Ex-NSA chief: keep water plant PLCs off the internet after suspected Iran attacks

Retired General Paul Nakasone, the former NSA director now heading Vanderbilt’s Institute for National Security, argues that the programmable logic controllers running U.S. water utilities have no business being reachable from the public internet. His warning follows a wave of intrusions against water systems in at least 12 states, which the FBI began investigating in late July. Private researchers—including Halcyon’s Cynthia Kaiser—point to Iran-linked crews, though the government has not made a formal attribution.

The underlying problem is structural. Roughly 50,000 municipalities supply about 90% of the country’s water, and many are small, chronically underfunded operations with little to no dedicated IT or security staff. That leaves the PLCs monitoring sensors and driving pumps exposed and largely undefended—a soft target Iranian operators have probed for years.

Nakasone’s prescription is twofold: raise the baseline (get these controllers off the internet and hold operators to higher standards) and lean on collaborative defense that resource-starved utilities can’t build alone. He pointed to volunteer efforts such as DEF CON’s Franklin project, which sends hackers to harden water facilities, and to Project Chimera, an open-source platform pairing academics and practitioners to shore up critical infrastructure.