The Water and Wastewater Systems Sector consists of drinking water and wastewater systems that treat, transmit, store, collect, and distribute water across the nation.
The water sector in New Jersey includes about 600 community drinking water systems. The 20 largest systems collectively serve roughly 3.8 million people and support water service to another 140 systems in the state.
Wastewater systems include treatment plants, pumping stations, collection systems, and sludge management processes. There are approximately 350 wastewater facilities, which vary in size and function. The largest 50 facilities process and treat 88 percent of the sludge residuals and 90 percent of wastewater generated in New Jersey.
The threat to the Water and Wastewater Systems Sector is moderate because of the known targeting of critical infrastructure by both state and non-state actors capable of conducting disruptive, manipulative, or destructive attacks. While there are no specific threats to this sector in New Jersey, numerous incidents over the past decade have demonstrated the vulnerability of industrial control systems (ICS) that regulate various components of water and wastewater operations. In 2015, the Water and Wastewater Systems Sector reported 25 cyber incidents to the US Department of Homeland Security ICS Cyber Emergency Response Team (ICS-CERT), a roughly 80 percent increase from 2014.
Terrorists have not targeted the Water and Wastewater Systems Sector in the last decade in the United States. Internationally, drinking water sources remain vulnerable to terrorist attacks because of limited security. In January 2016, Turkish intelligence officials reported individuals affiliated with the Islamic State of Iraq and Syria plotting to poison the water supply using tularemia, a bacterial disease found in animals that is transmissible to humans.
During Superstorm Sandy, 427 community water systems in New Jersey lost power. The heavy reliance on electric power makes any water or wastewater system vulnerable to extreme weather. Ninety-one wastewater treatment facilities were affected by flooding or power loss, resulting in reduced treatment capacity and discharging as much as five billion gallons of raw sewage into state waterways. Additionally, coastal flood waters damaged water utility infrastructure, leaving the communities they serve without clean water.
In March 2016, the New Jersey Board of Public Utilities announced new cybersecurity requirements for utilities in New Jersey. This action directs water and wastewater, electric, and natural gas utilities to:
- Have a cybersecurity program that defines and implements organizational oversight, accountabilities, and responsibilities for cyber risk management
- Establish policies, plans, processes, and procedures for identifying and mitigating risk to critical systems
ICS-CERT provides online training courses and cybersecurity evaluation tools at its website.
The US Environmental Protection Agency has tools for emergency response for water and wastewater utilities available at its website.
- Which operational devices used in Water and Wastewater Systems are most vulnerable to cyber threats?
- When and how have Water and Wastewater control systems in New Jersey been compromised by cyber threat actors? What was the impact?
For more information, please contact NJOHSP's Preparedness Bureau at firstname.lastname@example.org.