By Kevin M. Morley, PhD

It’s not a matter of if, but rather a matter of when a water utility will be impacted by a cyber incident. No water utility is immune from this threat.

So does size matter? The glib answer is of course it matters. The reality is that all water systems of any size now have virtual footprints that far exceed their physical perimeter. Cybersecurity is more than just ensuring that the customer service, accounting, and human resources folks protect personally identifiable information (PII) and conform to HIPAA (the Health Insurance Portability and Accountability Act of 1996) rules. It goes well beyond keeping your desktop or laptop operating systems updated with the latest patches from Microsoft or Apple. The growth in the Internet of Things (IoT), or more specifically, the Industrial Internet of Things (IIoT) has led to greater efficiency in leveraging data to optimize utility operations and processes. This includes all of the employees with smartphones, iPads, Kindles, and laptops that IIoT allows to remotely access, monitor, and manage the system. Included here are folks with personal devices that may ride along or otherwise “touch” a utility network, such as charging via a seemingly innocent USB cable or plugging in a memory stick from an unknown source.

#1. All water systems have people. Most, if not all, utility employees have computers that support some level of internet connectivity for business purposes like e-mail. This may or may not include the computer that runs supervisory control and data acquisition (SCADA). Most of these employees also have smartphones or similar devices that may or may not be provided by the utility.  Everyone is at risk of clicking on something that has a virus. Think about those e-mails from “friends” that say, “Here’s something you need to see: www.dontlook.com” or those e-mails from a long-lost relative who only needs a little bit of help.

As a result, this can expose a utility’s business and operating system to bad actors, which can have a significant financial or operational impact. “Bad actor” is a term used for cybercriminals. Ransomware is the most frequent and simplest attack, which basically blocks an owner from accessing various files and demands payment for recovery…rarely are those files returned. This type of attack is rampant, as represented in this graphic.

Source: Verizon, 2017. Data Breach Investigations Report, http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/.

#2. Operating systems are not consistently maintained/patched. A large percentage of successful attacks, across all sectors, have exploited vulnerabilities that have had mitigation patches available for decades. The only way to know that things are in good shape is to determine what controls are in place relative to what should be in place to protect a utility’s systems, especially process control systems. Resources such as the use-case tool developed by AWWA provide a utility with a clear set of prioritized controls that, if implemented, can mitigate the risks associated with cyberthreats. This does not mean the utility will not be targeted, but it does help lower the likelihood a hacker will be successful. This is a classic case of open versus closed—the more “doors” that are left open and unsecured, the greater the access and opportunity for bad actors. 

#3. Nobody knows ABC Water. It is reasonable for one to think that a large city’s water utility is a more attractive target when compared with Smallville’s utility. That concept does not work in cyberspace; while some attacks are targeted, many others are very opportunistic. In a few clicks and strokes of the keyboard, a hacker can distribute millions of e-mails to propagate their malware. In addition, consider that many control systems were installed before cybersecurity was something to even worry about. As a result, many utilities may not realize that portions of their system have publicly facing IP addresses that are easily targeted by bad actors using sources like SHODAN, a library of sorts for devices connected to the internet. Even if your IT staff or vendor says you’re not connected to the internet, verify that this exposure pathway is indeed closed. In this case, the size of the utility hosting a publicly facing device is completely irrelevant and unknown to the prospective exploiter. If these devices are important to your operations, protect them and manage them accordingly, using the recommended controls. That begins with securing these devices and turning on the security settings many devices already have in place rather than using default settings that anyone can look up online.

Bottom line: Cybersecurity matters. The size of your utility does not matter when it comes to cybersecurity. If a system is critical to your utility’s operations, you’ll need to implement controls to manage its cyber-risk. I suspect all your systems are critical; otherwise they never would have been installed, so get on it before it’s too late.

Kevin M. Morley, PhD, is AWWA’s Manager of Federal Relations. He can be contacted at kmorely@awwa.org.

The US Environmental Protection Agency (USEPA) continues to look at many of the same issues, but with new context. The past year’s deregulatory shift has brought considerable uncertainty to environmental rule making.

The past year has been a time of change and uncertainty for water regulations. First, a whirlwind of regulatory actions blew through in the last months of the Obama administration, including USEPA’s final fourth Unregulated Contaminant Monitoring Rule, the fourth Contaminant Candidate List, the final Risk Management Plan Rule, and rules implementing the Water Infrastructure Finance and Innovation Act. As predicted in the January 2017 Reg Talk column (www.awwa.org/RegTalk/Opflow/January2017), the Trump administration has taken a very different—and perhaps even more sweeping—approach.

PLANS TO REPEAL AND MODIFY RULES

One of the first priorities under the new administration is the implemented, planned, and possible repeal or major modification of several regulations. These efforts are intended to reduce the cost, complexity, and number of regulations in effect.

Executive Orders. The administration has implemented two major cross-agency initiatives. First, Executive Order (EO) 13771, Reducing Regulation and Controlling Regulatory Costs, sets two major rule making and agency requirements. Each new significant regulation must identify two regulations for possible repeal, and the total cost of any new significant regulation combined with repeal or revision of existing regulations must be zero or negative. In this structure, the total number of regulations must decrease, and the total cumulative cost of regulations must either decrease or stay level.

Second, based on another action, EO 13777, Enforcing the Regulatory Reform Agenda, the administration is actively seeking input on regulations to repeal or otherwise modify for possible action regardless of new regulatory proposals. For example, the administration has already issued draft repeals of the Clean Power Plan and the Clean Water Rule (Definition of Waters of the United States), which were the Obama administration’s signature environmental regulations. USEPA leaders have suggested that regulatory cost savings from these actions can

be used to offset other regulations, such as the anticipated long-term revisions to the Lead and Copper Rule.

Public Health, Public Comments. AWWA comments during USEPA’s open call for opportunities to reduce the burden of regulations focused on reducing the water sector’s burden from the Risk Management Plan Rule, streamlining the use of State Revolving Loan Funds, addressing concerns about recent health advisories, and several other issues. Like many other organizations, AWWA sought to identify ways to streamline rules that are potentially

ineffective or otherwise inefficient without compromising public health.

USEPA received 198,047 public comments. Although some essentially said “don’t change anything,” many others suggested a wide variety of changes across nearly every environmental rule administered by the agency. How USEPA (and other federal agencies that collected suggestions) plans to use this information remains to be seen.

Safe Drinking Water Act Protections. The Safe Drinking Water Act (SDWA) contains an “anti-backsliding” provision. This means that for maximum contaminant levels and some other rules that directly address public health protection, once a rule has gone into effect, USEPA can only revise the rule if the new rule is equally or more protective. For example, the revised Total Coliform Rule eliminated the maximum contaminant level (MCL) for total coliforms but substituted new requirements designed to make the rule better protect public health. Therefore, MCLs and key facets to many SDWA rules aren’t likely to be changed under the current deregulatory initiatives.

Congressional Review Act. In addition to the regulations being reviewed or repealed by the Trump administration, Congress has used a mechanism known as the Congressional Review Act (CRA) to eliminate 14 Obama administration rules (most of which are outside of the environmental space). This mechanism had been used successfully only once before this administration, so this may be the beginning of a new precedent. Moreover, attempts are under way to apply the CRA to guidance and advisory documents and for Congress to override agency guidance documents.

DRINKING WATER REGS DELAYED

Some drinking water regulations are still likely, although their timing and content are in flux. Until recently, it seemed likely USEPA would issue a proposal for the revised Lead and Copper Rule in early 2018, with a final rule coming by 2020. However, agency statements now suggest a delay past 2018. Substantial budget cuts also have been proposed for USEPA that could slow down this rule and others. New requirements to conduct economic analysis on existing rules to offset the costs of the new ones add to this budget challenge.

Perchlorate Deadline. Perchlorate is exempt from the regulatory budget because USEPA is under a December 2019 court-ordered deadline to either finalize a rule or make a final decision not to regulate perchlorate. This situation came about when the Natural Resources Defense Council sued USEPA in 2016 over failing to meet a statutory deadline to issue a proposed rule triggered by a positive regulatory determination in 2011. USEPA Administrator Scott Pruitt has since issued new internal guidelines that limit circumstances under which the agency can settle lawsuits, meaning that future litigation may be more drawn out.

The biggest uncertainties surrounding perchlorate are technical, with the appropriateness of a national rule still questioned by many. The model for perchlorate’s metabolism (a critical component of making the rule) is undergoing a second round of peer review, meaning that much work remains before USEPA can set a goal on which to base a proposed MCL.

Other Activities. Among other activities under way is the fourth round of the Unregulated Contaminant Monitoring Rule. After issuing health advisories for cyanotoxins (microcystins and cylindrospermopsin) and certain perfluorinated compounds (perfluorooctanoic acid and polyfluoroalkyl substances) in 2015 and 2016, respectively, USEPA and state agencies continue to seek additional ways to understand the risk posed by these substances and how to best manage environmental exposure. This means a future drinking water rule for one or both could be a possibility, but not for at least several years. USEPA has included cyanotoxins in the rule to get occurrence information to support decision making.

Also, the agency is reconsidering the Steam Electric Power Plant Effluent Guidelines Rule. AWWA, in collaboration with the National Association of Water Companies, is advocating for stricter controls on bromide to reduce disinfection byproduct formation at downstream water treatment plants. AWWA utility members should stay tuned for regulatory alerts on these and other issues.

STATES ACTING ON THEIR OWN

Given the combination of delays, which aren’t a new phenomenon, and ongoing deregulation at the federal level, some states are deciding to set their own standards in lieu of waiting for federal guidelines. SDWA and most other environmental laws allow states to pass regulations more stringent than federal standards if they choose. Although such regulations are common in a few states, their total number and distribution could increase in the next few years, especially if federal delays on anticipated rules continue. However, most state regulatory offices operate on limited budgets and don’t have the scientific, economic, and technical capacity that USEPA has when it develops a rule.

In 2018, the agency will push state SDWA primacy agencies to transition to a replacement data system for compliance monitoring reporting. What this means in each state will be different, but water systems should anticipate requirements for electronic compliance data reporting and be prepared for compliance data being rapidly available to the public through state and federal data systems. USEPA’s Safe Drinking Water Information System (SDWIS) Prime data system is scheduled to be operational in March 2018, and states are expected to transition to SDWIS by the end of the year.

MINIMIZE REGRETS

Although future regulatory requirements may be uncertain, now is the time for water utilities to take actions that promise significant benefits regardless of regulatory changes:

Invest in Infrastructure Maintenance and Renewal. Managing distributed water quality goes hand in hand with maintaining the infrastructure used to deliver it. In addition to improving water quality in the distribution system, infrastructure improvements often help ensure adequate supply, reduce water loss, increase energy efficiency, increase reliability, and improve consumer confidence. Given the long lifespan of most types of infrastructure, renewal and replacement is an opportunity to assess and improve on all of these concerns and others, saving money, energy, and resources through sound investments. Taking advantage of opportunities through the Water Infrastructure Financing and Innovation Act, State Revolving Loan Funds, the bond market, and other resources help to make these investments affordable.

Ensure Technical, Managerial, and Financial (TMF) Readiness. Lead and Copper Rule revisions, along with newly recognized contaminants such as perfluorinated compounds, represent significant financial and technical challenges on the horizon. TMF fundamentals are essential for water utilities to effectively handle such challenges.

Review Corrosion Control Practice. Water utilities need to ensure their staffs understand corrosion control in terms of current water supplies and treatment schemes as well as anticipated water supplies and wholesale accounts.

Talk to Customers. Service expectations are set and met locally, so open and transparent communication on hard topics like lead service line replacement, Legionella, cyanotoxins, and perfluorinated compounds requires building positive two-way communication with local decision makers and customers.

Although the regulatory landscape looks a lot different and more uncertain than it did a year ago, the level of activity nevertheless remains high. AWWA’s Water Utility Council and Government Affairs Office will continue to push for cost-effective regulations that protect public health.

Adam T. Carpenter is manager of energy and environmental policy at AWWA (www.awwa.org), Washington, D.C. Reprinted from AWWA’s Opflow magazine.

Resources abound for understanding intelligent water systems

Corey Williams and Lisa McFadden

Intelligent water systems (IWS) are built to link together sensors, control systems, information management, and communications systems. They emphasize the water sector’s opportunity to take advantage of advanced technologies and dramatically shift management decision making.

While there are varying ideas of what an IWS may be, there’s not one singular definition. Some see the concept as a small piece to help in analyze and process data both historical and real-time data; others see this integration as an opportunity to overhaul their entire decision making or performance management approach.

How far each utility or facility chooses to take the IWS concept will vary, but many water sector organizations have produced resources to help guide these choices.

Key mechanisms

The Water Science & Engineering Center within the Water Environment Federation issued a technical report that identifies the key mechanisms needed for utilities to start and run a successful intelligent water systems program. Titled, Intelligent Water Systems: The Path to a Smart Utility, the report explores the following 10 topics.

·         Data prioritization — First and foremost, utilities must decide what data is needed and how the data collected will fit into the ultimate strategy and goal of the utility. Data should not be collected for the sake of collection; collecting data takes time, staff, and money. The right data, at the right time, needs to be captured. This critical data must be accurate, complete, and aligned with business and operational management requirements.

·         Data governance — Prior to data capture, system managers need to formulate a data governance approach. This includes identifying data stewardship, storage and access rights, and archiving and deletion protocols. For example, by deciding these responsibilities ahead of time, data processing issues can be ironed out. Developing a data management and governance plan also can help reveal gaps in the system.

·         Data capture — This aspect is probably the most notable component of the process. With all the new and emerging technologies, utilities have vast options for how to capture data and how much to capture. With many new technologies promoting real-time data capture, it is important to note the difference between real-time data and data frequency. While real-time data deals with how quickly the user receives measured data, data frequency refers to how often the data is gathered.

·         Data validation — With speed and an abundance of tools choices, data validation becomes an important component. While collecting data is easy, the goal is to be confident in the data being receiving.

·         Data processing, storage, and access — Organize your data! Historically, data organization is sometimes forgotten. With newer platforms and easier accessibility, the storage, query, and transfer of data is now more manageable than ever. Data organization includes the formulation and upkeep of database table structures that fit the needs for analytics (as distinct from the database table structures for transaction processing).

·         Data integration — By prioritizing and organizing data, users can integrate easier this data into existing systems and processes easier throughout the utility and networks. Remembering the prioritization and overall purpose of the data can help ensure they are being applied in a useful way.

·         Data analytics — With Big Data come big opportunities. By incorporating data analytics, utilities can transform what’s been collected into information. Utilities can choose many types of data analytics tools to use. The ultimate performance goal or outcome helps choose the right platform or tools to perform the analytics.

·         Business intelligence and decision support — With the information provided, utility personnel can make operational and business decisions. By incorporating the information provided from the data analytics into modeling, optimization, and even predictive analysis tools, utilities can look at many different scenarios and find the best solution. By utilizing IWS, water sector agencies can get a big picture view, with the goal of making an informed decision. Theses decision support tools are not just for big capital improvement projects (CIP), but also can be applied to real-time situations and scenarios, through dashboards and cloud-based operations.

·         Knowledge sharing — Once useful information has been attained, it can be integrated throughout the utility’s system and utilized in cloud based systems, allowing the information to be centralized and used across all utility functional groups. By sharing information throughout a utility, data silos fall away. This enables all stakeholders to incorporate the same information into their decision-making processes. Further, data sharing can encourage its use for beneficial purposes that might not have been intended originally.

·         Performance reporting and visualization — IWS is not always just for predictive and decision-making tools, it also can show how efficiently a water sector agency is operating. Coupling tool for performance data and visualization  — such as interactive mapping or GIS, dashboards, or chart pop-ups — can provide useful insight into areas of need and improvement. Once performance gaps are identified via these visualization methods, water sector agencies can use optimization tools to improve operations, reduce energy usage, lower costs, or develop adaptive master planning and CIP. IWS provides the data and information that utilities need to take a step back and look at where improvements may be needed.

IWS drivers

Similar to the concepts identified by WEF, the National Association of Clean Water Agencies (NACWA; Washington, D.C.) identified several IWS drivers. NACWA published these findings in the white paper, Envisioning The Digital Utility Of The Future. The paper lists eight drivers for utilities, which include

·         reduce operational costs,

·         manage and mitigate risks,

·         enhance the customer experience,

·         improve financial execution,

·         optimize asset performance and uncover hidden value,

·         leverage existing communications and computing platforms,

·         maximize the engagement and efficiency of employees, and

·         integrate water quality, policy, and performance.

Wanted results and simple framework

At the 2018 AWWA/WEF Utility Management Conference (UMC), participants in the workshop, Demystifying the “SMART” Utility, shared their opinions on where IWS can help most. Fully two-thirds of the attendees believed cost reduction and asset optimization to be the most important result of IWS implementation. Figure 1 (p. xx) shows the full results of their voting.

The Smart Water Networks Forum (SWAN) is a non-profit organization that seeks to be the leading global hub for the smart water sector. This group, a WEF partner, seeks to accelerate the awareness and adoption of data-driven technologies in water and wastewater networks worldwide. To help communicate the critical components of IWS, SWAN has developed a five-level framework to clearly define the components.

·         The Physical level comes first. This includes components such as its pipes, pumps, valves, reservoirs, and tanks. As physical water infrastructure only, without data collection or analysis, this layer is often not considered “smart.”

·         The Sensing and Control level includes the initial components enabling IWS. These include sensors, meters, pressure-reducing valves (PRV), and automatic meter reading (AMR) and advanced metering infrastructure (AMI).

·         The Collection and Communication level are technologies that enable storage and transmission of data. Examples include fixed cable network, radio, cellular, and Wi-Fi.

·         Supervisory control and data acquisition (SCADA) system, cybersecurity, and customer information systems (CIS) and geographic information system (GIS) are prime examples of the Data Management and Display level.

·         Data Fusion and Analysis is the ultimate IWS level. These technologies perform data analytics and modelling to help operators by assessing effects of changes, responding to them in real-time, optimizing operations, and planning for enhanced decision-making.

Based on these five levels, the same UMC workshop participants who identified cost savings and asset optimization as primary drivers, claimed that the largest resource gap existed at the Data Fusion and Analysis and Collection and Communications levels. The implications are that, in general, water and wastewater utilities appear to have SCADA (level 4) for data management and display and instrumentation and sensors (level 2) in place. However, the need to communicate the data from the sensors to management platforms and the lack of ability to perform analysis for enhanced decision-making are the areas of greatest needs to take full advantage of IWS. Figure 2 (p. xx) shows the workshops participants full opinions on the needs for IWS implementation.

Changing workforce and skills

With the implementation of IWS, utilities will start to see a rise in the need for some new skillsets, including data science and data engineering. While current utility personnel may hone some of these skills, these are things that the utility engineer of the future will need to possess. It is important to make students aware of resources that exist outside the “typical” water engineering realm, and that is evident is the large mix of water personnel we are starting to see today.

Figure 1. Most desired benefits of intelligent water systems

Figure 2. Largest resource needs for intelligent water system implementation

About the Authors

Corey Williams is CEO of Optimatics (Overland Park, Kan.) and chair of the Interoperability Task Force for WEF’s Intelligent Water Technology Committee,

Lisa McFadden is director of Integrated Technical Programs and associate director of the Water Science & Engineering Center  at the Water Environment Federation (Alexandria, Va.).

In early August 2017, AWWA President Brenda Lennox, CEO David LaFrance, McCain, and other Association volunteers and staff met in Washington with representatives from Soldier for Life, Marine for Life, Veterans Affairs, the Department of Labor, and Department of Defense to build awareness and strategies that help veterans work in the water sector. And a defined strategy behind the Veterans Workforce Initiative was born.

The goal of the Veterans Workforce Initiative is to help veterans secure jobs in the water industry. The program has two aspects:

•  A volunteer support network
•  Tool kits —                           

1.   One for separating military personnel (How to Find a Job)
   
2. One for utilities (How to Hire a Veteran)

AWWA will oversee and manage the volunteer network. We will triage the requests and forward them to the appropriate section volunteer. AWWA will provide training for the volunteer network. The tool kits will be finished by ACE18. They will include resources for veterans that explain the training needed to work in the water sector and how to connect with education programs and utilities. AWWA will manage the development and promotion of the tool kits.

AWWA is currently seeking volunteers to serve on the Veteran Network. Volunteers need to be able to

•   communicate training/education/certification requirements.
•  make personal connections to utilities and employers to help veterans get their foot in the door.

AWWA will provide training and resources to volunteers. A time commitment will vary depending on requests; most volunteers will spend less than 10 hours/year on this project. This volunteer opportunity can be 100% virtual. Volunteers are not required to meet in person with separating military personnel.

To volunteer for the Veterans Workforce Networking Initiative contact Chad Weikel, Manager Education and Workforce, 303.347.6130, or Amy Brown, ETS Coordinator, 303.347.6189.

If you have questions about the Veterans Workforce Initiative, feel free to contact Chad Weikel, Manager Education and Workforce, 303.347.6130, or Amy Brown, ETS Coordinator, 303.347.6189.