Ten years ago, security at most mid-sized water treatment plants was little more than a locked door. Today, water and wastewater utilities are doing their best to protect the vulnerabilities of systems that spread out over literally millions of miles.

Utility managers have had to learn in a hurry how best to accomplish this.

“A ‘water security expert' is someone who's been involved on a part-time basis for the last three or four years,” says Dan Lynch, water and wastewater utility director for the city of Janesville, Wis. “By that definition I'm an expert, even though it's not what I spend most of my time doing.”

The 2009 federal budget proposal would cut grants to state and local governments for homeland security by $1.9 billion, or 47%. If enacted, it's doubtful the reduction would negatively impact the security of the nation's drinking water and wastewater treatment systems. Most have already done the job on their own.

“Right after 9/11 some of the larger systems did get some federal money, but there were never any direct grants or loans to smaller systems,” says Lynch. “There are ways to access homeland security money because water systems are considered first responders, but that also means we compete with police and fire departments.

“Before 9/11, security in this town meant trying to remember to lock the doors. But today there's only one city facility that is more secure than the water facility, and that's the police station. Because they have guns.”

Since Sept. 11, 2001, federal security programs have grown into a maze so labyrinth that even a dedicated bureaucrat could get lost.

Water and wastewater systems are a “critical infrastructure and key resource” (CI/KR) under the Department of Homeland Security's (DHS) National Infrastructure Protection Plan (NIPP). The lead agency for security enhancements to water and wastewater systems is the EPA, under the Sector-Specific Plan portion of NIPP.

To respond to its charge, the EPA established the Water Security Working Group under the National Drinking Water Advisory Council. With representation from water utilities across the nation, the group issued a report in 2005 that was adopted as a formal proposal to the EPA. The report concludes with recommendations for the 14 essential features of an “active and effective security program.”

The latest and greatest security plan came out last May as a joint DHS/EPA document titled Water: The Critical Infrastructure and Key Resources Sector-Specific Plan (SSP) as input to the National Infrastructure Protection Plan. The purpose of this massive document is “to provide information on the activities and initiatives [the water sector] is undertaking to identify, prioritize, and coordinate protection of critical sector infrastructure.”

These federal resources are good places to begin when trying to understand water and wastewater security issues in the United States. But most federal funding was allocated not as direct grants for key card systems and video cameras, but rather as support to develop guidance documents, communication methods, and training programs. Most of this has happened through associations such as the American Water Works Association (AWWA), the Water Environment Federation (WEF), the American Society of Civil Engineers (ASCE), the Association of Metropolitan Water Agencies (AMWA), and the Association of Metropolitan Sewerage Agencies (AMSA).

“Most of the federal funding that finds its way to our city is for personnel training,” says Grahame Watts, emergency and special projects manager for Thousand Oaks, Calif. “The challenge is that if funding comes from the federal government it goes first to the state, then to the region, then to the county, and the city gets whatever's left.”

ASSESSING YOUR FACILITY'S RISK

Although efforts to assess the vulnerability of water and wastewater facilities were under way before Sept. 11, this effort took on new urgency afterward. The Bioterrorism Act of 2002 required every water utility serving more than 3,300 people to submit a vulnerability assessment and emergency response plan by the end of 2004. Although not required, the act encourages water suppliers to update both the assessment and the emergency plan regularly.

Training programs and a vulnerability assessment tool (the Risk Assessment Methodology for Water Utilities, RAM-W) were developed by Sandia National Laboratories, working with AWWA. The Vulnerability Self-Assessment Tool (VSAT) was developed by AMSA, and an assessment tool for small water systems was developed by the Association of State Drinking Water Administrators and the National Rural Water Association.

The most comprehensive effort to improve security is the Water Infrastructure Security Enhancements (WISE) program, a joint effort funded by the EPA and coordinated by ASCE, AWWA, and WEF, that came about in three phases.

“The whole purpose of the WISE documents is to educate people and provide some rational starting and stopping points for design and operation and management of these facilities,” says Janesville's Lynch, who is a member of the WISE working group. “The documents are reasonable and usable by all sizes of cities.

“That was one of the hurdles we had: how to design a one-size-fits-all security system. We quickly came to the realization that you can't. Philadelphia or New York City will have security experts on staff, but most cities won't. These manuals may serve as references for the big cities, but that's not the target audience and neither are tiny cities.

“Another focus was to look at what are your risks? What are you trying to protect against? We realized that if you are the target of a bunch of experts, you're not going to stop them. The goal is to make it harder for them to succeed.”

In WISE Phase I, the working groups developed Interim Voluntary Guidance Documents, one for securing water utilities and another for securing wastewater/stormwater utilities. Issued late in 2004, these extremely detailed documents cover all managerial and operational aspects of plant operations, from worker background checks to storage tank security to cyber threats. Their purpose is to “provide water systems with an initial guide to the design of new facilities or the redesign or retrofit of existing facilities to create better physical security and reduce risk.”

Also part of Phase I is Guidelines for Designing an Online Contaminant Monitoring System. This is a bit difficult to do, as the authors admit, since “much of the basic scientific and engineering knowledge needed is not yet available ... [and] ... the instrumentation needed to accomplish the job directly, particularly for water supply systems, is not available in the marketplace.” So why bother? The guidelines' goal is to help guide the research, and to make residents feel they're being protected.

“I don't think the public is always comfortable with our security because it's not easily communicated,” says Thousand Oaks'Watts. “It's simply not a priority for most water utilities. I understand that they like to stay under the radar, but there's also the need to assure people that we aren't asleep at the wheel.”

Phase II is a training program for educating everyone involved with security for water or wastewater systems. This includes a PowerPoint presentation, a trainers' guide, and exams. The program is available on a CD-ROM provided free to qualified utility personnel.

Under Phase III, two Draft American National Standards for Trial Use were developed for the physical security of water utilities and wastewater/stormwater utilities. These detailed documents provide recommendations for various levels of security and help a utility establish a benchmark from which to measure progress.

STAYING UP TO DATE ON THREATS

One way to improve security is to keep water utilities up to date on the latest threats. That's the job of the Water Information Sharing and Analysis Center.

WaterISAC was created in 2002 by the Association of Metropolitan Water Agencies under a grant from the EPA. This information service provides its subscribers with comprehensive threat information from a variety of sources. Its experts gather information and disseminate alerts and analysis to the water community. The basic subscription is free to water utility operators, while WaterISAC Pro, with better analysis, costs $200 to $1,000/year depending on the utility's customer base.

“There are a number of information centers out there,” says Lynch. “Critical assets were identified where information sharing was needed—water, electricity, and even banking and chemicals. So it isn't just infrastructure, but anything that could take this country down whether through physical damage or economic damage.”

Even large utilities can't afford to be continuously prepared for a major problem, though, whether it's a terrorist attack or an earthquake or a flood. That's where the Water and Wastewater Agency Response Network (WARN) comes in.

Through WARN, utilities commit to providing one another with people and equipment in case of an emergency. Driven by the AWWA under a grant from the EPA, the WARN system has been adopted by at least 20 states and soon will be by nearly all states. California emergency planner Ray Riordan told AWWA's Water-Week that water and wastewater utilities are so specialized that they need experts, not generalists, during emergencies.

“Utilities also must fill the gap between the onset of a disaster and the arrival of government aid,” he says. “FEMA is muscular, but not very agile and quick on its feet.”

BRINGING TECHNOLOGY TO BEAR

From monitoring for contaminants to controlling access to closed-circuit video, technology is helping utilities in their quest to make systems more secure.

For example, few water providers monitor for contaminants on a real-time basis, but that may soon change. Sandia National Laboratories in Albuquerque, N.M., is working with the EPA, the University of Cincinnati, and Argonne (Ill.) National Laboratory to develop such a system under the EPA's Threat Ensemble Vulnerability Assessment (TEVA) research program (see photo on page 32).

Hach Co. says its Guardian Blue early warning system is the only online, anti-terrorism system certified by DHS. By measuring chlorine, pH, turbidity, conductivity, and TOC, the system analyzes water every 60 seconds for deviations from a baseline. Deviations caused by foreign agents in the water trigger an alarm.

Controlling access is a critical element in system security. Isonas Security Systems' proximity card readers are connected directly to the network, rather than to a control panel, and are powered through Ethernet cabling. Readers can be indoors or out, wired or wireless; this system can control thousands of access points and employees.

Arteco Intelligent Video Solutions detects and triggers alerts in real time, increasing the efficiency of employees who are responsible for multicamera sites. Recently installed at the Louisville, Ohio, water treatment plant, the system can detect the difference between a dog and a man.

CheckLight uses nonpathogenic, contaminant-sensitive, luminescent bacteria and a luminometer to monitor drinking water quality in real time.

Dewberry has developed Disaster Assistance Response and Recovery Technology software that uses a utility's GIS to provide analysis and visualization tools for disaster response, while ESRI has developed ways to use GIS to predict the effects of disasters on infrastructure.

— Palmer is former editor in chief of PUBLIC WORKS, and Newman has worked in the construction industry for more than 30 years as a builder and inspector.

Web extra: For links to the reports and programs mentioned in this article, visit the “article links” page under “resources” at www.pwmag.com.

Web extra: For links to more information on the technologies described in this article, visit the “article links” page under “resources” at www.pwmag.com.

Almost half of funding has been returned to federal coffers.

Federal funding for security enhancements is administered by the Department of Homeland Security (DHS) through the Homeland Security Grant Program (HSGP). As the lead agency for the Sector-Specific Plan for water and wastewater security, the EPA also provides some funding.

Who's got the money?

Under the HSGP, some specific urban areas and cities can apply directly to the federal government under the Urban Areas Security Initiative. All other grants, such as from the State Homeland Security Program, must go through the states.

Another DHS grant program, the Infrastructure Protection Program (IPP), also funnels money to the states, primarily for transportation-related projects.

Water infrastructure managers can look to the EPA for help, although the funds allocated to states and cities are small. State and Tribal Assistance Grants, for example, awarded $5 million for water infrastructure last year. State Revolving Funds can be a good resource, especially for smaller and disadvantaged communities, but appropriations to this federal program have consistently declined.

Will I get a grant or a loan?

Most DHS money comes in the form of grants. DHS allocates this money based on risk, which is defined as the product of three variables:

  • Threat—the likelihood of an attack

  • Vulnerability—the relative exposure to attack
  • Consequence—the expected impact of an attack.
  • Some grants require matching funds. In the agencies' capacity as response/recovery agencies, funding through DHS and the EPA may be distributed as low-interest loans.

    How much is available?

    Total HSGP funding rose to a high of $2.9 billion in 2004, but is down to $1.7 billion this year. Although the EPA's FY 2009 budget tags $170 million for water infrastructure security, little of that is for direct grants to cities.

    Is all the funding being spent and, if not, why not?

    From the HSGP's creation in 2002 to fiscal year 2007, about 30%—or $5 billion of $16 billion—of all the federal money approved by Congress for distribution to individual state anti-terrorist and natural disaster response agencies such as police, fire, and other emergency workers hasn't been spent.

    Unspent EPA funds are generally closed out.

    Reasons given for unspent funds include:

  • Long-range projects require gradual use of funds
  • Heavy demand for new equipment causes shortages
  • Smaller communities don't have required matching funds
  • Stringent contracting/bidding rules create bottlenecks
  • Lack of organization and direction can lead to inaction
  • Cooperation/coordination causes delays.