Chennai Metrowater’s Pump Controls Must Stay Separate
Chennai Metrowater is putting its SCADA centre, GIS team, war room and video walls into one ₹22.32-crore command building, and in our view the test is whether a separate pump-control network is kept that way through handover and years of maintenance
This post argues that Metrowater’s new ICCC is a chance to keep pump and valve controls on a network that the dashboards can only see, and that the real test is whether that separation holds once vendors, upgrades, remote access and data-sharing requests start to press on it, with the meter data checked before anyone acts on it.
On 11 November, The Hindu reported that Chennai Metrowater has called tenders for an Integrated Command and Control Centre to watch over the city’s water supply and sewerage network in real time.[1] The ₹22.32-crore building will come up as a two-storey block at the Metrowater head office in Chintadripet, with half the money from the Singara Chennai 2.0 scheme.[1] Officials expect work to begin in early January. The same day, the paper reported that the Greater Chennai Corporation has fitted air quality sensors at 93 places and plans to run city-wide AQI monitoring from its own ICCC.[2] We welcome that seriousness about live data. The plans already include a dedicated SCADA centre, which is being implemented now.[1] We assume the network that runs the pumps and valves will be kept separate from the dashboards, and we think that is the right approach. The question worth asking is how that separation is protected after the building opens.
The new building will put the control system and the public-facing screens under one roof
Metrowater is not starting from zero. It revamped its monitoring and control centre a few years ago, and that room already tracks reservoir data, water distribution points, sewage treatment plants and sewage decanting points, alongside a round-the-clock grievance cell for residents’ complaints.[1] The video walls showing tanker trips and other operations will move into the new building. The GIS application centre, which today sits on a separate floor of the headquarters, will join them, as will the dedicated SCADA centre.[1] SCADA, short for supervisory control and data acquisition, is the software and network that lets operators read pressures and flows from remote sites and, crucially, send commands back: start a pump, open a valve, change a set point. A dashboard that shows tanker trips is an information system. A SCADA screen that can switch a pumping station is a control system. Putting both in one building makes operational sense: the person handling a low-pressure complaint should see what the engineer sees. Separation is what lets that happen safely. The picture can be shared with the war room; the commands stay on the SCADA side.
Officials say the whole network will get flow meters and sensors, that the ICCC will read bulk water meters and household meters to find leaks and track water quality, and that it will monitor the upcoming ring main pipeline meant to link all of the city’s water sources.[1] Each meter is a small computer on a radio link, and a potential way in, which is why those links deserve the same care as the pump-control network itself.
Water utilities abroad were hit through weak passwords and exposed controllers, not clever code
This is why we think the separation is worth protecting. In November 2023, attackers took control of a booster station run by the Municipal Water Authority of Aliquippa in Pennsylvania; the utility disabled the system and ran it by hand.[9] CISA said there was no known risk to drinking water.[4] The device was a Unitronics programmable logic controller (PLC), the small industrial computer that runs a pump or valve, and it was reachable from the open internet. CISA’s advice was blunt: change default passwords, and make sure the factory password “1111” is not still in use.[4] A later joint advisory by CISA, the FBI, NSA, EPA and Israel’s cyber directorate found the same group had compromised at least 75 such devices in the US, at least 34 of them in water and wastewater, by logging in over the default port to devices with a default password or none at all, then erasing the control logic and locking operators out.[5] No exotic exploit was needed. The US Environmental Protection Agency then inspected water systems and, in a May 2024 enforcement alert, said more than 70 per cent of those inspected since September 2023 were in violation of basic requirements to assess risk and plan for emergencies. Inspectors found systems that had never changed default passwords, used a single login for all staff, or had not cut off access for former employees.[6] These are housekeeping failures that creep in at handover, or years later, when a convenient connection is added. In October 2024, American Water, which serves more than 14 million people, took systems offline after a cyber incident; its customer portal and billing went down for several days, but the company said it had no indication its water facilities were affected.[8] Billing stopped; the water did not. That is the outcome a lasting separation is meant to protect: if the office side of the new building is hit, the inconvenience should stop at the dashboards, not become a path to the pumps.
CERT-In already tells cities to isolate water treatment and harden command centres
Indian guidance points in the same direction. CERT-In’s Cyber Security Guidelines for Smart City Infrastructure say that physical separation, through dedicated hardware or air-gapped networks, gives the strongest isolation and “ensures that critical systems, like water treatment plants or energy grids, are entirely isolated from broader network ecosystems.”[3] For ultra-sensitive operations such as smart city command and control centres, the guidelines say air gaps or data diodes, devices that let data flow in only one direction, may provide a higher level of defence.[3] The same document lists data tampering and unauthorised access among the risks for smart water meters and water quality sensors.[3] Our view is that the SCADA servers and the PLCs at pumping stations, treatment plants and reservoirs belong in their own zone, and the GIS centre, the war room, the grievance cell and the video walls in another. Data should flow out of SCADA towards the dashboards, ideally through a one-way gateway, and nothing on the dashboard side should be able to send a command back. If an engineer genuinely needs remote access to a plant, it should go through a single controlled path with multi-factor login, as CISA and EPA recommend for water systems.[7] We made a similar case for building control rooms in our post on designing a BMS for a control room: plan for the failure, not for the demo.
A separate pump network can still give the war room a live picture
Some will worry that isolation slows the war room down. A night officer facing a dry ward wants a live picture, and will not want to walk down a corridor to find out what the pumps are doing. We think a well-kept separation is compatible with that speed. A one-way feed still puts pressures, flows and tanker movements on the war-room wall. The officer can see what the engineer sees. Commands stay on the SCADA side. If an engineer needs to change a set point from outside the SCADA room, that access can still exist, through one controlled path, not through the general dashboard network. That is a short delay, not a rebuild of a wiped controller.
Household meters are only useful if the readings can be trusted before crews are sent out
A leak shows up as a gap between what the bulk meters say went into a zone and what the household meters say came out, and that arithmetic only works if the meters report on time and report honestly. A meter that drops off the network, a gateway that sends stale readings, or a reading that has been altered will all look like a leak, or hide one. Monitoring networks can go quiet fast, as when Delhi’s air quality stations stopped sending data on Diwali night. A water ICCC should show, on the same screen as the leak alert, how many meters in that zone actually reported in the last cycle. If the Corporation’s ICCC wants Metrowater data for ward dashboards, it should receive a feed, not a login into the water utility’s systems. One-way sharing keeps a reasonable request for data from pressing a hole through the SCADA boundary.
What good looks like at handover, and in the years that follow
We think the test will not be the opening-day screens, but whether the separation is still there when a vendor arrives, a system is upgraded, or someone asks for a convenient connection. At handover, the one-way gateway and the single remote-access path described above should be visible on a network design document that shows the SCADA zone, the ICCC zone and every connection between them. There should be an asset register of every PLC, gateway, meter and server, with its firmware version, kept current through the maintenance period, and a rule that no default password survives commissioning, with individual logins for every operator and access removed on the day someone leaves.[6] No controller should sit directly on the internet.[4][7] Backups of PLC logic and SCADA configuration should be tested, so a wiped controller can be restored in hours rather than rebuilt from memory.[5] And each month the ICCC should report meter reporting rates by zone, so the leak figures can be trusted. None of this is expensive at the design stage; it is far harder once a temporary link put in during an upgrade is quietly left in place. Our earlier post on turning CERT-In’s guidance into contract clauses shows how to phrase such checks so they can be verified at handover and during maintenance. Chennai deserves credit for wanting its water network on one screen. What we care about is that the wall behind that screen lasts.
Planning a command and control centre? Talk to Trisim Global Solutions.
Trisim’s view: a water command centre should see every pump but command none of them from the dashboard side. Keep that SCADA boundary in place through handover and maintenance, while it still costs a check rather than a rebuild.
Sources
- The Hindu, New integrated command centre to bring Metrowater’s monitoring units under one roof, 11 November 2026
- The Hindu, Corporation to monitor air quality in Chennai; installs sensors at 93 places, 11 November 2026
- CERT-In, Cyber Security Guidelines for Smart City Infrastructure (PDF), undated, accessed 12 November 2026
- CISA, Exploitation of Unitronics PLCs used in Water and Wastewater Systems, 28 November 2023
- CISA, FBI, NSA, EPA and INCD, AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities, 1 December 2023, updated December 2024
- US EPA, Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities, May 2024
- CISA, EPA and FBI, Top Cyber Actions for Securing Water Systems, revised 23 February 2024
- American Water, American Water Reactivating Systems After Cyber Event, 10 October 2024
- WaterISAC, Water Utility Control System Cyber Incident Advisory: ICS/SCADA Incident at Municipal Water Authority of Aliquippa, updated 30 November 2023