Tourists or Spies? The Incident at Warsaw's Water Supply Is a Serious Warning Sign

An Innocent Souvenir or the Prelude to Sabotage?

On Monday, a news story broke that, given today's geopolitical climate, is enough to make your blood run cold. Near the "Gruba Kaśka" water intake, the key source of drinking water for Warsaw's west bank, authorities detained a group of foreign nationals. The reason? They were taking extensive photos and video of a site clearly marked with a strict ban on photography.

The relevant services, including the Internal Security Agency (ABW), took over the case immediately. Officially, investigators are still trying to establish why the group was there. Even so, the incident should be treated as a serious warning sign and examined from a cybersecurity perspective.

Physical Reconnaissance: The Digital Key to the Kingdom 🔑

Treating this as a routine breach of the rules would be a mistake. To a threat analyst, it is a textbook example of physical reconnaissance, which is very often the first and most important step in preparing an attack on critical infrastructure.

Think of it like breaking into a smart home. A professional burglar doesn't just start pounding on the door. First, they watch: where the cameras are, what kind of locks are installed, where the alarm panel is. The same logic applies here. Photos and video footage can be used for:

• Mapping key assets: Pinpointing the location of server rooms, control cabinets, LAN/WAN access points, backup power systems and communication antennas.
• Analyzing weak spots: Looking for gaps in physical security, such as holes in the fence or camera blind spots, that could be used to plant surveillance devices (e.g., wireless packet sniffers or keyloggers) or to gain physical access to the network.
• Planning an attack on SCADA/ICS systems: The industrial control systems that run a water utility are a prime target for hackers. Knowing the physical layout of a facility is invaluable when planning a cyberattack that could disrupt the water supply or, in a worst-case scenario, contaminate it by tampering with chemical dosing systems.

This isn't the plot of an action movie. It is a real risk in the age of hybrid warfare. The line between physical and digital security is blurring by the day.

The Bigger Picture: Hybrid Warfare on Our Doorstep

The Warsaw incident is not an isolated case. In recent years, Europe has seen a surge in activity around critical infrastructure: ports, power plants, pipelines and rail networks. Drones flying over LNG terminals, mysterious damage to undersea cables and, yes, "tourists" with cameras at sensitive sites.

All of this is part of hybrid warfare. The goal is not only to gather intelligence, but also to test our security procedures, measure how quickly the authorities respond, and spread anxiety among the public. Every incident like this teaches a potential aggressor something valuable about our weaknesses.

What Now? Recommendations for Operators

The "Gruba Kaśka" incident is a loud wake-up call. It's time for concrete action:

1. Review Physical Security: Audit every layer of protection, from fences and CCTV to access control procedures.
2. Training and Security Culture: Every employee, from engineers to security guards, must understand the threats and know how to respond to suspicious behavior. Reporting "someone taking too many photos" isn't overzealousness. It's a duty.
3. Integrate Physical and IT Security: The teams responsible for these two areas must work closely together. Alarms from the video surveillance system should be correlated with alerts on the corporate network.

Protecting critical infrastructure is a system of interconnected parts. Even the best firewalls won't help much if someone gets physical access to the heart of your network. Let's hope this incident turns out to be nothing more than a scare, and that it sharpens the vigilance of everyone responsible for securing strategic facilities across Poland.

Source: RMF24

Aleksander