Click for next page ( 2


The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 1
Part I Overarching Issues and Research and Technical Support Needs Assessment

OCR for page 1
2 A Review of the EPA Water Security Action Plan be woven together into a comprehensive guidance document (the Integrates} Water Security Prevention and Response Guidance) that wouIct direct a utility through available prevention strategies, information resources, communication planning, and response and recovery actions (including detection and monitoring, risk assessment, and decontamination). With the support of this guidance, each water organization can work with regional agencies to develop specific water security implementation plans based on its vulnerability assessment and any unique circumstances. The Action Plan needs to consider this broacler context for improving water security. The Action Plan is silent on the financial resources requires! to complete the proposed research and technical support projects and to implement the countermeasures needed to improve water security. The EPA should attempt to quantify the benefits and costs accruing to the proposed research and technical support projects, and further study should be directed to better acknowledging business-enabling dual-use benefits of security enhancements. More emphasis is needed on communicating the value of water and increased water system security with the public, rate regulators, and local elected and appointed officials, because increased rate structures may be needed to create the necessary financial resources to implement such countermeasures. ..... Assessments and Lessons Learned New Science and Research Databases Tools and Methods _ :$....... Communication Strategies Action Plan Integrated Water Security Prevention and Response Guidance (Includes EPA Communications Plan and Supporting "Play Books") Water Security Implementation Plans for Utilities and Regional Agencies Figure ES-. Example framework for depicting the contributions of the Water Security Research and Technical Support Action Plan to the broader needs for protecting the nation's water systems (including drinking water and wastewater).

OCR for page 1
Executive Summary The consequences of a terrorist attack on the nation's water supply to public health, national security, and the nation's economic services could be significant, and the sad events of September 11, 2001 have heightened concerns regarding the vulnerabilities of public water systems to deliberate attack. The Environmental Protection Agency (EPA) currently bears lead responsibilities for protecting water systems from terrorist threats, and they are currently working in partnership with federal, state, and local government agencies, water and wastewater utilities, and professional associations to ensure safe water supplies. To support their water security responsibilities, the EPA recently developed the Water Security Research and Technica;l Support Action Plan (Action Plan), which identifies critical security issues for drinking water and wastewater, outlines research and technical support needs within these issues, and presents a prioritized list of research and technical support projects to address these needs. The National Research Council (NRC) was tasked to review the EPA Water Security Research and Technical Support Action Plan and provide an initial assessment according to the following questions: . . Has the Action Plan completely and accurately identified important issues and needs in the water security arena? If not, what issues and needs should be added or removed? Overall, what changes to the Action Plan are recommended to improve its presentation in terms of content and structure so as to more clearly convey the water security research and technical support program that is described? This report was written by the Panel on Water System Security Research, organized under the NRC's Water Science and Technology Board. A subsequent report of the panel (see Part II) reviews the individual projects identified in the Action Plan and evaluates their prioritization and timing.

OCR for page 1
4 A Review of the EPA Water Security Action Plan OVERARCHING ISSUES The Action Plan contains an extensive list of drinking water and wastewater research and technical support needs and associated projects that cover many of the critical water security issues. However, the projects will not, in themselves, result in improved protection of the nation's drinking water and wastewater systems. Improved protection will only result when the information and knowledge obtained from the projects are integrated into funded water security plans that are implemented by collaborations of private and public organizations. Figure ES-1 provides a suggested framework for how the individual research and technical support projects within the Action Plan should contribute to improved water security. More specifically, the Action Plan encompasses data collection and assessments, database creation, new science and research, tools and methods development, and improved communications. Information from these activities, along with play books mentioned in the Action Plan, should be woven together into a comprehensive guidance document (the Integrated Water Security Prevention and Response Guidance) that would direct a utility through available prevention strategies, information resources, communication planning, and response and recovery actions (including detection and monitoring, risk assessment, and decontamination). With the support of this guidance, each water organization can work with regional agencies to develop specific water security implementation plans based on its vulnerability assessment and any unique circumstances. broader context for improving water security. ~ . , The Action Plan needs to consider this The Action Plan is silent on the financial resources required to complete the proposed research and technical support projects and to implement the countermeasures needed to ............................................................................................................................. ............................................................................... I ~ A- a-- ~~~-- ~~ A. :~ :~ :-: ~ :::::::::::::::::::::::::::::::::::::::::: - -::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: ................................................................................................................................................................................................................................................... . . ..... ..... ! ' -.- r .. -.-.- i -.- : Assessments and | Lessons Learned l New Science and Research Databases Tools and Methods Communication Strategies Action Plan it' it' }I - - Integrated Water Security Prevention and Response Guidance (Includes EPA Communications Plan and Supporting splay Books") Water Security Implementation Plans for Utilities and Regional Agencies Figure ES-1. Example framework for depicting the contributions of the Water Security Research and Technical Support Action Plan to the broader needs for protecting the nation's water systems (including drinking water and wastewater).

OCR for page 1
Executive Summary improve water security. The EPA should attempt to quantify the benefits and costs accruing to the proposed research and technical support projects, and further study should be directed to better acknowledging business-enabling dual-use benefits of security enhancements. More emphasis is needed on communicating the value of water and increased water system security with the public, rate regulators, and local elected and appointed officials, because increaser! rate structures may be needed to create the necessary financial resources to implement such countermeasures. The rapidity and high stakes of potential terrorist attacks on water supplies suggest that the EPA should pay particular attention to improving interagency coordination and to determining the roles, capabilities, and training of other agencies with regard to water ~~ ~-~ '1~1~ 1 ~ L _1 ~ 1 11 ~1 ~ ~1 1 security. 1 ne special circumstances of a purposeful attack Will require that the roles and responsibilities of various relevant parties (including law enforcement, FBI, and environmental and public health authorities) be worked out in detail ahead of time. The use of field and table-top exercises is necessary to help utilities and federal, state and local agencies develop improved coordination and response and recovery strategies. Developing an effective communication strategy that meets the needs of the broad range of stakeholders. including response or~ani7.ations water or~nni7:ntinnc ~nr1 ~'tilitiec . . . . .. . . .. .. . .. . . . . public health agencies, and the media, while addressing security concerns, should be among the highest priorities for the EPA. Criteria for classifying and distributing sensitive information should be developed that recognize the need for local and state agencies and other critical players to have access to water security information. Consideration needs to be made as to how the water security information databases will be accessed, who will be granted access, who will control and update the databases, and how the databases will be integrated with current systems. The EPA should thoroughly examine the consequences of various levels of information security and fund formal studies on the risks and benefits of widely transmitting water security data (including involvement of a wider research communitY1. The dangers of keeping information too closely guarded may, in fact, be much greater than the dangers of informing an ill- intentioned person. The panel recognizes the need to act quickly to address issues of water security. The EPA strategy in the Action Plan to emphasize immediate usability and first approximations is a sound one, but certain research or technological advances may only be accomplished through long-term research investments. The Action Plan should clarify which of its research activities are short-term, applied efforts and highlight long-term research needs, so that a collaboration of agencies could work to ensure that substantive, mission-oriented research questions in water security are not overlooked. REVIEW OF RESEARCH AND TECHNICAL SUPPORT NEEDS IDENTIFIED IN THE ACTION PLAN The drinking water research needs within the Action Plan are lengthy, detailed, and if met would go a long way toward providing information, tools, and methods necessary to help water managers respond appropriately to threats or attacks on water supply systems. Considerably less information is presented in the Action Plan regarding threats to the nation's wastewater infrastructure, which made it difficult to assess the adequacy of the proposed research needs.

OCR for page 1
6 A Review of the EPA Water Security Action Plan The following summarizes the revisions and changes in emphasis suggested to the research and technical support needs identified in the Action Plan. These rewritten needs are discussed in detail in Chapter 3. Protecting Physical and Cyber Infrastructure The EPA Action Plan identifies three important needs that, with some changes in emphasis, would address most of the major research and technical support challenges related to protecting physical and cyber infrastructure. One significant gap is the need for assessments of costs and benefits associated with various countermeasures. These suggestions are included in the following rewritten needs: . . . . An updated identification and prioritization of physical threats to and vulnerabilities of drinking water infrastructure, taking into account the substantial information gained from the vulnerability assessments of the nation s larger water systems and on other vulnerability and consequence assessments of water systems and their cyber infrastructure, along with improved means to assess these vuinerabilities. A thorough understanding and documentation of the consequences of physical or cyber attacks on the drinking water supply sources and infrastructure, including the evaluation and testing of computational models and decision science. A suite of countermeasures to prevent, or mitigate, the effects of physical and cyber attacks on water infrastructure, including improved design of Supervisory Control and Data Acquisition (SCADA) and water systems to reduce vuInerabilities. Assessments of costs and benefits (direct and indirect) associated with various countermeasures; and development of programs to assist implementing organizations (including water utilities) in communicating with the public, customers, rate regulators, and local elected and appointed officials regarding the value of water, increased water system security, and increased rate structures to create the necessary financial resources to implement such countermeasures. Contaminant Identification Several suggestions and modifications in emphasis are suggested to improve the four research and technical support needs delineated in the Action Plan for the issue of contaminant identification. The EPA should carefully consider the scope of the tasks identified here, so that the data gathering efforts (e.g., the contaminant database and the surrogate/simulant database) focus on the highest priority and most useful information in order to conserve time and resources. Determining contaminant threat scenarios was considered a significant need that should be separated from the development of a list of water security contaminants. The following rewritten needs are suggested: A list of contaminants that might be used to destroy, disrupt, or disable drinking water supplies and systems. This list would be linked to relevant associated contaminant information (stored in the database mentioned below), which could be used to prioritize or group the individual contaminants, as users of the list deem appropriate.

OCR for page 1
Executive Summary . . 7 An assessment of threat scenarios which could result in harmful exposure of the public or utility personnel to drinking water contaminants. A contaminant database for consultation by approved individuals and organizations that describes critically important information on contaminants with the potential to harm drinking water supplies and systems. Identification of a few well-selected surrogates or simulants for use in testing and evaluating fate and transport characteristics and treatment technologies for priority contaminants. Methods en c! means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to drinking water supplies and systems. Contaminant Monitoring and Analysis The Action Plan includes a broad set of seven needs on the issue of contaminant monitoring and analysis; yet, depending on interpretation, there may be some gaps. Improved guidelines for sampling, careful quality assurance and quality control procedures, and geographic and liability concerns limiting effective laboratory response are some of the issues that were not adequately addressed in the Action Plan. These and other suggestions are incorporated in the following rewritten needs: A "play book" for sampling and analytical response to contaminant threats and attacks on water supplies and systems, including protocols for identifying "unknown" contaminants that will serve as a vital component of an overall integrated response guidance. Improved analytical hardware and associated field and laboratory analysis methodologies (including generic simple techniques and laboratory-based, off- line and real-time monitoring technologies) for biological, chemical, and radiological contaminants in water. Requirements for appropriate quality assurance and quality control (QA/QC) and sampling approaches in response to suspected biological, chemical, and radiological contamination events. Testing and evaluation of drinking water "Early Warning Systems" (EWSs) and EWSs from other sectors amenable to application in the water environment. An improved and expanded, tiered capability laboratory capacity to be fully prepared for effectively responding to threats or attacks on water. Training modules and evaluation exercises for analytical methodologies and monitoring systems. Containment, Treatment, Decontamination, and Disposal Four broad research and technical support needs were described in the Action Plan to address the issue of containment, treatment, decontamination, and disposal of contaminants in a water system. A few issues were overlooked in the identified needs of the Action Plan, such as the importance of training and input data for successful

OCR for page 1
8 A Review of the EPA Water Security Action Plan application of distribution system models to respond to water security threats and the value of current and traditional treatment technologies to address water security needs. The scope of the need to understand contaminant fate was considered excessively broad, and recommendations were made to narrow the scope so that contributions could be made within the time frame of the Action Plan. Several suggestions and changes in emr~h~ci~ are noter1 in (chanter ~ which are summarized in the following rewritten needs ~ -^r ~~ Or--- _ ~ Improved distribution system models that can be used to more effectively protect drinking water in the event of deliberate contamination, which should consider not only technical improvements to such models, but also operator training to better use the models, the availability of information needed to run the models, and the dual-use benefits of model development. Improved understanding anti documentation of the environmental fate of contaminants in source waters, within drinking water systems, and once they are released, focusing first on a literature review and then on either the identification of generic physical and chemical parameters that are predictive of contaminant behavior in water supply systems or on a small set of fate and transport paradigms for common threat scenarios. Technologies and treatment processes to achieve multiple goals, and effective disposal and/or treatment technologies for water and equipment that have been contaminated, including in-place conventional technologies, new preventive technologies, mobile technologies, and technologies that can mitigate contaminant spread through the distribution system. A methodology, approach, or guide for use in determining when a drinking water system is no longer contaminated and when it can be placed back into limited or unlimited service. (This need is one component, or "play book," within the overall response guidance.) Contingency Planning and Infrastructure Interdependencies The Action Plan outlines three research and technical support needs that with minor changes would substantially address the topic of contingency planning and infrastructure interdependencies. One overlooked technical support need is the consideration of contingencies for situations where the operating personnel for a water system might be incapacitated. The following four revised needs are suggested: . . . Assessment of water supply alternatives for different types of drinking water systems in the Uniteci States (reflective of effects of size, type of supply, system design and type of distribution system), when the usual supply of water is not available. Testing and evaluation of improved technologies and anoroaches for providing ~ 1 ~ 1 1 1 C7 ., ~ . . .. . ~ . .. . . . . . . .. .. . supplies ot water in the event ot both long-term and short-term disruptions to drinking water systems. The evaluation of approaches should include customer preparedness and should assess the degree of reliability of the options. An improved understanding of water system interdepenciencies and the reliability of such interdependencies with other infrastructure sectors that are critical to national security.

OCR for page 1
Executive Summary 9 Explicit understanding of the role of failure of the "human subsystem" in water system operation, and the development of contingencies for responding to such eventualities. Targeting Impacts on Human Health and Informing the Public about Risks Five research anci technical support needs are presented in the Action Plan to address the issues of human health impacts and risk communication. While these needs are quite comprehensive, several gaps are noted, such as the need for establishing a risk communication planning process. Overall, the assessment of current disease surveillance efforts and the discussion of frameworks for assessing and managing risks are significant weaknesses in this section. Suggestions are also presented to narrow the scope of work for some needs to the intended time frame. These suggestions are incorporated in the following rewritten needs: An improved understanding of contaminant exposure routes (not only direct ingestion but also dermal and inhalation exposures), and of the acute and chronic public health effects from contaminants in drinking water supplies and systems, which should focus on generic models for different large classes of agents. . . . . A health surveillance network to rapidly identify and help control a disease outbreak or other public health emergency associated with contaminated drinking water. This effort should be cognizant of active disease surveillance efforts already underway, the limitations of active disease surveillance, anti the respective roles of the EPA and other public health agencies. An evaluation of the utility and validity of using non-traditional data sources (e.g., LD50, Quantitative Structure Activity Relationship [QSAR]) for the derivation of acute and chronic toxicity values applied to water. A risk assessment/risk management framework for identifying the impact of decontamination/treatment options en cl the subsequent response. (This need is one component of the overall response guidance.) Methods anti means to communicate threat risks to local communities and to respond to customers and the media in the case of an attack on drinking water systems, the success of which will depend upon the prior existence of an established relationship with communities that is the result of a detailed risk communication planning process. Wastewater The Action Plan presents a short overview of the extensive array of security issues facing the wastewater infrastructure. Although the human health consequences may be somewhat more indirect for threats on wastewater than in the case of drinking water systems, more thought should be given to the security of the nation's wastewater systems, and the interdependencies between drinking water and wastewater systems should be more carefully considered. Based on the panel's review of the information presented in the Action Plan, the following rewording of the needs is suggested:

OCR for page 1
10 A Review of the EPA Water Security Action Plan . . A thorough understanding and documentation of the possible threats to the nation's wastewater treatment and collection system infrastructure, including the interdependencies with drinking water systems and other critical infrastructure. An updated assessment of the possible health, safety and environmental risks related to potentially hazardous substances used by wastewater utilities or intentionally introduced into wastewater collection and treatment systems, or stormwater conveyance and treatment systems, including any impact on residuals management operations (sewage sludge). An assessment of the possible health, safety, and environmental risks related to potentially hazardous substances produced during response to security threats (e.g., decontamination materials and their byproducts) which may be discharged to sewer systems or stormwater conveyance systems. Improved intrusion monitoring and surveillance technologies to quickly notify wastewater utilities when these facilities or technologies are compromised by physical and cyber threats or chemical, biological, and radiological contaminants. (Note that some of this information may be transferred from knowledge gained while assessing drinking water systems.) . Improved designs for wastewater systems to reduce vulnerability to physical threats and as a way to prevent or mitigate the effects of attacks on wastewater infrastructure. Enhanced prevention and response planning methods, including emergency response, contingency planning, and risk communication protocols and guidance for wastewater systems of varying types (size, geographic location, design). The potential for emergency relocation of discharge or alternative treatment should also be assessed. Methods and means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to wastewater systems.