(TLP:CLEAR) Advisory – Safeguarding Sensitive Operational Information

Summary: AWWA and WaterISAC are advising water and wastewater systems to closely safeguard sensitive operational information following multiple public records requests from artificial intelligence (AI) service providers.

While it is unclear how the data would be used, in one case, an AI service provider appeared to have direct knowledge of the data historian used by the utility and specifically asked for “all SCADA logs for 2026 for all treatment, distribution and wastewater management systems.” In addition, the requestor(s) added that they were seeking “daily or hourly historical logs for the following environmental and physical process indicators only:

• Inflow and outflow water volumes/flow rates (MGD).
• Aggregate water quality baseline metrics (e.g., daily average turbidity, pH, dissolved oxygen, and conductivity).
• Historical reservoir/tank storage elevations or percentage capacity levels.
• Aggregate daily energy consumption or equipment run-times (e.g., daily total pump hours), without any active electrical load telemetry.”

This information has obvious operational sensitivity that defines a system’s continuity of service. Utilities should be aware that while individual data requests may appear benign, the aggregation of operational data across multiple systems has the potential to reveal patterns, vulnerabilities, and system behaviors. Such operational data could be used maliciously to threaten continuity of service which could harm the public and national security interests.

AWWA prepared a report in 2019, Protecting the Water Sector’s Critical Infrastructure Information, that summarizes each state’s information disclosure exemptions that can be used by a water system to protect sensitive information. It is best practice for utilities to carefully consider the potential sensitivity of the information being requested and make a risk-informed decision on whether, and under what conditions, to respond in compliance with applicable state information protection laws.

Water systems are encouraged to closely review public record requests, such as the one described, to ensure the interests of the water system are not compromised. It may be appropriate to review disclosure protections under current state law with legal counsel.

Utilities with concerns or having received similar requests are encouraged to share that information with WaterISAC for tracking. Likewise, utilities are invited to contact Kevin Morley, federal relations manager, with questions.