A successful attack is much less likely to be made public, for obvious reasons. We may have suffered from successful attacks and not know it (small enough concentrations of contaminants can’t be tasted)
Install water filters, HN. Use them. We have AquaSana under-the-sink in several locations through the house... no pitchers. Whole-house filters do not filter nearly the same variety of crap that under-the-sink and PUR pitchers do. Say no to Brita. Learn your NSF ratings and choose wisely.
You’re only paranoid if you’re wrong.
Most US tapwater is fantastically clean and drinkable, and doesn't generally need a filter. The Safe Drinking Water Act is pretty powerful stuff.
https://www.cdc.gov/healthywater/drinking/public/regulations...
I use one of those under-the-sink inline charcoal cartridge filters on the sink we use to make tea or cook with. If I grab some water from a different tap, you can tell immediately by the smell (chlorine) and the taste.
I'm surprised the filter takes out the chlorine honestly, but it's clearly taking out a bunch of stuff from what is otherwise considered very clean.
That said, having travelled extensively through places like India, South America, East Asia, etc., I'm certainly grateful for the water we have "on tap" in the house. It's easy to take for granted.
EPA mandates a floor of 0.2 mg/L chlorine for all Surface Water based drinking water supplies at all times[0]. There are additional chlorine requirements depending on what sort of filtration you perform, if any, and how far the first service connection is from the chlorine insertion, in minutes. (They also mandate a safety ceiling of 4 mg/L for all drinking water.) This level is continuously monitored.
Seattle does about 1 mg/L to meet these EPA-imposed requirements.[1]
Chlorine evaporates out of water, so if you don't like the taste, you can just let tap water sit a while. Sunlight helps. Boiling water (e.g., for tea) also removes most of the chlorine.
[0]: (PDF) https://www.epa.gov/dwreginfo/swtr-plain-english-guide
[1]: (PDF, p. 8) https://www.seattle.gov/Documents/Departments/SPU/Services/W...
They get filtered, but there is no chlorine directly. Some chlorine dioxide is used at the end, though. Here's the official description of the utility, translated to english:
- Via a raw water pumping station, the dam water first reaches the micro-screening plant. It removes coarse contaminants over 35 ~ µm in diameter through stainless steel mesh filters. This provides special safety in times of mass algae growth or during floods.
- Subsequently, the raw water is de-stabilized with a flocculant; and turbid matter accumulates to form large flocs.
- In filter stage 1, two filter materials of different coarseness are used to remove the flocs.
- Ozone is then added to disinfect the raw water.
- Filter stage 2 is equipped with activated carbon and frees the raw water from the reaction products of ozonation. Excess ozone reacts to form oxygen and is thus removed from the raw water.
- The further filter stage 3 uses natural limestone material over which the water flows. Here the excess carbonic acid in the water is removed. Finally, a small protective disinfection with chlorine dioxide takes place before the drinking water leaves the clean water tank in the direction of <city>.
- Ozone disinfection, and removal
- Tolt river supply only: water conditioning by filtering through "granular media." (Cedar river supply is clear enough without this step.)
- UV disinfection
- pH adjustment to avoid corroding pipes
- Flouridation for public health
- Chlorination as a final step as water leaves the treatment plant, and also at some downstream facilities (like a networking repeater; just to maintain chlorine levels that would otherwise have fallen due to distance from the upstream chlorination site)
Tolt: http://www.seattle.gov/utilities/your-services/water/water-s...
Cedar: http://www.seattle.gov/utilities/your-services/water/water-s...
> You might hear about different forms of chlorine. Seattle's water system uses "free chlorine" (not chloramines).
http://www.seattle.gov/utilities/your-services/water/water-s...
It is my understanding that most municipal water utilities only test water quality every 3 months. A problem can come and go between testing cycles.
Even with weekly testing, I’d expect the same risk (there’s still a window between tests). Basically you’re only going to know about a problem when it’s too late.
It depends on what contaminant you are measuring, but the testing frequency can vary from "every several years" to "continuously monitored and sets off a SCADA alarm if it exceeds a given threshold." The biggies--IIRC, turbidity, pH, and dosages of coagulant and treatment chemicals--are logged every 15 minutes, with more tests happening on hourly 6-hourly, and daily frequencies, followed by yet more contaminants happening largely on monthly or quarterly assessment bases. The issue in question would have shown up in a pH measurement, so there's no reason it shouldn't have been caught within minutes.
Indeed, you'll see that if a water test comes back positive, there will be multiple retests and a much greater rate of testing until the problem is abated, at least at my local drinking water board.
This isn't remotely true.
E.g., Seattle explicitly states:
> We monitor your water 24 hours a day, 365 days a year. We test samples from the region between 10 and 100 times per day.
https://www.seattle.gov/Documents/Departments/SPU/Services/W... (PDF)
> To ensure the safety of our drinking water, SPU's water quality laboratory analyzes over 20,000 microbiological samples each year (more than 50 a day) and conducts chemical and physical monitoring daily, 365 days per year.
https://www.seattle.gov/utilities/your-services/water/water-...
Yes - they should. Because there is going to be a lot more of this happening in the not so distant future.
While you can definitely make a respectable living in the cybersecurity industry the fact of the matter is that over that same time period the people vomiting JavaScript trackers all over the internet made the same or more money with less effort invested.
Sure, go into security, help make the world more secure... meanwhile I’ll be here writing some JavaScript making twice what you make and working probably half the hours you do.
Wait till we get our M2 Browning.
Perhaps a change in KPI or regulation requirements may create such incentive to ensure appropriate actions are taken.
Because this is most likely "teenager broke into a poorly secured shack and turned a random valve to be naughty", not "state actor sabotaged critical infrastructure".
(Still, the problem remains: if a naughty teenager can turn a valve for shits and cause a threat to public health, then perhaps that valve needs some access control.)
This isn't downplaying the potential risk, basically every other thing said highlighted the risk.
This is if you take the facts in this story at face value. In my mind, if someone can raise the level of a chemical to become dangerous, you already have a problem. 11000 ppm sounds huge to me (1.1%). What if instead of an external hacker you had an internal disgruntled employee. What if you had a leaky gasket. The system should have some multiple redundancies to not allow a dangerous level of a chemical to end up in the water supply.
(I recognize you also mentioned the difficulty, I just wanted to poke some fun :P)
Sounds like they did a great job fixing it.
https://www.politico.com/news/magazine/2020/12/23/flint-wate...
I think it's surprising it's even going to trial.
That is what a reasonable human would expect "the people" to do when multiple agencies overseeing the utilities were initially so irresponsible/incompetent/negligent that water superheroes from three states over had to swoop in to warn residents their fucking pipes are poisoned[1].
[1] https://en.wikipedia.org/wiki/Flint_water_crisis#Virginia_Te...
Edit: clarification
LOL, copper is poisonous in presence of corrosives. They are just replacing a poison with other.
All pipe materials are poison if enough is ingested, lead is however is toxic in extremely low amounts, while copper is actually needed in low amounts. You think PVC is better?
We, mammals, are relatively well protected to deal with it, but the real problem here is in the long term exposure. Can produce several forms of inner bleeding in the gut, and harm permanently the liver and kidneys. There is a lot of copper messing around for some reason in Alzheimer's patients also.
Moreover copper is particularly toxic for all aquatic life and invertebrates also causing an acute poisoning. I would not use that water in an aquarium for example. I had seen the stuff in action and is devastating for fishes.
[0]https://smile.amazon.com/Seachem-67105650-Cupramine-Copper-1... for example
Sodium hydroxide is a highly caustic base and alkali that decomposes proteins at ordinary ambient temperatures and may cause severe chemical burns. It is highly soluble in water, and readily absorbs moisture and carbon dioxide from the air. https://en.wikipedia.org/wiki/Sodium_hydroxide
The nice thing about lye is that it's typically sold in solid form, excepting in one of the most common household products, drain cleaner. Drano is sodium hydroxide in solution with aluminum, with which reacts in the presence of water, presumably to help mechanically break up clogs. Solid lye tends to be safer as there's less chance of ingestion, and less chance of it lingering on your skin--it turns your skin to soap.
Much more dangerous is stuff like sulphuric acid, which you can buy (at least in California) in concentrations of over 95% at the hardware store as Rooto and similar drain cleaners. That stuff is nasty as its in liquid form, easy to spill and even inhale as an aerosol. Also not a good idea for pipes despite how they're sold because such acids are hell on cast iron--i.e. what main sewage drains are made out of in older buildings and in jurisdictions that aren't favorable to PVC.
There are so many ways for evil people to do evil things it's amazing (and, frankly, fascinating and even instructive) that it doesn't happen more often. I'm curious to see how the situation will change as it becomes easier to be evil while remaining anonymous and remote. Still, I imagine it would be extremely difficult if not impossible to actually cause significant harm by changing the concentration of lye in the water suppler. For example, I'm skeptical that there would be enough lye in the dispenser at the treatment facility to cause serious harm. The worst effect would probably be disrupting the pH of the water system and possibly causing other ill effects, such as by leeching lead or rendering antimicrobials less effective.
Eh, at the end of the day it's just acid. You can always throw something basic at it to neutralize it. It's not like it's a heavy metal.
Here is an article where plant operators accidentaly left a sodium hydroxid pump in manual mode. Dumpibg way too much of it in one go causing chemical burns to the customers. There were Ph alarms but nobody heard them. https://www.google.co.uk/amp/s/www.telegram.com/article/2007...
This is the website of an other water treatment company explaining what processes they have in place to prevent an issue like the above: https://www.mwra.com/01news/2007/042507nosodiumhydroxide.htm
I don’t think it’s a good idea either, but it’s exactly why it happens.
While I said it’s new public management, it’s also a common management style in any form of private sector enterprise.
Our society’s inability to prioritize the solving of obvious problems is pervasive enough that it’s probably due to more than some badly chosen verbiage.
> We'll need to see n=1 disasters with this first, before there's public outcry to fix it.
It’s worse than that. It would have to be a really awful disaster, people would need to understand the causes and effects, and the prevention of future disasters would need to not threaten established businesses and political interests.
I have a problem with the language here. This was absolutely a public threat. The attacker demonstrated intent and capability to inflict public harm. That's the definition of a threat.
But the language downplaying the severity will mean this all blows over in a couple of months, without the actual mobilization/funds to properly secure not just this one site, but any similarly affected plants.
I've come to the conclusion that humans in general aren't very good at preventing catastrophic events we haven't seen before (see climate change). We'll need to see n=1 disasters with this first, before there's public outcry to fix it.