Since 27 July 2026, water and wastewater utilities in at least seven US states have reported cyber incidents to the FBI. Some lost pressure, some overflowed, some fell back to running the plant by hand. The FBI and the EPA describe the way in: industrial controllers reachable from the open internet, with addresses and passwords changed so operators lost visibility and control.

The American duty to "look at your cybersecurity" is attached to a different object entirely: the sanitary survey, an inspection built for pipes, chlorine and samples. One rule tried to bridge the two. It was frozen by a court in July 2023 and withdrawn that October.

In Minnesota more than thirty systems were touched, including a city of about eighty thousand people — large enough that the federal rule already applies to it. In Michigan, nine. Officials said the water stayed safe to drink: this is a story about control of the plant, not about what came out of the tap.

Investigators have not publicly attributed the attacks to anyone. Neither do we — it changes nothing in the design question.

About fifty thousand community water systems operate in the United States, and eight out of ten of them serve 3,300 people or fewer — below the line the federal duty draws. The honest counterweight: about 8% of systems serve roughly 80% of Americans. Any rule here has to choose which of those two facts it is built around.

The duty itself came in 2018 as a paragraph added to the drinking-water act of 1974. It requires a risk assessment — the security of computer systems is one of the things it must consider — an emergency plan, and self-certification to the EPA every five years. Not a minimum standard. Not an inspection of the network.

A system serving three thousand people with an exposed controller can flood a street. A system serving fifty thousand with nothing exposed cannot. The duty and the danger are pinned to different things.

The second mismatch decided the story: the federal instrument for checking a water utility is the sanitary survey. When the EPA wanted to reach cybersecurity in March 2023, it reached through that tool. Missouri, Arkansas and Iowa sued, joined by two industry associations including the one representing rural systems. A court froze the memo in July; the agency withdrew it in October, citing the litigation.

Be fair to the town that sued: a utility serving three thousand people may have two operators and a part-time manager, and all its money is what customers pay on their water bills. For that town a security programme is a line in the budget taken from something else.

And there is a third party nobody polls — the state. Sanitary surveys are run by inspectors trained on chlorine, backflow and sampling. The 2023 memo asked those same inspectors to judge a control network. A duty means something only when somebody in the state office knows what they are looking at, and that person has to be hired before the rule can bite.

Design one gives water its own law, as Europe does, and buys the one thing nobody has: a reporting clock that shows who is exposed. The catch is our own — Europe also draws a size line, on staff and turnover instead of customers, plus a door to pull in a small sole supplier. Someone has to decide who is critical enough, which is exactly the judgement the US agency was told it could not make.

Design two ties the duty to exposure. It lands where the danger is — and rests on the utility's own word, the same self-certification we just called the weak point, except now the ticked box decides whether any rule applies at all.

Design three copies the electricity model, which works because it regulates only the high-voltage backbone and leaves local distribution out. Water has no backbone to carve off: the plant serving three thousand people is the whole system for that town.

Customer counts, revenue bands, employee numbers, floor area: these get reached for because they are easy to count, not because risk respects them. Every design above uses one. So the question is never whether there is a line, but what it is drawn on — and who may step over it.

And a second question for any agency announcement: whose instrument is this? If a body reaches for a power built for something else because it has nothing of its own, the rule may work for a while, and it will disappear the first time someone with the right to sue objects.