Smart urban water systems: what could possibly go wrong?

Urban water systems are being redefined for a digital age, promising substantial advantages for service users and providers, and for society as a whole. However, beside the much-discussed benefits of smart urban water systems in future smart cities, the transition will also bring unique challenges, particularly with respect to privacy and cybersecurity. A preemptive delineation of these risks andproviding appropriate recommendations will help to guide digital transformations of urban water towards sustainable solutions. Faced with emerging risks of digitalization, urban water management needs to look beyond technologywhile recognizing the central andmultifaceted role of research. In smart city initiatives, urban water systems remain largely out of the digitalization spotlight compared to other types of infrastructure. Oftentimes, the management and planning of urbanwater systems still follow traditional, steel and concrete-based approaches that treat used water as waste and not as a resource [1]. The need for innovation, however, is significant: the infrastructure, operation, and maintenance cost of urban water systems around the world already ranges in the hundred billion dollars annually andwater-related stresses are expected to continue rising. Digitalization could not only increase the flexibility and effectiveness of existing urban water systems, but could also allow for the provisions of new services to society. The envisioned transformation, as outlined for example in the literature [2–4], entails novel data collection and transmission techniques, analytical methods, models, and automation. For example, smart water meter data can be combined with noise loggers to detect and roughly locate leaks in water mains. Together with automated control infrastructure, pressure can be regulated to reduce water losses [4]. By this and numerous other smart solutions, not only water distribution but also sewers and wastewater treatment will be transformed. In particular, digitalization facilitates large-scale implementation of disruptive technologies like decentralized wastewater treatment [5] and direct potable reuse, which will help cities to copewith climate change and urbanization. However, we argue that as the benefits of smart urban water systems are increasingly explored and showcased in literature, it is time to also give attention to potential risks that might emerge. Recurring data breaches and the growing use of cyber-attacks for geopolitical ends are a reminder that the digitalization of society indeed carries risks. Given the critical role of water services in society and within the water-energyfood nexus, these risks must be identified and managed pro-actively. In the following, we raise awareness and suggest ways forward in approaching the unique privacy and security issues that accompany the digitalization of urban water systems. Finally, we highlight the central role of researchers in assessing andmitigating the potential risks of the smart urban water solutions they propose.

Urban water systems are being redefined for a digital age, promising substantial advantages for service users and providers, and for society as a whole. However, beside the much-discussed benefits of smart urban water systems in future smart cities, the transition will also bring unique challenges, particularly with respect to privacy and cybersecurity. A preemptive delineation of these risks and providing appropriate recommendations will help to guide digital transformations of urban water towards sustainable solutions. Faced with emerging risks of digitalization, urban water management needs to look beyond technology while recognizing the central and multifaceted role of research.
In smart city initiatives, urban water systems remain largely out of the digitalization spotlight compared to other types of infrastructure. Oftentimes, the management and planning of urban water systems still follow traditional, steel and concrete-based approaches that treat used water as waste and not as a resource [1]. The need for innovation, however, is significant: the infrastructure, operation, and maintenance cost of urban water systems around the world already ranges in the hundred billion dollars annually and water-related stresses are expected to continue rising. Digitalization could not only increase the flexibility and effectiveness of existing urban water systems, but could also allow for the provisions of new services to society. The envisioned transformation, as outlined for example in the literature [2][3][4], entails novel data collection and transmission techniques, analytical methods, models, and automation. For example, smart water meter data can be combined with noise loggers to detect and roughly locate leaks in water mains. Together with automated control infrastructure, pressure can be regulated to reduce water losses [4]. By this and numerous other smart solutions, not only water distribution but also sewers and wastewater treatment will be transformed. In particular, digitalization facilitates large-scale implementation of disruptive technologies like decentralized wastewater treatment [5] and direct potable reuse, which will help cities to cope with climate change and urbanization.
However, we argue that as the benefits of smart urban water systems are increasingly explored and showcased in literature, it is time to also give attention to potential risks that might emerge. Recurring data breaches and the growing use of cyber-attacks for geopolitical ends are a reminder that the digitalization of society indeed carries risks. Given the critical role of water services in society and within the water-energyfood nexus, these risks must be identified and managed pro-actively. In the following, we raise awareness and suggest ways forward in approaching the unique privacy and security issues that accompany the digitalization of urban water systems. Finally, we highlight the central role of researchers in assessing and mitigating the potential risks of the smart urban water solutions they propose.

Water tells more than you know
Just as the waste heaps of ancient civilizations inform us of their practices, particularly residential wastewater can provide manifold insights into a city's population. A prominent example is how the analysis of the composition of the wastewater can reveal drug consumption patterns. Many medicinal and recreational drugs are only partially absorbed by the body and can be detected in urine in the form of metabolites. In wastewater, these metabolized residues are diluted and further degraded by chemical and biological processes. For certain drugs, the residues can still be measured at the end of the sewer network and used to back-calculate drug usage for an entire city. The method is a reliable alternative to self-reporting surveys for illicit drug use, and has been used to assess vaccine compliance during flu pandemics and for other public health questions. While wastewater analytics may seem benign at an aggregate scale, the availability of such data could lead to discrimination. Insurance companies or employers might disfavor neighborhoods based on the drug consumption or health information revealed through these practices. Wastewater studies have already been conducted on specific populations, including prison inmates and festivalgoers. In at least one study, the use of performance-enhancing 'smart drugs' among college students was investigated [6]. The scientific community, aware of the danger, has made some tentative recommendations that could ensure the anonymity of possibly disadvantaged groups [7]. However, such advice is not binding and in China, some cities are planning to use wastewater analysis to set quotas for drug-use arrests [8]. Another aspect to consider is the possibility of combining neighborhood drug consumption data with spatially explicit information like mobile phone locations. Over time, by analyzing usage patterns, single drug users could potentially be identified. In the future, wastewater analysis may also find proponents within the home, for monitoring health. Multiple companies have already announced consumer-oriented, connected devices for easy urine analysis. As wearable fitness trackers proliferate, people seem ready for continuous health data collection. Keeping this data private is an upcoming challenge for lawmakers, technology developers, and end-users alike.
Smart metering is another tool of smart urban water management that garners interest as well as apprehension. By analyzing high-frequency water flow or pressure variation data [9], the use of household appliances, faucets, toilets, showers, or baths can be identified. Such technologies allow convenient applications such as real-time leak prevention and set the stage for dynamic pricing and water conservation. However, the indirect documentation of information such as shower duration and toilet use raises concerns related to infringement of personal privacy both from outside and within the home, e.g. by burglars interested in home occupancy or by snooping family members [10]. Furthermore, water data can be combined with electricity data to paint a more detailed picture of behavior, by which individuals could be tracked [11]. In this setting, the challenge will be to strike a balance between data use and data protection. In water demand management, for example, the characterization of water end use, modeling of user behavior, and development of personalized water management strategies must be pursued without undermining household privacy [12]. Two unique characteristics of smart water metering campaigns further complicate the situation. First, when smart meters are rolled out for water conservation during intense droughts, deployment is sometimes conducted in haste, which might lead to privacy precautions being neglected [13]. Second, making use of social pressure to drive behavioral change, certain cities have resorted to publicly calling out or 'drought shaming' citizens who go over imposed water usage limits. With increased availability of personal information and potential for abuse, the sustainable city of the future will need to have transparent and just mechanisms for leveraging social pressure.
Digitalization can also create new vulnerabilities if the sensing, communication or control components forming the 'smart' system are not implemented correctly. Water utilities have not only been subject to cyberattacks aiming to steal client data or demand ransom: there have also been incidents where the physical processes of water utilities were remotely tampered with. For example, in the year 2000, an Australian wastewater treatment plant was repeatedly attacked, causing centrally controlled pumps in the sewer network to shut down. In total, nearly a million gallons of raw sewage overflowed into residential areas and water bodies, causing economic and environmental damage [14]. In another case, an American drinking water treatment plant was targeted by hackers who changed the chemical dosing of chlorine in the water [15]. Besides cyberattacks, software and hardware malfunctions have caused multiple incidents including sewage spills, urban flooding, deactivation of drinking water chlorination, destruction of pump equipment, and breaking of water mains [16]. These occurrences illustrate the type of consequences that can occur if the information layer of a smart urban water system is compromised.

Responding to smart water challenges
Many of the risks of smart urban water systems concern digital technology at a general level and should be addressed in a sector-independent way. However, the risks highlighted above are particularly relevant for the water sector and necessitate action on the part of water utilities and policy makers. They are however difficult to quantify and can easily be sensationalized. Therefore, water utilities need to learn to reap the benefits of digitalization while avoiding potential pitfalls. We recommend four guiding principles to this end: (i) invest in technology that can reduce risk, (ii) look to other sectors for inspiration, (iii) be transparent about successes as well as failures, and (iv) remember that smart urban water systems rely on competent human operators.
(i) Harnessing technology: Technical solutions are generally put forward to the problems created by technology. Most hacking risks can be greatly mitigated simply by keeping digital systems maintained. Beyond keeping software updated, this also means making use of state-of-the-art quality assurance methods for penetration testing and fault detection algorithms. As illustrated by Taormina et al [17] for water distribution networks, the analysis of network monitoring data alone could allow cyberattacks to be detected. Since cyberattacks could then be concealed or simulated simply by compromising the monitoring data, technology such as blockchain might be a solution to secure such data.
(ii) Cross-sectoral learning: The fact that the water sector is comparatively slow moving is an opportunity to draw experience from other sectors, to preemptively identify risks and find solutions for urban water systems. In the medical field for example, experts warn that regulatory overreaction to privacy concerns that restricts data collection should be avoided, as this directly impairs the use of promising artificial intelligence applications and prevents the creation of longitudinal records [18]. Similarly to medicine, water infrastructure is a critical foundation of public health and progress must not be curtailed by unfounded perceptions of risk. Other insights can be gained from smart electricity metering, which shares characteristics with water metering. For instance, utilities looking to introduce fair data collection could have an opt-in policy for data sharing [19], possibly with a compensation for participants. In such a case, users should have the freedom to select the resolution of the data shared and be informed of what aspects of their privacy they are potentially giving up. By looking to other sectors, researchers and practitioners can gain knowledge not only for privacy and cybersecurity concerns, but also the more common challenges of digital transformation.
(iii) Transparency: Openness about failures is a prerequisite to long-term acceptance by the public, and an enabler of technical progress. To foster transparency, we see a need for multi-sector databases that catalog and document digitalization failures. While such repositories already exist [16], their utility could be enhanced if positive experiences are also included, as well as contact information to facilitate direct exchanges. On one hand, such databases could give perspective to sensational and potentially fake news reports, e.g., about the health dangers of smart meters. On the other hand, the databases could raise awareness and understanding of actual risks so as to avoid future mistakes and guide innovation. A step in this direction was taken with the recent introduction of the General Data Protection Regulation (GDPR) in the European Union; Article 33 makes it mandatory to notify a supervisory authority within 72 h in case of a data breach. Besides the need for transparency, which applies to all smart city initiatives, trust and openness is necessary on behalf of the users of water services. Human hygiene and excreta are commonly in the realm of taboo, which complicate the acceptance of new technologies or sharing of even harmless data, undermining the success of otherwise promising sanitation projects.
(iv) People first: Education of the workforce must accompany and possibly precede the digital transformation of infrastructure. Adapting to a novel, digital system will require flexibility as well as the skills and knowledge for new tasks and responsibilities. Operators will need to oversee highly automated systems and be prepared to take control if the smart system fails or is hacked. For cybersecurity, the human factor remains critical for preventing, detecting, and countering attacks. This is illustrated by the Australian hacking incident mentioned previously, in which an operator noticed the intrusion and successfully disabled access initially, but was unable to prevent the sewage spill. In addition to investing in the education of personnel, the urban water sector will need to compete with technology companies for talent by offering attractive workplaces. Marketing the critical societal role of water could be one way forward to attract people with the necessary skills.

Research is and must remain critical
Researchers play a leading role in the conceptualization and design of smart urban water systems and as such, they carry a burden of responsibility. First, they need to realize their double role as both creators and critics of novel water solutions. It is in the interest of society that researchers be more candid about weaknesses of the ideas brought forward. On their side, funding bodies should support the identification and analysis of possible vulnerability and privacy issues, uncertainties, and implementation risks. Ideally, the increased awareness will lead to smart water solutions that address fundamental risks by design. The proposal of ethical guidelines for wastewater analysis by Prichard et al [7] is a positive example that can be imitated. In addition, urban water researchers should consider the diversity of geographic and cultural contexts when supporting technology trends, both in terms of new applications and possible issues. For instance, providing a reliable power supply to smart urban water systems may be a challenge in some regions. Urban water systems built in the future will likely shift away from the currently prevailing paradigm of large, centralized infrastructures. Instead, especially in areas with limited economic resources or water scarcity, alternative water and sanitation concepts will materialize. These concepts include direct potable reuse, resource recovery, or on-site treatment [20]. Far from being low-tech, they will expectedly incorporate advanced monitoring systems, data transmission and remote control technology. Smart urban water systems will however only be truly smart if we are able to anticipate and pre-emptively address what could possibly go wrong.