Sens. Klobuchar, Schiff Introduce Comprehensive Cybersecurity Bill in Wake of Recent Cyberattacks on Water Infrastructure

WASHINGTON - U.S. Senators Amy Klobuchar (D-MN) and Adam Schiff (D-CA) introduced the Water Cyber Shield Act to improve cybersecurity in America's water infrastructure in the wake of recent cyberattacks against water utilities.

The legislation would strengthen federal oversight by the Environmental Protection Agency (EPA), provide critical funding for local utilities, and safeguard drinking water and wastewater systems from cyberattacks.

"The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure," said Klobuchar. "Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats. Protecting our critical infrastructure and the safety of Minnesotans is a top priority."

"Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities," said Schiff. "These threats are not hypothetical-they are happening right now. This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers."

The new bill comes as federal officials warned in April of an alarming increase in cyberattacks against water utilities. In the last few weeks, coordinated attacks targeted more than 30 community water systems in Minnesota, underscoring the vulnerability of local infrastructure and the potential for the contamination of clean drinking water.

The Water Cyber Shield Act would:

• Authorize the EPA to conduct cybersecurity assessments and require corrective actions when significant vulnerabilities are identified.
• Authorize an additional $300 million each year for the Drinking Water and Clean Water State Revolving Funds dedicated to cybersecurity improvements.
• Require large drinking water and wastewater systems to assess cybersecurity risks as part of their existing risk and resilience planning.
• Direct the EPA to establish tiered cybersecurity standards developed in consultation with the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), states, and water sector stakeholders.
• Extend federal cyber incident reporting requirements to state and locally owned water and wastewater systems that were previously exempt.
• Protect sensitive cybersecurity information submitted by utilities from public disclosure.
• Provide pathways for states with sufficient capacity to assume primary enforcement responsibility while allowing EPA to lead where needed.

Smaller water systems and those with less capacity would receive additional flexibility and be prioritized for federal financial assistance, while EPA would be required to work closely with water utilities through a new technical advisory committee to develop practical cybersecurity standards.

Following the cyberattacks on Minnesota municipal water facilities, Klobuchar received a briefing from U.S. National Cyber Director and Minnesota native Sean Cairncross and spoke to several mayors whose communities have been impacted.

###