According to a report issued by the American Water Works Association (AWWA), the water utility industry's focus on homeland security since the terrorist attacks of 9/11 has resulted in an unprecedented mobilization of effort and resources to protect America's water supply.
The report, Drinking Water Security in America After 9/11, identifies the security measures water utilities have undertaken since 9/11. It also describes the new culture of security that water utilities now operate under and the challenges they still face in protecting the nation's water supplies from terrorism. For a copy of the full report, go to http://www.awwa.org.
"Homeland security has been one of the greatest challenges in American history and it is also proven to be one of the greatest American success stories," said Jack Hoffbuhr, Executive Director of AWWA. "Although drinking water in the United States has long been recognized as among the safest in the world, the devastating events of 9/11 brought water security to the forefront as a priority. Since then, the security of America's water supply has been one of the most critical components in the nation's homeland security efforts. Ultimately, the success of this massive, unprecedented effort will be judged by the terrorist attack we have been able to prevent."
"A secure water supply is a cornerstone of homeland security," said Lynn Stovall, President of AWWA and General Manager of the Greenville, SC, Water Department. "We are now living in world where every effort has to be made to protect and to dissuade and prevent acts of terrorism from occurring. The American drinking water profession has built a tradition and reputation for delivering clean and safe drinking water, we are now making the same commitment to the security of the nation's drinking water supply."
Working together with the Environmental Protection Agency (EPA), water utilities have ramped up security efforts at water supply systems throughout the nation. Background checks on new employees have become common, as have intensive employee training, security audits, assessments and emergency response and communications plans. A nationwide information sharing system has been developed for water utilities. Utilities are identifying their most vulnerable traits and are working with local emergency first responders to coordinate planning.
Taken together, this mobilization of effort and resources is virtually unprecedented. It has resulted in the development of:
• The EPA's "Baseline Threat Report" describing likely modes of terrorist attack and outlining the parameters for vulnerability assessments by community water systems. This is sensitive information provided only to water utilities;
• Risk assessment tools for utilities to identify and evaluate their own security risks. Such analyses, called vulnerability assessments, are required by the Bioterrorism Act;
• Training programs on vulnerability assessments, used by several thousand water systems, to help utilities prepare accurate and detailed assessments;
• Security protocols to assure that vulnerability assessments are safeguarded after they are sent to EPA, as required by the Bioterrorism Act;
• Guidance and technical assistance for utilities to use in revising emergency response plans as required by the Bioterrorism Act;
• Development of information on "best practices" and technical assistance on matters such as security hardware technologies;
• An inventory of past security threats to community water systems and the lessons learned from them;
• Analysis of the lessons learned by community water systems through the vulnerability assessment process;
• Guidelines that water utilities may use to guard against terrorists and security threats, correlated with the Department of Homeland Security's color-coded advisory system; and
• The Water Information Sharing and Analysis Center (WaterISAC), which provides a secure portal for the communication of sensitive security information among utilities, law enforcement, and intelligence agencies.
The drinking water community, in partnership with EPA and others, actually began to prepare for terrorist threats before September 11, 2001. In 1998, President Clinton signed Presidential Decision Directive 63 and thereby identified water as part of America's critical infrastructure. Under that Directive, EPA was assigned lead responsibility for the water sector and, in turn, designated the Association of Metropolitan Water Agencies (AMWA) as the lead for this sector. At the same time, the AWWA began to prepare technical materials and publications for water utilities relating to water system security. These efforts went into high gear immediately after the terrorist attacks on New York and Washington.
Title IV of the Bioterrorism Act, which was signed into law last June, amended the Safe Drinking Water Act (SDWA) and required specific actions to improve water security, with specific deadlines and requirements for both water utilities and the EPA.
The Bioterrorism Act mandated significant new security requirements for all community water systems serving more than 3,300 people. Collectively these approximately 8,000 utilities serve over 240 million people, or about 90% of the nation's population served by community water systems.
The Bioterrorism Act requires community water systems serving more than 3,300 people to do the following:
1. Conduct a vulnerability assessment;
2. Certify to EPA that the vulnerability assessment was completed by a date specified in the law;
3. Submit a paper copy of the assessment to EPA;
4. Prepare or revise their emergency response plan based on the results of the vulnerability assessment; and
5. Certify to EPA that the emergency response plan has been developed or revised by a date certain.
Deadlines for submission of vulnerability assessments to EPA depend on the size of the water system:
• Systems serving 100,000 or more people—March 31, 2003
• Systems serving between 50,000 and 99,999 people—December 31, 2003
• Systems serving between 3,300 and 49,999 people—June 30, 2004.
Six months after submission of the vulnerability assessment, utilities are required to certify to EPA that they have developed or revised an emergency response plan based upon the results of the vulnerability assessment.
Under the Bioterrorism Act, both vulnerability assessments and emergency response plans have to focus on terrorist attack or other intentional acts intended to disrupt the ability to deliver a safe and reliable supply of drinking water or otherwise present a significant health concern. That stands them apart from the assessments and plans that most utilities have had for years for dealing with natural disasters, vandalism, etc. While the assessments and plans that existed before September 11 may serve as a very good starting point, the focus of the Bioterrorism Act is purposeful destruction or contamination, and water utilities must alter their emergency response plans to meet these new threats.
EPA has its own set of deadlines in the Bioterrorism Act. Congress required that by Aug. 1, 2002, EPA complete a baseline threat report with information on likely threats for utilities to consider in the development of a vulnerability assessment. EPA completed the Baseline Threat Information for Vulnerability Assessments for Community Water Systems and provided this sensitive report to water utilities in the fall of 2002.
The law also required EPA to develop a protocol for protection of the submitted vulnerability assessments by Nov. 30, 2002. In response, the Agency has completed a robust protocol with multiple levels of protection to safeguard vulnerability assessments within a controlled-access facility at EPA headquarters.
EPA is also required to conduct research on prevention, detection, and response to contamination and supply disruption, and a research plan is under development. Finally, the law requires EPA to develop guidance for small systems serving less than 3,300 people. While these systems are not required to conduct a vulnerability assessment and revise an emergency response plan under the Bioterrorism Act, many are implementing plans to protect their customers.
Virtually all of the largest utilities – those with the earliest deadline of March 31, 2003 – submitted their vulnerability assessments to EPA on or before the deadline. They are now revising their emergency response plans to reflect what they learned in the vulnerability assessment. In addition, utilities are conducting prevention and response training to anticipate and prepare for issues surrounding a potential terrorist attack that impacts the water supply. Medium and smaller sized utilities across the nation are in the process of developing their vulnerability assessments, and they too will develop or revise effective emergency response plans. Both the utility community and EPA are giving security the serious attention it deserves.
Since the terrorist attacks of Sept. 11, 2001, water utilities have been assessing their systems. AWWA has estimated $1.6 billion is needed for the first steps toward greater physical protection, to include better fences, locks, lights, and alarms at critical utility assets. The cost of other necessary utility security upgrades is highly dependent on local factors such as the level of water security upgrades needed. Such costs have not been estimated at this time, but will be substantial. Barring additional local, state, or federal funding, these costs will be passed on to the customer.
