IC Technology & Cyber — 2026-08-10

Former NSA Director Nakasone Says Water System Controllers Must Be Disconnected From Internet After Iran-Linked Attacks Hit 12 States

BLUFFormal attribution to Iran remains unlikely by November 10, 2026, leaving roughly 50,000 municipal water utilities without a federal mandate to disconnect exposed controllers from the internet.

Paul Nakasone, former NSA director, said at DEF CON that programmable logic controllers running US water systems should not be connected to the internet 12, following suspected Iran-linked cyberattacks that struck water and wastewater facilities in at least 12 states 2. The FBI confirmed it is investigating intrusions targeting operational-technology devices, including PLCs that monitor tank levels and control pumps 2, but neither the FBI nor the Trump administration has formally attributed the attacks to Iran 2. Nakasone said federal officials are taking a measured approach to attribution but noted Iran-linked actors have shown the capability and intent to target such controllers 2; Cynthia Kaiser, SVP at the Halcyon Ransomware Research Center, said she would be shocked if it were not Iran, calling it almost certain 2. He cited roughly 50,000 US water utilities, supplying 90 percent of the nation's water, many without dedicated cybersecurity staff 2.

Analysis
Nakasone's call for utilities to pull PLCs off the internet follows FBI confirmation of intrusions into water-system operational technology across at least 12 states, up from seven at the last alert, though neither the FBI nor the Trump administration has attributed the campaign to Iran. Formal attribution is unlikely as investigators work to rule out a false-flag operation staged to mimic Iranian tradecraft, a genuinely plausible alternative given how chronically unpatched and internet-exposed municipal PLCs are to opportunistic or criminal exploitation. That leaves the roughly 50,000 US water utilities, most lacking dedicated cybersecurity staff, to fund and implement disconnection unevenly on their own, since attribution would be the trigger for sanctions, offensive cyber response, and expedited federal hardening funds now withheld. Confidence is low, resting on a single outlet's account of Nakasone's remarks with no independent FBI or CISA confirmation of attribution status.

2 sources