»> OFFiCf OF INSPECTOR. GENERAL
Evaluation Report
cV
EPA's Final Water Security Research
and Technical Support Action Plan
May Be Strengthened Through
Access to Vulnerability Assessments
Report No. 2004-P-00023
July 1,2004
*•>?"
-------
Report Contributors:
Erin Barnes-Weaver
Fred Light
Ricardo Martinez
Erin Mastrangelo
Abbreviations
EPA
ORD
OW
Environmental Protection Agency
Office of Research and Development
Office of Water
-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
OFFICE OF
INSPECTOR GENERAL
MEMORANDUM
SUBJECT:
FROM:
TO:
July 1,2004
Evaluation Report:
EPA's Final Water Security Research and Technical Support Action Plan
May be Strengthened Through Access to Vulnerability Assessments
Report No. 2004-P00023
Jeffrey K. Harris /<*/
Director for Program Evaluation, Cross-Media Issues
Paul Oilman
Assistant Administrator for Research and Development
Benjamin Grumbles
Acting Assistant Administrator for Water
Attached is a copy of the subject final report. During our ongoing evaluation of the
Environmental Protection Agency's (EPA's) activities to enhance the security of the Nation's
water supply, we noted an issue mat requires your immediate attention. Specifically, we believe
EPA's Office of Research and Development (ORD) should promptly request and be granted
access to the utility vulnerability assessments being prepared pursuant to the Public Health
Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act). These
vulnerability assessments may better enable ORD to assure that EPA's Water Security Research
and Technical Support Action Plan (Research Action Plan) appropriately considers needs
identified by water utilities.
We propose this action because, during our preliminary research,1 we learned that the draft
Research Action Plan may be finalized without ORD's considering potentially useful data in the
vulnerability assessment on water security needs. EPA has already initiated several research
projects, and half of the 3-year life of the National Homeland Security Research Center
responsible for executing the Plan has already expired (although extending the center's life is
being considered). We are reporting this issue at this time because of the time-critical nature.
The EPA Office of Inspector General conducted preliminary research evaluating water system security
activities in support of the Agency's Strategic Plan for Homeland Security.
1
-------
We based our observations and recommendations on information obtained from our interviews
with water security experts, water utility officials, Research Action Plan stakeholders, and
headquarters and regional EPA representatives; attendance at stakeholder and peer review
meetings; and a review of vulnerability assessment tools, methodologies, and related documents.
We are performing our evaluation in accordance with the Government Auditing Standards,
issued by the Comptroller General of the United States. We began our review on June 16, 2003,
and our review is continuing.
EPA's response to our draft report sufficiently addressed the report recommendations; therefore,
no additional response is necessary.
Background
In 1998, Presidential Decision Directive 63 addressed the need to protect the Nation's critical
infrastructures against criminal and terrorist attacks, and designated EPA the lead Federal agency
for water infrastructure. In December 2003, Homeland Security Presidential Directive 7
confirmed EPA's role as the lead agency for drinking water and water treatment systems. Water
protection concerns greatly increased following the terrorist attacks on September 11, 2001, and
subsequent reports of potential terrorist activities that could threaten the water infrastructure.
EPA's September 2002 Strategic Plan for Homeland Security stated, "EPA will advance the
state of knowledge in the areas relevant to homeland security to provide responders and decision
makers with tools and the scientific understanding they need to manage existing or potential
threats to homeland security."
EPA's Office of Water (OW) formed a Water Protection Task Force2 shortly after the
September 11,2001, terrorist attacks, and ORD formed the National Homeland Security
Research Center in September 2002. The OW task force and ORD research center jointly
developed the Research Action Plan. To develop the Plan, they held a series of meetings with
Federal partners and other select stakeholders, and submitted the Plan to a review panel at the
National Academies of Science on April 22, 2003. EPA's Research Action Plan sought to
identify and prioritize critical drinking water and wastewater security research needs, to provide
a road map to enhance the protection of the Nation's water systems from potential threats or
deliberate attacks. EPA estimates that it will require $43.6 million to fund needed research
projects.
-------
automated systems which are utilized by the public water system, the use, storage, or handling of
various chemicals, and the operation and maintenance of such system."3
ORD Should Access Utility Vulnerability Assessments
to Validate its Research Need Priorities
Despite the breadth, expense, and proximity of the vulnerability assessments conducted by water
utilities, ORD had not requested access to these assessments as of May 21, 2004, even though
the assessments could provide ORD with valuable information for updating the Research Action
Plan. Copies of the assessments are stored by OW's Water Security Division, and ORD would
need to request access to those secured documents in order to review them. However, ORD had
not requested such access from OW. We believe ORD's reviewing those vulnerability
assessments may provide it with additional information on needs identified by water utilities.
That information could then be used to make the Research Action Plan for addressing potential
terrorist attacks more protective of public health and the environment.
*
The direct utilization of the vulnerability assessments to identify water security research needs
has been advocated by internal and external stakeholders. EPA's Director for Ground Water and
Drinking Water cited vulnerability assessments as a source of research and development topics
as early as February 2003. Access was also advocated in an October 2003 General Accounting
Office Report,4 which noted that 90 percent of a group of nationally recognized water security
experts agreed or somewhat agreed that research allocation decisions should be based on
vulnerability assessment information. Further, in 2004, a member of the National Academy of
Science's Research Action Plan review panel stated:
The vulnerability assessments provide information that could provide guidance.
It will provide EPA an opportunity to address vulnerabilities instead of guessing
what they are. It will provide assurance that all that needs to be considered have
been considered or we risk leaving our self at risk. Access to the vulnerability
assessments would strengthen whatever plan is developed.
It should be noted that, in May 2003, EPA awarded a contract for a review of vulnerability
assessments, but this review did not include concerns related to EPA's Research Action Plan. In
December 2003, EPA amended the contract and included tasks for the contractor to address the
concerns of others. As a result, ORD submitted a list of questions relating to EPA's Research
Action Plan. However, the contractor responded that many of ORD's questions could not be
answered or could only be partially answered based on the data available in the assessments and
the level of contractor effort required. An EPA official said another contract amendment would
be necessary to complete ORD's review. This problem may have occurred, in part, because
ORD's inability to review at least a sample of the vulnerability assessments prevented ORD
3Public Law 107-188 - June 12, 2002; Title IV Section 1433 (a)(l).
4 GAO-04-29, "Expert's Views on How Future Federal Funding Can Best Be Spent to Improve Security,"
October 2003.
-------
I
officials from knowing what type of information was contained in the assessment and, thus, the
appropriate questions to ask.
Recommendations
To better ensure that the final Research Action Plan appropriately incorporates the breadth of the
Nation's water security needs, we recommend that:
1. ORD immediately request, and OW immediately grant to ORD officials responsible for
developing, prioritizing, and implementing critical water security research projects,
access to vulnerability assessments provided by utilities. Once granted access,
appropriate ORD officials should review the vulnerability assessments to determine the
extent to which EPA's Research Action Plan addresses utilities' most significant
vulnerabilities.
2. If ORD wishes to use a contractor for the vulnerability assessment review relating to
EPA's Research Action Plan, ORD should immediately request access to a sample of
vulnerability assessments to enable it to more effectively formulate questions for
contractor review, and OW should expedite a contract amendment to have the contractor
address ORD's additional questions.
Agency Response and Office of Inspector General Evaluation
In its response to our draft report, EPA agreed with the intent of our recommendations. EPA's
response included a corrective action plan, with milestone dates, which adequately addressed the
problems identified. We commend EPA for its continued efforts and quick action. The full
Agency response is provided in Appendix A.
If you or your staff have any questions, please call me at (202) 566-0831 or Ricardo Martinez at
(212)637-3045.
-------
Appendix A
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
MEMORANDUM
June 25, 2004
SUBJECT:
FROM:
TO:
Response to Office of Inspector General Draft Evaluation Report:
EPA's Final Water Security Research and Technical Support Action
Plan
May be Strengthened Through Access to Vulnerability Assessments
Assignment No. 2003-001288
Paul Oilman 14 P
-------
and OW should expedite a contract amendment to have the contractor
address ORD's additional questions.
We understand that the intent of your recommendations is to assure that EPA's Research
and Technical Support Action Plan (Action Plan) appropriately considers the security needs
identified by water utilities.
EPA's Office of Research and Development (ORD) has always had interest in accessing
the vulnerability assessments (VAs) for research and technical support needs to inform the
Action Plan; and EPA's Office of Water (OW) has been supportive of this interest. When access
was not immediately available, ORD and OW convened a meeting of water security stakeholders
to identify the most important issues associated with protecting water infrastructure. Information
was also received through a review of the Action Plan by the National Academies. Further,
National Homeland Security Research Center staff served on an advisory committee for a project
sponsored by the American Water Works Research Foundation. This project was designed to
better understand water infrastructure vulnerabilities. It involved group discussions between
consulting engineers who prepared the VAs and water utilities on the most important findings
from their efforts. Through this series of activities, ORD concluded this was the most efficient
way to gather information on water utility vulnerabilities.
While we are confident that the process our offices have used to develop the Action Plan
has been conducive to accurately identifying the utilities' highest priority security needs, we
agree with the intent of the recommendations. Our offices will take the necessary steps to
implement the above two recommendations and review a sample of the vulnerability
assessments.
As you pointed out in your memorandum and in preparation for ORD's review of the
vulnerability assessments, OW is evaluating the questions ORD posed regarding the potential
research needs contained in the vulnerability assessments. ORD has identified individuals with
the necessary security clearances for which access to vulnerability assessments has been
requested. OW is prepared to immediately grant access to the vulnerability assessments to these
individuals to expedite the ORD review process. In order to facilitate implementation of the
second recommendation, OW has already extended its original contract to allow for the
continuation of work in the event that the initial review of a sampling of vulnerability
assessments by ORD officials determines that additional contractor review is feasible and
advisable.
While we are confident that the process our offices have used to develop the Action Plan
has been conducive to accurately identifying the utilities' highest priority security needs, we
agree with the intent of the recommendations. Our offices will take the necessary steps to
implement the above two recommendations. ORD will work with OW to review a sample of the
VAs to determine their value in providing this information. ORD is not in a position to devote
scarce resources on a lengthy review of limited value; therefore, a more extensive review of the
VAs will be decided after this sampling is completed and evaluated.
-------
Please be assured that we are fully committed to meeting the Nation's water security
needs in the most effective and efficient way possible. ORD and OW are already implementing
the recommendations; thus, we are attaching our corrective action plan. We respectfully request
that the OIG close this audit upon issuance of the final report.
Thank you again for the opportunity to comment on the subject draft report. Should your
staff have any questions, or require additional information, please contact Jonathan Herrmann on
(513) 569-7839 or Terry Simpson on (202) 564-0968.
Attachment
t
cc: Henry L. Longest II, ORD
William Farland, ORD
Lek Kadeli, ORD
Jim Morant, ORD
Alice Sabatini, ORD
Tim Oppelt, ORD
Andy Avel, ORD
Jonathan Herrman, ORD
Terry Simpson, ORD
Michael Shapiro, OW
Cynthia Dougherty, OW
Nanci Gelb, OW
Janet Pawlukiewicz, OW
Debbie Newberry, OW
Cynthia Simbanin, OW
Mike Mason, OW
-------
n
8
, S
*•* *rm i/l "7?
• « > X "^
« *3 «J X> CO ^
i SrSa « « •
sS-9'E^l
s i* -a « ?s a '
J b^ D C »S «
! S tfl ° ^
1 § 1' ~
11.1
-------
Appendix B
Distribution
Assistant Administrator, Office of Research and Development (8101R)
Acting Assistant Administrator, Office of Water (4101M)
Comptroller (2731 A)
Agency Followup Official (the CFO) (271OA)
Agency Audit Followup Coordinator (2724A)
Audit Followup Coordinator, Office of Research and Development (8104R)
Audit Followup Coordinator, Office of Water (4101M)
Associate Administrator for Congressional and Intergovernmental Relations (1301 A)
Associate Administrator for Public Affairs (1101 A)
Inspector General (2410)
-------
-------
|