Reassessing Water
Security
Water & Wastes Digest
examines what measures utility personnel can take to ensure the
security of the nation’s drinking water
Beyond the hype, how will security regulations and upgrades
translate into an everyday routine for water utility personnel?
- By Jessica Moorman
According to the U.S. EPA, more than 90% of Americans are served by
public drinking water systems. This is a startling number
considering that many water utilities have only recently made
security a high priority. Some of these utilities serve millions
of people each day, and access to safe drinking water is a basic
element of life. A biological attack or even a natural disaster
that caused a water treatment system to fail could lead to
devastating results.
Scenarios such as this one have brought water security issues
to the front pages of major newspapers and to the plots of
primetime television shows. Since the tragic events of Sept. 11,
2001, the general public is more aware of water security than
ever before. Government officials have made it a top concern,
but regulations are slim and funding for security enhancements
is even slimmer. Across the U.S., significant actions have been
taken to assess and reduce water system vulnerabilities, but as
time goes by, the sense of urgency for securing these facilities
is diminishing.
Beyond the hype, how will security regulations and upgrades
translate into an everyday routine for water utility personnel?
Current regulations
Water security first came into the spotlight in 1998, when
Presidential Decision Directive 63 named water systems as one of
the nation’s critical infrastructures. This directive did little
to secure water systems, but it created new awareness of the
issue. The events of 9-11 brought an urgency to secure critical
infrastructures, and Congress soon passed the Public Health
Security and Bioterrorism Preparedness and Response Act of 2002
(Bioterrorism Act). This act mandated that all public water
systems with more than 3,300 customers complete a Vulnerability
Assessment (VA) and Emergency Response Plan (ERP) to assess the
weaknesses of their systems and develop procedures for handling
emergencies.
According to Janet Pawlukiewicz, director of the Water
Security Division of the U.S. EPA, the compliance of water
systems to this mandate has been very high. “I’m very pleased to
say that the water sector takes water security very seriously,”
Pawlukiewicz said. The EPA has received 100% of the VA’s from
the two largest divisions of water systems, which are those
serving more than 100,000 people and those serving 50,000 to
100,000. For the systems that serve 3,300 to 50,000, the EPA has
received 95% of VA’s. Pawlukiewicz said the compliance for
completing ERP’s has been very high as well.
“We feel as though the risk has been identified at the local
level by the utilities, Pawlukiewicz said. “So now our challenge
is to move from risk identification to risk reduction.”
To assist utilities with this transition, EPA worked with the
National Drinking Water Advisory Council’s Water Security
Working Group to identify the best security practices and
policies for drinking water and wastewater utilities.
“The reason we think these are so important is because water
systems have been asking what they should be doing from a
management perspective,” Pawlukiewicz explained. “Not only have
water systems been asking this but so have local governments and
rate setter organizations.”
The working group identified 14 features of active and
effective security programs, which can be found on the EPA’s
website (www.epa.gov). Some of these features include promoting
organization-wide security awareness, identifying security
priorities and resources to address them, updating emergency
response plans, and developing measures for assessing security
achievements. In the FY06 budget, the President requested and
Congress appropriated funds to provide additional training and
tools on effective security programs for water utilities.
Various approaches to security
Despite the recommendations of the Water Security Working
Group, water utilities have found no one solution to this issue.
Municipalities have done everything from the bare minimum
required by regulations to multi-million dollar physical
upgrades. Most often, the extent to which systems can perform
security upgrades depends on the depth of their pockets.
According to Neil Grigg, a professor of civil engineering at
Colorado State University, there are two ways utilities can
approach security.
“One is to have an overall security plan, where they have
done their VA; have their ERP in place; trained their personnel;
and approached security on an overall basis from a management
standpoint,” Grigg said. “The other thing they can do is focus
on the really critical facilities and protect them, making sure
they have some redundancy in case something goes out.”
The second approach should be a part of the overall security
plan, but with limited resources, many water utilities have been
forced to only secure their most critical facilities.
Physical upgrades
Water utilities have taken various measures to enhance their
security, and many look at physical upgrades first because they
are the most obvious.
Jack Moyer, deputy public utilities director for the city of
Raleigh, N.C., said that physical upgrades depend on the
individual VA of the utility, but he has observed some
consistent challenges among utilities, which include door locks
and key control issues, fences and cameras.
Moyer has a lot of experience with physical upgrades in
Raleigh, but most of those upgrades were driven by natural
disasters, not the threat of terrorism. The city of Raleigh has
recently spent about $2 million on physical security upgrades
for its water treatment and wastewater plants, after spending
more than $9 million on generators several years ago. The
generators were purchased after Raleigh endured a severe ice
storm and a hurricane, each causing major power failures. Moyer
said that these upgrades help to prepare for both natural
disasters and terrorist acts because once a given situation
occurs, the response is usually very similar. The amount spent
on physical upgrades varies among utilities, but Moyer said it
usually depends on the size of the facility.
“I’ve used a rough rule of thumb that about $100,000 should
be spent for every 10 mgd of production,” Moyer said.
With so many security products being introduced in the water
market, the EPA is assisting water utilities by posting
information about these products on their website. They give
individual summaries of security products and have been working
with the Homeland Security Research Center to test products
through the Environmental Technology Verification Program.
The funding dilemma
Conducting VA’s and upgrading facilities can get very
expensive for utilities with limited budgets. Some utilities are
turning to the federal government for funding, but this is
proving very difficult to find.
“If there is one need it would be funding,” Moyer said. “The
VA was mandated, but the grants were only for bigger systems. I
understand that was to help those with the highest terrorist
target risk, but it was mandated for most systems.” Grigg agreed
that utilities will encounter difficulties without more funding.
“My sense is that they’ll initiate the upgrades, particularly
if there is funding provided. But if there is additional funding
required, they will be slow to pick up because they have so many
competing needs.”
EPA’s Pawlukiewicz said that funding for security
enhancements is up to local governments. “They need to look at
their own financial planning and determine how security
enhancements can fit into their existing financial plans. They
also can turn to the state revolving loan funds. I think they
need to consider whether there might be multiple benefits to
these enhancements for other types of emergencies.”
Easy and inexpensive measures
Moyer said that although many physical upgrades are often
necessary, there are five easy and inexpensive measures that are
vital for water security.
“The commonality of these five is two-fold; the first is that
I really think they are the easiest and least expensive, and the
other is that I think they have the most value. They are not
absolutely costless, but they have almost no capital cost and no
equipment cost.”
Develop ERP details and training
“The important thing to do here is take the ERP and keep
working on it. Work with the operators and the other people in
the utility who will need to use it later and make it a useful
document,” Moyer said. “There is a buzzword that has caught on
that supports that argument. They’re called ‘rip and run’
sheets. If there’s something required to do, there should be a
page they can literally rip out and run with.” Establish
inter-agency relationships
“Get to know your police department, fire department and
health department,” Moyer said. “I think most utility directors
cannot name their local health director. They need to know to
call the water utility at the first hint of a waterborne
illness, and we need to know that we can call them if we’re
concerned about a water system incident.”
Conduct tabletop exercises
“I’m a big fan of tabletop exercises,” Moyer said. “They’re a
great way to test, brainstorm, exercise, and debug your
emergency response procedures. They’re also inexpensive; other
than photocopying some papers, providing refreshments, and the
cost of getting everyone together in the room, they have
virtually no cost.”
Recently the EPA released a CD-ROM with the basics of
conducting tabletop exercises; it is available on their website
(www.epa.gov).
Prepare messages to the media and the public
This involves drafting template messages that can be used in
the event of an emergency. “The idea is that you don’t want to
be drafting a news release in the middle of the night with
people in the hospital,” Moyer said.
Promote a security culture and address employee concerns
“In years past, you could have someone walking around a plant
and people would wonder who the guy is, but do nothing,” Moyer
said. “We all need to be more security conscious. A utility has
anywhere from one set of eyes to a thousand sets of eyes out
there. All of those people need to be part of their security
culture.”
The other part of this is dealing with employee issues in
advance and during an incident. “We have found here over the
various natural disasters we’ve had that employee issues are
probably the number one recurring issue,” Moyer said. These
issues involve employee concerns about their families’ safety
and their personal safety during an emergency. “The idea is to
try to address some of those issues in advance and be ready to
deal with them,” Moyer explained.
Some of these five items overlap with the Water Security
Working Group’s findings, but overall, these five are some of
the easiest and least expensive measures that water utilities
can do for security improvement and disaster preparedness.
The five P’s
Pawlukiewicz uses some of these same ideas when she gives
water utility personnel her five P’s to remember about water
security. They are:
- Partner—partnering with those in the community that can
help the utility in an emergency, such as the police and fire
departments, public health officials, etc;
- Plan—planning for the unexpected by understanding the VA
and updating the ERP;
- Procure—procuring the necessary equipment for security
enhancements;
- Practice—practicing the correct responses to specific
situations through training and tabletop exercises; and
- Promote—promoting the importance of water security to
others.
Training goals
In order to keep up-to-date on the latest in water security,
many associations offer training and educational opportunities.
The EPA offers a large number of training courses and workshops
on a wide variety of water security issues, and the AWWA, WEF
and ASCE offer various security seminars each year.
Through a grant from the EPA, each of these organizations is
also offering a comprehensive training program for incorporating
security measures into facility design, operation and
management. Each program will incorporate presentations,
instructor guidelines, quizzes and exams in MS Word, MS
PowerPoint and PDF formats. The programs are provided on a
CD-ROM, available on each organization’s website.
To stay informed of current security information, water
utilities can subscribe to the Water Information Sharing and
Analysis Center (WaterISAC), which gathers, analyzes and
disseminates information from DHS, EPA, and public health and
law enforcement sources, as well as utility security incident
reports. Through this secure service, subscribers can access
databases of chemical and biological agents, threat information
and water security tools.
What to expect in the future
With so much information available for water utility
personnel, the question now is how training and upgrades
translate into a long-term solution.
“What they need to know is out there,” Grigg said. “The next
level of issues is that given all of the pressures that they’re
facing, in terms of losing key employees, keeping their
workforce trained, and having enough money to take care of
pressing issues, how do they deal with the security issue, at
the same time as they’re dealing with all these other issues.”
While security issues are relatively new for existing water
utility personnel, Grigg is helping to teach the next generation
how to make security a part of their everyday routine when
working at a water plant.
“I have two lines of teaching and research,” Grigg said. “One
is water resource management, and the other is infrastructure
management. What I’m trying to do in both of these areas is take
the security issue and put it inside the management issue to
show students how security is a big part of management, just
like finance, law, politics, human resources.”
Hopefully, the next generation will come to the workforce
fully prepared to handle the many pressing issues involved in
managing a public drinking water utility, including integrating
security into the overall management of the facility.
Until then, water utility personnel have a challenging road
ahead as they attempt to keep the nation’s drinking water
secure.
Jessica Moorman is an
associate editor for Water & Wastes Digest. She can be reached
at 847/391-1012. For more information, write in 1100 on this
issue’s Reader Service Card.
Source: Water & Wastes Digest
September 2005 Vol: 45 Num: 9
Copyright © 2005 Scranton Gillette Communications |