1 MEMORANDUM OF UNDERSTANDING
BETWEEN
VIRGINIA POLYTECHNIC INSTITUTE AND STATE UNIVERSITY
(VIRGINIA TECH)
AND
CITY OF RIVERSIDE
(RPU)
1. Parties
This Memorandum of Understanding (hereinafter referred to as "MOU") is made and entered into by and between the City of Riverside, a California charter city and municipal corporation, with an address at 3750 University Ave , 5 th Floor, Rivers ide, CA, 92507 (hereinafter " Utility") and Virginia Polytechnic Institute and State University, with an address at NEC , 300 Turner St., NW STE 4200 Blacksburg, VA 24061 (herein after "University").
2. Purpose
This MOU, between the above-mentioned parties, is entered into to conduct a research project titled “Collection and Compilation of Water Pipeline Field Performance Data (PIPEiD)” (the “Research Project”). The University will perform a research study in collaboration with approximately 500 geographically distributed U.S. water utilities and 100 federal facilities. Using data and information provided by these water utilities and federal facilities , the University will develop a national Pipeline Infrastructure Database (“PIPEiD”) capable of efficiently and securely storing the collected data and conducting performance analysis and life- cycle economic analysis of water pipeline infrastructure systems. PIPEiD will help advance understanding of water pipeline performance parameters and development of reliable models and tools for advanced water pipeline infrastructure asset management.
3. Responsibilities
The Utility’s obligations under the MOU include providing (a) on an as-needed basis, existing data and information related to its water pipeline infrastructure systems; and (b) from time to time and as requested by the University, add itional input and analysis for the successful completion of the Research Project. Both parties acknowledge that University shall not request and Utility shall not be obligated to provide any utility customer data or information, including but not limited to names, credit history, utility usage data, home address, or telephone numbers. Should any such
2 utility customer information be inadvertently transmitted to University, University shall immediately notify Utility and return or destroy all copies of the data.
The University’s obligations under the MOU include (a) limiting the use of the Utility’s data, including geospatial or identifying information (“GIS” data), to the scope of the Research Project only; (b) providing, from time to time and as requested by the Utility, updates as to the status of the Research Project; (c) including deidentified Utility data only, excluding any GIS data, in the PipeID database; and (d) once completed, granting the Utility secured access, without reservation, limitations or cost, to the PIPEiD database, modeling, and visualization platform.
4. Contacts and Notices
Utility Technical Contact University Technical Contact Name: Farid Boushaki Sunil Sinha
Title: Principal Engineer, Water Resources Professor, CEE Address: 3750 University Ave, Suite 300 117-C Patton Hall Riverside, CA 91501 Blacksburg, VA 24061
Phone: 951-826-2328 540-231-9420
Email: [email protected] [email protected]
Utility Notices Contact University Notices Contact
Name: David Garcia Linda Feuster Duffy
Title: General Manager, Public Utilities AVP for Research and Innovation and Director of Sponsored Programs
Address: 3900 Main Street NEC, 300 Turner St., NW STE 4200 Riverside, CA 92522 Blacksburg, VA 24061
Phone: 951-826-5197 540-231-5281
Email: [email protected] [email protected]
5. Confidentiality
“Confidential Information” of either party, as applicable, means all information (regardless of form) of the University and the Utility, respectively, whether disclosed to or accessed by either party in connection with this MOU, that is either identified as confidential or would be deemed to be confidential by a reasonable person under the circumstances, including with respect to the Utility, all Utility Data, provided, however, that except to the extent otherwise provided by Law, the term “Confidential Inf ormation” shall not include information that (a) is independently developed by the recipient, as demonstrated by the recipient’s written records, without reference to the other Party’s Confidential Information, (b) is or becomes publicly known (other than through unauthorized disclosure by or through a Party), (c) is disclosed by the owner of such information to a third party free of any obligation of confidentiality, (d) was already known by the recipient at the time of disclosure, as demonstrated by the recipient’s written records, and the recipient has no obligation of confidentiality with respect to said information other than pursuant to this MOU, (e) is rightfully received by a Party free of any obligation of confidentiality, provided that (i) such
3 recipient has no knowledge that such information is subject to a confidentiality agreement and (ii) such information is not of a type or character that a reasonable person would have regarded it as confidential. Notwithstanding anything to the contrary, the term “Confidential Information” shall not include Personal Data.
University agrees not to disclose any Confidential Information, by publication or otherwise, to any person other than those persons whose services require access to Confidential Information on a need-to-know basis for purposes of carrying out the terms of this agreement, who are aware of the confidentiality provisions herein, and who agree to be bound by and comply with the provisions of this agreement.
Subject to the confidentiality provisions of this MOU, University agrees that technical report shall be written in such a manner to protect the identity of the Utility and other project participants from disclosure. As such, no individual Utility will be identified in the final technical report and said report shall be limited to a general discussion of the results of the research project.
In the event University receives a request for the identity of Utility or for the production, access to, or disclosure of any of the Confidential Information provided by Utility, University shall provide
written notice to Utility prior to any required disclosure, unless prohibited by law . To the extent any such request constitutes a request pursuant to Virginia’s Freedom of Information Act or other similar federal, state or local statute, University shall exercise due diligence in asserting all applicable exemptions or other bases for non -disclosure, and to the extent permissible, shall withhold such records from disclosure. Utility may obtain a protective order or other judicial relief from an appropriate court in Virginia prior to disclosing any Confidential Information.
6. Security
The University shall implement and maintain reasonable security procedures and practices that are appropriate to the sensitive and confidential nature of the Confidential Information provided by Utility and are reasonably designed to protect such information from hacking or other unauthorized access, use, or disclosure. University shall provide utility a general description of its security measures, plan and procedures (see Exhibit A).
All Confidential Information provided by Utility shall be stored in secured locations and on secured drives or websites, with access only through secure access portals by those individuals who are working directly on the Project, and who have signed the Confidentiality Agreement in Exhibit B.
All sensitive e -mail or other communications shall also be restricted and protected from unauthorized access.
7. General Provisions
a. Term. This MOU shall become effective on the day last signed and executed by the duly authorized representatives of the parties to this MOU and shall remain in full force and effect until December 31, 2028 unless terminated prior to such date.
b. Amendments. Either party may request changes to this MOU. Any changes, modifications, 4 revisions or amendments to this MOU that are mutually agreed upon by and between the parties, shall be incorporated by written instrument, executed and signed by all parties to the MOU.
c. Entirety of Agreement. This MOU, consisting of four (4) pages plus Exhibit A, represents the entire and integrated agreement between the parties and supersedes all prior negotiations, representations and agreements, whether written or oral.
d. Severability. Should any portion of this MOU be judicially determined to be illegal or unenforceable, the remainder of the MOU shall continue in full force and effect, and either party may renegotiate the terms affected by the severance.
e. Intellectual Property. Both parties to this agreement agree that no new intellectual property will be created during performance of the Research Project. University shall grant to the Utility a non-exclusive royalty free right to use all technical information generated during performance of the Project for internal use and evaluation purposes only.
f. Export Control Regulations . University and Utility agree that each shall comply with all export control regulations of the United States applicable to the technical data and information involved in or derived from its activities under this MOU, and that, each shall be responsible f or obtaining all information regarding such regulations as is necessary for it to comply.
g. Payment. No financial considerations shall be made to either party as a result of this MOU.
[signatures on the following page]
5 IN WITNESS WHEREOF , the parties have, through duly authorized representatives, executed this Agreement effective as of the date in the preamble hereof.
CITY OF RIVERSIDE, a California
charter city and municipal corporation
By: _____________________________
City Manager
Date:
Attest:
City Clerk
Virginia Polytechnic Institute and State
University
By: ________________________________
Name: Linda Feuster Duffy
Title: AVP for Research and Innovation and
Director of Sponsored Programs
Date:
Certified as to Availability of Funds:
By:
Chief Financial Officer
Approved as to Form:
By:
Deputy City Attorney
313025 RMS 1/6/26
Linda Duffy (Jan 9, 2026 13:16:19 EST)
Linda Duffy
01/09/2026
Ruthann Salera
Security of Geospatial Data Shared with
Virginia Tech by PIPEiD Member Utilities
Exhibit A
SSecurity Considerations for Each Major Workflow Step
(note: colors correspond to lines in the diagram)
1. Virginia Tech provides a secure endpoint for utilities to upload data. a. This could be an on premises server supporting the WebDAV protocol, OR a third party commercial service that provides encryption in transit. b. Utilities contact PIPEiD team to request access to the system. i. PIPEiD team provisions access credentials to utilities, or enables utilities to self-provision.
ii. Credentials shall not be stored in clear text by Virginia Tech. c. Utilities connect to File upload/staging server using WebDav over SSL. i. Utilities upload source data to be transformed into common schema and used in models.
ii. Both credentials and data are encrypted in transit.
2. The PIPEiD team accesses uploaded files from file upload/staging server via ArcGIS Desktop and runs an Extract/Transform/Load (ETL) process to conflate data into common schema.
a. Data is stored in a PostgreSQL database that has been “spatially enabled” to support ArcGIS clients via ArcSDE.
b. Access to this database is restricted to by both IP address, and login with strong passwords, to those with a need to access the data, which is limited to
i. systems administrators
ii. PipeID researchers building models
iii. the service accounts of ArcGIS Server instance(s) exposing the data as services.
c. There is no public access to this database.
d. Once the data has been ETL’d into ArcSDE, the intermediate copies on the staging server should be deleted.
3. The PIPEiD team and other Users builds models
a. Models and Tools using ESRI ArcGIS/Other Language Desktop that reference the data in its transformed state in the PostgreSQL database.
4. Models are published to ArcGIS Server as geo-processing services, and cartographic representations of utility data are published as map services. a. Access to the map and geo-processing services served by ArcGIS Server is restricted to logged-in clients of the web application that consumes these services.
Exhibit A
b. The web application will access the geo-processing and map services via a proxy to prevent the client from ever having access to the credentials, or tokens created from those credentials, that are used to run the application. c. There is no public access to the geo-processing and map services on the ArcGIS Server instance. All access is through the Web tier.
5. The PIPEiD team develops a web application instance for each participating water utility based on Secure Sockets Layer (SSL).
a. The web application is served over SSL (https://, port 443) b. The web application references the map and geo-processing services on the ArcGIS Server machine via a resource proxy application that encodes the credentials/tokens server side – clients never have access to clear text credentials or tokens
c. The web application is accessed via login credentials that may use the same identity store as the WebDAV upload service (as a convenience) or not – in either case these will be known only to the utility and the PIPEiD team members.
d. The web interface will be the only point of entry into the data, for both visualization and modeling purposes, unless the data owning utility requests access to the web services endpoints for map and geo- processing services pertaining to data they own.
6. Additional web application instances may be developed for research or demonstration purposes that reference multiple utilities’ data, and may permit access by multiple utilities or project stakeholders, beyond just the data-owning utilities themselves
a. No application developed by the PIPEiD team will permit access to a member utility’s data without their express consent.
b. Representations of data shared with audiences beyond the owning utility MUST be vetted by the owning utility for compliance with that utility’s data sensitivity / security policies.
c. It is the responsibility of the PIPEiD team to propose to member utilities the creation of any applications that use their data, and secure all necessary approvals prior to making the same available.
'$
%
&!
#
!
#
$
!
$
$"
% &
"
(($
!
#! "
#
#
$
# !
! !
$
Exhibit A