> The attacker demonstrated intent and capability to inflict public harm.

This is if you take the facts in this story at face value. In my mind, if someone can raise the level of a chemical to become dangerous, you already have a problem. 11000 ppm sounds huge to me (1.1%). What if instead of an external hacker you had an internal disgruntled employee. What if you had a leaky gasket. The system should have some multiple redundancies to not allow a dangerous level of a chemical to end up in the water supply.