The criteria you mention seem to fit some areas. The Columbia River Dams, Some of the Missouri River Dams, The Connecticut River Dams, The Ohio River Dams and a couple of other river system dams seem to fit this. I note that there may well be several such dams in CA that would cause severe problems to population centers. I note that several weeks back the Connecticut River Dam system seemed to be being scouted by people of apparent Middle eastern extraction but no arrests were made. New York City is pretty much immune from this due to the very long navigable portion of the Hudson upstream and the tidal nature of the Hudson within New York City itself.
Stay well - Stay safe - Stay armed - Yorktown
Ludington Pumped Storage Plant [link 1]
Ludington Pumped Storage Plant [link 2]
Ludington Pumped Storage Plant [link 3]
(I mention that place because we drive past it maybe once a month or so, and I always get the creeps looking at the big dirt hill next to the highway, thinking about all the water it's keeping from swamping the road.)
I've had my camera handy, but have not seen any MEs around the dams in the area since shortly after the attack. In the unlikely event that they were planning to blow the dams, they would need a lot more explosives than Timmy McVeigh's helpers gave him to breech the dam faces.
Even if they managed to sneak this much explosive in under the noses of the MDC authority, which has been on high alert, the breeches would not result in a sudden deluge, but rather a gradual opening of the initial breech, accompanied by rising water levels, as opposed to abrupt walls of water scouring the valleys. Because the villages directly beneath the dams are equipped with flood sirens (and the sound of them going off is quite unmistakeable), and because our FD's practice for flood evacs, there would likely be few casualties as a result.
On the other hand, the MEs could be scouting the reservoirs which are used for municipal drinking water with the notion of poisoning the water supply.