Iran, a Minnesota Water System, and the Theory That the State Hacked Itself

On his blog, Bruce Schneier examines reports of cyberattacks on the water systems of Minnesota, reportedly originating from Iran. He offers an immediate caveat: attribution is still preliminary, and no real damage appears to have been done.

This is not, however, a single isolated incident. According to the available data, the campaign affected at least seven states — meaning this is not a random glitch at some local facility, but coordinated activity against critical infrastructure.

An unexpected theory of origin

The most curious part of the post is not technical but political. As Schneier notes, Donald Trump's reaction defies the usual logic. The president, by his account, does not believe in an Iranian trail — and, if you follow the thought to its conclusion, it turns out that Minnesota supposedly hacked itself.

Trump flatly blamed the state itself and its leadership for what happened: “I think I'd put the blame on Minnesota, because they're grossly incompetent. I'd put the blame on Minnesota and on the governor, the corrupt governor of Minnesota. They like to say, ‘Oh, it's Iran.' Iran should be so lucky. Iran has bigger problems than worrying about Minnesota.”

Schneier adds a single but exhaustive comment: it is unknown whether the president believes the other six states hacked themselves as well.

Why this matters

Behind the ironic framing lies a genuinely serious problem. Attacks on water supplies and other utility infrastructure are a long-standing sore spot in cybersecurity: such facilities are often poorly protected, and the fallout from a failure is felt by ordinary residents. And when the official response amounts to hunting for a culprit at home rather than analyzing the incident, the thing that suffers most is the very ability to recognize a threat in time and respond to it.

Schneier, as usual, draws no sweeping conclusions and does not overstate the scale: there is no damage, and the attribution is raw. But he pins down precisely the contrast between the calm technical description and the political noise surrounding it.

Source: Schneier on Security