FLOWS Act would fund cyber upgrades for rural water utilities

A bipartisan bill introduced to Congress last week would help small and rural water utilities adopt modern cybersecurity protections and digital monitoring tools.

The Futureproofing Local Operations for Water Systems, or FLOWS, Act, introduced by Sens. John Boozman, R-Ark., and Mark Kelly, D-Ariz., would create a federal grant program to help rural communities upgrade water, wastewater and stormwater systems with updated industrial control systems and adopt modern technologies like real-time sensing tools, artificial intelligence software and advanced modeling platforms.

The legislation would authorize $50 million annually for Environmental Protection Agency grants, aiding communities with limited resources. The bill would not require a local funding match, a major barrier for small utilities with limited ratepayer bases. It would also allow grants to cover both the purchase and ongoing maintenance of software, to help ensure upgrades remain sustainable.

“Every family deserves safe drinking water. That requires up-to-date, reliable water infrastructure,” Kelly said in a press release. “Right now, rural communities are dealing with aging systems, tight budgets, and growing cyber threats. We’re helping local water providers upgrade their equipment, catch problems before they become costly emergencies, and protect their systems from attacks so families aren’t left footing the bill for breakdowns and disruptions.”

A 2023 report from the nonprofit U.S. Water Alliance found that digital water management technologies can improve reliability, reduce operating costs and help operators monitor system health in real time.

Fred Hintermister, a visiting professor at the University of Albany’s homeland security and cybersecurity college, said many small utilities operate with limited staff and aging equipment, leaving them without the digital tools needed to monitor systems in real time, an especially pressing concern given the increasing level of cybersecurity threats they face.

“One of the very first things to understand about those sectors is that, particularly in rural country, [they’re] likely very fragmented,” Hintermister said in an interview. “Water, wastewater, sewer management and similar systems for public engineering would benefit from federal direct investment through grant funded assistance.”

Without modern sensors or automated controls, operators often cannot detect leaks, equipment failures or pressure problems until after damage has already occurred.

Hintermister said that these operational challenges can worsen during extreme weather, creating cybersecurity risks, as utilities increasingly rely on interconnected digital systems.

“The digital connection and communication between outside networks, including the internet has increased in the control space,” Hintermister said. “As that happens, of course, you offer the opportunity for vulnerabilities in the cyber risk arena that could have real-world physical impacts in cyber, in all hazards and in physical security.”

Hintermister said federal investment into IT upgrades has made great improvements to the resilience of the energy sector, another part of the country’s critical infrastructure, which also uses small electric providers and distributors to provide essential services to communities across the nation.

“It’s been very, very successful line of investment for the nation as a whole,” Hintermister said. “The smaller asset owner operators who are applying for the grants tend to innovate independently in new ways that can be measured, studied and used to elevate practice in critical infrastructure sectors. So a lot of times that systemic resilience benefits quite a bit if we help a large number of lesser resourced asset owner operators.”

The FLOWS Act could help rural utilities deploy similar IT tools, strengthening both operational resilience and cybersecurity across the nation’s water systems.

New York Gov. Kathy Hochul this week announced a $2.5 million grant program aimed at helping her state’s drinking water and wastewater facilities conduct risk assessments and implement upgrades. New York is holding its water treatment facilities to a new, more stringent set of cybersecurity standards, such as limiting users’ access to only systems they need, prohibiting the use of default credentials and requiring complex passwords and multi-factor authentication.