In 2013 an intruder spent three weeks inside the control system of a small New York flood-control dam, reading water levels and the gate's status. He could not move the gate. A maintenance crew had unhooked it.
Every account of Bowman Avenue turns on one Justice Department sentence: the access would normally have let the intruder operate the sluice gate, and it did not, because the gate had been manually disconnected for maintenance. The thing between a remote session and a physical gate was not a control anyone designed. It was a work order. The crew did its job. This is not an argument about competence.
It is about which state the site was in. The rung above was closed for a temporary reason: a gate under maintenance goes back into service, and the city says this one first ran in spring 2014. What changed before then is on no record. This is BlastWave's analysis, not a disclosed fact: the save was a state, not a design. A physical disconnect is the most honest control in OT, because it does not know who is asking. Build it in on purpose, with an alarm when it changes.
What is not known: How he got in is not on any record we could read. The cellular modem comes from a Homeland Security summary as reported in 2015, and the search engine discovery from people close to the investigation. Nobody has said who found the intrusion or whether any command was sent. The city that owns the dam described a standalone PC, not yet functional, logging levels; the Justice Department says the access would normally have permitted gate operation. The city says the gate first ran in spring 2014; what changed before then is undisclosed.
Recommendation
Take the path away No gate controller or supervisory PC at a remote water asset answers from the public internet or a carrier network. Find the modems first.
Remove standing remote command Moving a gate takes a named, verified person in a scheduled window. Local becomes the default on purpose, and the operator station alarms whenever it changes.
Make read-only consumers read one way Water level, temperature and gate position reach the office over a path that cannot write back, so seeing the dam never requires a door into it.
Sources: DOJ release 16-348 and SDNY release, 24 Mar 2016; FBI wanted notice, Hamid Firoozi; City of Rye statement, Dec 2015; WSJ, 20 Dec 2015 (via The Register); Newsweek, 30 Mar 2016. No advisory issued.. Full list with links.
Soft Spots: The cellular modem is reporting of a DHS summary we have not read, and the indictment was not read as text. That a maintenance state, not a design, was the save is BlastWave's analysis; what changed before the gate first ran is unknown.
The full record
Every claim numbered to its source. Last updated .
Three weeks inside the control system of a small New York flood-control dam, reading a gate the intruder could not move because a maintenance crew had unhooked it. What is verified, what is only reported, and what is still unknown.
Summary
Between 28 August and 18 September 2013, according to the Justice Department, an intruder repeatedly accessed the SCADA system of the Bowman Avenue Dam, a small flood-control dam in Rye Brook, New York, reading water levels, temperature and gate status. He could not operate the sluice gate: it had been manually disconnected for maintenance. One man was charged, not convicted.2,8
Timeline of the Bowman Avenue Dam intrusion
Every date is tied to a source. Press reporting appears only as evidence of what was said.
A sluice gate is added to the dam, according to the City of Rye.1
Hamid Firoozi repeatedly obtains unauthorized access to the dam's SCADA system and reads water levels, temperature and the status of the sluice gate, according to the Justice Department. The gate has been manually disconnected for maintenance.2,4
The Department of Homeland Security approaches the City of Rye about apparent unauthorized access to its computer system relating to the dam.1
Homeland Security gives the city a report "containing findings, conclusions and recommendations."1
The city uses the sluice gate for the first time, during a storm event, by its own account.1
The Wall Street Journal reports the intrusion, citing an unclassified Homeland Security summary for access through a cellular modem, and reports that investigators initially thought a much larger dam in Oregon was involved.5,6,10
The City of Rye issues a statement on the dam, including that "at no time was the sluice gate ever manipulated by unauthorized users outside of the City."1
A federal grand jury in the Southern District of New York indicts Firoozi and six others, under seal.8
The indictment is unsealed. The Justice Department and the US Attorney in Manhattan announce the charges; the dam is one count in a case mainly about attacks on the US financial sector.2,4
Press reports, sourced to people close to the investigation, say the dam was found through search engine queries. Newsweek publishes the city manager's description of the system.7,9
A trade publication writes that the Iranians may have meant to target the Oregon dam and "mistakenly hit Rye Brook instead," inverting the original account.12
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Water levels, temperature and the status of the sluice gate2,4
Verified
Could he operate the gate?
Not at the time. The access "would normally have permitted" it, but the gate "had been manually disconnected for maintenance"2
Verified
Was any command sent or attempted?
No command is on the record. The city says the gate was never manipulated by unauthorized users; whether anything was attempted is not stated1
Undisclosed
How did he get in?
A cellular modem, per a Homeland Security summary as reported by the Wall Street Journal; not in either Justice Department release4,5,6
Reported only
How was the dam found?
Search engine queries, per people close to the investigation7
Reported only
Who discovered the intrusion?
Not named. Homeland Security approached the city in or about September 20131
Undisclosed
Who was charged?
Hamid Firoozi, network manager at ITSec Team, indicted 21 January 2016; still listed as wanted by the FBI2,8
Verified (charged, not convicted)
Was the target an Oregon dam?
No record says so. It was investigators who initially thought the Oregon dam was involved5,10
Reported only
Malware
None named in any document
Undisclosed
Cost
Remediation over $30,000. Total cost not published2
Verified (remediation only)
When did the gate first operate?
On or about 30 April to 1 May 2014, during a storm, per the city1
Verified (owner's account)
Could the intruder have opened the dam's gate?
Not that month: the Justice Department says the sluice gate had been manually disconnected for maintenance. Between 28 August and 18 September 2013, the intruder could read the water level, the temperature and the status of the sluice gate, the component "responsible for controlling water levels and flow rates."2,4 In the department's words, the access "would normally have permitted" him to operate the gate remotely. The release then says that he
"did not have that capability because the sluice gate had been manually disconnected for maintenance at the time of the intrusion."
That sentence is about a gate, not the dam, and about a maintenance state, not a security control. The dam was not offline. No command is on the record, and the city says that "at no time was the sluice gate ever manipulated by unauthorized users outside of the City."1 Whether any command was attempted is not stated in any record we could read.
The dam's owner gives a second account of the system, and it sits beside the Justice Department's rather than against it. The City of Rye's city manager told Newsweek in March 2016 that the system was
"a standalone PC that had its own Internet connection to connect to the dam, and it wasn't even functional at that point yet."
The Rye Brook mayor described the structure as being in "maintenance mode."9 The city's own statement says a sluice gate was added in or about June 2013 and was used "for the first time during a storm event on or about April 30 to May 1, 2014."1 That timeline fits the city manager's "not even functional" better than the department's "manually disconnected for maintenance." Both accounts are printed here; we do not choose between them.
How did the intruder get into the dam's control system?
No primary record we could read says. Neither Justice Department release describes how the system was reached, and the published indictment is a scanned document we have not been able to read as text.2,4,11 Two accounts come from reporting, and both are attributed here rather than stated as findings.
A cellular modem. The Wall Street Journal, on 20 December 2015, attributed access through a cellular modem to an unclassified Homeland Security summary. We have not seen that summary.5,6
Search engine discovery. Reporting in March 2016, sourced to people close to the investigation, said the system was found through targeted search engine queries.7
How the intrusion was noticed. The Journal reported that US analysts watching machines they tied to Iranian hackers saw one crawling the internet for vulnerable US industrial control systems.5,6
Found is a different story from chosen. Nothing on the record says the intruder selected Bowman Avenue as a target. Credential stuffing, weak credentials, a port scanner and firmware enumeration have all been attached to this incident, including by us; none of them appears in any document we found.
Who was charged with the Bowman Avenue Dam intrusion?
Hamid Firoozi, one of seven Iranian nationals indicted in Manhattan. He has not been tried. A grand jury in the Southern District of New York returned the indictment on 21 January 2016, and it was unsealed on 24 March 2016.4,8 The case is mainly about a denial of service campaign against 46 victims, primarily in the US financial sector, between late 2011 and mid-2013. Firoozi carries one additional count for the dam, "obtaining and aiding and abetting unauthorized access to a protected computer."2,4
The Justice Department described Firoozi as the network manager at ITSec Team, one of two Iran-based companies, with Mersad, that "performed work on behalf of the Iranian Government, including the Islamic Revolutionary Guard Corps."2 That is the grain of the charge: individuals employed by companies said to work for the government. It is not a finding that the Revolutionary Guard hacked a dam. The same release says:
"An indictment is merely an accusation"
The FBI lists Firoozi as wanted and says he is "thought to be living in Iran."8 Announcing the charges, the US Attorney for the Southern District of New York, Bharara, said:
"The infiltration of the Bowman Avenue dam represents a frightening new frontier in cybercrime."
The charging record does not use the name Operation Cleaver, which comes from a December 2014 vendor report, and it does not describe the intrusion as retaliation for Stuxnet, which no government has acknowledged.
Did the hackers mean to hit a dam in Oregon?
No record says so. The confusion in the original reporting belonged to US investigators, not the intruder. As the Wall Street Journal's December 2015 story was republished that week, investigators initially thought the intrusion involved the Arthur R. Bowman Dam in Prineville, Oregon:5,10
"investigators initially thought the attack involved a much larger dam in central Oregon, the Arthur R. Bowman dam near Bend."
By 2021 the confusion had changed sides. A trade publication wrote:
"It's possible the Iranians meant to target this dam ... but mistakenly hit Rye Brook instead."
The flipped version invents target selection: it says the intruder was hunting a large dam and missed. Nothing on the record says he chose Bowman Avenue at all, let alone mistook it for another dam.
Who discovered the intrusion, and when?
No primary record names who found the intrusion. The only date comes from the dam's owner: the City of Rye says the Department of Homeland Security approached it "in or about September 2013" about apparent unauthorized access to the city's computer system relating to the dam, and that "in or about January 2014, the DHS provided a report to the City, containing findings, conclusions and recommendations."1 Whether those recommendations were acted on before the gate first ran in spring 2014 is on no record.
The account that US intelligence analysts noticed the intrusion while watching machines tied to Iranian hackers comes from the Wall Street Journal's reporting, not from a government document.5,6
What is still not known about Bowman Avenue
How the intruder got in. The cellular modem is reporting of a Homeland Security summary we have not seen, and the indictment has not been read as text.5,11
How the system was found, and whether it was selected at all. The search engine account comes from people close to the investigation.7
Who discovered the intrusion. The city dates only the Homeland Security approach, in or about September 2013.1
Whether any command was sent or attempted.
How the system authenticated a remote user, or whether it did. No investigating body has published a root cause.
What, if anything, changed before the gate first ran on or about 30 April to 1 May 2014, and whether the January 2014 Homeland Security recommendations were acted on.1
Whether a later sluice gate replacement, reported locally at about a million dollars, has any connection to the intrusion. No record we found links them.
The total cost of the incident. Only remediation, over $30,000, is published.2
Claims about Bowman Avenue the record does not support
Widely repeated claim
What the record says
"The Iranians meant to hit a bigger dam in Oregon and got the wrong one."
Inverted. The original reporting says US investigators initially thought the Oregon dam was involved. Nothing on the record says the intruder chose Bowman Avenue at all.5,10,12
"The dam was offline for maintenance."
A gate, not the dam: the sluice gate "had been manually disconnected for maintenance at the time of the intrusion."2
"Iran's Revolutionary Guard hacked a New York dam."
One man was charged, employed by a company the Justice Department says "performed work on behalf of the Iranian Government, including the Islamic Revolutionary Guard Corps." Charged, not convicted.2
"Access was through a cellular modem."
Reporting of an unclassified Homeland Security summary. Neither Justice Department release mentions a modem.4,5,6
"They got in with credential stuffing, weak credentials, a port scanner and firmware enumeration."
None of these appears in the Justice Department releases, the FBI notice, the owner's statements or the original reporting.2,4,8
"It was part of Operation Cleaver, in retaliation for Stuxnet."
The charging record never uses the name Operation Cleaver, and no government has acknowledged Stuxnet.2
"The same actors are behind the 2026 attacks on US water systems."
No record links them by actor. The July 2026 wave is unattributed in every government document; see our US Water Campaign entry. Adjacency of sector and vector is not continuity of actor.
Including our own. Our Volume 1 Hackopedia page gave the impact as "None due to dam being offline for maintenance," stated credential stuffing, weak credentials and firmware enumeration, filed the intrusion under Operation Cleaver as retaliation for Stuxnet, and named the Revolutionary Guard as the attacker without qualification.13 Our anniversary blog of 24 August 2026 put "The Same Country" in a headline over the unattributed July 2026 water wave, stated the cellular modem as fact, called press release wording "the indictment's wording," said "Thirteen years ago today" four days before the intrusion's anniversary, and said "the village" replaced a gate the City of Rye owns.14 All are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the save was a state, not a design
Analysis, not a disclosed fact
Every account of Bowman Avenue turns on one Justice Department sentence: the access would normally have let the intruder operate the sluice gate, and it did not, because the gate had been manually disconnected for maintenance.2 The thing between a remote session and a physical gate was not a control anyone designed. It was a work order. The crew that unhooked the gate did its job, and the city that owns the dam cooperated with the investigation.1 This is not an argument about competence. It is about which state the site was in: inside a real control system, reading real values, with no command on the record and no physical effect. The rung above was closed for a temporary reason. A gate under maintenance goes back into service, and the city says this one first ran in spring 2014; what changed before then is on no record. This is BlastWave's analysis, not a disclosed fact: the save was a state, not a design.
A physical disconnect is the most honest control in operational technology, because it does not know who is asking. At Bowman Avenue it was an accident of the calendar. The lesson is to build that state in on purpose, as the default, with an alarm when it changes, rather than waiting for a maintenance week to supply it.
Podcast: “The Car on the Lift” (8:59). Joe Baxter and Cam Cullen on why a maintenance job, not a control, kept the gate shut, and what changes the day it goes back together.
Video: Bowman Avenue Short (60 to 90 seconds).
Frequently asked questions
What happened at the Bowman Avenue Dam?
According to the Justice Department in March 2016, an intruder repeatedly accessed the SCADA system of the Bowman Avenue Dam, a small flood-control dam in Rye Brook, New York, between 28 August and 18 September 2013. He read water levels, temperature and the status of the sluice gate but could not operate the gate, which had been manually disconnected for maintenance. Remediation cost over $30,000. One man was charged and has not been tried.
Could the hacker have opened the Bowman Avenue Dam's floodgate?
Not at the time. The Justice Department said in March 2016 that the access would normally have permitted remote operation of the sluice gate, but the intruder did not have that capability because the gate had been manually disconnected for maintenance. No command is on the record, and the City of Rye says the gate was never manipulated by unauthorized users. Whether a command was attempted is not stated in any record we could read.
Who hacked the Bowman Avenue Dam?
In March 2016 the Justice Department unsealed charges against Hamid Firoozi, network manager at ITSec Team, an Iran-based company it says performed work on behalf of the Iranian government, including the Revolutionary Guard. He was one of seven Iranians indicted in a case mainly about attacks on the US financial sector. He is charged, not convicted; the FBI lists him as wanted and thought to be living in Iran.
How did the hackers get into the Bowman Avenue Dam?
No record we could read says. The Wall Street Journal reported in December 2015 that access was through a cellular modem, citing an unclassified Homeland Security summary, and press in March 2016 reported, citing people close to the investigation, that the system was found through search engine queries. Neither Justice Department release mentions a modem or describes how the system was reached.
Did Iranian hackers mean to attack a dam in Oregon instead?
No record says so. In the Wall Street Journal's December 2015 reporting, it was US investigators who initially thought the much larger Arthur R. Bowman Dam in Oregon was involved. By 2021 a trade publication had inverted this, writing that the Iranians may have meant to hit Oregon and mistakenly hit Rye Brook. Nothing on the record says the intruder chose Bowman Avenue at all.
Was the Bowman Avenue Dam offline during the hack?
No. The Justice Department said in March 2016 that the dam's sluice gate, not the dam, had been manually disconnected for maintenance at the time of the intrusion. That maintenance state is why remote gate operation was unavailable. The City of Rye says the gate was added in about June 2013 and first used during a storm on or about 30 April to 1 May 2014.
How much did the Bowman Avenue Dam intrusion cost?
The only published figure is remediation, which the Justice Department said in March 2016 cost over $30,000. The total cost of the incident has not been disclosed. A later sluice gate replacement, reported by local press at about a million dollars, is not linked to the intrusion by any record we found and should not be presented as a consequence of it.
Is the Bowman Avenue Dam hack linked to the 2026 attacks on US water systems?
Not by actor. The July 2026 wave of intrusions at US water systems is unattributed in every government document, and a spring 2026 federal advisory named only Iranian-affiliated actors without a confidence level. The two share a sector and a kind of path, a remotely reachable controller at a small water asset, but adjacency of sector and vector is not continuity of actor.
Primary sources are the Justice Department's two charging releases of 24 March 2016, the FBI's wanted notice and the dam owner's own statement; no advisory was issued for this incident. Press is cited only as evidence of what was said.
GovernmentCity of Rye, statement by City Manager Marcus Serrano on the Bowman Avenue Dam, December 2015 (myrye.com). The dam's owner's own account.
FederalUS Department of Justice, Office of Public Affairs, press release 16-348, "Seven Iranians Working for Islamic Revolutionary Guard Corps-Affiliated Entities Charged for Conducting Coordinated Campaign of Cyber Attacks Against U.S. Financial Sector," 24 March 2016. justice.gov
PressCBS News New York, report on the charges, 24 March 2016. Cited for the description of the dam as "a small flood-control structure." cbsnews.com
FederalUS Attorney's Office, Southern District of New York, "Manhattan U.S. Attorney Announces Charges Against Seven Iranians For Conducting Coordinated Campaign Of Cyber Attacks Against U.S. Financial Sector On Behalf Of Islamic Revolutionary Guard Corps-Sponsored Entities," 24 March 2016. justice.gov
PressWall Street Journal, "Iranian Hackers Infiltrated New York Dam in 2013," 20 December 2015. Paywalled and not read at first hand; its claims are cited through same-week republications (The Register, Power Magazine, Fox News, CAMERA), which agree. Cited as evidence of what was reported.
PressThe Register, report republishing the Wall Street Journal's account, 21 December 2015. Cited for the cellular modem and the crawler account as reported.
PressLily Hay Newman, Slate, 30 March 2016. Cited for the search engine discovery account, sourced to people close to the investigation speaking to the Wall Street Journal.
FederalFederal Bureau of Investigation, wanted notice, "Hamid Firoozi." fbi.gov · Poster (PDF)
PressMax Kutner, Newsweek, 30 March 2016. Cited for the city manager's and the Rye Brook mayor's accounts.
PressPower Magazine, report republishing the Wall Street Journal's account, 22 December 2015. Cited for the investigators' initial Oregon confusion as reported. powermag.com
Court recordIndictment, United States v. Ahmad Fathi et al. (S.D.N.Y.), returned 21 January 2016, unsealed 24 March 2016, published by the Justice Department as a scanned PDF. Not read as text; cited for its existence only.
PressControl Engineering, "Throwback Attack: How the modest Bowman Avenue Dam became the target of Iranian hackers," 12 August 2021. Cited as an example of the inverted Oregon account. controleng.com
CompanyBlastWave, Hackopedia Volume 1 entry "Bowman Avenue Dam, USA (2013)" (hackopedia.blastwave.com). Cited as evidence of what we said.
CompanyBlastWave blog, "Thirteen Years After Bowman Avenue: The Same Country, the Same Modem," 24 August 2026. Cited as evidence of what we said.
Cite this page
BlastWave. “Bowman Avenue Dam Intrusion (2013): What Is Verified.” Hackopedia, Volume 2, FILE 019. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/bowman-avenue-2013/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 019 in Hackopedia Volume 2, in the Water edition.
28 Sep 2026
Hand-check and final review: the 2021 trade-press sentence that inverted the Oregon confusion was read at source and its date and wording confirmed; the page was checked against the full record and against related entries.
26 Sep 2026
Full validation: every charging-record fact re-read in the two Justice Department releases and the FBI notice. The City of Rye's own statement was added; it dates the Homeland Security approach (about September 2013), a January 2014 report with recommendations, and the gate's first use (spring 2014). Statements that had called the discovery date and the gate's return undisclosed were corrected, and an inference that nothing changed before the gate returned was withdrawn.
24 Sep 2026
Volume 2 entry built from primary sources. Corrected Volume 1 errors: the dam described as offline, access methods no document supports, and a campaign name the charging record never uses.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
Rye Brook, New York, US
22
Print edition · Volume 2File 019 as a printable pageThe same record, laid out for print: one page, US Letter, PDF.Download PDF · 246 KB