Hackers working for hostile states like Vladimir Putin’s Russia and Iran could switch off British water and energy supplies in AI-driven cyber attacks, a former security chief of the National Grid has warned.
Increasingly sophisticated artificial intelligence tools are now able to direct hackers towards digitally controlled pumps in water stations or gas networks to attempt to interfere with supplies, experts say.
At a US Senate hearing on last month, industrial cyber security firm Dragos revealed that an AI agent operating inside a water utility had independently sought out computers controlling water pumps. The agent had attempted around 2,800 passwords to access them, all of which failed.
There are now fears that similar situations could arise in the UK unless firms take greater steps to prevent them.
Phil Tonkin, field chief technology officer for Dragos, who spent five years overseeing security for the National Grid, told The i Paper that too many firms have yet to put adequate defences in place.
The British Government is stepping up its protection of critical national infrastructure (CNI), which includes water pumping stations, power stations and data centres, as well as transport hubs and banks, under the Cyber Security and Resilience Bill currently before the Lords.
The bill will put greater responsibility on firms to report cyber attacks, protect their supply chains from potential hostile actors and allows ministers to directly step in to stop hostile states from being involved in supply chains to CNI.
Key infrastructure vulnerable to cyber attacks
The rapid pace of AI is expanding the abilities of potential attackers to target things like water company pumps or devices that control energy output, Tonkin said.
He told The i Paper: “We are not currently seeing AI independently carrying out attacks against critical infrastructure, but it is making it easier for attackers to understand operational environments that previously required specialist engineering experience.
“AI can help attackers understand how electricity and water networks are connected, identify exposed systems and determine where disruption could have the greatest impact.
“For UK utilities, the concern is the increasing number of smaller sites and distributed assets connected remotely to support daily operations, particularly where systems managing water pumps or electricity output may be exposed through poorly secured connections.”
Advances in technology have made it easier for water pumps and cold storage units to be controlled remotely. But this also leaves them exposed to cyber attack, whether or not AI technology is involved.
In October, hundreds of French supermarkets were hit by a cyber attack that caused their fridges and freezers to heat up, causing millions of euros worth of damage from spoilt food.
Temperature controls for the cold storage units were linked to a network which was compromised in the cyber attack.
He added: “In many cases the controls needed to reduce these risks are already well understood, and organisations need to ensure they are applying them consistently across both their IT and operational environments.
“As more systems become connected remotely, relying on a single perimeter to protect an entire network becomes increasingly difficult to maintain.
“Operators need to consider the possibility of a breach and ensure they have appropriate segmentation and monitoring within their operational networks.”
New cyber security bill a ‘sensible evolution’
Tonkin described the Cyber Security and Resilience Bill as a “sensible evolution of the UK’s approach to protecting critical infrastructure, building on existing requirements while recognising the increasing reliance on connected services and technology”.
He said: “The UK has been able to develop this legislation without the pressure of an external deadline, allowing it to move towards a more risk-based approach. The inclusion of the wider supply chain, including digital service providers and data centres, is particularly important given their role in supporting essential services.
“However, its effectiveness will depend on how these requirements are funded and implemented across sectors with different levels of cybersecurity maturity.”
AI data centres – which are used to handle the vast amounts of data produced by AI tasks – could also be targeted in cyber attacks.
Tonkin said: “These environments attract attention from cyber criminals, state actors and activist groups, meaning operators need to understand the risks across their digital and physical operations.
“Many leading operators are already incorporating security into the design of new facilities, although the speed and complexity of current expansion means security measures and regulatory requirements need to keep pace with development.”
Last week, the Government launched its Be Ready campaign, which advises the public to stockpile three days’ worth of bottled water, tinned food and other emergency supplies in case of disaster.
While flooding and other extreme weather events are high on the list of risks people might need to stockpile for, there are also concerns that cyber attacks on CNI such as a water pumping station or gas facility would leave local areas without power and energy sources.
Tonkin added: “People are right to expect that the essential services they depend on are protected, but the growing awareness of cyber threats should not create unnecessary concern.
“The UK electricity sector has invested in cyber security for many years, and operators increasingly recognise the importance of maintaining essential services even when individual systems are compromised.
“Government campaigns such as Be Ready have an important role in encouraging the public to prepare for potential disruption, whether that comes from storms, flooding, technical failures or cyber incidents.”