Thirsting for Power: The Liquid Core of Critical Infrastructure
- Dennis Hackney
- 23 hours ago
- 10 min read
Freshwater is the wave of the future.
Welcome back to CyberSecureOT. If you are a regular listener of the podcast, I just covered a piece on the usage of freshwater here:
Today, we are diving into a single, indispensable resource that connects almost every piece of critical infrastructure on the planet. It cools the servers that run our world, it spins the turbines that light our cities, and it extracts the minerals that power our future. I’m talking about water.
In this post, we are going to look at the intersection of water scarcity, industrial demand, and the massive, expanding attack surface this creates for our operational technology networks.
Let’s get into it.
The Illusion of Abundance
Let’s start with a reality check about the planet we live on. You look at a globe, and it’s mostly blue. Seventy-one percent of the Earth's surface is covered in water. But that blue is a mirage when it comes to human utility.
Roughly 96.5 percent of all the water on Earth is in the oceans. It is saltwater, toxic to our crops, corrosive to our machinery, and fatal if we drink it. Of the remaining 3.5 percent that is fresh water, the vast majority is locked up in glaciers, ice caps, or deep underground aquifers.
When you strip it all away, the easily accessible surface fresh water, the lakes, the rivers, the reservoirs we rely on, makes up less than one percent of the global water supply. To put that in perspective: globally, we have about 8 billion people. According to the UN, greater than 2 billion of those people live in highly water-stressed countries. The per capita availability of fresh water is dropping every single year as populations grow and aquifers are drained faster than they recharge.
Now, you might think, "Dennis, why not just build more desalination plants?" I've been around enough massive industrial sites to tell you that desalination is an engineering marvel, but it is brutally expensive and incredibly energy-intensive. You are forcing saltwater through reverse osmosis membranes at thousands of PSI. It costs anywhere from fifty cents to over two dollars to produce a single cubic meter of fresh water, not including the massive capital expenditure to build the plant or the environmental cost of dumping hypersaline brine back into the ocean.
Here is a staggering comparison that highlights our priorities as a species. In the United States alone, we have over 2.6 million miles of fossil fuel pipelines, oil, natural gas, and refined products. If you want to move crude oil from Texas to New Jersey, we have a pipe for that. But fresh water? Water pipelines are almost entirely localized. Moving bulk water over thousands of miles is considered economically nonviable because water is heavy and traditionally cheap.
The result? For most of the global population, getting a gallon of refined gasoline shipped across the world is logistically easier and more reliable than getting a gallon of clean, piped fresh water.
And as we'll see, our most advanced technologies, the ones we are building our entire future on, are incredibly, violently thirsty.
The Data Center Drought and the OT Threat
We need to take a deep, hard look at the reality of the AI and cloud computing boom. If you read the tech blogs, you hear about the silicon. You hear about the gigawatts of electricity. But what is consistently brushed under the rug is the water.
Let’s establish some physics. Thousands of servers clustered together processing massive AI models generate an ungodly thermal load. You cannot just aim a desk fan at these racks. You have to remove that heat, and the most thermodynamically efficient way to do that at scale is through evaporative cooling.
Inside the facility, hot air from the servers is passed over chilled water coils. That water absorbs the heat and is piped outside to massive cooling towers. In those towers, the hot water is sprayed over a fill media while giant fans blow outside air across it. A portion of that water evaporates, pulling an enormous amount of thermal energy out of the remaining water. But that evaporated water is gone into the atmosphere. To keep the system running, the cooling tower requires a constant influx of "makeup water" from the local utility grid.
Before we get into the consumption statistics, it helps to visualize the thermodynamics of this process:
Key insight: A portion of that water evaporates. That phase change, from liquid to vapor, removes an enormous amount of thermal energy from the remaining water, cooling it so it can be cycled back into the building. But that evaporated water has gone into the atmosphere. To keep the system running, the cooling tower requires a constant influx of "makeup water" from the local utility grid.
The sheer volume of that makeup water is staggering.
Let's look at what just happened in May 2026 down in Fayetteville, Georgia. Last year, residents started experiencing noticeably weak water pressure during a drought. The county utility initially blamed residents for watering their lawns.
When they finally launched a proper investigation, they discovered that a massive, 615-acre data center campus under development had been secretly guzzling up to 30 million gallons of water [1][2][3]. Utility officials found two industrial-scale water hookups, one installed completely without the utility's knowledge. That is the equivalent of 44 Olympic-sized swimming pools of water.
And this isn't an isolated incident. The data center water wars are expanding nationwide [5]:
California: Because the tech hubs in the Bay Area and Los Angeles are saturated, developers are pushing into the Central and Imperial Valleys. State lawmakers are currently fighting to pass strict water transparency bills because these developers are exploiting loopholes to keep their massive water consumption hidden from local farming communities [4].
Corporate Pushback: Investors are currently staging massive pushes against major tech giants, demanding mandatory, exact disclosures of data center water and power consumption metrics [7].
Tennessee: Down in Memphis, xAI abruptly sidelined a crucial water reuse project for its massive supercomputer facility, raising massive alarms ahead of a potential SpaceX IPO [6].
So, as security professionals, why do we care?
It means the attack surface of the global cloud has fundamentally shifted into the physical world of municipal water utilities. A hyperscale data center relies entirely on its Building Management Systems (BMS) and Programmable Logic Controllers (PLCs) to manage these millions of gallons of cooling water.
If a nation-state adversary wants to cripple a US financial cloud or an AI infrastructure node, they don't need to burn a zero-day exploit against the server hypervisor. They just need to hack the cooling system.
So, as security professionals, why do we care?
It means the attack surface of the global cloud has fundamentally shifted into the physical world of municipal water utilities. A hyperscale data center relies entirely on its Building Management Systems (BMS) and Programmable Logic Controllers (PLCs) to manage these millions of gallons of cooling water.
If a nation-state adversary wants to cripple a US financial cloud or an AI infrastructure node, they don't need to burn a zero-day exploit against the server hypervisor. They just need to hack the cooling system. If I can breach the OT network and spoof the Human Machine Interface (HMI) to make it appear that makeup water is flowing into the cooling towers while the valves are actually slammed shut, those massive server racks will enter thermal runaway and physically shut down within minutes.
Turning Water into Watts
We’ve talked extensively about how we use water to cool our technology, but we also need to understand how water actually creates the power grid itself. When people look at an electrical socket, they see electricity. When I look at an electrical socket, I see water.
Let's start with Hydroelectric Power. According to the United States Geological Survey (USGS), understanding a dam requires understanding head (the vertical distance water falls) and flow (the volume) [11]. You take the immense kinetic energy of a massive river, block it up to build potential energy, and then force that water down a massive pipe called a penstock.
To grasp the scale of water involved, look at the statistics from Türkiye this month. Heavy seasonal rainfall boosted reservoir levels, allowing Türkiye to set an all-time monthly hydropower output record. Their hydroelectric plants generated a staggering 11.66 billion kilowatt-hours (kWh) of electricity in a single month, accounting for 41.4% of the country's overall electricity generation [9].
Explore the internal cross-section of a hydroelectric dam to see exactly how water pressure is converted into rotational energy:
Key insight: The turbine governor, a mechanical system now controlled by digital PLCs, must ensure water hits the blades at the exact pressure required to maintain a steady AC frequency on the grid without tearing the massive metal turbines apart.
But it’s not just hydro. Consider Geothermal Electricity, where we pump water deep into the earth's crust to generate steam to spin turbines [8]. And look at Green Hydrogen Production via Electrolysis, which is insanely water-intensive.
Based on pure chemistry, to produce exactly 1 kilogram of hydrogen, you need 8.92 liters of water. But you cannot use raw tap water in a Proton Exchange Membrane (PEM) electrolyzer [10]. The minerals will destroy the catalyst membranes. The water must be purified using massive Reverse Osmosis (RO) plants. When you factor in the rejected water and cooling requirements, practical PEM electrolysis consumes roughly 17.5 to 22 liters of water per kilogram of hydrogen [12].
The OT Threat Models for Power Generation:
Hydro Dams: If an Advanced Persistent Threat (APT) actor penetrates the OT network of a dam and spoofs flow sensor data, they could force the PLC to fully open the penstock valves while grid load is low, overspeeding and destroying the turbine.
Geothermal: Geothermal plants rely on precise pressure equilibriums. Spiking the pressure in an injection well can induce micro-seismicity—literally triggering localized earthquakes.
Green Hydrogen: If an attacker compromises the PLCs governing the RO water purification system, hard, mineral-rich water would flow directly into the electrolyzer stacks, destroying the plant's operational capacity.
Mining the Future: Lithium and the Atacama
For our final look, we need to talk about the physical ingredients of the energy transition. You cannot build a single EV battery or grid-scale storage array without lithium. But lithium extraction is a water-intensive, highly contentious, and heavily automated nightmare.
The bulk of the world's lithium comes from the "Lithium Triangle" in South America, specifically the Salar de Atacama in Chile, one of the driest places on Earth.
The traditional extraction method involves pumping ancient, lithium-rich brine from deep beneath the salt flats up to the surface. Miners lay it out in massive evaporation pools. According to recent industry metrics, traditional brine extraction requires pumping roughly 2 million liters of water—about 500,000 gallons—to produce a single ton of lithium [19].
A report from Mongabay detailed how this pumping is causing the Salar de Atacama to literally sink, while local groundwater levels have collapsed by more than 33 feet over the last 15 years [14]. There is fierce pushback from Colla Indigenous communities who fear their ancient water supplies are being permanently destroyed by mining giants [15].
Here in the US, the water wars have reached the highest courts. In Nevada, warring lithium companies have taken a massive dispute to the state Supreme Court over who holds the water rights necessary to operate their mines in Clayton Valley [20].
The industry is desperately pivoting to Direct Lithium Extraction (DLE), which uses advanced chemical filters to rapidly process brine and return the water to the aquifer [17][16]. But these "green" efforts face massive scrutiny [13]. Scientists recently revealed methods using PFAS—toxic "forever chemicals"—to extract 99% pure battery-grade lithium [18]. We are trading a water scarcity problem for a toxic chemical problem.
The Mining OT Threat Model:
A modern lithium mine is a highly autonomous industrial operation controlled by centralized SCADA networks. If an attacker breaches the OT network of a DLE facility and manipulates the chemical dosing PLCs, they could introduce the wrong chemical mixtures, destroying massive yields of battery-grade lithium. Worse, by manipulating valve sequencing, an attacker could cause an uncontrolled spill of toxic brine and PFAS chemicals directly into the fragile desert ecosystem.
Water is the lifeblood of our critical infrastructure. It is the liquid core of the modern world. And wherever water flows in industry, operational technology controls the valves.
As defenders, engineers, and operators, we have to recognize that protecting our water systems is quite literally protecting civilization from grinding to a halt.
Do your part. Audit your networks. Segment your IT from your OT. And never trust a physical process to a digital control without an analog failsafe.
— Dennis Hackney, Ph.D. OT Cybersecurity Leader | Creator of CORE | Host of CyberSecureOT
Transparency Statement: AI tools were utilized to assist in drafting and structuring portions of this article, image, and video generation. The author maintains full responsibility for the final content and its intended message. This content is provided for informational purposes only and does not constitute formal professional or legal advice.
Endnotes & References
[1] Tom's Hardware, Georgia Data Center Used 29 Million Gallons of Water. Available at: https://www.tomshardware.com/tech-industry/georgia-data-center-used-29-million-gallons-of-water
[2] Politico, Georgia data centers water. Available at: https://www.politico.com/news/2026/05/08/georgia-data-centers-water-00909988?fbclid=IwZXh0bgNhZW0CMTEAc3J0YwZhcHBfaWQKNjYyODU2ODM3OQABHgQPyaXdW5ACH-fdm0MHvdLtgfzOD6721UpdQOh19Tu9Uwv8anQlNLVw4QjW_aem_Fn2JWL64qjZS0qimp6Z77g
[3] Ars Technica, Data center used 30 million gallons of water without initially paying. Available at: https://arstechnica.com/tech-policy/2026/05/data-center-used-30-million-gallons-of-water-without-initially-paying/
[4] CalMatters, California Data Centers Water Transparency. Available at: https://calmatters.org/environment/water/2026/05/california-data-centers-water-transparency/
[5] Fortune, Data Center Georgia Arizona Water Wars. Available at: https://fortune.com/2026/05/13/data-center-georgia-arizona-water-wars/
[6] Politico, xAI Water Reuse Project. Available at: https://www.politico.com/news/2026/05/05/xai-water-reuse-project-musk-ai-spacex-ipo-environmental-project-ee-00896170
[7] Tom's Hardware, Investors push Amazon, Microsoft, and Google to disclose data center water and power consumption. Available at: https://www.tomshardware.com/tech-industry/investors-push-amazon-microsoft-and-google-to-disclose-data-center-water-and-power-consumption
[8] Department of Energy, Geothermal Electricity Generation. Available at: https://www.energy.gov/hgeo/geothermal/geothermal-electricity-generation
[9] Hurriyet Daily News, Turkiye breaks monthly hydropower generation record in April. Available at: https://www.hurriyetdailynews.com/turkiye-breaks-monthly-hydropower-generation-record-in-april-222518
[10] Department of Energy, Hydrogen Production: Electrolysis. Available at: https://www.energy.gov/cmei/fuels/hydrogen-production-electrolysis
[11] USGS, Hydroelectric power: How it works. Available at: https://www.usgs.gov/water-science-school/science/hydroelectric-power-how-it-works
[12] Britannica, Alternative Energy Debate. Available at: https://www.britannica.com/procon/alternative-energy-debate
[13] Climate Home News, Efforts to green lithium extraction face scrutiny over water use. Available at: https://www.climatechangenews.com/2025/10/13/efforts-to-green-lithium-extraction-face-scrutiny-over-water-use/
[14] Mongabay, Lithium mining leaves severe impacts in Chile, but new methods exist. Available at: https://news.mongabay.com/2025/09/lithium-mining-leaves-severe-impacts-in-chile-but-new-methods-exist-report/
[15] The Guardian, Chile lithium Rio Tinto fears Colla indigenous water Atacama ecosystem. Available at: https://www.theguardian.com/global-development/2026/jan/01/chile-lithium-rio-tinto-fears-colla-indigenous-water-atacama-ecosystem
[16] Phys.org, Density key sustainable lithium reveals. Available at: https://phys.org/news/2025-09-density-key-sustainable-lithium-reveals.html#google_vignette
[17] Warp News, New technology can extract lithium with a tenth of the water consumption. Available at: https://www.warpnews.org/green-tech/new-technology-can-extract-lithium-with-a-tenth-of-the-water-consumption/
[18] Interesting Engineering, Scientists use toxic forever chemicals to extract 99% pure battery-grade lithium. Available at: https://interestingengineering.com/science/scientists-use-toxic-forever-chemicals-to-extract-99-pure-battery-grade-lithium
[19] Farmonaut, Lithium brine extraction water usage per tonne 2026. Available at: https://farmonaut.com/mining/lithium-brine-extraction-water-usage-per-tonne-2026
[20] Las Vegas Review-Journal, Warring lithium companies take dispute to Nevada Supreme Court. Available at: https://www.reviewjournal.com/news/environment/warring-lithium-companies-take-dispute-to-nevada-supreme-court-3433520/
Comments