Why is dam breach data a secret?

Ask a navigation authority or a reservoir undertaker for the breach modelling data behind a raised embankment above your site, and there is a fair chance you will be told that the information is held and will not be released. The exception usually relied on is regulation 12(5)(a) of the Environmental Information Regulations 2004: disclosure would adversely affect public safety. The wording varies. The outcome rarely does.

Refusals of that kind are lawful, reasoned and entirely conventional. They are also the third act of an argument that has run in this country for the better part of twenty years, and the reservoir half of that argument has already been settled in the opposite direction.

An asset owner will commonly confirm that it holds hydraulic and breach modelling, release decades of incident history and asset-by-asset condition grades for the same stretch of infrastructure, and withhold the modelling itself.

What gets released, and what gets withheld

A refusal is more informative read alongside what was disclosed than read on its own, because the line an owner draws tells you what it treats as dangerous and what it treats as merely information. The pattern is consistent enough to plan around.

The withheld item is always the modelling itself, which is the thing that turns everything else on that list into a depth, a velocity and a flow route across a particular field. The reasoning given is that such modelling includes detailed assessments of potential breach locations, predicted inundation extents and areas of vulnerability, and that release could let someone identify weaknesses in infrastructure, or locations where assets may be more susceptible to failure.

Set against a condition schedule that will happily name individual structures and grade them Poor, that is a fine line. It is not an unreasonable one. A condition grade tells you an embankment is in poor repair, while a breach model tells you what happens to the properties below it. But it is still a line, and it is worth understanding how it came to be drawn where it was.

Does a refusal remove the assessment?

No. The planning system does not care whether the model sits in somebody else's filing cabinet. If a site lies below a raised canal, reservoir or defence, the flood risk assessment for planning still has to establish what happens when that structure fails, and it has to do so on evidence rather than assertion.

Government guidance on flood risk assessments requires all sources of current and future flood risk to be considered. Planning practice guidance names reservoirs, canals and lakes among them. It goes further on residual flood risk, requiring an assessment to weigh what happens if infrastructure fails or has its design standard exceeded, and it gives a breach of a raised defence as the example. None of that is reached by the Sequential Test, which sorts land by mapped probability and so says nothing at all about a canal. The wider NPPF flood risk framework takes the same line.

The practical consequence of a refusal, then, is not that the risk disappears. It is that the applicant pays to rebuild breach modelling data the asset owner already holds, working it up from topographic survey and LiDAR terrain data. Where the consequence is material, that means hydraulic flood modelling of the breach scenario rather than a hand calculation, built in the usual modelling software and run to the Environment Agency's river modelling technical standards so that a consultee can rely on it. The Agency's own guidance on using modelling for flood risk assessments puts the burden of checking model suitability on the applicant, not the reviewer.

A refusal shifts the cost of the answer from the body that already holds it to the applicant who needs it, and produces a second, less well-informed model of the same embankment.

What regulation 12(5)(a) actually requires

Regulation 12(5)(a) is a qualified exception rather than a blanket exemption, and the bar it sets is higher than the phrasing suggests. The Information Commissioner's guidance is explicit that a possible harm will not do.

• Identify a real adverse effect. Public safety harm means hurt or injury to a member of the public, not inconvenience or embarrassment.
• Meet the probability standard. It must be more probable than not that the harm would follow release.
• Rest on evidence. An authority cannot rely on unsubstantiated speculation that a risk exists.
• Survive the public interest test. Regulation 12(1)(b) requires the public interest in maintaining the exception to outweigh the public interest in disclosure, and regulation 12(2) requires a presumption in favour of disclosure to be applied first.

Two things follow. Once harm is established, the threshold for engaging the exception is generous. One tribunal held that nothing in the wording requires the adverse effect to be significant, so even a modest one is enough. But reaching that point requires evidence that release makes harm more likely than not. The public interest test then has to be worked through against a statutory presumption pointing the other way. That is where reasonable people disagree.

Has Britain ever breached a dam on purpose?

Once, in the summer of 1942, and it was not a flood risk exercise. It was weapons research, which is the reason breach analysis entered British engineering as an attack problem rather than a planning one.

Nant-y-Gro sits in the Elan Valley in Powys. It was built between 1893 and 1904 to supply water to the workforce constructing the Elan Valley reservoirs, then abandoned once the main scheme was finished. That made it the one thing Barnes Wallis needed: a real masonry dam, at full scale, that nobody would miss.

His first attempts in May 1942 fired charges at a distance from the wall. They were spectacular and they barely marked it. In July he tried the other approach, suspending a mine at the optimum depth on scaffolding from the midpoint of the 180-foot dam and firing it remotely. The centre of the wall went. The official record of the monument puts the gap at 19 metres wide and 8 metres high, with the two ends still standing to their full 11 metres, which is how you find it today.

The conclusion was the part that mattered. A charge had to be delivered underwater and in contact with the wall to do the job at all, and that single finding produced the bouncing bomb. In May 1943 it produced 617 Squadron over the Ruhr dams.

Two things follow from that history. Britain's understanding of how a large dam gives way was classified from the beginning, because it was worked out to destroy dams and the results were a state secret before they were an engineering resource. Water was being used as a weapon elsewhere in the same war, as the deliberate inundation of the Dutch coast shows. The second point follows from the first: the concern behind a modern refusal is not invented. Somebody really did establish by experiment that the weak point of a dam is a particular place at a particular depth, and that is the kind of finding breach modelling data now carries.

Britain's knowledge of how a dam fails began as weapons research. Flood mapping for the public had to be argued for separately, and it took another sixty years.

Why do reservoirs have public flood maps?

Because somebody argued for it and won. None of this is new, and reservoirs got there first: Sir Michael Pitt's review of the 2007 floods recommended that Local Resilience Forums be given inundation maps for reservoirs, and that outline maps be published online for the public. Both happened, and the split between the two set the pattern still in use today.

1. December 2010. The Environment Agency publishes outline reservoir flood maps for large raised reservoirs in England and Wales. The outlines deliberately exclude the likelihood of failure, the depth and speed of the water, and how long it would take to arrive.
2. 2010 to 2014. The detailed maps, carrying extent, depth, velocity, hazard rating and flood arrival times, sit on the National Resilience Extranet and then on the Cabinet Office's Resilience Direct. They are marked Official Sensitive and released only to Category 1 and 2 responders.
3. August 2019. Days after the Toddbrook spillway failure at Whaley Bridge, the Canal & River Trust redacts its own Toddbrook inspection reports under regulation 12(5)(a), citing the risk of sabotage. The response arrives 49 days after the request, against a statutory 20 working days.
4. October 2021. The First-tier Tribunal upholds the Environment Agency's refusal to release vector reservoir flood outline data, on national security and public safety grounds.
5. November 2021. Weeks later, the Environment Agency publishes upgraded reservoir flood maps for 1,865 large raised reservoirs in England, as open data anyone can download.

A tribunal agreed, and then the data went open anyway

The tribunal case is worth dwelling on, because the Information Commissioner still cites it as the leading example of regulation 12(5)(a) applied to water infrastructure. The appellant asked for the simplified vector data underlying maps the Agency was already publishing as images. The tribunal accepted the Agency's case, finding that detailed data about how the maximum flood outline for a large reservoir has been calculated could be used by those intent on causing harm to the public in order to cause a catastrophic flood. It also recorded that neither it nor the Commissioner was in a position to analyse the data and reach its own view.

Within weeks of that decision the Environment Agency completed a £3 million upgrade to its reservoir flood mapping. It published the results for 1,865 large raised reservoirs, showing maximum extent on both a dry day and a wet day, and those datasets sit today on the Defra Data Services Platform under the Open Government Licence in GeoJSON, GeoPackage and web mapping formats. The metadata states that there are no public access constraints to the data. The wet-day national dataset was last revised in June 2026.

The security case for withholding reservoir flood extents won in a tribunal in October 2021 and was overtaken by the Environment Agency's own open-data release the following month.

The honest reading is not that the Agency was caught out. Two different things had been travelling under one label: the outline of where water would go, and the detailed hydraulics of how a particular structure gives way. Once they were separated, the first turned out to be publishable and the second did not. Depth, velocity, hazard rating and arrival time are still restricted to responders. Extent is open to anyone who wants it, and it now sits behind the postcode flood risk map most buyers and applicants check first, alongside the wider picture of reservoir flooding and Unda's explainer on how it is assessed.

Why isn't canal breach data mapped at all?

Reservoirs have a statutory mapping regime because they have a statutory safety regime, and canals have neither. The asymmetry is legislative rather than technical.

• The statutory regime was written for dams. The Reservoirs Act 1975 governs large raised reservoirs, with inspection by panel engineers and, since a 2021 ministerial direction, mandatory on-site flood plans.
• Most Trust reservoirs sit inside it. Of the Canal & River Trust's 84 reservoirs, 74 are regulated as large raised reservoirs under that Act and appear in the national inundation mapping.
• The canals they feed sit outside it. The embanked canal carries no equivalent statutory mapping duty, so no national dataset shows what a canal breach would do to the land below, and any breach modelling data stays with its owner.
• The exposure is not small. Around 2.2 million people in England live in areas that could be affected by reservoir flooding, according to Defra's reservoir safety reform programme. No equivalent figure has ever been published for canals.

So the water body with the strongest regulatory regime is nationally mapped and largely open, while the one running on an embankment through a village is neither mapped nor disclosed. Nobody decided this. It is a gap left by legislation written for dams and applied to a network of Georgian and Victorian earthworks that happens to hold water at roof height. It is the same gap that made the Whitchurch canal breach so hard for anyone to have anticipated locally, and the reason infrastructure flooding so rarely appears on a flood map at all.

Who is allowed to see breach data?

Breach information in England sits in four tiers. Working out which tier your question falls into is most of the battle.

Product 4 is requested free through the Flood Map for Planning service, and carries breach hazard information where the Environment Agency holds it. It is the one route by which a private applicant can obtain modelled breach output without commissioning it, and delays to that data are a familiar drag on planning programmes. It covers defended river and coastal frontages rather than canals, and it says nothing about a structure the Agency neither owns nor models. That is the position for most raised canal embankments in the country.

Is the secrecy justified?

There is a serious argument on each side, and it does not resolve neatly.

For withholding: a detailed breach model does identify the weakest point on a structure, and it quantifies the consequence of attacking it. Water infrastructure is critical national infrastructure, the information has no obvious substitute for anyone with hostile intent, and the Commissioner's guidance accepts terrorism as a legitimate basis for the exception. Asset owners also make a fair point about context: a modelled inundation extent released without the assumptions behind it invites misreading, and a misread map does its own damage to confidence in a network that is, on the whole, well managed.

Against: the reasoning behind the Pitt recommendations was that people who do not know they live below a raised water body cannot prepare for it. On that view preparedness is itself a public safety interest, not a competing one. Every documented UK canal failure of the last twenty years has been traced to internal erosion, culvert failure, slope failure, overtopping in extreme rainfall, or an operator leaving lock paddles open. None was caused by an attacker who had read a model. The reservoir experience also suggests that flood extent can be published without the consequence anyone feared, provided the hydraulics behind it are not.

The disclosure line that has held for reservoirs since 2021 is extent open, hydraulics restricted. No equivalent line has ever been drawn for canals, so everything sits on the restricted side by default.

Where that leaves a practitioner is unglamorous but clear. The refusal is defensible on its own terms and the appeal routes are real but slow, and neither fact moves the deadline on a planning application. In any case, the information that decides the assessment is not the owner's model. It is the head between the canal and the site, the location and construction of the embankment above it, and the volume the isolated pound would release before stop planks took effect. All three can be established independently, which is the point our consultants usually end up making.

If your site lies below a raised canal, reservoir or flood defence and the asset owner will not release its modelling, our consultants can establish the geometry, model the breach scenario, and set the floor levels and freeboard that follow from it. That work sits inside a flood risk assessment supported by hydraulic modelling. The same evidence supports flood risk due diligence on an acquisition, and a flood warning and evacuation plan where the residual flood risk warrants one. Call 01293 214444 or email enquiries@unda.co.uk.

Frequently asked questions