In November 2023, hackers with ties to the Iranian government hacked into the Municipal Water Authority of Aliquippa in Pennsylvania.
The breach demonstrated how vulnerable medium to small municipalities water systems are to hacking.
Now, one group of “white-hat” hackers is volunteering to help protect those systems.
“We’ve seen both the urgency of the threat and the potential of a community-driven solution,” said Jake Braun, co-founder of the DEF CON hacker convention of security experts and Executive Director at the University of Chicago’s Cyber Policy Initiative, first told ABC News.
“This next phase brings together top minds from DEF CON, academia, industry, and philanthropy to provide support in ways that are designed specifically for the unique realities of the water sector.”
Experts say that an attack on a water utility facility could have devastating consequences, from shutting off access to water to creating a chemical imbalance in the water and potentially poisoning people.
The goal is to provide “hacker-volunteers” to water utilities in an effort to shore up their cybersecurity systems. The volunteers are ethical hackers who help run through vulnerabilities in an effort to strengthen the cybersecurity system.
“This isn’t just about protecting networks,” Braun said. “It’s about protecting drinking water, public health, and national resilience.”
Franklin, which is providing the manpower behind the operation is partnering with the National Rural Water Association (NRWA), Cyber Resilience Corps, Aspen Digital, the American Water Works Association, and UnDisruptable27
“When people think of cyberattacks, they picture big cities and major infrastructure. But the truth is, the water system in a town like Rensselaer, Indiana is just as vulnerable — and often far less protected,” Matt Holmes, the CEO of the National Rural Water Association said. “That’s why this partnership matters. DEF CON Franklin is bringing world-class cybersecurity expertise to the communities that need it most. For the little guys, this isn’t just innovation — it’s survival.”
The program has already deployed teams in Indiana, Oregon, Utah, and Vermont, offering no-cost support on network mapping, password protocols, and OT assessments.
The announcement was made at DEF CON 2025 in Las Vegas and the group says more deployments are coming in the future. DEF CON is an annual conference hosted in Las Vegas which brings together cybersecurity professionals from around the world to collaborate on ideas about the profession.
