Regional water supply officials say the Peace River system is safer than the small Florida community that was hacked and nearly poisoned in February.
One major difference between the Peace River Manasota Regional Water Authority and the Oldsmar community near Tampa is the Peace River system is not connected to the internet, Deputy Director Mike Coates told the water authority commissioners Wednesday in Charlotte County.
Unlike the Oldsmar system of 15,000 people, the regional water authority serves about 1 million people in three counties — Charlotte, DeSoto and Sarasota with Manatee participating for future interests. The regional authority has about 80 miles of pipeline.
On Feb. 5, a water utility employee in Oldsmar noticed that someone had taken over his computer, but he assumed it was a supervisor working remotely, according to The New York Times. About 5 hours later, he noticed the levels of sodium hydroxide — lye — had been increased from 100 parts per million to 11,100 ppm. That’s when he took action before the contamination took effect. So far, no one has been identified as the hacker of this system. Security experts said at the time it could be a disgruntled employee or a foreign government. Reached for comment, Pinellas County sheriff’s Public Information Officer Aleksandra Kowalski said, “This case is still open and active; therefore, no further details can be released at this time.”
Officials in Oldsmar said other system alarms would have caught the contamination before it reached the public. But the lax use of team software and outdated operating systems were blamed by some cyber experts for the break in.
The Peace River reservoir and operations are based in DeSoto County. Administrative offices are two counties away in Lakewood Ranch.
The DeSoto facility is staffed 24 hours a day, seven days a week, 365 days a year, said Coates. It does not include any remote operation access, he said, and most likely never did in the last 30 years. Staff don’t just sit at the computer, he added. They are out on the property, checking things out. The reservoir is fenced in with surveillance and limited access.
Several years ago, he said, the U.S. Department of Homeland Security visited the site and made security recommendations, Coates said. The water authority implemented those changes, which he said he would not describe.
Although they have security systems in place, the hack at Oldsmar was a reminder, Coates said.
“That incident makes us ask, ‘What can we do better?’” he said.
Earlier in the week Charlotte County Commissioner Chris Constance objected to the item being on the agenda for public presentation.
“I don’t even know why this is on the agenda other than to say, ‘We’re going to have a ‘shade’ meeting,’ (behind closed doors) and i wouldn’t talk at all about anything else,” Constance told his board. “The fact that they feel comfortable with their cyber security makes me very nervous.”
Responding to Constance’s criticism, Coates told The Daily Sun, “We felt that it was high level enough so that we’re not giving anything away. The best defense is a strong offense.”
In 2002, following the 2001 World Trade Towers attack, Congress passed a Public Health and Security and Bioterrorism Preparedness and Response Act, Coates said, requiring all systems with more than, 3,300 customers to perform vulnerability assessments.
The World Health Organization also advised municipal systems to safeguard raw materials, restrict critical areas, and to screen employees and other personnel on site. They advise water supply operators to communicate effectively with consumers. This is to provide early alerts, but also, because consumers are among the first to notice changes in water quality.