3 ms·

Because it was being addressed before the defunding? I mean... clearly not. They haven't been defunded yet. The issue is unlikely to be money, nor is it likely

by 015a 2y ago

Because it was being addressed before the defunding? I mean... clearly not. They haven't been defunded yet. The issue is unlikely to be money, nor is it likely to be technical. If throwing ever-increasing amounts of money at the problem isn't fixing it, maybe it isn't all that crazy to try the opposite.

toomuchtodo 2y ago
Republican lawmakers and the water industry sued the EPA saying it would be too expensive to secure water systems. > In a statement to Recorded Future News, an EPA spokesperson confirmed that the memorandum – handed down in March – was being withdrawn due to lawsuits filed by attorneys general in the States of Missouri, Arkansas, and Iowa as well as industry groups American Water Works Association (AWWA) and National Rural Water Association (NRWA). There is no point in trying to solve what there is no will to solve. Less money, more money, they just don’t want to have to do it or be liable. https://therecord.media/epa-says-litigation-from-republicans-and-water-companies-forced-withdrawal-of-cyber-memo https://therecord.media/epa-says-litigation-from-republicans... https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-biden-administration-over-new-cybersecurity-regulations-for-public-water/ https://www.iowaattorneygeneral.gov/newsroom/attorney-genera... https://content.govdelivery.com/attachments/IACIO/2023/04/18/file_attachments/2470891/Iowa%20Petition%20for%20Review.pdf https://content.govdelivery.com/attachments/IACIO/2023/04/18...
- 015a 2y ago
  That's not how I read that. This statement from the EPA is the crux of it: "Most cybersecurity practices can be implemented at minimal cost."; a statement that anyone involved with software/cybersecurity knows has never been true about any software system, ever. It feels very reasonable to me that some of these dirt-poor counties could look at a new set of cyber requirements and say, we physically cannot pay for this; and while the EPA goes on to list sources of funding they offer, I don't know much about those; its possible that given they've already vastly underestimated the cost of securing an industrial software system, they're also vastly under-provisioning the grant funding available to do it. No one wants their water systems insecure. Republicans aren't a comic book villain; and to help empathize with how they think, right or wrong, consider this: What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). The EPA seems really good at drafting memorandums they have to redact and publishing reports about how insecure our water systems are; Republicans would argue, the money we spent on those things did nothing to help actually fix the problem, so maybe the solution is "less EPA". I'm not saying this is right, and I'm not saying its even representative of a cogent reality. I'm just saying, this is the line of thinking.
  - toomuchtodo 2y ago
    As a cybersecurity practitioner and owner of a mid 7 figures budget to defend an enterprise, I am not unfamiliar with the costs (controls, staff, implementation). But, the evidence is clear that the response was “no” to this effort, and no further action or negotiation to improve the security posture of these entities. I know what it looks like when someone says “we don’t have the funds for this, what can we do with what we have?” but also what it looks like when lack of funding is an excuse to take no further action. Republicans have made no effort to appropriate funding for this work at either the federal or state level, for example. If this matters to them, when can we expect this to happen? And how many people will have to be harmed first for it to happen? > Republicans aren't a comic book villain; Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. But if that’s what you vote for as a voter, who am I to get in your way? This isn’t a problem to be fixed, this is an indicator of electorate intent. > What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). This sounds like a recipe for fraud and waste due to the sophistication of those responsible at the local level, with no accountability.
    - roenxi 2y ago
      > Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. 1) What, Republicans don't need to drink water now? 2) I find it amazing. For decades the small government people have been arguing that centralising power to the national level is a bad idea because it creates a single point of failure. It is a real tell that people are play-acting with their concerns about the Republicans that they currently control all the major organs of the US government AND are led by Trump, but this is not enough to provoke a "gee, maybe centralising all these critical functions is a bad idea" response. The answer is still to concentrate power towards Trump and the Republican party, just to demonise them more vociferously. I mean gee. If there are a group of people who are so terrible at securing clean water, don't give them control over the water systems ~50% of the time. Let it all happen at the local or state level. Is this such a radical position?
Spooky23 2y ago
There has actually been a lot of investment in this area, especially in the last few years. Cyber is seen as a risk and most municipal utilities and auditors are treating it as such. The private companies… not so much unless there’s a clear financial benefit or mandate.

by 015a 2y ago

toomuchtodo 2y ago

Republican lawmakers and the water industry sued the EPA saying it would be too expensive to secure water systems. > In a statement to Recorded Future News, an EPA spokesperson confirmed that the memorandum – handed down in March – was being withdrawn due to lawsuits filed by attorneys general in the States of Missouri, Arkansas, and Iowa as well as industry groups American Water Works Association (AWWA) and National Rural Water Association (NRWA). There is no point in trying to solve what there is no will to solve. Less money, more money, they just don’t want to have to do it or be liable. https://therecord.media/epa-says-litigation-from-republicans-and-water-companies-forced-withdrawal-of-cyber-memo https://therecord.media/epa-says-litigation-from-republicans... https://www.iowaattorneygeneral.gov/newsroom/attorney-general-bird-sues-biden-administration-over-new-cybersecurity-regulations-for-public-water/ https://www.iowaattorneygeneral.gov/newsroom/attorney-genera... https://content.govdelivery.com/attachments/IACIO/2023/04/18/file_attachments/2470891/Iowa%20Petition%20for%20Review.pdf https://content.govdelivery.com/attachments/IACIO/2023/04/18...

015a 2y ago
That's not how I read that. This statement from the EPA is the crux of it: "Most cybersecurity practices can be implemented at minimal cost."; a statement that anyone involved with software/cybersecurity knows has never been true about any software system, ever. It feels very reasonable to me that some of these dirt-poor counties could look at a new set of cyber requirements and say, we physically cannot pay for this; and while the EPA goes on to list sources of funding they offer, I don't know much about those; its possible that given they've already vastly underestimated the cost of securing an industrial software system, they're also vastly under-provisioning the grant funding available to do it. No one wants their water systems insecure. Republicans aren't a comic book villain; and to help empathize with how they think, right or wrong, consider this: What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). The EPA seems really good at drafting memorandums they have to redact and publishing reports about how insecure our water systems are; Republicans would argue, the money we spent on those things did nothing to help actually fix the problem, so maybe the solution is "less EPA". I'm not saying this is right, and I'm not saying its even representative of a cogent reality. I'm just saying, this is the line of thinking.
- toomuchtodo 2y ago
  As a cybersecurity practitioner and owner of a mid 7 figures budget to defend an enterprise, I am not unfamiliar with the costs (controls, staff, implementation). But, the evidence is clear that the response was “no” to this effort, and no further action or negotiation to improve the security posture of these entities. I know what it looks like when someone says “we don’t have the funds for this, what can we do with what we have?” but also what it looks like when lack of funding is an excuse to take no further action. Republicans have made no effort to appropriate funding for this work at either the federal or state level, for example. If this matters to them, when can we expect this to happen? And how many people will have to be harmed first for it to happen? > Republicans aren't a comic book villain; Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. But if that’s what you vote for as a voter, who am I to get in your way? This isn’t a problem to be fixed, this is an indicator of electorate intent. > What if we took a good chunk of the EPA's budget and distributed it to the local water utilities directly (in other words: Your federal taxes go down, your county taxes go up). This sounds like a recipe for fraud and waste due to the sophistication of those responsible at the local level, with no accountability.
  - roenxi 2y ago
    > Agreed, they’re much worse. “We’re going to spend nothing, and when something happens to you, too bad, so sad” under the guise of fiscal responsibility. 1) What, Republicans don't need to drink water now? 2) I find it amazing. For decades the small government people have been arguing that centralising power to the national level is a bad idea because it creates a single point of failure. It is a real tell that people are play-acting with their concerns about the Republicans that they currently control all the major organs of the US government AND are led by Trump, but this is not enough to provoke a "gee, maybe centralising all these critical functions is a bad idea" response. The answer is still to concentrate power towards Trump and the Republican party, just to demonise them more vociferously. I mean gee. If there are a group of people who are so terrible at securing clean water, don't give them control over the water systems ~50% of the time. Let it all happen at the local or state level. Is this such a radical position?

Spooky23 2y ago

There has actually been a lot of investment in this area, especially in the last few years. Cyber is seen as a risk and most municipal utilities and auditors are treating it as such. The private companies… not so much unless there’s a clear financial benefit or mandate.