As dozens of communities across Michigan and six other states have faced cyber attacks on their water infrastructure in recent weeks, likely from Iranian hackers, the City of Grand Rapids is months away from completing an overhaul of its remote operating system aimed at security upgrades.
These improvements are a three-year-long, $12 million revamp of the city’s supervisory control and data acquisition (SCADA) system, which helps city operators manage tanks and pumps from remote locations, said Wayne Jernberg, utilities director for the city of Grand Rapids.
Three years ago, external consultants audited the city’s SCADA system to assess potential risk.
“Those audits have now been turned into this capital project that we have, that’s enhancing our system even further,” the utilities director said.
No Grand Rapids water or wastewater infrastructure device is connected to the internet, said Doug Start, director of information technology for Grand Rapids.
Jernberg declined to describe how the SCADA systems operate or specific security measures out of safety concerns.
“We have multiple layers of protection that are in place that keep the bad guys out,” Jernberg said. “I’ll just leave it at that.”
The city also conducts internal audits to identify potential vulnerabilities in its water and wastewater systems, which have been clean.
Grand Rapids has never been the victim of any cyberattack, said Start.
Start and Jernberg receive regular updates from the FBI, Michigan State Police Cyber Command Center, and the American Waterworks Association on cyber attacks on municipal governments. The city has a contract with the Department of Homeland Security and the Multi-State Information Sharing and Analysis Center for information sharing, threat intelligence, and cybersecurity services.
Both department heads said law enforcement has been quiet on the nature and locations of the attacks, to avoid other hackers from seeking to exploit the same weaknesses in these systems.
Since the start of war in Iran, Jernberg estimated law enforcement agencies have sent out double the number of alerts.
“By far and away, this is the most chatter I’ve ever seen,” Jernberg said.
With new developments in artificial intelligence and the widespread availability of sophisticated large language models, hackers can find vulnerabilities much faster, Start said. Patching—the process of updating software to address system weakness—happens more frequently as a result.
“AI has really pushed that boundary,” Start said.
SCADA systems have been in place for about 50 years. In the event of a cyber attack, the city would revert to turning pumps on and off manually.
“If something were to go wrong, you go into full manual, which is the old way it was done,” Jernberg said.
Grand Rapids is one of the largest water systems in the state, by customers served. Retail customers include Grand Valley State University, Allendale Township, and Coopersville. Other customers, like Ada and East Grand Rapids, are wholesale customers, which manage their own assets, such as pump stations.
Grand Rapids manages an average water flow of about 37 million gallons per day and treats 25 to 30 million gallons of sewage daily. In events like large storms, the city can treat 60 million gallons of sewage in a day.
Small communities, which don’t have an IT department in house, are especially at risk of cyber attacks, Jernberg said. The utilities department has a staff member dedicated to SCADA IT. MSP will audit SCADA systems for free, but municipalities are on the hook for upgrading their own systems.
Write to juliana@grherald.com