EPA Security Advisory

CDPHE is sending you the following information in partnership with EPA: 

Stay connected with the Office of Water Emergency Response & Cybersecurity at EPA

EPA Advisory: Protecting Sensitive Operational Information in Water and Wastewater Systems

cyber alert

The U.S. Environmental Protection Agency (EPA) is advising water and wastewater systems to consider the risks of disclosing sensitive operational information following multiple public records requests from artificial intelligence (AI) service providers, as reported by the WaterISAC and the American Water Works Association (AWWA).

In at least one instance, an AI service provider requested “all SCADA logs for 2026 for all treatment, distribution and wastewater management systems.” The requestor also indicated they were seeking “daily or hourly historical logs” for specific environmental and physical process indicators, including inflow and outflow water volumes and flow rates, aggregate water quality baseline metrics, historical reservoir and tank storage levels, and aggregate daily energy consumption or equipment run-times.

This type of information carries significant operational sensitivity given the insight it provides to a utility’s operations. EPA concurs with the WaterISAC’s and AWWA’s recommendation that water and wastewater utilities recognize that the aggregation of operational data across multiple utilities has the potential to reveal patterns, vulnerabilities, and system behaviors in the water sector. Such data, if obtained with malicious intent, could be used to jeopardize continuity of service, endangering public health and national security.

EPA encourages water sector utilities to evaluate the potential sensitivity of information requests and to make risk‑informed decisions about whether—and under what conditions—to respond, consistent with applicable state information protection laws.

Hand-Pumped Wells Disinfection Updates Underway

Did you know that Colorado has over 100 hand-pumped wells that provide drinking water to transient public water systems throughout the state at areas such as campgrounds? These hand-pumped wells are regulated by CDPHE and have very specific procedures and guidelines must be followed to ensure that they are providing potable water. Hand-pumped wells are, as the name implies, water sources that are pumped by hand and do not have continuous disinfection treatment. For seasonally operated hand-pumped wells, the well water, pump and piping must be disinfected within 30 days of opening for the season. The hand-pumped wells typically have a removable plug that can be removed and a chlorine solution can then be poured into the well to disinfect the well. However, operators have reached out to the Division with concerns about disinfecting hand-pumped wells where there is no removable plug or the plug is seized and cannot be removed. In 2024, the Division worked with hand-pumped systems to update the department’s “Hand-pumped wells operational guidance and handbook” and develop an alternative disinfection procedure. Based on communications with operators and hand-pumped systems, the current configuration on disinfecting hand-pumped wells was not the most conducive method. In close collaboration with operators, an alternative disinfection procedure (below) was developed to utilize for situations where there is no removable plug or if the plug is seized. 

Gallon Chlorine Solution Method – Utilizing the hand-pump’s weep hole, chlorine solution is applied via the spout and into the pump base. One (1) gallon of chlorine solution is added to the hand-pump according to the standing water height in the well casing. A chlorine solution of 3 tablespoons of 8 ¼ percent bleach will be added to a 1 gallon jug of water for every 10 feet of standing water. For example, 18 tablespoons of 8 ¼ percent bleach will be added to the 1 gallon water jug and inserted into the hand-pump base for 60 feet of standing water. A table showing the amount of bleach used per gallon jug of water is presented below for different chlorine bleach strengths. To ensure that the chlorine solution entered the well casing, wait a few minutes for all the chlorine solution to drain from the weep hole. Pump the well one to two times to ensure no solution is pumped out and that all the chlorine solution enters the well casing.  After completely pouring the 1 gallon chlorine concentrate into the well, operate the hand pump until the distinct odor of chlorine is detected in the discharge. Remove the pump handle and allow the chlorine solution to remain in the well for a minimum of 6 hours. Reinstall the pump handle and flush the well until the free chlorine residual is below 0.2 mg/L. Chlorine residual must be measured with an approved chlorine test kit. After successfully completing the disinfection process please continue to follow the “Hand-pumped wells operational guidance and handbook” on completing the necessary steps to bring the well online.

Disinfection of hand-pumped wells is an important step in ensuring safe drinking water and the division appreciates the coordination with operators on this issue. The Field Services Section will be working on an update to the “Hand-pumped wells operational guidance and handbook” in the future. If you have questions regarding hand-pump disinfection, please email the Field Services Section at cdphe_wqcd_fss_questions@state.co.us. The department, operators and the supplier share the same goal – “Always Safe Drinking Water.” 

➽ Thomas Valenta, Field Services Work Group Lead