According to the U.S. EPA, more than 90% of Americans are served by public drinking water systems. This is a startling number considering that many water utilities have only recently made security a high priority. Some of these utilities serve millions of people each day, and access to safe drinking water is a basic element of life. A biological attack or even a natural disaster that caused a water treatment system to fail could lead to devastating results.
Scenarios such as this one have brought water security issues to the front pages of major newspapers and to the plots of primetime television shows. Since the tragic events of Sept. 11, 2001, the general public is more aware of water security than ever before. Government officials have made it a top concern, but regulations are slim and funding for security enhancements is even slimmer. Across the U.S., significant actions have been taken to assess and reduce water system vulnerabilities, but as time goes by, the sense of urgency for securing these facilities is diminishing.
Beyond the hype, how will security regulations and upgrades translate into an everyday routine for water utility personnel?
Current regulations
Water security first came into the spotlight in 1998, when Presidential Decision Directive 63 named water systems as one of the nation’s critical infrastructures. This directive did little to secure water systems, but it created new awareness of the issue. The events of 9-11 brought an urgency to secure critical infrastructures, and Congress soon passed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act). This act mandated that all public water systems with more than 3,300 customers complete a Vulnerability Assessment (VA) and Emergency Response Plan (ERP) to assess the weaknesses of their systems and develop procedures for handling emergencies.
According to Janet Pawlukiewicz, director of the Water Security Division of the U.S. EPA, the compliance of water systems to this mandate has been very high. “I’m very pleased to say that the water sector takes water security very seriously,” Pawlukiewicz said. The EPA has received 100% of the VA’s from the two largest divisions of water systems, which are those serving more than 100,000 people and those serving 50,000 to 100,000. For the systems that serve 3,300 to 50,000, the EPA has received 95% of VA’s. Pawlukiewicz said the compliance for completing ERP’s has been very high as well.
“We feel as though the risk has been identified at the local level by the utilities, Pawlukiewicz said. “So now our challenge is to move from risk identification to risk reduction.”
To assist utilities with this transition, EPA worked with the National Drinking Water Advisory Council’s Water Security Working Group to identify the best security practices and policies for drinking water and wastewater utilities.
“The reason we think these are so important is because water systems have been asking what they should be doing from a management perspective,” Pawlukiewicz explained. “Not only have water systems been asking this but so have local governments and rate setter organizations.”
The working group identified 14 features of active and effective security programs, which can be found on the EPA’s website (www.epa.gov). Some of these features include promoting organization-wide security awareness, identifying security priorities and resources to address them, updating emergency response plans, and developing measures for assessing security achievements. In the FY06 budget, the President requested and Congress appropriated funds to provide additional training and tools on effective security programs for water utilities.
Various approaches to security
Despite the recommendations of the Water Security Working Group, water utilities have found no one solution to this issue. Municipalities have done everything from the bare minimum required by regulations to multi-million dollar physical upgrades. Most often, the extent to which systems can perform security upgrades depends on the depth of their pockets.
According to Neil Grigg, a professor of civil engineering at Colorado State University, there are two ways utilities can approach security.
“One is to have an overall security plan, where they have done their VA; have their ERP in place; trained their personnel; and approached security on an overall basis from a management standpoint,” Grigg said. “The other thing they can do is focus on the really critical facilities and protect them, making sure they have some redundancy in case something goes out.”
The second approach should be a part of the overall security plan, but with limited resources, many water utilities have been forced to only secure their most critical facilities.
Physical upgrades
Water utilities have taken various measures to enhance their security, and many look at physical upgrades first because they are the most obvious.
Jack Moyer, deputy public utilities director for the city of Raleigh, N.C., said that physical upgrades depend on the individual VA of the utility, but he has observed some consistent challenges among utilities, which include door locks and key control issues, fences and cameras.
Moyer has a lot of experience with physical upgrades in Raleigh, but most of those upgrades were driven by natural disasters, not the threat of terrorism. The city of Raleigh has recently spent about $2 million on physical security upgrades for its water treatment and wastewater plants, after spending more than $9 million on generators several years ago. The generators were purchased after Raleigh endured a severe ice storm and a hurricane, each causing major power failures. Moyer said that these upgrades help to prepare for both natural disasters and terrorist acts because once a given situation occurs, the response is usually very similar. The amount spent on physical upgrades varies among utilities, but Moyer said it usually depends on the size of the facility.
“I’ve used a rough rule of thumb that about $100,000 should be spent for every 10 mgd of production,” Moyer said.
With so many security products being introduced in the water market, the EPA is assisting water utilities by posting information about these products on their website. They give individual summaries of security products and have been working with the Homeland Security Research Center to test products through the Environmental Technology Verification Program.
The funding dilemma
Conducting VA’s and upgrading facilities can get very expensive for utilities with limited budgets. Some utilities are turning to the federal government for funding, but this is proving very difficult to find.
“If there is one need it would be funding,” Moyer said. “The VA was mandated, but the grants were only for bigger systems. I understand that was to help those with the highest terrorist target risk, but it was mandated for most systems.” Grigg agreed that utilities will encounter difficulties without more funding.
“My sense is that they’ll initiate the upgrades, particularly if there is funding provided. But if there is additional funding required, they will be slow to pick up because they have so many competing needs.”
EPA’s Pawlukiewicz said that funding for security enhancements is up to local governments. “They need to look at their own financial planning and determine how security enhancements can fit into their existing financial plans. They also can turn to the state revolving loan funds. I think they need to consider whether there might be multiple benefits to these enhancements for other types of emergencies.”
Easy and inexpensive measures
Moyer said that although many physical upgrades are often necessary, there are five easy and inexpensive measures that are vital for water security.
“The commonality of these five is two-fold; the first is that I really think they are the easiest and least expensive, and the other is that I think they have the most value. They are not absolutely costless, but they have almost no capital cost and no equipment cost.”
Develop ERP details and training
“The important thing to do here is take the ERP and keep working on it. Work with the operators and the other people in the utility who will need to use it later and make it a useful document,” Moyer said. “There is a buzzword that has caught on that supports that argument. They’re called ‘rip and run’ sheets. If there’s something required to do, there should be a page they can literally rip out and run with.” Establish inter-agency relationships
“Get to know your police department, fire department and health department,” Moyer said. “I think most utility directors cannot name their local health director. They need to know to call the water utility at the first hint of a waterborne illness, and we need to know that we can call them if we’re concerned about a water system incident.”
Conduct tabletop exercises
“I’m a big fan of tabletop exercises,” Moyer said. “They’re a great way to test, brainstorm, exercise, and debug your emergency response procedures. They’re also inexpensive; other than photocopying some papers, providing refreshments, and the cost of getting everyone together in the room, they have virtually no cost.”
Recently the EPA released a CD-ROM with the basics of conducting tabletop exercises; it is available on their website (www.epa.gov).
Prepare messages to the media and the public
This involves drafting template messages that can be used in the event of an emergency. “The idea is that you don’t want to be drafting a news release in the middle of the night with people in the hospital,” Moyer said.
Promote a security culture and address employee concerns
“In years past, you could have someone walking around a plant and people would wonder who the guy is, but do nothing,” Moyer said. “We all need to be more security conscious. A utility has anywhere from one set of eyes to a thousand sets of eyes out there. All of those people need to be part of their security culture.”
The other part of this is dealing with employee issues in advance and during an incident. “We have found here over the various natural disasters we’ve had that employee issues are probably the number one recurring issue,” Moyer said. These issues involve employee concerns about their families’ safety and their personal safety during an emergency. “The idea is to try to address some of those issues in advance and be ready to deal with them,” Moyer explained.
Some of these five items overlap with the Water Security Working Group’s findings, but overall, these five are some of the easiest and least expensive measures that water utilities can do for security improvement and disaster preparedness.
The five P’s
Pawlukiewicz uses some of these same ideas when she gives water utility personnel her five P’s to remember about water security. They are:
- Partner—partnering with those in the community that can help the utility in an emergency, such as the police and fire departments, public health officials, etc;
- Plan—planning for the unexpected by understanding the VA and updating the ERP;
- Procure—procuring the necessary equipment for security enhancements;
- Practice—practicing the correct responses to specific situations through training and tabletop exercises; and
- Promote—promoting the importance of water security to others.
Training goals
In order to keep up-to-date on the latest in water security, many associations offer training and educational opportunities. The EPA offers a large number of training courses and workshops on a wide variety of water security issues, and the AWWA, WEF and ASCE offer various security seminars each year.
Through a grant from the EPA, each of these organizations is also offering a comprehensive training program for incorporating security measures into facility design, operation and management. Each program will incorporate presentations, instructor guidelines, quizzes and exams in MS Word, MS PowerPoint and PDF formats. The programs are provided on a CD-ROM, available on each organization’s website.
To stay informed of current security information, water utilities can subscribe to the Water Information Sharing and Analysis Center (WaterISAC), which gathers, analyzes and disseminates information from DHS, EPA, and public health and law enforcement sources, as well as utility security incident reports. Through this secure service, subscribers can access databases of chemical and biological agents, threat information and water security tools.
What to expect in the future
With so much information available for water utility personnel, the question now is how training and upgrades translate into a long-term solution.
“What they need to know is out there,” Grigg said. “The next level of issues is that given all of the pressures that they’re facing, in terms of losing key employees, keeping their workforce trained, and having enough money to take care of pressing issues, how do they deal with the security issue, at the same time as they’re dealing with all these other issues.”
While security issues are relatively new for existing water utility personnel, Grigg is helping to teach the next generation how to make security a part of their everyday routine when working at a water plant.
“I have two lines of teaching and research,” Grigg said. “One is water resource management, and the other is infrastructure management. What I’m trying to do in both of these areas is take the security issue and put it inside the management issue to show students how security is a big part of management, just like finance, law, politics, human resources.”
Hopefully, the next generation will come to the workforce fully prepared to handle the many pressing issues involved in managing a public drinking water utility, including integrating security into the overall management of the facility.
Until then, water utility personnel have a challenging road ahead as they attempt to keep the nation’s drinking water secure.
