Central Arkansas Water's Doug Shackleford 8-13-26

McDonald's is putting value back on the menu. Whether you're craving a Big Mac nuggets or sausage egg and cheese McGrittles, make it a meal and save. Your favorite is now your wallet's favorite, too. Extra value meals are back. Grab an epic meal for easy money. 10-piece McNuggets or filet-o fish served with medium fries and a medium cope, all for just $8. Price and participation may vary. Promotion pricing may be lower than meal pricing. Start your day with the morning jolt of Drake C. Toll. See, now it's on demand. My podcast is kind of a radio thing, I think, but also it's a bit of a TV show, and it's about whatever I want it to be. It's listening live as it happened, when it happened, with the instant reaction. You're home for talking sports. We go back, the Great Toll Show, Westwood One Sports Network, and there will be on demand on your radio. Anywhere in the country. I'll see you there. Westwood One Sports Talk. Your home for Drake C. Toll. Follow and listen on your favorite platform. Good Thursday morning to you. Welcome back to First News 13th day of August, just about 19 minutes in front of 8 o'clock. And so there have been some recent hacking attacks and attempts on U.S. water systems and water companies. So here to talk about how Arkansas specifically Central Arkansas Water are defending themselves against these types of attacks. It's Doug Shackleford. He's the public affairs officer for Central Arkansas Water. And he's on the American leak detection phone line this morning. Doug, good morning. Welcome back to the show. How are you today? How you doing? Well, good. We appreciate you jumping on with us. So, Doug, Arkansas reportedly has about 790 different water systems, including Central Arkansas water. And so to start with, has Central Arkansas water experienced attempts of hacking of people or groups trying to access the inner workings of your system that you're aware of? Yeah, not that we're aware of. I think what we saw with the attacks in Minnesota a couple of weeks ago, it appeared that they were maybe targeted more towards some of the smaller, more rural utilities. Like they weren't going after, you know, the city of Minneapolis. They were going after areas outside of that where maybe smaller. Maybe they don't have the protections in place. Maybe they don't have the staff. um you know some of those things they were the largest water utility in arkansas right and you know you can imagine that because just of our scale alone that we're able to you know just like every other department scale up our staff scale up our equipment scale up the things that maybe some of those water utilities don't have the ability to do, the money to do, the employees to do, you know, and I think that's maybe what they were looking at was trying to find some, for lack of a better term, just kind of some low-hanging fruit as it related to water systems. Yeah, less resources, obviously, can impact how you can defend yourself against something like this. So, Doug,

What can a hacker do if they get into a water system? Can they shut it down? Can they contaminate the water? What's the dangers that they pose when a water system does get hacked? I mean, I guess there could be some pretty high risks out there depending on the system. A lot of it is going to depend on how their system is structured. You know, separations of systems and just if they were able to get into, say, a financial system, obviously, you know, at CAW, we... bill customers. We have customer data, you know, for everyone that we bill. And in some cases, financial information, you know, if they're doing auto pay through their bank accounts or whatever. So we have that type of data. And just like any other business. And so it's up to us to protect it. So, you know, you've got to protect those systems. You've got to protect the actual water, the water systems and what can be done there. And, yeah, we saw this, I guess maybe it was about 20%. two years ago, Toby, where someone tried to hack into a smaller system in Florida, and they were actually trying to get into the operations of the water treatment plant is what they were trying to hack into. Now, luckily, that water system in Florida was fully protected. They recognized it right away. There was no risk to drinking water. And I think that's really the biggest obligation for water systems. It's just ensuring that even if... there is some level of breach if someone is trying to attack or, you know, kind of kick down the door, if you will, that if they do get through the door and they get on the other side, there's nothing there for them to see. And so, you know, that's really the, what I think most systems try to do is just keep those separations and prevent people from coming in and trying to do something like, you know, I mean, theoretically they could come in and. I guess, adjust chemical doses into water. Sure. But the system would tell us that, and we sample. So we still do a lot of manual work. It's not at all computerized. So, you know, our folks would be out taking the samples like they do every day, hundreds of samples. They're just in the plant. And they would say, wait a minute, you know, something's not right with our dosing here, and we can shut the plant off in seconds. So, you know, it's... It's all about just having plans in place and following those plans in the event that something does happen. We're talking with Doug Shackleford this morning. He's the public affairs officer for Central Arkansas Water. I saw that the, Doug, that the FBI put out some guidance to local water providers. I assume that Central Arkansas Water got whatever it was that they sent out. Anything that you can tell us about. I don't know how much you can talk about that the FBI says to you about defending your system. But was there any guidance that they provided that was new to Central Arkansas water, anything that you guys weren't doing yet, but now you're implementing?

No, I don't think it was anything new. I think really what the FBI was trying to do was just reiterate what should be done, how things should be handled. And again, I think most water systems were doing that. You know, again, I can't get into specifics, like you said, because there are some risks out there by kind of throwing out our secrets. But, you know, what we can say is that we have a multi-level. very robust, you know, system in place to protect not only our, you know, customer data, our financial data, but also the plants and the treatment processes, even our physical facilities, just access to our physical facilities, you know, all of those different things, you know, very highly protected. And we have a staff of folks here at CAW whose sole purpose every day is to ensure that those systems are operating. you know, in a protected state. And they do all the work of monitoring to make sure that, you know, if we are seeing something abnormal happening, some sort of outside intrusion attempt, they're on top of it right away. So, you know, it's, again, the FBI, I think was just kind of going back to what I said kind of at the beginning, reminding maybe some of those systems that. maybe don't have those systems in place, don't have those tools in place. Hey, if you don't, you need them. Yeah. And you need to get them now. And you need to do this now. And, and we've been, we've been in place, these protections, you know, many, many layers of protection in place for years and years, ever since we've been a, you know, a quote, unquote. digital or computerized, you know, system. In just a general term, Doug, is the, is the, is the, the defense for a water company is, you know, you've got all these digital systems, you know, you can adjust valves and then different things, water flow, things like that. Is the, is the main part of defense being that you can, you can go back to manual, that you, you can take it offline and, and be able to operate the system manually? Is that the main, is that the main defense that you have? I don't know if that's necessarily the main defense. Or a big defense? Yeah, that's certainly an option. And that's what we saw in Minnesota. You know, they recognized the issue right away. They came in and one of their pumps wasn't running at one of the water treatment plants. And they're like, well, what's going on? I guess the pumps down. And then they just went right into their normal, you know, standard operating practice. You've got all those those. you know, SOPs written down probably in a binder somewhere and they opened it up and said, all right, what do we do? And so they just shut down the digital side of the plant immediately and began treating water manually there at that plant. And because of that, they didn't have any water issues for the customers. They had enough water. They did tell their customers, you know, hey, take it easy on the water today because we're operating. using water that's already been treated that was already in the tanks, and it's going to be a little bit until we're able to produce new water. So, you know, they just kind of put out a notice to their customers of, you know, don't, not everybody fill up your swimming pool at the same time today. But, you know, it's just following those plans and rules that you've already got in place. And in the event that you do see something abnormal or something that just doesn't seem right, you know.

going right to the to the playbook, if you will, and saying, hey, you know, what's, what are we supposed to be doing here? And, and, and manual operation is, is, I'm sure, a big part of most playbooks. Yeah. So, you know, I mean, computers are great and they, they make, they make things a lot easier in our lives. But, you know, for a hundred years, water treatment plants were operated by folks with pencils and binders and books and, and the know how to go and, and, and, and, and, So, you know, we still have those folks, and they still have the ability to go and do the math and say, you know, this is exactly what level of chlorine the water is supposed to have. This is exactly what level of phosphate we're supposed to be putting in the water, all of those things, and they can do it with a pencil and a piece of paper. You mentioned earlier, you know, that you've had to address physical access to, to, you know, defend, you know, physical access to the plants. Does that mean that with like third party vendors that may be hired to do certain work? Are you vetting them differently now than say five years ago? Is that a different process more in depth than it used to be? I don't know, honestly, for us that we're doing it a lot differently because we were already doing it well. Sure. You know, again, if I take people to tour our water treatment plants sometimes, and there's a process for that, and there's a badge that has to be worn, and there's all of these different things that have to happen before someone can come into the plant. And, you know, a lot of that, honestly, is from, you know... 25 years ago. We were talking about 9-11. And when that occurred, just what a lot of different, you know, not just water, but natural gas, power, all of these different facilities said, you know, what, we need to go back and look at our protections and see what we have in place. And so... You know, it's not unfettered access. I mean, even I have a card that allows me in and out. And when I scan that card, you know, in our locations here, there's people that can go on and say, well, Doug just scanned his card at this location. I mean, they kind of know exactly what. what even what closet I'm going into, if you, you know, if you really want to get down to the granular. So, you know, it allows us to monitor what's going on. And, of course, you know, like most other businesses or places, the camera systems in place and all those things so we can, you know, have eyes on the ground and what's going on around. So it's just, again, it's just doing everything we can possibly do to ensure that, that. you know, we're protected. Well, we all know, Doug, that we've got great water around here. And so we appreciate you guys keeping it flowing safely for us. And then, folks, if you want more information, you can always go to Central Arkansas Water's website. It's C-A-R-K-W.com. So C-R-W.com. And that's where you can find any information that you need or contact Central Arkansas Water and find out what you're looking for. But, Doug, appreciate you coming on the show. Obviously, something we need to all pay attention to it at this point. And obviously, you guys are on the front.

end of that, but it's a weird climate that we're in these days. But I appreciate you guys, you know, having the forethought to protect all of it up front. But I appreciate you coming on the show and talking about at least as much as you could this morning. I think the information was really good, Doug. So thanks for the time today. Hey, thank you, Toby. Start your day with the morning jolt of Drake C. Toll. See, now it's on demand. My podcast is kind of a radio thing, I think, but also it's a bit of a TV show, and it's about whatever I want it to be. It's listening live as it happened, when it happened with the instant reaction. You're home for talking sports. We go back, the Drake Toll Show, Westwood One Sports Network, and there will be on demand on your radio. Anywhere in the country, I'll see you there. Westwood One Sports Talk. Your home for Drake C. Toll. Follow and listen on. Your favorite platform.