As @PatrickCMiller, @hacks4pancakes and @chrissistrunk say in this article, it would difficult to make dangerous changes.

Why is that with water systems? Or more generally, why? https://www.vice.com/en/article/akdqxk/why-cybersecurity-experts-hate-teamviewer-the-software-used-to-tamper-with-florida-water-supply

The specific chemical here was sodium hydroxide, normally at 10ppm.

It's not disinfection, it's pH control. When your water gets acidic, it causes corrosion, which in turn means that metals (including heavy metals) can get into the water.

It was apparently dosed at 10ppm here.

That's 10 parts per million. ppm is also mg/L

That's 0.01g per litre.

10g per tonne of water. It's a tiny amount.

The aim isn't to get 10ppm of sodium hydroxide in the water output from the plant.

The aim is to get the pH right, about neutral.

So these values are what is *dosed*, not what is *output*.

There would have been some kind of closed-loop control system here, aiming to get the pH correct.

This could have been continuous pH monitoring, it could have been someone with pH paper every day or week.

But it was closed.

Lots of other dosing - like chlorine - looks for a given amount output from the system (e.g. free chlorine).

Most systems like this are under tight closed-loop control with sensors changing the dosing.

The system would have been designed to handle a given range of input pH and a given flow rate.

It could have dosed anything from 0ppm up to maybe 500ppm tops, probably lower.

11,100ppm would have not been physically possible.

There are also frequently downstream devices that will only accept a range of inputs. A PLC connected over Modbus that can only ever dose at 100ppm maximum.

But even if it were pushed high, a lot of drinking water systems make heavy use of reservoirs.

Even if the output from the plant was high, it would take even longer for the reservoir to become high.

It sounds like this plant had physically present operators as well.

It's highly likely this would be detected by other means.

For example, why is the sodium hydroxide tank going down this fast?

Why is the pH wrong?

None of this absolves leaving TeamViewer open.

Gas is probably as resilient as water.

Our gas systems make heavy use of compressors and regulators, moving massive amounts of gas at high pressure and dropping it down for distribution to houses.

It's at an almost comically low pressure once it reaches your house (in the UK)

But, for the most part, the pipework is built to stand a given pressure, and the design of the physical systems prevent overpressure.

Electricity... hmm. Again, the regulation systems (today) for frequency and voltage would be really hard to subvert.

You could change a tap changer to give someone more voltage, but they are only designed to operate inside the normal sag/surge.

It's not like you can give someone 11kV instead of 240V.

The point is, to make these systems do really bad things, you need to do something a little bit more serious than just tweak one parameter.