Encryption can hide an industrial control message while leaving clues about when its delivery matters most. University of British Columbia researchers have used that distinction to disrupt simulated water-treatment operations by selectively dropping encrypted traffic.
A UBC report published on 3 November describes ICS-Sniper, a research framework targeting communications between industrial facilities and cloud-hosted monitoring and control systems. This is a laboratory demonstration, not a report of attacks against operational water or energy networks.
The attack needs a position along the network path
The research paper assumes an adversary can observe and interfere with the Internet path carrying the facility’s VPN traffic. A compromised router on that path is one way to obtain this position.
ICS-Sniper studies packet sizes, directions and timing to infer repeating communication patterns. It then identifies short periods likely to carry important coordination messages and drops selected packets during a subsequent operating cycle. The encrypted contents remain unread.
The distinction matters for defenders: the attack targets timely delivery and coordination between processes, rather than decrypting commands or installing malware inside the plant.
The study is also older than the university announcement. Its arXiv record dates the initial submission to December 2023 and the latest revision to 2 November 2026. UBC says it has been accepted for NDSS 2027.
What the experiments establish
UBC reports a roughly 15-minute delay in the start of clean-water pumping in one experiment and a simulated valve remaining open over nine minutes longer than intended in another. Although the team examined traffic across multiple industrial protocols and a power-grid dataset, the demonstrated operational disruptions were in water-treatment models.
The project’s documentation clarifies that one testbed used software controllers and another used real industrial PLCs. Both simulated the mechanical process; no experiment touched a live plant. Its detector evaluation also has a specific scope: some scenarios produced no alert during the attack, while others alerted only after operations had already degraded.
Resilience requires more than confidential traffic
The researchers identify traffic padding or timing changes, alternative communication routes and more resilient control coordination as possible defensive directions. These require care around industrial timing constraints. They are research proposals, not a universally validated fix operators can simply enable.
