Hackers are after your water. How this town defends against them.

0:00Chris Hughes has what he calls an interesting job. He's an assistant operator at a wastewater treatment plant in Cavendish, Vermont. So where we're going now is the beginning of the process. This is where it comes into the sewer plant. On a recent August afternoon, he gave NPR's Jenna McLaughlin a tour of the plant. What you see there are rags and things that don't belong that we have to screen out ourselves. Some places have automated machines that do that. We don't. We have a rake. Sounds like a fun job. Yeah. Yeah, again, either you love it or you don't. It's nature of the beast. Hughes does love his work in all its technical, mathematical, chemical, and yes, dirty glory.

0:39But lately, Hughes has had to worry about a new hazard, cyber attacks. If someone got into the system, they could just turn it off and we could stop producing water. We'd be dead in the water, I guess. The threat of someone cutting water off for Americans is real. Chinese hackers recently spent nearly a year inside a Massachusetts utility company that provides power and water. And last October, hackers targeted American Water, the largest wastewater utility company in the country. Monday, the water utility said that they discovered a cyber attack last week. And in an effort to protect customers' data and prevent any future harm...

1:17Consider this. Water is an appealing target for hackers. And some people are working to make sure a cyber attack doesn't stop the flow. From NPR, I'm Ari Shapiro.

1:39It's Consider This from NPR. The Environmental Protection Agency recently sounded the alarm about an increase in malicious cyber attacks targeting water systems. as hackers from nation states and criminal gangs cause chaos, make money, and even prepare for potential future conflicts with the U.S. In Vermont, the small town where Chris Hughes works is trying to protect its water from hackers. NPR's cybersecurity correspondent Jenna McLaughlin paid a visit. It's late summer in southern Vermont, and Buttermilk Creek in Ludlow is cascading into three gushing waterfalls. Meanwhile, Chris Hughes is trying to figure out why there's water gushing where it shouldn't.

2:20Hang on a minute. We're at the water treatment plant Hughes helps run. He makes a call to his boss. Hey, we got a problem with the water plant. Hughes is the assistant operator here. It's just two people treating all the drinking and wastewater in the small towns of Cavendish and Proctorsville. System shut off. The water's pouring out of the clear well outside. Turns out, a lightning strike shot off power to one of the systems. Speaking outside earlier that day, while the storm that likely hit the plant passed through the area, Hughes said the work is never boring. I haven't had a lot of jobs but it is by far the most interesting job that I've ever had and so you you have to like it you have to kind of care.

3:04Hughes has dealt with all kinds of problems from lightning strikes to hunting down missing manhole covers and dense tall grass or raking so-called flushable wipes out of sewer pipes but now Hughes Hughes is learning about a new threat on the horizon, hackers. It's kind of scary that I'm the only door between, you know, the Iranians and our water system. You know, it kind of makes me a little nervous. I don't really have the background to be fending off foreign entities, you know. Hughes isn't exaggerating. The threat is real. Last October, criminal hackers targeted American Water, the largest publicly traded water and wastewater utility company in the United States.

3:48Then that January, Russian hackers took credit for making a water system overflow in Muleshoe, Texas. Meanwhile, the White House has been cutting federal funding for many cybersecurity programs. But there's good news. There's a team assembling here in Vermont to help Hughes out. I grew up in Berkshire, Vermont. My town doesn't have a high school. Meet Forrest Anderson. another local water operator. Carrying a ukulele case full of gadgets, he's also a self-proclaimed tech nerd. That's part of how he recently got a job as a cybersecurity system specialist for the non-profit Vermont Rural Water Association.

4:24As we ducked out of the rain, he mentioned another hacking group that he's worried about. If you aren't familiar with Volt Typhoon, it's going on right now. Volt Typhoon is in New England. Volt Typhoon. He's referring to a Chinese hacking group U.S. national security officials say has been burrowing into U.S. critical infrastructure, lying in wait to shut off water systems and spread fear in the event of a conflict, like if China wanted to invade Taiwan. So I don't scare people, I give people the facts. And the fact is that they're here, and if we were to lose our supply of semiconductors on top of our manufacturing, our power, and our water, we would not stand a chance against any conflict.

5:07Also joining us was Tim Papa, a former FBI agent who now works in cybersecurity in the corporate world. You kind of mix people. You didn't expect to be mixed together. I don't know if Chris and I would have met ordinarily, but we have, and we have different backgrounds and different perspectives on things. He's here thanks to a new volunteer effort called Project Franklin, put together by heavy hitters in the cyberspace, from the well-known DEF CON hacking conference to the University of Chicago. Cavendish might be small, but it's nestled up alongside Glitzy Ski Resort's major defense contractors.

5:40It's part of the critical infrastructure of New England. Anderson and Hughes both remember Hurricane Irene back in 2011. How the flooding damaged everything. Even led to the deaths of a father-son water operator team in nearby Rutland. And how the towns came together to help each other rebuild. Especially after the flooding, we realized there's no cavalry. We are the cavalry. We are. That goes back to that New England Yankee ingenuity. We'll do it ourselves. New England ingenuity and some good tech hygiene. I watch as Anderson, Hughes, and Papa put some basics in place to set Cavendish up for success, no matter what's coming their way.

6:20I have something pulled up for you to check out later. Some event logs and a security. They cover up the Wi-Fi password, install network monitoring tools, a virtual private network, and system backups. If you see a failed log in attempt and then a successful log in attempt, and then they take a data packet, a file, or a folder, you can assume that it was malicious. It's a big step in the right direction of making Cavendish a smaller target for bad guys. To explain, Anderson has the perfect Vermont metaphor. I say right now is hunting season. We are the six-point buck in the field. We're just hanging out in the fields.

6:56Right now we need to get in the woods because it's a lot harder to hit a target in the woods. Going forward, it might indeed be harder for hackers to hit their mark here amongst the sugar maples of Vermont. That's NPR cybersecurity correspondent Jenna McLaughlin. This episode was produced by Alejandra Marquez-Hansé and Karen Zamora. It was edited by Courtney Dorning and Andrew Sussman. Our executive producer is Sammy Yenigan. It's Consider This from NPR. I'm Ari Shapiro.