Water System Controllers Don't Belong on the Internet, Says Ex-NSA Chief After Suspected Iran Attacks
The Register, Friday, August 7th, 2026
Retired NSA chief Paul Nakasone urges disconnecting PLCs after suspected Iranian attacks on US water systems.
At least 12 US states' water systems have been compromised in suspected Iranian cyberattacks targeting programmable logic controllers that monitor sensor data and control pumps.
Retired General Paul Nakasone, former NSA chief, said these PLCs should not be connected to the internet and called for higher standards in critical infrastructure defense.
US water infrastructure presents a massive attack surface across 50,000 municipalities, most underfunded with limited IT staff and no dedicated cybersecurity personnel.
Researchers suspect Iranian involvement based on historical targeting patterns, though no official attribution has been made. Nakasone advocates collaborative defense approaches including initiatives like DEF CON Franklin, where volunteers help secure water facilities.