwell Automation that are commonly used to automate water-treatment processes.
The technology itself is not inherently vulnerable. In many facilities these controllers can operate entirely on isolated local networks, or even without any network connection beyond an operator’s control panel. Problems arise when convenience takes precedence over security. If industrial controllers are connected directly to the public internet and their communication ports remain exposed, they become inviting targets for anyone with modest technical expertise.
That, investigators believe, is likely what happened.
The geopolitical backdrop ensured that the incident quickly acquired an international dimension. With tensions in the Middle East already high, reports soon emerged suggesting that Iranian hackers were responsible. Minnesota Governor Tim Walz publicly echoed that interpretation, despite the fact that the FBI has not attributed the attack to any state or organisation.
President Donald Trump responded in character, dismissing the foreign-threat narrative and instead accusing Minnesota’s leadership of incompetence. Governor Walz replied that the attacks demonstrated how modern conflict increasingly targets civilian infrastructure and argued that America lacks a coherent strategy for confronting such threats.
Neither exchange brought the public much closer to understanding who was actually responsible.
Federal authorities have confirmed that incidents occurred in seven states, while reports from affected communities have so far identified Minnesota, Michigan, South Dakota and Wisconsin. Yet investigators have released neither a definitive account of how each breach was carried out nor any public attribution of responsibility.
Cybersecurity experts, by contrast, have found little mystery in the technical failings. According to specialists in industrial control systems, some of the affected facilities left internet-facing controllers unnecessarily exposed, allowing outsiders to identify not only the equipment in use but also its operational status. Under such circumstances, exploiting the systems would not necessarily require the capabilities of a nation-state. Basic operational discipline, they argue, would probably have prevented the incident altogether.
That distinction matters. Governments often frame cyber incidents as evidence of an escalating geopolitical contest, while engineers tend to see them as the predictable consequences of neglected digital hygiene. Both perspectives may be valid. But before blaming foreign adversaries, it is worth asking why critical infrastructure was so easily reachable in the first place.
In cybersecurity, as in public health, the most damaging failures are often the least dramatic. They occur not because attackers possess extraordinary capabilities, but because ordinary precautions are ignored.
Vitaly Golovkov
Yuri Chekalin
