My company manufactures control/telemetry equipment for municipal utilities, and we also author a great deal of firmware/software for this equipment. We have been very tuned into the security aspects of these control systems for years now. As you can imagine, we are focused upon this more now than ever.
Have suspicious arabs shown an interest in these systems? Yes. Homeland Security had heard of some inquiries, and they sent us a fax this past winter to be on guard. Also, our company was approached once. A few years ago, a saudi requested detailed information on our control system via email; and we responded with the standard brochures (nothing sensitive). Didn't think much about it at the time, and deleted the email long ago. Also, he didn't like my "foreign business policy"... foreigners pay in advance :-)
This summer, we also observed a man making inquiries to an internet programmers newsgroup targeted toward web server programmers/administrators on Windows platforms. All of his requests focused on finding ways to break into web servers such as Apache, IIS, and Netscape. It became very apparant when looking at all of his posts as a whole. We found that his ip address is in the united arab emirates, and then we notified the FBI with the info. (don't know if they pursued it further.)
Do I think they will hit our water and power supplies? Not really. I have yet to see them take any action which is not based upon killing a lot of people.
Shutting down computerized water pumping stations will not even run people out of water. First, most water systems have a large amount of pressurized storage (water up in the water towers). Second, every piece of industrial equipment that I have ever seen always has "manual" controls in addition to the computers. Could they poison a water supply? Does anyone know how much poison it would take to overcome the dillution of 10's of millions of gallons in a water system? Not likely to happen. Anthrax in the water? The chlorine would kill it. Worst case scenario with water: some people get sick, no deaths. Best case scenario: alqaeda gets shot by the neighbor who lives next to the water tower.
Dam control system disruptions? The filling/emptying of a dam is a VERY slow control processes. "Manual" override would be instituted far in advance of any repercussions.
Power? Power is a lot more vulnerable, because there is no "storage" within the system (as with water). Even a short disruption would be noticed. And power is everything. Actually the best way to shut down a water system is to shut down its power. And why attack the power grid control computers, when much more lasting damage can be done through a physical attack? (Look at what we did to the power system in Yugoslavia). However, although a power shutdown would be pretty darned inconvenient, I still don't see how it is going to kill Americans.
In summary... I don't see alqaeda pursuing this computer hacking angle, because it doesn't kill anybody. These guys are all about killing.
ps. This is just my educated opinion. I'm sure there are smart people who would disagree.... and sorry about the long post. Usually I specialize in short, smartass comments. :-)
Al Qaeda has said that one of its goals is to destroy our economic system. Seems to me that demolishing a large part of our infrastructure -- financial and otherwise -- would go a long way toward acheiving that aim.