Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 1
Part I
Overarching Issues and Research and Technical Support
Needs Assessment
OCR for page 2
2
A Review of the EPA Water Security Action Plan
be woven together into a comprehensive guidance document (the Integrates} Water Security
Prevention and Response Guidance) that wouIct direct a utility through available prevention
strategies, information resources, communication planning, and response and recovery actions
(including detection and monitoring, risk assessment, and decontamination). With the support of
this guidance, each water organization can work with regional agencies to develop specific water
security implementation plans based on its vulnerability assessment and any unique
circumstances. The Action Plan needs to consider this broacler context for improving water
security.
The Action Plan is silent on the financial resources requires! to complete the proposed
research and technical support projects and to implement the countermeasures needed to improve
water security. The EPA should attempt to quantify the benefits and costs accruing to the
proposed research and technical support projects, and further study should be directed to better
acknowledging business-enabling dual-use benefits of security enhancements. More emphasis is
needed on communicating the value of water and increased water system security with the
public, rate regulators, and local elected and appointed officials, because increased rate structures
may be needed to create the necessary financial resources to implement such countermeasures.
.....
Assessments and
Lessons Learned
New Science
and Research
Databases
Tools and Methods
_
:$.......
Communication
Strategies
Action Plan
Integrated
Water Security
Prevention and
Response
Guidance
(Includes EPA
Communications
Plan and
Supporting
"Play Books")
Water Security
Implementation
Plans
for Utilities
and Regional
Agencies
Figure ES-. Example framework for depicting the contributions of the Water Security
Research and Technical Support Action Plan to the broader needs for protecting the nation's
water systems (including drinking water and wastewater).
OCR for page 3
Executive Summary
The consequences of a terrorist attack on the nation's water supply to public health,
national security, and the nation's economic services could be significant, and the sad
events of September 11, 2001 have heightened concerns regarding the vulnerabilities of
public water systems to deliberate attack. The Environmental Protection Agency (EPA)
currently bears lead responsibilities for protecting water systems from terrorist threats,
and they are currently working in partnership with federal, state, and local government
agencies, water and wastewater utilities, and professional associations to ensure safe
water supplies. To support their water security responsibilities, the EPA recently
developed the Water Security Research and Technica;l Support Action Plan (Action
Plan), which identifies critical security issues for drinking water and wastewater, outlines
research and technical support needs within these issues, and presents a prioritized list of
research and technical support projects to address these needs.
The National Research Council (NRC) was tasked to review the EPA Water Security
Research and Technical Support Action Plan and provide an initial assessment according
to the following questions:
.
.
Has the Action Plan completely and accurately identified important issues and
needs in the water security arena? If not, what issues and needs should be added
or removed?
Overall, what changes to the Action Plan are recommended to improve its
presentation in terms of content and structure so as to more clearly convey the
water security research and technical support program that is described?
This report was written by the Panel on Water System Security Research, organized under
the NRC's Water Science and Technology Board. A subsequent report of the panel (see
Part II) reviews the individual projects identified in the Action Plan and evaluates their
prioritization and timing.
OCR for page 4
4
A Review of the EPA Water Security Action Plan
OVERARCHING ISSUES
The Action Plan contains an extensive list of drinking water and wastewater research
and technical support needs and associated projects that cover many of the critical water
security issues. However, the projects will not, in themselves, result in improved
protection of the nation's drinking water and wastewater systems. Improved protection
will only result when the information and knowledge obtained from the projects are
integrated into funded water security plans that are implemented by collaborations of
private and public organizations.
Figure ES-1 provides a suggested framework for how the individual research and
technical support projects within the Action Plan should contribute to improved water
security. More specifically, the Action Plan encompasses data collection and
assessments, database creation, new science and research, tools and methods
development, and improved communications. Information from these activities, along
with play books mentioned in the Action Plan, should be woven together into a
comprehensive guidance document (the Integrated Water Security Prevention and
Response Guidance) that would direct a utility through available prevention strategies,
information resources, communication planning, and response and recovery actions
(including detection and monitoring, risk assessment, and decontamination). With the
support of this guidance, each water organization can work with regional agencies to
develop specific water security implementation plans based on its vulnerability
assessment and any unique circumstances.
broader context for improving water security.
~ . ,
The Action Plan needs to consider this
The Action Plan is silent on the financial resources required to complete the proposed
research and technical support projects and to implement the countermeasures needed to
.............................................................................................................................
...............................................................................
I ~
A- a-- ~~~—-- ~~— A. :~ :~ :-: ~
:::::::::::::::::::::::::::::::::::::::::: - -::::::: ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
...................................................................................................................................................................................................................................................
. . ..... ..... !
' -.- r .. -.-.- i -.- :
Assessments and
| Lessons Learned l
New Science
and Research
Databases
Tools and Methods
Communication
Strategies
Action Plan
it'
it'
}I
-
-
Integrated
Water Security
Prevention and
Response
Guidance
(Includes EPA
Communications
Plan and
Supporting
splay Books")
Water Security
Implementation
Plans
for Utilities
and Regional
Agencies
Figure ES-1. Example framework for depicting the contributions of the Water Security
Research and Technical Support Action Plan to the broader needs for protecting the
nation's water systems (including drinking water and wastewater).
OCR for page 5
Executive Summary
improve water security. The EPA should attempt to quantify the benefits and costs
accruing to the proposed research and technical support projects, and further study should
be directed to better acknowledging business-enabling dual-use benefits of security
enhancements. More emphasis is needed on communicating the value of water and
increased water system security with the public, rate regulators, and local elected and
appointed officials, because increaser! rate structures may be needed to create the
necessary financial resources to implement such countermeasures.
The rapidity and high stakes of potential terrorist attacks on water supplies suggest
that the EPA should pay particular attention to improving interagency coordination and to
determining the roles, capabilities, and training of other agencies with regard to water
~~ ~-~ '1~1~ 1 ~ L _1 ~ 1 ·11 · ~1 ~ ~1 1
security. 1 ne special circumstances of a purposeful attack Will require that the roles and
responsibilities of various relevant parties (including law enforcement, FBI, and
environmental and public health authorities) be worked out in detail ahead of time. The
use of field and table-top exercises is necessary to help utilities and federal, state and
local agencies develop improved coordination and response and recovery strategies.
Developing an effective communication strategy that meets the needs of the broad
range of stakeholders. including response or~ani7.ations water or~nni7:ntinnc ~nr1 ~'tilitiec
. . . . .. . . .. .. . .. . . . .
public health agencies, and the media, while addressing security concerns, should be
among the highest priorities for the EPA. Criteria for classifying and distributing
sensitive information should be developed that recognize the need for local and state
agencies and other critical players to have access to water security information.
Consideration needs to be made as to how the water security information databases will
be accessed, who will be granted access, who will control and update the databases, and
how the databases will be integrated with current systems. The EPA should thoroughly
examine the consequences of various levels of information security and fund formal
studies on the risks and benefits of widely transmitting water security data (including
involvement of a wider research communitY1. The dangers of keeping information too
closely guarded may, in fact, be much greater than the dangers of informing an ill-
intentioned person.
The panel recognizes the need to act quickly to address issues of water security. The
EPA strategy in the Action Plan to emphasize immediate usability and first
approximations is a sound one, but certain research or technological advances may only
be accomplished through long-term research investments. The Action Plan should clarify
which of its research activities are short-term, applied efforts and highlight long-term
research needs, so that a collaboration of agencies could work to ensure that substantive,
mission-oriented research questions in water security are not overlooked.
REVIEW OF RESEARCH AND TECHNICAL SUPPORT NEEDS IDENTIFIED
IN THE ACTION PLAN
The drinking water research needs within the Action Plan are lengthy, detailed, and if
met would go a long way toward providing information, tools, and methods necessary to
help water managers respond appropriately to threats or attacks on water supply systems.
Considerably less information is presented in the Action Plan regarding threats to the
nation's wastewater infrastructure, which made it difficult to assess the adequacy of the
proposed research needs.
OCR for page 6
6
A Review of the EPA Water Security Action Plan
The following summarizes the revisions and changes in emphasis suggested to the
research and technical support needs identified in the Action Plan. These rewritten needs
are discussed in detail in Chapter 3.
Protecting Physical and Cyber Infrastructure
The EPA Action Plan identifies three important needs that, with some changes in
emphasis, would address most of the major research and technical support challenges
related to protecting physical and cyber infrastructure. One significant gap is the need for
assessments of costs and benefits associated with various countermeasures. These
suggestions are included in the following rewritten needs:
.
.
.
.
An updated identification and prioritization of physical threats to and
vulnerabilities of drinking water infrastructure, taking into account the substantial
information gained from the vulnerability assessments of the nation s larger water
systems and on other vulnerability and consequence assessments of water
systems and their cyber infrastructure, along with improved means to assess these
vuinerabilities.
A thorough understanding and documentation of the consequences of physical or
cyber attacks on the drinking water supply sources and infrastructure, including
the evaluation and testing of computational models and decision science.
A suite of countermeasures to prevent, or mitigate, the effects of physical and
cyber attacks on water infrastructure, including improved design of Supervisory
Control and Data Acquisition (SCADA) and water systems to reduce
vuInerabilities.
Assessments of costs and benefits (direct and indirect) associated with various
countermeasures; and development of programs to assist implementing
organizations (including water utilities) in communicating with the public,
customers, rate regulators, and local elected and appointed officials regarding the
value of water, increased water system security, and increased rate structures to
create the necessary financial resources to implement such countermeasures.
Contaminant Identification
Several suggestions and modifications in emphasis are suggested to improve the four
research and technical support needs delineated in the Action Plan for the issue of
contaminant identification. The EPA should carefully consider the scope of the tasks
identified here, so that the data gathering efforts (e.g., the contaminant database and the
surrogate/simulant database) focus on the highest priority and most useful information in
order to conserve time and resources. Determining contaminant threat scenarios was
considered a significant need that should be separated from the development of a list of
water security contaminants. The following rewritten needs are suggested:
· A list of contaminants that might be used to destroy, disrupt, or disable drinking
water supplies and systems. This list would be linked to relevant associated
contaminant information (stored in the database mentioned below), which could
be used to prioritize or group the individual contaminants, as users of the list
deem appropriate.
OCR for page 7
Executive Summary
.
.
7
An assessment of threat scenarios which could result in harmful exposure of the
public or utility personnel to drinking water contaminants.
A contaminant database for consultation by approved individuals and
organizations that describes critically important information on contaminants
with the potential to harm drinking water supplies and systems.
Identification of a few well-selected surrogates or simulants for use in testing and
evaluating fate and transport characteristics and treatment technologies for
priority contaminants.
Methods en c! means to securely maintain and, when appropriate, transmit
information on contaminants and threat scenarios applicable to drinking water
supplies and systems.
Contaminant Monitoring and Analysis
The Action Plan includes a broad set of seven needs on the issue of contaminant
monitoring and analysis; yet, depending on interpretation, there may be some gaps.
Improved guidelines for sampling, careful quality assurance and quality control
procedures, and geographic and liability concerns limiting effective laboratory response
are some of the issues that were not adequately addressed in the Action Plan. These and
other suggestions are incorporated in the following rewritten needs:
A "play book" for sampling and analytical response to contaminant threats and
attacks on water supplies and systems, including protocols for identifying
"unknown" contaminants that will serve as a vital component of an overall
integrated response guidance.
Improved analytical hardware and associated field and laboratory analysis
methodologies (including generic simple techniques and laboratory-based, off-
line and real-time monitoring technologies) for biological, chemical, and
radiological contaminants in water.
Requirements for appropriate quality assurance and quality control (QA/QC) and
sampling approaches in response to suspected biological, chemical, and
radiological contamination events.
Testing and evaluation of drinking water "Early Warning Systems" (EWSs) and
EWSs from other sectors amenable to application in the water environment.
An improved and expanded, tiered capability laboratory capacity to be fully
prepared for effectively responding to threats or attacks on water.
Training modules and evaluation exercises for analytical methodologies and
monitoring systems.
Containment, Treatment, Decontamination, and Disposal
Four broad research and technical support needs were described in the Action Plan to
address the issue of containment, treatment, decontamination, and disposal of
contaminants in a water system. A few issues were overlooked in the identified needs of
the Action Plan, such as the importance of training and input data for successful
OCR for page 8
8
A Review of the EPA Water Security Action Plan
application of distribution system models to respond to water security threats and the
value of current and traditional treatment technologies to address water security needs.
The scope of the need to understand contaminant fate was considered excessively broad,
and recommendations were made to narrow the scope so that contributions could be
made within the time frame of the Action Plan. Several suggestions and changes in
emr~h~ci~ are noter1 in (chanter ~ which are summarized in the following rewritten needs
~ -^r ~~ Or--- _ ~
Improved distribution system models that can be used to more effectively protect
drinking water in the event of deliberate contamination, which should consider
not only technical improvements to such models, but also operator training to
better use the models, the availability of information needed to run the models,
and the dual-use benefits of model development.
· Improved understanding anti documentation of the environmental fate of
contaminants in source waters, within drinking water systems, and once they are
released, focusing first on a literature review and then on either the identification
of generic physical and chemical parameters that are predictive of contaminant
behavior in water supply systems or on a small set of fate and transport
paradigms for common threat scenarios.
· Technologies and treatment processes to achieve multiple goals, and effective
disposal and/or treatment technologies for water and equipment that have been
contaminated, including in-place conventional technologies, new preventive
technologies, mobile technologies, and technologies that can mitigate
contaminant spread through the distribution system.
· A methodology, approach, or guide for use in determining when a drinking water
system is no longer contaminated and when it can be placed back into limited or
unlimited service. (This need is one component, or "play book," within the
overall response guidance.)
Contingency Planning and Infrastructure Interdependencies
The Action Plan outlines three research and technical support needs that with minor
changes would substantially address the topic of contingency planning and infrastructure
interdependencies. One overlooked technical support need is the consideration of
contingencies for situations where the operating personnel for a water system might be
incapacitated. The following four revised needs are suggested:
.
.
.
Assessment of water supply alternatives for different types of drinking water
systems in the Uniteci States (reflective of effects of size, type of supply, system
design and type of distribution system), when the usual supply of water is not
available.
Testing and evaluation of improved technologies and anoroaches for providing
~ 1 ~ 1 1 1 C7
., ~ . . .. . ~ . .. . . . . . . .. .. .
supplies ot water in the event ot both long-term and short-term disruptions to
drinking water systems. The evaluation of approaches should include customer
preparedness and should assess the degree of reliability of the options.
An improved understanding of water system interdepenciencies and the reliability
of such interdependencies with other infrastructure sectors that are critical to
national security.
OCR for page 9
Executive Summary
9
· Explicit understanding of the role of failure of the "human subsystem" in water
system operation, and the development of contingencies for responding to such
eventualities.
Targeting Impacts on Human Health and Informing the Public about Risks
Five research anci technical support needs are presented in the Action Plan to address
the issues of human health impacts and risk communication. While these needs are quite
comprehensive, several gaps are noted, such as the need for establishing a risk
communication planning process. Overall, the assessment of current disease surveillance
efforts and the discussion of frameworks for assessing and managing risks are significant
weaknesses in this section. Suggestions are also presented to narrow the scope of work
for some needs to the intended time frame. These suggestions are incorporated in the
following rewritten needs:
An improved understanding of contaminant exposure routes (not only direct
ingestion but also dermal and inhalation exposures), and of the acute and chronic
public health effects from contaminants in drinking water supplies and systems,
which should focus on generic models for different large classes of agents.
.
.
.
.
A health surveillance network to rapidly identify and help control a disease
outbreak or other public health emergency associated with contaminated drinking
water. This effort should be cognizant of active disease surveillance efforts
already underway, the limitations of active disease surveillance, anti the
respective roles of the EPA and other public health agencies.
An evaluation of the utility and validity of using non-traditional data sources
(e.g., LD50, Quantitative Structure Activity Relationship [QSAR]) for the
derivation of acute and chronic toxicity values applied to water.
A risk assessment/risk management framework for identifying the impact of
decontamination/treatment options en cl the subsequent response. (This need is
one component of the overall response guidance.)
Methods anti means to communicate threat risks to local communities and to
respond to customers and the media in the case of an attack on drinking water
systems, the success of which will depend upon the prior existence of an
established relationship with communities that is the result of a detailed risk
communication planning process.
Wastewater
The Action Plan presents a short overview of the extensive array of security issues
facing the wastewater infrastructure. Although the human health consequences may be
somewhat more indirect for threats on wastewater than in the case of drinking water
systems, more thought should be given to the security of the nation's wastewater systems,
and the interdependencies between drinking water and wastewater systems should be
more carefully considered. Based on the panel's review of the information presented in
the Action Plan, the following rewording of the needs is suggested:
OCR for page 10
10
A Review of the EPA Water Security Action Plan
.
.
A thorough understanding and documentation of the possible threats to the
nation's wastewater treatment and collection system infrastructure, including the
interdependencies with drinking water systems and other critical infrastructure.
An updated assessment of the possible health, safety and environmental risks
related to potentially hazardous substances used by wastewater utilities or
intentionally introduced into wastewater collection and treatment systems, or
stormwater conveyance and treatment systems, including any impact on residuals
management operations (sewage sludge).
An assessment of the possible health, safety, and environmental risks related to
potentially hazardous substances produced during response to security threats
(e.g., decontamination materials and their byproducts) which may be discharged
to sewer systems or stormwater conveyance systems.
· Improved intrusion monitoring and surveillance technologies to quickly notify
wastewater utilities when these facilities or technologies are compromised by
physical and cyber threats or chemical, biological, and radiological contaminants.
(Note that some of this information may be transferred from knowledge gained
while assessing drinking water systems.)
.
· Improved designs for wastewater systems to reduce vulnerability to physical
threats and as a way to prevent or mitigate the effects of attacks on wastewater
infrastructure.
Enhanced prevention and response planning methods, including emergency
response, contingency planning, and risk communication protocols and guidance
for wastewater systems of varying types (size, geographic location, design). The
potential for emergency relocation of discharge or alternative treatment should
also be assessed.
Methods and means to securely maintain and, when appropriate, transmit
information on contaminants and threat scenarios applicable to wastewater
systems.
Representative terms from entire chapter:
water security
