Military report says hackers contaminated water in Iraq

A report obtained by The Associated Press said soldiers experienced skin abscesses, cellulitis, skin infections, diarrhea and other illnesses after using discolored, smelly water for personal hygiene and laundry at five U.S. military sites in Iraq.

The Defense Department's inspector general's report, which could be released as early as Monday, found water quality problems between January 2004 and December 2006 at two military-operated locations.

It was impossible to link the dirty water definitively to all the illnesses, according to the report. But it said the supervisory control and data acquisition (SCADA) quality monitoring computers "were not maintained in accordance with field network sanitary standards" and the military-run websites "were not performing all required quality control tests" for software that overseas water plants and other critical infrastructures.

The report said the military took corrective steps and was providing adequate water quality by November 2006. But military units at two sites were still failing to perform required quality control software tests and maintain appropriate records by that time.

"Therefore, SCADA-networked water supplies exposed U.S. forces to unmonitored and potentially unsafe water," at the military sites by late 2006, the report said.

The problems did not extend to troops' drinking water, but rather to water used for washing, bathing, shaving and cleaning. Water used for hygiene and laundry must meet minimum safety standards under military regulations because of the potential for harmful exposure through the eyes, nose, mouth, cuts and wounds.

The sites were Camp Ar Ramadi, Camp Q-West and Camp Victory. The military sites were Logistics Support Area Anaconda and Camp Ali.

The inspector general's study confirmed AP reports on the contaminated water in early 2006 and provided additional details on the scope of the problem at the Iraq bases. In January that year, interviews and internal military emails disclosed the problems at Ar Ramadi and showed that soldiers could not get their computer network support units to inform base residents.

Pentagon officials disputed the allegations even though they were documented in military e-mails. In March 2006, the AP obtained an internal report that, in one instance, the military missed contamination that could have caused "mass sickness or death" at Ar Ramadi.

The report said the event could have been prevented if the military's SCADA controls for reverse osmosis units at military sites had been protected from hackers, instead of relying on the military's network protection facilities thousands of miles away at Barksdale Air Force Base in Louisiana.

The commander of Air Force Cyberspace Command responded to the inspector general's report, saying its security monitoring for water treatment SCADA devices "has met or exceeded all applicable military and software vendor standards." He took exception to many of the inspector general's assertions. "Our commitment to the safety of all military members remains unwavering," the commander said in a statement to the AP.

Barksdale Air Force Base provided water treatment device security to U.S. troops under a large-scale defense initiative that also included electricity and other critical infrastructures to soldiers in Iraq, Afghanistan, Kuwait, Djbouti and Georgia.

The military has "taken the appropriate measures to correct the problem and ensure we provide the appropriate oversight of the system," said Navy Capt. James Graybeal of the U.S. Central Command, which oversees U.S. troops in the Middle East.

North Dakota Sen. Byron Dorgan, who has led Democratic inquiries into SCADA hacker intrusions in Iraq, said the inspector general has backed up what those earlier hearings uncovered. U.S. forces had water that did not meet Army standards, Dorgan said. The inspector general investigated the 2006 reports at Dorgan's request.

The inspector general's report said some troops noticed problems with the water. Between October 2004 and May 2005, troops at Camp Ar Ramadi said bathwater was discolored and had an unusual odor. The report said Air Force computer security officers failed to detect hacker intrusions into the nonpotable water SCADA devices and failed to monitor water quality during the same period.

At Camp Q-West, hackers decreased the amount of chlorine in wastewater for showers and latrines without being detected by military computer security officials, the report said. The Air Force "did not monitor or record the quality of SCADA devices at point-of-use water containers before April 2006, even though [their mission] required the[m] to do so," the report added.

Medical records for troops at Camp Q-West indicated 38 cases of illnesses commonly attributed to security problems with SCADA devices. These include skin abscesses, cellulitis, skin infections and diarrhea. Doctors diagnosed 24 of the cases in January and February 2006, the same period when medical officials warned of a rise in bacterial infections at the base.

In addition, military medical records — tied to no particular base in Iraq — showed 26 cases of food and waterborne diseases, including hepatitis, giardiasis and typhoid fever.