Canada

Why hire someone locally when you can save money with random contractors that will do it just as well? /s

But how do you provide durable savings by outsourcing management if you airgap critical life systems?

/s

I'm surprised too. At my former company, to get access to the infrastructure took at minimum 3 different passwords (4 if you were coming in on the VPN) to get at anything. Even within the O&M system, different subsystems were segregated from each inherent. There was a lot of nested VLANS going on.

Made it interesting to configure new stuff, and there were regular audits to make sure you couldn't simply telnet (or SSH or whatever other protocol) from one device to another.

And we weren't anything near as important as a water utility.

There's far more secure methods than what you listed, but I'm also curious how this happened as neither the article or anything it cites specifices what the actual weakness was. I would love if someone has any sources on this infrastructure. If they are accessible via the internet, why was any device with an SSH key compromised and how? It would likely be on that end and potentially any cybersecurity contractor that was used for this (I'm guessing this is a consequence of some neoliberalism as per usual).

Wait for power grid... it's incredible as everything is connected on the internet with SCADA, some for like 20-25 years now, I'm sure China/Russia could have full control on it and shutdown everything in a few seconds.

Because a town council wanted to get re-elected and so “streamlined” the budget for the water department to save voter tax dollars.

Yes, and the same is true for all public infrastructure and other sensitive technology.

But tankies keep up the illusion that remote control of Chinese tech isn't a problem.

As an addition: In August 2025, a joint advisory of Western goverments' intel - including Canadian Centre for Cyber Security (Cyber Centre) and the Canadian Security Intelligence Service (CSIS) - said,

People’s Republic of China (PRC) state-sponsored cyber threat actors are targeting networks globally, including, but not limited to, telecommunications, government, transportation, lodging, and military infrastructure networks. While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks. These actors often modify routers to maintain persistent, long-term access to networks. [Source (pdf)]

I worked in water treatment during an internship and learned about air gapping. You make it so that data can go out for monitoring, but nothing can come in. You need physical access to make changes. Because if someone can control it remotely, that means anyone can control it remotely.

The smaller the municipality (and the older the system), the less likely that they have a robust IT department managing all the access controls.

Then again, I've also an encountered office (not utility infrastructure) where some random employee had plugged a WIFI access point into their desks ethernet port and set it on the window ledge so they could use their phone on the company network while they were outside having a smoke... (yes they faced consequences when management was made aware)

As we all know, security is only as good as your weakest link.

Most likely Windows XP on an old dell desktop in a closet. Can't be upgraded due to some no longer maintained driver blah blah