The public health psychological challenges of protecting wastewater treatment plants from cybersecurity criminal risks
DOI:
https://doi.org/10.34140/bjbv8n3-005Palavras-chave:
Wastewater cybersecurity, Supervisory Control and Data Acquisition security, critical infrastructure protection, operational technology threats, cyber-physical systems, public health risk, industrial control system vulnerabilities, chemical dosing manipulationResumo
Local wastewater treatment plants have become increasingly vulnerable to cyber intrusions due to rapid digitization, insufficient segmentation, and persistent reliance on legacy industrial control systems. Recent incidents in Florida, Pennsylvania, and Texas demonstrate that malicious actors can remotely manipulate chemical dosing, disable alarms, and disrupt critical operations, creating direct pathways to environmental contamination and acute public health harm. Smaller municipalities, lacking dedicated cybersecurity resources, face disproportionate risk as adversaries increasingly exploit default credentials, vendor access pathways, and converged information technology–operational technology environments. This commentary synthesizes emerging threat trends, highlights the systemic fragility created by inadequate governance and supply-chain oversight, and evaluates the cascading consequences of disruption, including regulatory noncompliance and erosion of public trust. Findings underscore the need for layered controls, cyber-informed engineering practices, and rehearsed incident response to mitigate escalating risks. Securing Supervisory Control and Data Acquisition–enabled wastewater systems is therefore a critical public health and safety imperative.
Referências
ADEPU, S.; MATHUR, A. Distributed detection of single-stage multipoint cyber attacks in a water treatment plant. International Journal of Information Security, v. 15, n. 3, p. 315-327, 2016. DOI: 10.1145/2897845.2897855.
AKHTAR, M. M.; SHATAT, A. S.; AL-SAADI, A. M. A risk assessment model for cyber-physical water and wastewater systems: towards sustainable development. Sustainability, v. 14, n. 8, art. 4480, 2022. DOI: 10.3390/su14084480.
ALANAZI, M.; MAHMOOD, A.; JABED, M.; CHOWDHURY, M. SCADA vulnerabilities and attacks: a review of the state of the art and future challenges. Computers & Security, v. 125, art. 103028, 2023. DOI: 10.1016/j.cose.2022.103028.
ALBUSTAMI, A. A.; TAHA, A. F. Breaking the flow and the bank: stealthy cyberattacks on water distribution networks. Water Research, 2025. DOI: 10.1016/j.watres.2025.121XXX.
ALEX, J.; HÜBNER, C.; FÖRSTER, L. Planning, testing and commissioning of automation solutions for wastewater treatment plants using simulation. IFAC-PapersOnLine, 2020. DOI: 10.1016/j.ifacol.2020.12.1084.
AMERICAN WATER. American Water announces cybersecurity incident affecting customer portal and billing systems. 2024. Disponível em: https://www.amwater.com/. Acesso em: 3 jul. 2026.
AMERICAN WATER WORKS ASSOCIATION. Automation and control systems for water treatment plants (AWWA Manual M42). Denver: American Water Works Association, 2019.
ANDERSSON, J.; SEID, E. The classification and impact of cyber attacks targeting critical service providers. In: INTERNATIONAL CONFERENCE ON INFORMATION SYSTEMS SECURITY AND PRIVACY (ICISSP), 10., 2024. Proceedings [...]. [S. l.]: SCITEPRESS, 2024. p. 137-145. DOI: 10.5220/0012374500003648.
ANDRESS, J. The basics of information security. Waltham: Syngress Press, 2019.
ASSOCIATED PRESS. Indiana wastewater plant hit by cyberattack; operators switch to manual controls. 2 abr. 2024. Disponível em: https://apnews.com/. Acesso em: 3 jul. 2026.
BAJAK, F.; LEVY, M. Breaches by Iranian-affiliated hackers spanned multiple U.S. states, federal agencies say. Associated Press News, 3 dez. 2023. Disponível em: https://apnews.com/article/hackers-iran-israel-water-utilities-critical-infrastructure-cisa-554b2aa969c8220016ab2ef94bd7635b. Acesso em: 3 jul. 2026.
BAJAK, F. In Florida city, a hacker tried to poison the drinking water. Associated Press, 8 fev. 2021. Disponível em: https://apnews.com/article/hacker-tried-poison-water-florida-ab175add0454bcb914c0eb3fb9588466. Acesso em: 3 jul. 2026.
BAUMEISTER, R. F.; LEARY, M. R. Writing narrative literature reviews. Review of General Psychology, v. 1, n. 3, p. 311-320, 1997. DOI: 10.1037/1089-2680.1.3.311.
BERGMAN, R. Cyberattack targets Israeli water supply system. The New York Times, 24 abr. 2020. Disponível em: https://nytimes.com. Acesso em: 3 jul. 2026.
BAKER, K. What is Cyber Threat Hunting? CrowdStrike, 4 mar. 2025. Disponível em: https://www.crowdstrike.com/en-us/cybersecurity-101/threat-intelligence/threat-hunting/. Acesso em: 3 jul. 2026.
BURTON, S. L. Strategy: a business and cybersecurity intertwined necessity. International Journal of Smart Education and Urban Society, v. 13, n. 1, art. 32, p. 1-12, 2022. DOI: 10.4018/IJSEUS.312232.
CENTERS FOR DISEASE CONTROL AND PREVENTION. Global water, sanitation, and hygiene (WASH). 2021. Disponível em: https://www.cdc.gov/healthywater/global/index.html. Acesso em: 3 jul. 2026.
CHERDANTSEVA, Y.; BURNAP, P.; BLYTH, A.; EDEN, P.; JONES, K.; SOULSBY, H.; STODDART, K. A review of cyber security risk assessment methods for SCADA systems. Computers & Security, v. 56, p. 1-27, 2016. DOI: 10.1016/j.cose.2015.09.009.
CITY OF ARKANSAS CITY. City of Arkansas City responds to cyber incident affecting water treatment operations. 2024. Disponível em: https://www.arkcity.org/. Acesso em: 3 jul. 2026.
COGHLAN, D.; BRANNICK, T. Doing action research in your own organization. 4. ed. Thousand Oaks: SAGE Publications, 2014.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA); FEDERAL BUREAU OF INVESTIGATION (FBI); ENVIRONMENTAL PROTECTION AGENCY (EPA). Top cyber actions for securing water systems. 21 fev. 2024. Disponível em: https://www.cisa.gov/news-events/alerts/2024/02/21/cisa-epa-and-fbi-release-top-cyber-actions-securing-water-systems. Acesso em: 3 jul. 2026.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA). Water and wastewater systems sector cybersecurity. 2023. Disponível em: https://www.cisa.gov/water. Acesso em: 3 jul. 2026.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA); FEDERAL BUREAU OF INVESTIGATION (FBI); NATIONAL SECURITY AGENCY (NSA). People's Republic of China state-sponsored cyber activity targeting United States critical infrastructure (Joint Cybersecurity Advisory AA23-136A). Washington, DC: United States Department of Homeland Security, 24 maio 2023. Disponível em: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a. Acesso em: 3 jul. 2026.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA); FEDERAL BUREAU OF INVESTIGATION (FBI); NATIONAL SECURITY AGENCY (NSA); ISRAELI NATIONAL CYBER DIRECTORATE (INCD). IRGC-affiliated cyber actors exploit PLCs in multiple sectors, including U.S. critical infrastructure (AA23-327A). 22 nov. 2023. Disponível em: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-327. Acesso em: 3 jul. 2026.
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA). Compromise of U.S. water treatment facility (AA21-042A). 12 fev. 2021. Disponível em: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-042a. Acesso em: 3 jul. 2026.
DAWSON, R.; BOYD, C.; DAWSON, E.; NIETO, J. M. G. SKMA: a key management architecture for SCADA systems. Computers & Security, v. 75, p. 118-131, 2018.
DRITSAS, E.; TRIGKA, M. A survey on cybersecurity in the Internet of Things. Future Internet, v. 17, n. 1, art. 30, 2025. DOI: 10.3390/fi17010030.
ETXEZARRETA, X.; GARITANO, I.; ITURBE, M.; ZURUTUZA, U. Software-defined networking approaches for intrusion response in industrial control systems: a survey. International Journal of Critical Infrastructure Protection, art. 100615, 2023. DOI: 10.1016/j.ijcip.2023.100615.
ENVIRONMENTAL PROTECTION AGENCY (EPA). EPA to increase enforcement of cybersecurity requirements in sanitary surveys. 3 mar. 2024. Disponível em: https://www.epa.gov/newsreleases/epa-increase-enforcement-cybersecurity-requirements-sanitary-surveys. Acesso em: 3 jul. 2026.
EZELL, B. C. Risks of cyber attack to water utility supervisory control and data acquisition systems. Military Operations Research, v. 6, n. 2, p. 23-33, 2001.
FEDERAL BUREAU OF INVESTIGATION (FBI). Internet Crime Report 2023. Washington, DC, 2024. Disponível em: https://www.ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf. Acesso em: 3 jul. 2026.
FERRARI, R. Writing narrative style literature reviews. Medical Writing, v. 24, n. 4, p. 230-235, 2015. DOI: 10.1179/2047480615Z.000000000329.
GILLILAND, T.; SNOW, S. Texas rural water systems hacked by overseas group, officials say. Associated Press News, 23 jan. 2024. Disponível em: https://apnews.com/article/texas-water-systems-hack-cyberattack-infrastructure. Acesso em: 3 jul. 2026.
GRIEVSON, O. (ed.). A strategic digital transformation for the water industry. London: International Water Association, 2022. Disponível em: https://library.oapen.org/handle/20.500.12657/59116. Acesso em: 3 jul. 2026.
GRIGG, N. S. Digital transformation in water utilities: status, challenges, and prospects. Smart Cities, v. 8, n. 3, art. 99, 2025. DOI: 10.3390/smartcities8030099.
GULZAR, M. M.; HUANG, Y.; SRINIVASAN, S. An analytical survey of cyber-physical systems in water treatment and distribution: security challenges, intrusion detection, and future directions. Security and Privacy, v. 7, n. 3, e440, 2024. DOI: 10.1002/spy2.440.
GULZAR, Q.; MUSTAFA, K. An analytical survey of cyber-physical systems in water treatment and distribution: security challenges, intrusion detection, and future directions. Security and Privacy, v. 7, e440, 2024. DOI: 10.1002/spy2.440.
HUANG, J.; YAN, X.; LUO, L. Machine learning-based modeling and control of wastewater treatment processes: a review. Journal of Environmental Management, v. 302, art. 114033, 2022. DOI: 10.1016/j.jenvman.2021.114033.
INDUSTRIAL CYBER. New CISA and EPA guidelines aim to shield water and wastewater systems from cyber threats. Industrial Cyber, 16 dez. 2024. Disponível em: https://industrialcyber.co/utilities-energy-power-water-waste/new-cisa-and-epa-guidelines-aim-to-shield-water-and-wastewater-systems-from-cyber-threats/. Acesso em: 3 jul. 2026.
KNOWLES, W.; PRINCE, D.; HUTCHISON, D.; DISSO, J.; JONES, K. A survey of cybersecurity risk assessment techniques for SCADA systems. Computers & Security, v. 56, p. 1-15, 2015. DOI: 10.1016/j.cose.2015.09.002.
KSHETRI, N. Cyberattacks on critical infrastructure: trends and implications. Computer, v. 54, n. 1, p. 36-45, 2021.
LINSTONE, H. A.; TUROFF, M. (ed.). The Delphi method: techniques and applications. Newark: New Jersey Institute of Technology, 2002. Disponível em: https://web.njit.edu/~turoff/pubs/delphibook/delphibook.pdf. Acesso em: 3 jul. 2026.
LIU, Y.; ZHANG, H.; CHEN, M. Cybersecurity framework for water treatment SCADA systems. Applied Sciences, v. 10, n. 18, art. 6285, 2020. DOI: 10.3390/app10186285.
MARTINS, G.; BHATIA, S.; KOUTSOUKOS, X.; STOUFFER, K. Detection of cyber attacks on a water treatment process. IFAC-PapersOnLine, v. 55, n. 7, p. 643-648, 2022.
MILLER, K. Rural Texas towns report cyberattacks that caused one water system to overflow. The Associated Press, 18 abr. 2024. Disponível em: https://apnews.com/article/texas-muleshoe-water-systems-cyberattacks-russia-5f388bf0d581fc8eb94b1190a7f29c3a. Acesso em: 3 jul. 2026.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST). Guide to Operational Technology (OT) Security (NIST Special Publication 800-82 Revision 3). Gaithersburg: NIST, 2023. DOI: 10.6028/NIST.SP.800-82r3.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST). Guide to Industrial Control Systems (ICS) Security (Special Publication 800-82 Rev. 2). Gaithersburg: NIST, 2015. DOI: 10.6028/NIST.SP.800-82r2.
NISSENBAUM, H. Hacker culture and digital disobedience. Cambridge: Massachusetts Institute of Technology Press, 2020.
REASON, J. Managing the risks of organizational accidents. London: Routledge, 2016.
SINHA, S. K. Water sector infrastructure systems resilience: a social-ecological-technical system-of-systems approach. Cambridge Prisms: Water, 2023. DOI: 10.1017/wat.2023.3.
SNYDER, H. Literature review as a research methodology: an overview and guidelines. Journal of Business Research, v. 104, p. 333-339, 2019. DOI: 10.1016/j.jbusres.2019.07.039.
STANTON, N. A.; SALMON, P. M.; WALKER, G. H.; JENKINS, D. P. Human factors methods: a practical guide for engineering and design. 2. ed. London: Routledge, 2021.
STOUFFER, K.; PILLITTERI, V.; LIGHTMAN, S.; ABRAMS, M.; HAHN, A. Guide to Industrial Control Systems (ICS) Security (NIST Special Publication 800-82 Revision 3). Gaithersburg: National Institute of Standards and Technology, 2023. DOI: 10.6028/NIST.SP.800-82r3.
STRINGER, E. T. Action research. 4. ed. Thousand Oaks: SAGE Publications, 2014. Disponível em: https://us.sagepub.com/en-us/nam/action-research/book233725. Acesso em: 3 jul. 2026.
TAORMINA, R.; GALELLI, S. Real-time detection of cyber-physical attacks on water distribution systems using deep learning. In: WORLD ENVIRONMENTAL AND WATER RESOURCES CONGRESS, 2017. Proceedings [...]. Reston: American Society of Civil Engineers, 2017. DOI: 10.1061/9780784480625.043.
TAYLOR, J. Effectiveness of SCADA system security used within critical infrastructure. arXiv, preprint arXiv:2012.11375, 2020. Disponível em: https://arxiv.org/abs/2012.11375. Acesso em: 3 jul. 2026.
TEXAS TRIBUNE. Hackers breached multiple small Texas towns’ water systems, causing tank overflow in one community. 19 jan. 2024. Disponível em: https://www.texastribune.org/2024/01/19/texas-water-hack-cyberattack/. Acesso em: 3 jul. 2026.
UNITED NATIONS (UN). The United Nations World Water Development Report 2023: Partnerships and Cooperation for Water. Paris: UNESCO, 2023. Disponível em: https://www.unesco.org/reports/wwdr/2023/en. Acesso em: 3 jul. 2026.
WALKER, M.; WAINWRIGHT, N.; WELLS, L. Applying cyber-informed engineering to water treatment operations. Water Research, v. 212, p. 118-132, 2022.
WANG, X.; WEI, W.; YOO, C.; LIU, H. Data-driven fault detection and diagnosis methods in wastewater treatment systems: a comprehensive review. Environmental Research, v. 268, art. 120822, 2025. DOI: 10.1016/j.envres.2025.120822.
WANG, H.; CHEN, Z.; ZHAO, J.; DI, X.; LIU, D. Detection and localization of cyber attacks on water treatment systems: an entropy-based approach. Frontiers of Information Technology & Electronic Engineering, v. 22, n. 3, p. 370-382, 2021. Disponível em: https://link.springer.com/article/10.1631/FITEE.2000546. Acesso em: 3 jul. 2026.
WEITOISH, T.; BURRELL, D. N. SCADA systems and threats to critical infrastructures. In: LEWIS, E. (ed.). Evolution of Cross-Sector Cyber Intelligent Markets. Hershey: IGI Global Scientific Publishing, 2024. p. 74-100. DOI: 10.4018/979-8-3693-1970-3.ch004.
WEITOISH, T. Cyber security laws, regulation, and policy frameworks for SCADA systems and mitigating threats to critical infrastructures. Journal of Crime and Criminal Behavior, v. 5, n. 1, p. 103-144, 2025. Disponível em: https://www.arfjournals.com/image/catalog/Journals%20Papers/JCCB/2025/No%201%20(2025)/6_Tiffany%20Weitoish.pdf. Acesso em: 3 jul. 2026.
WORLD HEALTH ORGANIZATION (WHO). Drinking-water. 2022. Disponível em: https://www.who.int/news-room/fact-sheets/detail/drinking-water. Acesso em: 3 jul. 2026.
WILSON, A.; TAYLOR, S. Human-machine interface design for water treatment plant SCADA systems. In: INTERNATIONAL CONFERENCE ON WATER TECHNOLOGY AND MANAGEMENT. Proceedings [...]. [S. l.]: Water Technology Institute, 2020. p. 89-102.
YADAV, G.; PAUL, K. Architecture and security of SCADA systems: a review. arXiv, 2020. Disponível em: https://arxiv.org/abs/2001.02925. Acesso em: 3 jul. 2026.
