The Second Emergency All working notes On the Record Contact

Working Note 09

Who Checks the Water?

Two Canadian warnings, one reassurance, and the gap between them. What the dates show, what the words say, and who has been told what to do.Published 1 October 2026

Over the past year, Canada's cyber security agency has published two warnings about attacks on the systems that run our water, and one reassurance about its own websites. Read side by side, with their dates, they tell a story about who gets told, who gets instructions, and who finds out last. This note sets it out in three parts.

4 monthsbetween AI hacking attempts on a federal website and the public hearing of them
1 daybetween researchers telling Ottawa and Ottawa's reassurance
0instructions for households when AI fails in an essential service

Part One

The dates

1. What happened, and when

Here is the record, in order. Each line comes from a source listed at the end.

WhenWhat happenedWho was told
October 2025Someone interfered with the water pressure controls at a Canadian municipal water system, affecting service to a community. The municipality was not named.The public, through a Cyber Centre alert reported on 30 October 2025
28 May and 9 June 2026An AI agent sent 899 requests to a search service run by Library and Archives Canada, including what researchers later called rudimentary hacking attempts. They do not appear to have worked.Not made public for four months
July 2026OSFI, the federal regulator of banks and insurers, tells them to test what happens when AI fails and to keep manual fallbacks ready.Banks and insurers
30 July 2026The FBI and the US Environmental Protection Agency report attacks on the controls of American water utilities.Water operators
19 August 2026Five US agencies warn that AI is making these attacks faster and easier.System operators
By 14 September 2026Canada's Cyber Centre warns that attackers are using AI against the controls of water, energy, food and other systems, and that future incidents in Canada will likely be more severe. It repeats the October 2025 water incident.System owners and operators
28 September 2026Transluce, an independent research lab, tells the Government of Canada about the Library and Archives Canada attempts.The government, privately
29 September 2026The Cyber Centre says it is aware of suspicious activity, including suspected AI agent activity, targeting public websites, and that there is "no indication that government systems have been compromised at this time."The public
30 September 2026Transluce publishes its findings. News reports follow.The public

The attempts happened in May and June. The government was told on 28 September. It answered the public the next day.

2. What the dates show

The reassurance of 29 September came one day after an outside research lab told the government what it had found, and one day before that lab told everyone else. The researchers found the evidence in pages saved by Arquivo.pt, a public web archive based in Portugal.

The researchers were careful. They said the attempts do not appear to have succeeded, and they did not firmly attribute them to any company. The Cyber Centre was careful too. It said it had no indication of a compromise "at this time" and that its assessment was continuing.

What the dates do show is a pattern. In Working Note 08, two AI incidents each took about three months to reach the public. This is a third, and it happened here.

Three incidents. Three gaps of three months or more. The third one was in Canada.

Part Two

The words

3. Two statements about two different things

The warning, by 14 September

AboutThe controls that run water, energy, food and other systems.

SaysAttackers "changed device settings, disabled alarms, and locked operators out of their systems." Canada has not yet had a high-impact incident, and future ones will likely be more severe.

Written forThe people who own and operate those systems.

The reassurance, 29 September

AboutPublic websites, "such as the Government of Canada."

Says"There is no indication that government systems have been compromised at this time." The assessment continues.

Written forThe public.

Neither statement takes back the other. The warning about water is still on the Cyber Centre's site. The reassurance is about websites. Each may be accurate. Read quickly, though, the second sounds like an all clear, and it was the one written for the public.

4. What "government systems" covers

A federal agency can speak for federal systems. The water from your tap is a different matter. In Ontario it is run by your municipality, or by a utility your municipality owns or hires. A statement from Ottawa about its own websites cannot tell you whether anyone has checked the controls at your water plant, and it does not claim to.

"No indication of compromise at this time" means that, when the statement was written, the agency had found no evidence of a break-in. That is an honest, limited sentence, and it deserves to be heard as one. Nothing in it says anyone checked the water.

A statement about government websites is not, by itself, an answer about the water coming out of our taps.

5. What we were not told

The October 2025 water incident has been public for almost a year. The municipality has never been named. We do not know whether its residents were told, how the attacker got in, how long it took to notice, or what stopped it from getting worse. Some technical details deserve protection. The basic facts of a public service being tampered with are a different matter: residents can be told that much without anyone being put at risk.

Part Three

The instructions

6. Who has been told what to do

Banks

Told in July to test AI failure and outage scenarios, keep manual fallbacks, and make suppliers say "if and how they are using AI to deliver services."

A binding rule on AI and other models takes effect on 1 May 2027.

Water systems

Warned that attacks using AI are increasing and will likely get worse.

Advised to keep their controls off the open internet. An alert, not a rule.

Households

Nothing.

No plan, no notice, and no one required to tell them.

The federal bank regulator moved first, and it moved well. It assumed AI would fail, and told the banks to have a way to keep working by hand when it does. That is ordinary emergency management, and it is exactly what is missing for the water.

The banks have been told to plan for AI failure. The people who drink the water have not been told anything.

7. Why an AI helper changes the picture

An AI helper, sometimes called an AI agent, is a program that can act on its own: it can log in, search, change a setting or send a message without a person approving each step. OSFI put it plainly. These systems "can act with limited human oversight."

That is useful when the instruction is right. When the instruction is wrong, or has been slipped in by someone else, the helper carries it out just the same, and quickly. The attempts on Library and Archives Canada were automated: 899 requests, sent by a machine, found months later by researchers abroad.

Imagine if

It is a cold Tuesday in February. A company hired to tune a city's pumps uses an AI helper to adjust the schedule overnight. A hidden instruction in an email it reads tells it to change a pressure setting. It does. By morning, three apartment towers on the same street have a trickle from the tap.

The building manager calls the city. The city calls the contractor. Residents see a notice that says "maintenance." Nobody is required to tell them what happened, whether it could happen again, or what to do in the meantime.

An AI helper carries out the instruction it is given, right or wrong. The first sign may be the tap.

8. Questions for the people responsible

For the Canadian Centre for Cyber Security: when did you first learn of the activity on the Library and Archives Canada website? Did your 29 September assessment cover any provincial or municipal systems, including water? Were the residents served by the October 2025 water system told what happened?

For the Province of Ontario: which ministry is responsible for the cyber security of municipal water controls, and what does it require of them?

For municipalities: can your water controls be reached from the internet? If they stopped working, or started taking the wrong instructions, how would you run the system by hand, and how would you tell residents?

For all three: if Canada's bank regulator can require manual fallbacks for AI failure, who will require the same for water?

9. What a household can do now

You cannot inspect a water plant. You can decide in advance what your household does if the water stops, or comes out wrong. The Plan sets out five first steps for the day it happens, two sheets to fill in by hand, and what to check once service returns. It is free, in English and French.

Smaller dated events go to On the Record, one line and one source each.

Sources

Verification note: every date above is as shown in the sources. An earlier note, Working Note 07, gave the Cyber Centre's industrial-controls warning as dated 8 September 2026. The page shows it was modified on 14 September 2026, and its first publication date has not been confirmed. Note 07 was corrected on 1 October 2026, and the change is recorded in the site updates.

All working notes On the Record Print or save as PDF Back to the documents

Free to use, adapt and reproduce. No permission required, no fee.

Working notes are dated when published. If one is revised, the change is recorded in the site updates log. Notes are never silently edited and never backdated.
TheSecondEmergency.com