Updated 2/10/2021 at 8 PM ET: In a statement, Express Water said that high concentrations of lye would wreck their reverse osmosis filters.
Updated 2/9/2021 at 4 pm ET: The manufacturer of Berkey filters says they have no testing data on lye, and John Squires of St. Paul Mercantile told us that activated carbon does not filter lye.
Unsettling news today out of Florida: Pinellas County Sheriff Bob Gualtieri held a press conference to announce that last Friday, an intruder infiltrated the City of Oldsmar’s water treatment system. The attacker spiked the levels of lye in the water to exceedingly dangerous levels.
This is wild.
Here you have multiple local government officials on camera saying that a hacker was very close to poisoning an entire town by breaching a water treatment facility
— Chris Bing (@Bing_Chris) February 8, 2021
Fortunately, the attack was caught and reversed quickly, before the water was contaminated.
But this is scary — a terrorist got close to poisoning an entire town — and is part of a larger trend of cyberattacks. For example, Israel’s water grid is a frequent target from suspected state actors like Iran, and the US defense community is aware of and constantly monitoring for these kinds of attempts. They happen more often than most people think. And in recent years, this kind of “probe a small target to see if it’s possible and how they react” pattern is a growing cause for concern.
So what can you do to prepare for this?
- There’s obviously no real warning for this. The citizens of Pinellas County couldn’t have done anything reasonable ahead of time to know this was coming.
- Even if the attack wasn’t caught just in time and contaminants did go out, it would likely be back to normal within a few weeks.
- A core part of the basic emergency preparedness checklist is to store at least a few weeks of potable water in your home, ready to use at any time with no advanced warning. Imagine if the water system had to shut down for a few weeks to clean out the problems, for example.
- We love using countertop water filters in daily life, not just during known emergencies, partly for this reason — but while such water filters are effective at reducing chemicals, it’s uncertain if they’d be able to handle that amount of lye. We contacted New Millenium Concepts, the maker of the Berkey filters, and they told us they do not have testing data on lye. John Squires of St. Paul Mercantile said lye would not bond to the activated carbon in his filters. Express Water said that high concentrations of lye could bypass and ruin their filters. The consensus seems to be that these products would not protect you from this attack.
- Whether or not you have a countertop filter or something equivalent like a reverse osmosis system plumbed into your home, you should have a bug out bag / emergency kit with water filters or disinfectants that can create more potable water once the stored stuff runs out (or if you need to leave your home and can’t take the big systems with you.)
- Follow your local news. This story might not make big national news, but you’d sure want to know about this quickly if you lived in the affected area.
Learn everything you need to know about water preparedness and survival in our online video course, taught by a SERE instructor and the founder of The Prepared. Over 7 hours of lessons for only $49. You’d be able to handle events like this Florida hack better than 99% of people around you!
What we know about the attack
On the morning of Friday, February 5, 2021, an attacker infiltrated the computer system that runs the City of Oldsmar’s water treatment facility. The operator on duty noticed the system’s mouse cursor moving on its own and watched as the intruder opened the control panel and increased the level of sodium hydroxide (lye) from 100 parts per million to 11,100 parts per million.
Thankfully, the operator on duty noticed the increase and immediately lowered the sodium hydroxide to the appropriate level. City and county officials repeatedly stated that multiple pH sensors in the water system would have caught water with such a high pH after being tainted with dangerous levels of lye.
That’s of course assuming an attacker couldn’t disable those systems as well.
Officials also said that it would have taken 24-36 hours for the tainted water to reach the main water supply, so thankfully there are buffers in place.
What’s especially concerning about this cyberattack is that the City of Oldsmar has a population of just under 15,000. If it can happen there, it could happen anywhere. However, the good news is that the attack was a manual attack exploiting the TeamViewer remote access software, instead of automated malware that could run unchecked.
Authorities currently do not have leads on the perpetrator, but the attack is similar to water treatment attacks in Israel last year that have been blamed on Iran. In April, attackers infiltrated a water treatment plant in Israel and raised the chlorine levels. As in Florida, the adjustment was caught and quickly corrected. Later in June, cyberattackers attacked water pumps in rural regions of upper Galillee and Mateh Yehuda in Israel.
We do not yet know if the attacks in Israel are linked to the attack in Florida.
Lye is extremely dangerous
Lye is a strong base with many uses, like cleaning drains, soapmaking, and water treatment, where it’s used to reduce the acidity of drinking water and bring it back to a neutral pH level.
Lye is also extremely caustic, and in its most concentrated form, basically melts skin. Drug cartels in Mexico use it to dissolve bodies. Contact with lye can cause severe and agonizing chemical burns, and if it gets in your eyes, instant and permanent blindness. If you’ve ever seen the movie Fight Club, you know how bad lye can be. (NSFW warning)
How dangerous were the levels of lye set by the attacker? Our resident scientist, Ari Allyn-Feuer, did some back-of-the-napkin math and estimates that the resulting pH level would be about 13.6, or about the same as undiluted lye.
The idea of pure lye coming out of a tap is frightening, to say the least. Imagine turning on a tap to wash your hands and being immediately subjected to an excruciating chemical burn. It would also probably do serious damage to water pipes both inside and outside your home.
If you experience a lye burn, despite what Fight Club’s Tyler Durden says, the best treatment is large amounts of water, not vinegar, the latter of which will do nothing or actually make things worse. That’s yet another reason to keep water storage on hand.
Would your preps handle lye?
In the time window where the lye is going through the grid but the public doesn’t know about it yet, the first line of defense would likely be a countertop water filter like the Big Berkey or a plumbed-in reverse osmosis system throughout your house. Unlike portable filters, bigger at-home filters can treat chemicals, toxins, and other contaminants that dissolve into the water.
New Millenium Concepts, the company that produces the Berkey water filters, told us that they do not yet have testing data on how well their filters handle lye. John Squires of St. Paul Mercantile told us that activated carbon does not bind to lye and that your best bet in case of accidental lye ingestion is to drink milk. A reader contacted Express Water to ask if their reverse osmosis filters would work against lye, and this is what they said:
In small amounts(the amounts deemed acceptable by the USEPA for disinfection purposes), regular replacement of the prefilters will mitigate any sodium hydroxide in your water. However, in extreme and irresponsibly high concentrations, some Sodium Hydroxide(commonly known as lye) can make it past the carbon prefilters, and may foul the membrane, thus allowing the sodium hydroxide to pass through. The filters would all need to be changed immediately, and we would recommend following your water provider’s instructions of flushing your water(these instructions would likely go out if an incident like this was actually executed before it was caught) before installing new filters.
We’re skeptical that any filter could work against such a high concentration of lye, but if an attacker boosted the amount of another chemical in the water, like chlorine, it might be effective.
More: Review: St. Paul Mercantile water filter
Unfortunately, a countertop water filter wouldn’t do much to protect you if you washed your hands or hopped in the shower. You’d also have to be alerted by the water company before you knew to filter or avoid the water, and that may not happen in time. Pinellas County, Florida waited three whole days before alerting the public.
A whole-house reverse osmosis filter might be more effective, but again, there are no guarantees when dealing with such high concentrations of chemical contamination.
The types of portable products you’d have in a go-bag would not remove lye from the water. So in that case it’s not about treating the lye-laced water — it’s about finding other sources of water from something like a nearby lake and using those portable products to make that water safe while waiting for the grid to come back online.
Learn how to handle any water emergency with our new best-on-the-web video course.
You are reporting the comment """ by on