The Growing Threat to U.S. Water and Critical Infrastructure
State and local governments across America are increasingly targeted by sophisticated cyber threat actors backed by foreign nations. These entities manage essential services including water treatment, sewage systems, hospitals, and schools — yet often operate with cybersecurity budgets too small to defend against state-sponsored attacks. The vulnerability of this critical infrastructure was highlighted in August when the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint advisory about an "active threat" targeting Siemens S7 series programmable logic controllers (PLCs). These industrial devices are widely used to monitor sensors and control equipment like valves, motors, and pumps in water treatment plants, power facilities, and manufacturing sites.
This threat is not theoretical. In 2024, Russian-affiliated hackers exploited a similar vulnerability to breach the water system of a small Texas town. The attack caused the town’s water tank to overflow, demonstrating how cyber intrusions can directly disrupt physical infrastructure. Notably, the town’s entire annual revenue in 2023 was just $3.37 million, with no dedicated funding allocated for cybersecurity defenses. Officials described the incident as a "trial run" that provided valuable intelligence to the attackers about detection timing and response capabilities.
Local Governments Lack Resources for Basic Cybersecurity
Many state and local agencies simply do not have the financial or technical capacity to implement robust cybersecurity measures. A growing number of state chief information security officers reported flat or reduced cybersecurity budgets for 2026. At the municipal level, the situation is often more dire: a single IT operator may be responsible for managing asset inventory, software patching, and incident response across an entire utility or water system.
Research from the Center for Internet Security in 2024 underscores the scope of the problem. After surveying thousands of local agencies, researchers found that approximately one-third were conducting minimal to no cybersecurity activities. In Minnesota, several communities — including Braham, Plymouth, South St. Paul, and Maple Plain — were identified as targets of cyber intrusions. Braham, in particular, faces a stark imbalance: the city identified $22.98 million in needed water infrastructure upgrades, yet its annual city budget totals only $2.2 million.
Although a state bond appropriation provided $10.22 million for Braham’s water system — funding a wastewater treatment plant upgrade, water main replacement, and well replacement — none of these funds could be used for cybersecurity. The money was explicitly restricted to physical infrastructure improvements, leaving critical digital defenses unfunded. As a result, the city lacked basic protections such as security software, network monitoring tools, or dedicated cybersecurity personnel when it was later discovered to be among many municipalities targeted by actors allegedly linked to Iran.
Tax Policy as a Practical Solution
Given the financial constraints faced by state and local governments, expecting them to organically grow their cybersecurity budgets to adequate levels is unrealistic. Instead, the article argues that the federal government can leverage existing tax policy to accelerate cybersecurity adoption. Specifically, it calls for clarifying that current tax code already supports the expensing of cybersecurity software and hardware purchases.
One proposed mechanism is applying bonus depreciation under the One Big Beautiful Bill to cover cybersecurity investments. The article also recommends classifying digital infrastructure as eligible for full expensing, similar to physical capital investments. Additionally, it seeks clarification on whether cybersecurity software implementation could qualify under Section 174A of the tax code, which covers research and experimental expenditures. An affirmative interpretation would allow businesses and infrastructure operators — especially those in rural or underserved areas — to access private-sector cybersecurity solutions through tax-advantaged investments.
Senator Tom Cotton has already advocated for this approach, sending a letter to Treasury Secretary Scott Bessent requesting formal clarification on how tax law could support cybersecurity investment in critical infrastructure. The article notes that while deploying new cybersecurity tools presents challenges — such as incomplete asset inventories and the need for bespoke software due to legacy equipment — iterative development and pilot programs could become feasible if tax incentives reduce upfront costs.
Broader Benefits of Tax-Driven Cybersecurity Investment
The advantages of using tax policy to drive cybersecurity adoption extend beyond immediate threat mitigation. Clear tax incentives would encourage private sector investment in cybersecurity solutions, expanding the market and lowering costs through economies of scale. This is particularly urgent given that adversaries are now using artificial intelligence to enhance the speed and precision of attacks on critical infrastructure.
By enabling state and local governments, water utilities, and other essential service providers to affordably acquire cybersecurity software, hardware, and expertise, federal tax policy could transform a growing vulnerability into a manageable risk. The article concludes that the current administration must act swiftly to provide this support, ensuring that American critical infrastructure is not compromised by increasingly sophisticated and well-resourced malicious actors.
Source: CyberScoop