Unusual Freedom of Information requests targeting Danish utility companies, Digi Mart USA News (Denmark): An unusually large wave of public access-to-information requests and requests for data disclosure has in recent weeks reached the inboxes of several water utilities and district heating companies, according to the industry organizations Dansk Fjernvarme, DANVA and Danske Vandværker.
The requests are assessed to have been generated by artificial intelligence. They ask, among other things, about lawsuits in which the companies have been involved, and about people who do not exist in the companies’ customer databases.
Although it is not known who is behind the requests or what their motive is, the companies are concerned. Kim Mortensen, director of Dansk Fjernvarme, said that given the current geopolitical situation, Denmark is under attack from Russia in several areas.
“We are concerned that it may be used to gather information about the utility companies, so that it can be used in a larger context to gain more clarity about how our emergency preparedness is built up,” he said.
He explained that several members of the industry organization received the requests from the same email address, which cannot be identified as belonging to a person in Denmark.
Last week it emerged that many educational institutions have also received mysterious access-to-information requests. These also asked about court judgments and case systems used by the schools.
The motive is also unknown there, but there are fears that the requests may be part of an attempt to access critical personal data such as exam papers.
The requests have prompted the Ministry of Education to closely monitor the situation due to heightened attention to cybersecurity, and educational institutions have been urged by the Danish Agency for IT and Learning to report the inquiries as IT crime.
DANVA, the industry organization for Danish water utilities and wastewater companies, has also noted that its members have been “hard hit” by access-to-information requests. Jens Plesner, senior consultant at DANVA, said several things are raising alarm bells, including the number of requests, warnings from government authorities about possible criminal activity, and information about police reports regarding some of the requests.
He said the requests also ask about court judgments in which the relevant water company has been a party.
Asked whether the requests are an attempt to target critical infrastructure or simply harassment, Plesner said that viewed in isolation the request may not seem suspicious, but that when other critical infrastructure parties report experiencing the same thing, it may be serious. He noted that hackers have attempted and in some cases successfully hit water utilities, so such incidents must be taken seriously.
Danske Vandværker, the industry organization for smaller, consumer-owned water utilities, has in recent weeks received inquiries from 10 to 12 member water utilities that were contacted. Its members are not covered by the Public Administration Act.
They were contacted by the same private individual, who requested a range of personal data from the various companies. The individual is not affiliated with any of the water utilities, so the inquiries were rejected.
Director Lise Lotte Toft described the inquiries as “strange” because the person asked for information that did not exist in their systems. Danske Vandværker has therefore passed the information on to the Danish Agency for Societal Security and Emergency Preparedness, Toft said.
As is the case for educational institutions, public district heating companies, water utilities and wastewater companies are obliged to respond to and guide requests for access to information. The organizations therefore hope for help and guidelines from the authorities, so that companies can rule out requests created and sent by AI bots while still complying with the law so other requests are processed.
“We need clarity from the authorities and clear guidelines regarding these access requests, so that we can meet the guidelines in the legislation,” Mortensen of Dansk Fjernvarme said.
DR News asked the Ministry of Societal Security and Emergency Preparedness and the Ministry of Justice how seriously they view the requests and whether they should be answered. The Ministry of Societal Security and Emergency Preparedness referred the question to the Danish Agency for Societal Security, which had not been able to answer the questions on Friday.
The Ministry of Justice also had not been able to say by Friday afternoon how companies should handle the access-to-information requests.
