Lawmakers weigh S213 changes as state experts say water meters pose minimal cyber risk

House Energy and Digital Infrastructure members on March 26 debated S213, a bill addressing advanced metering infrastructure (AMI) and whether cyber‑security language belongs in permitting statutes.

Denise Ry Hughes, secretary of the Agency of Digital Services, told the committee that cyber‑security requirements embedded in a permitting law would be a poor fit because permitting engineers and water‑system operators have different functions than centralized cyber oversight. “When the agency of natural resources has cyber security requirements, the agency of digital services is the entity that supports them,” Hughes said, recommending that the Cybersecurity Advisory Council (CAC) and the Agency of Natural Resources (ANR) handle guidance and reporting rather than placing prescriptive cyber language into permit text.

Hughes and other witnesses said the CAC already issues non‑binding guidance and that much of the work the bill seeks — including standards for water operators — is already being developed in council reports. Brian Redmond of the Agency of Natural Resources noted that a Senate amendment allowing ANR to request CAC guidance was a notable change and asked the committee to clarify whether explicit statutory authority is necessary.

The committee also heard technical testimony about how Vermont systems read meters. Witnesses described most water AMI in the state as short‑range, encrypted radio reads (AMR or limited AMI) that provide one or two numeric registers such as gallons used and a meter ID. Those devices typically use low‑power batteries and a vendor‑supplied reader and do not connect to a customer’s home Wi‑Fi or to production‑control equipment. “There is no connection between the meter and the operation of water production or delivery of water to homes,” Liz Royer, executive director of the Vermont Rural Water Association, told lawmakers, adding that meters are “one‑way communication” and that the meters Vermont systems deploy “contain very minimal data.”

Asked about public‑safety risk, Hughes said an FBI liaison for the state had not identified meters as a public‑safety cyber threat; the liaison’s concern was the broader operating environment and control systems, not meter telemetry. Witnesses emphasized that the principal cyber risk for water systems is access to supervisory control and data acquisition (SCADA) or other operational networks, not edge‑level meter reads that report volumetric data.

Committee members pressed for practical examples and next steps. Witnesses and lawmakers agreed that operators who install and maintain meters should testify — Champlain Water District, Burlington, and Cavendish representatives were suggested — and that written recommendations from ANR on whether section two (the CAC request language) is necessary would be helpful. Several members also expressed concern that overly prescriptive statutory definitions of “advanced” or “smart” meter technology could quickly become obsolete given rapid device change cycles.

Supporters of cautious statutory placement noted AMI benefits for infrastructure management: encrypted reads can help detect leaks and provide towns visibility into aging pipes, though small systems face installation costs and multi‑year rollouts.

The committee did not take a vote. Members said they would solicit further operator testimony and written recommendations on whether statutory language should be retained, moved, or adjusted to reference the CAC’s existing authorities and reporting.