Division of Drinking Water backs bill requiring rapid reporting of cyber incidents at public water systems

The Division of Drinking Water told the Legislative Water Development Commission on Oct. 14 that draft legislation would require public water systems to report cyber incidents immediately so state and federal cyber response teams can act.

Nathan Lundstedt, director of the Division of Drinking Water, said the draft is a continuation of House Bill 492 from last year and would “require public water systems to report cyber events within 2 hours.” Lundstedt told commissioners the change would notify the state cyber center and simultaneously notify the division so experts can pursue recovery and mitigation measures quickly.

The bill builds on federal planning requirements in the America’s Water Infrastructure Act of 2018, Lundstedt said, which already requires emergency planning that addresses cyber events for systems serving more than 3,300 people. Lundstedt told the panel many Utah systems already include cyber response in their emergency plans; the proposed change adds a short statutory reporting window to get FBI, Homeland Security and the state cyber center engaged faster.

Why it matters: Division staff and commission members said faster reporting increases the chance of recovering stolen funds and limiting damage. Senator Mike Hinkins told the commission that many recent intrusions target billing and financial systems rather than water quality, and he asked Lundstedt to clarify how attacks have affected local utilities. Lundstedt described two incidents in Emery County, including a case he described as an AI-enabled “deep fake” phone call that induced a bank employee to transfer funds.

Several commissioners flagged capacity gaps in rural systems. Representative Kera Albrecht said many smaller towns lack IT resources and suggested funding or training for rural utilities. Lundstedt and other commissioners said the Public Utilities and Energy and Technology Committee previously gave the measure a favorable committee vote.

No formal commission recommendation or vote on the draft was recorded during this meeting. Lundstedt closed by noting the bill is intended to reduce response times and improve outcomes when attacks occur; there were no public comments on the draft during the meeting.

The commission received the briefing as part of its agenda; staff noted cybersecurity awareness month and encouraged coordination between utilities, the state cyber center and federal partners.