National Academies Press: OpenBook

A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II (2004)

Chapter: 3 Review of Identified Water Security Research Needs

« Previous: 2 Overview Issues in the Review of the Water Security Research and Technical Support Action Plan
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 25
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 26
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 27
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 28
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 29
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 30
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 31
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 32
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 33
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 34
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 35
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 36
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 37
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 38
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 39
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 40
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 41
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 42
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 43
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 44
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 45
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 46
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 47
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 48
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 49
Suggested Citation:"3 Review of Identified Water Security Research Needs." National Research Council. 2004. A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II. Washington, DC: The National Academies Press. doi: 10.17226/10772.
×
Page 50

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Chapter 3 Review of Identified Water Security Research Needs In keeping with the format used within the EPA Action Plan, this chapter discusses research issues and needs separately for drinking water and wastewater. The drinking water research needs within the Action Plan are lengthy, detailed, and if met would go a long way toward providing the overall response guidance mentioned in Chapter 2 as necessary to help water managers respond appropriately to threats or attacks on water supply systems. Considerably less information is presented in the Action Plan regarding threats to the nation's wastewater infrastructure, making it difficult to assess the adequacy of the proposed research. The significantly greater text and research focused on drinking water within the Action Plan is likely a reflection of the report's authors' expertise as well as the perception of drinking water supply systems as more vulnerable targets of a potential terrorist attack with more direct human health consequences in comparison to wastewater treatment plants. DRINKING WATER The research ant} technical support needs for preventing, preparing for, and responding to physical, cyber, and contaminant attacks on drinking water supply systems are categorized in the Action Plan under six major headings: (1) protecting physical and cyber infrastructure, (2) identifying drinking water contaminants, (3) improving analytical methodologies and monitoring systems for drinking water, (4) containing, treating, decontaminating, and disposing of contaminated water and materials, (5) planning for contingencies and addressing infrastructure interdependencies, and (6) targeting impacts on human health and informing the public about risks. A detailed evaluation for the individual research needs identified in the Action Plan is presented below, which identifies notable gaps and redundancies and suggests changes in emphasis. The application of the needs to small versus large utilities is also discussed. 25

26 A Review of the EPA Water Security~4ction Plan Protecting Physical and Cyber Infrastructure (Action Plan Section 3.1) Drinking water utilities (supply works, treatment plants and distribution systems) consist of physical assets, human assets, and cyber assets. The physical assets include piping, valving, reservoirs, pumps, and treatment works; human assets include operators and management personnel; cyber assets include software and hardware devoted to process control, operation of remote facilities, and accounting. The security of water utilities depends upon mitigating threats to these assets. The EPA Action Plan delineates this work into three categories of research and technical support needs: a) An updated identification and prioritization of physical threats to drinking water infrastructure, including an improved understanding of the vulnerability of water systems to cyber threats and improved means to assess these vuinerabilities. b) A thorough understanding and documentation of the consequences of physical or cyber attacks on the drinking water infrastructure, including the evaluation and testing of computational models and decision science. c) A suite of countermeasures to prevent or mitigate the effects of physical and cyber attacks on water infrastructure, including improved design of water systems to reduce vulnerabilities in the long term. Commentary on Identified :Needs 3.1.a Identification and Prioritization of Physical Threats. Identifying and prioritizing physical and cyber threats to water infrastructure represents an important first step before countermeasures can be developed. There is a substantial base of experience on physical threat identification that has been gained from the vulnerability assessments completed by larger utilities and those in progress by smaller utilities. Under American Water Works Association Research Foundation (AwwaRF) project 2909, there is to be a focus on review, prioritization, and lessons learned from these activities. Furthermore, there has been considerable effort spent at other facilities, such as in the chemical and power industries, on protection from physical and cyber threats. Need 3. pa should strive to incorporate knowledge gained from these efforts rather than on re-inventing such knowledge. Another type of threat that may be worth considering is the dissemination of malicious disinformation (e.g., on the safety or reliability of a given system) via external web sites and other electronic means. Such actions have the potential for producing long- lasting impacts on the reputation of water suppliers, with potential consequences of having concerned users ultimately switching to less adequate alternate supplies. In the assessment of resources to protect, source water catchment structures and areas (reservoirs, watersheds, artificial impoundments) and raw water conveyance structures (aqueducts, underground flow paths) should be given consideration. Other points where vulnerability may occur could include remote monitoring stations, points of chemical addition (e.g., dechlorination or fluoridation), and remote wellheads, especially those with associated disinfection facilities. 3.1.b Understanding and Documentation of the Consequences of Physical or Cyber Attacks. The vulnerability assessment efforts noted in the previous section have also resulted in the preparation of consequence analyses as part of the mandated filing.

Review of Research Needs 27 To the degree possible, the EPA should take advantage of the efforts of AwwaRF project 2909 and similar reviews to help it in its understanding of consequences of physical or cyber attacks. In addition, the EPA should take advantage of prior threat, vulnerability, and consequence assessments in understanding potential impacts on water systems from cyber and physical threats. For example, lessons can be learned from the efforts taken for assessing cyber vulnerability in preparation for the year 2000 (Y2K) and from homeland security analyses of Supervisory Control and Data Acquisition (SCADA) system vuInerabilities and consequences for water and other utilities. 3.1.c Countermeasures to Prevent or Mitigate the Effects of Physical and Cyber Attacks. Research to reduce vuInerabilities in water systems to physical and cyber attacks is a third important need. In preventing or mitigating the effects of attacks to cyber systems, a key component is understanding the vulnerability of and consequences from malfunctioning or sabotaged SCADA systems. This understanding could be facilitated by interaction with control and software vendors and with users in other industries. The importance of this might be underscored by rewording item 3. l.c to read "...including improved design of SCADA and water systems ...." Specific attention should be placed on addressing internal threats (e.g., the disgruntled employee) and making use of existing SCADA system attack countermeasures that have been developed for other analogous institutions. Additional Research and Technical Support Needs In the development and assessment of countermeasures, it is important to identify both the costs and the benefits, from more obvious examples such as the benefit of risk reduction to ancillary or spin-off benefits. For example, the installation of secure Internet sites for a utility (implemented perhaps for secure process monitoring purposes) might also serve as a platform for implementation of either business-to-business or consumer e- commerce, and thereby permit an additional revenue stream (or reduction in costs of activities previously conducted non-electronically) to be realized. The suite of countermeasures that might be developed should be described by a tiered arrangement to permit selection as appropriate in a given locale (small versus large utilities, different geographic environments, etch. The identification of a suite of countermeasures is useful only to the degree that necessary measures can be implemented and can be paid for. A major priority should be in communicating the need for security measures with the consumer and in promoting willingness to pay for implementation of necessary countermeasures. Hence, the following additional need is suggested: Assessments of costs and benefits (direct and indirect) associated with various countermeasures; and development of programs to assist implementing organizations (including water utilities) in communicating with the public, customers, rate regulators, and local elected and appointed officials regarding the value of water, increased water system security, and increased rate structures to create the necessary financial resources to implement such countermeasures. Application to Large versus Small Systems An important difference for the Action Plan to consider is that small water systems (those serving less that 3,300 people) will not be required to conduct vulnerability assessments. This means that the EPA will have less information about the types of threats to which small systems may be subjected. This should be considered in

28 A Review of the EPA Water Security Action Plan addressing the first need and in devising appropriate and cost-effective countermeasures to reduce the vulnerabilities of small systems. Second, when recommendations are made regarcling consequences or countermeasures for protecting SCADA systems, the EPA shouts! consider the differences between the largest ant} more sophisticated systems and the vast majority of the systems which are quite small anct may have limited or no SCADA systems and limited resources with which to secure the systems they do have. The Action Plan should focus on coming up with relatively simple-to-implement best practices (such as separating SCADA networks from data networks and installing firewalls) that can work across the broad range of water system types, rather than on the highly technical detail that would be needed for the more extensive and complicated systems. Recommendations In conclusion, the pane! recommends the following rewritten needles: · An updated icientification and prioritization of physical threats to and vuinerabilities of drinking water infrastructure, taking into account the substantial information gained from the vulnerability assessments of the nation s larger water systems and on other vulnerability and consequence assessments of water systems and their cyber infrastructure, along with improved means to assess these vuInerabilities. . . . A thorough understanding and documentation of the consequences of physical or cyber attacks on the drinking water supply sources and infrastructure, including the evaluation and testing of computational models and decision science. A suite of countermeasures to prevent, or mitigate, the effects of physical ant! cyber attacks on water infrastructure, including improved design of SCADA and water systems to reduce vuinerabilities. Assessments of costs and benefits (direct and indirect) associated with various countermeasures; and development of programs to assist implementing organizations (including water utilities) in communicating with the public, customers, rate regulators, and local elected and appointed officials regarding the value of water, increased water system security, and increased rate structures to create the necessary financial resources to implement such countermeasures. Contaminant Identification (Action Plan Section 3.2) As the scope of available pathogens and hazardous chemicals expands so should our assessment of the threats and consequences they pose to water security. Identification of the contaminants ot concern IS an initial step in protecting the nation s water supplies. Knowledge of critical contaminant properties, such as toxicity, environmental fate, and methods for mitigation, will be needed to respond effectively to threats on our water supplies. The EPA Action Plan delineates this work into four categories of research and technical support needs: a) A manageable, prioritized list of both contaminants and threat scenarios that might be used to destroy, disrupt, or disable drinking water supplies and systems.

Review of Research Needs b) A contaminant database for consultation by approved individuals and organizations that describes critically important information on contaminants with the potential to harm drinking water supplies and systems. c) A surrogate/simulant database for use in testing and evaluating methods, approaches, and technologies to more effectively protect drinking water supplies and systems. d) Methods and means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to drinking water supplies and systems. This is a logical and comprehensive breakdown ofthe needs. There are no obvious gaps. 29 Commentary on Identified Needs 3.2.a Development of a List of Contaminants and Threat Scenarios. The development of a list of contaminants, both chemical and biological, is an important early step that will ultimately serve to guide the development of analytical techniques and treatment technologies. However, the pane! struggled with the scope of this need. The word "manageable," which was not defined in the Action Plan, raised concerns that potentially relevant contaminants might be overlooked. Yet, developing a single list of all possible contaminants could be an endless task, as the list would always be incomplete and would require extensive time and effort to develop and continuously update. One approach proposed would be to develop a list that would include only those contaminants of potential concern to water security based on a well-defined set of criteria, such as human toxicity, current and future availability, and solubility in water, among others. The EPA should work to develop this set of criteria. To expedite the formation of the water security contaminant list, existing lists (e.g., from the CDC or the EPA Office of Pollution Prevention & Toxics) could be re-visited with these criteria in mind. In addition, a mechanism needs to be built into this process ensuring that the list is regularly updated as new information becomes available. Considering that the compiled list of contaminants will guide water security activities, this list should be as complete as is practicable. The Action Plan suggests that the list of contaminants should be prioritized. In order for this to occur, the list should also contain associated information regarding a contaminant's potential for being a threat (e.g., the well-ciefined set of criteria described above). This is the kind of information anticipated to be included in the database mentioned below (3.2.b); thus, there is significant overlap between these two needs (3.2.a and 3.2.b). Prioritization is a subjective process that will depend on the weighting of various criteria and on currently available data about a contaminant (see NRC, 1999 for a more thorough treatment of contaminant prioritization). The types of information expected to be useful in prioritizing contaminants include, for example, an assessment of the contaminant's threat consequence, its current level of availability, or its resistance to residual chlorine. This information and any prioritization scheme would need to be transparent to the users of the list. The database format allows for alternate groupings or prioritization schemes based on the specific needs of treatment engineers, toxicologists, microbiologists, physical scientists, emergency response providers, etc. An assessment of contaminant threat scenarios is necessary to improving water security because the means of introducing a contaminant into the water system can significantly affect the consequences of an attack. As more is learned about modes of attack, and as new modes of attack become available due to changes in technology,

30 A Review of the EPA Water Security Action Plan policy, or practice, the threat scenarios will change. Given the description of two separate research projects in the Action Plan (p. 21), it appears that the authors intended for there to be both a list of water security contaminants en cl a list of threat scenarios. Although the lists are related, this approach is advisable as threat scenarios identified may highlight appropriate and necessary countermeasures that could be implemented, which would not be specific to any particular contaminant (e.g., backflow restriction devices). Also, this approach would prevent the consideration of current threat scenarios from constraining the list of water security contaminants. This sentiment should be expressed more clearly by explicitly separating the delineation of threat scenarios from the need for creating a list of contaminants. 3.2.b Development of a Database on the Critical Contaminants. As the list of contaminants is assembled, the most relevant physical, chemical, biological, and toxicological data should be included in a supplementary database. The nature of the data to be included in this database should be established based on perceived needs from potential end users, which would include emergency response personnel, public health department personnel, toxicologists, planners, treatment engineers/scientists, etc. Based on the anticipated uses of the supplementary database, the relevant contaminant properties should be identified. This task of identifying appropriate categories of information to be contained in this database would likely be the first project for such an activity. It should be noted that some of the parameters needed for the database will be contaminant specific. For example, a parameter critical for understanding viruses in water supply systems may have no bearing on the behavior of other pathogens. Filling in every gap within the database of critical contaminants and relevant parameters may not be necessary or worthwhile. Rather, research should be initiated to fill the most important gaps in the contaminant properties lists. This might include combing the literature for contaminant-specific information, and it should also embrace theoretical, semi-empirical, and expert judgment as needed. One way to organize the research and data gathering needs associated with the database is to determine early on which contaminant properties are most useful for particular classes of contaminants. In many cases, estimates or educated guesses might be used in place of well-established contaminant-specific data in order to address near-term risk management needs, although the sources and the reliability of the data should be noted. 3.2.c Development of a Surrogate/Simulant Database. Simulants or surrogates are intended to be similar in some specific way to individual contaminants or a group of target contaminants, but they are less toxic and therefore less hazardous to work with than the contaminants of concern. The nature of the similarity between target and simulant would necessarily depend on the type of investigation for which it will be user! (e.g., size and charge would be key parameters if removal by membrane filtration is the focus). An ideal simulant would be non-toxic and easily measured using an analytical method applicable to the contaminant of concern, but this may not be possible in many cases. Studies on treatment, decontamination, transport, and environmental fate of contaminants could benefit from a few well-selected simulant compouncts or microorganisms. Developing a complete and comprehensive database of surrogates ant! simulants would not likely be a wise use of resources. One of the end products of this work would be a set of guidelines or an operational handbook describing how surrogates or simulants should be used. Consideration should be given to selection of the simulant, handling, analysis, and data interpretation.

Review of Research Needs 31 3.2.d Means for Maintaining and Transmitting Information on the Above. Once compiled, the information that is the subject of research needs 3.2.a through 3.2.c should be continually updated and made available to those for whom it was intended. As discussed in detail in Chapter 2, information security will play an important role in carrying out the Action Plan. A plan for providing essential information to response agencies, while restricting access to classified information should also be developed. Application to Large versus Small Systems The identification of contaminant lists and compilation of data are centralized activities that do not have any specific bearing on utility size. However, the nature and relative importance of certain threat scenarios may be highly dependent on utility size. Data handling and transfer may also be different for large utilities versus small ones. Recommendations In conclusion, the panel recommends the following rewritten needs: A list of contaminants that might be used to destroy, disrupt, or disable drinking water supplies and systems. This list would be linked to relevant associated contaminant information (stored in the database mentioned below), which could be used to prioritize or group the individual contaminants, as users of the list deem appropriate. · An assessment of threat scenarios which could result in harmful exposure of the public or utility personnel to drinking water contaminants. A contaminant database for consultation by approved individuals and organizations that describes critically important information on contaminants with the potential to harm drinking water supplies and systems. Identification of a few well-selected surrogates or simulants for use in testing and evaluating fate and transport characteristics and treatment technologies for priority contaminants. Methods and means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to drinking water supplies anti systems. Contaminant Monitoring and Analysis (Action Plan Section 3.3) needs: Reliable detection of contaminants is essential to protecting consumers against chemical and biological attacks on water supplies. As the scope of available pathogens and toxic chemicals expands, so must our abilities expand to detect their presence. Early detection of an intrusion will be one defense against widespread exposure. Aside from the more obvious need to define the extent of contamination, advise the public of the contamination, and, if necessary, take actions to avoid exposure, detection methods and associated protocols are needed for purposes of assessing performance of treatment and decontamination efforts. The EPA Action Plan delineates this work into seven research and technical support

32 A Review of the EPA Water Security Action Plan a) A "play book" for analytical response to contaminant threats and attacks on water supplies and systems, including protocols for identifying "unknown" contaminants. b) Improved analytical hardware and analysis methodologies for biological, chemical, and radiological contaminants in water. c) Requirements for monitoring technologies used in responding to biological, chemical, and radiological contamination events. d) Testing and evaluation of monitoring technologies, including standard operating procedures, for biological, chemical, and radiological contaminants and threats. Testing and evaluation of drinking water "Early Warning Systems" (EWSs), and EWSs from other sectors amenable to application in the water environment. An improved and expanded laboratory capacity and capability (as necessary) to be fully prepared in responding to threats or attacks on water. g) Training modules and evaluation exercises for analytical methodologies and monitoring systems. This set of needs is quite comprehensive. vet depending on interpretations there maY be some important gaps. There may also be some reasons for combining portions of these. -7 ~ -- -or- = -- ------or- --7 ------ ---he ~ ~ . . . ~ Commentary on Identifie dNeeds 3.3.a "Play Book" for Analytical Response. The analytical "play book" includes decision trees as well as analytical methodologies and end points and is therefore much more than a toolbox. An ideal play book for analytical response would combine tools (e.g., formal analytical methods and early warning system detection methods) and provide clear direction to those trying to identify or clarify a known or perceived threat. This play book would also include protocols for sampling and identifying unknown contaminants. The play book would also consider special sampling needs and the analytical environment. Early investigations at sites where high toxicity levels are deemed possible might require the use of small mobile "Hazmat"-type labs. Once the nature of the contamination is better understood, subsequent analysis would likely take place in state or federal laboratories. The analytical play book should serve as one component of a larger integrated response guidance, which needs to be created to enable other appropriate parallel actions (e.g., communication, remediation, risk assessment, emergency response). Other components of this response guidance are discussed in sections 3.4.a' and 3.6.a'. The integrated prevention and response plan should invoke appropriate action from within the analytical play book when a disease outbreak of unknown origin is detected. In other words, the play book should include protocols for water quality sampling to determine whether drinking water is a potential vector of a disease outbreak. 3.3.b Improved Hardware and Analysis Methodologies. The need for new methods and analytical hardware is obvious when one considers that even the most abbreviated of contaminant lists is r-r~ _h_____~l_ -- microorganisms for which there are no properly validated methods. In some cases there may never have even been an attempt to detect the contaminant in a water matrix. The nonulated with numerous chem~ca Is or

Review of Research Needs 33 problem of analyzing for a contaminant threat of unknown origin is so challenging that general screening methods may have to be developed and user! in lieu of or in addition to the traditional well-validated specific method. 3.3.c Requirements for Monitoring Technologies. This sub-category is not clearly described in the EPA document, and the project list does not seem to logically follow from the preceding text. This confusion limited a thorough review of this neecl. Nevertheless, the development of quality assurance methods and other analytical features within need 3.3.c is a logical extension of need 3.3.b. New analytical methodologies will need to be accompanied by adequate protocols for sampling, analytical performance, and quality assurance, as described in the Action Plan. The document also highlights considerations that should be given to safety, sample transport, and integration with other activities issues which may also be addressed by the analytical play book. There are some rather unique quality assurance and quality control (QA/QC), sampling, and detection issues that characterize this sub-category that were overlooked in the discussion of this need in the Action Plan. Analytical quality assurance probably takes on greater importance when considering contaminants that can cause widespread illness and/or panic. For this reason, standard QA/QC procedures neec! to be carefully examined in light of the high stakes involved. Rates of false positives and false negatives should be clearly understood and results should be interpreted accordingly. Research should also explicitly address some aspects of sampling protocols and some of the unique challenges faced when monitoring treatment efficiency. Sampling may be especially problematic for hazardous contaminants because of concerns over the health of the technician and possible spreading of the contaminant by opening closed systems (e.g., unwanted exposure from opening hydrants). Protocols need to be developed to match the level of care during sampling with the likelihood of risk. Sampling guidelines are needed that address issues of spatial and temporal sampling requirements for particular types of events. Toxic contaminants may be relatively insoluble or in a particulate or micellized form. Any of these can lead to non- homogeneous distributions of contaminants. Elevated concentrations may exist at interfaces (e.g., air:water, pipe:water) or imbedded in solid phases (e.g., biofilms, scale formations, aquifer materials). Methods for sampling such heterogeneous systems need to be considered. Refined sampling methodology may be needed for detecting pathogens in complex field settings. The Action Plan notes in section 3.4 that point-of-use/point-of-entry (POW/POE) devices already in place may trap some contaminants, thereby serving as remote sampling devices during a contamination event. The analyses of POW/POE devices would be almost experimental in nature and produce only qualitative results because of the many unknowns and uncontrolled variables (e.g., volume of flow during the event, length of time in use, variability of the types of absorber, and competition with other actsorbates from the water). In order to obtain valid historical water contamination data, a proactive network of metered surveillance water sampling units with defined characteristics, such as flow through units with activated carbon collectors or microbial sampling devices, would be required. Such a surveillance network would be costly to establish and would require a regular schedule of collection, replacement, and analysis. The monitoring of treatment efficiency presents some other unique challenges. This is especially problematic when residuals streams (e.g., backwash water, settled sludge) need to be examined for assessing hazards or formulating mass balances. For example,

34 HI Review of the EPA Water Security Action Plan microbial contaminants may be especially difficult to detect against the high background of particulate matter. 3.3.d Testing and Evaluation of Monitoring Technologies. Although very important, this particular sub-category does not merit separate treatment within the Action Plan. For the purposes of this discussion, monitoring is assumed to refer to analysis of contaminants or surrogates in the field, possibly using flow-through devices. Work on monitoring (and sensing) technologies is taking place in many different fields for many different purposes. There have been startling advancements in the sensitivity and selectivity of micro devices for field deployment. However, the distinction between classical laboratory methods and field monitors may be an artificial one. In particular, detection of chemical contaminants includes a spectrum of techniques, many of which can be used with both laboratory and field methods. The two often employ identical methodology and even similar hardware. There may be cases where field sampling requires additional concentration techniques that would not be required in standard laboratory protocols, and monitoring technologies will need to be thoroughly tested under field conditions, but these issues can be addressed in the above needs. For this reason it seems unnecessary to separate needs 3.3.b and 3.3.a7. 3.3.e Early Warning Systems. Early warning systems are valuable components in the overall analytical effort. They may be the only means by which a utility is alerted to potential problems, prior to widespread illness. In some cases, existing and commonly used technologies may be employed as early warning systems. Examples include online sensors for turbidity, UV absorbance, pressure, conductivity, and chlorine residual. However, while the appropriate technology may be available, other factors such as signal processing capabilities and sufficient baseline data may need additional attention. These factors should be considered in the Action Plan. The EPA may want to include the use of dedicated water sampling devices as part of an overall water quality monitoring plan where the devices could function as a non- specif~c early warning system. Other monitoring systems could also be considered, such as a flow-through biomonitoring system using selected fish species (e.g., medaka, flat head minnows, or trout) whose behavior and physical state could quickly reflect the presence of a toxic material in the water. Maintaining such a system is complicated and costly, requiring fixed facilities with technical staff and active management. In addition, decision logic would need to be developed to determine the interpretation and follow-up that would be needed in the event that a physiological reaction was noted in the fish. There is also a spectrum of new technologies that are applicable to early warning systems, some of which come from other fields of study. Some of these technologies are compound specific, whereas others are used to measure bulk or surrogate parameters. 3.3.f Assessment of National Laboratory Capability. The ability of the nation's analytical laboratories to respond to a toxic attack will depend on the nature and scope of the attack. Most of the potential toxic chemical and biological agents are not routinely measured by water testing laboratories. While methods and equipment may be developed to measure these agents, there will be little incentive for commercial laboratories to acquire these capabilities unless routine monitoring is needed. Nevertheless, the most common emergency scenario is one of a sudden need for fast and reliable analysis of non-standard analyses. Strategies need to be developed that will ensure the ready availability of such analytical services. These strategies should include a tiered capability analytical structure, matching the most sophisticated analytical needs to the laboratories

Review of Research Needs 35 that are best equipped to handle them. Commercial laboratories will have to resolve liability issues prior to taking a role in analytical response and will need analytical methods that will minimize risks to workers. Liability issues may require that government laboratories play a leading role in analytical readiness, or that commercial labs be compensated in new and creative ways for providing analytical services for high risk or likely threat contaminants. Analytical readiness also requires that the nation's laboratories be able to effectively respond to threats. Thus, capacity and need should be geographically well matched. It is of little advantage if advanced laboratory capabilities exist in California, when an attack occurs in Florida that requires rapid turn-around. Mobile analysis units might be evaluated relative to regionally distributed laboratories for their ability to meet local laboratory needs (in terms of timeliness, reliability, and capacity) following a terrorist threat. 3.3.g Training. Training of personnel for routine monitoring as well as event sampling and analysis of biological and chemical hazards in water should necessarily follow the development of key analytical protocols anc! the analytical play book. The EPA has appropriately recognized this by including the need for training modules and evaluation exercises in the Action Plan. Adequate training of personnel from water utilities and local and state agencies is essential to early detection and to effective water terrorism response. To promote collaboration and effective response, public health officials should also be involved in this training. Application to Large versus Small Systems In general, small utilities, whether they are community or non-community water systems, will not have in-house capabilities to monitor or measure specific priority contaminants. However, they may be able to monitor for some indicators that could serve as early warning systems (e.g., monitoring chlorine residual). Other more sophisticated early warning systems will probably be too expensive or complicated for small systems to easily employ. Once there is credible evidence for a toxic attack, the analytical play book would probably require that state agencies become involved and that state personnel and laboratory facilities would become available, such that utility size may not affect the path taken. On the other hand, some of the early stages in the play book could be tailored to utility size based on (differing analytical and diagnostic capabilities. Recommendations In conclusion, the panel recommends the following rewritten needs: A "play book" for sampling and analytical response to contaminant threats and attacks on water supplies and systems, including protocols for identifying "unknown" contaminants, that will serve as a vita] component of an overall integrated guidance plan. Improved analytical hardware and associated field and laboratory analysis methodologies (including generic simple techniques and laboratory-based, off- line, and real-time monitoring technologies) for biological, chemical, and radiological contaminants in water. Requirements for appropriate QA/QC and sampling approaches in response to suspected biological, chemical, and radiological contamination events.

36 A Review of the EPA Water Security Action Plan Testing and evaluation of drinking water "Early Warning Systems" (EWSs), and EWSs from other sectors amenable to application in the water environment. An improved and expanded tiered capability laboratory capacity to be fully prepared for effectively responding to threats or attacks on water. Training modules and evaluation exercises for analytical methodologies and monitoring systems. Containment, Treatment, Decontamination, and Disposal (Action Plan Section 3.4) One of the most important stages in dealing with a contamination or threat event will be the actions taken to contain and treat contaminated water. Depending on where a contaminant is introduced, this may involve mitigation within a drinking water treatment plant, within the distribution system, or at points downstream. Any materials, including water, that cannot be successfully treated to meet water quality or other standards will have to be disposed of properly. In addition, the physical infrastructure of water systems may require decontamination before it can be safely reused. The EPA Action Plan delineates this work into four categories of research and technical support needs: a) Improved distribution system models that can be used to more effectively protect drinking water in the event of deliberate contamination. b) Improved understanding and documentation of the environmental fate of contaminants in source waters, within drinking water systems, and once they are released. Newer technologies and treatment processes to achieve multiple goals, and effective disposal and/or treatment techniques and technologies for water and equipment that have been contaminated. d) A methodology, approach, or guide for use in determining when a drinking water system is contaminated and when it is clean and can be used. Commentary on Identified Needs 3.4.a Improved Distribution System Models. Distribution system hydraulic models can help delineate deliberate or acciclental contamination that may be introduced into source waters or at points in the water distribution system. Hydraulic models can be used to identify affected areas within the water system, contaminant concentration, the influence of decay and dilution, and the duration of the exposure, providing information that can be used to determine which areas may need to be isolated, closed, sampled, or cleaned and when these areas can be returned to use. Further development and resolution of distribution system hydraulic models are clear research needs. In general, the Action Plan adequately describes the need for improved models and identifies research issues and requirements for their implementation. However, several issues should be more clearly addressed. Hydraulic models have many applications in addition to their use as part of water security efforts. The multiple benefits that may be obtained from the research activities should be better described.

Review of Research Needs 37 The EPA should conduct an inventory or survey of water systems to determine (1) how many utilities have developed and calibrated models, (2) which models are being used, and (3) the availability of information to develop models. The Action Plan should discuss the likely difficulties associated with the development, calibration, and implementation of the models. Training needs should be described, since water utility operators will need to be able to use the models on short notice and under adverse conditions. For example, such training could be made part of the Operator Continuing Education Program that all states are now required to have. Training and implementation needs should devolve from information gained from the water system vulnerability assessments. Hydraulic models can be developed for all types and sizes of water systems including large, complex systems that have multiple wells or surface water sources, storage facilities, and treatment sites. Nevertheless, calibration of the models for each utility s unique conditions can be time consuming and expensive and may be beyond the financial and technical capabilities of many medium- and small-sized systems, even though small systems may be structurally simpler than larger systems. The EPA should describe the need for hierarchical models for various sizes and types of water systems. The models for small systems may be less complex, and the EPA should determine the applicability of developing a less complicated model that may be used by many smaller systems. It may be possible to develop a model with relatively few parameters that can, in conjunction with information from continuous pressure monitors and flow meters, provide useful information when small systems are contaminated. The models should consider both decay or die-off rates of water contaminants and the possible adsorption or attachment of the contaminants to the interior surfaces of pipes and storage reservoirs. In addition, the current models are limited to the consideration of a contamination event of relatively short duration (5 minutes or less). Continuous introduction of a contamination over a longer period of time should be modeled as well. The Action Plan notes that existing models can be overlaid with geographic information system (GIS) and public health data and recommends the development of an interface module to allow overlapping of health data, consumer complaints, GIS, and SCADA data with current hydraulic models for data collection and manipulation in close to real time. Before developing such a module, the intended use of the information and limitations should be considered and any associated research or implementation needs should be described in conjunction with the surveillance activities described in section 3.6.b. In addition, the limitations of the information garnered from this application should be made available to water system managers. Coding the location of health outcome information for routine display on a water distribution system map is not likely to be feasible in the near future, and its effectiveness in warning of potential waterborne exposures seems questionable. However, it might be useful to develop an interface module for mapping cases as they occur during an investigation of an outbreak or contamination event. This type of mapping could assist officials in identifying and isolating a general area of contamination. Finally, it should be noted that the Action Plan discusses the use of POU devices for sampling purposes in conjunction with distribution system models. The panel s review of this application is discussed in the previous section. 3.4.b Improved Understanding of the Environmental Fate of Contaminants. A better understanding of contaminant fate and transport in various source waters (including both surface water and groundwater) and within water systems is clearly

38 A Review of the EPA Water Security Action Plan integral to determining how pollutants that are intentionally added to such systems might behave. Nonetheless, this need is stated in such broad terms that it is impossible to define logical starting points for attempting such research, which should necessarily be cognizant of the very large body of work that has occurred on this topic over the last 30 years. Thus, the need should be restated in a way that is more approachable from the standpoint of understanding possible threats to water supply systems. The complexity of the need is illustrated by considering the amount of work involved in better understanding the fate and transport of every individual contaminant of concern. Given limited resources, it may be desirable to instead have as the goal the identification of generic physical and chemical parameters (e.g., KoW' Kd, other partition coefficients, half-lives) that are predictive of contaminant behavior in water supply systems. A second approach would be to develop a set of fate and transport paradigms for a small number of common threat scenarios (which might be defined in response to the need! stated in section 3.2.b). This is consistent with the notion in section 3.2 of developing a short list of possible threat scenarios that explicitly consider certain exposure routes. Finally, a literature review is necessary as a precursor to engaging in research on this topic in order to document where the field of contaminant fate and transport has been and is going. 3.4.c Newer Technologies and Treatment Processes for Water and Equipment That Have Been Contaminated. Although the Action Plan highlights a number of treatment processes to address water security needs, the Action Plan could better articulate the important treatment issues by structuring the discussion according to the following four general approaches: . What kind of treatment can be expected from in place conventional technologies? What kind of new technologies could be abided in a preventive or quickly reactive mode? How can mobile technologies be brought in? How can mitigation of distribution system contamination occur (with POU devices, turning off part of the distribution system, flushing, and others)? Traditional centralizeci whole or partial system mitigation, depending upon the type of contamination, has successfully included: . . boosting chlorination levels improving central treatment performance adding powdered activated carbon at the plant or in the distribution system (experimentally) isolating portions of the distribution system flushing mains and service lines bringing in mobile treatment systems (e.g., Reverse Osmosis Water Purification Unit) · others These traditional techniques are likely to be more feasible than newer, more complex techniques (e.g., post-contamination POW/POE ), and they can be implemented rapidly in most cases. Readily accessible information is needed on techniques that are particularly effective for decontaminating distribution systems and treatment facilities after they have become contaminated with various types of agents. Both here and with the other contamination circumstances, linkage of the finite types of contamination scenarios based upon physical and chemical properties, to the relatively short list of mitigation approaches should be made. This approach would be more efficient than creating long

Review of Research Needs 39 lists of potential contaminants and attempting to develop specific mitigation data on each one. And again, this is consistent with the notion in section 3.2 of developing a short list of possible threat scenarios that explicitly consider certain exposure routes. The Action Plan suggests a possible role for POU or POE devices for mitigation of some types of contamination. POU (single tap) and POE (whole house) water treatment devices cover a broad range of chemical and microbiological removal capabilities. Although many POW/POE devices undoubtedly have capacity to remove the more exotic terrorism agents, to date they have not been tested against those agents (although programs are underway to develop expanded test protocols and assess several units). For their application as a mitigation or protection against high risk contaminants, the units may need to be more ruggedly designed, undergo more rigorous QA/QC in manufacture, and be proven in tests against the actual agents or suitable surrogates. The presence of appropriate POU or POE devices prior to a contamination event may provide some serendipitous benefit in removing the agent. For example, the incidence of cryptosporidiosis was reported to be lower among people in Milwaukee who had certain treatment crevices in place during the CryptosporiJium outbreak in 1993. On the other hand, the crevices could also increase exposure if the accumulated contaminant leached into the water at a later time. Consideration should be given to exploring the possible role for POE treatment as a preemptive approach for certain essential anc! high risk facilities such as police and fire stations and medical care facilities. In hospitals' POE technologies might also provide immediate ancillary benefits bY providing protection from routine water quality variability. -a rid -= r- Using POU or POE devices for post contamination mitigation is problematic, although this approach might be appropriate during persistent distribution system contamination that cannot be rapidly removed by conventional treatment. However, the logistics of implementing a decentralized POW/POE system would be formidable, both in terms of installation time and expense, especially in a large community. 3.4.d A Methodology for Determining When a Drinking Water System Is Contaminated and When It Is Clean. This need is an amalgam of several broact objectives. The main goad appears to be to develop a research plan that would provide the means for the EPA to say with confidence when a water system or supply is no longer contaminated and when it can be again used for limited or unlimited beneficial purposes, including as a source of drinking water. This need represents an additional play book, like that mentioned in section 3.3.a for monitoring and in 3.6.ci, which identifies the need for a risk assessment/risk management framework for identifying the impact of decontamination and treatment options and the subsequent risk assessment response. As discussed in Chapter 2, these play books should be combined into a comprehensive response guidance document. Application to Large versus Small Systems For two of the needs above, there are substantive differences that may accrue between small and large water supply systems. In particular, the development of adequate hydraulic models of distribution systems becomes much more complex as the size of the system increases, although larger systems may have greater financial and personnel resources for conducting this activity. Second, with respect to the treatment of purposefully contaminated water, larger water supplies are likely to have more treatment options available compared to smaller water systems, and thus may be less vulnerable to certain threat scenarios.

40 Recommendations A Review of the EPA Water Security Action Plan In conclusion, the pane! recommends the following rewritten needs: . . Improved distribution system models that can be used to more effectively protect drinking water in the event of deliberate contamination, which should consider not only technical improvements to such models, but also operator training to better use the models, the availability of information needed to run the models, and the dual-use benefits of mode! development. Improved understanding and documentation of the environmental fate of contaminants in source waters, within drinking water systems, and once they are released, focusing first on a literature review and then on either the identification of generic physical and chemical parameters that are predictive of contaminant behavior in water supply systems or on a small set of fate and transport paradigms for common threat scenarios. · Technologies and treatment processes to achieve multiple goals, and effective disposal and/or treatment technologies for water and equipment that have been contaminated, including in-place conventional technologies, new preventive technologies, mobile technologies, and technologies that can mitigate contaminant spread through the distribution system. · A methodology, approach, or guide for use in determining when a drinking water system is no longer contaminated and when it can be placed back into limited or unlimited service. (This need is one component of the overall response guidance, which is also expressed in Chapter 2 and sections 3.3.a and 3.6.d, and would be best expressed in combination with those needs.) Contingency Planning and Infrastructure Interdependencies (Action Plan Section 3.5) Water systems will need to develop contingency plans for providing a sufficient quantity of adequate quality water to their service area in the event that deliberate malfeasance (or "natural" hazards) causing service disruption occurs. Water systems, particularly (but not only) larger ones, are increasingly relying on automation, and they depend on the reliable functioning of other systems (e.g., electric, telecommunications). Thus, contingency planning should consider the potential for disruption to occur not only within a water supply system but also to one or more of these necessary auxiliary systems. The EPA Action Plan delineates this work into three categories of research and technical support needs: a) Assessment of water supply alternatives for different-sized drinking water systems at different geographical locations in the United States when the usual supply of water is not available. · · . . .. _ O b) Testing and evaluation of improved technologies and approaches for providing supplies of water in the event of both long-term and short-term disruptions to drinking water systems. An improved understanding of water system interdependencies with other infrastructure sectors that are critical to national security.

Review of Research Needs 41 Commentary on Identified Needs 3.5.a Assessment of Water Supply Alternatives. The Action Plan stresses the importance of contingency planning for a range of system types, but this research need should be expanded to acknowledge that size and geographic location are not the only factors that account for diversity in water systems. Other factors, which may influence the nature of the required contingency plan or infrastructure interdependence, include: · type of source water (e.g., lake, river, groun(lwater, etc.) · existence of multiple sources of supply · use of water purchased from a wholesaler · interconnections with neighboring water systems · system design (looped distribution, ability to blend supplies in distributions treatment type) · pressure source (predominantly gravity systems versus predominantly pumped systems) The degree to which contingency planning can and should rely on consumer preparedness should be addressed. Is it realistic to rely on POU treatment or on consumer stockpiling of potable water (for how long; with what degree of compliance can be anticipated)? Such consumer preparedness can only be carried out with the assistance of a well-developeci communication plan for response prior to and during an emergency. This communication plan should be developed upfront and should be known in advance by the potential recipients of information to minimize misinformation during an incident. It should be noted that other benefits could arise from planning for contingencies resulting from terrorist actions or threats. These include improved preparedness for natural hazards (e.g., earthquakes, floods, tornadoes) or accidents (e.g., crashes, chemical tank failures). Indeed, the ancillary benefits that may arise from preparing for contingencies from terrorist actions or threats may make the implementation of such preparations more economically justifiable to ratepayers, regulators, and other stakehol(iers. 3.5.b Testing and Evaluation of Improved Technologies and Approaches for Providing Supplies of Water. Previous sections of this report (~3.3.c and 3.4.c) have discussed POU devices and how they might be utilized both for sampling and treatment purposes during a contamination event. That discussion is relevant here as well. In addition, identification and enumeration of technologies for providing emergency potable water supply would also be valuable, probably in the form of a database. To what degree, for example, are military resources available to handle the task of water supply during large-scale interruption? The appropriate alternative strategies for a given location will be site-specific but should be enumerated in such a database. 3.5.c An Improved Understanding of Water System Interdependencies with Other Infrastructure Sectors. This need should be expanded to include an understanding of the reliability of systems upon which continued functioning of the water system depends (e.g., electric power, road transportation, telecommunications), and an assessment of the weakest links among the systems that are required for continued functioning. For large utilities, a fault tree analysis for the most critical components or processes might be conducted, and in this manner such dependencies could be detected. It might be a more efficient use of resources to "harden" aspects of other infrastructure so as to promote reliability of a particular water system component (e.g., electric power

42 A Review of the EPA Water Security Action Plan utility substation), rather than to harden an aspect of the water utility itself. It should be noted that preparation for the Y2K changeover proved to be a valuable source of lessons regarding interdependencies, and this knowledge should be captured in responding to the challenge of terrorism. A potential contingency response by utilities to system vulnerability is ~iisaggregation or decentralization of supply and/or treatment systems. The Action Plan should consider to what degree this is beneficial or undesirable from a preparedness viewpoint (e.g., is there an optimum level of disaggregation or a maximum safe level of aggregations. Additional Research and Technical Support NeedEs Missing from this section is a discussion of a key element to successful operation of most water systems the human factor. The Action Plan should consider under what circumstances the operation of a water treatment plant (or supply system) could be adversely impacted by the incapacitation ofthe operating personnel and whether there are potential contingencies or mitigations for such occurrences. The Action Plan should also consider potential back-up support that might exist for this failure pathway (e.g., importing personnel from neighboring utilities, or military and civilian emergency response personnel). It should be noted that a failure of"human subsystems" that could impact a water system could occur as a result of a direct attack via a non-water route, for example via a massive community bioterrorism incident in which a substantial fraction of operating personnel were affected. Application to Large versus Small! Systems Contingency planning is highly dependent upon the size, location, and type of water supply system to be protected. In general, smaller systems may be less dependent upon automated control technologies, and therefore less vulnerable to cyber threats. Small systems may or may not be able to readily arrange for alternative sources of supply or redundant connections from other necessary infrastructure systems (especially for small systems in sparsely populated regions). These considerations indicate that the overall response guidance needs to consider diverse strategies depending upon the threat encountered as well as the nature of the system. Recommendations In conclusion, the pane! suggests the following rewording of the identified needs: Assessment of water supply alternatives for different types of drinking water systems in the United States (reflective of effects of size, type of supply, system design, and type of distribution system), when the usual supply of water is not available. Testing and evaluation of improved technologies and approaches for providing supplies of water in the event of both long-term and short-term disruptions to drinking water systems. The evaluation of approaches should include customer preparedness and should assess degree of reliability of the options. · An improved understanding of water system interdependencies and the reliability of such interdependencies with other infrastructure sectors that are critical to national security. · Explicit understanding of the role of failure of the "human subsystem" in water system operation, and the development of contingencies for responding to such eventualities.

Review of Research Needs Targeting Impacts on Human Health and Informing the Public about Risks (Action Plan Section 3.6) 43 Because human health protection is one of the ultimate endpoints of the EPA s water security efforts, research into better understanding the human response to contamination or threat scenarios is critical. This includes not only human physical response to different classes of waterborne contaminants and ways to measure that response, but also the social and psychological response to contamination events and how best to communicate relevant threat information to all stakehoIclers. The EPA Action Plan delineates this work into five categories of research and technical support needs: a) An improved understanding of contaminant exposure routes, and the acute and chronic public health effects from contaminants in drinking water supplies and systems. b) A health surveillance network to help public health officials and water utility operators rapidly identify and control a disease outbreak or other public health emergency associated with contaminated drinking water. c) A methodology or procedure for using non-traclitional data sources (e.g., LDso' Quantitative Structure Activity Relationship (QSAR]) for the derivation of acute anile chronic toxicity values applied to water. d) A risk management/risk assessment framework for identifying the impact of decontamination/treatment options and the subsequent risk assessment response. Methods and means to communicate risks to local communities with respect to threats and to respond to customers and the media in the case of an attack on drinking water systems. Commentary on Iclentifiec!Neecits 3.6.a An Improved Understanding of Contaminant Exposure Routes and the Acute and Chronic Public Health Effects from Contaminants in Drinking Water. The large scope of this need makes it unusable as an objective in an Action Plan. Taken literally it describes a decades-long research agenda that has already been in progress for many years. It includes yet another database with no clear idea of how this product will be used, articulated with other databases and systems, and maintained over time. An EPA strategy that emphasizes immediate usability and first approximations is a sound one. This need, therefore, should be interpreted in that light and be stated more modestly and specifically. Generic categories corresponding to the three routes of exposure (inhalation, ingestion, dermal) could be developed to provide generic models for different large classes of agents that would provide some initial, albeit crude, guidance in a relatively short span of time, and the details could be continually filled in as additional information becomes available (e.g., regarding sensitive subpopulations such as children, the elderly, and immunocompromised individuals). This is consistent with the notion in section 3.2 of developing a short list of possible threat scenarios that consider explicitly certain exposure routes.

44 ~ Review of the EPA Water Security Action Plan 3.6.b A Health Surveillance Network Associated with Contaminated Drinking Water. In describing this need, the EPA makes assumptions about the activities and capabilities of the CDC and other Department of Health and Human Services (DHHS) agencies that need to be corrected. The Action Plan states that if the twater] contaminant causes a notifiable disease, it will be picked up by existing health surveillance systems, and thereby presumes that most notifiable diseases (e.g., giardiasis and cryptosporidiosis) are typically reported and in a timely fashion. Indeed, the percentage of reportable diseases reported by even the largest and most sophisticated active disease surveillance systems is surprisingly low (for an example from New York City see NRC, 2000, Chapter 6~. The Action Plan also incorrectly notes that a national surveillance system for potentially waterborne diseases is well underway. The Action Plan should contain an accurate evaluation and description of current surveillance and other related activities in the public health sector, and the EPA should define its role and research agenda in this regard. The EPA may not be the lead agency for public health surveillance but should be an active participant in understanding and establishing effective surveillance for waterborne agents, since it is the lead agency for water security. The primary goalies) of the waterborne surveillance system should be stated. Is the primary goal to detect a possible terrorist attack, or detect outbreaks of accidental contamination, or both? If the goal is to detect a terrorist attack, then surveillance may focus on very different agents and illnesses. The Action Plan should describe the overall needs of a surveillance program and how waterborne surveillance woulc! fit into a larger surveillance program. The plan should also address the investigative response (e.g., who will take the lead for initiating action, and how will the investigative teams coordinate their activities?) in addition to describing research activities. Finally, the needs for training and coordination of local health department employees and medical personal in the development of an effective water surveillance program should be acknowledged. Public health surveillance is important to help detect possible outbreaks or epidemics. The surveillance activities should be sensitive enough to detect increased risks early enough for the initiation of timely investigations, mitigation actions, ant! efforts to prevent the spread of illness. Surveillance activities can be designed to monitor various outcomes such as selected diseases (e.g., cases reported by clinicians), symptoms (e.g., complaints to nurse practitioners), events (e.g., sale of anti-diarrhea! medicines), and/or laboratory analyses (e.g., positive stool specimens for Cryptosporiclium). If the incidence of any of the outcomes is increased, officials must then assess the risk and take appropriate actions. Information will be required about the possible routes of exposure (ingestion, inhalation, dermal), modes of transmission (indoors and outdoor airborne, foodborne, waterborne, person-to-person, direct contact), type and source of contamination, and water supply treatment or isolation options. Thus, surveillance activities will need to include a well-thought-out plan not only how best to monitor outcomes of interest but also how to coordinate the response of a team of investigators (epidemiologists, physicians, microbiologists, chemists, and engineers) if water is the suspected mode of transmission. There is a substantial communication component to this need on many levels (e.g., among the investigators, with the public), especially for intentional contamination events that are investigated in the context of a potential crime. In recent years, several active disease surveillance systems have been initiated at the local and state level for the improved detection of both foodborne and waterborne outbreaks. An evaluation of these systems should be included among the research needs. The effectiveness of monitoring various alternative outcomes (e.g., complaints, symptoms, drug sales, sentential populations) should also be evaluated.

Review of Research Needs 45 Finally, water quality monitoring and analysis should be used in conjunction with active disease surveillance data to help confirm or deny the role of water as a route of transmission during an event. This suggests better linking this research need with the monitoring activities discussed in section 3.3. 3.6.c A Methodology for Using Non-traditional Data for the Derivation of Toxicity Values Applied to Water. This need would be applicable in cases where new contaminants are noted for which there are few or no available toxicological data. The EPA already has substantial in-house resources and expertise in predictive toxicology, especially in the New Chemicals Program within the Office of Pollution Prevention and Toxics (OPPT). The Office of Ground Water and Drinking Water/Office of Science and Technology also has a functioning Health Advisory Program for non-regulated contaminants that includes short-term exposure scenarios. It would be logical and probably most efficient for the EPA to make use of those resources rather than contracting externally. The Food and Drug Administration is also engaged in some similar work, and the Department of Defense (DOD) has efforts in these areas. Collaborations between the active organizations for a concerted! effort would appear to be highly desirable and most efficient. Use of single point toxicity estimates such as LD50 values ant! structure/activity relationships to project acute toxicity values for human populations is a difficult concept and one that would require significant validation before carrying much weight in a decision process. Work is underway and some models do exist (e.g., MCASE, TOPCAT, DEREK3, PALLAS). The DOD's Armed Forces Medical Intelligence Center recently held a conference on prediction of acute toxicity that concluded that acute toxicity endpoint QSARs are less well developed than QSARs for chronic toxicity endpoints (William Waugh, EPA OPPT, personal communication, 2003~. QSAR methodologies have been developed for many longer-term toxicology endpoints, such as cancer and reproduction and neurotoxicity, and these are used routinely by the OPPT New Chemicals Program. Commercially available systems also exist. QSAR or other predictive systems for ecological endpoints also exist (e.g., ECOSAR and Aquatox), and these would be relevant for assessing the potential consequences of discharges of contaminated wastewater. , · . . . . . . . . · · . . _ _ (~ 1 Predictive airborne contaminant assessment work related to terrorism Is also underway in the OPPT (e.g., Acute Exposure Guideline Levels). This would also have applicability in the water context for aerosol exposures in the home and in water and wastewater treatment plants. Predictive tools applied to microbial contaminants have not developed as far as it has for chemical toxicology. The concept of Virulence Factor Activity Relationships (VFARs) has been suggested as appropriate for some pathogens. However, the state of the art and the scientific complexities involved place this in the long-term basic research realm. The far-reaching implications of this potential too} in public health and medicine are such that it would be best addressed by a research agency such as NIH rather than the EPA. 3.6.d Frameworks for Assessing and Managing Risks. The centrality of risk assessment and risk management to an overall response for water security stands in stark ~ The NRC's Risk Assessment in the Federal Government: Managing the Process (1983) distinguishes risk management and risk assessment, and this view is reflected in the Action Plan. Therefore, the distinction is maintained here.

46 A Review of the EPA Water Security Action Plan contrast to its brief treatment in Action Plan. Indeed, the need statement suggests that risk assessment follows risk management, which is counter to prevailing uses of both terms (see NRC, 1983 for detailed} descriptions). As envisioned by the panel, this particular need should stress the importance of integrating risk assessment and risk management into decision making during all stages from threat assessment to event response. Although the Action Plan recognizes that on-scene decision makers will require the support of a risk assessment/risk management protocol and it emphasizes the utility of table-top exercises, no information is provided on possible frameworks for use cluring contamination events or threat scenarios. This need requires considerably more thought from the EPA authors, and it should be put in the appropriate context, since it represents another component of the overall response guidance mentioned in Chapter 2, section 3.3.a, and section 3.4.a7. 3.6.e Methods and Means to Communicate Risks to Local Communities. Prior to the development of methods and means to communicate risks to communities, there should be an established relationship in place with these communities. This relationship is the result of a detailed risk communication planning process that identifies not only the people with whom risks must be communicated, but also the appropriate methods and tools that can and should be used in diverse scenarios. Thus, risk communication cannot be viewed as the last step in the management of water system security but should be incorporated throughout. No one method or means will be appropriate for all places or times. Knowing what tool to use, and when, and how can only be determined through communication planning and research. For example, standard public health notices (e.g. "boil water" or '~do not use," as mentioned in section 3.4.d of the Action Plan) may not be effective in all or even a majority of cases (O'Donnell, et al., 2000~. Risk communication can be defined as a process to develop two-way communication between various parties that addresses the needs and concerns of all affected parties (NRC, 1989~. Risk communication is an essential component in the overall risk management scheme. It should not be considered a separate piece of the mode! to be utilized and developed after the other steps, but something that should be factored into each step of the risk management model. Additionally, risk communication is not limited to the thoughtful development of tools to assist in the communication process. It is a methodology or strategic planning process to establish contact up-front with various constituent groups within and outside of an agency, facility or community. This process takes into account how communities see risk and requires earning trust and credibility and explaining risk. There are seven important steps in risk communication planning: 1 ) issue identification and clarification; 2) setting the goal for the communication; 3) profiling or understanding the nature of the issue or event and the parties that will be affected; 4) identifying and assessing audience need and concerns; 5) message development; 6) method development; and 7) plan implementation and evaluation (Pflugh et al., 1992~. In order for a plan to be successful, it must be in place prior to an event with all potentially affected parties informed in advance of what will be communicated and what they will be asked to do to protect themselves. Information developed in advance and in consultation with the potentially affected parties will yield the response required and desired by the communicator should a national security situation arise. Having a plan in place, using tools developed through the risk communication planning process, and knowing how people will respond to risk information will help in the distribution of information to the appropriate people as

Review of Research Needs 47 needed. Releasing appropriate information in a timely fashion can build trust and may moderate the public response in the event of an actual attack or a hoax. Application to Large versus Small Systems For at least one research need in this section, there are considerations that should be taken into account for small versus large water supply systems. Resources for local health surveillance may be very limited for small water systems, and some surveillance methods may not be as effective for small systems. Thus, the evaluation of an active disease surveillance system should include an assessment of its effectiveness and financial feasibility for systems of various sizes. Recommendations . . . . . In conclusion, the pane' recommends the following rewritten needs: An improved understanding of contaminant exposure routes (not only direct ingestion but also dermal and inhalation exposures), and of the acute and chronic public health effects from contaminants in drinking water supplies anci systems, which should focus on generic models for different large classes of agents. A health surveillance network to rapidly identify and help control a disease outbreak or other public health emergency associated with contaminated drinking water. This effort should be cognizant of active disease surveillance efforts already underway, the limitations of active disease surveillance, and the respective roles of the EPA and other public health agencies. An evaluation of the utility and validity of using non-traditional data sources (e.g., LD50, QSAR) for the derivation of acute and chronic toxicity values applied to water. A risk assessment/risk management framework for identifying the impact of decontamination/treatment options and the subsequent response. (This need is one component of the overall response guidance, which is also expressed in Chapter 2 and sections 3.3.a and 3.4.d, and would be best expressed in combination with those needs.) Methods and means to communicate threat risks to local communities and to respond to customers and the media in the case of an attack on drinking water systems, the success of which will depend upon the prior existence of an established relationship with communities that is the result of a detailed risk communication planning process. WASTEWATER In areas of dense population, the carriage and appropriate treatment and disposal of human waste via the wastewater system provides an essential service to the maintenance of public health and sanitation. Wastewater collection and treatment systems are also control points for water quality protection. There are many health-related issues when considering the security of the nation's wastewater plants, because many surface water supplies of drinking water contain treated wastewater. The purposeful impairment of wastewater treatment facilities could notably affect drinking water quality downstream. In addition, there are other beneficial uses of surface water resources that can be

48 HI Review of the EPA Water Security Action Plan adversely affected by disturbances in the wastewater system, including aquatic ecosystems and contact recreation. The wastewater collection system, by design, serves as an access point to numerous structures in a region. Hence this system is not only physically vulnerable to terrorist activities, but it also presents a potential conduit for malicious use to damage structures that may be serviced by the system. Thus, it is appropriate that consideration be given to the security of the nation's wastewater systems, although the human health consequences may be somewhat more indirect than in the case of drinking water systems. Wastewater Infrastructure (Action Plan Section 4.0) The EPA Action Plan delineates this work into six categories of research ant! technical support needs: a) A thorough understanding and documentation of the possible threats to the nation's wastewater treatment and collection system infrastructure, including the interdependencies with drinking water systems and other critical infrastructure. b) An updated assessment of the possible health and safety risks related to potentially hazardous substances used by wastewater utilities or intentionally introduced into wastewater collection and treatment systems, including any impacts on residuals management operations (sewage sludge). c) Improved intrusion monitoring and surveillance technologies to quickly notify wastewater utilities when these technologies are compromised by physical and cyber threats or chemical, biological, and radiological contaminants. d) Improved designs for wastewater systems to reduce vulnerability to physical threats and as a way to prevent or mitigate the effects of attacks on wastewater infrastructure. Enhanced prevention and response planning methods, including emergency response, contingency planning, and risk communication protocols and guidance for systems of varying sizes. Methods and means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to wastewater systems. Commentary on Identified Needs In general the panel is concerned that the level of detail in this section of the Action Plan is much less than the level of detail that exists in section 3.0. Broad threats to wastewater systems include contaminant impact on facility performance, effects on receiving water quality and associated damage to environmental targets such as aquatic ecosystems, physical damage to collection systems or treatment facilities, and use of the sewer system as a means to get undetected access to sensitive locations. In addition, impacts on stormwater and collection systems (either separate or combined) should be considered. Within the Action Plan, more thorough and thoughtful analyses are needed 1 ~ , , · ~ , , to consider the security needs OI wastewater Infrastructure.

Review of Research Needs 49 Certain distinct features differentiate wastewater systems from drinking water systems. First, wastewater system disruption is physically simple in that it is possible to introduce materials to a sewer on a surreptitious basis from almost anywhere (an intrinsic design feature of such systems). Second, it is impossible to turn off a wastewater collection system, which could make mitigation of a contamination event very difficult. The Action Plan should address the broad spectrum of threats to wastewater systems and a various facility types. The interdependencies between drinking water and wastewater systems should be considered. For example, contaminated drinking water can serve as an input to the wastewater system and contaminated wastewater may adversely impact downstream sources of drinking water. Emergency responders would benefit from an examination of the possibility and availability of emergency points of relocation of an effluent discharge or the availability and utility of emergency treatment systems to continue to protect vulnerable water resources. Emergency relocation or treatment may be especially useful where wastewater discharge is a major contributor to groundwater recharge or where it impacts a nearby surface water intake for drinking water supplies. The degree to which deliberately introduced contaminants pass through a wastewater treatment plant and either into the effluent or the sludge needs to be reviewed. The potential impact of residuals from cleanup of a terrorist event needs to be judged (e.g., could wash waters sent to a sewer damage routine plant operation or pose a major additional loader. Occupational risks to wastewater collection system and treatment plant operators from these materials need to be assessed, along with recommendations for personal protective gear when contamination is suspected. Recommendations The security of the nation's wastewater infrastructure needs additional effort within the Action Plan, similar to that undertaken for drinking water systems, including input from various stakeholder groups. Based on the information presented in the Action Plan, the following rewording of needs is suggested: . . . A thorough understanding and documentation of the possible threats to the nation's wastewater treatment and collection system infrastructure, including the interdependencies with drinking water systems and other critical infrastructure. An updated assessment of the possible health, safety and environmental risks related to potentially hazardous substances used by wastewater utilities or intentionally introduced into wastewater collection and treatment systems, or stormwater conveyance and treatment systems, including any impact on residuals management operations (sewage sludge). An assessment of the possible health, safety, and environmental risks related to potentially hazardous substances produced during response to security threats (e.g., decontamination materials and their byproducts) which may be discharged to sewer systems or stormwater conveyance systems. Improved intrusion monitoring and surveillance technologies to quickly notify wastewater utilities when these facilities or technologies are compromised by physical and cyber threats or chemical, biological, and radiological contaminants. (Note that some of this information may be transferred from knowledge gained while assessing drinking water systems.)

so A Review of the EPA Water Security Action Plan . . . Improved designs for wastewater systems to reduce vulnerability to physical threats and as a way to prevent or mitigate the effects of attacks on wastewater infrastructure. Enhanced prevention and response planning methods, including emergency response, contingency planning, and risk communication protocols and guidance for wastewater systems of varying types (size, geographic location, design). The potential for emergency relocation of discharge or alternative treatment should also be assessed. Methods and means to securely maintain and, when appropriate, transmit information on contaminants and threat scenarios applicable to wastewater systems.

Next: References »
A Review of the EPA Water Security Research and Technical Support Action Plan: Parts I and II Get This Book
×
Buy Paperback | $60.00 Buy Ebook | $47.99
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

The report examines a draft plan, prepared by the Environmental Protection Agency, that identifies critical security issues for drinking water and wastewater and outlines related research and technical support needs. This report recommends increased attention to interagency coordination and encourages additional consideration of current restrictions on secure information dissemination. It further suggests that EPA incorporate the results of their research activities into an integrated water security guidance document to improve support for water and wastewater utilities.

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook, NAP.edu's online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  6. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  7. ×

    View our suggested citation for this chapter.

    « Back Next »
  8. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!