President Donald Trump has blamed Minnesota for the recent cyberattacks on its water systems, saying the state was "behind it" and "grossly incompetent". However, US investigators have attributed the attacks to Iran, which has been engaged in a cyber warfare campaign against the United States.
Cyber Experts Push Back Against Trump's Comments
Cybersecurity experts have quickly pushed back against Trump's comments, with Chris Wysopal, co-founder and chief security evangelist of Veracode, saying "Victim blaming in cyber is so 2000 and late" on the Bluesky social media platform. Jake Williams, a member of the IANS faculty, also criticized Trump's comments, stating "His own intelligence services are attributing this to Iran".
Attribution of Cyberattacks
Andy Jabbour, founder and CEO of Gate 15, a cybersecurity firm that provides support to the water sector, said "Attribution is tricky business" and that "random unsubstantiated allegations aimed at political opponents seem reckless and are a disservice to the American people". Jabbour also referenced recent alerts from the Cybersecurity and Infrastructure Security Agency (CISA) and others, which have attributed the recent activity to Iran-aligned threat groups.
CISA has updated an advisory about how Iranian hackers were targeting programmable logic controllers in the water sector and other sectors, a warning that the water industry's information sharing and analysis center said it believed. Tom Dobbins, executive director of WaterISAC, told CyberScoop that "We have evidence of earlier attacks from Iran even before this current conflict. Cyber attacks are the most viable way that Iran can directly attack our homeland, and it is logical that they would do so, especially given the challenges of absolute attribution".
Response from Minnesota Officials
Minnesota Governor Tim Walz struck back at Trump in a Facebook post, noting steps from his Department of Government Efficiency to slash federal funding. Walz said "Trump knows exactly who is responsible for this attack, and knows that other states were hit too" and that "This is what modern warfare looks like, and it further illustrates there's no plan to win a war with Iran".
A spokesperson for Minnesota IT Services, a state agency that has been responding to the water cyberattacks, declined to address Trump's remarks, saying "We remain focused on supporting affected communities, securing critical infrastructure and coordinating with local partners and federal officials as the investigation continues".
Cybersecurity Experts Weigh In
Bryson Bort, CEO and founder of Scythe, said the evidence supports the attribution with Iran, and that it looks like hackers there found something they could exploit on the internet and seized the chance. Cynthia Kaiser, a former top FBI cyber official, said that when the bureau conducts attributions, it looks at technical indicators but also who has the capability, who has conducted similar attacks in the past and what the purpose of the attacks is. Kaiser said "Iran ticks all these kinds of things" and that "My view is, if it walks like a duck, if it talks like a duck, I strongly suspect it's a duck. I'd be shocked if we found out it wasn't Iran".
The water sector is often viewed as one of the most vulnerable critical infrastructure sectors, and Dobbins called on Congress to provide funding to support the ISAC. Trump has previously displayed a laissez-faire view toward other cyberattacks on the United States, such as when he's been asked about Chinese and Russian cyberattacks and Trump shrugs them off as something America does, too.
Source: CyberScoop