State of Infrastructure Security: Protecting

State of Infrastructure Security: Protecting Water Lifelines From Physical and Cyber Threats

Twenty years after 9/11 the challenges to maintain normal operation of water and wastewater systems continue to increase as the water sector works to improve drinking water security and resilience

A Louisiana National Guard soldier distributes food and water to citizens in the wake of Hurricane Ida in Westwego, La., on Sept. 1, 2021. (U.S. Army National Guard photo by Sgt. Renee Seruntine) Alan Roberson

Imagine that it’s Monday morning and you’re in your kitchen filling up the coffeemaker before starting the work week and nothing comes out of the tap. Now imagine by Friday you still have no water—not for coffee, your morning shower, your cooking and cleaning, or to flush toilets. Imagine for five days being unable to do these mundane activities you’ve come to take for granted every day—and that’s just the impact to you, personally. Without water and wastewater service many businesses can’t open, and eventually, an entire community’s ability to function begins to degrade.

The fact remains that drinking water is fundamental to life and our expectation is to have this convenient service (along with wastewater) at our fingertips every minute of every day of every year. When it’s gone, it’s not only extremely disruptive to us individually, but its absence also threatens everything around us..

Legislation Addresses Security

Twenty years after 9/11, the challenges to maintain normal operation of water and wastewater systems continue to increase as the water sector works to improve drinking water security and resilience. In response to the terrorist attack, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (P.L. 107-188) was passed on June 12, 2002. This legislation amended the Safe Drinking Water Act (SDWA) and required approximately 8,400 community water systems serving greater than 3,300 people to conduct vulnerability assessments (VAs) and prepare emergency response plans (ERPs). This legislation authorized (but didn’t appropriate) funding for preparing the VAs and ERPs and for emergency grants to states and utilities.

This legislation directed the U.S. Environmental Protection Agency (EPA), not the Department of Homeland Security (DHS), to review methods to prevent, detect, and respond to threats to water safety and infrastructure security. The EPA set up a water security division (WSD) and focused its initial efforts on foreign and domestic terrorist threats, improving physical security, and detecting intentional contamination by adversaries. This legislation did not require water systems to make security upgrades to address potential vulnerabilities, but many water systems made physical security improvements, such as improving access control to their facilities.

In the same time frame, DHS identified 16 critical infrastructure sectors where assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, the national economy, and public health and safety. Water and wastewater systems are one of the 16 sectors, and guidance and resources have been developed by DHS and EPA to assist systems in improving security and resilience—but there is much more to do.

As the water sector increased its knowledge on security and resilience, and there were zero (or a limited number) of incidents of physical attacks or intentional contamination, it became apparent that an all-hazard approach was needed that addressed extreme weather events, such as hurricanes, flooding, ice storms, wildfires, etc., as well as cybersecurity and other threats. The water sector then established water/wastewater response networks (WARNs) across the U.S. to provide a system for “utilities helping utilities” in the aftermath of an extreme weather event. In many cases, the WARNs have been effective ways to bring people and equipment in to assist prior to the arrival of federal resources and to aid in navigating the federal process for reimbursement of response and recovery expenditures.

Extreme weather events occur on a regular basis and Hurricane Ida and its impacts on water systems in Louisiana are the latest example. As of Sept. 11, 2021 (12 days after Ida made landfall), at 3 p.m., CDT, according to the Louisiana Department of Health website, the impacts to its water systems included: S 217 water systems serving 822,246 people were cleared of boil water advisories. S 91 water systems serving 326,226 people were on boil water advisories. S 18 water systems serving 19,661 people had water outages, i.e., no water service.

These statistics show the power of extreme weather events to impact water systems, even in areas like Louisiana that are used to hurricanes. They know better than most how to prepare and how to respond, but there’s only so much a utility can do with 150-mile-per-hour winds, several inches of rain, and substantial power outages. Supplies of treatment plant chemicals also became an issue in the aftermath of Ida. The strength of Ida created water service impacts for approximately 25 percent of Louisiana’s population and considerable impacts to water and wastewater systems in other neighboring states.

Improving Operations

System resilience goes beyond response and recovery into design and operational issues that also need improvements. Remember that EPA’s focus, as defined by the SDWA, is ensuring that these systems meet the standards for more Continued on page 54

Continued from page 53 than 90 regulated contaminants. Meeting the standards is essential for public health protection, but having an adequate water source is part of the equation. Approximately half of those systems serve fewer than 500 people, and it’s likely that most, if not all, of them are groundwater systems with a single well and single storage tank. With only a single source of water, the well pump can’t be pulled and maintained as it should be, and the well casing and screens also can’t be checked and maintained.

While it’s a small system issue, it becomes a big problem in the community when there’s no drinking water. Additionally, there are no federal requirements for backup power, nor are there state-level requirements for backup power, and fuel storage for generators varies from state to state.

Time marches on, and Congress responded to the increasing number and diversity of threats to water systems with another round of legislation. The America’s Water Infrastructure Act (AWIA) was passed on Oct. 23, 2018, and AWIA Section 2013 required approximately 10,000 community water systems serving greater than 3,300 people to develop or update risk and resilience assessments and their ERPs. The law specifies the components that these assessments and ERPs must address and establishes deadlines by which water systems must certify to EPA completion of the risk and resilience assessment.

Current Challenges

After two rounds of federal legislation and two cycles of assessments and ERPs, where are we today in the water sector? The short answer is that we are still facing many, many challenges.

First, a significant challenge is the sheer number of public water systems. There are more than 150,000 public water systems and more than 50,000 community water systems (CWS) where people live and work every day. Another challenge is that the most CWS are publicly owned and become easily tangled up in politics and resistance to raising rates to buy “insurance,” i.e., to make improvements to protect against low-probability events.

Second, neither round of federal legislation nor the systems’ assessments required systems to make any improvements to address any of the vulnerabilities that were identified. It’s up to the governing board or the city council to make the financial decisions on whether to invest in the necessary security and resiliency improvements. Progress on these improvements is unknown.

Third, after 9/11, many states passed exceptions to the Sunshine Act or other public disclosure laws for security information. These protections are logical, as one wouldn’t want adversaries to know the strengths and weaknesses of any system’s security improvements, but these protections present challenges for federal and state regulators to understand the breadth and depth of potential security problems. The national scope of the problems is unknown; what, for instance, is the total national need (cost) for security and resiliency improvements?

Fourth, there is no systematic reporting of security breaches and outages at water and wastewater systems, other than at the state level as previously discussed for the recovery from Hurricane Ida in Louisiana. When there is a power outage in an area, sometimes the system has adequate backup power and enough fuel to sustain the generators during the outage, but in a sustained power outage maintaining an adequate fuel supply can be problematic. There is no systematic reporting of impacts to water and wastewater systems during power outages and there is a legitimate issue on what the data would be used for if collected.

Fifth, an understanding of the relative risks of the threats (physical destruction versus intentional contaminant versus cyberattacks) is needed to prioritize investments in improvements so that the most-likely risks are addressed. Research is needed on how to harden water and wastewater infrastructure in a cost-effective manner.

Finally, cybersecurity in the water sector has emerged as a top priority in the past couple of years. In 2019 and 2021, well-publicized incidents in Ellsworth, Kan., and in Oldsmar, Fla,, respectively, are prime examples. The media carried the story of the 2021 indictment of a former employee in Ellsworth, and law enforcement held a news conference in Oldsmar to report the attack (no indictments yet), but many other cyberattacks in the water sector don’t make the news and we don’t know how many attacks occur or how significant the attacks are to system operations.

Increased automation in water and wastewater systems has improved efficiency, but it has also increased the risk of cybersecurity attacks. The water sector is lacking a baseline estimate of how many systems have remote access, but it’s likely at least 50 percent. Cybersecurity tools and resources have been developed by EPA and others, such as the American Water Works Association (AWWA), but it’s unclear how many systems have taken advantage of these resources or made any of the improvements noted in a cybersecurity assessment.

Moving Forward

So, what’s next for the water sector? Several questions need to be answered in a collaborative manner, so that everyone agrees with the path forward for improving security and resilience in the water sector: S What are the greatest risks for water and wastewater systems? Is the risk for each system site-specific? S What have systems done already to lower those risks? What improvements remain?

How much would those improvements cost? S How many water systems have a single source of supply? How would emergency water be supplied if that source failed?

How long could that emergency supply be sustained? S How many systems have full backup power?

Who would look at the data if collected?

What would be the resultant actions from this data collection? S Do we need a national reporting system of system breaches and cyberattacks? Who would look at this data? What would be the resultant actions from this data collection? S How do we best increase cybersecurity skills and knowledge across the water sector? S How do we best reduce the cybersecurity risks to water and wastewater systems? S Are the ongoing treatment plant chemical supply issues solely related to the

COVID-19 pandemic or are they indicative of a more systemic problem? S How could we optimize the federal/state/ local response to extreme weather events?

These questions may sound simple, but they represent a staggering research agenda that needs significant federal funding for making progress on the necessary security and resiliency improvements to our water and wastewater systems. A coordinated effort is needed as soon as possible, as it’s critical that the speed of the progress be increased through collaboration between federal and state agencies and water and wastewater systems. The alternative—to stay with the status quo—means that the water sector will continue to make slow and steady progress on improving security and resiliency, while many more extreme events occur. This will likely leave communities without water, which will continue to destabilize their economies and the lives of the people within them.

Alan Roberson, P.E., is executive director of Association of State Drinking Water Agencies in Arlington, Va. This article was first published by Homeland Security Today. S