How volunteer cyber experts are helping protect rural water systems

A volunteer effort to help protect water utilities from cyberattacks has generated important insights about the challenges that utilities face and the most realistic ways to overcome them, in addition to boosting the security and confidence of the small group of participating utilities.

In late 2024, the DEF CON hacker conference, the University of Chicago’s Harris School of Public Policy and the National Rural Water Association (NRWA) launched DEF CON Franklin, connecting public-spirited cybersecurity experts with small, rural water systems that badly needed help fending off hackers. There are roughly 50,000 community water systems in the U.S., and the vast majority of them are small and poorly funded, which makes the aging infrastructure powering their essential services an easy target for hackers intent on causing chaos in American society.

That danger has received renewed attention in recent days amid a wave of cyberattacks on water utilities in multiple U.S. states, breaches that officials have tentatively linked to Iran.

DEF CON Franklin, whose name pays homage to Benjamin Franklin’s role in creating the first volunteer fire department in the U.S., is the nation’s first significant attempt to connect volunteer security professionals with woefully unprotected critical infrastructure operators. The program, which expanded in August 2025, has earned praise from participants and observers for offering aid that reflects utilities’ real needs and capabilities and for bridging a divide between two very different communities.

At a time when states are grappling with budget crises and the federal government is scaling back its support for critical infrastructure, Franklin has emerged as an effective — albeit limited — stopgap solution for vulnerable utilities that have nowhere else to turn.

“Volunteer programs can provide significant value by connecting utilities with cybersecurity support they may not otherwise have access to,” said Victor Atkins, director of critical infrastructure security at the consulting firm 1898 & Co. 

‘A huge blessing’

Franklin has kept things small since launching its initial pilot program in November 2024. The program has deployed 27 volunteers to 21 water utilities in seven states, and it’s still working with six of those utilities, including five from the pilot program.

“Most of these have been, come in, help them with some particular issues, and then leave after we’ve helped them, but then remain a phone-a-friend, so when they have other questions, they call,” said Jake Braun, Franklin’s founder and the executive director of the Harris School’s Cyber Policy Initiative.

Some Franklin engagements consist of conference calls or meetings to share best practices and answer utilities’ questions. In other cases, volunteers visit facilities to guide staff through specific upgrades. Franklin’s experts cover everything from basic cybersecurity hygiene, such as changing default passwords and enabling multifactor authentication, to documenting incident-response plans and procedures.

“Almost none of them had any documentation of [what to do] in case of an attack,” Braun said.

Volunteers also help utilities map their networks, a vital task for understanding equipment needs and vulnerabilities. Legacy technology is a major problem in the water industry, where IT consultants frequently show up, install equipment and then leave without documenting their work.

The water sector can be an insular community, and veteran system operators are often wary of outsiders promising free help. For Franklin to succeed, it needed a trusted industry partner to vouch for it. It found just that partner in the NRWA, a nonprofit organization whose state affiliates serve more than 31,000 utilities nationwide. The NRWA recruited the seven utilities for Franklin’s initial pilot program and has since helped broker other relationships, in addition to advising volunteers on where they can make the biggest impact.

“We’ve gotten some great feedback from the utilities that the Franklin volunteers have worked with on how they’ve improved,” said John DeGour, the NRWA’s director of regulatory affairs.

Chelsie Johnson, the superintendent of public works in Wilder, Idaho, said working with Franklin volunteer David Armstrong has been a “phenomenal” experience.

“He’s been able to teach me a lot of stuff,” she said. “There’s a whole world out there I don’t even know about. … It’s been a huge blessing to our city. I know our mayor and council are very thankful for what he’s done for us, as well as myself.”

Wilder, Idaho, faces the same challenges as many other small cities: a lack of cybersecurity staff, complex operational technology that needs protecting and a small budget with little room for IT spending whose returns aren’t obvious. “We could never afford [a hacker’s ransom demand] if they were to break into our system and take it over,” Johnson said.

During a handful of meetings, Armstrong sketched out a series of actions that Johnson could take to boost security. “Chelsie actually knocked it out of the park” with those actions, Armstrong said.

Struggling to take free help

In addition to helping individual utilities, Franklin has also yielded broader insights about the water sector.

One Franklin report, which the group shared exclusively with CFO Dive sister publication Cybersecurity Dive, looked at security companies’ offerings of free services to water utilities and found that, in most cases, those offers were useless. The services were “free like a puppy,” Braun quipped, meaning they came with pricey strings — an upfront purchase of an expensive device in order to get free licenses to use it, or a free monitoring system that required an expensive security consultant to analyze its data. 

“They can’t afford to take the free help,” Braun said. “That was very revealing for us and for a lot of the utilities [that] were under pressure to explain why they weren’t accepting all these free goods and services.”

Franklin also produced another important insight: Managing expectations is key when cybersecurity experts swoop in to help utility operators.

Many of Franklin’s volunteers work at large organizations and have unrealistic assumptions about how much technological and organizational change they’ll be able to implement in short order. Meanwhile, many utilities have unrealistic expectations about how Franklin’s security evaluations will work. Over time, Franklin’s leaders have learned how to prepare both sides. Now, Braun said, “everybody walks into the first conversation with more of a ‘we’re going to meet folks where they are’ frame of mind.”

Franklin’s biggest challenge, however, is outside of its control. Over the course of the program, some utilities have dropped out as other responsibilities have monopolized their time — “like PFAS or lead pipes or other important things that I’m glad they’re dealing with,” Braun said.

The problem is especially acute in the tiny communities that need Franklin’s help the most.

“When you have to run a whole city by yourself with two or three people, it’s hard,” Johnson said. “My focus is on keeping the water running through town and the toilets flushing. … I’ve got to make sure 1,500 people have a glass of water [to] drink when they get up in the morning.”

That reality, Braun said, is “why the [cybersecurity] problem is so intractable.”

---

“My focus is on keeping the water running through town and the toilets flushing.”

Chelsie Johnson

Superintendent of Public Works, Wilder, Idaho

---

AI data centers and word of mouth

Franklin is a tiny program dealing with one of the largest and most dispersed critical infrastructure sectors. Braun compared the situation to election security, his previous focus with the DEF CON community, and predicted that it would take “10 times the effort to make a similarly unsatisfying amount of progress in the water industry.”

Still, his volunteers’ commitment gives him hope. “The fact that we’ve got folks that have been around for two years is shocking to me,” he said. “We’ve got people beating down our doors to do more and get assignments to more utilities.”

To harness that enthusiasm, Franklin is looking at scalable ways to expand its support. Braun is especially interested in helping the water utilities that cool AI data centers, which he sees as growing targets for nation-state hackers and cybercriminals.

Franklin’s volunteer model has its advantages and its limitations. It connects utilities with help they might never have received otherwise, but its periodic engagements can’t replace managed security services, and its maintenance, vigilance and planning recommendations don’t come with funding or personnel. Plus, its reach pales in comparison to the size of the sector.

Even so, there is another reason for optimism: Franklin’s impact is already spreading beyond its partner utilities.

Every few months, Johnson, the public-works director in Wilder, Idaho, meets with her peers from equally small neighboring cities. Since she started working with Franklin, she has used those meetings to tell her colleagues about the security improvements she’s making.

“I brought [multifactor authentication] to our last meeting, and they were, like, ‘How do you do it?’” Johnson said. “I showed them … and they were, like, ‘That is so cool.’”

She recently learned about passkeys and plans to explain them at the next meeting of cities.

“They may not have the support that I do,” she added, and “I’m [in] no way a cybersecurity person, but if I can help them with the little stuff that I know [and] pass [it] along, I think it’s a big deal to them.”