Hackers are after your water. How this town defends against them.

Summary

---

Podcast Summary: Consider This from NPR

Episode: Hackers are after your water. How this town defends against them
Date: September 8, 2025
Host: Ari Shapiro (with field reporting by Jenna McLaughlin)

---

Overview

This episode of Consider This explores the rising threat of cyberattacks on U.S. water systems, focusing on the small Vermont community of Cavendish. Through firsthand accounts from local water operators and cybersecurity professionals, NPR demonstrates how even rural towns are on the front line in defending critical infrastructure against sophisticated hackers—ranging from criminal gangs to nation-state actors such as China and Russia. The show highlights the challenges posed by limited resources and federal funding cuts, and the innovative grassroots efforts emerging to bolster cyber defenses on the ground.

---

Key Discussion Points & Insights

1. Life at the Water Treatment Plant

• Chris Hughes is the assistant operator at the Cavendish, VT wastewater plant, where tasks range from raking up rags by hand to managing technical chemical processes.
  • Quote: “Either you love it or you don’t. It’s nature of the beast.” (00:28 – Chris Hughes)
• Jenna McLaughlin of NPR tours the facility, giving a tactile sense of the low-tech daily grind and humble resources in use.

2. Rise of Cyber Threats to Water Systems

• Recent cyberattacks have shown just how vulnerable America’s water infrastructure is:
  • Chinese hackers spent almost a year inside a Massachusetts utility that supplies water and power.
  • American Water, the largest wastewater utility in the U.S., was targeted by hackers in October.
• Chris Hughes acknowledges the daunting reality:
  • Quote: “If someone got into the system, they could just turn it off and it would stop producing water. We’d be dead in the water, I guess.” (00:43 – Chris Hughes)

3. On the Front Lines— With Few Resources

• The Cavendish plant is run by only two people, highlighting how small utilities are uniquely exposed.
• Hughes admits feeling unprepared:
  • Quote: “It’s kind of scary that I’m the only door between, you know, the Iranians and our water system… I don’t really have the background to be fending off foreign entities.” (04:31 – Chris Hughes)

4. The Broader National Picture

• Attacks are not isolated:
  • Russian hackers made a Texas water system overflow (Jan).
  • Simultaneously, federal funding for cybersecurity programs is being cut.
• The EPA has issued warnings about increased risks.

5. Grassroots Response: Project Franklin

• Enter Forrest Anderson, a local operator and “tech nerd,” who now works as a cybersecurity systems specialist for Vermont Rural Water Association.
  • He travels with a ukulele case full of cybersecurity gadgets.
• Awareness of advanced threats is growing:
  • Quote: “If you aren’t familiar with Volt Typhoon, it’s going on right now. Volt Typhoon is in New England.” (05:39 – Forrest Anderson)
  • Volt Typhoon is a Chinese hacking group reportedly embedded in U.S. critical infrastructure, lying in wait for potential geopolitical conflict.

6. Community Resilience and Collaboration

• Tim Pappa, ex-FBI agent, joins the effort, underscoring the need for diverse expertise.
• The team is part of Project Franklin, a volunteer initiative to support small towns.
• Post–Hurricane Irene, local operators know they must rely on themselves:
  • Quote: “There’s no cavalry. We are the cavalry. We are.” (07:09 – Forrest Anderson)
  • Quote: “That goes back to that New England Yankee ingenuity. We’ll do it ourselves.” (07:16 – Chris Hughes)

7. Practical Defenses in Vermont

• On the ground, the team implements foundational security:
  • Covering WiFi passwords
  • Installing network monitoring tools and VPNs
  • Creating system backups
• The goal: Make Cavendish a less visible (and therefore less attractive) target.
  • Quote/Metaphor: “Right now it’s hunting season. We are the six point buck in the field… We need to get in the woods because it’s a lot harder to hit.” (08:01 – Forrest Anderson)

---

Memorable Moments & Notable Quotes

• Chris Hughes describing the “dirty glory” of the job and new anxieties about cyber vulnerability. (00:28 – 00:43)
• Forrest Anderson on the reality of foreign cyber intrusions:
  “And the fact is, is that they’re here… If we were to lose our supply of semiconductors on top of our manufacturing, our power and our water, we would not stand a chance against any conflict.” (06:02)
• Reflections on local determination:
  “We’ll do it ourselves.” (07:16 – Chris Hughes)

---

Timestamps for Important Segments

• 00:00–01:18 – Introduction; tour of Cavendish water plant with Chris Hughes
• 02:51–03:46 – Background on cyber threats to U.S. water (EPA warning, recent attacks)
• 04:31–05:19 – Hughes’ perspective: Small town, big threat; feeling outgunned
• 05:19–06:09 – Introduction of Forrest Anderson; Volt Typhoon threat
• 06:18–07:16 – Community self-reliance; Project Franklin described
• 07:31–08:09 – Implementation of security basics and hunting season metaphor

---

Conclusion

This episode personalizes the abstract threat of cyberattacks on critical infrastructure, giving listeners an inside look at both the challenges and grassroots resilience powering small-town water utilities. The conversation underscores the everyday people—like Chris Hughes and Forrest Anderson—who not only keep the water running, but are now becoming the frontline defenders in America’s cyber conflict.

---

Transcript

[Ari Shapiro]

Chris Hughes has what he calls an interesting job. He's an assistant operator at a wastewater treatment plant in Cavendish, Vermont.

[Chris Hughes]

So where we're going now is the beginning of the process. This is where it comes into the sewer plant.

[Ari Shapiro]

On a recent August afternoon, he gave NPR's Jenna McLaughlin a tour of the plant.

[Chris Hughes]

What you see there are rags and things that don't belong that we have to screen out ourselves. Some places have automated machines that do that. We don't. We have a rake.

[Jenna McLaughlin]

Sounds like a fun job.

[Chris Hughes]

Yeah. Yeah. Again, either you love it or you don't. It's nature the beast.

[Ari Shapiro]

Hughes does love his work in all its technical, mathematical, chemical, and, yes, dirty glory. But lately, Hughes has had to worry about a new hazard, cyber attacks.

[Chris Hughes]

If someone got into the system, they could just turn it off and it would stop producing water. We'd be dead in the water, I guess.

[Ari Shapiro]

The threat of someone cutting water off for Americans is real. Chinese hackers recently spent nearly a year inside a Massachusetts utility company that provides power and water. And last October, hackers targeted American Water, the largest wastewater utility company in the country.

[Jenna McLaughlin]

Monday, the water utility said that they discovered a cyber attack last week. And in an effort to protect customers data and prevent any future harm, consider this.

[Ari Shapiro]

Water is an appealing target for hackers and some people are working to make sure a cyber attack doesn't stop the flow. From npr, I'm Ari Shapiro.

[NPR Host (Sources and Methods)]

Sources and methods, the crown jewels of the intelligence community. Shorthand for how do we know what's real? Who told us? If you have those answers, you're on the inside and NPR wants to bring you there. From the Pentagon to the State Department to spy agencies, listen to understand what's really happening and what it means for you. Sources and methods, the new National Security podcast from npr.

[NPR Host (Here and Now Anytime)]

Immigration raids, masked ICE agents, Operation Patriot. Our podcast here and now Anytime is looking at Trump's agenda of mass deportation through the eyes of one state.

[Chris Hughes]

I'm coming to Boston. I'm bringing hell with me.

[NPR Host (Here and Now Anytime)]

Listen to the podcast here and now Anytime from NPR and wbur.

[NPR Host (Short Wave)]

Short Wave thinks of science as an invisible force showing up in your everyday life, powering the food you eat, the medicine you use, the tech in your pocket. Science is approachable because it's already part of your life. Come explore these connections on the shortwave podcast from npr.

[Ari Shapiro]

It's consider this from npr. The environment. The Environmental Protection Agency recently sounded the alarm about an increase in malicious cyber attacks targeting water systems as hackers from nation states and criminal gangs cause chaos, make money and even prepare for potential future conflicts with the U.S. in Vermont, the small town where Chris Hughes works is trying to protect its water from hackers. NPR's cybersecurity correspondent Jenna McLaughlin paid a visit.

[Jenna McLaughlin]

It's late summer in southern Vermont, and Buttermilk Creek in Ludlow is cascading into three gushing waterfalls. Meanwhile, Chris Hughes is trying to figure out why there's water gushing where it shouldn't.

[Chris Hughes]

Hang on a minute.

[Jenna McLaughlin]

We're at the water treatment plant Hughes helps run. He makes a call to his boss.

[Chris Hughes]

Hey, we got a problem with the water plant.

[Jenna McLaughlin]

Hughes is the assistant operator here. It's just two people treating all the drinking and wastewater in the small towns of Cavendish and Proctorsville.

[Chris Hughes]

System shut off. The water's pouring out of the clear well outside.

[Jenna McLaughlin]

Turns out a lightning strike shut off power to one of the systems. Speaking outside earlier that day, while the storm that likely hit the plant passed through the area, Hughes said the work is never boring.

[Chris Hughes]

I haven't had a lot of jobs, but it is by far the most interesting job that I've ever had. And so you have to like it. You have to kind of care.

[Jenna McLaughlin]

Hughes has dealt with all kinds of problems, from lightning strikes to hunting down missing manhole covers and dense tall grass or raking so called flushable wipes out of sewer pipes. But now Hughes is learning about a new threat on the horizon. Hackers.

[Chris Hughes]

It's kind of scary that I'm the only door between, you know, the Iranians and our water system. You know, that kind of makes me a little nervous. I don't really have the background to be fending off foreign entities.

[Jenna McLaughlin]

You know, Hughes isn't exaggerating. The threat is real. Last October, criminal hackers targeted American Water, the largest publicly traded water and wastewater utility company in the United States. Then that January, Russian hackers took credit for making a water system overflow in Mule Shoe, Texas. Meanwhile, the White House has been cutting federal funding for many cybersecurity programs. But there's good news. There's a team assembling here in Vermont to help. He's out.

[Forrest Anderson]

I grew up in Berkshire, Vermont. My town doesn't have a high school.

[Jenna McLaughlin]

Meet Forrest Anderson, another local water operator carrying a ukulele case full of gadgets. He's also a self proclaimed tech nerd. That's part of how he recently got a job as a cybersecurity system specialist for the nonprofit Vermont Rural Water Association. As we ducked out of the rain, he mentioned another hacking group that he's worried about.

[Forrest Anderson]

If you aren't familiar With Volt Typhoon. It's going on right now. Volt Typhoon is in New England.

[Jenna McLaughlin]

Volt Typhoon, he's referring to a Chinese hacking group US national security officials say has been burrowing into US critical infrastructure, lying in wait to shut off water systems and spread fear in the event of a conflict. Like if China wanted to invade Taiwan.

[Forrest Anderson]

So I don't scare people. I give people the facts. And the fact is, is that they're here. And if we were to lose our supply of semiconductors on top of our manufacturing, our power and our water, we would not stand a chance against any conflict.

[Jenna McLaughlin]

Also joining us was Tim Pappa, a former FBI agent who now works in cybersecurity. In the corporate world, you kind of.

[Forrest Anderson]

Mix people you didn't expect to be mixed together. I don't know if Chris and I would have met ordinarily, but we have, and we have different backgrounds and different perspectives on things.

[Jenna McLaughlin]

He's here thanks to a new volunteer effort called Project Franklin, put together by heavy hitters in the cyberspace. From the well known DEFCON hacking conference to the University of Chicago. Cavendish might be small, but it's nestled up alongside glitzy ski resorts, major defense contractors. It's part of the critical infrastructure of New England. Anderson and Hughes both remember Hurricane irene back in 2011. How the flooding damaged everything, even led to the deaths of a father, son, water operator team in nearby Rutland. And how the towns came together to help each other rebuild.

[Forrest Anderson]

Especially after the flooding. We realized there's no cavalry. We are the cavalry. We are.

[Chris Hughes]

That goes back to that New England Yankee ingenuity. We'll do it ourselves.

[Jenna McLaughlin]

New England ingenuity and some good tech hygiene. I watch as Anderson, Hughes and Papa put some basics in place to set Cavendish up for success, no matter what's coming their way.

[Forrest Anderson]

I have something pulled up for you to check out later. Some event logs and a security.

[Jenna McLaughlin]

They cover up the WI fi password, install network monitoring tools, a virtual private network and system backups.

[Forrest Anderson]

If you see a failed login attempt and then a successful login attempt, and then they take a data packet, a file or a folder, you can assume that it was malicious.

[Jenna McLaughlin]

It's a big step in the right direction of making Cavendish a smaller target for bad guys to explain. Anderson has the perfect Vermont metaphor.

[Forrest Anderson]

I say, right now it's hunting season. We are the six point buck in the field. We're just hanging out in the fields right now. We need to get in the woods because it's a lot harder to hit.

[Jenna McLaughlin]

A target in the woods going forward, it might indeed be harder for hackers to hit their mark here amongst the sugar maples of Vermont.

[Ari Shapiro]

That's NPR CyberSecurity Correspondent Jenna McLaughlin. This episode was produced by Alejandra Marques Hanse and Karen Zamora. It was edited by Courtney Dorning and Andrew Sussman. Our executive producer is Sammy Yenigun. It's Consider this from npr. I'm Ari Shapiro.

[NPR Host (Sources and Methods)]

Military commanders, intelligence officials, diplomatic power players, they know things you may not about where the world is headed. And we will pull back curtain on what they're thinking on sources and methods. NPR's new National Security podcast, our team will help you understand America's shifting role in the world. Listen to Sources and Methods from npr.

[NPR Host (Up First)]

America's thirst for oil and gas has left a vast landscape of wells, but most don't produce much oil at all.

[NPR Host (Consider This Sponsor Message)]

These piddly little wells that are just drip drabbing, a little bit of profit while polluting, they're not worth it.

[NPR Host (Up First)]

Why so many American whales remain unplugged and abandoned despite the real threat of long term pollution. Listen now to the Sunday story on the Up First Podcast from npr.

[NPR Host (Consider This Sponsor Message)]

Want to hear this podcast without sponsor breaks? Amazon prime members can listen to Consider this sponsor free through Amazon Music. Or you can also support NPR's vital journalism and get consider this [e-mail] that's plus.NPR.org.