Chairman Capito Asks Witnesses About Cybersecurity Challenges Facing US Water Infrastructure, Delivers Closing Remarks

WASHINGTON, D.C. - Today, U.S. Senator Shelley Moore Capito (R-W.Va.), Chairman of the Senate Environment and Public Works (EPW) Committee, led a hearing to examine the cybersecurity challenges impacting American water infrastructure and to identify opportunities to improve water sector cybersecurity.

During the hearing, Chairman Capito asked Dr. Scott Simonton, a Fellow at Marshall University's Institute for Cyber Security, about the use of circuit riders to contribute additional expertise to water systems in West Virginia. She also asked Matt Odermann, Executive Board Member at North Dakota Rural Water Systems Association, about the unique cybersecurity challenges faced by small and rural water systems and opportunities to improve available tools. Finally, the Chairman asked Scott Dewhirst of Fairfax Water about ways to attract young talent to the water utility workforce.

In her closing remarks, Chairman Capito addressed the emotional weight that can fall on rural communities who lose access to their water supplies following cyber-attacks or other challenges, as well as the importance of ensuring data is available to understand previous attacks and prevent additional breaches in the future.

HIGHLIGHTS:

CYBER EXPERTISE FOR WATER SYSTEMS

Chairman Capito:

"Dr. Simonton, you highlighted obviously that Marshall University's Institute for Cyber Security is presently partnering with Anstead, which is […] a very small area, and the Huntington Water System […]. I was interested to hear [about], and I heard this from the rural water utilities folks that came in to see me yesterday from West Virginia, the cybersecurity circuit rider idea through [Department of Agriculture]. So, if you could frame out, just briefly, how valuable circuit riders are in general for physical infrastructure for the smaller systems and then how, as somebody dedicated fully to cyber, [do you believe] a dedicated cyber [expert] would be the best, or somebody who has that enhanced credentialing that could do both on the existing program?"

D. Scott Simonton, PE, PhD, Fellow at Marshall University Institute for Cyber Security:

"As far as the circuit rider is concerned, [Marshall] University is already […] moving towards supplying both students to do these things for utilities or others that don't have that in-house capacity. And of course, also for our national guard units that we're training, not just in water cyber, but in infrastructure security in general. So, I would see or we would see these circuit riders as dedicated certainly to cybersecurity because that is the need within the utilities. […] And they provide that expertise. They basically become consultants to the various utilities [and] provide the expertise that they don't already have."

Chairman Capito:

"[…] Technical assistance is what all three of you have said you really need. You're not expecting the one- and two- and three-person utility to be able to meet this challenge on their own. They have to have this assistant. [Could there be] a framework for smaller systems that could then sort of be a plug-and-play [system] […]?"

D. Scott Simonton, PE, PhD, Fellow at Marshall University Institute for Cyber Security:

"That's what we are trying to develop is this scalable plug-and-play framework. Every system, of course, is going to be different, but the needs are going to be very similar. They're going to have very similar systems. They're going to have very similar threats. They're going to have very similar needs. And so, we're developing this framework that can apply, not just to water utilities, but across infrastructure. And so, again, it's providing that in-house expertise that they don't have."

RURAL COMMUNITIES

Chairman Capito:

"Mr. Odermann, we're talking about rural water systems here and the unique challenges of the systems in rural areas. […] How many different systems do you have in North Dakota?"

Matt Odermann, Executive Board Member at North Dakota Rural Water Systems Association:

"There's 282 members of the Association. It's 97% of the state, so it's significant."

Chairman Capito:

"How do you see [the Circuit Rider Program helping], in terms of being able to serve where you are in North Dakota?"

Matt Odermann, Executive Board Member at North Dakota Rural Water Systems Association:

"The Circuit Rider Program is single-handedly the most successful, built-up program that I see in our state. It's mature. It's well-documented. The deliverables and the administrative stuff is set up already. Those trusted relationships between those systems and the state associations are built, and so, if we were able to spin up a technical circuit rider for cybersecurity, I imagine the uptake on that would be significant."

WORKFORCE CHALLENGES

Chairman Capito:

"I want to talk about the workforce challenges because this is something I've been interested in and in several bills in the past, [I] have put in some availabilities for workforce development. As I see in West Virginia, when I visit utilities, […] trying to get young people interested in this as a career is, I think, difficult. […] I know one of our water systems in the audience has used an apprenticeship [program] […]. Have you had any experience with that, Mr. Dewhirst?"

Scott Dewhirst, Deputy General Manager, Engineering and Technology at Fairfax Water, on behalf of Association of Metropolitan Water Agencies (AMWA)

"At Fairfax Water, we do take a pretty aggressive approach with summer internships. I think what people don't understand [is], it takes many different types of skillsets and different types of jobs to run a water utility. So, this gives students a chance to really see what is involved, even in the cyber space, even in the technology space, laboratory, whatever it may be. So, we think that's a great approach to getting people introduced to the industry and to have a long-term career."

IMPACTS OF ATTACKS ON RURAL SYSTEMS AND ADDITIONAL NEEDS

Chairman Capito:

"I'd like to make an additional point, as someone who lives in a community that lost their water source through a chemical spill for many weeks. There are a couple things beyond what happens to the destruction of the system. It becomes a very emotional response. And it can really grow because you begin to lose trust. The authorities, health authorities and otherwise, unless they're crystal clear-and we've gone through this with the CDC because they were not in this case-begin to take on a greater role. And they have to be prepared for this too, whether it's a cyber-attack or a chemical spill or whatever.

"So, if you are able to infiltrate successfully a cyber-attack on one of your smaller systems, there might be people that would say, 'oh well, that only serves 2,500 people. That doesn't really matter.' But what matters is the lack of trust and the cascading effect that it has in every rural community of, 'this could be me. And how do I know?' And so that's why I think at every level, we need to make sure that the protections that we afford the larger systems are the same protections that we can provide for the smaller systems.

"[…] I think there's a lot more connectivity here and [a greater] emotional part of protecting our rural water systems than we really got into today. I would identify also a gap. I think we need better data on how many attacks we have. […] I think [we need to know] how many, where are they occurring, how they occurred. That's always going to be good for best practices to try to prevent [future attacks]."

Click HERE to view Chairman Capito's closing remarks.

# # #