Ordering Information:
ORDER NUMBER:  91218
DATE AVAILABLE: Fall 2008

PRINCIPAL INVESTIGATORS:
Charles N. Herrick, Elizabeth Scherer, and Gregory J. Welter

OBJECTIVES:
The objective of this project was to develop information, guidance, and a decision tool to help water utilities identify and manage potentially sensitive records and information.

BACKGROUND:
Protection of utility information that could be used by terrorists to disrupt service, destroy critical infrastructure, or damage public confidence in the water supply is a key aspect of a comprehensive security program. Vulnerability assessments and security audit findings are examples of security-relevant information that must be managed appropriately. Following the attacks of September 11, 2001, many organizations began restricting some of their information from access by the public. In some cases, these restrictions resulted in extensive denial of access. It has been recognized that information restriction practices can make it difficult for legitimate partners to obtain information to conduct valued activities.

HIGHLIGHTS:
Water utilities are clearly aware of the risks associated with inappropriate acquisition and use of information concerning their operations, but practices employed and capabilities for addressing this issue vary significantly. Federal policies and freedom of information exemptions at the state level provide utilities with the legal means to restrict information to the public. This project outlines an approach that balances the risks and benefits associated with information disclosure.

APPROACH:

• Reviewed literature of information management policies, approaches, and related issues, including the field of records management
• Reviewed legal and statutory materials and developed an inventory of state-level freedom of information exemptions pertinent to water utility information
• Identified and evaluated information security approaches from analog sectors
• Conducted in-depth interviews with water utilities and other experts, focusing on typical and exemplary information management practices
• Conducted an integrated analysis.

RESULTS/FINDINGS:
It is suggested that water utilities develop information policies and designate three levels of information sensitivity:

• Confidential Information—Information that could be useful in planning or executing an attack on specified utility assets or processes, or could otherwise adversely impact the utility
• Restricted Information—Information or records that should not be broadly released to the general public, but may be used by utility representatives or other individuals/groups with a “need to know”
• Public Information—Information provided to the public with few or no restrictions

Once the utility has specified the sensitivity of a particular item of information, the next decision is to designate an appropriate management protocol. Water utility information can be managed in many different ways, from absolute withholding to full and unrestricted disclosure. The report and accompanying electronic decision tool illustrate a range of useful and pragmatic approaches between these two extremes.

IMPACT:
This project provides intuitive guidance and a decision tool to help utilities identify and manage potentially sensitive information and records. The approach is framed to mesh with existing records management systems and to help utilities strike a reasonable balance between information security and legitimate dissemination of information.

MULTIMEDIA:
Project outputs include a report and CD-ROM decision tool to help utilities identify sensitive information and select appropriate measures and approaches for information management.

RESEARCH PARTNER:
USEPA

PARTICIPANTS:
The following participating utilities provided input and feedback on all aspects of the research, analysis, and reporting of this work: Aquarion Water Company, Santa Clara Valley Water District, Fairfax County Water Authority, Newport News Waterworks, and Lincoln Water System.

ISBN 978-1-60573-024-6