People use 1000x more water than they need to drink.
If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted.
Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope.
It wouldn't cause the mass casualties an enemy might assume.
It's actually insane to me that the nation convulsed over the inability to get water to flint Michigan and people are still over here doing "no one actually deserves water, you use too much of it anyway"
Maybe if we're worried about running out of water, we should prioritize getting the water we do have to actual people. Could the problem be that we're trying to grow avocados in a literal desert? Nah, it's the dang citizens taking too many showers again.
Are you one of these broadminded people who are about to destroy the Peruvian economy and genocide their people because you heard on tiktok that an avocado in the Peruvian desert takes eight gallons etc etc ... while the alternative is applying the half ton of fungicide it takes everywhere else. This is by the way the first desert irrigated, ~5000 years ago, with the same water, by the earliest state in the Americas, growing cotton for export.
I'm not sure what Peru has to do with anything. TFA is about the USA, and usda.gov is an American site.
But I bet if the average ancient Peruvian had to choose between their avocados dying or their next-door neighbors dying, they'd choose to save their neighbors. Unfortunately in modern times, I'm not so sure anymore.
Peru is the home of desert irrigated avocado. It is a leading factor in the total economy, following techniques already known to their ancestors 5000 years ago, but with their cotton not with Mexican avocado.
There were no avocados until quite recently, and thus no choice. There was only uninhabitable desert - though it had once been inhabited and indeed constituted the first known state in the Americas.
Your idea is 'i heard about desert avocadoes on tiktok and its insane and whoever does it needs machine-gunned.'.
Apple to oranges. The problem with Flint was lead in municipal pipes, and it has been fixed since forever ago. The majority of US water usage is agricultural and that is only really an issue west of the Mississippi. They are completely separate concerns supported by completely separate infrastructures.
Trouble is, there's a good chance that a large portion of the population will then be in favour of ending the war by escalating it to the point of flattening Iran. And that portion of the population has somewhat of a correlation with the political base of the current administration.
It is impossible to affect the Persian empire by such means. They might as well have tried to take the Soviet Union or China by like means. There is no such thing as 'flattening' China or Iran
Notice I said that it's the populace who will gain an appetite for flattening Iran, not that it's actually practical to achieve that. You could very well find yourself extending the war for much longer than it would otherwise go on, because there will be increased political support for it.
Look at what 9/11 did - for quite a while after the attack, which was heinous but in the grand scheme of things nothing compared to the scale of destruction that was visited upon Iraq and Afghanistan afterwards; And at least for a few years, very many Americans were in favour of those conflicts.
I'm not saying it's possible to accomplish that, just that directly harming the comfort of the American populace is a good way to unify large parts of said populace in wanting to destroy you. There's a non-zero chance of increasing America's appetite for war rather than reducing it with such actions.
The only thing I can see is some political crony company getting a big payment from the federal budget to take on the "burden" of doing so. But then not actually distributing enough water so they can still price-gouge individuals because we wouldn't want people to become entitled, right?
>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure.
You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety.
Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.
Please expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correct data structures of a type that can be thrown over a wall. Like sure it's easy to cut one ethernet pair, or one serial line wire, but building up a software stack that can use that for one-way communication still seems like a hassle.
The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network.
You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved.
The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection.
Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network.
A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job.
Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking.
What you're describing is a whole bunch of bespoke engineering. That is the opposite of cheap.
It would be interesting to go down this design path trying to make a generic product. I'd aim to dovetail into the bespoke engineering that PLCs already involve. I'd be tempted to design it as something like a modbus target (that PLC engineers would set up the system to write data to), except that modbus sucks rocks as a data format, never mind lacking the abstractions to do express multiples of the same systems. So then I guess you're left with some schema language that you're trying to appeal to PLC engineers to write securely. Maybe akin to the IEC 61131-3 Functional Block Diagram language, but with a very clear "this is the airgapped dividing line" ?
But in the general case, you still need to get control data back into most systems system. So your data link will likely still be bidirectional, but with the goal to keep the protocol small and simple, to keep the attack surface small.
The main problem is that it still only takes one PLC engineer to connect the two sides of the network for their own expedience. From what I can tell this is how the horror stories abound. PLCs generally use ethernet/IP these days, so one has to do deliberate work to segment the networks. And it just takes one too-smart-for-their-own-good person who wants to make that PLC available from their desk/home/vacation to ruin it.
I think this landscape is littered with simulated systems as honeypot. Once you have it a normal adversary would stop searching, besides regular checks that the gun still works.
The existing Iran state entity has killed about a quarter the population of Syria. It has killed basically unlimited numbers of Arabs. It is a killing machine with few parallels in history. The present war is nuts, but the ridiculous fawning over the sick mullahs who dumped the children of Syria in acid baths is literal demonic possession.
The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are issuing this Public Service Announcement (PSA) to warn critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyber attacks targeting Operational Technology (OT) devices, including Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series. Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. While the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs.
After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.
Does anyone recall the Colonial Pipeline outage? They had their IT and OT networks segregated but without billing capacity nothing else mattered. You didn’t expect them to let the petrol flow for free, didja? All that it takes is for a “jump box” that spans or bridges supposedly segregated networks to be p0wned to permit compromise of the soft and chewy center.
Some of these municipal water plants in the US are independently operated by municipalities of awfully few people and even fewer resources to spare, often serving relatively vast areas…
It’s probably not how you or I would set things up—especially after many years of warnings and slick best practices guides-but I can sympathize with “if it’s not broken…”-style maintenance, especially at the local level.
These things have lifespans measured in decades, and budgetary cycles to match… and for all of CISA’s good work (on limited budgets, and with power that’s more persuasive than fearsome) [0], it seems hard to get all 148,000 [1] system operators to afford to care, much less to afford to fix things—much less to check their work.
Yes. The last federal administration attempted to use CISA to encourage better cyber outcomes for water supply systems, and the water industry and Republican states sued over it. There is no will to fix this, only to push the liability elsewhere.
When will the public figure out that many IT exploits are the result of malpractice by developers and network adminstrators, and the businesses employing them? We're building and operating bridges that we know will collapse. Our products are nearly indefensible, literally - they can't realistically be secured except at great expense. We talk about the imbalance between costs of attack and defense; we made that imbalance.
The big LLM security threat is arguably just a revelation of the sh-ty work our field has accepted. Maybe we need to become actual engineers and invest in building proper, reliable, safe systems (which includes not being a dangerous risk for fraud, surveillance, and addiction). The 'anything goes' extreme disruption of many current SV corporate leaders and their technology is, in a way, a culmination of what they've always done.
The good news is that LLMs used properly might make proper engineering less expensive. The LLMs will more likely be used to make sh-t cheaper, so we can make more of it. Unless of course we take action.
Why are water systems still on the internet? They should be completely cut off. If necessary, remote access must be from dedicated devices only, only to a mirrored view, and never for remote control.
DOGE eliminated 1/3 of CISA staff in 2025. Trump reduced the 2026 CISA budget by $491 million (17%). Trump intends to slash their budget by an additional $707 million in 2027.
The ICE budget was just increased by $70 BILLION, bringing its total to >$200 billion.
CISA staff doesn’t do security patches and updates on local water supplies.
You’re mixing a lot of stuff around there, none of it relevant to the discussion.
CISA is the one who mandates these controls and who manages the public/private relationship. Who issues the active exploration warnings. Who suggests legislation to prevent this in the future, including mandatory software updates.
If your question was only a trite recitation of the fact that private enterprise consistently refuses to practice cybersecurity then you've added nothing.
If your question was about who watches the watchers and what we're doing about the fact that private enterprise refuses to practice cybersecurity then it was an incredibly relevant statement.
A public water authority needs to step it up, at least to the level of other public water authorities who don’t have the problem.
Simple matter of disconnecting it from the internet and running security patches, c’mon man!
If a number of these submissions didn't get any upvote traction or more importantly didn't get much discussion, then this unwieldly list of links is not helpful. It's spam.
They always point to a state actor to skirt liability for their own shitty IT work. Then the dim evil journalists swallow it whole, later regurgitating it for their eager little baby bird subscribers.
If there were actual penalties for rawdogging a PLC (or any other control system) on the internet, shit like this wouldn’t happen.
> “I blame it on Minnesota because they are grossly incompetent,” Trump said at a cabinet meeting at Camp David on Friday, adding that Walz is “corrupt” and “Iran has bigger problems than worrying about Minnesota.” Asked later if he could rule out Iranian responsibility, Trump said, “ I don’t think there was an Iranian cyberattack. I think Minnesota ought to get its act together.”
Iran is beside the point. There is always a convenient bogeyman: China, Russia, North Korea… They sow discord between peoples to cover-up the ineptitude of domestic institutional assholes.
Sorry, this is just plain facts, and anyone who doesn't understand that at this point is clearly trying to avoid cognitive dissonance. Or they have their heads terminally in the sand.
Yes; it is a fact that the post I was complaining about was in violation of HN guidelines, and a fact that it demonstrated the same behaviour it accused others of.
We don't follow "rules" in war anymore, according to "Secretary of War" Pete Hegseth. We show no quarter and take no prisoners, we pursue "maximum lethality, not tepid legality."
That's American policy now. The gloves are off, no holds barred, everything and everyone is on the table. So I guess we reap what we sow.
If I was in a power position, I could theoretically channel this water into my own private reservoirs and locations like private land, bunkers, etc to weather a disruption, and blame Iran and it would be really hard to validate.
I mean if I was in a power position I would have also disrupted those in positions who would be validating me, made journalism much harder and have algorithms with LLM-enhanced astroturf accounts running to label any questioning of the official narrative as conspiratorial or tin-foil hat.
I would probably be on sites like this downvoting people who said things like this. Yes. That's how I would do it. edit: Oh I might even consider channeling that water to my data center friends!
But they wouldn't need to false-flag an excuse to capture and privatize resources, they could and would just do that openly. The government can just take whatever it wants through eminent domain.
Wasn't there a Defcon or Derby talk about this years back? (The insecurity, not the Persian angle)
Struggling for a source.
Guy had the energy of that one Simcity 2000 character who bugs out if you cut back on funding that you'll regret it. Early twenty aughts IIRC?
Not sure about defcon, but Buckminster Fuller wrote waay back in the sixties about the New York's vulnerability to a fresh water supply attack.
If you haven't read it Operating Manual For Spaceship Earth is one of my favorite books.
https://archive.org/details/operatingmanualforspaceshipearth...
I'll throw it on my list, I've got a pretty big backlog right now.
People use 1000x more water than they need to drink.
If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted.
Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope.
It wouldn't cause the mass casualties an enemy might assume.
It's actually insane to me that the nation convulsed over the inability to get water to flint Michigan and people are still over here doing "no one actually deserves water, you use too much of it anyway"
And let's not forget:
> Agriculture accounts for about 80 percent of consumptive use in the United States
https://www.nifa.usda.gov/topics/water
Maybe if we're worried about running out of water, we should prioritize getting the water we do have to actual people. Could the problem be that we're trying to grow avocados in a literal desert? Nah, it's the dang citizens taking too many showers again.
Are you one of these broadminded people who are about to destroy the Peruvian economy and genocide their people because you heard on tiktok that an avocado in the Peruvian desert takes eight gallons etc etc ... while the alternative is applying the half ton of fungicide it takes everywhere else. This is by the way the first desert irrigated, ~5000 years ago, with the same water, by the earliest state in the Americas, growing cotton for export.
I'm not sure what Peru has to do with anything. TFA is about the USA, and usda.gov is an American site.
But I bet if the average ancient Peruvian had to choose between their avocados dying or their next-door neighbors dying, they'd choose to save their neighbors. Unfortunately in modern times, I'm not so sure anymore.
Peru is the home of desert irrigated avocado. It is a leading factor in the total economy, following techniques already known to their ancestors 5000 years ago, but with their cotton not with Mexican avocado.
There were no avocados until quite recently, and thus no choice. There was only uninhabitable desert - though it had once been inhabited and indeed constituted the first known state in the Americas.
Your idea is 'i heard about desert avocadoes on tiktok and its insane and whoever does it needs machine-gunned.'.
Chill. I've never used tiktok. Don't assume everyone you talk to saw the same meme you did.
Did you know more than one country grows avocados?
Apple to oranges. The problem with Flint was lead in municipal pipes, and it has been fixed since forever ago. The majority of US water usage is agricultural and that is only really an issue west of the Mississippi. They are completely separate concerns supported by completely separate infrastructures.
Iran doesn't need to cause mass casualties. They just need to make US citizens hate the war in Iran.
Trouble is, there's a good chance that a large portion of the population will then be in favour of ending the war by escalating it to the point of flattening Iran. And that portion of the population has somewhat of a correlation with the political base of the current administration.
It is impossible to affect the Persian empire by such means. They might as well have tried to take the Soviet Union or China by like means. There is no such thing as 'flattening' China or Iran
Notice I said that it's the populace who will gain an appetite for flattening Iran, not that it's actually practical to achieve that. You could very well find yourself extending the war for much longer than it would otherwise go on, because there will be increased political support for it.
Look at what 9/11 did - for quite a while after the attack, which was heinous but in the grand scheme of things nothing compared to the scale of destruction that was visited upon Iraq and Afghanistan afterwards; And at least for a few years, very many Americans were in favour of those conflicts.
What's he gonna do? Nuke Iran?
You know, I said that as a joke, but...
It's getting hard to tell jokes from reality with this administration (excluding roasts at the WHCD).
How are you going to flatten Iran? A country twice the size of Texas with 90M people.
You would have to fire your entire nuclear arsenal and commit mass genocide.
Even then, you may not be able to destroy the missile cities, many of them were built to be nuclear resistant.
I'm not saying it's possible to accomplish that, just that directly harming the comfort of the American populace is a good way to unify large parts of said populace in wanting to destroy you. There's a non-zero chance of increasing America's appetite for war rather than reducing it with such actions.
Dunno, Trump's war didn't make them give up on 'Death to America', but just gave it new life.
Exactly how big do you think those bottles would be?
Who exactly is this "we" in 2026 ?
The only thing I can see is some political crony company getting a big payment from the federal budget to take on the "burden" of doing so. But then not actually distributing enough water so they can still price-gouge individuals because we wouldn't want people to become entitled, right?
[dead]
>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure.
You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety.
Completely stopping ingress of control (using above mentioned data diodes) is relatively easy, and should be legislated into being the norm.
Please expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correct data structures of a type that can be thrown over a wall. Like sure it's easy to cut one ethernet pair, or one serial line wire, but building up a software stack that can use that for one-way communication still seems like a hassle.
The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network.
You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved.
The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection.
Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network.
A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job.
Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking.
[1] https://en.wikipedia.org/wiki/Unidirectional_network
What you're describing is a whole bunch of bespoke engineering. That is the opposite of cheap.
It would be interesting to go down this design path trying to make a generic product. I'd aim to dovetail into the bespoke engineering that PLCs already involve. I'd be tempted to design it as something like a modbus target (that PLC engineers would set up the system to write data to), except that modbus sucks rocks as a data format, never mind lacking the abstractions to do express multiples of the same systems. So then I guess you're left with some schema language that you're trying to appeal to PLC engineers to write securely. Maybe akin to the IEC 61131-3 Functional Block Diagram language, but with a very clear "this is the airgapped dividing line" ?
But in the general case, you still need to get control data back into most systems system. So your data link will likely still be bidirectional, but with the goal to keep the protocol small and simple, to keep the attack surface small.
The main problem is that it still only takes one PLC engineer to connect the two sides of the network for their own expedience. From what I can tell this is how the horror stories abound. PLCs generally use ethernet/IP these days, so one has to do deliberate work to segment the networks. And it just takes one too-smart-for-their-own-good person who wants to make that PLC available from their desk/home/vacation to ruin it.
There are plug and play devices that do multiple flavors of SCADA, but as you've said, they aren't trivial, thus not cheap.
https://archive.is/fa2Xj
I think this landscape is littered with simulated systems as honeypot. Once you have it a normal adversary would stop searching, besides regular checks that the gun still works.
In this war initiated by USA and Israel, it isn't Iran who's attacking civil targets.
The existing Iran state entity has killed about a quarter the population of Syria. It has killed basically unlimited numbers of Arabs. It is a killing machine with few parallels in history. The present war is nuts, but the ridiculous fawning over the sick mullahs who dumped the children of Syria in acid baths is literal demonic possession.
The Federal Bureau of Investigation (FBI) and Environmental Protection Agency (EPA) are issuing this Public Service Announcement (PSA) to warn critical infrastructure asset owners and operators that malicious cyber actors (MCAs) are conducting cyber attacks targeting Operational Technology (OT) devices, including Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically MicroLogix 1100 and 1400 series. Since 27 July 2026, Water and Wastewater Sector (WWS) utility companies in at least seven states have reported incidents to the FBI, and some of that activity degraded water operations. While the FBI has only observed this behavior with the referenced Rockwell PLCs, similar considerations should also be made with other branded PLCs.
After remotely accessing internet-facing devices, the actors changed the IP addresses and passwords, resulting in a loss of monitoring and control functionality. To reduce the risk of compromise, the FBI and EPA recommend removing PLCs from direct internet exposure via secure gateway and firewalls, setting up strong, unique passwords, and utilizing an access control list (ACL) to allow only authorized communication between expected control system devices.
https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-...
Did they literally just leave the water supply plant management software out available on the open internet? Hard to even call this a hack!
Does anyone recall the Colonial Pipeline outage? They had their IT and OT networks segregated but without billing capacity nothing else mattered. You didn’t expect them to let the petrol flow for free, didja? All that it takes is for a “jump box” that spans or bridges supposedly segregated networks to be p0wned to permit compromise of the soft and chewy center.
I mean
Some of these municipal water plants in the US are independently operated by municipalities of awfully few people and even fewer resources to spare, often serving relatively vast areas…
It’s probably not how you or I would set things up—especially after many years of warnings and slick best practices guides-but I can sympathize with “if it’s not broken…”-style maintenance, especially at the local level.
These things have lifespans measured in decades, and budgetary cycles to match… and for all of CISA’s good work (on limited budgets, and with power that’s more persuasive than fearsome) [0], it seems hard to get all 148,000 [1] system operators to afford to care, much less to afford to fix things—much less to check their work.
[0] https://www.cisa.gov/topics/industrial-control-systems , and https://www.gao.gov/assets/d24106576.pdf for an idea of the staffing they’re doing it with…
[1] https://www.epa.gov/dwreginfo/information-about-public-water...
Who connected the systems to the Internet in the first place?
Why?
Most likely to cut costs and have one person remote-admin all pumps, valves, etc. instead of a crew for each location.
Why didn't they have firewalls, admin accounts, access rights, you know, proper security? They were glad it barely worked at all.
Yes. The last federal administration attempted to use CISA to encourage better cyber outcomes for water supply systems, and the water industry and Republican states sued over it. There is no will to fix this, only to push the liability elsewhere.
https://news.ycombinator.com/item?id=39243560
https://web.archive.org/web/20240409155326/https://www.awwa....
(cybersecurity practitioner is a component of my professional persona)
When will the public figure out that many IT exploits are the result of malpractice by developers and network adminstrators, and the businesses employing them? We're building and operating bridges that we know will collapse. Our products are nearly indefensible, literally - they can't realistically be secured except at great expense. We talk about the imbalance between costs of attack and defense; we made that imbalance.
The big LLM security threat is arguably just a revelation of the sh-ty work our field has accepted. Maybe we need to become actual engineers and invest in building proper, reliable, safe systems (which includes not being a dangerous risk for fraud, surveillance, and addiction). The 'anything goes' extreme disruption of many current SV corporate leaders and their technology is, in a way, a culmination of what they've always done.
The good news is that LLMs used properly might make proper engineering less expensive. The LLMs will more likely be used to make sh-t cheaper, so we can make more of it. Unless of course we take action.
Why are water systems still on the internet? They should be completely cut off. If necessary, remote access must be from dedicated devices only, only to a mirrored view, and never for remote control.
Where does all the money go? Not to cyber apparently.
DOGE eliminated 1/3 of CISA staff in 2025. Trump reduced the 2026 CISA budget by $491 million (17%). Trump intends to slash their budget by an additional $707 million in 2027.
The ICE budget was just increased by $70 BILLION, bringing its total to >$200 billion.
CISA staff doesn’t do security patches and updates on local water supplies. You’re mixing a lot of stuff around there, none of it relevant to the discussion.
CISA is the one who mandates these controls and who manages the public/private relationship. Who issues the active exploration warnings. Who suggests legislation to prevent this in the future, including mandatory software updates.
If your question was only a trite recitation of the fact that private enterprise consistently refuses to practice cybersecurity then you've added nothing.
If your question was about who watches the watchers and what we're doing about the fact that private enterprise refuses to practice cybersecurity then it was an incredibly relevant statement.
A public water authority needs to step it up, at least to the level of other public water authorities who don’t have the problem. Simple matter of disconnecting it from the internet and running security patches, c’mon man!
[flagged]
28 Jul 2026 22:47:42 UTC
Coordinated cyberattack disrupts water utilities in 30 Minnesota communities
https://statescoop.com/coordinated-cyberattack-disrupts-wate...
https://news.ycombinator.com/item?id=49091021
[ok]
29 Jul 2026 07:47:11 UTC
Cyberattack targeted 30 Minnesota water systems
https://mn.gov/mnit/media/blog/?id=38-761869
https://news.ycombinator.com/item?id=49094533
[ok]
30 Jul 2026 17:08:40 UTC
U.S. Sees Iran as Likely Behind Cyberattack on Minnesota Water Systems
https://www.nytimes.com/2026/07/30/us/politics/minnesota-wat...
https://news.ycombinator.com/item?id=49112788
[ok]
30 Jul 2026 23:12:21 UTC
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran
https://www.wired.com/story/a-leaked-memo-ties-cyberattacks-...
https://news.ycombinator.com/item?id=49117018
[ok]
31 Jul 2026 13:35:38 UTC
US investigating if Iran was behind cyberattack on water systems in seven states
https://www.cbsnews.com/news/us-investigating-iran-cyberatta...
https://news.ycombinator.com/item?id=49122974
[ok]
31 Jul 2026 18:17:17 UTC
Iranian hackers likely behind Minnesota municipal water cyberattack
https://www.axios.com/local/twin-cities/2026/07/30/report-ir...
https://news.ycombinator.com/item?id=49126761
[ok]
31 Jul 2026 23:55:10 UTC
Cyberattack on water systems in multiple states has US officials on edge
https://www.cnn.com/2026/07/31/politics/sweeping-cyberattack...
https://news.ycombinator.com/item?id=49129814
[ok]
If a number of these submissions didn't get any upvote traction or more importantly didn't get much discussion, then this unwieldly list of links is not helpful. It's spam.
They always point to a state actor to skirt liability for their own shitty IT work. Then the dim evil journalists swallow it whole, later regurgitating it for their eager little baby bird subscribers.
If there were actual penalties for rawdogging a PLC (or any other control system) on the internet, shit like this wouldn’t happen.
<adjustsTinFoilHat> The Trump plan in Iran is not working. Gotta make them look like the evil bogeyman to get people to support further action.
This conspiracy theory would make more sense if he wasn’t working so hard to divert blame away from Iran: https://www.politico.com/news/2026/07/31/trump-minnesota-wat...
> “I blame it on Minnesota because they are grossly incompetent,” Trump said at a cabinet meeting at Camp David on Friday, adding that Walz is “corrupt” and “Iran has bigger problems than worrying about Minnesota.” Asked later if he could rule out Iranian responsibility, Trump said, “ I don’t think there was an Iranian cyberattack. I think Minnesota ought to get its act together.”
As if it were only Minnesota. But his base doesn’t pay attention to details.
The rest of the thread demonstrates well enough that flagging would have been a better response than trying to engage with it factually.
But I do appreciate the attempt anyway.
Iran is beside the point. There is always a convenient bogeyman: China, Russia, North Korea… They sow discord between peoples to cover-up the ineptitude of domestic institutional assholes.
Blacks.
Homosexuals.
Communists.
Islamics.
Hispanics.
Liberals.
Intellectuals.
There’s always an other. That’s what the Republicans have been doing for decades.
> There’s always an other. That’s what the [group I definitely don't belong to] have been doing for decades.
Please reconsider your logic. And:
> Please don't use Hacker News for political or ideological battle. It tramples curiosity.
Sorry, this is just plain facts, and anyone who doesn't understand that at this point is clearly trying to avoid cognitive dissonance. Or they have their heads terminally in the sand.
Yes; it is a fact that the post I was complaining about was in violation of HN guidelines, and a fact that it demonstrated the same behaviour it accused others of.
[flagged]
Irrational reach.
...said no one ever.https://www.nytimes.com/2026/07/31/us/politics/trump-minneso...
I fail to understand how this relates to the original claim.
That no one is blaming liberals for hacking? Not sure what else there would be to possibly understand.
Is this the true reason for the cyclosporasis outbreaks?
Nah. Cyclospora is a parasite, not a virus.
[Riffing on the gag, not an actual misunderstanding, just to be clear.]
Can we still blame Mexico, Taylor Farms and Taco Bell as well?
Taco Bell is secretly funded by Iran and North Korea and invented covid…
> “I think Minnesota is behind it,” Mr. Trump said on Friday in response to a reporter’s question about Iran’s possible involvement,
What a coward and a traitor to the American people.
He knows he brought these attacks with his war, but he doesn’t take the blame for anything.
Either he knows and doesn't want to take the blame, or he doesn't know. I'm not sure which one is worse.
He stopped going to security briefings before, maybe he simply doesn't care to know.
> he brought these attacks with his war
I'm no Trump supporter and this war was a big mistake, but justifying a nation poisoning another's civilian water supply is a bit upside down.
Yeah, what could we possibly have done[0] to justify an attack on our water supply?
[0]: https://www.commondreams.org/news/iran-water-desalination-pl...
Ask the people of Flint, Michigan?
We don't follow "rules" in war anymore, according to "Secretary of War" Pete Hegseth. We show no quarter and take no prisoners, we pursue "maximum lethality, not tepid legality."
That's American policy now. The gloves are off, no holds barred, everything and everyone is on the table. So I guess we reap what we sow.
I hope it gets bad enough people wake tf up and do something with me about it.
Context: He said the state was “behind it” because of gross incompetence and that he doesn’t buy the Iran attribution
It was probably the same (imaginary) people who damaged the lining of the Reflecting Pool.
I think we should think about making blatant lies by politicians a crime.
What's one more crime compared to all of the ones they've already committed?
If I was in a power position, I could theoretically channel this water into my own private reservoirs and locations like private land, bunkers, etc to weather a disruption, and blame Iran and it would be really hard to validate.
I mean if I was in a power position I would have also disrupted those in positions who would be validating me, made journalism much harder and have algorithms with LLM-enhanced astroturf accounts running to label any questioning of the official narrative as conspiratorial or tin-foil hat.
I would probably be on sites like this downvoting people who said things like this. Yes. That's how I would do it. edit: Oh I might even consider channeling that water to my data center friends!
You know water is kind of big right?
I understand being mad, I also get mad.
This is a bit unhinged.
We used to say that about some things before Snowden. And then there was Snowden.
But they wouldn't need to false-flag an excuse to capture and privatize resources, they could and would just do that openly. The government can just take whatever it wants through eminent domain.
[dead]