Iranian hackers infiltrated a small New York dam in 2013 in a previously undisclosed incident, according to The Wall Street Journal. 
 
 ADVERTISEMENT 
 
 Investigators said that the hackers didn’t take control of the system, but were probing its defenses. The White House was alerted when officials initially believed the intrusion occurred at a much larger facility in Oregon. 
 
 The still-classified breach occurred amid a wave of Iranian hacks on U.S. banks and just three years after a computer worm believed to be built by the U.S. and Israel damaged nuclear infrastructure in Iran. 
 
 The incident fits a pattern openly described by U.S. officials who warn that hackers from Russia, Iran and China are testing U.S. critical infrastructure networks for vulnerabilities. 
 
 National Security Agency Director Michael Rogers told lawmakers last fall that China and “one or two” other countries would be able to shut down portions of critical U.S. infrastructure with a cyberattack. Researchers suspect Iran to be on that list. 
 
 In fiscal 2015, the Department of Homeland Security (DHS) responded to 295 hacking incidents related to industrial controls, up from 245 the year previous, the Journal reports. 
 
 If hackers moved from grid-mapping to a deliberate attack, the consequences could be devastating. A blackout across 15 states and Washington, D.C., could cost the economy hundreds of billions, raise mortality rates at hospitals and cut the nation’s water supply, according to a recent study. 
 
 Experts say utilities are unprepared to cope with the threat of such an attack. Much of the technology governing industrial systems is outdated and in many cases connected directly to at-risk office networks. 
 
 The U.S. has more than 57,000 industrial-control systems connected to the Internet. The DHS has issued repeated public warnings to utilities that their networks are at risk. 
 
 A top DHS official recently told energy firm executives at a conference that ISIS “is beginning to perpetrate cyberattacks.” 
 
 The incident in New York also raises questions about the murky set of guidelines surrounding cyberwarfare. 
 
 Experts say there are three distinct kinds of cyber intrusions: corporate espionage intended to financially benefit foreign companies, hacks intended to do damage to infrastructure and traditional intelligence-gathering efforts performed by nation states. 
 
 Lawmakers have called for clear standards governing the U.S. response to different incidents, in some cases pressing the intelligence community to create such guidelines. 
 
 “We don’t know what constitutes an act of war, what the appropriate response is, what the line is between crime and warfare,” Rep. Jim Himes (D-Conn.) said in a House Intelligence Committee hearing in September. ||||| By Barrie Barber and Steve Bennish 
 
 Staff Writer 
 
 An employee of the National Weather Service’s Wilmington office has been indicted on charges of illegally hacking into a restricted federal computer database controlled by the U.S. Army Corps of Engineers detailing information about dams nationwide. 
 
 The indictment echoes a security breach in 2013 in which U.S. intelligence officials revealed a computer intrusion into the same database by what were described as Chinese government cyber spies. 
 
 The Corps’ National Inventory of Dams has deep security implications because it includes detailed information on a critical part of the infrastructure that supplies hydroelectric power to the electrical grid. Additional concerns are that dams could be targeted in war time to cause large losses of life. 
 
 The Federal Bureau of Investigation said that Xiafen “Sherry” Chen, 59, of Wilmington, was indicted in U.S. District Court on one count of theft of U.S. government property, punishable by up to 10 years in prison; one count of illegally accessing a U.S. government computer database, punishable by up to five years in prison; and two counts of making false statements to federal agents, punishable by up to five years in prison. She also faces fines totaling $1 million. 
 
 She was arrested Monday by FBI agents at her workplace. 
 
 Chen, described as a naturalized U.S. citizen, is employed as a hydrologist at the National Oceanic and Atmospheric Administration facility. 
 
 Assistant United States Attorney Dwight Keller, who is representing the government in the case, said Tuesday that he couldn’t comment on similarities to earlier reports of Chinese government espionage. 
 
 “You can draw your own conclusions; I can’t comment on that,” Keller said. “At this point, I am reluctant to say any more. I’ll rest on the allegations of the indictment.” 
 
 An Army Corps of Engineers spokesman referred questions about the investigation to the FBI and the U.S. Attorney’s office. 
 
 Federal public defense attorney Cheryll Bennett has been assigned to represent Chen. She did not return a call seeking comment. 
 
 The indictment says that on various dates in May 2012, Chen illegally accessed restricted areas of the protected U.S. government computer database and downloaded sensitive files from the National Inventory of Dams. This database is maintained and controlled by the U.S. Army Corps of Engineers in conjunction with the National Dam Safety Review Board. 
 
 The indictment adds that on June 11, 2013, Chen provided “materially false statements to officials from the Department of Commerce Office of Security who were assigned to investigate her activities.” 
 
 U.S. Attorney Carter Stewart commended the FBI and the U.S. Department of Commerce’s Office of Security, which are jointly investigating this case. 
 
 The National Inventory of Dams includes information on the location, size, purpose, type, date of last inspection, and regulatory and technical data of dams, according to the Army Corps of Engineers. 
 
 The federal agency updates the information every two years. The 2013 update included information on more than 87,300 dams, including 14,726 classified as “high hazard potential,” where failure or mis-operation could cause loss of human life, the federal agency reported. 
 
 Another 12,406 dams were classified as “significant hazard potential,” where failure or mis-operation could cause economic losses. About 65 percent of the dams in the United States are privately owned. 
 
 In another case based on an FBI investigation, the U.S. Justice Department in May indicted five members of the Chinese People’s Liberation Army and charged them with hacking Westinghouse Electric and the United States Steel Corporation, among other company networks. The indictment said the five were members of Unit 61398, a unit of the People’s Liberation Army. 
 
 The FBI said that the hacking targeted “economic espionage, and other offenses directed at six American victims in the U.S. nuclear power, metals, and solar products industries.” 
 
 FBI investigators said “conspirators stole trade secrets that would have been particularly beneficial to Chinese companies at the time they were stolen.” 
 
 “In other cases,” the FBI said, “the conspirators also stole sensitive, internal communications that would provide a competitor, or an adversary in litigation, with insight into the strategy and vulnerabilities of the American entity.” ||||| Iranian hackers infiltrated the control system of a small dam less than 20 miles from New York City two years ago, sparking concerns that reached to the White House, according to former and current U.S. officials and experts familiar with the previously undisclosed incident. 
 
 The breach came amid attacks by hackers linked to Iran’s government against the websites of U.S. banks, and just a few years after American spies had damaged an Iranian nuclear facility with a sophisticated computer worm called Stuxnet. In October 2012,... ||||| SHARE THIS ARTICLE Share Tweet Post Email 
 
 Hackers working for a foreign government recently breached at least a dozen U.S. power plants, including the Wolf Creek nuclear facility in Kansas, according to current and former U.S. officials, sparking concerns the attackers were searching for vulnerabilities in the electrical grid. 
 
 The intruders could be positioning themselves to eventually disrupt the nation’s power supply, warned the officials, who noted that a general alert was distributed to utilities a week ago. Adding to those concerns, hackers recently infiltrated an unidentified company that makes control systems for equipment used in the power industry, an attack that officials believe may be related. 
 
 The chief suspect is Russia, according to three people familiar with the continuing effort to eject the hackers from the computer networks. One of those networks belongs to an aging nuclear generating facility known as Wolf Creek -- owned by Westar Energy Inc., Great Plains Energy Inc. and Kansas Electric Power Cooperative Inc. -- on a lake shore near Burlington, Kansas. 
 
 The possibility of a Russia connection is particularly worrisome, former and current officials say, because Russian hackers have previously taken down parts of the electrical grid in Ukraine and appear to be testing increasingly advanced tools to disrupt power supplies. 
 
 The hacks come as international tensions have flared over U.S. intelligence agencies’ conclusion that Russia tried to influence the 2016 presidential election. The U.S., which has several continuing investigations into Russia’s activities, is known to possess digital weapons capable of disrupting the electricity grids of rival nations. 
 
 “We don’t pay attention to such anonymous fakes,” Kremlin spokesman Dmitry Peskov said, in response to a request to comment on alleged Russian involvement. 
 
 It was unclear whether President Donald Trump was planning to address the cyberattacks at his meeting on Friday with Russian President Vladimir Putin. In an earlier speech in Warsaw, Trump called out Russia’s “destabilizing activities” and urged the country to join “the community of responsible nations.” 
 
 The Department of Homeland Security and Federal Bureau of Investigation said they are aware of a potential intrusion in the energy sector. The alert issued to utilities cited activities by hackers since May. 
 
 “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks,” the government agencies said in a joint statement. 
 
 The Department of Energy also said the impact appears limited to administrative and business networks and said it was working with utilities and grid operators to enhance security and resilience. 
 
 “Regardless of whether malicious actors attempt to exploit business networks or operational systems, we take any reports of malicious cyber activity potentially targeting our nation’s energy infrastructure seriously and respond accordingly,” the department said in an emailed statement. 
 
 Representatives of the National Security Council, the Director of National Intelligence and the Nuclear Regulatory Commission declined to comment. While Bloomberg News was waiting for responses from the government, the New York Times reported that hacks were targeting nuclear power stations. 
 
 The North American Electric Reliability Corp., a nonprofit that works to ensure the reliability of the continent’s power system, said it was aware of the incident and was exchanging information with the industry through a secure portal. “At this time, there has been no bulk power system impact in North America,” the corporation said in an emailed statement. 
 
 In addition, the operational controls at Wolf Creek were not pierced, according to government officials. “There was absolutely no operational impact to Wolf Creek,” Jenny Hageman, a spokeswoman for the nuclear plant, said in a statement to Bloomberg News. “The reason that is true is because the operational computer systems are completely separate from the corporate network.” 
 
 Determining who is behind an attack can be tricky. Government officials look at the sophistication of the tools, among other key markers, when gauging whether a foreign government is sponsoring cyber activities. 
 
 Several private security firms are studying data on the attacks, but none has linked the work to a particular hacking team or country. 
 
 “We don’t tie this to any known group at this point,” said Sean McBride, a lead analyst for FireEye Inc., a global cybersecurity firm. “It’s not to say it’s not related, but we don’t have the evidence at this point.” 
 
 U.S. intelligence officials have long been concerned about the security of the country’s electrical grid. The recent attack, striking almost simultaneously at multiple locations, is testing the government’s ability to coordinate an effective response among several private utilities, state and local officials, and industry regulators. 
 
 Specialized teams from Homeland Security and the FBI have been scrambled to help extricate the hackers from the power stations, in some cases without informing local and state officials. Meanwhile, the U.S. National Security Agency is working to confirm the identity of the hackers, who are said to be using computer servers in Germany, Italy, Malaysia and Turkey to cover their tracks. 
 
 Many of the power plants are conventional, but the targeting of a nuclear facility adds to the pressure. While the core of a nuclear generator is heavily protected, a sudden shutdown of the turbine can trigger safety systems. These safety devices are designed to disperse excess heat while the nuclear reaction is halted, but the safety systems themselves may be vulnerable to attack. 
 
 Homeland Security and the FBI sent out a general warning about the cyberattack to utilities and related parties on June 28, though it contained few details or the number of plants affected. The government said it was most concerned about the “persistence” of the attacks on choke points of the U.S. power supply. That language suggests hackers are trying to establish backdoors on the plants’ systems for later use, according to a former senior DHS official who asked not to be identified. 
 
 Those backdoors can be used to insert software specifically designed to penetrate a facility’s operational controls and disrupt critical systems, according to Galina Antova, co-founder of Claroty, a New York firm that specializes in securing industrial control systems. 
 
 “We’re moving to a point where a major attack like this is very, very possible,” Antova said. “Once you’re into the control systems -- and you can get into the control systems by hacking into the plant’s regular computer network -- then the basic security mechanisms you’d expect are simply not there.” 
 
 The situation is a little different at nuclear facilities. Backup power supplies and other safeguards at nuclear sites are meant to ensure that “you can’t really cause a nuclear plant to melt down just by taking out the secondary systems that are connected to the grid,” Edwin Lyman, a nuclear expert with the Union of Concerned Scientists, said in a phone interview. 
 
 The operating systems at nuclear plants also tend to be legacy controls built decades ago and don’t have digital control systems that can be exploited by hackers. Wolf Creek, for example, began operations in 1985. “They’re relatively impervious to that kind of attack,” Lyman said. 
 
 The alert sent out last week inadvertently identified Wolf Creek as one of the victims of the attack. An analysis of one of the tools used by the hackers had the stolen credentials of a plant employee, a senior engineer. A U.S. official acknowledged the error was not caught until after the alert was distributed. 
 
 According to a security researcher who has seen the report, the malware that activated the engineer’s username and password was designed to be used once the hackers were already inside the plant’s computer systems. 
 
 The tool tries to connect to non-public computers, and may have been intended to identify systems related to Wolf Creek’s generation plant, a part of the facility typically more modern than the nuclear reactor control room, according to a security expert who asked to note be identified because the alert is not public. 
 
 Even if there is no indication that the hackers gained access to those control systems, the design of the malware suggests they may have at least been looking for ways to do so, the expert said. 
 
 Stan Luke, the mayor of Burlington, the largest community near Wolf Creek, which is surrounded by corn fields and cattle pastures, said he learned about a cyber threat at the plant only recently, and then only through golfing buddies. 
 
 With a population of just 2,700, Burlington boasts a community pool with three water slides and a high school football stadium that would be the envy of any junior college. Luke said those amenities lead back to the tax dollars poured into the community by Wolf Creek, Coffey County’s largest employer with some 1,000 workers, 600 of whom live in the county. 
 
 E&E News first reported on digital attacks targeting U.S. nuclear plants, adding it was code-named Nuclear 17. A senior U.S. official told Bloomberg that there was a bigger breach of conventional plants, which could affect multiple regions. 
 
 Industry experts and U.S. officials say the attack is being taken seriously, in part because of recent events in Ukraine. Antova said that the Ukrainian power grid has been disrupted at least twice, first in 2015, and then in a more automated attack last year, suggesting the hackers are testing methods. 
 
 Scott Aaronson, executive director for security and business continuity at the Edison Electric Institute, an industry trade group, said utilities, grid operators and federal officials were already dissecting the attack on Ukraine’s electric sector to apply lessons in North America before the U.S. government issued the latest warning to “energy and critical manufacturing sectors.” The current threat is unrelated to recently publicized ransomware incidents or the CrashOverride malware, Aaronson said in an emailed statement. 
 
 Neither attack in Ukraine caused long-term damage. But with each escalation, the hackers may be gauging the world’s willingness to push back. 
 
 “If you think about a typical war, some of the acts that have been taken against critical infrastructure in Ukraine and even in the U.S., those would be considered crossing red lines,” Antova said. 
 
 For more on cyber security, check out the Decrypted podcast: 
 
 — With assistance by Charlotte Chilton
– Iranian hackers who targeted American financial institutions two years ago were also apparently curious about a small dam in upstate New York—and officials are worried what this means for the security of US industrial infrastructure overall, the Wall Street Journal reports. The hackers reportedly infiltrated the controls for the facility—IDed by Journal sources as the Bowman Avenue Dam near Rye—in 2013 through a cellular modem, per an unclassified Homeland Security document. And while the interlopers didn't wrest control of the dam, it appears they poked around quite a bit—underscoring how easy it is to break into the more than 57,000 systems for US power grids, pipelines, bridges, and dams, many of which are antiquated and virtually unprotected, the Journal notes. In fact, per a separate AP investigation, "sophisticated foreign hackers" have accessed about a dozen power networks here, attacks that the AP says the US public is rarely informed about. US infrastructure is often run by creaky systems that were previously offline, which kept them relatively safe. But, "against the advice of hacking gurus," as the Journal notes, many companies started connecting their systems to the Internet without adequately securing them. And the number of such hacks has been creeping up since. Per Homeland Security data, over the 12 months ending Sept. 30, it took in and responded to 295 incidents, up from 245 the year before, per the Journal. Possible consequences: hackers causing a flood, explosion, or even bumper-to-bumper traffic, either by accident or intentionally. A Homeland Security official recently told energy execs at a conference that even ISIS "is beginning to perpetrate cyberattacks," per the Hill. In the Bowman Dam incident, the White House was informed because officials initially thought the hack was against Oregon's larger Arthur R. Bowman Dam, per the Journal. (The AP investigation chillingly reveals how hot a target the US power grid has been.)