What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out
What Happens if China Hacks the US Water Supply? đźš°
A simulated catastrophic cyberattack on US water utilities showcased alarming potential impacts. A full 24 hours of in-game time passed since hackers disrupted 5,000 water utilities across the United States in this imagined scenario. The second-order effects of widespread water outages started to become clear:
- Food refrigeration systems failed at cold storage warehouses.
- Water-dependent drug and chemical manufacturing was bottlenecked, leading to insulin shortages.
- Data centers’ cooling systems failed, causing outages of cloud services.
Most critically, 2,000 hospitals were without water, hampering patient care and in some cases leading to evacuations as HVAC systems shut down. “Everyone downstream is without water pressure,” said Joshua Corman, a former Cybersecurity and Infrastructure Security Agency strategist leading the exercise. “Everything depends on water.”
Most China-watchers in the cybersecurity world agree that this particular clock has already been ticking for years. In May 2023, Microsoft, the National Security Agency, and CISA all announced the discovery of what they called Volt Typhoon, a group of hackers working in service of the Chinese military. The intruders had broken into the networks of critical infrastructure facilities across the continental United States and the US territory of Guam, hitting targets related to everything from manufacturing to telecommunications to the electric grid.
These breaches were especially alarming because the hackers seemed to be going beyond standard espionage, instead “pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.” Volt Typhoon was, in other words, “pre-positioning,” as another CISA and NSA advisory put it in early 2024, laying the groundwork for broad cyberattacks aimed at disabling the US military at a crucial strategic moment.
As tracking of Volt Typhoon continued, it became clear that the hackers’ target list wasn’t limited to networks allowing sabotage of US military assets. They included the IT systems of a water utility in Hawaii, multiple US ports, and at least one oil and gas pipeline, but also hundreds of other entities including water and electric infrastructure as small-scale as the Littleton Electric Light & Water Departments. “The only reason to target that sort of entity is to cause societal chaos in the United States,” CISA’s former executive director Brandon Wales stated. Volt Typhoon, he added, seemed to be preparing to “cause chaos in the homeland–to influence our geopolitical freedom of action, our willingness to fight.”
Joe Slowik, a former Los Alamos National Labs cybersecurity researcher, says Volt Typhoon–or a related hacker group it has evolved into–is still targeting the US electric grid and water utilities. Some intrusions are caught, but others go undetected due to minimal security budgets and the hackers’ stealthy mode of operating, known as “living off the land,” that hijacks legitimate functions in a network instead of planting malware.
The scenario modeled by Corman’s war game–5,000 hacked water utilities–would be unprecedented. Yet Jen Easterly, who served as director of the Cybersecurity and Infrastructure Security Agency when China’s hacking campaign was first discovered, warns that AI could make such mass-sabotage far more plausible, particularly over the next few years. “What we found was really just the tip of the iceberg,” Easterly said, emphasizing that she believes there’s no change to “China’s very deliberate strategy to create access points in our most important civilian infrastructure, to be able to launch disruptive attacks in the event of a crisis in the Taiwan Strait.”
Former NSA director of cybersecurity Rob Joyce underscored this warning recently, writing that “China has effectively strapped the digital equivalent of explosives to the backbone of American society… Quietly maintaining access. Waiting.”