Danneels, Jeffrey J.

Finley, Ray E.

OpenSIUC

Assessing the Vulnerabilities of U.S. Drinking Water Systems8JOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATIONUCOWRAssessing the Vulnerabilitiesof U.S. Drinking Water SystemsJeffrey J. Danneels and Ray E. FinleySandia National LaboratoriesDuring the Clinton administration, theimportance of our critical infrastructure washighlighted by the National Security Councilin Presidential Decision Directive 63 (PDD 63).PDD 63 was superseded recently when PresidentBush signed Homeland Security PresidentialDirective 7 (HSPD-7).  HSPD 7, like its predecessorPDD 63, establishes a national policy under whichfederal departments and agencies are required toidentify and prioritize United States criticalinfrastructure and the key resources needed toprotect them from terrorist attacks.  PDD 63 andHSPD 7 also encourage Federal departments andagencies to form public and private partnerships topursue the goal of lowering risks to our national assetsdue to malevolent events.  The EnvironmentalProtection Agency (EPA) is assigned responsibilityfor the water infrastructure, which includes bothdrinking water and wastewater systems.Subscribers (mainly water utilities) of theAmerican Water Works Association ResearchFoundation (AwwaRF) were also becomingconcerned about security at drinking water utilitiesand encouraged AwwaRF to assist them inunderstanding potential malevolent threats.  Inresponse to PDD 63, and with input from public waterutilities, both EPA and AwwaRF initiated programsto understand and mitigate the security vulnerabilitiesof drinking water utilities.  The events of 9/11accelerated the development of these programs.This paper describes efforts to assess and mitigatethe vulnerabilities of drinking water utilities.  (SeeO’Neill and Hais,  this volume, for a discussion ofwastewater security issues.)  This paper coversseveral key areas, including threat assessment, watercontamination, and response effectiveness.Law Requires VulnerabilityAssessmentsOn June 12, 2002, President Bush signed thePublic Health Security and BioterrorismPreparedness and Response Act of 2002 into law(PL 107-188).  This Act requires community watersystems that serve populations of greater than 3,300persons to conduct vulnerability assessments.According to EPA statistics, approximately 4,800water utilities fit into this category.  When combined,these water utilities serve over 256 million people.Large drinking water utilities, defined as thoseserving more than 100,000 people, were required toconduct their vulnerability assessments and submita report to the EPA by March 31, 2003.  Drinkingwater utilities serving 50,000 to 100,000 people wereto conduct their vulnerability assessments and submita report by December 31, 2003.  Drinking waterutilities serving 3,300 to 50,000 people were toconduct their vulnerability assessments and submita report by June 30, 2004.Vulnerability Assessment ProcessIn cooperation with the EPA and AwwaRF,Sandia National Laboratories (Sandia) created theRisk Assessment Methodology for Water Utilitiesknown as RAM-WTM.  RAM-WTM is the most widelyUNIVERSITIES COUNCIL ON WATER RESOURCESJOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATIONISSUE 129, PAGES 8-12, OCTOBER 2004JOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATION UCOWR9Danneels and Finleyused methodology to assess security risks at largewater utilities.  Several thousand water utility owners/operators, regulators, and water industry consultantshave been trained in the use of RAM-WTM.  Othertools have been developed by other entities and wereused at several large water utilities, but were appliedmore prevalently to medium and small water utilities.Figure 1 illustrates the process followed in RAM-WTM and demonstrates the iterative nature of themethodology.  This methodology was developedthrough decades of security research anddevelopment at Sandia, initially focused on safety ofnuclear facilities.  Ideally, the entire analysis is drivenby the threats one wants to protect against.  In manyhigh-security applications, this threat level isdetermined by a federal entity (e.g., the Departmentof Energy or the Nuclear Regulatory Commission)and a designated security analyst then evaluates theeffectiveness of the security system.  Most high-security applications also employ an on-site guardforce, usually armed and well trained, to respond tomalevolent incidents.  Managers of the majority ofcivilian infrastructures do not employ a dedicatedresponse force and operate geographically distributedassets, the majority of which reside in the publicrealm.Each major block of the methodology has multiplesteps and/or requirements.  For a completedescription of RAM-WTM, please contact theAmerican Water Works Association for a copy (therequestor must demonstrate a need-to-know andmust sign a nondisclosure agreement).  AwwaRFsubscribers  may contact them directly.ResultsSandia conducted several vulnerabilityassessments during the development and validationof RAM-W TM and water utility owners/operatorsand consultants applied the methodology at severalhundred additional locations.  As a result, the watercommunity gained a good understanding of the stateof security at water utilities and identified challengesthat may lie ahead.  In a recent project, AwwaRFand Sandia teamed to collect information on thevulnerability assessments conducted by the largewater utilities to better understand (1) how well theprocess worked, (2) remaining areas of concern,and (3) what further developmental efforts to pursue(AwwaRF 2004).Defining the Threat to Water UtilitiesAlthough encouraged to contact local lawenforcement and other authorities, most waterutilities found it difficult to obtain relevant threat data.Figure 1. RAM-WTM ProcessAssessing the Vulnerabilities of U.S. Drinking Water Systems10JOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATIONUCOWRAs stated earlier, the specified threat drives the riskanalysis.  Therefore, water utilities are faced with ahigh degree of ambiguity about what the actualthreats are while having to undertake risk reductionprograms that may cost millions of dollars.  Evenwith the billions of dollars already being spent toimprove the security of our nation’s water utilities, itis questionable whether or not the utilities will beable to withstand a high-level threat.  Much of theutilities’ infrastructure resides in the public realm, isbroadly distributed, and is very difficult to protect.The Federal government has not defined a threatthat can be used as the basis of a security design forthe water infrastructure, nor is there agreement inthe water community about what threats to consider.Therefore, the water utilities analyzed a multitudeof threats and threat levels.  Neighboring waterutilities often used significantly different threat levelsduring their risk assessment.  The number ofadversaries and their projected capabilities willdramatically affect the outcome of the security riskanalysis.Contamination of Water SuppliesOne of the least understood threats to the drinkingwater industry is contamination, particularly in thewater distribution system.  At the beginning of theprogram to assess the vulnerabilities of waterutilities, very little was known about malevolent watercontamination and even fewer analytical tools wereavailable to help understand and analyze the problem.Since 9/11, several groups, including the AwwaRF,the EPA, and the Center for Disease Control, havecollaborated to collect and characterize informationon contaminants that may pose a significant healththreat in drinking water systems.  Prioritizingcontaminants, developing methods to rapidly detectthem, developing a full understanding of contaminantfate and transport, developing estimates forcontamination risks to water distribution systems,creating programs for isolating and treatingcontaminants, and final restoration of clean watersupplies are all in their early stages of development.Sandia has launched an internal research program,with collaborators at EPA, to provide tools foranswering many of these important contamination-related questions.  This research program willdevelop numerical tools to probabilistically predictthe fate and transport of a variety of potentialcontaminants and thus facilitate the development ofcontamination risk maps for water distributionsystems.  The research program will also helpdetermine optimal sensor locations for detection ofcontaminants (assuming the appropriate sensors aredeveloped) and develop analytical tools to quicklylocate where contaminants were introduced.Response to ThreatsHigh-security environments often have an on-siteresponse force to deal with malevolent threats.  Thevast majority of water utilities do not employ such astrategy.  Instead, they rely on cooperation from locallaw enforcement, public health authorities, and otherproviders of emergency services.  This is not anunusual situation within the community of criticalinfrastructures, but this approach leads to longresponse times, raising a concern about the level ofsecurity provided.Immediately after 9/11, many metropolitan areasassigned police officers at water utility assets to deteradversaries.  Due to budget constraints and a beliefthat the threat is not as imminent as previouslybelieved, this practice has been largely discontinued.RecommendationsBased on the experience of applying RAM-WTMto hundreds of water utilities, several improvementscould enhance future risk assessments.  Theseimprovements include:  a refined threat description,complete integration of the water distribution systemcontamination analysis with the risk assessment,and improved response protocols.  Naturally, theserecommendations will require resources and timeto accomplish.Because the threat level drives the riskassessment analysis and ultimately, the riskreduction recommendations, the area of threatassessment could be improved.  A variety ofapproaches may be taken, such as the following:1. Issue a mandatory threat level for all waterutilities (minimum standard) to use as the basisfor determining which risk reduction upgradesare appropriate2. Use a graded approach to implementingupgrades based on population served or someother statistic, such as volume of water shippedJOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATION UCOWR11Danneels and Finley3. Water-community-developed threat scenariosthat are graded by population4. Threat levels based on regional or targetattractivenessWhatever threat definition system is chosen,consistency and minimally acceptable threat levelsshould be created to provide a balanced approachto countering the threat.The water distribution system has long beenknown to represent one of the greatest securityvulnerabilities.  Current challenges include a lackof clear understanding of the fate and transportand consequences of potential contaminants withina water distribution system coupled with generallyeasy access into the system.  To minimize thepotential risks from a malevolent contaminationattack, it is first necessary to develop computationaltools that can predict the fate and transport ofcontaminants within distribution systems, or moregenerally, how contaminants might move in ahydraulically complex pipe network.  Thiscomputational tool must be integrated within asystematic framework (as embodied inRAM-WTM), so that a more comprehensive riskassessment can be accomplished.  Such a tool (orset of tools) (1) would be capable of determining(in a probabilistic sense) the spread of contaminantswithin a distribution system, (2) could be used toestimate consequences from such an attack, (3)would be able to identify optimum locations forearly-warning sensors, and (4) would be able toidentify the source location (point of introduction)in near-real time.  Determining the extent ofcontamination in a water distribution system in realtime is essential so that proper actions can be takento minimize the further spread of the contaminants.Methodologies for conducting vulnerabilityassessments should include a framework forcleanup and recovery. The tools to estimate thefate and transport of contaminants within a waterdistribution system could also play a significant rolein developing a methodology for recovery aftersuch an event and could serve as the instrument tointegrate both components for the protection ofdrinking water systems.Better response protocols are needed in severalareas.  Response to water contamination events isentirely different than response to an armed attackwhere the intent is to damage the utility’s physicalassets.  The current research underway tounderstand the fate and transport of contaminantswill help decision makers understand the risk andto develop new response protocols that addressthat attack before the contamination event.  Thoseprotocols must include clean-up processes andplacing the system back in service.Responding to threats may require newapproaches that greatly enhance the time anadversary needs to complete a malevolent act.Threats can be countered by storing high-consequence assets underground, limiting the pathsan adversary might exploit and thereby creatinglong task times.  For example, pumping stationscould be protected better by installing them belowgrade in protected shelters.In testimony to the United States House ofRepresentatives Committee on Science entitled“H.R. 3178 and the Development of Anti-TerrorismTools for Water Infrastructure,” Jeffrey J.Danneels of Sandia suggested several alternativesthat might provide the improved security desiredat a much lower cost than the physical securityapproaches currently in use.  Research dollarsshould be made available to study alternatives thatput final treatment of the water supply closer tothe consumer, consider much of the present potablewater system as non-potable to decentralize theimpact of a potential event, and evaluate theefficacy of creating municipal bottling facilities andother novel approaches that provide the level ofsecurity demanded by the water consumer andwhich may not be achievable through any othermeans.ConclusionsUnderstanding and analyzing the vulnerabilitieswithin the water infrastructure is a very importantundertaking.  Our government needs to protect oneof the most basic assets America has—a cleanwater supply.  Understanding and analyzing thevulnerabilities within the nation’s water infrastructurewill help us protect the health and safety of ourcitizens.  The efforts completed to date havehighlighted several vulnerabilities that will requiresignificant amounts of effort to correct.  Within thelist of 14 U.S. critical infrastructures listed in HSPD-7, the water infrastructure is probably the most takenfor granted.  A large investment will be required toprovide even minimal levels of security for thisAssessing the Vulnerabilities of U.S. Drinking Water Systems12JOURNAL OF CONTEMPORARY WATER RESEARCH AND EDUCATIONUCOWRimportant resource.  “When is enough, enough?”will be a difficult question to answer and will bedebated for years to come.AcknowledgementsSandia is a multiprogram laboratory operated by SandiaCorporation, a Lockheed Martin Company, for the United StatesDepartment of Energy under Contract DE-AC04-94AL85000.Author Bio and Contact InformationJEFFREY J. DANNEELS is a Department Manager within theSecurity Systems and Technology Center at Sandia NationalLaboratories. He manages critical infrastructure securityprograms and is responsible for the Risk AssessmentMethodology for Water Utilities, RAM-W™. Shortly after theevents of 9/11 he testified to Congress on two occasions. Hisfirst testimony concerned the security of the water infrastructureand in the second he outlined security research needs to betterprotect the water infrastructure. Mr. Danneels has providedsecurity training to hundreds of students and led thedevelopment of a security course for water utility employeesthat has been attended by thousands. Mr. Danneels was theProgram Director for the international Innovative Technologiesfor Disaster Mitigation conference held in Washington, DC inOctober of 1999. This three-day Architectural Surety®conference provided a forum for experts from around the worldto exchange information on mitigating the consequences of naturaland man-made disasters. He holds a BSCE from Michigan StateUniversity, a MSCE from Louisiana State University, and aMasters in Management from the University of New Mexico.Jeff has been with Sandia since 1985. Jeffrey J. Danneels, SandiaNational Laboratories, PO Box 5800, Albuquerque, NM 87185,Phone: 505-284.3897, FAX: 505-284-8677,jsdanneels@sandia.govRAY FINLEY is the Manager of the Geohydrology Department atSandia National Laboratories in Albuquerque, New Mexico. Hehas evaluated security aspects related to Sandia’s criticalinfrastructure program since the mid-1990’s. He participated inthe development of methodology for evaluating thevulnerabilities of large federal dams, electrical transmissionsystems, and drinking water systems. In this role he has led andparticipated in numerous vulnerability assessments, trainingprograms, applications of the methodologies, and vulnerabilityassessment reports. He continues to be actively engaged inassessing vulnerabilities of critical infrastructures, includingphysical disruption and contamination of water distributionsystems.ReferencesAwwa Research Foundation. 2002.  Risk AssessmentMethodology for Water Utilities (RAM-WTM). 2nd ed. Denver,Colorado: Awwa Research Foundation and Sandia NationalLaboratories.Awwa Research Foundation. 2004. Results from the Water UtilityVulnerability Assessment Lessons Learned Study. Denver,Colorado: Awwa Research Foundation and Sandia NationalLaboratories.Environmental Protection Agency. n.d. FACTOIDS:  DrinkingWater and Ground Water Statistics for 2001. Available athttp://www.ngwa.org/pdf/01factoids.pdf.

Assessing the Vulnerabilities of U.S. Drinking Water Systems

http://opensiuc.lib.siu.edu/cgi/viewcontent.cgi?article=1077&context=jcwre

Assessing the Vulnerabilities of U.S. Drinking Water Systems

Abstract

Similar works

Full text

Available Versions

OpenSIUC