America’s water systems are under attack. We are not ready.
Follow this author to personalize your feed and get instant alerts.
关注该作者来个性化您的提要并获得即时提醒。
Follow this author to personalize your feed and get instant alerts.
关注该作者来个性化您的提要并获得即时提醒。
In late July, the Federal Bureau of Investigation received reports of cyberattacks on water facilities from utility companies in at least seven states in the United States.
7月下旬，联邦调查局收到来自美国至少七个州的公用事业公司对供水设施进行网络攻击的报告。
One of those attacks, in Braham, Minnesota, a city of around 1,800 people, affected the functioning of a pump at a water treatment plant and threatened the water supply.
其中一次袭击发生在明尼苏达州布拉汉姆市，这座城市约有 1,800 名人口，影响了水处理厂水泵的运行，并威胁到供水。
Public works crews in the city quickly and impressively isolated the system, restored a backup, and had the water plant back up and running in around 90 minutes, according to Nate George , the mayor of Braham.
布拉汉姆市长内特·乔治 (Nate George) 表示，该市的公共工程人员迅速而令人印象深刻地隔离了系统，恢复了备份，并在大约 90 分钟内使水厂恢复正常运行。
While this ad hoc response worked this time, much more is needed to make America truly resilient to hybrid attacks by malicious actors on the critical infrastructure that Americans depend on every day for water, power, healthcare, and financial transactions.
虽然这次临时应对措施奏效了，但要让美国真正抵御恶意行为者对美国人每天赖以进行水、电力、医疗和金融交易的关键基础设施的混合攻击，还需要做更多的工作。
In April, the U.S. Cybersecurity and Infrastructure Security Agency issued a warning saying that Iranian-backed groups are targeting America’s critical infrastructure, including water systems.
今年四月，美国网络安全和基础设施安全局发出警告称，伊朗支持的组织正在瞄准美国的关键基础设施，包括供水系统。
More capable adversaries of America, China and Russia , are also actively targeting critical infrastructure in the United States, according to U.S. officials.
据美国官员称，美国、中国和俄罗斯等更有能力的对手也在积极瞄准美国的关键基础设施。
President Donald Trump said he does not believe that Iran is behind these most recent cyberattacks.
唐纳德·特朗普总统表示，他不认为伊朗是最近这些网络攻击的幕后黑手。
Unnamed U.S. officials reportedly believe that Iran-backed groups are the likely culprits but also caution that the findings are preliminary and that there is a chance that the attackers may be impersonating Iran to stoke tensions.
据报道，未透露姓名的美国官员认为，伊朗支持的组织可能是罪魁祸首，但他们也警告说，调查结果只是初步的，袭击者有可能冒充伊朗来加剧紧张局势。
Meanwhile.
同时。
the Trump Administration has been gutting U.S. cybersecurity capabilities, cutting roughly a third of the federal cyber agency’s workforce at exactly the moment small utilities need it most.
特朗普政府一直在削弱美国的网络安全能力，在小型公用事业公司最需要的时候削减了联邦网络机构大约三分之一的劳动力。
A new approach is needed.
需要一种新的方法。
Washington needs a whole-of-society, resilience-based approach to deter and defend against these increasing hybrid threats to the American homeland.
华盛顿需要采取全社会、基于复原力的方法来阻止和防御这些对美国本土日益增长的混合威胁。
Washington can learn a lot from its European allies.
华盛顿可以从其欧洲盟友那里学到很多东西。
Europe has spent decades hardening its systems through a whole-of-society effort it calls “ total defense .” Finland and Estonia are especially instructive examples.
欧洲花费了数十年的时间，通过全社会的努力强化其系统，称之为“全面防御”。芬兰和爱沙尼亚是特别有启发性的例子。
Finland runs a national supply agency that holds reserves of fuel, grain, and medicine and rehearses shortages alongside the private companies that would actually have to manage them.
芬兰设有一个国家供应机构，负责储备燃料、粮食和药品，并与实际需要管理这些物资的私营公司一起应对短缺情况。
Estonia fields a volunteer cyber unit within its Defense League, a militia under the command of its defense ministry .
爱沙尼亚在其国防联盟内部署了一支志愿网络部队，这是一支由其国防部指挥的民兵组织。
The volunteers are civilians with day jobs who train with the state and show up when attackers strike.
这些志愿者都是从事日常工作的平民，他们与国家一起接受培训，并在袭击者发动袭击时出现。
They run exercise programs built around cyber resilience, information sharing, and public-private partnerships.
他们围绕网络弹性、信息共享和公私合作伙伴关系开展演习计划。
So what does Washington need to do to harden America’s water systems and other critical infrastructure?
那么华盛顿需要采取哪些措施来强化美国的供水系统和其他关键基础设施呢？
First, America needs to broadly embrace a whole-of-society “total defense” approach to homeland security, adopting and adapting innovative ideas from partners and allies.
首先，美国需要广泛采用全社会的“全面防御”方法来实现国土安全，采纳和适应合作伙伴和盟友的创新理念。
More specifically, policymakers can take three specific steps now that will help prepare for, and perhaps deter, the next attack.
更具体地说，政策制定者现在可以采取三个具体步骤，这将有助于为下一次袭击做好准备，或许还可以阻止下一次袭击。
First, they should renew the State and Local Cybersecurity Grant Program, a small grants program for states that helps build state and local level cyber defenses.
首先，他们应该更新州和地方网络安全拨款计划，这是一项针对各州的小额拨款计划，旨在帮助建立州和地方级别的网络防御。
The program has already lapsed once and now runs on year-to-year extensions, which is no way to fund a defense.
该计划已经失效一次，现在逐年延期，这无法为辩护提供资金。
Make it permanent and carve out a sizable share for water.
使其永久化并为水分配相当大的份额。
Second, Washington should set a response floor for water municipalities and measure it in hours.
其次，华盛顿应该为水务城市设定一个响应下限，并以小时为单位进行衡量。
Electric utilities operate under binding federal cyber standards backed by real financial penalties.
电力公司按照具有约束力的联邦网络标准运营，并受到实际的经济处罚。
Water utilities have no equivalent, and the Environmental Protection Agency currently has no authority to impose one.
自来水公司没有相应的规定，环境保护局目前无权强制实施。
Congress should give it a narrow version: every system above a modest size must be able to run manually for 72 hours and must prove it in an annual drill.
国会应该给它一个狭窄的版本：每个中等规模以上的系统都必须能够手动运行 72 小时，并且必须在年度演习中证明这一点。
This is not a technology mandate; it is a time standard, and it is the only number that matters once the pumps stop.
这不是一项技术强制要求；而是一项强制要求。它是一个时间标准，也是泵停止后唯一重要的数字。
Braham did it in 90 minutes.
布拉汉姆只用了 90 分钟就完成了。
That should be the benchmark.
这应该是基准。
Finally, the U.S. needs to build the bench.
最后，美国需要建立替补席。
There are roughly 50,000 small water systems in this country, and most have no dedicated IT staff at all.
该国大约有 50,000 个小型供水系统，其中大多数根本没有专门的 IT 人员。
No grant program can hire its way out of that.
没有任何资助计划可以通过雇佣来解决这个问题。
Governors can act tomorrow with authorities they already have: cyber teams in the National Guard on standing state active duty orders, tied to a water mutual aid compact modeled on the one power companies use to restore each other’s lines after hurricanes.
州长们明天就可以利用他们已有的权力采取行动：国民警卫队的网络团队执行国家现役命令，与水互助契约挂钩，该契约仿照电力公司在飓风过后用来恢复彼此线路的协议。
When a plant serving 1,800 people gets hit at two in the morning, somebody should already have the phone number.
当一家为 1,800 人提供服务的工厂在凌晨两点遭到袭击时，应该已经有人知道电话号码了。
A country that can afford 11 aircraft carriers can afford to teach 50,000 water operators to turn a valve by hand.
一个有能力建造 11 艘航空母舰的国家就有能力教授 50,000 名水务操作员手动转动阀门。
Resilience is not a consolation prize for failed deterrence.
韧性并不是威慑失败的安慰奖。
By forcing an adversary to think twice about whether an operation will succeed, resilience is deterrence.
通过迫使对手三思而行，行动是否会成功，韧性就是威慑。
The original version of this story included a photo of a treatment plant that was not mentioned in this article.
这个故事的原始版本包含一张本文未提及的处理厂的照片。
It has been replaced.
它已被替换。