Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
Council approves moving forward with state-funded cybersecurity pilot for city water SCADA
Summary
Wellsville council heard a state-funded cybersecurity briefing from Phil Millett about vulnerabilities in the city's SCADA water-control system and voted to authorize staff to proceed with a pilot funded by the state; the city may incur limited costs only if the local SCADA service provider charges for extra labor.
Phil Millett, a consultant who said the project is state-funded, told the Wellsville City Council that the city’s SCADA (Supervisory Control and Data Acquisition) system — which monitors tank levels and controls pumps — can be a target for actors who could disrupt dosing or stop pumps. “They’ll go in and then take over control of your SCADA,” Millett said, adding that attackers could change dosing or stop systems that keep reservoirs full.
Scott Wells and other council members pressed for details about scope and cost. Millett said the pilot is paid for by the state and that Wellsville would not be asked to cover the program, though he warned the city’s SCADA service provider could bill for any extra on-site work they perform on the city’s behalf. “I won’t be asking for any of your money,” Millett said, and he described requirements the state has set for pilot participants, including annual employee cybersecurity training and a two-hour breach-notification rule to the Utah Cyber Center.
Council members asked how often water systems experience unexplained outages; Millett said outages occur and are sometimes indistinguishable from attacks without validation, which is one rationale for the state’s notification rules. After discussion about timing and potential bills from the city’s SCADA vendor, councilmember (speaker 7) moved that the council approve proceeding with the state-funded cybersecurity option; the motion passed by voice vote.
The council’s action authorizes staff to coordinate with Millett and the state to begin the vulnerability assessment and follow the state’s pilot process; any charges from the city’s SCADA contractor would be billed to the city only after prior authorization, Millett said. The council did not set a separate funding appropriation; Millett repeated that the program itself is funded through the state’s pilot program.
