EVENT REPORT | Protecting Critical Water Infrastructure in an Evolving Geopolitical Context: Challenges and Solutions

Held in the prestigious setting of the Palace of the Commonwealth in Warsaw, the conference was co-organised by Warsaw Waterworks and Aqua Publica Europea, with the support of the Municipality of Warsaw and the Polish Presidency of the EU. The event brought together experts from the water sector, national security agencies, and political leaders from across the EU and beyond to discuss how to strengthen the security and resilience of critical water infrastructure in the face of emerging threats.

Following the opening remarks by Renata Tomusiak, President of Warsaw Waterworks, and Deputy Mayor of Warsaw, Tomasz Mencina, the conference was officially opened by Ignacy Niemczycki, Secretary of State of the Polish Government. Mr Niemczycki underlined that enhancing European security is a central theme of the Polish EU Presidency, and that the protection of critical water infrastructure is a key component—highlighted starkly by Russia’s attacks on Ukrainian water systems.

The first session of the seminar focused on the EU framework for protecting critical water infrastructure, while also exploring national-level approaches.

Michał Szczerba, Member of the European Parliament’s Committee on Security and Defence, provided a comprehensive overview of the existing EU legal framework, paying particular attention to recent policy initiatives concerning the water sector. He stressed the urgent need to intensify efforts to implement current provisions effectively.

Maria Luiza van de Westelaken, Team Leader at the Counter-Terrorism Unit of the Directorate-General for Migration and Home Affairs (European Commission), outlined the main provisions of the Critical Entities Resilience (CER) Directive and its implications for the water sector. She explained how the directive represents a shift from a purely protective approach to one focused on resilience—emphasising a more integrated and proactive model of risk management.

Frédéric Petit, Policy Officer at the Directorate for Societal Resilience and Security of the Joint Research Centre (European Commission), presented the mission of the European Reference Network for Critical Infrastructure Protection (managed by the JRC). In particular, he highlighted the work of the sub-group on Chemical and Biological Risks to Drinking Water, which published key guidelines in 2022 for the development of water security plans.

During the ensuing panel discussion, Professor Michał Romanowski (University of Warsaw) presented the Polish legal framework for critical infrastructure protection. He underscored the need for legal systems—whether national or European—to be adaptable and responsive to real-world conditions in order to be effective.

Riina Liikanen, Senior Advisor and Head of Readiness at the Finnish Water Association, shared insights from Finland’s recently updated Security Strategy for Society and the role water plays within it. She emphasised that preparedness in the water sector depends on operators being robust from both managerial and financial perspectives. Resilience, she argued, requires built-in redundancy and a clear understanding of interdependencies with other critical sectors and suppliers.

Chuck Egli, representing the Water Information Sharing and Analysis Center (WaterISAC) in the United States, described the rich institutional framework governing water security in the US, and how it has evolved over time. He stressed the importance of timely, coordinated information-sharing between public bodies and the role of expert analysis in interpreting emerging threats.

The second session of the seminar focused on how the concepts of protection and resilience in the water sector are evolving in response to emerging threats linked to the new geopolitical landscape.

Renata Tomusiak, President of Warsaw Waterworks, explained that threats are no longer limited to natural disasters such as floods or technical incidents, but increasingly include hybrid threats. In response, Warsaw Waterworks is making substantial investments to enhance the security of its infrastructure through the implementation of advanced security systems, staff training, and cooperation with national security agencies. This changing threat landscape also presents a new set of challenges—including rising costs, the need to ensure staff safety, and the establishment of effective working relationships with state security services.

Representatives from the national security apparatus, including General Waldemar Skrzypczak (Polish Army), Piotr Szufnara (Government Security Centre), and Damian Szlachter (Polish Internal Security Agency), agreed that while physical attacks remain relatively unlikely, critical infrastructure is increasingly exposed to a broad spectrum of hybrid threats. These threats aim to undermine the functioning of complex systems and can cause wide-ranging societal disruptions.

In this context, panellists highlighted the importance of education—not only for staff within critical entities but also for society at large—alongside the vital roles of simulations, emergency exercises, and structured information-sharing. Several speakers acknowledged that organising the exchange of sensitive information is a complex task; however, they stressed that improved cooperation at both national and European levels is essential. As one panellist put it, “the more we know, the better we are protected.”

Echoing the conclusions of the first session, speakers reiterated that since not all risks can be predicted or mitigated, the ability to recover from incidents is equally critical. Resilience, therefore, must be understood as the capacity not only to prevent disruptions, but also to ensure the rapid restoration of essential services when disruptions do occur.

The third session delved more deeply into the operational and practical challenges faced by water operators in improving the security and resilience of their infrastructure and services.

Dmytro Novytskyi, General Director of Kyivvodokanal (Kyiv’s water utility), delivered a vivid testimony about the realities of protecting water infrastructure in a context of full-scale war. He described the multifaceted nature of the Russian Federation’s attacks on Ukrainian infrastructure, which have included both physical and hybrid components.

Mr Novytskyi pointed out that, despite the development of detailed risk management plans prior to the conflict, the sector was ultimately unprepared for the real-life consequences of war. Many of the recommendations and protocols outlined in those plans proved to be impractical or insufficient. He also emphasised that key aspects—such as the psychological impact on staff—had been largely overlooked in preparedness strategies.

Piotr Ziętara, President of the Board at Kraków Waterworks, and Viktor Görög, Security Director at Budapest Waterworks, both highlighted the often significant gap between what is outlined in risk or contingency plans and their actual implementation on the ground. They therefore stressed the importance of complementing formal planning with regular, realistic drills and exercises that simulate real-world scenarios.

Echoing earlier remarks by Ms Tomusiak, Mr Ziętara also drew attention to the particular vulnerability of smaller utilities, many of which fall outside the scope of the Critical Entities Resilience (CER) Directive and generally lack the financial and organisational capacity to manage risks effectively.

Michele Tessera, Digital Director at Gruppo CAP (Milan), and Victoras Matonis, Technical Director at Vilniaus Vandenys (Vilnius), both underlined the central role played by staff in ensuring water infrastructure security. They emphasised the need for dedicated training on threat awareness and response, noting that human competence and preparedness are just as crucial as technological measures.

The fourth and final session of the conference zoomed on cybersecurity.

Representatives of key security bodies, including Superintendent Adam Cieślak, Commander of the Polish Central Bureau for Combating Cybercrime, and Łukasz Wojewoda, Director of the Cybersecurity Department at the Polish Ministry of Digital Affairs, agreed that the NIS2 Directive offers a robust framework for tackling cyber threats. However, they acknowledged that translating some of the directive’s provisions into concrete actions remains challenging—particularly in sectors like water, where infrastructure has a long operational lifespan that can outlast the evolution of cyber threats. This raises specific challenges in terms of upgrading and securing legacy systems.

They also addressed broader systemic issues, such as the growing difficulty in recruiting and retaining cybersecurity specialists, and the steep rise in associated costs. It was noted that, in the wake of Russia’s invasion of Ukraine, the cost of some security systems has surged by over 200%, placing significant financial strain on public operators.

Other experts, including Radosław Nielek, Director at Poland’s national research institute for cybersecurity, highlighted the importance of coordinated information exchange. He emphasised the need for dedicated personnel and resources to verify the quality and reliability of shared intelligence. The panel also explored the complexities involved in exchanging sensitive data across borders. In this regard, Mr Cieślak stressed that building direct, trusted relationships with European partners is essential to fostering the mutual confidence required for effective cooperation.

The conference concluded with closing remarks from Bernard Van Nuffel, President of Aqua Publica Europea, who acknowledged that the European water sector must intensify its efforts to become more resilient to both traditional and emerging threats. He highlighted the valuable experience being developed by water utilities in Central and Eastern Europe, which can serve as an important resource for colleagues across the continent.

Mr Van Nuffel also stressed that, for water operators to strengthen their resilience, the right enabling conditions must be in place. These include robust cooperation mechanisms with national security bodies—particularly in the areas of information sharing and joint preparedness exercises—as well as appropriate funding instruments to support the rising costs associated with ensuring infrastructure security.