MARY LOUISE KELLY, HOST:
An agreement to reopen the Strait of Hormuz could be close to being sealed. Iran’s Parliament is reviewing the proposal to reopen the waterway and – key point here – the deal is between Iran and Oman. It would not directly involve the United States. We don’t know yet what that could mean for the U.S. or for global oil markets. Meanwhile, the broader conflict continues. Over the next few minutes, we’re going to hear about what could be a new front – cyberattacks. I spoke about that today with NPR cybersecurity correspondent Jenna McLaughlin on NPR’s Sources & Methods podcast.
(SOUNDBITE OF ARCHIVED NPR CONTENT)
KELLY: Jenna, you’re bringing us fresh reporting on cyberattacks – alleged cyberattacks by Iran on U.S. infrastructure. What do we know?
JENNA MCLAUGHLIN, BYLINE: Yes. There’s still a lot we don’t know, so I’ll preface with that. But essentially, what we do know is that the FBI has revealed that there are at least seven states where we’ve seen attacks on the water sector – so water, waste water, public utilities.
KELLY: OK.
MCLAUGHLIN: There’s 50,000 of these across the United States, so…
KELLY: Utilities – 50,000 utilities.
MCLAUGHLIN: Fifty thousand water facilities.
KELLY: OK.
MCLAUGHLIN: So we could hear of a lot more down the line, but that’s what we know so far. So what happened at these water facilities is there were cyberattacks on what are called programmable logic controllers – basically a fancy term for a simple machine in industrial systems that monitors and controls things that those machines do. So in water, it’s going to keep track of levels, pressure, etc., and it might control that pressure. So these hackers targeted those systems and, in some cases, they locked people out of their connection to the water pumps. They caused some flooding. They caused some changes in pressure, and that immediately inspired a fair amount of panic in these local communities that – oh, no, what’s happening with…
KELLY: Yeah.
MCLAUGHLIN: …Our systems.
KELLY: You said at least seven states that we know of. And I was starting to look. I saw reports – Georgia, New Jersey…
MCLAUGHLIN: Yes.
KELLY: …Minnesota. So this is, like, all over. It’s…
MCLAUGHLIN: Yes. Minnesota was the first to come out and talk about this. They’ve been really transparent. I actually spoke to the mayor of Braham, Minnesota, Nate George, and he has been really transparent about this. He’s talked a lot about sort of when he first learned that this was going on.
KELLY: When did he first – like, what’s the timeline on this?
MCLAUGHLIN: He said around Monday morning. I think that was the 28 – the 27 or the 28…
KELLY: Of July. OK.
MCLAUGHLIN: …And the attacks took place over the weekend in the middle of the night. That’s when he first learned about it. And his teams took a couple of hours. They put out an advisory and said, hey, everybody, please conserve water while we figure out what’s happening. We’ve got the backups in our water tank. We’re going to be fine. But, you know, something wrong happened here, and we’re going to investigate it. So they managed to get those systems back online pretty quickly.
KELLY: So yeah, stay with that, with the do not panic piece of this podcast. As far as we know, no, like, issues with water quality. Nobody’s been hurt by this. It’s an issue of trying to figure out something happened, what happened?
MCLAUGHLIN: Correct.
KELLY: OK.
MCLAUGHLIN: Yeah. There’s no reason to panic that the well has been poisoned.
KELLY: Right.
MCLAUGHLIN: Actually, in conversations with a lot of these water operators, there’s only so much you can do remotely. You can mess with the levels, the pressure. You can adjust the levels of chlorine, maybe. But there’s not a lot you can do unless you’re physically on site. So people don’t have to panic about that.
KELLY: OK. To the who. We said the thinking is this is Iran, that the FBI is thinking this is Iran. Like, tell me more in terms of attribution.
MCLAUGHLIN: Yeah. So my reporting right now indicates – I have one anonymous source, who requested anonymity to speak about sensitive issues, and they said that there is some intelligence indicating that this is connected to the IRGC. So the…
KELLY: The Revolutionary…
MCLAUGHLIN: Yeah.
KELLY: …Guard Corps.
MCLAUGHLIN: Exactly. However, I also spoke with Rob Lee. He’s the CEO and cofounder of Dragos, which is, you know, one of the biggest names in the game as far as industrial cybersecurity. He essentially told me that this is still ongoing. But from what he can see, there’s a little bit of hesitation to immediately attribute this. And Dragos doesn’t do attribution, but there’s hesitation in the community to definitively say that this is Iran because no one’s actually taken credit for it yet, which is kind of weird. There’s still that possibility that it’s another actor who’s trying to take advantage of the tension between the U.S. and Iran to drum up this fear and concern.
KELLY: Would this square with what we know Iran’s cyber capabilities and ambitions to be?
MCLAUGHLIN: Yes. So Iranian actors have, for several years, been trying to find vulnerable systems, particularly in industrial controls in U.S. critical infrastructure to sort of mess around with them – low-level stuff, not super sophisticated. You know, they might get in. They might log somebody out of their system. They might deface the display. They’ve done that before. I think that was with the Unitronics systems in Aliquippa, Pennsylvania. So they have a history of this behavior.
But I think as far as actually, you know, wiping out the power, the water, etc., that is not something that Iran is capable of. They also have a history of exaggerating their impacts, saying we’ve reached and touched the Great Satan, and we’ve influenced their water, and that was a big win, and we’re so powerful, you know?
KELLY: Go to the why, Jenna. We’re at war with Iran. So, you know, if Iran can’t shoot a missile that can reach all the way to – I don’t know – D.C., LA, New Orleans, wherever, this is a way of hitting us.
MCLAUGHLIN: Certainly. I think they maybe wouldn’t want to do that because the U.S. can certainly respond with force. But I talked to Michael Crean. He’s a cybersecurity expert at SonicWall, and he said that these kinds of attacks can create fear, whether we’re in the middle of an active war or it’s a peacetime.
MICHAEL CREAN: What is it that you can do to potentially, quote-unquote, “scare” the American people? Well, water is one of those things. It’s a necessity of life.
MCLAUGHLIN: So I think that puts it pretty well. You want to create panic, essentially.
(SOUNDBITE OF EMANUEL KALLINS AND STEPHEN TELLER’S “PLUNGED INTO CRISIS”)
KELLY: That was NPR cybersecurity correspondent Jenna McLaughlin. We were speaking on our national security podcast Sources & Methods. You can hear our full conversation wherever you get your podcasts. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
