SACRAMENTO — A California bill that would require marketplaces like eBay and Nextdoor to start collecting bank accounts and tax identification numbers from high-volume sellers who advertise online but collect payments offline is being fast-tracked by Democratic lawmakers with committees voting on it Tuesday.

The idea is that thieves will be less likely to resell stolen merchandise if authorities can track them down.

The measure is part of a legislative package of 14 bills to combat retail theft in the state. The California Retailers Association has said the issue has reached crisis levels, though it’s challenging to quantify because many stores don’t share their data.

Proponents, including district attorneys and some big box retailers, said the data collection proposal would shut down organized theft rings seeking to resell stolen goods and would close a loophole in existing laws that don’t require platforms to track offline transactions.

The rules under the bill would apply to sellers who make at least $5,000 profit and engage in at least 200 transactions in a year.

Opponents say the measure’s new requirement is so broad and vague that some platforms would have to start collecting sensitive information from all users, harming California’s e-commerce businesses.

“This is basically going to force businesses out of California,” said David Edmonson of TechNet, a technology advocacy group. “I imagine most sellers will have to think long and hard about whether or not they want to provide that information to the online marketplace just to be able to sell, you know, household products.”

Nathan Garnett, general counsel of OfferUp, a mobile marketplace that connects local buyers and sellers so they can complete transactions in-person, said the proposal would significantly benefit big box retailers and cripple classified ad sites’ ability to do business in the state.

In the case of OfferUp, its 11 million users in California would have to hand over their personal information before they could list something like a used coffee table or an old truck on the platform, Garnett said.

Opponents say the measure also runs contrary to a federal law that went into effect last July, which requires online marketplaces like Amazon to verify high-volume sellers on their platforms as part of an effort to tamp down the amount of goods being stolen from brick-and-mortar stores and resold online.

The federal law was negotiated to protect classified websites, and there was no legal loophole, said Carl Szabo, the general counsel of an Internet trade group NetChoice. The group, which represents companies including Facebook parent Meta and Etsy, filed a lawsuit against Georgia last week to halt the implementation of a state law that would establish similar requirements.

Requiring platforms to monitor all transactions, including those happening offline, is an impossible task, Szabo said.

“The only people they would have to get that information from are high-volume sellers, not every single person who uses their site,” she said.

The proposal is part of a legislative package that would increase penalties for organized crime rings, expand drug court programs and close a legal loophole to make it easier to prosecute auto thefts, among other things.

Lawmakers are racing to deliver the bills to Democratic Gov. Gavin Newsom in a few weeks. Once signed, the bills would take effect immediately — a new get-tough-on-crime strategy in an election year seeking to ease the growing fears of voters while preserving progressive policies designed to keep people out of prison.

On Tuesday, lawmakers are also planning to add a clause to the retail theft bills that would void the laws if voters pass a tough-on-crime ballot initiative.

WASHINGTON — A first-of-a-kind proposal to begin using the mind-altering drug MDMA as a treatment for PTSD was roundly criticized Tuesday — a potentially major setback to psychedelic advocates who hope to win a landmark federal approval and bring the banned drugs into the medical mainstream.

A panel of advisers to the Food and Drug Administration voted 10-1 against the overall benefits of MDMA when used to treat post-traumatic stress disorder. They cited flawed study data, questionable research conduct and significant drug risks, including the potential for heart problems, injury and abuse.

“It seems like there are so many problems with the data — each one alone might be OK, but when you pile them on top of each other … there’s just a lot of questions I would have about how effective the treatment is,” said Dr. Melissa Decker Barone, a psychologist with the Department of Veterans Affairs.

The FDA is not required to follow the group’s advice and is expected to make its final decision by August, but the negative opinion could strengthen FDA’s rationale for rejecting the treatment.

MDMA is the first in a series of psychedelics — including LSD and psilocybin — that are expected to come before the FDA for review in the next few years as part of a resurgence of interest into the drugs’ medical potential, which advocates claim could transform the treatment of mental health disorders.

But FDA advisers spent most of Tuesday’s meeting leveling pointed questions and criticisms at the research submitted on MDMA, which is sometimes called ecstasy or molly. Panelists pointed to flawed studies that could have skewed the results, missing follow-up data on patient outcomes and a lack of diversity among participants. The vast majority of patients studied were white, with only five Black patients receiving MDMA, raising questions about the generalizability of the results.

“The fact that this study has so many white participants is problematic because I don’t want something to roll out that only helps this one group,” said Elizabeth Joniak-Grant, the group’s patient representative.

FDA’s rejection represents a major disappointment for the San Jose-based biotech company Lykos Therapeutics and the nonprofit Multidisciplinary Association for Psychedelic Studies (MAPS), founded in Santa Cruz, where MDMA therapy got its start. Clinical trials were conducted at UC San Francisco.

Lykos Therapeutics, created by MAPS and supported by $150 million in investor funds, sought the sole rights to commercialize MDMA for five years. If approved, a patent was on the horizon.The FDA advisers also drew attention to allegations of misconduct in the trials that have recently surfaced in news stories and a report by the nonprofit Institute for Clinical and Economic Review, which evaluates experimental drug treatments. The incidents include a 2018 report of apparent sexual misconduct by a therapist interacting with a patient.

Lykos Therapeutics, the company behind the study, said it previously reported the incident to the FDA and regulators in Canada, where the therapist is based. Lykos is essentially a corporate spinoff of the nation’s leading psychedelic advocacy group, the Multidisciplinary Association for Psychedelic Studies, or MAPS, which funded the studies. The group was founded in 1986 to promote the benefits of MDMA and other mind-altering substances.

Lykos and MAPS did not immediately respond to requests for comment Tuesday evening.

The negative panel ruling could further derail financial investments in the fledgling psychedelic industry, which has mainly been funded by a small number of wealthy backers. Dozens of startup companies have launched in recent years seeking to study psilocybin, ketamine and others drugs for conditions like depression and addiction, though many have struggled to raise money.

MDMA’s main effect is triggering feelings of intimacy, connection and euphoria. When used to enhance talk therapy, the drug appears to help patients process their trauma and let go of disturbing thoughts and memories.

But the panel struggled with the reliability of those results, given the difficulties of objectively testing psychedelic drugs.

Because MDMA causes intense, psychological experiences, almost all patients in two key studies of the drug were able to guess whether they had received the MDMA or a dummy pill. That’s the opposite of the approach generally required for high-quality drug research, in which bias is minimized by “blinding” patients and researchers to whether they received the drug under investigation.

“I’m not convinced at all that this drug is effective based on the data I saw,” said Dr. Rajesh Narendran, a University of Pittsburgh psychiatrist who chaired the panel.

Panelists also noted the difficulty of knowing how much of patients’ improvement came from MDMA versus simply undergoing the extensive therapy, which totaled more than 80 hours for many patients. Results were further marred by other complicating factors, including a large number of patients who had previously used MDMA or other psychedelics drugs recreationally.

Nearly three dozen public speakers addressed the panel, including veterans who said they benefitted from MDMA therapy, medical professionals who advised against its use and journalists and independent researchers who reiterated the allegations of misconduct in the trials.

The meeting concluded with several experts encouraging Lykos and the FDA to continue studying psychedelics for PTSD, citing the field’s potential to help patients.

“I think this is a really exciting treatment and I’m encouraged by the results to date,” said Dr. Paul Holtzheimer of the VA’s National Center for PTSD, “but from a safety and efficacy standpoint I feel it’s still premature.”

Staff writer Lisa Krieger contributed to this report.

The social media platform X says it will now formally allow people to show consensual adult content, as long as it is clearly labeled as such. The move makes official a policy already in place when the platform was known as Twitter, before billionaire Elon Musk purchased it in 2022.

In a recent update on its website, the San Francisco-based company said users “should be able to create, distribute, and consume material related to sexual themes as long as it is consensually produced and distributed. Sexual expression, whether visual or written, can be a legitimate form of artistic expression.”

Adult material was allowed under the pre-Musk Twitter as well, although there was no official policy in place. X said it is restricting adult content for children and for adult users who choose not to see it.

“We also prohibit content promoting exploitation, nonconsent, objectification, sexualization or harm to minors, and obscene behaviors,” X said. It added that it does not allow sharing adult content in “highly visible” places such as users’ profile photos or banners.

X’s policy stands in contrast to other social media platforms, such as Meta’s properties — Instagram and Facebook — as well as TikTok and Google’s YouTube.

The company appears to be courting people, including creators and artists, who have been marginalized by other social media platforms that have guidelines restricting nudity or sexual expression, she added.

The policy applies to real as well as artificial-intelligence-generated material.

X is asking users who regularly post adult content to adjust their media settings to place all their images and videos behind a content warning. This requires users to acknowledge that they want to see the posted image before they can view it.

Shares of Trump Media & Technology Group closed lower Friday after swinging wildly over the course of the day following the conviction of former President Donald Trump in his hush money trial.

After the U.S. stock markets closed Thursday, a New York jury found Trump guilty of falsifying business records in a scheme to illegally influence the 2016 election through hush money payments to an adult film actor who said the two had sex.

After rising more than 2% at the opening of trading Friday, the shares ended the day down 5.3%.

The stock, which trades under the ticker symbol “DJT,” has been extraordinarily volatile since its debut in late March, joining the group of meme stocks that are prone to ricochet from highs to lows as small-pocketed investors attempt to catch an upward momentum swing at the right time.

The stock has tripled this year, in the process frequently making double-digit percentage moves either higher or lower on a single day. It peaked at nearly $80 in intraday trading on March 26. For context, the S&P 500 is up almost 10% year to date.

In a filing with the U.S. Securities & Exchange Commission before going public, Trump Media warned investors of the potential pitfalls faced by the former president and the adverse affect it might have on the stock.

“President Donald J. Trump is the subject of numerous legal proceedings, the scope and scale of which are unprecedented for a former President of the United States and current candidate for that office. An adverse outcome in one or more of the ongoing legal proceedings in which President Donald J. Trump is involved could negatively impact TMTG and its Truth Social platform.”

Earlier this month, Trump Media reported that it lost more than $300 million last quarter, according to its first earnings report as a publicly traded company.

For the three-month period that ended March 31, the company posted a loss of $327.6 million, which it said included $311 million in non-cash expenses related to its merger with a company called Digital World Acquisition Corp. DWAC was an example of what’s known as a special purpose acquisition company, or SPAC, which can give young companies quicker and easier routes to getting their shares trading publicly, but with much less scrutiny.

Trump Media & Technology fired an auditor this month that federal regulators recently charged with “massive fraud.” The media company dismissed BF Borgers as its independent public accounting firm on May 3, delaying the filing of its quarterly earnings report.

Trump was charged with 34 counts of falsifying business records at his company in connection with an alleged scheme to hide potentially embarrassing stories about him during his 2016 Republican presidential election campaign.

The charge, a felony, arose from reimbursements paid to then-Trump lawyer Michael Cohen after he made a $130,000 hush money payment to porn actor Stormy Daniels to silence her claims of an extramarital sexual encounter with Trump in 2006. Trump was accused of misrepresenting Cohen’s reimbursements as legal expenses to hide that they were tied to a hush money payment.

Trump’s defense contended that the Cohen payments were for legitimate legal services.

The purchase price was not disclosed. Ulukaya said in a statement issued Friday that Anchor embodies much of what makes San Francisco so great and he’s excited to be part of the company’s rebirth.

“I have fallen in love with this city, its history, grit and charm. I believe brands born in places like this are incredibly special and must be treasured, respected and loved,” he said.

Beer lovers mourned when the brewing company, established in San Francisco in 1896, announced its closure last year amid declining sales and increased competition from canned cocktails, crafted drinks, spirits and wines.

Anchor was rescued previously from near financial insolvency in the 1960s when it was acquired by Fritz Maytag, who sparked a revival in small-scale and local brewing. Japanese brewer Sapporo then purchased Anchor Brewing in 2017.

Last year heartbroken brewery employees failed in attempts to buy the company.

Shepherd Futures, the family office of Chobani CEO and founder Ulukaya, now owns the assets of Anchor Brewing.

Ulukaya was raised in a dairy-farming family in eastern Turkey. He founded Chobani in 2005 after moving to the U.S., looking to recreate the wholesome Greek yogurt from his childhood, according to the Chobani website.

The company has expanded beyond yogurt to milk, creamers and other drinks. It is based in New York.

The complaint filed Thursday follows an investigation by the department’s Wage and Hour Division that found a 13-year-old worked between 50 and 60 hours a week operating machines on an assembly line that formed sheet metal into auto body parts.

Hyundai said in a statement that it cooperated fully with the Labor Department and that it is unfair to be held accountable for the practices of its suppliers.

“We are reviewing the new lawsuit and intend to vigorously defend the company,” the statement said.

SACRAMENTO — As corporations increasingly weave artificial intelligence technologies into the daily lives of Americans, California lawmakers want to build public trust, fight algorithmic discrimination and outlaw deepfakes that involve elections or pornography.

The efforts in California — home to many of the world’s biggest AI companies — could pave the way for AI regulations across the country. The United States is already behind Europe in regulating AI to limit risks, lawmakers and experts say, and the rapidly growing technology is raising concerns about job loss, misinformation, invasions of privacy and automation bias.

A slew of proposals aimed at addressing those concerns advanced last week, but must win the other chamber’s approval before arriving at Gov. Gavin Newsom’s desk. The Democratic governor has promoted California as an early adopter as well as regulator, saying the state could soon deploy generative AI tools to address highway congestion, make roads safer and provide tax guidance, even as his administration considers new rules against AI discrimination in hiring practices.

With strong privacy laws already in place, California is in a better position to enact impactful regulations than other states with large AI interests, such as New York, said Tatiana Rice, deputy director of the Future of Privacy Forum, a nonprofit that works with lawmakers on technology and privacy proposals.

“You need a data privacy law to be able to pass an AI law,” Rice said. “We’re still kind of paying attention to what New York is doing, but I would put more bets on California.”

California lawmakers said they cannot wait to act, citing hard lessons they learned from failing to reign in social media companies when they might have had a chance. But they also want to continue attracting AI companies to the state.

Here’s a closer look at California’s proposals:

FIGHTING AI DISCRIMINATION AND BUILDING PUBLIC TRUST

Some companies, including hospitals, already use AI models to define decisions about hiring, housing and medical options for millions of Americans without much oversight. Up to 83% of employers are using AI to help in hiring, according to the U.S. Equal Employment Opportunity Commission. How those algorithms work largely remains a mystery.

One of the most ambitious AI measures in California this year would pull back the curtains on these models by establishing an oversight framework to prevent bias and discrimination. It would require companies using AI tools to participate in decisions that determine results and to inform people affected when AI is used. AI developers would have to routinely make internal assessments of their models for bias. And the state attorney general would have authority to investigate reports of discriminating models and impose fines of $10,000 per violation.

AI companies also might soon be required to start disclosing what data they’re using to train their models.

PROTECTING JOBS AND LIKENESS

Inspired by the months-long Hollywood actors strike last year, a California lawmaker wants to protect workers from being replaced by their AI-generated clones — a major point of contention in contract negotiations.

The proposal, backed by the California Labor Federation, would let performers back out of existing contracts if vague language might allow studios to freely use AI to digitally clone their voices and likeness. It would also require that performers be represented by an attorney or union representative when signing new “voice and likeness” contracts.

California may also create penalties for digitally cloning dead people without the consent of their estate, citing the case of a media company that produced a fake, AI-generated hourlong comedy special to recreate the late comedian George Carlin’s style and material without his estate’s permission.

REGULATING POWERFUL GENERATIVE AI SYSTEMS

Real-world risks abound as generative AI creates new content such as text, audio and photos in response to prompts. So lawmakers are considering requiring guardrails around “extremely large” AI systems that have the potential to spit out instructions for creating disasters — such as building chemical weapons or assisting in cyberattacks — that could cause at least $500 million in damages. It would require such models to have a built-in “kill switch,” among other things.

The measure, supported by some of the most renowned AI researchers, would also create a new state agency to oversee developers and provide best practices, including for still-more powerful models that don’t yet exist. The state attorney general also would be able to pursue legal actions in case of violations.

A bipartisan coalition seeks to facilitate prosecuting people who use AI tools to create images of child sexual abuse. Current law does not allow district attorneys to go after people who possess or distribute AI-generated child sexual abuse images if the materials are not depicting a real person, law enforcement said.

A host of Democratic lawmakers are also backing a bill tackling election deepfakes, citing concerns after AI-generated robocalls mimicked President Joe Biden’s voice ahead of New Hampshire’s recent presidential primary. The proposal would ban “materially deceptive” deepfakes related to elections in political mailers, robocalls and TV ads 120 days before Election Day and 60 days thereafter. Another proposal would require social media platforms to label any election-related posts created by AI.

ConocoPhillips is buying Marathon Oil in an all-stock deal valued at approximately $17.1 billion as energy prices rise and big oil companies reap massive profits.

The deal is valued at $22.5 billion when including $5.4 billion in debt.

Crude prices have jumped more than 12% this year, and the cost for a barrel rose above $80 this week. Oil majors put up record profits after Russia’s invasion of Ukraine in 2022 and while those numbers have slipped, there has been a surge in mergers between energy companies flush with cash.

“We never know when these opportunities come available, and this one certainly came available, or to our attention, here a few weeks ago,” Chief Executive Officer Ryan Lance told analysts and investors Wednesday on a conference call. “We weren’t necessarily out looking for something, but it was an opportunity that presented itself.”

Chevron said last year that it was buying Hess in a $53 billion acquisition, though that deal faces headwinds. The company warned the buyout may be in jeopardy because it will require the approval of Exxon Mobil and a Chinese national oil company, which both hold rights to development of an oil field off the coast of the South American nation Guyana where Hess is a big player.

In July of last year, Exxon Mobil said that it would pay $4.9 billion for Denbury Resources, an oil and gas producer that has entered the business of capturing and storing carbon and stands to benefit from changes in U.S. climate policy. Three months later, Exxon announced the proposed acquisition of shale operator Pioneer Natural Resources for $60 billion.

All the proposed acquisitions could face pushback from the U.S. which, under the Biden administration, has stepped up antitrust reviews for energy companies and other sectors as well, such as tech.

The Federal Trade Commission, which enforces federal antitrust law, asked for additional information from Exxon and Pioneer about their proposed deal. The request is a step the agency takes when reviewing whether a merger could be anticompetitive under U.S. law. Pioneer disclosed the request in a filing in January.

As part of the ConocoPhillips transaction, Marathon Oil shareholders will receive 0.2550 shares of ConocoPhillips common stock for each share of Marathon Oil common stock that they own, the companies said Wednesday.

ConocoPhillips said Wednesday that the transaction will add highly desired acreage to its existing U.S. onshore portfolio.

“This acquisition of Marathon Oil further deepens our portfolio and fits within our financial framework, adding high-quality, low cost of supply inventory adjacent to our leading U.S. unconventional position,” ConocoPhillips Chairman and CEO Ryan Lance said in a prepared statement.

The deal is expected to close in the fourth quarter. It still needs approval from Marathon Oil stockholders.

Separate from the transaction, ConocoPhillips said that it anticipates raising its ordinary dividend by 34% to 78 cents per share starting in the fourth quarter. The company said that once the Marathon Oil deal closes and assuming recent commodity prices, ConocoPhillips plans to buy back more than $7 billion in shares in the first full year. It plans to repurchase more than $20 billion in shares in the first three years.

Shares of ConocoPhillips declined 3.3% before the market open, while Marathon Oil Corp.’s stock rose more than 7%.

DETROIT — Cars, trucks and SUVs in the U.S. keep getting older, hitting a record average age of 12.6 years in 2024 as people hang on to their vehicles largely because new ones cost so much.

S&P Global Mobility, which tracks state vehicle registration data nationwide, said Wednesday that the average vehicle age grew about two months from last year’s record.

But the growth in average age is starting to slow as new vehicle sales start to recover from pandemic-related shortages of parts, including computer chips. The average increased by three months in 2023.

Still, with an average U.S. new-vehicle selling price of just over $45,000 last month, many can’t afford to buy new — even though prices are down more than $2,000 from the peak in December of 2022, according to J.D. Power.

“It’s prohibitively high for a lot of households now,” said Todd Campau, aftermarket leader for S&P Global Mobility. “So I think consumers are being painted into the corner of having to keep the vehicle on the road longer.”

Other factors include people waiting to see if they want to buy an electric vehicle or go with a gas-electric hybrid or a gasoline vehicle. Many, he said, are worried about the charging network being built up so they can travel without worrying about running out of battery power. Also, he said, vehicles are made better these days and simply are lasting a long time.

New vehicle sales in the U.S. are starting to return to pre-pandemic levels, with prices and interest rates the big influencing factors rather than illness and supply-chain problems, Compau said. He said he expects sales to hit around 16 million this year, up from 15.6 million last year and 13.9 million in 2022.

People keeping vehicles longer is good news for the local auto repair shop. About 70% of vehicles on the road are 6 or more years old, he said, beyond manufacturer warranties.

Those who are able to keep their rides for multiple years usually get the oil changed regularly and follow manufacturer maintenance schedules, Campau noted.

WASHINGTON — Cyberattacks against water utilities across the country are becoming more frequent and more severe, the Environmental Protection Agency warned Monday as it issued an enforcement alert urging water systems to take immediate actions to protect the nation’s drinking water.

About 70% of utilities inspected by federal officials over the last year violated standards meant to prevent breaches or other intrusions, the agency said. Officials urged even small water systems to improve protections against hacks. Recent cyberattacks by groups affiliated with Russia and Iran have targeted smaller communities.

Some water systems are falling short in basic ways, the alert said, including failure to change default passwords or cut off system access to former employees. Because water utilities often rely on computer software to operate treatment plants and distribution systems, protecting information technology and process controls is crucial, the EPA said. Possible impacts of cyberattacks include interruptions to water treatment and storage; damage to pumps and valves; and alteration of chemical levels to hazardous amounts, the agency said.

“In many cases, systems are not doing what they are supposed to be doing, which is to have completed a risk assessment of their vulnerabilities that includes cybersecurity and to make sure that plan is available and informing the way they do business,” said EPA Deputy Administrator Janet McCabe.

Attempts by private groups or individuals to get into a water provider’s network and take down or deface websites aren’t new. More recently, however, attackers haven’t just gone after websites, they’ve targeted utilities’ operations instead.

Recent attacks are not just by private entities. Some recent hacks of water utilities are linked to geopolitical rivals, and could lead to the disruption of the supply of safe water to homes and businesses.

McCabe named China, Russia and Iran as the countries that are “actively seeking the capability to disable U.S. critical infrastructure, including water and wastewater.”

Late last year, an Iranian-linked group called “Cyber Av3ngers” targeted multiple organizations including a small Pennsylvania town’s water provider, forcing it to switch from a remote pump to manual operations. They were going after an Israeli-made device used by the utility in the wake of Israel’s war against Hamas.

Earlier this year, a Russian-linked “hacktivist” tried to disrupt operations at several Texas utilities.

A cyber group linked to China and known as Volt Typhoon has compromised information technology of multiple critical infrastructure systems, including drinking water, in the United States and its territories, U.S. officials said. Cybersecurity experts believe the China-aligned group is positioning itself for potential cyberattacks in the event of armed conflict or rising geopolitical tensions.

“By working behind the scenes with these hacktivist groups, now these (nation states) have plausible deniability and they can let these groups carry out destructive attacks. And that to me is a game-changer,” said Dawn Cappelli, a cybersecurity expert with the industrial cybersecurity firm Dragos Inc.

The world’s cyberpowers are believed to have been infiltrating rivals’ critical infrastructure for years planting malware that could be triggered to disrupt basic services.

The enforcement alert is meant to emphasize the seriousness of cyberthreats and inform utilities the EPA will continue its inspections and pursue civil or criminal penalties if they find serious problems.

“We want to make sure that we get the word out to people that ‘Hey, we are finding a lot of problems here,’” McCabe said.

EPA did not say how many cyber incidents have occurred in recent years, and the number of attacks known to be successful so far is few. The agency has issued nearly 100 enforcement actions since 2020 regarding risk assessments and emergency response, but said that’s a small snapshot of the threats water systems face.

Preventing attacks against water providers is part of the Biden administration’s broader effort to combat threats against critical infrastructure. In February, President Joe Biden signed an executive order to protect U.S. ports. Health care systems have been attacked. The White House has pushed electric utilities to increase their defenses, too. EPA Administrator Michael Regan and White House National Security Advisor Jake Sullivan have asked states to come up with a plan to combat cyberattacks on drinking water systems.

“Drinking water and wastewater systems are an attractive target for cyberattacks because they are a lifeline critical infrastructure sector but often lack the resources and technical capacity to adopt rigorous cybersecurity practices,” Regan and Sullivan wrote in a March 18 letter to all 50 U.S. governors.

Some of the fixes are straightforward, McCabe said. Water providers, for example, shouldn’t use default passwords. They need to develop a risk assessment plan that addresses cybersecurity and set up backup systems. The EPA says they will train water utilities that need help for free. Larger utilities usually have more resources and the expertise to defend against attacks.

“In an ideal world … we would like everybody to have a baseline level of cybersecurity and be able to confirm that they have that,” said Alan Roberson, executive director of the Association of State Drinking Water Administrators. “But that’s a long ways away.”

Some barriers are foundational. The water sector is highly fragmented. There are roughly 50,000 community water providers, most of which serve small towns. Modest staffing and anemic budgets in many places make it hard enough to maintain the basics — providing clean water and keeping up with the latest regulations.

“Certainly, cybersecurity is part of that, but that’s never been their primary expertise. So, now you’re asking a water utility to develop this whole new sort of department” to handle cyberthreats, said Amy Hardberger, a water expert at Texas Tech University.

The EPA has faced setbacks. States periodically review the performance of water providers. In March 2023, the EPA instructed states to add cybersecurity evaluations to those reviews. If they found problems, the state was supposed to force improvements.

But Missouri, Arkansas and Iowa, joined by the American Water Works Association and another water industry group, challenged the instructions in court on the grounds that EPA didn’t have the authority under the Safe Drinking Water Act. After a court setback, the EPA withdrew its requirements but urged states to take voluntary actions anyway.

The Safe Drinking Water Act requires certain water providers to develop plans for some threats and certify they’ve done so. But its power is limited.

“There’s just no authority for (cybersecurity) in the law,” Roberson said.

Kevin Morley, manager of federal relations with the American Water Works Association, said some water utilities have components that are connected to the internet — a common, but significant vulnerability. Overhauling those systems can be a significant and costly job. And without substantial federal funding, water systems struggle to find resources.

The industry group has published guidance for utilities and advocates for establishing a new organization of cybersecurity and water experts that would develop new policies and enforce them, in partnership with the EPA.

“Let’s bring everybody along in a reasonable manner,” Morley said, adding that small and large utilities have different needs and resources.

Phillis reported from St. Louis.