"Ancient Weapon": French Fears of Russian Targeting of Drinking Water

French media have raised questions about the possibility that Russia might resort to an "ancient weapon of war" to cut off drinking water supplies to the French, recalling an incident that occurred in March 2024.

At that time, pro-Russian hackers boasted that they had taken control of a French dam, before it became clear that it was not a dam but a small hydroelectric mill in Corlandon in the Marne region, where they lowered the water level by 20 centimeters, as reported by the newspaper "Le Monde" at the time.

But the magazine "Challenges" now sees this as evidence of the ability of groups linked to Russian military intelligence to penetrate industrial control systems, asking: "What if the target were not a mill but a station feeding an entire city?", especially since major companies are relatively prepared, while small municipalities remain the weakest link.

Ancient Weapon
The magazine noted that water is an ancient weapon of war, as the Ostrogoths cut off the city of Rome during their famous siege between 537 and 538 AD, aiming to force its surrender by cutting off its vital water artery and preventing the operation of the water mills on which it relied to produce flour.

According to "Challenges," Russia used this method in Syria and then in Ukraine, striking water facilities in Kryvyi Rih in September 2022. It believes that the first front in any confrontation with Russia will likely be digital, and that it is already open.

Recorded Vulnerabilities
The National Agency for Information Systems Security (ANSSI) counted, until the end of 2024, 31 cyber intrusions against entities in the water sector since 2021, including 8 involving ransomware—data or digital systems held hostage by internet hackers who prevent owners from accessing them and demand financial payments (ransom) for their release.

In April 2024, a municipality lost remote control over its production but maintained distribution in a limited mode, according to the magazine, which clarified that these attacks are mostly cybercrimes motivated by profit, not a Russian campaign, but they reveal vulnerabilities that Kremlin hackers could exploit.

Weakness in Fragmentation
Companies Veolia, Suez, and Saur, which dominate the water management and sanitation sector in France, supply about 60% of the population. Alongside them are many local public bodies, some of whose equipment is old and rarely meets advanced information security standards.

Frank Galland, associate researcher at the Strategic Research Foundation, states: "The real danger lies in rural public bodies, because their capabilities to protect their facilities are limited."

Physical Sabotage and Drones
Moscow could also strike physical resources: sabotaging pipes, disabling pumping stations, targeting factories, as well as the electricity grid on which a large part of treatment and distribution depends.

Galland fears the use of "useful idiots" from the far right or far left to carry out sabotage.

However, the most important facilities are well protected, with fences, closed doors, cameras, alarms, and intrusion detectors linked to security forces. Protection has increased since the attacks of September 11, 2001, and since the Ukraine war in 2022. But drones bypass these barriers, representing a new threat.

What About Poisoning the Water?
Workers in the sector reassure regarding poisoning, as pipes are equipped with sensors continuously monitoring several water quality parameters, and dilution greatly limits the risk of widespread contamination.

As for preparedness and alternatives, major companies are classified as "of vital importance," adhering to special security rules and repeating exercises with state agencies.

A security official at a major group, in contact with intelligence, police, and gendarmerie, says: "The key is anticipation." Simulations take place at his company's headquarters almost monthly, now including sabotage, hacking, and disinformation together, i.e., the hybrid attack scenario.

If a facility falls, there are alternatives: interconnections to bypass damaged equipment, tanks that continue temporary distribution, and continuity plans to operate at reduced capacity. Major companies can deploy mobile treatment stations, as seen in natural disasters abroad.

As a last resort, water is transported in bottles and tankers, with priority given to hospitals and essential services. The magazine concludes that "no network is impervious," but operators have learned to face surprises.