Long Island water and sewer districts prepare for cyberattacks

Long Island water and sewer districts, already on high alert after reports of cyberattacks across the country, plan to use millions in new state grant money to assess and bolster safeguards they've been honing for years.

The state recently awarded $4 million to water and sewer districts on Long Island as part of its cybersecurity grant program. Individual awards on the Island ranged from $16,500 to $445,200. Long Island received about half the $9 million total awarded across the state.

Water and sewer officials told Newsday that while worries about foreign hackers have been percolating since Sept. 11, 2001, those fears have spiked since the start of the Iran war in February. At least a dozen states have reported disruptions to their water systems, including in Michigan, Minnesota and New Jersey, and Iran-backed hackers are the likely suspects, according to news reports. The City of Cape May and Woodbine, a borough in New Jersey, reported hacks in late July, but no impacts on the water supply.

There are more than four dozen water entities on Long Island, with the vast majority in Nassau County.

“The threat landscape continues to evolve,” said Kenneth P. Wenthen Jr., chairman of the West Hempstead Water District board of commissioners, which received a $349,000 grant. "We constantly have to invest and improve upon what we already have in place.”

Mike Yeosock, Glen Cove’s director of public works, said water districts use technology to pump water and keep levels safe. If a system is compromised, hackers might be able to adjust pump pressure or regulate chlorine balance in the water.

“It’s always been kind of a concern, but it’s a bit more prevalent now,” Yeosock said.

In worst-case scenarios, experts said, a hacker could gain control of the water supply or wastewater management and lock out the agency. Hackers could then poison the water or send waste into waterways.

Officials at Suffolk’s water authority said these scenarios — as well as severe storms and other disasters — require physical backup plans for its 600 wells.

“If we’re locked out of the system, we could deploy boots on the ground to run the pump stations,” said Steven Galante, chief technology officer for the Suffolk County Water Authority, which serves 1.2 million people and covers more than 80% of the county’s water supply. “There’s physical measures in place ... not everything is fully relying on IT systems.”

'A playbook on what to fix'

Citing security concerns, water and sewer officials declined to discuss details of their cybersecurity operations with Newsday or whether they had been hacked or thwarted any hacking attempts.

The millions awarded to Long Island’s water and sewer districts is largely split into two categories: assessment and implementation.

To determine a system’s vulnerabilities, districts will often hire a third-party contractor to try to break in from the outside, said Henry “Chip” Kreymborg, Riverhead Town’s head of IT and networks and systems coordinator. The exercise is called a "penetration test."

“At some point they will either give up or tell you they got in,” he said.

The company also tests from the inside. It supplies a device that gets plugged into the system to check for weaknesses, he said.

“That rummages around, scans your network, and tries to find other vulnerabilities,” he said. “Hopefully you pat yourself on the back and they were not successful. But they will clearly identify the problems they found, and now you have a playbook on what to fix.”

Once a report is issued by the contractor, districts can explore corrective measures, said James Neri, senior vice president of H2M Architects and Engineers in Melville, a consultant for about 30 Long Island water districts.

That could mean new computers and software or even placing a metal lock cage around modems.

“Could somebody who’s visiting a plant put a USB key into one of your modems because they can get to it? Because it’s just hanging out on the wall behind the couch?” Neri said.

Thwarting hackers

The state has had a cyber incident response team for local governments since 2017, said Meghan Cook, director of that team for the state’s division of homeland security and emergency services. The reporting requirement has allowed her office to respond quicker to breaches, Cook said. 

“Across the entire country, local governments are always under attack,” she said. “What I think we are seeing now is a more directed attack at critical infrastructure.”

Local officials said employees have eyes on their systems 24/7. Still, hackers can disarm alerts so that no one watching realizes the system has been infiltrated, experts said. 

“I’m not a fool who thinks we can keep the hackers out forever,” Kreymborg said. “There’s the human factor that is almost impossible to control, no matter how much training you do. People get duped; they get tricked.”

“Hackers can be very successful in creating havoc, and they get very smart once they’re informed that things are being changed,” said Frank DeMayo, chief plant operator for the Greenlawn water district.

The focus on funding and security represents a sea change in how water-related infrastructure is protected from cyber hacking, Kreymborg said.

“I think technology, by its very nature, is very complicated," he said, noting funding needs are often difficult to convey to lawmakers.

The potential for danger, “only becomes clear when you hear about a couple of breaches," he added. "It’s almost like ‘oh that’s what you were talking about.’”

Every five years, the state requires water districts to complete a vulnerability plan, said Salvatore Astuto, supervisor of water plant operations for the Village of Bayville, which received $400,000 in state grant money.

Years ago, cybersecurity was just a section of that form, he said.

“Now, cybersecurity is a whole other ballgame," Astuto said. He added, "it's its own chapter."