Clean-water pumping started about 15 minutes late in one laboratory attack, even though the facility’s communications remained encrypted. Another attack left a simulated valve open for more than nine minutes longer than intended. Neither required access to the water plant’s internal systems or the ability to read its messages.

The University of British Columbia team calls its framework ICS-Sniper. The research is slated to appear at the Network and Distributed System Security Symposium in 2027. It examines a weakness in industrial systems that exchange monitoring and control messages with cloud services over the internet.

An attacker must first control a router carrying those communications, a significant prerequisite. From that position, the framework analyzes message timing, sizes and direction, then selectively blocks traffic. The tests demonstrate a threat to operational continuity without showing an attack on a working public utility.