Developing a National Program to Protect Our Nation’s Water Systems

Threats to our water sector pose one of the more formidable risks to the safety and security of our Nation. Critical components of our water sector infrastructure are unprotected and thus represent attractive targets for attacks that could include chemical, biological and/or radiological (CBR) contamination, physical damage, or threats to supervisory control and data acquisition (SCADA) systems. Successful attacks against a water system could result in serious consequences to human health through contamination of drinking water. Such attacks also could adversely impact critical community capabilities including firefighting, healthcare, and wastewater conveyance or treatment capability.

The U.S. Environmental Protection Agency (EPA) has been given the important mission of protecting all critical infrastructures across the water sector. Much has already been accomplished, following directions established in the Agency’s Strategic Plan for Homeland Security. As research programs called for in the Water Security Research and Technical Support Action Plan come to fruition, EPA’s water security program likely will move in new directions as well. Immediate pressing programmatic challenges for EPA include:

• Refining a strategic plan that leads to an effective culture of security in the water sector and measurable security improvements
• Selecting an appropriate mix of voluntary and regulatory program measures and standards to motivate water utilities and publicly owned treatment works to improve security
• Developing technically sound recommendations for water sector monitoring, operations, and response.

In many ways, EPA is encountering a similar situation to that faced by the U.S. Department of Energy (DOE) several years ago. Battelle’s experience in supporting DOE in developing its national security program for the nuclear weapons complex provides key insight to what may lie ahead for the water sector security program.

During the initial development of the DOE program, the critical importance of institutionalizing oversight in the development and implementation of the security program became quite evident. This allowed one organization to have the responsibility, authority, and resources to lead the program and institute the changes needed to ensure success. The adoption of a standardized Developing a National Program to Protect Our Nation’s Water Systems vulnerability assessment process ensured that all facilities approached security risk from the same perspective. This allowed DOE to make comparisons between facilities in order to address issues related to common strengths and weaknesses. Many lessons were learned during the evolutionary process of developing a comprehensive security program for DOE that are applicable to EPA’s efforts in water security.

An important part of the process is to develop an understanding of the assets that require protection—including the consequences associated with the loss or compromise of those assets. The relative focus of asset protection efforts must be in proportion to the consequence of loss. By developing a design-basis threat and tailoring that threat accordingly to various facilities, one can determine the level of effort needed to overcome the postulated threats to various assets. Using a graded approach in the design of the security programs at the different facilities will help to ensure a cost-effective approach for developing a comprehensive overall security program.

Physical security design criteria and program elements need to be standardized and tailored to meet the needs of the different levels of security required for the types of facilities within the water sector. This ensures that resources are assigned on a priority basis (according to where the need is greatest). Performance testing should be conducted, where appropriate, to ensure that security programs have been designed and implemented effectively. The assumptions upon which the security programs are based should be regularly revisited in order to provide continuous improvement and risk reduction. Finally, by making every employee an integral part of the security program, a sense of ownership is achieved, which is necessary to ensure long-term success.

In summary, Battelle’s experience with DOE has taught us that a successful security program is fully integrated into the design, maintenance, and operation of each and every facility. Through a graded process of continuous reassessment and incremental improvement, security, like any other quality assurance goal, is attainable by even the smallest water utility. Battelle has a long and distinguished history of supporting homeland security, many years before the events of September 11, 2001. We have included in this issue of Environmental Updates some examples of our relevant technical expertise and experience that contribute to the security of our Nation’s water systems.