Consider This from NPR - Hackers are after your water. How this town defends against them.

Episode Date: September 8, 2025

Chris Hugues has what he calls an interesting job.He’s an assistant operator at a wastewater treatment plant in Cavendish, Vermont.On a recent August afternoon he gave NPR’s Jenna McLaughlin a tour of the plant.Hughes loves his work, in all its technical, mathematical, chemical, and yes, dirty, glory.  But lately, Hughes has had to worry about a new hazard: cyberattacks.  The threat of someone cutting water off for Americans is real.Chinese hackers recently spent nearly a year inside a Massachusetts utility company that provides power and water. And last October, hackers targeted American Water, the largest wastewater utility company in the country.Water is an appealing target for hackers. People like Chris Hughes are working to make sure a cyber-attack doesn’t stop the flow. For sponsor-free episodes of Consider This, sign up for Consider This+ via Apple Podcasts or at plus.npr.org. Email us at [e-mail] episode was produced by Alejandra Marquez Janse.It was edited by Courtney Dorning and Andrew Sussman.Our executive producer is Sami Yenigun.Learn more about sponsor message choices: podcastchoices.com/adchoicesNPR Privacy Policy

Chris Hughes has what he calls an interesting job. He's an assistant operator at a wastewater treatment plant in Cavendish, Vermont. So where we're going now is the beginning of the process. This is where it comes into the sewer plant. On a recent August afternoon, he gave NPR's Jenna McLaughlin a tour of the plant. What you see there are rags and things that don't belong, that we have to screen out ourselves. Some places have automated machines that do that. We don't.

We have a rake. Sounds like a fun job. Yeah. Yeah. Do you love it or you don't? It's nature of the beast. Hughes does love his work in all its technical, mathematical, chemical, and yes, dirty glory. But lately Hughes has had to worry about a new hazard, cyber attacks. I have someone got into the system, they could just turn it off, and we can stop producing water. We'd be dead in the water, I guess. The threat of someone

cutting water off for Americans is real. Chinese hackers recently spent nearly a year inside a Massachusetts utility company that provides power and water. And last October, hackers targeted American water, the largest wastewater utility company in the country. Monday, the water utility said that they discovered a cyber attack last week and in an effort to protect customers' data and prevent any future harm. Consider this. Water is an appealing target for hackers.

And some people are working to make sure a cyber attack doesn't stop the flow. From NPR, I'm Ari Shapiro. It's Consider this from NPR. The Environmental Protection Agency recently sounded the alarm about an increase in malicious cyber attacks targeting water systems as hackers from nation states and criminal gangs cause chaos, make money, and even prepare for potential future conflicts with the U.S. In Vermont, the small town where Chris Hughes works is trying to protect its water from hackers.

NPR's cybersecurity correspondent, Jenna McLaughlin, paid a visit. It's late summer in southern Vermont, and Buttermil Creek and Ludlow is cascading into three gushing waterfalls. Meanwhile, Chris Hughes is trying to figure out why there's water gushing where it shouldn't. Well, this is far. Hang on a minute. We're at the water treatment plant Hughes helps run. He makes a call to his boss. Hey, we got a problem with the water plant.

Hughes is the assistant operator here. It's just two people treating all the drinking and wastewater in the small towns of Cavendish and Procter'sville. Systems shut off, and the water's pouring out of the clear well outside. Turns out, a lightning strike shut off power to one of the systems. Speaking outside earlier that day, while the storm that likely hit the plant passed through the area, Hughes said the work is never boring. I haven't had a lot of jobs, but it is by far the most interesting job. that I've ever had.

And so you have to like it. You have to kind of care. Hughes has dealt with all kinds of problems, from lightning strikes to hunting down missing manhole covers and dense, tall grass, or raking so-called flushable wipes out of sewer pipes. But now, Hughes is learning about a new threat on the horizon, hackers. It's kind of scary that I am the only door between

you know, the Iranians and their water system, you know, that kind of makes me a little nervous. I don't really have the background to be fending off foreign entities, you know. Hughes isn't exaggerating. The threat is real. Last October, criminal hackers targeted American water, the largest publicly traded water and wastewater utility company in the United States. Then that January, Russian hackers took credit for making a water system overflow in Uelshoe, Texas.

Meanwhile, the White House has been cutting federal funding for many cybersecurity programs. But there's good news. There's a team assembling here in Vermont to help Hughes out. I grew up in Berkshire, Vermont. My town doesn't have a high school. Meet Forrest Anderson, another local water operator. Carrying a ukulele case full of gadgets, he's also a self-proclaimed tech nerd. That's part of how he recently got a job as a cybersecurity system specialist for the nonprofit Vermont Rural Water Association.

As we ducked out of the rain, he mentioned another hacking group that he's worried about. If you aren't familiar with Volt Typhoon, it's going on right now. Volt Typhoon is in New England. Volt Typhoon. He's referring to a Chinese hacking group, U.S. national security officials say, has been burrowing into U.S. critical infrastructure, lying in wait to shut off water systems and spread fear in the event of a conflict, like if China wanted to invade Taiwan. So I don't scare people. I give people the facts. And the fact is that they're here. And if we were to lose our supply of semiconductors on top of our manufacturing, our power, and our water, we would not stand a chance against any conflict.

Also joining us was Tim Papa, a former FBI agent who now works in cybersecurity in the corporate world. You kind of mixed people. You didn't expect to be mixed together. I don't know if Chris and I would have met ordinarily, but we have. We have different backgrounds and different perspectives on things. He's here thanks to a new volunteer effort called Project Franklin, put together by heavy hitters in the cyberspace, from the well-known DefCon Hacking Conference to the University of Chicago. Cavendish might be small, but it's nestled up alongside Glitzy Ski Resorts, major defense contractors.

It's part of the critical infrastructure of New England. Anderson and Hughes both remember Hurricane Irene back in 2011, how the flooding damaged everything, even led to the deaths of a father-son water operator team in nearby Rutland, and how the towns came together to help each other rebuild. Especially after the flooding, we realize there's no cavalry. We are the cavalry. We are. That goes back to that New England and Yankee Ingenuity.

We'll do it ourselves. New England ingenuity and some good tech hygiene. I watch as Anderson, Hughes, and Papa put some basics in place to set Cavendish up for success, no matter what's coming there. way. I have something pulled up for you to check out later, some event logs and a security. They cover up the Wi-Fi password, install network monitoring tools, a virtual private network, and system backups.

If you see a failed login attempt and then a successful login attempt, and then they take a data packet, a file, or a folder, you can assume that it was malicious. It's a big step in the right direction of making Cavendish a smaller target for bad guys. To explain, Anderson has the perfect Vermont metaphor. I say right now, it's hunting season. We are the six-point buck in the field. We're just hanging it out in the fields. Right now we need to get in the woods because it's a lot harder to hit a target in the woods.

Going forward, it might indeed be harder for hackers to hit their mark, here amongst the sugar maples of Vermont. That's NPR cybersecurity correspondent, Jenna McLaughlin. This episode was produced by Alejandra Marcus Hansi and Karen Zamora. It was edited by Courtney Dorney and Andrew Sussman. Our executive producer is Sammy Yenigan. It's Consider This from NPR. I'm Ari Shapiro.

Want to hear this podcast without sponsor breaks? Amazon Prime members can listen to Consider This sponsor-free through Amazon music. Or you can also support NPR's vital journalism and get Consider This Plus at plus.npr.org. That's plus.npr.org.