Senate Democrats introduce bill to distribute $300 million annually to shore up water system cybersecurity

Senate Democrats introduce bill to distribute $300 million annually to shore up water system cybersecurity

Two Democratic senators introduced legislation Monday that would allocate $300 million each year to fund a spate of cybersecurity improvements for the water and wastewater sector.

Sens. Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) announced the Water Cyber Shield Act, which would give the Environmental Protection Agency increased powers to regulate cybersecurity protections of water and wastewater systems across the U.S.

The legislation comes in the aftermath of recent cyberattacks on at least 30 water and wastewater systems in about 12 states. Experts believe the attacks were launched by groups connected to Iran’s military.

The bill would authorize $300 million each year of Drinking Water and Clean Water State Revolving Funds dedicated to cybersecurity improvements. It would amend the Safe Drinking Water Act and the Clean Water Act, giving the EPA the authorization to conduct cybersecurity assessments and would require corrective actions be taken when vulnerabilities are found.

Water and wastewater systems would need to assess their cybersecurity risk as part of resilience planning and would be forced to comply with incident reporting requirements outlined in the forthcoming Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).

The act outlines different rules for water systems based on their size and would allow states to decide whether they can handle the cybersecurity regulations on their own or if they want the EPA to step in and help them.

The EPA would also coordinate with the Cybersecurity and Infrastructure Security Agency (CISA) on threat information and cybersecurity standards. A technical advisory committee would be created to develop the standards.

Cybersecurity information submitted by utilities would be exempt from public disclosure and smaller water systems would receive flexibility while being prioritized for federal financial assistance.

The EPA would need to create cybersecurity metrics to analyze the progress of the water sector and publish reports on the issue.

“The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure,” Klobuchar said. “Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats.”

The EPA is tasked with managing the water sector but lacks the authority to institute cybersecurity rules. The Biden administration tried to add cybersecurity checks to annual water system assessments but was sued by water industry groups and several states, which argued that any cybersecurity improvements would force them to raise costs on customers.

Biden officials eventually abandoned the effort, and since then, state-backed groups and ransomware gangs have repeatedly attacked water systems across the U.S. — forcing several to shut off some tools or operate systems manually.

A spokesperson for Schiff told Recorded Future News his office consulted with water industry groups, state regulators, cybersecurity experts and federal agencies to head off any complaints they may have. They also got feedback from the EPA and other federal agencies.

“Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities,” Schiff said.

“These threats are not hypothetical — they are happening right now. This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers.”