Trump Blamed Minnesota for the Water Attacks While His Own Agencies Declined to Blame Anyone

The Yahoo News aggregation of Friday 31 July reports President Donald Trump blaming Minnesota and Governor Tim Walz for the attacks, quoting him directly: “I think that Minnesota is behind it.” The remark came a day after the FBI, EPA and CISA public service announcement that NBC News notes does not name the states involved, and while, per CBS News, federal sources were cautioning that no definitive attribution had been made and were examining whether the actor had tried to appear Iran-based. Minnesota is the jurisdiction that disclosed the intrusions in the first place: more than 30 water and wastewater facilities with OT systems targeted on 26 and 27 July, per SecurityWeek and CBS citing Minnesota IT Services, with the state’s IT agency saying on 30 July there was no indication any municipal water supply had been contaminated.

The infrastructure numbers around the story are firmer than the attribution. SecurityWeek reports that days before the Minnesota attacks, federal agencies updated their April advisory to warn that industrial control systems made by Siemens, Schneider Electric and Rockwell Automation had been targeted — three named vendors. SecurityWeek also cites Censys counting roughly 10,000 Rockwell, Siemens and Schneider Electric PLCs exposed to the internet, while noting it is unclear how many are actually vulnerable; that is a snapshot, not a trend. CISA’s release, via Yahoo News, says it is “observing a significant increase in cyber threat actors targeting programmable logic controllers” in the water and wastewater sector. The remediation instruction is to take the devices off the public internet — a measurable action, unlike the question of who touched them.

Assessment: Two competing attributions now sit on the same file: an unnamed foreign state, sourced to background officials, and a domestic governor, sourced to the president on camera. Neither is evidence. What matters is which one the agencies bend toward. If CISA or FBI messaging starts accommodating the Minnesota line, the technical record becomes unusable for anyone outside the United States trying to assess whether Iranian OT operations are real and escalating — which is precisely the judgement Gulf utilities and CERTs need to make. No Iranian denial or acknowledgement has been located. Tehran’s silence past 72 hours is itself worth logging, because Iranian state media has been quick to claim less consequential things.