Investigation Launched After Hacker Tries to Poison Water Supply in Florida
<p>Authorities in Florida said investigations were underway after a hacker attempted to poison the water supply to the city of Oldsmar on February 5.</p><p>Pinellas County Sheriff Bob Gualtieri held a press conference on February 8 in which he said a hacker briefly increased the amount of sodium hydroxide, also known as lye, to “dangerous” levels after remotely accessing a computer for the city’s water treatment system.</p><p>A supervisor saw the levels being changed on his computer screen and immediately reversed it, leading to no impact on the water supply, Gualtieri said.</p><p>Mayor Eric Seidel said the monitoring protocols in place would have caught the change in the water’s pH level if the supervisor had not observed it. Credit: Pinellas Sheriff via Storyful</p>
OLDSMAR, Fla. — A hacker broke into remote access software shared by workers at a Florida city’s water treatment plant in an unsuccessful attempt to fill the water supply with a potentially harmful chemical, authorities said.
An unknown suspect breached a computer system for the city of Oldsmar’s water treatment plant on Friday and briefly increased the amount of sodium hydroxide from 100 parts per million to 11,100 parts per million, Pinellas County Sheriff Bob Gualtieri said during a news conference Monday.
Sodium hydroxide, also called lye, is used to treat water acidity but the compound is also found in cleaning supplies such as soaps and drain cleaners. It can cause irritation, burns and other complications in larger quantities.
A supervisor saw the chemical being tampered with – as a mouse controlled by the intruder moved across the screen changing settings – and was able to intervene and reverse it, Gualtieri said. Oldsmar, a city of 15,000 residents, is about 15 miles northwest of Tampa.
“At no time was there a significant adverse effect on the water being treated,” Gualtieri said. “Importantly, the public was never in danger.”
Still, Florida Sen. Marco Rubio described the attempted attack on Twitter as “a matter of national security” on Monday.
Oldsmar officials have since disabled the remote-access system, and say there were other safeguards to prevent the increased chemical from getting into the water. Officials told other city leaders in the region about the incident and suggested they check their systems.
Experts say municipal water and other systems have the potential to be easy targets for hackers because local governments’ computer infrastructure tends to be underfunded.
Tarah Wheeler, a Harvard Cybersecurity Fellow, said communities should take every precaution possible when using remote access technology on something as critical as a water supply.
“The systems administrators in charge of major civilian infrastructure like a water treatment facility should be securing that plant like they’re securing the water in their own kitchens,” Wheeler said via email. “Sometimes when people set up local networks, they don’t understand the danger of an improperly configured and secured series of internet-connected devices.”
The driver survived, somehow: A truck careened off an exit ramp bridge and plummeted 70 feet onto Interstate 94 in Wisconsin.
The sheriff said the intruder was active for three to five minutes. When they exited, the plant operator immediately restored the proper chemical mix, he said.
Other safeguards in place – including manual monitoring – likely would have caught the change before it reached the water supply, the sheriff said.
“The protocols that we have in place, monitoring protocols, they work — that’s the good news,” said Oldsmar Mayor Eric Seidel. “Even had they not caught them, there’s redundancies in the system that would have caught the change in the pH level.
“The important thing is to put everyone on notice,” Oldsmar Mayor Eric Seidel was quoted in the Tampa Bay Times. “There’s a bad actor out there.”
Investigators said it wasn’t immediately clear where the attack came from. The FBI, along with the Secret Service and the Pinellas County Sheriff’s Office are investigating the case.
— to www.usatoday.com