Former NSA Chief Issues Stark Warning Against Connecting Water System PLCs to the Internet

Iran-Linked Group Suspected in Water

Facility Attacks

US water systems are being targeted by organized cyber attacks. The FBI announced in late July 2026 that “malicious cyber actors” launched attacks against Operational Technology (OT) devices, particularly Programmable Logic Controllers (PLC). These attacks have impacted water systems in at least 12 states.

According to a report by The Register, private security researchers strongly suspect an Iran-linked group is behind this series of attacks. Cynthia Kaiser, Senior Vice President at the Halcyon Ransomware Research Center, stated at DEF CON, “It would be surprising if it weren’t Iran.”

Former NSA Chief’s Sense of Crisis

Retired General and former NSA Chief Paul Nakasone highlighted to reporters at DEF CON the dangers of PLCs in water systems being connected to the internet.

“We need to have higher standards. These PLCs should not be connected to the internet.” — Paul Nakasone

PLCs are devices that monitor sensor data like tank water levels and control the on/off operation of pumps. Exposing these devices to the internet provides a direct pathway for intrusion into critical infrastructure.

Structural Vulnerabilities in US Water Systems

The US water system is a collection of decentralized facilities, historically prone to underfunding, with many having limited IT staff or no cybersecurity experts. Nakasone emphasized the vastness of this attack surface.

There are approximately 50,000 water utilities in the US, supplying 90% of the nation’s water. It is practically difficult for each facility to implement individual security measures, highlighting the need for a unified defense approach.

Partnerships Essential for Defense

Nakasone argues that defending water systems requires a different approach than in the past. As the director of Vanderbilt University’s Institute for National Security, he explains that collaboration with multiple partners is indispensable.

Based on this philosophy, the “DEF CON Franklin” project has been operating at DEF CON for two years. This is a volunteer initiative where hackers assist in strengthening the security of water facilities. Nakasone is also involved in “Project Chimera,” where academic researchers and cybersecurity practitioners collaborate to enhance infrastructure resilience using open-source technology.

Editorial Opinion

Short-term Impact

This incident reconfirms the urgent need for security measures in critical infrastructure OT devices. As the FBI investigation progresses, it may emerge that other key infrastructures like electricity and gas face similar risks, not just water facilities. Over the next 3-6 months, discussions on establishing federal OT device security standards and expanding subsidies for municipalities are expected.

Long-term Perspective

The decentralized structure of 50,000 water utilities points to a fundamental challenge in US infrastructure security. Instead of each municipality responding individually, a shift towards cost-sharing models like cloud-based security services or shared Security Operations Centers (SOCs) may accelerate. There is also a valid view that community-led defense models utilizing open-source technology could become the new standard for infrastructure security.

Question from the Editorial Desk

The report reiterates the principle that “PLCs should not be connected to the internet.” However, in reality, many facilities are forced to maintain connections due to needs for remote management and data collection.

References

• “Water system controllers don’t belong on the internet, says ex-NSA chief after suspected Iran attacks”, by Jessica Lyons — The Register, 2026-08-07T19:53:10.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/08/07/water-system-controllers-dont-belong-on-the-internet-says-ex-nsa-chief-after-suspected-iran-attacks/5285070