(The Center Square) – The Environmental Protection Agencies withdrew a cybersecurity rule for water and wastewater utilities last week, but lawmakers have another solution pending in Congress.
The rule introduced in March required states to evaluate the cybersecurity of water utilities during audits, surveys or another equivalent process.
The American Water Works Association, the National Rural Water Association and the states of Iowa, Arkansas and Missouri challenged the rule in a lawsuit shortly after it was released. A U.S. District Court judge issued a stay on the rule in July.
The EPA announced it was withdrawing the rule last week. The agency said in an email to The Center Square on Tuesday that cybersecurity is still very important.
“Cybersecurity represents a serious and increasing threat to drinking water and wastewater utilities. EPA remains committed to using available tools and resources to help protect communities from the increasing number and severity of cyber-threats facing our nation’s water systems,” the agency said. “EPA will continue to work with states, Tribes, and territories to protect the public from the threats created by cybersecurity incidents and support the efforts of water systems to adopt cybersecurity best practices.”
The rule would have caused an increase in water rates, Iowa Attorney General Brenna Bird said.
“The EPA’s illegal mandate hurt 93% of our water systems, each of which serve between 25 and 3,300 people,” Bird said in a statement. “With these strict mandates in place, Iowans would have been slapped with inflated water bills with no benefit.”
A bill moving through Congress would give rural lawmakers the tools to stave off a cyberattack that could devastate a water utility. Last month, U.S. Sens. Mike Rounds, R-S.D., and Catherine Cortez Masto, D-Nev., introduced the Cybersecurity for Rural Water Systems Act. The bill would provide technical assistance and updated cybersecurity, the senators said in a statement.
A bipartisan group of representatives that includes Rep. Zach Nunn, R-Iowa, introduced a companion bill in June.
The bill is backed by the two water system associations.
“We also recognize that cyber threats in the water sector are real and growing, and we cannot let our guard down for even a moment,” said David LaFrance, CEO of the American Water Works Association. “Strong oversight of cybersecurity in the water sector remains critical. We urge U.S. Congress and EPA to support a co-regulatory model that would engage utilities in developing cybersecurity requirements with oversight from EPA.”
