AI and Securing Water Systems with Feras Batarseh

(music)

Travis

There very few things I feel comfortable saying that we all have an agreement, but water, clean water that is, might just be one of them.

In fact, can't say I've ever met a person who doesn't see the value of having clean water, even though admittedly some of us may not drink enough of it on a regular basis. So ensuring that our communities have access to this vital element seems to be in all our best interest, but I'm curious exactly how we're going about making sure that happens. Specifically, I'm curious how we're leveraging advanced technologies to protect both against natural occurring threats to water, but also threats from bad actors.

Thankfully, this is exactly the intersection Virginia Tech's Firas Batarse studies, and he was kind enough to answer all my questions. Firas is an associate professor with the Department of Biological Systems Engineering and the Commonwealth Cyber Initiative. We talked about some of his work that involves using artificial intelligence and machine learning to monitor and then better predict problems with water quality, as well as cyber attacks on water systems.Feras also shared some of the work he, his colleagues, and students are doing at Virginia Tech's AI and Cyber for Water and Ag lab, as well as what drew him to this interesting intersection in the first place.

So if you like water, and I think most of you do, it's worth your time to hear how for Ross and his colleagues are helping us keep it flowing. I'm Travis Williams, and this is Virginia Tech's Curious Conversations.

Travis

So before we jumped on here, we were talking, you and I were talking a little bit just about this interesting intersection of water and technology and how much really our water quality, my water quality is dependent upon technology. And so you're telling me this interesting story about something that recently happened in Washington, D.C. that I just I think it illustrates this greatly. So could you please maybe share that with the folks that will listen to this?

Feras

Yes, for sure. Yeah. So in July 2024, very recently DC Water, DC Water is the main water management entity in the district and also many parts of North Virginia, different counties in North Virginia as well. They issued a boil water advisory for all their customers, which are basically in DC, Pentagon, Arlington, the Reagan National Airport region and so on. it was, they declared it was a precautionary notice to all customers to boil the water before they ingest it. So not to drink tap water, not to use it in any form before it's being boiled. The reason for that is they realized with the help of the Corps of Engineers that the water has very high turbidity, the water that's being released to urban use and homes and houses and so on it has very high durability. And high durability means the water has more, has things in it, content, could be phosphorus, could be nitrogen, could be different components that are not good for human consumption. Now, in that case, you know, this is a, it's a difficult thing to identify without using technology, but it's actually much, much more easier if technologies like AI and data are used. For example, our lab has been working with DC Water for a long time, and we've developed all forms of models, AI models, that can predict water values. So when we talk about water values, we're talking about water flow, pH levels, certain amounts of nitrogen or phosphorus in the water. We're talking about even water pressure, pumping, all kinds of different values that are relevant to to water quality and quantity and availability, right? So in this case, at the Equal Lab, we have a turbidity sensor that we've been developing models around, we've been creating data around. Turbidity sensors work well. They can tell you how turbid is your water. And using AI, you can start to predict based on certain seasonalities and certain events that happen in the outside world, external factors that impact your water. You can start predicting things like that. So there's really, there's no reason for, you know, water treatment facilities around the country to not be able to have preventive measures for water quality.

Travis

Well, it sounds to me like if we have better technology and using, harnessing things like artificial intelligence, we can better predict these problems and kind of stop them before we get to a boil notice. so that we don't have, so the people in the White House don't have to boil the water.

Feras

That's a good way to put it. I agree with you. there's the need for AI is there are many reasons why we need AI, but one of them and the most pressing one is that our adversaries are using AI and many, many of the other players in this domain that are trying to poison the water, change water quality in the United States are using intelligent methods to change those values and variables in our water. So for us to be able to confront that, detect that, and be able to mitigate those risks, the only way today where the state of the art is, state of the science is, is to use AI. Now, using technology overall, for instance, in water systems, most water systems are relevant, are reliant, sorry, on SCADA systems. SCADA systems, they're traditional legacy infrastructure systems that allow the software to interact with the hardware layer and so on. So those systems are, you know, have been in place for years and they're used all over the world. So that's fine. But then the layer of AI sits on top and allows us to better measure all the inner workings of the system in a way that will allow us see any slight changes. Machine learning, which is a form of AI, is one of the prime ways to identify minimal changes in values. And those minimal changes, when we're talking about water quality, are very substantial. Because if we say there's a minimal rise in nitrogen, then that's dangerous for human health. So obviously, we can't allow that. So this granularity that only AI allows or is able to identify is very important, especially in the age of big data. So now most treatment facilities, have massive data sets. It's very difficult for them to pinpoint a change in value just right away without using detection algorithms such as using machine learning and deep learning. And I can provide an example of what happened in Florida most recently. Those are the prime examples when it comes to cyber incidents.

Travis

Yeah, I'm curious when it comes to cyber attacks because the idea of a cyber attack on our water or somebody being able to infiltrate and change the quality of the water, me and my family drinks from another country in that way, it kind of blows my mind. So I would love to hear maybe what some of these bad actors are doing if they are...trying to just cause chaos, if they're trying to steal information. What's going on when somebody does a cyber attack on a water facility, what are they generally trying to do?

Feras

Yeah, yeah. So I'll begin with two quick examples. The most recent one was a cyber incident on a treatment facility in Texas. And what happened in that case is that there were, in three days, there were more than 35,000 attempts at breaching the system in three days. So when we say 35,000 in three days, that then automatically tells you that's not a single person. That's a bunch of bots or a group of electronic armies and stuff like that, That incident was this year. It occurred this year in Texas.

And in an area called Mule Shoe, 60 miles, I guess, west of Dallas, I think. the goal of that incident was to get into the system and collect all the data and take control of the software. Now, luckily, that was detected in time. After the damage happened, the systems were shut down and it didn't continue. But still the systems were shut down, meaning the water treatment stopped for a good amount of time. Another more obvious example is what happened in Florida before that. What happened in Florida is that the attackers, changed the amount of sodium hydroxide that is measured by the sodium hydroxide sensors in the water. So they changed one value and by adding a few zeros to how much sodium hydroxide should be added to the water.

Now, adding this many zeros to sodium hydroxide means much more water, means that if this water is released, the second it's in contact with humans, it will burn skin, it's fatal, it's very dangerous. That much sodium hydroxide is very dangerous. So that attack occurred and it impacted the water in Florida. The treatment facility is in Oldsmar, Florida, it's a small town. There were no fatalities, there were no deaths or anything like that. But this is an example of a slight change in the data that leads to a massive change in the biological system. That small change is only detectable using a tool or a set of tools or algorithms like AI.

Travis

 Yeah, so it sounds like using artificial intelligence allows us to see those really tiny changes that...indicate that a bad actor is doing something we might otherwise miss. It sounds too like maybe, I mean, I don't do 35,000 of anything in any given three days. So it sounds like too maybe just having those monitoring systems in place just may help us better protect somebody that's maybe trying to get in as well. Is that something you all are working on?

Feras

Yeah, that's true. So now, you know, we're talking about mitigation or protection on the other side. So there's a really rising field in AI that's referred to by the Department of Defense as counter AI. So when you're compromised or an adversary is using intelligent algorithm to attack or to change your system, your infrastructure, building AI algorithms that are able to not only defend, but also counter attack is a rising field. So the Department of Homeland Security has this list of 16 critical US infrastructures that are critical to our nation, obviously critical to our well-being and for the country to keep going in many ways. Water systems is one of those, obviously, and it's now deemed as one of the first targets for cyber attacks. The sensitivity with water is that the damage can happen much faster. Water systems are more real time, the treatment is more real time. besides human health, water could be dumped into rivers as treatment facilities do. Like for instance, many of our partners in this area, the treated water gets dumped into the Potomac River. And the Potomac River has all forms of ecosystems around it, including recreational activities by humans, including all forms of different forms of life in that system. So the well-being and the water quality in rivers has impact as well across different environmental aspects and so on. not only human health, not only urban and drinking water and all that stuff, but also there's an environmental impact as well.

Travis

Yeah, there's a lot that goes into that and I think anybody who listens to this probably knows how often and how much water impacts their lives And if not, maybe they will think about that after this. I know there's a term that you've coined for this type of work cyber biosecurity Which is which is a really interesting term. How do you describe cyber biosecurity?

Feras

Yeah, so some of us here as you mentioned it was a coin that Virginia Tech by and the idea behind cyber biosecurity is that to stress the difference between cyber biosecurity and cybersecurity. So cyber biosecurity's challenge is that you have a biological system involved. And you have a direct contact with a biological system that is impacted by the cyber attack.

So as biological systems become more dependent on technology, just like we're describing, as they, because they, you know, we need to improve their quality and so on, they become more prone to cyber incidents and the overlap between the biological, cyber, and even physical components is very high. So think of a bio lab that runs experiments on even...in many cases, medical in the medical domain or or in many cases, if we talk about water systems, you have sampling machines, have machines that do different forms of microscopes and so on, right? All those machines today have IP addresses and have are, you know, technically hackable, meaning they could be they could be breached by an external player unwarranted access player. that those machines have direct access to control over biological components that can be very dangerous, even such as pathogens and viruses and chemical material that we don't want to be released from the lab. We don't want it to be in touch with humans. We don't want to be in the wrong place. And given those components now, visual components are being controlled by technology. Cyberbio security became kind of lent itself to be introduced because you have to protect your biological assets. And that was the main driver behind pushing this field forward. There's a lot of interest from, obviously, the US government, different agencies, and many countries around the world now are starting to get on board with this issue and its importance.

Travis

Yeah, you mentioned a lot about some of the challenges, and it does sound like that this is a an emerging area and it just sounds like there's just a lot of challenges there. What are some of the things that we are doing at Virginia Tech right now to maybe help meet some of the challenges, specifically at your lab and in this test bed?

Feras

Yeah, so we're doing a lot of things. So one of the things that we're doing is as part of the Center for Advanced Innovation in Agriculture, which is short for it is KIA, Virginia Tech, became a founding member of an information sharing and analysis center focused on agriculture and agricultural systems. And that's in collaboration with other universities across the country. But we are helping this, what's referred to as the ICAC, create a repository of different forms of attacks so that the research community or the private sector industry are aware of the different forms of cyber incidents in cyber biosecurity. because cyber attacks are different, not all attacks are created equal, how you deal with different attacks, and we talk about counter AI, how you counter different attacks requires different algorithms and different technologies. So to understand the landscape of those attacks is very important. Now, some companies, like for instance, there's the attack framework, there's, MITRE has that framework, the private sector has a lot of different cyber, taxonomies and structures that allow us to classify what each attack is, but not for cybersecurity, not for cyber biosecurity. And that's the differentiator here, is that you need to understand the dependency on the biological system from the cyber component and vice versa to be able to classify those attacks, because their impacts are completely different than conventional cybersecurity. So so VirginTech, we're part of that national coalition, if you will. We're also, we introduced the first cyber biosecurity course at VirginTech. So we have a graduate course dedicated to cyber biosecurity. It's in the Department of Biological Systems Engineering, BSE. As part of the Commonwealth Cyber Initiative, CCI, CCI is also leading cyber security research development, workforce development, across the state of Virginia. And cyber biosecurity is one of the pillars, one of the main threads that CCI focuses on. So we collaborate with universities in the area, across the state, and we try to develop a workforce, train students, train even in many cases, water treatment operators, farmers, and other biological system operators and so on that will get them training and so on on this domain. And the last thing I want to mention is that we're closely working with many of the water treatment facilities in the state, as well as DC, North Virginia, Southwest Virginia, many places across the state to improve their systems, make them more intelligent and make them more cyber secure. Yeah, well, it sounds like you've got a tremendous amount of...partners that you're working together with, is great because I think collaboration makes everybody stronger.

Travis

I think you also mentioned, I can't remember if it was earlier or maybe it was before we were recording, that we have maybe the first testbed, like aqua testbed in the country or in the world, which was that?

Feras

Yeah, yeah. So yeah, AquaLab, right? So it's the first intelligent water systems testbed. And the reason we, there's another system in Singapore that is similar, but it's very different at the same time. So that's why I'm very careful to say if it's the first in the world or in the US, it's definitely the first in the US, but the one in Singapore, we collaborate with them all the time. It does not have the cyber component. It collects data and so on, but our lab is the only lab that can simulate cyber incidents on water systems. And then, have us develop solutions to defend against those attacks. yeah, the AI and cyber water and anchor system lab is the first of its kind in the world for sure. it's, you know, we actually also invite any water treatment facility or water treatment plant to, we can give them, you know, we can work with them, we can give them access to run scenarios, you know, with us in the labs to make sure that their systems are secure to maybe predict certain scenarios that might occur that they're worried about. We've met with many treatment facilities and most of them are very aware that this is a big issue, but they're unable to really do much about it because it's costly, it requires a lot of investment and so on. So we're trying to help as many treatment facilities in the region as possible, work with them closely to mitigate some of these issues.

Travis

Yeah, so sounds like an open invitation to come play in the test bed and learn how to be safer. That's true. Absolutely. Yeah, well that's great. Well, I am curious how you got into this field. Did you enter this from the water side or the cyber side of this equation?

Feras

Yeah, so I'm an AI scientist by training. My background is in computer engineering. So all my work is in AI and cyber. But I worked for the USDA for six years plus. And while at USDA, our team developed the USDA's data infrastructure. So we developed the data infrastructure for many of their trade data, production, yield, different agricultural commodities. And when we did that, we realized that, first of all, The agricultural and water systems are one of the forms of systems that are untapped into when it comes to technology. At the same time, they're one of the fields that can really benefit massively from those technologies. What's more important than improving our water security, food security, right? As we always say, water and food security is their national security.

It's very important and now with the rising forms and complexities of cyber attacks the computer networks and other forms of systems are you know conventionally there's been a lot of work in them to improve their security but the biological systems given their complexity it's a very interesting research question and it's a very interesting scientific pursuit to be able to marry those two areas the biological and the and the cyber component. And so that got me interested, but also actually gets a lot of students out of GenTech, graduate, undergrads, get them excited about how they can use AI in a good way to also keep away from the maybe constant stigma that's surrounding AI now with chat GPT and all the different tools, deep fakes and all that stuff. Unfortunately, AI has been used in ways that are not very...constructive I would say. So we try to make the case that AI is a technology that can be used to benefit the country, benefit our health and water quality.

Travis

Yeah, well that makes a lot of sense to me, why that would be interesting. I don't know a single person who doesn't use both water and food, so it's very applicable.

Feras

Absolutely.

(Music)

Travis

And thanks to Firas for talking to us about his work at the intersection of water systems and emerging technologies. If you or someone you know would make for a great curious conversation, email me at traviskw at vt.edu. I'm Travis Williams and this has been Virginia Tech's Curious Conversations.