Maine DWP Update: Security Advisory

Security Advisory

The Maine CDC Drinking Water Program (DWP) is a member of the Water Information Sharing and Analysis Center (WaterISAC). WaterISAC is an all-threats security information source for the water and wastewater sector. It was established in 2002 in partnership with the U.S. Environmental Protection Agency and authorized by Congress in the Bioterrorism Act.

DWP received a security advisory from WaterISAC on January 12, 2021, and is passing it along for your situational awareness. Please prepare as you feel is necessary for your system. If you have (or may have) experienced an attack, please contact local law enforcement as soon as possible, and your DWP Public Water System Inspector as soon as you are able.

Thank you for all you do 24/7 to provide safe drinking water in Maine. The following is adapted from the WaterISAC Security Advisory.

---

WaterISAC Members:

WaterISAC is aware of social media posts on two platforms calling for violent acts against critical infrastructure assets. These posts have been identified both through WaterISAC’s own research and that of its security partners. WaterISAC is not aware of any known specific or credible threats against water and wastewater systems at this time, but the posts highlight concerns about the potential for domestic extremists to do harm and utilities should remain vigilant.

WaterISAC has been in contact with the FBI and will continue to communicate with the FBI and other security partners as the current situation evolves. WaterISAC advises utilities to be prepared to modify their procedures in the event of an emergency or observed suspicious activity. Staff members should report suspicious activity to local law enforcement and any on-site security staff.

One post on the platform 8kun, available in WaterISAC's Resource Center, advocated for attacks against energy systems and specifically referenced the water sector, stating "They cannot rule us if they do not have electricity running the water, sewage, and communications infrastructure."

Another post, found on Parler, did not mention water systems but stated, "Load your magazines gather your things ... you had better be ready patriots! It is go time very soon. We must attack all central communications to big cities ... Fiber optics telecom bridges supply routes we can starve those [expletive]s to death." While the post also stated the poster would "give it until Monday" (presumably January 11, 2021) and the campaign would begin "after that," WaterISAC is not aware of any incidents reflecting the described method of operation.

The water sector has been identified as a target in past plots against critical infrastructure assets. On January 8, 2021, a report emerged about a former Marine who was charged in September 2020 with lying to the FBI during its investigation of a plot to attack water and energy sector assets. Further, as WaterISAC previously noted in its latest Threat Analysis for the Water and Wastewater Sector, "Recent incidents, messaging, and other activities … have put the spotlight on 'accelerationist' anti-government extremists. These extremists believe that an attack by a single individual or small cell can trigger events like civil wars and social upheavals, leading to the downfall of governments." The term "accelerationist" refers to the adherents' expectations that their actions will hasten the beginning of an anticipated conflict.

Such a strategy was observed in 2014, when the FBI arrested three individuals who were planning to attack critical infrastructure assets, including water utilities, to inspire other private paramilitary groups (colloquially known as "militias") to commit violent acts and attempt to impose "martial law" in the United States. This threat was previously examined in WaterISAC’s Threat Analysis for the Water Sector for January to June 2014.

 

 Physical Security Resources

Utilities can refer to the following resources as they assess or revise their security plans:

   • National Stakeholder Menu of Tactical Options from the United Kingdom’s National Counter Terrorism
     Security Office describes security measures entities can adopt in response to heightened security concerns.

   • Counter-IED Awareness Products from the U.S. Department of Homeland Security (DHS) Office of Bombing
     Prevention provides resources to aid organizations in identifying and preventing potential attacks with
     improvised explosive devices.

   • First Responder’s Toolbox includes Vehicle-Borne Attacks: Tactics and Mitigation and
     Vehicle Borne Improvised Explosive Device (VBIED): Preparedness, Recognition, and Response.
     Both documents are available in WaterISAC’s Resource Center.

   • Protecting against the Threat of Unmanned Aircraft Systems: An Interagency Security Committee Best Practice
     from the DHS Cybersecurity and Infrastructure Security Agency examines potential vulnerabilities unmanned
     aircraft systems (UAS, also known as “drones”) can exploit and describes how organizations can protect their
     facilities from airborne threats.

 

 Potential for Civil Unrest and Extremist/Terrorist Violence in Days and Weeks Ahead

Given the current climate in the country, there is a heightened potential for civil unrest and incidences of significant violence. As WaterISAC previously advised its members, such as during nationwide civil disturbances that occurred over the summer and in the period surrounding the presidential election, water and wastewater utility facilities and personnel could be affected by civil unrest that occurs in their communities, as has happened in previous cases. This could be limited to minor vandalism to buildings and assets. Or it could be more severe, such as if a government office where utility staff are located is targeted, if an employee is affected by an incident as they are out in the community, or if infrastructure is attacked in a type of accelerationist plot previously described.

In addition to encouraging its members to report reports incidents and suspicious activities to local law enforcement and, time-permitting, to WaterISAC, it also reminds its members of the following resources further inform them about these types of threats and help them protect their facilities and personnel from attacks:

   • Protecting Infrastructure During Public Demonstrations (CISA)

   • Violent Extremists and Terrorists Exploit Civil Unrest and Public Assemblies in the United States
     (DHS, NCTC, and FBI – First Responder’s Toolbox)

   • Special Report on Extremist Violence and Tactics during Protests (ST, PT, OTRB ISACs)

   • (U//FOUO) Violent Opportunist Tactics Observed during Civil Disturbances 26-31 May

 

WaterISAC will continue to collaborate with its partners and share additional information as appropriate. Please contact WaterISAC at 866-426-4722 or analyst@waterisac.org with any questions about this advisory.

The WaterISAC Team

---