PARK RIDGE, N.J.—Standing just off the firehouse on Wednesday with one of Park Ridge’s massive municipal water tanks behind him, Rep. Josh Gottheimer pointed to the borough’s water system as both essential infrastructure and an example of what communities increasingly must protect from cyberattack.
Gottheimer, joined Aug. 12 by state, county and local officials, announced what he called his bipartisan Critical Infrastructure Security Plan, a package of proposed federal actions following recent cyberattacks on municipal water systems in New Jersey and elsewhere around the country.
“Every morning, folks in this town wake up, turn on the faucet, and clean water comes out. You flip a switch and your lights come on. Nobody thinks twice about it. Nobody should have to,” Gottheimer said. “I’m standing here because in towns just like this one, all over the country, that deal we have with our utility companies has been put in real jeopardy, and if we don’t get out ahead of it, it could mean a disaster.”
Gottheimer said Park Ridge’s water controls operate offline on a closed system (also serving Woodcliff Lake), making them less vulnerable to the type of intrusion involved in the recent attacks, and credited the borough with upgrading its systems over the past year.
“Park Ridge’s systems weren’t hit in this attack,” he said. “But, in a rare move, the town hasn’t waited around to get lucky.”
Gottheimer said attacks over the past two weeks targeted water systems in New Jersey and at least a dozen other states. He cited incidents affecting municipal systems in Cape May and Woodbine, where operators had to manually operate valves and pumps after digital controls were compromised.
The FBI is investigating incidents in several states, Gottheimer said, and the Cybersecurity and Infrastructure Security Agency, Environmental Protection Agency and FBI have issued a joint advisory urging water utilities to secure vulnerable systems.
He said investigators have pointed to Iranian-affiliated actors while also examining whether other adversaries may be using similar methods.
Gottheimer said smaller municipal utilities are particularly vulnerable because many operate with limited staffing and cybersecurity resources and rely on older equipment and software.
“There are roughly 150,000 public water systems in this country, and 97 percent of them serve small and mid-sized communities, just like here in Park Ridge,” he said.
He said New Jersey has more than 600 community water systems serving approximately 87 percent of the state’s population.
Gottheimer announced two bipartisan bills and a letter seeking additional federal action.
The proposed AI Cyber Defense Act, which Gottheimer said he is introducing with Reps. Don Bacon of Nebraska, Zach Nunn of Iowa, Hilary Scholten of Michigan and Greg Landsman of Ohio, would provide critical-infrastructure operators access to advanced artificial-intelligence tools intended to help identify and address cybersecurity vulnerabilities.
“This is about getting our defense to catch up to their offense, and making it free for the towns that need it most,” Gottheimer said.
He said the legislation would help smaller water and electric utilities obtain cybersecurity tools that otherwise may be beyond their budgets.
A second measure, the Securing Our Critical Infrastructure Act, would create a dedicated rapid-response and threat-notification service within CISA for small and midsize water and electric utilities.
Gottheimer said the service would establish a clear federal point of contact for utilities facing an active cyber threat or suspected intrusion. “Right now, if you’re a small town utility and something looks wrong on your network, you might not have anyone to call, or you might not even know who to call in the first place.”
Gottheimer also said he is sending a letter to CISA, the EPA and FBI calling for additional incident-response teams and technical assistance for water and wastewater utilities affected by the recent attacks. He calls for water- and electric-system-specific cybersecurity guidance and a standing rapid-response framework.
“My cybersecurity package works together to protect our towns and families,” Gottheimer said. “The legislation gives our utilities the tools to find their own weaknesses before an adversary does. The rapid response service makes sure small towns aren’t fighting this alone.”
He also called on the Senate to pass the PILLAR Act, which would reauthorize the State and Local Cybersecurity Grant Program through 2033, and cited other federal legislation aimed at improving cybersecurity for rural electric cooperatives, municipal utilities and the grid.
Gottheimer said the threat extends beyond water and power systems, pointing to a 2023 ransomware attack that forced Hackensack Meridian Mountainside Medical Center and Hackensack Meridian Pascack Valley Medical Center to divert ambulances and reschedule elective procedures. “When I say critical infrastructure, I’m not just talking about water or energy systems,” he said.
Joining Gottheimer were New Jersey Cybersecurity and Communications Integration Cell Director Michael Geraghty, Bergen County Prosecutor Mark Musella, Bergen County Chief of Detectives Jeff Angermeyer, state Sen. Holly Schepisi (who also is borough rate counsel, through O’Toole Scrivo LLC), Park Ridge Mayor Keith Misciagna, Councilman Will Fenwick, and Councilman Bruce Goldsmith.
Gottheimer said municipalities and utilities should continue updating and patching systems, strengthening authentication and access controls, testing their networks and training employees, while acknowledging that smaller operators often need federal assistance to do so.
“Keeping the water running and the lights on isn’t a Democratic issue or a Republican issue,” he said. “It’s the most basic American obligation we have to the people we serve.”
Geraghty told reporters at the media event, “What they [the hackers targeting municipal systems in Cape May and Woodbine] were able to do is disable the monitoring and management systems they relied on to measure tank levels, pressure, and all those other things.”
He said water operations and safety in targeted municipalities were not affected. “The water operators there caught it immediately and responded immediately to start using manual systems.”