NEWS: Sens. Schiff, Klobuchar Release Comprehensive Cybersecurity Bill in Wake of Recent Cyberattacks on Water Infrastructure

Bill would give EPA explicit oversight authority on state water systems, something previous administrations were unable to implement even after cyberattacks Washington, D.C. – U.S. Senator Adam Schiff (D-Calif.), the top Democrat on the Fisheries, Water, and Wildlife subcommittee of the Environment and Public Works Committee, and Senator Amy Klobuchar (D-Minn.) are unveiling legislation today to meet the increased need for cybersecurity improvements in America’s water infrastructure in the wake of recent cyberattacks penetrating utilities and historic inability for coordinated federal response. The comprehensive legislation would strengthen federal oversight by the Environmental Protection Agency (EPA), provide critical funding for local utilities, and safeguard drinking water and wastewater systems from cyberattacks. The new bill comes as federal officials have warned of an alarming increase in cyberattacks against water utilities. In recent days, coordinated attacks targeted more than 30 community water systems across multiple states, underscoring the vulnerability of aging infrastructure and the potential for the contamination of clean drinking water for millions of Americans. Cyberattacks can also cause significant financial damage to municipalities and local utilities, including through ransomware payments that can be passed through to households in the form of higher water bills. “Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities. These threats are not hypothetical—they are happening right now. This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers,” said Senator Schiff. “The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure. Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats. Protecting our critical infrastructure and the safety of Minnesotans is a top priority,” said Senator Klobuchar. The EPA serves as the federal Sector Risk Management Agency for the water sector, but it currently lacks many of the authorities necessary to oversee cybersecurity across the nation’s drinking water and wastewater systems. This legislation fills the gap exposed in 2023 when the Biden administration was forced to abandon a proposal for stronger cybersecurity guidelines after lawsuits by states over lack of explicit authority. The Water Cyber Shield Act would: Authorize the EPA to conduct cybersecurity assessments and require corrective actions when significant vulnerabilities are identified. Authorize an additional $300 million each year for the Drinking Water and Clean Water State Revolving Funds dedicated to cybersecurity improvements. Require large drinking water and wastewater systems to assess cybersecurity risks as part of their existing risk and resilience planning. Direct the EPA to establish tiered cybersecurity standards developed in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), states, and water sector stakeholders. Extend federal cyber incident reporting requirements to state and locally owned water and wastewater systems that were previously exempt. Protect sensitive cybersecurity information submitted by utilities from public disclosure. Provide pathways for states with sufficient capacity to assume primary enforcement responsibility while allowing EPA to lead where needed. Smaller water systems and those with less capacity would receive additional flexibility and be prioritized for federal financial assistance, while EPA would be required to work closely with water utilities through a new technical advisory committee to develop practical cybersecurity standards. Federal agencies like the FBI and CISA have joined the EPA in urging utilities to strengthen their cyber defenses following cyberattacks. The legislation was developed after consultation with federal agencies and numerous water stakeholders, state regulators, and cybersecurity experts. A full summary of the bill can be found here. The full text of the legislation can be found here. ###