Water and wastewater systems are being advised to exercise caution when responding to public records requests seeking operational data. On June 4, WaterISAC issued an advisory following reports that multiple utilities have received public records requests from artificial intelligence (AI) service providers for historical logs of indicators such as:
- Inflow and outflow water volumes/flow rates (MGD);
- Aggregate water quality baseline metrics (e.g., daily average turbidity, pH, dissolved oxygen, and conductivity);
- Historical reservoir/tank storage elevations or percentage capacity levels; and
- Aggregate daily energy consumption or equipment run-times (e.g., daily total pump hours).
While it is unclear how AI service providers intend to use the data, this information has clear operational sensitivity. Members should be aware that while individual data requests may appear harmless, aggregating operational data from multiple systems could reveal patterns, system behaviors, and vulnerabilities that could be exploited to disrupt service or compromise critical infrastructure.
Water systems are encouraged to closely review public record requests involving operational data and assess the potential risks of disclosure. Systems are urged to make a risk-informed decision on whether, and under what conditions, to respond in compliance with applicable state information protection laws. Given the legal considerations involved, members are advised to consult with legal counsel before releasing operational data in response to public records requests. AWWA's 2019 report, Protecting the Water Sector’s Critical Infrastructure Information, provides an overview of state information disclosure exemptions that may help water systems protect sensitive information.
Members with concerns or having received similar requests are encouraged to share that information with WaterISAC for tracking. If you have any questions about this notice, please contact Liz Jordan, AMWA’s Manager for Sustainability and Resilience Policy.