UK security risk, USA News: Hackers working for hostile states like Vladimir Putin’s Russia and Iran could switch off British water and energy supplies in AI-driven cyber attacks, a former security chief of the National Grid has warned. Increasingly sophisticated artificial intelligence tools are now able to direct hackers towards digitally controlled pumps in water stations or gas networks to attempt to interfere with supplies, experts say.
At a US Senate hearing last month, industrial cyber security firm Dragos revealed that an AI agent operating inside a water utility had independently sought out computers controlling water pumps. The agent attempted around 2,800 passwords to access them, all of which failed. There are now fears that similar situations could arise in the UK unless firms take greater steps to prevent them.
Phil Tonkin, field chief technology officer for Dragos, who spent five years overseeing security for the National Grid, told The i Paper that too many firms have yet to put adequate defences in place. The British Government is stepping up its protection of critical national infrastructure (CNI), which includes water pumping stations, power stations and data centres, as well as transport hubs and banks, under the Cyber Security and Resilience Bill currently before the Lords. The bill will put greater responsibility on firms to report cyber attacks, protect their supply chains from potential hostile actors and allows ministers to directly step in to stop hostile states from being involved in supply chains to CNI.
Key Infrastructure Vulnerable to Cyber Attacks
The rapid pace of AI is expanding the abilities of potential attackers to target things like water company pumps or devices that control energy output, Tonkin said. He told The i Paper that while they are not currently seeing AI independently carrying out attacks against critical infrastructure, it is making it easier for attackers to understand operational environments that previously required specialist engineering experience.
“AI can help attackers understand how electricity and water networks are connected, identify exposed systems and determine where disruption could have the greatest impact,” Tonkin said. For UK utilities, the concern is the increasing number of smaller sites and distributed assets connected remotely to support daily operations, particularly where systems managing water pumps or electricity output may be exposed through poorly secured connections.
Advances in technology have made it easier for water pumps and cold storage units to be controlled remotely, but this also leaves them exposed to cyber attack, whether or not AI technology is involved. In October, hundreds of French supermarkets were hit by a cyber attack that caused their fridges and freezers to heat up, causing millions of euros worth of damage from spoilt food. Temperature controls for the cold storage units were linked to a network which was compromised in the cyber attack.
Tonkin said utility and other companies need to identify weaknesses in their systems, particularly when several sites were protected by a single cyber perimeter. Operators need to consider the possibility of a breach and ensure they have appropriate segmentation and monitoring within their operational networks.
New Cyber Security Bill a ‘Sensible Evolution’
Tonkin described the Cyber Security and Resilience Bill as a sensible evolution of the UK’s approach to protecting critical infrastructure, building on existing requirements while recognising the increasing reliance on connected services and technology. However, its effectiveness will depend on how these requirements are funded and implemented across sectors with different levels of cybersecurity maturity.
AI data centres could also be targeted in cyber attacks. Tonkin noted that these environments attract attention from cyber criminals, state actors and activist groups, meaning operators need to understand the risks across their digital and physical operations. Last week, the Government launched its Be Ready campaign, advising the public to stockpile three days’ worth of bottled water, tinned food and other emergency supplies in case of disaster. While extreme weather remains a high priority, cyber attacks on CNI remain an ongoing concern for local continuity.
