Senators Adam Schiff (D-Calif.) and Amy Klobuchar (D-Minn.) on Monday introduced the Water Cyber Shield Act, a measure aimed at hardening the nation's drinking water and wastewater systems against cyber intrusions. The bill comes less than a month after a coordinated attack disrupted operations at more than 30 municipal water utilities across Minnesota.
The legislation would channel an additional $300 million annually into the Drinking Water and Clean Water State Revolving Funds, specifically for cybersecurity upgrades. It would also empower the Environmental Protection Agency (EPA) to conduct cybersecurity assessments of water systems and require corrective actions where vulnerabilities are found.
Schiff, the top Democrat on the Senate Environment and Public Works subcommittee overseeing fisheries, water, and wildlife, stressed that the threat is immediate. "Every American depends on safe, reliable drinking water, yet recent events have exposed just how vulnerable our water systems remain to cyberattacks by foreign adversaries and criminal entities. These threats are not hypothetical—they are happening right now," he said in a statement.
The Minnesota incidents, which affected towns including Plymouth, South St. Paul, Maple Plain, and Braham, caused brief automated shutdowns and pressure losses. Some facilities were forced to switch to manual operations, a scenario that underscores the potential for hackers to lock out operators or alter system configurations, leading to a loss of visibility into plant machinery.
Under the bill, the EPA would work with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology to establish baseline cybersecurity standards for drinking water systems. States that demonstrate capacity could assume primary enforcement responsibility for these requirements, a provision designed to accommodate states that want to take the lead.
Klobuchar, who has been vocal about the Minnesota attacks, framed the bill as a direct response to a real-world vulnerability. "The recent cyberattacks on Minnesota have highlighted the urgent need to improve the security of our water systems and critical infrastructure," she said. "Our legislation will direct the EPA to assess water infrastructure cybersecurity and identify vulnerabilities, and help municipal water systems defend against cyber threats."
The proposal also aims to shield ratepayers from absorbing cybersecurity costs, as Schiff noted: "This legislation gives EPA the tools it needs to protect this critical infrastructure while providing the resources that local water and wastewater systems need to strengthen their cybersecurity without passing the cost on to ratepayers."
The bill arrives as Congress grapples with broader oversight of critical infrastructure, a theme that has gained urgency following past failures in legislative oversight. It also taps into ongoing debates about federal versus state roles in cybersecurity, a dynamic that has played out in partisan clashes over regulatory authority.
With water systems increasingly targeted by state-sponsored actors and criminal groups, the measure is likely to become a test case for how far Congress is willing to go in mandating security standards for essential services. The bill's sponsors are betting that bipartisan concern over cyber threats will outweigh resistance to new EPA mandates.
