Federal lawmakers and cybersecurity leaders have launched parallel initiatives to protect US water infrastructure from growing cyber threats, combining new federal legislation with a grassroots defense project for local utilities.
Senators Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) introduced the Water Cyber Shield Act to expand federal oversight and funding for water security. The bill would grant the Environmental Protection Agency (EPA) explicit authority to perform cybersecurity assessments, enforce corrective measures, and establish security standards alongside CISA and NIST.
To help utilities fund these upgrades, the legislation authorizes $300 million annually for the Drinking Water and Clean Water State Revolving Funds. It also mandates risk assessments for large systems, expands mandatory cyber incident reporting to state and locally owned facilities, and protects sensitive utility data from public disclosure.
The legislative push follows recent coordinated cyberattacks targeting dozens of community water systems across at least 12 US states, including Minnesota, Michigan, Georgia, South Dakota, New Jersey and Alabama.
Simultaneously, DEF CON Franklin and the National Rural Water Association (NRWA) launched the Water Watch Center (WWC) at the DEF CON conference in Las Vegas. The program targets small, under-resourced utilities serving fewer than 10,000 people, which represent 91% of the nation’s roughly 50,000 community water systems.
Through the WWC, five cybersecurity firms — Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies — will deliver managed detection and response services directly to small utilities while sharing threat intelligence through the NRWA. Seed funding for the initiative was provided by Craigslist founder Craig Newmark.
The launch builds on a two-year pilot program that paired nearly 450 volunteer cyber experts with utilities across seven states. The WWC is now expanding into Maryland to protect civilian water systems supporting critical national security and military assets.
To develop future defenses, the WWC is partnering with Vanderbilt University to use research from DARPA’s CASTLE program. The plan is to construct digital twins of water environments to test and ultimately implement AI-driven defensive agents capable of automatically detecting and stopping cyber intrusions.
Related: Cybersecurity Alliance Drafts SAFE Guidelines for Sharing AI Incident Data
Related: White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative
Related: Linux Foundation Unveils New Open Source Security Project Akrites
