Buy America Build America creates valuable U.S. jobs and strengthens domestic manufacturing, but the policy also has knock-on benefits well beyond economic stimulus.
“Accessible and reliable water and wastewater services are essential to protect public health and provide fundamental services to our constituents. These services can also be a foundational basis for a strong economy and a strong America.”
That’s what Chair Shelley Moore Capito (R-W. Va) said in her opening statement during the U.S. Senate Committee on Environment and Public Works hearing she chaired last month. And she’s not wrong: Reliable water and wastewater services are as close to a definitive public necessity as you’re likely to get. And their importance explains why they’re persistently the target of foreign cyberattacks; it was, in fact, the subject of the hearing.
Capito and others on the committee, including ranking member Sen. Sheldon Whitehouse (D-R.I.), made note of that persistence, and witnesses urged lawmakers to fund any mandates for cybersecurity improvements. One witness, Scott Dewhirst of Fairfax Water in Virginia, pointed out that while Congress has authorized programs that extend grants for cybersecurity enhancements, they aren’t well-funded. And it’s all optional, he said.
“While guidance and tools provided by [the Environmental Protection Agency] and [the Cybersecurity and Infrastructure Security Agency] are valuable, there are currently no statutory federal cybersecurity requirements for water systems, making these best practices optional and leaving less resourced utilities wholly unprepared for a cyber incident,” Dewhirst said.
So what works in its place?
Improved cybersecurity may be a knock-on effect of domestic procurement preferences – better known as Buy America rules. That was the observation made in another hearing a few weeks later in a House Energy & Commerce subcommittee hearing that examined challenges facing public water utilities. It’s not easy to run such a service with limited funds, (important) regulatory requirements, and the real threat of cyberattacks.
About halfway through the hearing, Subcommittee Chairman Rep. Gary Palmer (R-Ala.) raised the question directly to Eric Hill, the general manager of the Russellville Water & Sewer Board in Russellville, Ala. Hill was appearing before the committee on behalf of the National Rural Water Association.
“On the issue of cybersecurity risk, do you think the Build America Buy America (BABA) requirements are an appropriate mechanism to ensure the critical components are sourced from American companies, not from adversaries like China? That’s part of my concern is: them embedding the ability to interfere with their water systems,” asked Palmer. “Is that a concern for the rural systems?”
Hill responded:
“It was a big concern for us. We had a telemetry system, which could be intercepted, and it was a proprietary system. So we reached out with our [technical assistance] providers from Alabama World Water Association, and we got on the same page with them. And we bid the project out with SRF funds, and we switched over with those SRF funds and installed a [supervisory control and data acquisition system]. It has the VPN. It is encrypted. It is BABA compliant. And that was our biggest concerns with something like that.”
The idea that Palmer was getting at – and that Hill confirmed in his answer – is that procuring electronic equipment from domestic sources limits cybersecurity threats. It’s the same reason there’s a rule banning Chinese software in connected automobiles: The software itself is the vector for an attack, and imported software is less secure than that developed outside of the purview of U.S. law and regulation.
Buy America has many more obvious and direct benefits to it. By giving American manufacturers the first shot at federally backed infrastructure projects, U.S. workers benefit from public spending. However, improved cybersecurity in our public water systems is an unquestionably positive and important knock-on effect.
Watch the full House Energy & Commerce hearing below.