By Jack Evans
Tampa Bay Times
PINELLAS COUNTY, Fla. — Local and federal authorities are investigating after an attempt Friday to poison the city of Oldsmar’s water supply, Pinellas County Sheriff Bob Gualtieri said.
Someone remotely accessed a computer for the city’s water treatment system and briefly increased the amount of sodium hydroxide, also known as lye, by a factor of more than 100, Gualtieri said at a news conference Monday. The chemical is used in small amounts to control the acidity of water but it’s also a corrosive compound commonly found in household cleaning supplies such as liquid drain cleaners.
The city’s water supply was not affected. A supervisor working remotely saw the concentration being changed on his computer screen and immediately reverted it, Gualtieri said. City officials on Monday emphasized that several other safeguards are in place to prevent contaminated water from entering the water supply and said they’ve disabled the remote-access system used in the attack.
The Pinellas County Sheriff’s Office is investigating, along with the FBI and the Secret Service, Gualtieri said.
Nobody has been arrested, Gualtieri said, though investigators have some leads. They do not know why the city of Oldsmar was targeted, he said. He added that other area municipalities have been alerted to the attack and encouraged to inspect the safeguards to their water treatment systems and other infrastructure.
Though some cities obtain water through Pinellas County, Oldsmar provides water directly to its businesses and roughly 15,000 residents, Gualtieri said. The computer system at the water treatment plant was set up to allow authorized users to remotely access it for troubleshooting.
A plant operator was monitoring the system at about 8 a.m. EST Friday and noticed that someone briefly accessed it. He didn’t find this unusual, Gualtieri said, because his supervisor remotely accessed the system regularly.
But at about 1:30 p.m. the same day, Gualtieri said, someone accessed the system again. This time, he said, the operator watched as someone took control of the mouse, directed it to the software that controls water treatment, worked inside it for three to five minutes and increased the amount of sodium hydroxide from 100 parts per million to 11,100 parts per million.
The attacker left the system, Gualtieri said, and the operator immediately changed the concentration back to 100 parts per million.
“At no time was there a significant adverse effect on the water being treated,” the sheriff said. “Importantly, the public was never in danger.”
Even if the operator hadn’t caught it, he said, it would have taken more than a day for the water to enter the water supply.
“The protocols that we have in place, monitoring protocols, they work — that’s the good news,” Oldsmar Mayor Eric Seidel said. “Even had they not caught them, there’s redundancies in the system that would have caught the change in the pH level.
“The important thing is to put everyone on notice,” he said. “There’s a bad actor out there.”
[READ: 5 tactics to protect your police agency from ransomware]
Sen. Marco Rubio, R-Fla., also addressed the attack in a tweet Monday, saying it “should be treated as a matter of national security.”
The Sheriff’s Office learned of the attack and began investigating Friday evening, Gualtieri said. Investigators don’t yet know whether the attack originated within or outside Pinellas County, Florida or the United States. If the attacker is apprehended, he said, the person will face state felony charges and possibly federal charges.
Contact with sodium hydroxide can kill skin and cause hair loss, according to the National Center for Biotechnology Information. Ingestion can be fatal.
Gualtieri said he didn’t know what physiological effects would result from the concentration dialed up in the attack. Nor was it immediately apparent whether a similar attack had ever happened in the U.S. In 2007, the water of a town in Massachusetts was accidentally treated with too much lye, causing burns and skin irritation among people who showered with it.
“I’m not a chemist,” Gualtieri said. “But I can tell you what I do know is ... if you put that amount of that substance into the drinking water, it’s not a good thing.”
(c)2021 the Tampa Bay Times (St. Petersburg, Fla.)