I am so glad to see this is the top comment. Hacks on public infrastructure feel to me like one very small step away from actual military actions. I don’t understand why they never seem to be reported with the gravity they deserve.
A successful attack is much less likely to be made public, for obvious reasons. We may have suffered from successful attacks and not know it (small enough concentrations of contaminants can’t be tasted)
Install water filters, HN. Use them. We have AquaSana under-the-sink in several locations through the house... no pitchers. Whole-house filters do not filter nearly the same variety of crap that under-the-sink and PUR pitchers do. Say no to Brita. Learn your NSF ratings and choose wisely.
You’re only paranoid if you’re wrong.
Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. The Safe Drinking Water Act is pretty powerful stuff.
https://www.cdc.gov/healthywater/drinking/public/regulations...
It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles.
Even with weekly testing, I’d expect the same risk (there’s still a window between tests). Basically you’re only going to know about a problem when it’s too late.
Indeed, you'll see that if a water test comes back positive, there will be multiple retests and a much greater rate of testing until the problem is abated, at least at my local drinking water board.
This isn't remotely true.
E.g., Seattle explicitly states:
> We monitor your water 24 hours a day, 365 days a year. We test samples from the region between 10 and 100 times per day.
https://www.seattle.gov/Documents/Departments/SPU/Services/W... (PDF)
> To ensure the safety of our drinking water, SPU's water quality laboratory analyzes over 20,000 microbiological samples each year (more than 50 a day) and conducts chemical and physical monitoring daily, 365 days per year.
https://www.seattle.gov/utilities/your-services/water/water-...
It depends on what contaminant you are measuring, but the testing frequency can vary from "every several years" to "continuously monitored and sets off a SCADA alarm if it exceeds a given threshold." The biggies--IIRC, turbidity, pH, and dosages of coagulant and treatment chemicals--are logged every 15 minutes, with more tests happening on hourly 6-hourly, and daily frequencies, followed by yet more contaminants happening largely on monthly or quarterly assessment bases. The issue in question would have shown up in a pH measurement, so there's no reason it shouldn't have been caught within minutes.
I use one of those under-the-sink inline charcoal cartridge filters on the sink we use to make tea or cook with. If I grab some water from a different tap, you can tell immediately by the smell (chlorine) and the taste.
I'm surprised the filter takes out the chlorine honestly, but it's clearly taking out a bunch of stuff from what is otherwise considered very clean.
That said, having travelled extensively through places like India, South America, East Asia, etc., I'm certainly grateful for the water we have "on tap" in the house. It's easy to take for granted.
> You might hear about different forms of chlorine. Seattle's water system uses "free chlorine" (not chloramines).
http://www.seattle.gov/utilities/your-services/water/water-s...
EPA mandates a floor of 0.2 mg/L chlorine for all Surface Water based drinking water supplies at all times[0]. There are additional chlorine requirements depending on what sort of filtration you perform, if any, and how far the first service connection is from the chlorine insertion, in minutes. (They also mandate a safety ceiling of 4 mg/L for all drinking water.) This level is continuously monitored.
Seattle does about 1 mg/L to meet these EPA-imposed requirements.[1]
Chlorine evaporates out of water, so if you don't like the taste, you can just let tap water sit a while. Sunlight helps. Boiling water (e.g., for tea) also removes most of the chlorine.
[0]: (PDF) https://www.epa.gov/dwreginfo/swtr-plain-english-guide
[1]: (PDF, p. 8) https://www.seattle.gov/Documents/Departments/SPU/Services/W...
They get filtered, but there is no chlorine directly. Some chlorine dioxide is used at the end, though. Here's the official description of the utility, translated to english:
- Via a raw water pumping station, the dam water first reaches the micro-screening plant. It removes coarse contaminants over 35 ~ µm in diameter through stainless steel mesh filters. This provides special safety in times of mass algae growth or during floods.
- Subsequently, the raw water is de-stabilized with a flocculant; and turbid matter accumulates to form large flocs.
- In filter stage 1, two filter materials of different coarseness are used to remove the flocs.
- Ozone is then added to disinfect the raw water.
- Filter stage 2 is equipped with activated carbon and frees the raw water from the reaction products of ozonation. Excess ozone reacts to form oxygen and is thus removed from the raw water.
- The further filter stage 3 uses natural limestone material over which the water flows. Here the excess carbonic acid in the water is removed. Finally, a small protective disinfection with chlorine dioxide takes place before the drinking water leaves the clean water tank in the direction of <city>.
- Ozone disinfection, and removal
- Tolt river supply only: water conditioning by filtering through "granular media." (Cedar river supply is clear enough without this step.)
- UV disinfection
- pH adjustment to avoid corroding pipes
- Flouridation for public health
- Chlorination as a final step as water leaves the treatment plant, and also at some downstream facilities (like a networking repeater; just to maintain chlorine levels that would otherwise have fallen due to distance from the upstream chlorination site)
Tolt: http://www.seattle.gov/utilities/your-services/water/water-s...
Cedar: http://www.seattle.gov/utilities/your-services/water/water-s...
Yes - they should. Because there is going to be a lot more of this happening in the not so distant future.
Wait till we get our M2 Browning.
While you can definitely make a respectable living in the cybersecurity industry the fact of the matter is that over that same time period the people vomiting JavaScript trackers all over the internet made the same or more money with less effort invested.
Sure, go into security, help make the world more secure... meanwhile I’ll be here writing some JavaScript making twice what you make and working probably half the hours you do.
Perhaps a change in KPI or regulation requirements may create such incentive to ensure appropriate actions are taken.
Because this is most likely "teenager broke into a poorly secured shack and turned a random valve to be naughty", not "state actor sabotaged critical infrastructure".
(Still, the problem remains: if a naughty teenager can turn a valve for shits and cause a threat to public health, then perhaps that valve needs some access control.)