Iran Hacks Water Systems in 7 States - USA Losing War

Eli opens with the CBS News story at the center of the episode: malicious cyber activity affected technology at water systems in at least seven states this week, including Minnesota and Michigan, forcing some utilities to switch to manual operations while state and federal authorities investigate. He stresses the scale hidden in that headline, noting that more than 30 community water systems across Minnesota alone were affected, meaning the true nationwide total could run into the hundreds of facilities hit in a single coordinated wave. Federal agencies including the FBI, EPA, and CISA warned that attackers are targeting internet-exposed industrial controllers used by water and wastewater utilities, with some cases resulting in loss of monitoring and control functionality that led to pressure loss and flooding. Most confirmed Minnesota cases involved remote monitoring and control technology, including programmable logic controllers, though officials maintain no water supply has actually been compromised.

Eli lingers on what these systems actually do, explaining that water treatment relies on computer-controlled dosing of chemicals like chlorine and fluoride before water reaches the public, and reminds listeners that a Florida water system was compromised in exactly this way a few years ago, with an attacker briefly able to alter the chemical composition of the water supply. That precedent, he argues, is what makes the current story genuinely alarming rather than abstract.

Investigators are still trying to determine whether Iranian hackers are actually responsible, and officials have cautioned that attribution could change as more technical evidence comes in. Notably, CBS reported that investigators are also examining whether the actor deliberately tried to appear Iran-based in order to inflame tensions during the active US conflict with Iran. Eli seizes on this detail, pointing out the strategic incentive some other actor might have to stage the attack as Iranian in order to make it look like Iran was trying to harm American civilians and provoke a harsher US response.

He underscores that Michigan's Department of Environment, Great Lakes and Energy confirmed a small number of reports consistent with the federal warnings, insisting all systems continued operating safely with no known public health impacts, a phrase Eli treats with open skepticism given how early the investigation still is.

The episode's sharpest moment of mockery comes from Trump's own words at a televised Camp David cabinet meeting, where he declared, 'I think that Minnesota is behind it... I don't think there was an Iranian cyber attack. I think that Minnesota ought to get its act together,' attributing the incident to the state's supposed incompetence and even suggesting the governor was involved. Eli treats this as damning evidence that the administration isn't taking the attack seriously as a national security threat, choosing instead to turn it into a domestic political grievance against a state government. He frames the response as emblematic of an administration more interested in soundbites and grievance politics than in protecting the systems Americans depend on for survival.

He extends the sarcasm further, joking about how much jail time Minnesota should serve and whether Trump's planned battleships will be deployed to 'conquer' the state, using the absurdity to sharpen his real point that the administration has no coherent framework for responding to infrastructure attacks.

Eli's central policy complaint is a spending comparison: the US budgets roughly 1.5 trillion dollars for the military and reportedly spent around 200 billion dollars on bombing operations in Iran, while Trump simultaneously pushes to build three of the largest battleships ever constructed, ships Eli says experts consider likely obsolete before they even launch. Meanwhile, he argues, there is no comparable federal investment in cybersecurity infrastructure or auditing for hospitals, schools, libraries, and water utilities, no clear resource Americans running these systems can call for help, and no meaningful oversight regime. He is careful to clarify he isn't calling for regulation of every small business's computer system, just the systems a community actually depends on to survive.

He sharpens the historical embarrassment by recalling that Windows NT 4.0, the operating system he earned his MCSE certification on back in 2000, had NSA-approved configurations secure enough to run within national security environments more than two decades ago. If a 26-year-old operating system could be hardened to that standard, he argues, there is no excuse for water facilities in 2026 remaining vulnerable to mass compromise by outside actors.

Eli draws a direct line to Stuxnet, the historic cyberattack that used compromised Siemens industrial controllers to destroy Iranian nuclear centrifuges, arguing that if the US could infiltrate supposedly high-security Iranian facilities that way, it should be no surprise that America's own internet-exposed industrial controllers are just as vulnerable in return. To make the stakes visceral, he recounts his own experience during Hurricane Helene's flooding in Asheville roughly two years earlier, when power, cell service, and water all failed within minutes and three of the region's interstate highway connections were wiped out. What made that disaster survivable, he explains, was that just twenty or thirty miles outside Asheville everything remained completely normal, allowing resources and evacuees to move in and out, a contrast he vividly illustrates by describing sitting with a Starbucks coffee in Atlanta's Piedmont Park mere hours after fleeing a town without water or power.

His real fear is what happens when there is no unaffected zone nearby to absorb the shock, imagining a scenario where coordinated cyberattacks on water and power grids are paired with coordinated physical attacks, eliminating the safety net that saved Asheville. He references talk of attempts to target the entire northeastern electricity grid as further evidence that the threat model extends well beyond a single sector, urging listeners to research it further on their own.