China-Made Cameras May Be Used To Spy On U.S. Infrastructure
In October 2024, America’s largest water utility, American Water, was hit by a cyberattack — an event that underscored the growing vulnerability of U.S. critical infrastructure. For a utility that provides drinking and wastewater services to more than 14 million people, such attacks pose serious risks to public safety.
Cyber threats may not always be top of mind for water and wastewater operators, but they are a growing reality. Recently, the U.S. Department of Homeland Security (DHS) issued an alert highlighting potential threats posed by the People's Republic of China (PRC), specifically a threat to internet-connected cameras.
Just how much could this affect the water industry, though? There could be more at stake than you might think.
For one, if a cyber actor gains access to a camera’s surveillance data, they could map a utility’s layout, aiding in a cyberattack. Furthermore, these cameras could even put a utility at risk to have fail-safe mechanisms disabled. A cyber actor could even suppress alarms to keep operators unaware of any dangerous situations.
According to DHS, “These devices typically lack data encryption and security settings and have default settings to communicate with their manufacturer.” If cameras are PRC-made, these manufacturers could be in China and therefore able to disrupt U.S. critical infrastructure.
As of early 2024, the DHS estimated that there are 12,000 PRC-made internet-connected cameras in use at critical U.S. infrastructure facilities.
While China has managed to work around U.S. regulatory restrictions on its internet-connected cameras by using a tactic called “white labeling,” per CNBC, there are tools which could recognize PRC cameras that may help utilities protect themselves.
The U.S. EPA, in collaboration with CISA, released a fact sheet with mitigation tips for water systems. These tips include inventorying all internet-exposed devices and creating strong usernames and passwords to prevent hackers from easily accessing the devices.
Staying ahead of cyber threats is critical. By staying up to date on cybersecurity best practices, water utilities can play their part in safeguarding the nation’s water infrastructure.