Data Protection and Cybersecurity for Small and Medium Systems

Many water utilities rely on online technology and computer systems to increase their working efficiency. In the office space, data management software, pay roll systems, customer billing programs, utility websites, and social media improve customer services and provide an organized method to retain and access utility information. On the operational side, employees may rely on remote access control systems such as SCADA or smart metering to monitor or control systems while performing maintenance in the field. These control systems allow for improved response times and monitoring.

Yet as we all learned from Spiderman, with great power comes great responsibility. Without sufficient cybersecurity measures, systems risk the health and security of their customers. Successful attackers can steal customer personal data such as credit cards, social security numbers, and contact information. They may attempt to deface utility websites compromising customer confidence. If your system uses online process control systems, hackers could lock out utility access, alter treatment processes, damage equipment, and override alarms. The American Water Works Association (AWWA) has listed a variety of cyberattacks and their consequences in its 2018 Cybersecurity Risk & Responsibility in the Water Sector Report. These attacks resulted in leaked customer information, considerable financial losses, altered chemical dosing, and even source water contamination. Just recently staring in May of 2019 the City of Baltimore has been held hostage by an ongoing three week cyberattack that demands $100,000 in Bitcoin to free city files and water billing data.

There are many types of cyberattacks including password hacking, the exploitation of software vulnerabilities, denial of service, and malware. Common malware includes ransomware, spyware, trojan horse, viruses, and key loggers. Attacks can even happen through opportunity theft, improper disposal of computer equipment, or phishing attempts where thieves pose as legitimate organizations requesting confidential information.

To prevent cyberattacks, start by identifying vulnerabilities, developing a multi-tier security plan, and actively enforcing that plan. The EPA has developed a guide explaining 10 key components for a cybersecurity plan that includes planning worksheets and information on how to respond in the event of an attack. Systems should plan to update software regularly and require strong passwords that are different for each account. Installing anti-virus software and firewalls is also effective. A security plan should include measures to educate employees on cybersecurity awareness and limit access to security information based on job function.

For an in-depth list of security practices, read through WaterISAC’s 2019 guide to reduce exploitable weaknesses or the EPA’s Incident Action Checklist. The AWWA’s guide on Process Control System Security Guidance for the Water Sector can aid systems using smart technology. To improve social media and website security, start with Hootsuite’s social media security tips and Sucuri’s website security tips.

If a data breech does occur, utilities will want to have and established protocol to resolve and mitigate potential damage. The Cyber Security Adviser Program with the Department of Homeland Security (DHS) offers regional affiliates that will assist systems in vulnerability assessments, plan development, and informational support. While the costs associated with response, forensics, and legal fees can be expensive, waiting to take action can incur an even greater cost. Remember to keep an active cybersecurity plan and, if incidents should occur, report them to local law enforcement, the DHS, and WaterISAC.

Featured Video: Drought Response and Recovery in the Town of Castine, ME

This week's featured video tells the story of how  the small town of Castine, ME headed off recent drought and infrastructure challenges - a story that may be adaptable to other small systems nationwide. This video is featured on the USEPA's Drought Response and Recovery StoryMap Project for Water Utilities (ArcGIS) and is included as a case study resource in their recently updated Drought Response and Recovery Guide for Water Utilities guide. 

Revisiting History: How One Firefighter Protected a Town's Water Supply

Our featured video this week tells the story of how, 31 years ago, Dayton, OH's Fire Chief Glenn Alexander collaborated with the city's water and environment departments to make a difficult, but very crucial decision to stand aside and allow a Sherwin Williams paint factory to burn down. By doing so, he saved the city's water supply for generations to come. 

This story highlights the importance of collaborating with affected parties in order to make smart decisions during emergencies - certainly a lesson that never grows old. And among the many additional lessons gleaned from the incident: the importance of involving emergency responders in wet-field protection task forces or similar partnerships.  

Spooky Sewers and Things That Go Bump at the Treatment Plant: 2018 Edition

Featured Video: Using Powdered Activated Carbon to Remove Cyanotoxins

In May of this year, the city of Salem, Oregon discovered the state's first-ever algae breach in finished drinking water. Since then, there has been quite a bit of soul-searching, as well as a third-party assessment of exactly what happened and the effectiveness of the water utility's response after the event. In the end, the assessment concluded that the city was not prepared to deal with the public relations fallout, or the more practical matter of helping citizens access emergency water supplies. 

In the meantime, the Oregon Health Authority responded by creating almost unprecedented new cyanotoxin monitoring regulations for systems across the state, and the city of Salem was left to figure out how to cope with what may turn out to be a long-standing threat.

As an emergency measure, the utility started using powdered activated carbon (see video below from Statesman Journal reporter Dick Hughes) but it can cause clogging of the filtration plant.  The city is now also looking into ozone filtration, as well as other improvements including hazard response and crisis communication planning in order to be better prepared to handle future events.  

What's New in our Document Library: Fall 2018

Every day, staff members at WaterOperator.org search the internet to find events, resources and tools that have the potential to make a water operator's job easier and more effective. Here is a selection of our most recently-entered resources of interest to small system operators. 

Have we missed anything especially helpful recently? Let us know! 

Biosolids

• Comparison of Options for Biosolids Dewatering (slide presentation, ORWEF) 

Cyanobacteria/Harmful Algal Blooms

• Cyanobacteria and Public Water Systems (guidance manual, MassDEP)

Emergency Response

• Santa Rosa: Response and Recovery from 2017 Fires (slide presentation, ACWA)
• Disaster Management for Water Utilities - What is Your Emergency Response Plan (slide presentation, Iowa Rural Water Association)
• Guidance for Building Field Capabilities to Respond to Drinking Water Contamination (guidance manual, US EPA)

Financial Management

• Water Cost of Production (spreadsheet, Iowa Rural Water Association)

Inflow/Infiltration

• Newberg Inflow and Infiltration Study (slide presentation, ORWEF)

Non-community Systems

• Small Water System Management Program Guide for Noncommunity Systems: An Operations and Management Tool for Owners of Nonresidential Water Systems (manual, WDOH)

Safety

• Safety Issues in the Treatment Plant (slide presentation, NAWT)

Sampling/Monitoring

• How to Develop a Sample Siting Plan (video, Alaska DEC)

Test-Prep Resources

• Water Treatment and Distribution Operator Math Reference Sheet (factsheet, AWWA)
• Water Treatment and Distribution Operator Chemistry Reference Sheet (factsheet, AWWA)

Wastewater

• Current Trends in Digester Mixing Technologies (slide presentation, ORWEF)
• Handling Flushable Wipes in Wastewater (slide presentation, RUSA/UCC/PNCWA)

Water Security

• Enhanced Security Monitoring (video, USEPA)
• Wastewater Systems Security Vulnerability Assessment & Emergency Response Template (form/template, Minnesota Rural Wastewater)

Featured Video: Surviving the Quake

Did you know that almost half of all Americans live in areas prone to earthquakes? Water and wastewater utilities serving this population are extremely vulnerable to damage because of their vast network of underground pipes as well as their pumps, tanks, reservoirs and treatment facilities (not to mention their dependency on electricity!). This week's featured video introduces small and medium-sized water and wastewater utilities to earthquake resilience and introduces EPA tools including the Earthquake Resilience Guide and Earthquake Interactive Maps.  

After watching this video, read about the experiences of actual water utilities that have successfully implemented mitigation measures to address this threat in the EPA's new Earthquake Resilience Guide. And if you wondering if your utility is in an earthquake hazard area, you will soon be able to use a map such as this one from the California Geological Survey to find out.  

When an earthquake strikes, it can cause breaks in pipelines, cracks in storage and process tanks and even the collapse of an entire plant. When this happens, a community can experience loss of pressure, contamination and drinking water service disruption. The first step in protecting your community is to be prepared because the faster a water or wastewater utility recovers from an earthquake, the faster the community it serves can recover. 

Testing the Link Between Wildfires and Benzene Contamination

In the weeks following the Santa Rosa, CA wildfires last October, city officials found elevated levels of benzene in water system samples taken from the nearly totally-razed Fountaingrove neighborhood. The first round of samples returned 4 results of over 500 parts per billion, with one of these at 918 parts per billion (MCL for benzene in drinking water is 1 part per billion). A second round of testing produced similar numbers over the MCL, without the higher spikes. A total of 145 samples have now shown elevated levels.

According to this article in The Press Democrat, city officials, who for months have stressed that the contamination appeared isolated to the advisory area, were taken by surprise that six of those results were from outside the existing advisory area.

With the help of a forensic chemist, who helped eliminate the possibility of petroleum leaks, the city now suspects that the most likely cause of contamination is heat damage to high-density polyethylene service lines or other plastic components (such as PVC) in the water or wastewater system. The city is enacting more extensive testing to find out if plastic laterals are responsible. Once the exact cause is identified, the city will consider solutions. Replacing the water system could cost over $20 million.

Interested in finding out more about benzene contamination in drinking water supplies, including sampling methods, treatment strategies, and private well concerns? Check out this EPA website or this Oregon Health Authority factsheet. Another useful resource is this template (from North Carolina) to be used when high levels of Benzene need to be reported to the public.

Featured Video: The Science Behind Exploding Manhole Covers

Every season has its challenges for public works departments, and now that spring is just around the corner, it is pretty obvious that this past winter came with more than its fair share. Yet we are not in the clear quite yet, as this news story about two manhole explosions just a few weeks ago demonstrates. In fact, as winter winds down, accumulated road salt compounds corrode through underground electrical cables, causing sparks to ignite gases that can build up in confined spaces. With over 2,000 annual incidents in New York City alone, exploding manholes are not a joke: they can be dangerous, destructive and downright difficult to predict.

And while large cities like New York City are especially prone to these incidents due to aging infrastructure and the sheer amount of underground electrical cables present, small towns are definitely not immune. For example, in 2014 the tiny town of Sauget, Illinois (pop. 150) experienced an explosion so powerful manhold covers damaged overhead power lines.  

 Find out more about how road salt compounds contribute to this problem in this week's featured video.  

While explosions are the most dramatic hazard associated with manholes, research suggests that manholes are in general one of the most dangerous work locations for water system staff. In fact, according to AFSCME, fully one-third of all injuries/deaths of workers occur in or around manholes. Check out this safety presentation hosted by Michigan WEA for more information on the types of hazards presented by manholes and how to protect yourself from them. 

And if you have any lingering doubts about the force, and destructive power, of an expoding manhole, take a look at this video. 

Responding to Cold Weather Main Breaks

Recent extreme cold weather has affected a large numbers of private and public water lines across the country, resulting in low pressure, main breaks and water service disruptions, including this one at New York's JFK airport.  During the cold snap over the 2018 New Year's holiday, the St. Louis region alone had to deal with 60 breaks per day, with more than 40 crews out at a time. 

Responding to these events, both the dramatic and the more "invisible" ones, can be particularly challenging and can put utility staff at risk. Here are some resources that can help when frigid weather causes trouble: 

• USEPA's Extreme Cold and Winter Storms Incident Action Checklist
• Alaska Department of Environmental Conservation's Intro to Small System Systems chapter five section on methods for thawing out frozen water lines (p. 181).
• Of course, prevention is the best cure, so here is Indiana AWWA's updated winterizing checklist for ideas on how to prepare for freezing temperatures, snow, ice and sleet at your utility and around town the next time around. For even more readiness tips, take a look at this article on how to make water infrastructure winter-ready. 

Need a good public education tool to explain the water main break repair process to the general public? Check out this video from the city of Midland, Michigan showing how water distribution crews handle main breaks during the cold winter months. And here is another example from the city of Arlington, VA.