The Worst News of the Day
(Or How Bad Is It?)
Who is taking land, who is paying for the power and what switches on next. Free, and you can leave whenever you like.
Some 379 machines that open valves and drive pumps across America’s gas country sit wide open on the internet, taking orders from anyone who asks.
The small industrial computers keep gas pipelines running — opening valves, starting pumps, regulating pressure. They’re designed to operate deep inside private control networks. But 379 of them are exposed directly to the public internet.
Worse, they communicate using a 40-year-old industrial protocol that was never designed to authenticate who is sending a command. There is no username. No password. No built-in way to distinguish the authorized operator from a stranger. Send a valid command, and the controller executes it. To the machine, everyone looks like the operator.
Real pipeline controllers a stranger could reach on the open internet.
Passwords, PINs or locks standing between them and anyone who asks.
That reads HIGH. It has read HIGH all summer.
Small industrial computers — controllers — that physically run pipelines and gas plants. They open valves, start pumps, hold pressure. Cruise control for a pipe.
They were built to live on private, walled-off networks. These 379 answer from anywhere, the same way a public website does.
They speak Modbus, a machine language from the 1970s with no login built in. It never checks who is talking. A stranger’s command looks exactly like the operator’s.
Reading a gauge is one thing. These can be told to act — throw a valve, change a setting. That is the difference between watching the tank and emptying it.
Scan the whole country and 69,631 things answer on this one port. Strip out the traps and toys and only a hard little core is real equipment.
99 percent of what answers is decoys, junk and internet noise — including 1,560 honeypots, machines set out on purpose to look vulnerable and waste an attacker’s time. The 379 is what is left after the bait is thrown out.
Texas, Ohio, Louisiana. The exposed controllers cluster in oil-and-gas country.
Violet is oil-and-gas country, where the steel really sits. Grey states are likely inflated: the internet reports where a machine’s address is registered, not where the machine is.
One town in Louisiana sets the price the whole country trades on.
In Erath, Louisiana, sits Henry Hub — the single delivery point the entire U.S. natural-gas futures market prices against. Louisiana carries 277 of these exposed controllers, in the same Gulf Coast corridor whose meters and compressors run on this exact gear.
A faked flow reading, or a valve forced at the wrong meter, does not just move gas. It moves the number the market prices against. That is the chaos worth watching.
One metric runs through the whole site. It rates two different things by two different methods, but on the same terms — countable public signals only, and a stated basis under every number.
The meter. The How Bad Is It? meter on the daily Big Drop rates cybersecurity vulnerabilities in industrial controls, and it uses the industry’s own numbers, not ours. Each day it features one verified flaw in control-system gear, chosen from a curated list of flaws that are confirmed exploited and reachable on U.S. networks, never repeated within seven days. The needle is that flaw’s base score under the Common Vulnerability Scoring System (CVSS), as published in the National Vulnerability Database, on CVSS’s own 0-to-10 scale and banded by the published rating scale — 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, 9.0 to 10 Critical. The caption states the other standard facts as facts: whether the flaw is on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities list, whether that list records ransomware use, the Exploit Prediction Scoring System (EPSS) probability published by FIRST.org that the flaw is exploited within 30 days, and the number of exposed U.S. devices counted on Shodan that morning. Because every featured flaw is confirmed exploited, most days read High or Critical. That is the truth about the list. What is editorial is which flaw is featured, and the rule for that is stated here.
The story. Each day’s worst news is chosen by rating nine consequences of the buildout — the land, local control, the water, the noise, the air, the wildlife, your bill, the grid, the controls — on The Big Drop’s own 0-to-12 editorial index, and leading with the worst. Seven of the nine are scored on legislative pressure: live state bills sorted by subject from the words in their titles, where one bill scores 6, two score 7, three score 8, four or five score 9, and six or more score 10. Live means the bill had legislative action in the last 90 days and did not fail, die, get vetoed, or get postponed. A bill that has been enacted counts too, and the rating names it separately as a law — a law on the books is the stronger signal. Bills whose titles match no subject count for nothing. The ladder is the whole rule for those seven: no floors, no handicaps, and a consequence with no qualifying bill scores nothing and does not appear. Two of the nine are scored differently. The grid is scored on year-over-year growth in peak electricity demand as reported by the Energy Information Administration (EIA), from 3 for under 3 percent to 10 for 15 percent or more. The controls are scored from the same flaw the meter features that day, its Common Vulnerability Scoring System (CVSS) severity converted to this 12-point index, so the story rating and the meter can never disagree. The land draws on more than bills as well: a condemnation case on a court docket scores 7 on its own, and reports from landowners are counted. A report from a social account on its own can flag a consequence but never rate it above Moderate — a documented case or a live bill is what earns a higher rating. Ten to twelve reads Severe, seven to nine High, four to six Moderate, three or below Low. The rating runs under the headline — consequence, band, score and the count that produced it. The weighting is ours, published so anyone can check it.
The risk score at the top of this page is a third, longer-running figure — the tracker’s own six yes-or-no exposure factors for the Modbus fleet — and is neither the daily meter nor the story rating.
Violet points are the real field controllers; grey points are cloud-hosted decoys. Each sits at the location its internet address registers to — not always where the steel is. Tap a dot for its city, network and model.
Every figure here is a public internet scan, dated and repeatable. The Big Drop only watches what is already public — it never touches, probes or logs into anyone’s machine, and no single device is named. The 379 is an estimate built from a confirmed sample, so read it as “a few hundred,” not an exact census. Being reachable is not the same as being attacked. It is the same as leaving the door unlocked. Snapshot 2026-09-12.
Check our work — the raw numbers are downloadable: CSV · history CSV · GeoJSON · KML for Google Earth. They refresh every morning.
Good choice…
I’ll be in touch as soon as I can.
