A Water Security Handbook:
   Planning for and Responding to
   Drinking Water Contamination
   Threats and Incidents

-------
Printed on Recycled Paper

-------

Note to Readers: The U.S. Environmental Protection Agency (EPA) prepared this
guide to help you enhance the security of your water system. This document does not
impose legally binding requirements on EPA, states, tribes, or the regulated community,
and it may or may not apply to a particular situation, depending on the circumstances.
EPA and state decision-makers retain the discretion to adopt approaches on a case-by-
case basis that may differ from this guide where appropriate. Any decisions regarding a
particular community water system should be made based on the applicable statutes and
regulations.  Therefore, interested parties are free to raise questions and objections about
the appropriateness of the application of this guide to a particular situation, and EPA will
consider whether the recommendations or interpretations in this guide are appropriate in
that situation based on the law and regulations. EPA may change this guide in the future.
To determine whether EPA has revised this guide or to obtain additional copies, contact
the Safe Drinking Water Hotline at 1-800-426-4791 or visit the EPA's Water  Security
website at www.epa.gov/watersecurity.
                               Water Security Handbook

-------
Table  of Contents
 L
 O
   1st of Acronyms and Abbreviations	v
    verview	1

 What is the Water Security Handbook?	1
 Why Is This Handbook Important?	2
 How Can This Handbook Help Me?	2
 Who Should Read This Handbook?...                                                ...3
1.
      Water Utility Planning Guide	4
  Introduction	4
  Why is Water Security Planning Important?	4
  What Are Contamination Threats and Contamination Incidents?	4
  Should We Be Concerned About Contamination Threats and Contamination Incidents?	5
  Is Intentional Contamination Possible or Probable?	6
  How Serious Could Intentional Water Contamination Be?	6
  What is Due Diligence?	7
  How Do I Prepare For A Contamination Threat or Incident?	7
 2
   •  Contamination Threat Management Guide	10
  Introduction	10
  Roles and Responsibilities	11
  Federal Roles:  The National Response Plan (NRP)	11
  Federal, State and Local Roles: The National Incident Management System (NIMS)	12
  Federal, State and Local Roles: The Incident Command System (ICS)	12
  Local Role: Incident Command at the Water Utility	13
  Federal, State and Local Roles: Unified Command	14
  Your Role and Responsibilities	15
  A General Plan forThreat Response and Threat Management	18
      Step 1: Decide if the Threat is 'Possible'	19
      Step 2: Determine if the Threat is 'Credible' and Protect Public Health	21
      Step 3: 'Confirm' the Threat	23
      Step 4: Remediate the Affected Water System	24
      Step 5: Recovery of the System	25
                                Water Security Handbook

-------
 .,/ •  Site Characterization and Sampling Guide	26

  Introduction	26
  Investigating the Site	26
  Who Does the Site Characterization and Sampling?	27
  Ensuring Safety and Protection for Personnel	27
  What Does Site Characterization Involve?	27
  Initial Hazard Assessment Before Entering the Site	28
  Approaching the Site and Doing a Field Safety Screening	29
  Characterizing the Site	30
  Collecting Samples	31
  Exiting the Site	31
4.
      Analytical Guide	32
 Introduction	32
 What Do I Need to Know About Laboratory Analyses?	32
 Safety Considerations for Water Utilities and Others	33
 Types of Labs and Analyses Performed	33
 Non-Utility Laboratories That Perform Chemical Analyses	34
 Non-Utility Laboratories That Perform Biological Analyses	35
 Obtaining High-Quality Lab Results	35
 Approaches to Analytical Screening For Unknown Contaminants	36
 Why Analytical Laboratories Should Plan for Threat Response	38
5
      Public Health Response Guide	39
  Introduction	39
  Response Planning for Protection of Public Health	39
      Step 1.  Plan the Public Health Response Before a Threat Occurs	39
      Step 2.  When a Threat or Incident Occurs, Determine the Public Health Consequences ...41
      Step 3.  Carry Out Operational Response Actions	42
      Step 4.  Notify the Public	43
      Step 5.  Provide an Alternate Water Supply for the Short Term	44
                                 Water Security Handbook

-------
6,
       Remediation and Recovery Guide	45
  Introduction	45
  Who is Responsible?	45
  Remediation and Recovery	46
       Step 1.  Find an Alternate Water Supply for the Long Term	46
       Step 2.  Do a System Characterization and Feasibility Study	46
       Step 3.  Do a Risk Assessment	46
       Step 4.  Evaluate Remediation and Rehabilitation Alternatives	46
       Step 5.  Choose the Right Remediation Technology	47
       Step 6.  Design the Remediation	47
       Step 7.  Do the Remediation	47
       Step 8.  Do Post-Remediation Monitoring	47
       Step 9.  Communicate With the Public to Restore Confidence	47
  The Final Step - Full Recovery	47
 F
   inal Thoughts	48
      ossary of Terms	49
       itional Resources	54
 L
   ist of Contacts for States, Commonwealths, and Territories	58
 L
   ist of EPA Regional Contacts	61
iv                                Water Security Handbook

-------
List  of Acronyms and Abbreviations
   ATSDR       Agency for Toxic Substances and Disease Registry
   CDC         Centers for Disease Control and Prevention
   CWC         Chemical Weapons Convention
   DHS         U.S. Department of Homeland Security
   DOE         U.S. Department of Energy
   EOC         Emergency Operations Center
   EPA          U.S. Environmental Protection Agency
   ERP          Emergency Response Plan
   ETV          Environmental Technology Verification Program
   FBI           Federal Bureau of Investigation
   FEMA        Federal Emergency Management Agency
   FOIA         Freedom of Information Act
   FRMAC       Federal Radiological Monitoring and Assessment Center
   Handbook     this Water Security Handbook
   HazMat       Hazardous materials specialists, including specialists from government agencies and
                 private contractors
   HHS         U.S. Department of Health and Human Services
   HSIN-CS      Homeland Security Information Network for Critical Sectors
   ICS           Incident Command System
   LEPC         Local Emergency Planning Committee
   LRN          Laboratory Response Network
   MOU         Memorandum of Understanding
   NEMI        National Environmental Methods Index
   NEMI-CBR    National Environmental Methods Index for Chemical, Biological and Radiological
                 Contaminants
   NHSRC       National Homeland Security Research Center
   NIC          National Incident Management System (NIMS) Integration Center
   NIH          National Institutes of Health
   NIMS         National Incident Management System
   NRC         National Response Center
   NRP          National Response Plan
   NRT          National Response Team
   QA/QC       Quality Assurance and Quality Control
   Toolbox       Response Protocol Toolbox: Planning For and Responding to Drinking Water Contamination
                 Threats and Incidents
   TSWG        Technical Support Working Group
   TTEP         Technology Testing and Evaluation Program
   USAMRIID    U.S. Army Medical Research Institute for Infectious Diseases
   USCG        United States  Coast Guard
   WaterlSAC     Water Information Sharing and Analysis Center
   WaterSC      Water Security Channel
   WCIT        Water Contaminant Information Tool
   WMD        Weapons of Mass Destruction
   WUERM      Water Utility Emergency Response Manager
                                 Water Security Handbook

-------

-------
 Overview
What is the Water Security Handbook?
    As a water utility manager, your role in
    water security planning and threat response
is critically important.  This Water Security
Handbook was developed by the U.S. EPA to
help you, the water utility official, protect your
water system and respond effectively to threats
and contamination incidents involving your
water system.

EPA also wrote this Handbook in response
to calls for a short, simplified document that
summarizes the comprehensive document
entitled Response Protocol Toolbox: Planning For
and Responding to Drinking Water Contamination
Threats and Incidents (also known as the Response
Protocol Toolbox).

The Handbook is also intended to be a
companion to EPA's Response Protocol Toolbox:
Planning For and Responding to Drinking Water
Contamination Threats and Incidents: Response
Guidelines. The Response Guidelines provides
many forms and checklists to help you organize
and carry out your emergency  response and
planning efforts.  This Handbook describes the
                        basic concepts and procedures involved in water
                        security planning and threat response. Together,
                        the Handbook and Response Guidelines provide
                        succinct recommendations concerning water
                        security planning and response actions.

                        While the Response Protocol Toolbox is aimed at
                        all utilities, agencies and other organizations that
                        may be involved in responding to drinking water
                        threats and incidents, this Handbook is aimed
                        primarily at water utility managers and staff.
                        This Handbook should help you to:

                          • Understand the "basics" of responding to
                           contamination threats and incidents;
                          • Plan for responding to water contamination
                           threats and contamination incidents;
                          • Learn about key concepts of water security
                           covered  in the Response Protocol Toolbox; and
                          • Learn how to use the Response Protocol
                           Toolbox, the Response Guidelines, and other
                           available tools to help you provide water
                           security.
   You can use this Handbook as a guide to the Response Protocol Toolbox, because chapters
   in this Handbook correspond to modules in the Toolbox:
   Handbook
   Chapter
    1
    2
    3
    4
    5
    6
Toolbox
Module
  Water Utility Planning Guide
  Contamination Threat Management Guide
  Site Characterization and Sampling Guide
  Analytical Guide
  Public Health Response Guide
Rasponse Protocol Toolbox •
Planning for and Responding to
Drinking Water Cc**1afnmauon
Threals and Iซ
-------
         Why Is This Handbook Important?    How Can This Handbook Help Me?
O
         Contamination of a drinking water system
         can cause illness, disease, or even death. A
         water system can be contaminated, damaged
         or disrupted through intentional terrorist or
         criminal actions or by an accident. Intentional
         contamination poses one of the most serious
         threats to a water system because of the intent
         to harm human health or cause damage. When
         a contamination threat is received or a
         contamination incident happens, it is critical
         that you act quickly and effectively to protect
         public health and the environment.

         This Handbook should help you to develop
         your own utility's plan for quickly and
         effectively responding to contamination threats
         or contamination incidents, even in situations
         where information may be limited.
            This Handbook should help you in the following
            ways:

              • Help you to plan for unforeseen emergencies
               involving your water system;
              • Help you to review and improve your water
               utility's Emergency Response Plan (ERP) on
               an ongoing basis to address contamination
               threats and intentional incidents. Federal
               law required that drinking water systems
               serving more than 3,300 customers develop
               an ERP (see the "Public Health Security and
               Bioterrorism Preparedness and Response Act
               of 2002", also known as the Bioterrorism
               Act of 2002). Although the deadlines for
               certifying ERPs for approval have passed,
               all utilities should continue to review and
               improve their plans as their water system
               infrastructure, staff, technology and
               capabilities change.
              • Provide pointers on how to respond to
               contamination threats and incidents; and
              • Introduces and summarizes the more
               comprehensive Response Protocol Toolbox.

            Please note that this Handbook provides
            general advice and general procedures for
            responding to a water system contamination
            threat or contamination incident.  Because
            every water system and incident will be
            different, it would be impossible to develop a
            one-size-fits-all emergency response template.
            The steps described in this Handbook are
            recommendations, not rules.

            Although this Handbook is not a regulatory
            document nor is it a template for an Emergency
            Response Plan, it can help you to review,
            update and implement your own ERP, because
            it describes the planning you would do to
            create such a plan. For example, in your ERP,
            you should provide answers to the  following
            questions:
        2
Water Security Handbook

-------
  Emergency Response Plans (ERPs):

  For more information on ERPs, see EPA's
  document entitled Emergency Response Plan
  Guidance for Small and Medium Systems
  to Comply with the Public Health Security
  and Bioterrorism Preparedness and Response
  Act of 2002, the Emergency Response
  Plan Outline, and other emergency
  response planning documents.  These
  documents can be downloaded from
  EPA's water security website at www.epa.
  gov/watersecurity. You may also obtain a
  copy by calling EPA's Safe Drinking Water
  Hotline at 1-800-426-4791 or by sending
  a request to the Hotline via e-mail at www.
  epa.gov/safewater/hotline.
  • Who will respond?
  • What level of personal protection do
    responders need in order to protect their
    health and safety?
  • Who can I call for help and advice?
  • When and where should samples be
    collected?
  • Who will collect samples?
  • Who will analyze water samples to identify
    the contaminant(s)?
  • Who will make public health decisions?
  • Who will manage remediation and recovery
    activities?

Addressing these kinds of questions should help
you to update your own ERP for responding
to a water contamination threat or incident.
Utilities may also want to share their ERPs with
local response partners in order to improve
coordination when an incident or emergency
actually occurs.
Who Should Read This Handbook?

This Handbook was written for water system
owners and managers, water utility emergency
response managers (WUERMs), and utility staff
who maintain public and private drinking water
systems, regardless of their size. In addition, anyone
who may be involved in an emergency response
concerning drinking water, such as public health
officials, emergency responders, law enforcement
officials, environmental protection officials and other
government officials should read this Handbook.
Utility managers in the wastewater sector may find
this Handbook useful because it describes a general
process for threat and incident response.

In the next chapter, water security planning is
discussed.
                                               Where To Get More Information:
                       ftffiA
                            Response Protocol Toolbox:
                           . Planning for and Responding to
                            Drinking. Water Cortamnaaon
For more information
on a specific topic,
please refer to the
full Response Protocol
Toolbox. You can
download the
entire Toolbox, this
Handbook, the
Response Guidelines,
and other water
security documents
from the EPA Water Security website at www.
epa.gov/watersecurity. This frequently updated
website also contains other useful information
on water security planning, requirements and
training opportunities.  You can also request a
copy of these documents by calling EPA's Safe
Drinking Water Hotline at 1-800-426-4791 or
by sending a request to the Hotline via e-mail
at www.epa.gov/safewater/hotline. Finally, the
section on "Additional Resources" at the end
of this Handbook describes many useful water
security resources.
                                                  O
                                   Water Security Handbook

-------
         Water Utility  Planning Guide
•JB
'5
O

'E

a.
ฃ>
i
Introduction

    This chapter discusses why you, as a water
    utility manager or officer, should know
about water security planning for effective
response to contamination threats and incidents.
This chapter also defines water contamination
threats and incidents and describes how
water security planning is  done. Chapter
1 corresponds to Module  1 of the Response
Protocol Toolbox.  See EPA's Water Security
website at www.epa.gov/watersecurity for more
information.

The first water security planning step is to
designate an individual to be the lead emergency
response manager for your utility, as well as an
alternate. At a small utility, you may be this
individual. The  second step is to plan your
utility's response to a contamination threat
or contamination incident. In responding,
you should decide if the threat or incident
is 'possible', 'credible', or 'confirmed'.  If
the threat is 'confirmed', then it becomes a
contamination incident, requiring remediation
(cleanup).  Following successful remediation,
the system is returned to normal safe operations
(recovery).

Why is Water Security Planning
Important?

Water security planning is critical because of
the increased threat of terrorism and other
intentional attacks since 9/11.  There are
many ways in which water systems can be
threatened by contamination or be intentionally
contaminated. Responding to contamination
threats and contamination incidents requires
careful planning and preparation.
                                                     What Are Contamination Threats
                                                     and Contamination  Incidents?

                                                     There are two kinds of water contamination
                                                     problems that you may have to deal
                                                     with:  contamination threats and actual
                                                     contamination incidents.
                                                       A contamination threat is a suggestion
                                                       or an indication that water has been or
                                                       will be contaminated, but no conclusive
                                                       proof has been collected yet to confirm that
                                                       contamination has actually occurred.  A
                                                       threat may be written, verbal, or based on
                                                       observations or other evidence.
Here are some examples of contamination
threats:

1) A suspicious empty container with an
unknown residue is left next to a reservoir. This
is a contamination threat. In this case, there is
physical evidence that suggests something has
potentially been added to the water supply, but
contamination has not yet been 'confirmed'
through testing or other conclusive evidence.

2) Someone phones to say that they observed
someone adding something to the water
reservoir.  As before, you have become aware of
a threat and there is not yet any proof that the
contamination has actually occurred.

A contamination incident has occurred if you
analyze water from the reservoir, distribution
system or another part of your water system and
find that the water contains levels of a harmful
                                         Water Security Handbook

-------
contaminant above baseline or background
levels. This is no longer a contamination threat,
but an actual contamination incident.  In
short, a contamination threat has not yet been
proven (or 'confirmed'), while a contamination
incident has already occurred. Be alert to
the possibility that field or lab testing may
not be comprehensive enough to  detect the
contaminant that may be present; for example,
a Microtoxฎ analysis should tell you whether
or not there is a toxin present, but it does not
measure radioactive materials or metals.
  A drinking water contamination incident
  occurs when the presence of a harmful
  contaminant has been 'confirmed'; that is,
  verified.
To protect your water system, you should
be ready to respond to both contamination
threats and contamination incidents. You
might not know whether a threat constitutes
a contamination incident until you get more
information. However, if you ignore a threat
and it turns out to be a contamination incident,
public health and/or the water system might be
harmed. You should always investigate a threat
and determine whether or not a contamination
incident has occurred.
                                              Should We Be Concerned About
                                              Contamination Threats and
                                              Contamination Incidents?

                                              Contamination threats and contamination
                                              incidents could impact the public in the
                                              following ways:
   Cause harm to public health (illness, disease,
   or death);
   Cause fear or loss of public confidence;
   Disrupt the water system or cause long-term
   shortage of clean, safe water to customers
   or prevent use of the water supply for fire
   fighting;
   Disrupt businesses and services that depend
   on a safe water supply;
   Cause damage to the water system
   infrastructure (e.g., water plant, pumps,
   pipes, wells, treatment system, distribution
   system, electrical system or computer
   network) resulting in contamination or
   interference with treatment or delivery;
   Create a need to remediate and replace
   portions of the water system to make it safe,
   which could in turn create water shortages or
   outages;
   Result in significant costs for remediation  or
   replacement; and
   Impact other critical infrastructures that
   rely on safe water, due to interdependencies
   (e.g., food processing and refineries, among
   others).
Since any one of these impacts could have
serious consequences, you should be concerned
about contamination threats and incidents.
 CD
;o
'5
O
Q_
&
 0)
-i-ป
i
                                  Water Security Handbook

-------
 
-------
less harmful chemicals.  Other contaminants
could cause death or illness in people who are
especially at risk, such as children, the elderly,
those who are already ill due to other causes or
others who are particularly sensitive.  There are
hundreds of contaminants that could disrupt
normal operations and cause the public to lose
confidence in the water system, but which
would not cause illness or death.

What is Due Diligence?

How will you know when you have done enough
to evaluate and respond to a contamination
threat or incident?  This is where due diligence
comes in.  Due diligence involves a careful
evaluation of any contamination threat and an
appropriate response based on the evaluation.
The response flow chart on the back cover of
this Handbook shows what steps to take when
a threat or incident occurs. Carrying out each
of these steps in a responsible, careful, efficient
and timely manner should help to ensure due
diligence.
Due diligence should be determined locally, and
local authorities should decide what level of risk
is reasonable in a threat situation. If the threat
is 'possible', appropriate responses to a threat
could include immediate operational  response
actions and site characterization. If the threat is
'credible', more significant response actions may
be needed, such as restrictions on water use.  For
a 'confirmed' incident, authorities may be faced
with a potential public health crisis, and response
actions should include all steps necessary to
protect public health, supply an alternate source
of drinking water, and begin remediation of the
system.

 Due diligence means that you have  done
 everything suitable, sensible and responsible
 to evaluate a contamination threat or incident
 and respond appropriately.
It is up to you and your response partners to
decide when due diligence has been exercised,
because response capabilities vary. As part of this
decision, you should decide how much risk is
acceptable.  You may also want to ask for help in
responding to a threat. Keep in mind, however,
that over-responding to a threat may cause
problems too, especially if it is a false alarm.

How Do  I Prepare For A
Contamination Threat or Incident?

You can prepare for contamination threats and
incidents by taking these steps:

Q  Develop your own guidelines for dealing
   with intentional  contamination at your
   utility.  Make these guidelines easy to use.
   Emphasize action items.  Know your roles
   and responsibilities. Include all necessary
   forms and checklists, as well as contact
   information for important people. Be sure
   to keep this information up-to-date.  The
   Response Guidelines provide short summaries
   of specific responses that can be taken to
   specific threats.

Q  Set up your Incident Command structure
   ahead of time so everyone knows who will
   be in charge during an emergency and
   everyone knows what to do. Again, know
   your roles and responsibilities in advance.
   The structure should be based on the
   Incident Command System (ICS), which is
 CD
;o
'5
O
Q_
&
 0)
-i-ป
i
                                   Water Security Handbook

-------
            used throughout the nation for responding
            to natural disasters or emergencies. See
            Chapter 2 for further discussion of ICS.
 
-------
            Q  Information on drinking water protection
               from services such as WaterlSAC, WaterSC,
               InfraGard, and from other utilities and
               agencies can help you to prepare for a
               contamination threat or incident. See the
               section on "Additional Resources" at the end
               of this Handbook.

            Q  Seek out support and training by contacting
               your state drinking water primacy agency
               and technical assistance providers (e.g., state
               rural water association).

            The next chapter describes a general game plan
            for managing the response to a contamination
            threat or intentional incident.
The diagram below shows the intended audience for each module of the Toolbox.


Enviro. Chemistry
Lab
Develop analytical approach
for unknown chemicals in
water using Modules 1 and 4

Small Utility
Update ERP using
Module 1


^^
Law Enforcement
Review Modules 1 and 2 to
appreciate public health
mission of water systems.

First Responders
Integrate sampling & screening
procedures for water (Modules
1-3) into existing protocols.
^-^r<>
V
V

Large Utility
Develop comprehensive plan
for contamination threats using
Modules 1-6


f ^
I
Response
Protocol
\J Toolbox

A
-<=i-j^-i=>

• i — N Statp Watpr Pronram

Develop comprehensive
response plan using
Modules i -D

Public Health Agency
Review Modules 2 and 5
~~ to understand public health
response options available
to a utility.



                                                              (D
                                                              ;o
                                                              '5
                                                              O
                                                              Q_
                                                              &
                                                              0)
                                                              -i-ป
                                                              i
Water Security Handbook

-------
        Contamination  Threat Management Guide
        Introduction
 d>
•p
'5
O
+•ป
 c

 0>
 o)
 CO
 OJ
 0
 ฃ
ฃ
*ฃ
 o
o
  If a contamination threat or incident occurs,
  you should act quickly to protect public
health and limit the spread of the contaminant,
based on the best information you have at the
time. You should also avoid over-reaction or
false alarms that might inconvenience your
customers and harm your credibility.  You
may not have all the information needed
to determine whether the water has been
contaminated or not, because this may require
water testing, which takes time. As new
information becomes available, however, you
might change the way in which you are dealing
with the threat or incident.

In this chapter, you will learn about a general,
yet systematic approach for evaluating
contamination threats and managing the
overall response to a contamination threat
or incident. You will learn how to manage a
threat response in a timely manner to protect
public health, using due diligence. For effective
contamination threat management, this
systematic approach or general game plan for
threat response is perhaps the most important
planning tool covered in this Handbook.
                                                   Chapter 2 covers the following topics:
   Roles and responsibilities;
   A general plan for responding to
   contamination threats and incidents;
   How to evaluate a water contamination
   threat;
   How to make the right decisions and when;
   Types of information needed to evaluate
   threats;
   Response actions to protect public health;
   and
   Exercising care in response actions.
Chapter 2 summarizes Module 2 of the
Toolbox, which can be obtained at EPA's Water
Security website at www.epa.gov/watersecurity.
                                       Water Security Handbook

-------
Roles and Responsibilities

The vast majority of threats and incidents will
likely be handled by individual utilities working
together with their local responder network.
Some incidents may be elevated to the federal
level, especially incidents involving terrorism
or an incident of national significance, such as
a severe hurricane. This section of Chapter 2
briefly  outlines roles and responsibilities from the
federal level down to the utility level.
Federal Roles:

The National Response Plan (NRP)

The National Response Plan, or NRP,
establishes a comprehensive all-hazards
approach to manage domestic incidents. The
NRP brings together individual federal agency
response plans, the Concept of Operations
Plan, the Federal Response Plan and the Federal
Radiological Emergency Response Plan into a
single, comprehensive approach.

The NRP includes the best practices and
procedures from several incident management
disciplines (e.g., homeland security, emergency
management, law enforcement, fire fighting,
public works, public health, responder and
recovery worker health and safety, emergency
medical services, and the private sector) and
combines them into one. The NRP outlines
how federal departments and agencies should
work together and how the federal government
should coordinate with state, local, and tribal
governments and the private sector during
incidents.

As an example, the  NRP designates the U.S.
Department of Health and Human Services
(HHS) as the lead federal agency in response
to a disease outbreak (which could be the
result of intentional water contamination)
requiring federal assistance.  The NRP
recognizes, however, that state, local,  and tribal
governments are primarily responsible for
detecting and responding to disease outbreaks
and implementing measures to minimize the
health, social and economic consequences of
such an outbreak.  Coordination between HHS
and local authorities would occur  as necessary
to determine current medical and public health
assistance requirements.
EPA supports HHS by providing technical and
policy assistance in matters involving drinking
water supplies. To learn more about the NRP,
visit the Department of Homeland Security
website at www.dhs.gov.
 0)
p
'5
O
+•ป
 c

 0)
 o
 (0
 (0

                                                  0
 ฃ
ฃ
?
 o
o
                                   Water Security Handbook

-------
 d>
•p
'5
O
+•ป
 c

 0>
 o)
 CO

 0
 c
 ฃ
 o
o
Federal,  State and Local Roles:

The National Incident Management System
(NIMS)

During an incident, the National Incident
Management System, or NIMS, further defines
roles and responsibilities. NIMS has established
standardized incident management processes,
protocols, and procedures that all responders
(federal, state, tribal, and local) should use to
coordinate and conduct response actions. The
use of standardized procedures should enable
you and other responders to
focus on incident management
when a water security incident
occurs. These standardized
procedures apply whether the
incident is related to terrorism,
an accident or a natural
disaster.

NIMS is maintained by the
NIMS Integration Center
(NIC)  that, under the direction
of DHS, provides strategic direction and
oversight for NIMS. One function of the NIC
is to help establish general training requirements
and to develop national-level training standards
and course materials associated with NIMS.

The overwhelming majority of emergency
incidents will be handled on a daily basis by a
single jurisdiction at the local level. However,
there will be  some instances, such as terrorist
attacks, accidents or nationally significant
natural disasters, in which successful incident
management requires the involvement
of emergency responders from multiple
jurisdictions, as well as personnel and equipment
from other states and the federal government.
These instances require effective and efficient
coordination across many organizations
and activities. The Incident Command
System (ICS), as described below, provides
the management framework to achieve this
coordination.

To ensure further coordination during incidents
involving multiple jurisdictions or agencies, the
principle of Unified Command (defined below)
has also been incorporated into NIMS via the
ICS.

To learn more about NIMS and training
opportunities, visit the FEMA website at www.
fema.gov/nims/.

             Federal, State and
             Local Roles:

             The Incident Command System
             (ICS)

             Under NIMS, the Incident
             Command System (ICS)
             is the national standard for
             the command, control, and
             coordination of a response. The
flexible nature of the ICS structure allows  for
the numbers and types of people on the response
team to change over time as the need for
resources and skills changes.

The ICS organization can expand or contract to
address a particular incident, but all incidents,
regardless of their size or complexity, will
initially have a single Incident Commander.
The Incident Commander is the individual
responsible for managing the overall response
to the crisis. The Incident Commander
frequently oversees a group of people, often
from his or her own organization as well as other
agencies or organizations, who are responsible
for responding with due diligence to the
contamination threat or incident.

To learn more about NIMS and ICS training
opportunities, visit the FEMA website at www.
fema.gov/nims/.
                                          Water Security Handbook

-------
            scene.
Local Role:

Incident Command at the Water Utility

If a threat or incident is discovered first by
water utility personnel, you or an appropriate
designated person should be the Incident
Commander, at least initially.  As additional
responders arrive in response to your
notifications, command may transfer to an
agency that has primary authority for overall
control of the threat or incident or to a more
senior or better qualified first responder. At
the transfer of command, you  should give the
incoming Incident Commander a full briefing
and notify all staff of the change in command.

Organizations that may provide an Incident
Commander include:

Water Utility: Every water  system should
designate a lead emergency response coordinator
and an alternate. This point person can be
known as the Water Utility Emergency
Response Manager (WUERM) or by some
other title as defined by the utility. This
individual (which may be you) is responsible
for managing the water utility's internal
emergency response procedures and may
initially be responsible for Incident Command.

 How does the ICS organization grow or shrink to fit the incident?
  The Incident Commander has overall control over the incident. In a small
  incident, he or she may be the only person needed to manage an incident.
  In larger or more complex incidents, the Incident  Commander may assign
  other members of the Command Staff, including a Public Information
  Officer (vital in assuring that an accurate, consistent message is given to the
  public), a Safety Officer (responsible for the safety of incident personnel
  and operations) and/or a Liaison Officer (who coordinates between
  incident command and the various response agencies). The Incident
  Commander also may assign General Staff, who serve as Section Chiefs
  for the Operations, Planning, Logistics and Finance/Administration
  Sections. The Section Chiefs have the authority to expand or contract
  their sections as the resource (people and equipment)
  demands of the incident increase or decrease.         •—
            Drinking Water Primacy Agency:  If the utility
            does not have all the resources needed to manage
            the threat, the drinking water primacy agency
            may take the lead after being notified by the
            water utility. The roles of the utility and the
            drinking water primacy agency should be defined
            during the planning stage.

            Public Health Agency (state or local): This
            agency may take the lead in Incident Command
            if there is a public health crisis and no criminal
            act is involved or at least not initially suspected.

            Local Law Enforcement: May take on Incident
            Command if the site of an incident is a crime
            HazMatl'Fire Department: If the incident
            involves a hazardous material or spill, an
            individual from one of these organizations may
            assume Incident Command.

            FBI: The FBI may assume Incident Command
            if the FBI determines that a federal crime (e.g.,
            terrorism or an incident crossing state lines) has
            been committed.
O


 O)

                                                               .0
                                                               '55
                                                                c
                                                                ฃ
Water Security Handbook

-------
 d>
•p
'5
O
+•ป
 c

 0>
 o)
 CO

 0
 c
 ฃ
 o
o
Federal, State and Local Roles:

Unified Command

In most cases, more than one organization or
agency has jurisdiction or statutory authority
in managing a response, and a Unified
Command may be established. Unified
Command is a team effort that allows all
agencies with  responsibility for the incident,
either geographic or functional, to manage an
incident together by establishing a common
set of incident goals and strategies. Unified
Command not only coordinates the efforts of
many jurisdictions, but provides for and ensures
joint decisions on plans, priorities and public
communications.  Unified Command does not
have a single Incident Commander; instead,
representatives from several responding agencies
contribute to the command process.  Unified
Command does not mean losing or giving
up any of your individual agency's authority,
responsibility, or accountability.
          Free Online Training in NIMS, NRP and ICS:
                                                                                      1
  FEMA offers free online training courses to help you become familiar with NIMS, the NRP,
  ICS, and the duties of being an Incident Commander. Examples of courses include:

  National Incident Management System: NIMS is now the nationwide standard for incident
  management, and NIMS certification (by September 30, 2006) is required in order to be eligible
  for federal preparedness grants. FEMA's online courses include IS-700 National Incident
  Management System and others.

  National Response Plan: The NRP is based on NIMS; together, they provide a template
  for effective threat prevention and response. FEMA's online courses include IS-800 National
  Response Plan and others.

  Incident Command System: Use of ICS is recommended under NIMS. FEMA's online
  courses on ICS include IS-100 (Introduction to the Incident Command System), and IS-200
  (Basic Incident Command System). There is also IS-100.PW (Introduction to the Incident
  Command System for Public Works).

  To enroll in these courses, visit FEMA's website at http://training.fema.gov/EMIWeb/IS.
         14
                                 Water Security Handbook

-------
Your Role and Responsibilities

As the utility emergency response manager or
utility manager, you should make decisions
and carry out your utility's pre-existing plans
for responding to an incident.  Depending on
the situation, you may also assume the role
of Incident Commander. As each incident is
unique, your role in the ICS may change. In one
incident, you may provide information to the
Incident Commander from another agency to
carry out a response. In another incident, your
input may be included as part of the Unified
Command decision-making process.
                           Unified Command is
                              established with
                             several agencies
                YOU
                               An individual from
                                 another agency
                                   becomes 1C
You become
  Incident
Commander
   (1C)
Figure 1 shows how your role may change
at various stages during an incident.  At the
'possible' threat stage, you will most likely be the
Incident Commander. At the 'credible' threat
stage, the figure shows that Incident Command
will be dictated by the situation and that
command may shift as more becomes known
about the situation. It is highly likely that any
'confirmed' contamination threat (especially
if terrorism related) will  be managed by a
Unified Command, and you may be in Unified
Command or in a supporting role.

The textbox on the following two pages
provides an example that shows how your role
may change throughout the process of threat
evaluation and response.
                                                                                     General
                                                                                      Staff
                                                                             Unified
                                                                            Command
                                                                                  ;o
                                                                                  '5
                                                                                  O


                                                                                   O)

                                                .0
                                                '55
                                                 c
                                                 ฃ
                                          You remain
                                            the 1C
 Figure 1. How Your Role May Change
                                  Water Security Handbook

-------
Example of How Your Role May Change
During Threat Evaluation and Response:
You have just received a phone call from
an unknown individual claiming to have
contaminated one of your water tanks. Once
you decide that this threat is 'possible' based
on the details of the threat warning and your
knowledge of the water tank in question, you
should next determine if the threat is 'credible'.
You may also consider initiating operational
response actions, such as isolating the suspect
water tank, if feasible. You may wish to
consult with outside resources, such as your
state primacy agency or police, to help you
determine if the threat is 'credible'.

Next, you or one of your staff and another
employee may drive to the water tank to  begin
an initial site characterization to see if there
is anything unusual (see Figure 2 on page 18
describing threat evaluation  and response).
Other employees may be sent to  collect water
samples  from the distribution system.  On
arrival at the water tank, you discover that the
fence is cut, ripped-open bags with a white
powdery residue are scattered about, protective
suits and latex gloves are piled in a heap,  and the
tank hatch is open.

Recognizing that this is potentially a crime
scene and not knowing  how dangerous the
powder is, you may decide to call the police
to the scene of what now appears to be a
'credible' threat. Once the  police arrive,
you may decide to relinquish incident
command to the responding law enforcement
officer, who is probably better qualified to
address the potential criminal and HazMat
issues. However, you should assist law
enforcement officials in the  ensuing response
and investigation. You should also continue
to direct your own  staff within your utility's
internal  ICS structure.
 As the situation unfolds, you might receive a
 call from the local public health agency, which
 informs you that people in the area of the
 water tank are reporting to the local hospital
 complaining of similar illness symptoms. You
 should instruct the public health agency to
 notify the Incident Commander via the Liaison
 Officer.

 Meanwhile, the Incident Commander has
 already called the National Response Center, a
 single point of contact for all pollution incident
 reporting, and a regional HazMat team to do a
 more intensive site characterization that includes
 rapid field screening of the white powder.
 Preliminary indications are that the powder is
 some form of poison. Although you or Incident
 Command do not yet have any lab results from
 water samples  to 'confirm' that this potential
 poison is in the water, the Incident Commander
 decides that a preponderance of evidence  now
 exists to determine that the threat is 'credible'.

 At this point, having determined  that the threat is
 'credible', the Incident Commander notifies the
 public, through the Public Information Officer,
 that they should not drink the water. The
 Incident Commander also informs the public of
 what is being done to provide an  alternate  supply
 of safe drinking water.  He or she may also notify
 the FBI and activate the Emergency Operations
 Center (EOC) to support the response.
What is an Emergency Operations Center?

The Emergency Operations Center, or
EOC, is a pre-designated facility established
by an agency or jurisdiction to coordinate the
overall agency or jurisdictional response to an
emergency. It is not a part of on-scene incident
management, but rather supports the on-scene
Incident Commander or Unified Command by
arranging for needed resources.

                                 Water Security Handbook

-------
By now, many more agencies have been
notified by the Incident Commander or
the EOC, and a Unified Command may
be formed to lead the response. In this
situation, Unified Command may have
members from the police, FBI, HazMat,
state, EPA and other agencies having
jurisdiction over the incident.  At this
point, you may report to the EOC to
assist in their response efforts.  However,
someone should be designated as the
utility's internal Incident Commander,
who will undertake operational
responses at your utility in support of
Unified Command.

In this example, Unified Command
will continue to work with appropriate
laboratories, including laboratories only
accessible by federal agencies such as the
FBI, to 'confirm' the contamination
incident. Once the white powder has
been positively identified and detected
in the water system and the threat
or incident has been 'confirmed',
Unified Command will update or revise
their public notifications.  Unified
Command will most likely direct you to
undertake appropriate operational and
remediation and recovery activities at
your utility.

Even if the contaminant is never
positively identified in the water,
Unified Command,  in consultation
with public health, may still determine
that the contaminant was introduced
into the water system, based on a
preponderance of evidence.
  Tip: Your local emergency plans may
  differ from the example presented here.
  This is why it is very important for you
  to talk with other first responders in your
  area so that you will understand where you
  "fit in" in various emergency scenarios.
Keep in mind that ICS is a flexible system and
will be uniquely established by the Incident
Commander (which may be you or someone
from another agency) or Unified Command
for each incident. The example given above is
only one of the many ways in which ICS may
be used to effectively manage a water supply
incident. Your local and state policies and
procedures may require different actions than
those described in the example given above.
This is why it is important for you to include
your local  first responders, local emergency
planning committee (LEPC), public health
and state primacy agencies in your emergency
response planning efforts.
  Remember:  Regardless of the organization
  responsible for incident command, the
  utility has an ongoing responsibility to
  serve as a technical advisor to the Incident
  Commander or Unified Command for
  issues related to the operation of the water
  system and ensuring water quality.
 0)
p
'5
O
+•ป
 c

 0)
 o
 (0
 (0

 0
                                                 ฃ
                                                ฃ
                                                ?
                                                 o
                                                o
                                 Water Security Handbook
                                          17

-------
         A General Plan for Threat Response and Threat Management
 d>
•p
'5
O
+•ป
 c

 0>
 o)
 CO
 CO

 0
 c
 ฃ
 o
o
The goals of threat response and threat
management are to:  1) evaluate the threat,
2) take necessary steps to protect public
health while the threat is being evaluated,
3) 'confirm' the threat, 4) remediate the
water system if necessary, and 5) return the
system to safe, normal operation as soon as
possible.

To achieve these goals, the response to a
contamination threat or incident should
be efficiently managed. Threat response
and management involves a number of
steps, actions and decision points.  The
most important lesson of this chapter
is to understand these key elements
and how to proceed from one decision
point to the next to achieve these goals.
The key elements of threat response are
summarized below and in  Figure 2, with
key terms in bold:

Step 1. Decide if a threat is 'possible',
take appropriate preliminary response
actions to protect public health, and
proceed to Step 2.
Step 2.  Determine if a 'possible' threat
is 'credible' through consultation with
other utilities, the drinking water primacy
agency, public health and other agencies. If it
is 'credible', notify the necessary agencies and
the public, take appropriate response actions to
further protect public health, and proceed to
Step 3.

Step 3.  'Confirm' a 'credible' threat (which
results in a 'confirmed' contamination incident),
take appropriate public health and other
response actions, and proceed to Step 4.

Step 4.  Remediate the water system; and
                                                                      Module 2
                                                     Contamination Threat Management Decision Tree
                                                                   Review existing information
                                  investigation, return\
                                  rmal operation, and  1
                                  ument the threat.  /
                                                                  Revise operational response and
                                                                    notifications as necessary
                                                                     Develop remediation
                                                                      and recovery plan
                                Revise sampling and
                                  analysis plans
 Figure 2.  Process of Threat Evaluation and
            Response

Step 5. Return the water system to normal, safe
operation (recovery).

Each of these steps is described in more detail
below and in Module 2 of the Toolbox.

Please note that your responsibility, as the
water utility manager (or emergency response
manager), is to operate and maintain a safe
water system, ensure a safe water supply
         18
                                   Water Security Handbook

-------
and provide public notification regarding
impaired drinking water quality.  In a threat
situation or contamination incident, a different
Incident Commander or Unified Command
structure may be in charge of Steps 2 through
5, as explained previously.  You can serve an
important role by providing technical advice on
your water system to the Incident Commander
or Unified Command.
  A detailed Decision Tree for responding to a
  contamination threat or incident is available
  in Module 2 of the Response Protocol Toolbox.
Step 1: Decide if the Threat is 'Possible'

After receiving a threat, the first step is to
decide if the threat is 'possible'. This is the first
decision-point and the lowest threat level.

A water contamination threat is 'possible' if
the circumstances suggest that contamination
could have occurred. If the threat is found to
be impossible, then the investigation is closed,
the incident is documented, and operations
are returned to normal. However, if the
contamination threat is 'possible', then further
investigation is needed. It is likely that most
contamination threats will be classified as
'possible'.
To decide whether a threat is 'possible' or not,
you need reliable information in the one hour
you have to make a decision.  Often, the threat
warning itself can provide much information.

If the threat warning is 'possible', then go on
to Step 2 (see below).  However, if the threat
warning is not believable because it comes from
an unreliable  source or the situation does not
lend itself to such contamination, you may
decide that contamination is not  'possible'.  If
the threat warning is not 'possible', then your
response actions are to note the incident and
the reasons for the decision to return to normal
operations.
                                                                                                  0)
                                                                                                 •
                                                   c

                                                   0)
                                                   o
                                                   (0
                                                   (0

                                                   0
               How much time do I have to decide if a threat is
               'possible' or not?

               Speed is critical for protecting public health. Once a threat
               warning is received, you should act with due diligence
               to manage the threat. You should decide quickly if a
               contamination threat is 'possible' within one (1) hour from
               the time you receive the threat warning. You may have to
               make a decision based on the limited information available at
               the time.
                                                   ฃ
                                                  ฃ
                                                  ?
                                                   o
                                                  o
                                   Water Security Handbook

-------
  A threat warning is an indication that something may be
  wrong.  Examples of different threat warnings that may be
  classified as 'possible' are:

    • Security breach - evidence of an unauthorized entry into a
     secured facility, such as an alarm, cut fence, etc.
    • Witness account - someone directly witnesses suspicious
     activity and notifies the utility.
    • Direct notification by perpetrator - the perpetrator sends a
     verbal or written threat to the utility.
    • Notification by news media - a threat is sent to the media,
     or the media may learn of a threat and pass it on to the
     utility.
    • Notification by law enforcement - a law enforcement
     agency may pass along information about a threat to a utility.
    • Unusual water quality - on-line monitoring, grab sampling
     or an early warning system indicate unusual water quality
     results.
    • Consumer complaints - an unusual or unexplained increase
     in consumer complaints may indicate contamination.
    • Notification by public health agencies - health agencies
     or health care providers observe increased illness, disease or
     death rates, which may indicate a contaminated water supply.
  Remember:

    • Use due diligence at all times.
    • Encourage staff to immediately
     report any and all threat warnings
     to you, 24 hours a day, 7 days a
     week, 365 days a year.
    • Within one (1) hour of receiving
     the threat warning, you should
     decide whether the incident is
     'possible' or not.
    • Practice notification and reporting
     procedures ahead of time to be
     prepared for a real emergency.
    • Most threats will end up being
     'possible', unless you are able to
     absolutely rule out the possibility
     of contamination.
                                 Who Do I Notify
                                 Once A Threat is
                                 'Possible'?

                                 Once you decide that
                                 a threat is 'possible',
                                 you should notify other
                                 utility staff. You may
                                 also want to consult
                                 with or notify your
                                 local law enforcement
                                 agency and drinking
                                 water primacy agency,
                                 depending on the nature
                                 of the threat. Be aware
                                 of your state's reporting
                                 requirements.
                                                  Notification
                                                    by Law
                                                  Enforcement
20
Water Security Handbook

-------
Step 2: Determine if the Threat is 'Credible'
and Protect Public Health

Once you have decided that the threat is
'possible', you should immediately do two
things:

  • Determine if the threat is 'credible' or not;
    and if it is 'credible', then
  • Protect public health through operational
    responses.

These two actions should be carried out
together, because your first and highest priority
is to protect public health, so you should move
quickly to determine if the threat is 'credible' or
not.

The word 'credible' means believable, plausible
or reliable. A contamination threat is 'credible'
if the threat is both 'possible' and other reliable
information shows that there is reason to
believe that the threat warning is real and that
contamination is likely.  A 'credible' threat is
a much higher threat level than a 'possible'
threat.
  How much time do I  have to decide if a
  threat is 'credible' or not?

  As a general rule, once  you have decided
  that the threat is 'possible', you should
  determine within 2 to 8 hours whether
  the threat is also 'credible', based on site
  information, the nature of the threat,
  the circumstances and other reliable
  information.
It is crucial to make this assessment quickly,
because if the threat does turn out to be
'credible', public health and safety are at stake.
Here are some actions you can take to  determine
if a threat is 'credible' or not:
1) Conduct a site characterization by
   collecting more information about the
   site of the 'possible' contamination to
   help decide if the 'possible' threat is
   also a 'credible' threat. This step should
   probably involve sample collection to find
   out if contaminants are present and to
   help 'confirm' the threat.  Proper sample
   collection should help to ensure that
   lab analyses provide useable data. Law
   enforcement agencies may be investigating
   the site as well, and you should assist them
   in protecting a crime scene.  See  Chapter  3
   of this Handbook to learn more about site
   characterization.

2) Check to see if there have been previous
   security incidents similar to the current
   'possible' threat, including previous
   incidents at your utility and/or elsewhere.

3) Consult early with other agencies and
   organizations to get information  to help
   you evaluate the threat.  Some useful
   sources of information are listed  below
   (Note that not all of these  may be relevant,
   depending on your locality and the threat
   or incident under investigation):
 0)
p
'5
O
+•ป
 c

 0)
 o
 (0
 (0

 0
 ฃ
ฃ
?
 o
o
                                    Water Security Handbook

-------
O


 O)

.0
'55
 c
 ฃ
    Your state drinking water primacy agency;
    EPA Regional Office;
    The National Response Center;
    Law enforcement agencies and your regional
    FBI Joint Terrorism Task Force;
    Neighboring utilities;
    Public health agencies (local, state, and
    federal - the latter includes the CDC,
    ATSDR, and NIH);
    9 1 1 call centers;
    Homeland Security Warnings and Alerts (see
    the DHS website at www.dhs.gov);
    Water Information Sharing and Analysis
    Center, or WaterlSAC, which can assist in
    threat evaluation (see the WaterlSAC website
    at www.waterisac.org) ;
    Contaminant information from EPA's Water
    Contaminant Information Tool (WCIT) at
    www. epa. gov/wcit;
    Use the Contamination Threat Management
    Matrices (see Module 2, p.54 of the Toolbox)
    and the Response Guidelines to help you
    collect and organize information and
    evaluate the threat; and
    Other resources listed in the "Additional
    Resources" section of this Handbook.
You should now decide if the threat warning is
'credible' or not.  However, because of the types
of information needed, the determination of
credibility of the threat will most likely involve
more parties than your utility alone.

If the threat warning is not 'credible', then the
investigation is closed, the incident is documented
and water system operations are returned to normal.

If you determine that the threat warning is
'credible', then you should notify appropriate
agencies and the public, undertake suitable
response actions to protect public health and
'confirm' the threat (see below).

To protect public health, provide immediate
operational responses to prevent or limit public
  Collecting and Organizing Information
  For Threat Evaluation:

  "Contamination Threat Management
  Matrices"

  To help you collect and organize the
  information to help determine if a threat
  is 'possible', 'credible', or 'confirmed',
  see Module 2 of the Toolbox for the
  "Contamination Threat Management
  Matrices". Each matrix covers:

    • Information and factors considered in
     assessing a threat;
    • Possible notifications; and
    • Possible response actions.

  These generalized matrices can be customized
  to your utility or to specific incidents.
  Customized matrices can be used in your
  utility's Emergency Response Plan.

  Response Guidelines

  The Response  Guidelines is a companion to
  this Handbook and contains emergency
  response planning checklists, standard report
  forms and other forms to help you manage
  and organize your emergency response. Visit
  www.epa.gov/watersecurity to download this
  document.
exposure to the (potentially) contaminated
water. See Chapter 5 for examples of operational
responses that may include isolating suspect
water or increasing levels of disinfection.  For a
'credible' threat warning, the public health goal
is to minimize public exposure to the suspected
contaminated water. If it is not possible to provide
an operational response that effectively reduces the
possibility that the public will be exposed to the
suspected contaminant, then you should speed up
your assessment of the credibility of the threat.
         22
                                   Water Security Handbook

-------
  Who Do I  Notify Once the Threat is
  'Credible'?

  Once you decide that the threat is 'credible,'
  you should report the threat to your drinking
  water primacy agency, public health agencies,
  law enforcement agencies and others, if you
  have not done so already. They will need
  some basic information, such as your name,
  contact information, a description of the
  threat, incident or event, and its location.
  You may also need to notify the public.  Be
  aware of your state's reporting requirements.
Step 3.  'Confirm' the Threat

Once you decide
that a threat
warning is
'credible', you
should work with
your drinking
water primacy
agency, public
health agencies and law enforcement agencies
to 'confirm' the threat. Here are some steps in
confirming the threat:

  1)  Send water samples collected during
     site characterization to a laboratory
     for analysis and identification of
     unknown or suspected contaminants
     in the water. The best way to 'confirm'
     contamination is to provide factual
     evidence of contamination by measuring
     contaminants through laboratory analyses
     of water samples.  Laboratory analysis
     can potentially identify and/or 'confirm'
     contaminants(s), although it is important
     to keep in mind that not all contaminants
     can be identified and/or 'confirmed' by
     every laboratory (see Chapter 4 of this
   Handbook). Lab data can also be useful in
   planning and implementing remediation
   activities (see Chapter 6). However,
   if laboratory analysis of samples is not
   possible for some reason, the standard for
   'confirming' a 'credible' threat is that
   a "preponderance of evidence exists" to
   confirm an incident. A preponderance of
   evidence means that most of the evidence
   available points in this direction.

2) Conduct additional site characterization
   and sampling if needed to 'confirm'
   a contamination incident. You may
   need more information after your initial
   site characterization to 'confirm' the
   incident. For example, your initial
   site characterization and sampling may
   indicate that the contaminant was
   introduced somewhere outside the area
   where you first sampled.  (Note:  If the
   'credible' contamination threat cannot
   be 'confirmed', then the additional site
   characterization and water sampling is
   done to make sure the water is safe and to
   support the decision to return to normal
   operations).

3) Notify law enforcement agencies in the
   event that criminal activity is involved,
   if you have not done so already. Law
   enforcement agencies may need to collect
   evidence and samples to determine whether
   or not criminal activity occurred. You
   should continue to
   help ensure a safe
   water supply and
   work together with
   law enforcement
   agencies to obtain
   evidence that
   could help to
   'confirm' whether
   contamination
   occurred or not.
 0)
p
'5
O
+•ป
 c

 0)
 o
 (0
 (0

 0
 c
 ฃ
 o
o
                                  Water Security Handbook
                                        23

-------
;o
'5
O


 O)

.0
'55
 c
 ฃ
Once you have lab results and other information,
you should decide whether the threat can be
'confirmed' or not. When a threat is 'confirmed',
you should immediately notify appropriate public
health agencies (if you have not done so already).
This sets the stage for public health agencies to
make public health recommendations.  Review
the public health protection measures that may
already have been provided (when the threat was
found to be 'credible'), and provide additional
protection measures if needed.  You may also be
required to notify the public. See Chapter 5 of
this Handbook for more information on public
health.

Public notification may be required at any
stage of the threat evaluation process under the
National Primary Drinking Water Regulations:
Public Notification Rule, which says that
the public should be notified when there is a
"situation with significant potential to have serious
side effects on human  health as a result of short term
exposure. " (see www.epa.gov/safewater/pn.html).

Public health advisories may be issued, such as:

  • "Boil water";
  • "Do not drink the water";
  • "Do not use water"  (including no flushing  of
    toilets and no use of water for fire fighting).

Remember, 'confirming' a 'credible' threat
represents an important and necessary decision-
making step. Once a threat is  'confirmed'
and it becomes a contamination incident,
decisions should be made concerning public
health responses, and remediation and  recovery.
Keep in mind that it may take several rounds
of information collection and evaluation to
'confirm' a threat.

If the threat cannot be 'confirmed' because
there is not enough information, the process of
                                                         Why should I 'con firm'a 'credible'
                                                         threat?

                                                         You should 'confirm' a 'credible' threat
                                                         because responding to a 'credible' threat is an
                                                         important decision that could affect public
                                                         health, affect your water system, involve
                                                         different agencies and require resources.  To
                                                         'confirm' a 'credible' threat, you should be
                                                         certain, based on definitive lab results or a
                                                         "preponderance of evidence" that the threat
                                                         is plausible and believable. Once a threat is
                                                         'confirmed', it becomes a contamination
                                                         incident.
collecting information should be continued until
a preponderance of evidence indicates that the
threat either can be 'confirmed' or, alternatively,
the threat cannot be 'confirmed' because it is an
empty threat.

Step 4.  Remediate the Affected Water System

In this step, the goal is to remediate the
contaminated water system to remove or
inactivate the contaminant and test the water
to make sure that the remediation has worked.
Remediation is discussed in more detail in
Chapter 6.

By this time, if the threat has been  'confirmed'
to be a contamination incident, a Unified
Command structure will probably  be established
and other agencies and organizations will be
responsible for overseeing the response and
remediation.  During remediation, your role
as water utility manager will most likely be to
work with the remediation team and Unified
Command to help ensure recovery of the water
system.
        24
                                  Water Security Handbook

-------
Step 5.  Recovery of the System

In this step, the goal is to return your water system
to safe, normal operation, which is also called
recovery. Recovery of your water system can begin
as soon as remediation is complete. If a portion
of your water system is remediated, you may be
able to resume normal operation of that portion
provided that it does not affect remediation of
other affected parts of the system.  Keep in mind
that your customers may still be experiencing
residual  contamination from within their home
or business plumbing. As the water system is
remediated and returned to normal, it is important
to keep your water utility customers informed.
Recovery is discussed in more detail in Chapter 6.

Now that the general process of threat response
has been described, the following chapters will
describe site characterization, sample analysis,
the public health response, and remediation and
recovery in more detail.
Remember, successful response
involves:
    Planning before an incident occurs;
    Responding in a timely manner and
    using due diligence;
    Protecting public health;
    Investigating and documenting the
    incident;
    Identifying the contaminant;
    Basing your decisions on a
    "preponderance of evidence" if
    sample analyses are not conclusive;
    Choosing the right remediation in
    collaboration with others; and
    Returning the system to normal,
    safe operation (recovery).
 0)
p
'5
O
+•ป
 c

 0)
 o
 (0
 (0

                                                                                                 0
                                                                                                 ฃ
                                                                                                ฃ
                                                                                                ?
                                                                                                 o
                                                                                                o
                                   Water Security Handbook
                                     25

-------
         Site  Characterization  And  Sampling Guide
 
_c
"5.
 E
 
-------
Who Does the Site
Characterization and Sampling?

The answer to this question depends on what
stage of site characterization and sampling
you are in. You or another designated utility
emergency response lead may carry out the first
steps of site characterization and sampling. Or,
an Incident Commander from another agency
may oversee the threat response, beginning with
site characterization and sampling.

The Site Characterization Team is the group
that actually performs site characterization and
sampling activities.  This team may include
people from the water utility,  police and fire,
HazMat specialists, environmental response
teams from government agencies, public health
officials, FBI and EPA criminal investigators,
civil support teams and other agencies.
  The Incident Commander or
  the WUERM manages the site
  characterization and sampling. The site
  characterization team carries out the
  investigation. The utility remains involved
  at all times, but its role may change as a
  particular investigation progresses.
Ensuring Safety and Protection for
Personnel

Protecting the safety of the Site Characterization
Team during site characterization is critical.
Team members must have the proper training,
protective gear, clothing and other equipment
needed to safely inspect and sample the site.
If there is a threat to safety, then the team
should stop until the proper gear, personnel, or
equipment can be obtained.
What Does Site Characterization
Involve?

First, the Site Characterization Team develops
and uses a customized site characterization plan
as a set of guidelines for investigating the threat.
Each threat or incident will be different, so
every site characterization plan will be different.
However, all plans will share certain features in
common.  You may already have a generic site
characterization plan which should contain the
following five elements:

  1)  Hazard evaluation (including an initial
     hazard assessment before entering the site
     and ongoing reassessment of the hazard as
     you collect more information);
  2)  Approaching the site and doing a field
     safety screening;
  3)  Characterizing (investigating) the site;
  4)  Collecting samples; and
  5)  Leaving the site.

Each of these elements is described below.
O
 05
 C
"5.
 E
 CG
CO
•o
 c
 OS
 c
 o
                                                                                               a
                                                                                               o
o
ฃ
CO
                                  Water Security Handbook
                                          27

-------
O
 o>
_c
"5.
 E
 (0
CO
•o
 c
 (0
 c
 o
a
 o
 5
 CC
O
a
CO
Initial Hazard Assessment Before
Entering the Site

The first step
in developing
a specific site
characterization
plan is to decide
if the site is safe
to enter and
investigate further.
This is done by making an initial hazard
assessment before the team is sent to the site.
You or the Incident Commander (which may be
you) should make this initial hazard assessment,
based on the available data and initial threat
evaluation.  A decision is made regarding the
potential need for special hazardous material
handling techniques or equipment. This is a
very important step that protects the safety of
anyone who enters the site.  People should not
be sent into  a dangerous area without protection.
Response plans should document who would be
called to respond to contamination threats under
different hazard conditions.

Some possible hazard categories are described in
the textbox.  Although these hazard categories
are based upon tentative identification of the
particular type of contaminant at the site,
there may be enough information in a threat
warning to allow you to judge that a particular
hazard category may apply to the situation, thus
helping you to make an initial hazard assessment.
As you get more information from the site
characterization and sampling, you may want to
revise your initial hazard assessment (and take
appropriate precautions).  Hazard evaluation is
an ongoing and iterative process.
Possible hazard categories:

Low Hazard - there are no obvious
signs of radiological, chemical, or
biological contaminants at the site, in
the air, or on surfaces.  Contaminants
that may be present in the water are
assumed to be dilute and confined to
the water.

Radiological Hazard - radiological
isotopes or emitters are identified at the
site or in the water (i.e., through the use
of a field radiation detector).

Chemical Hazard - presence of highly
toxic chemicals (e.g., chemical weapons
or biotoxins) or volatile toxic industrial
chemicals is potentially identified at
the site or in the water, with a possible
risk of exposure through dermal or
inhalation routes.

Biological  Hazard - presence of
pathogens is potentially identified at
the site, with a possible risk of exposure
through dermal or inhalation routes.

         28
                                   Water Security Handbook

-------
The initial hazard assessment is also important
for deciding who should be on the Site
Characterization Team, because the team should
have the skills, experience and equipment needed
to deal with the hazards that may exist on the
site.  Some suggestions for possible staff are given
below:

  • If the site appears to be a "Low Hazard"
    site, the water utility staff may do the  site
    characterization.

  • If there are clear signs of greater hazard
    (radiological, chemical, or biological
    hazard), then HazMat professionals
    trained in hazardous materials safety and
    handling techniques may need to do the
    initial hazard assessment and the entire site
    characterization as well.

  • The HazMat team may do the initial hazard
    assessment, find that the site is safe enough
    for others to enter, and allow the utility
    staffer other agency staff to enter the  site to
    continue the site characterization.

The threat warning itself may suggest what the
hazard is.  Be alert to the possibility of "red
herrings", where the threat warning suggests
one type of hazard, yet the site actually contains
a different hazard.  Another example would
be misleading clues designed to confuse the
investigation. If this occurs, the contamination
threat or incident is most likely intentional.
Approaching the Site and  Doing a
Field Safety Screening

In this step following the initial hazard
assessment, the Site Characterization Team
approaches the site and conducts a field safety
screening.  Field safety screening is done to
observe site conditions and, in particular, to
detect any immediate threats to the response
team from contaminants in the atmosphere
or on surfaces. Field safety screening might
include field testing for radioactivity, chemical
and biological agents.  The site characterization
team should already have been trained in the
use of safety screening equipment. Because
such equipment can be expensive, you may
have to call in a HazMat specialist with the
proper equipment and training to conduct such
screening. Consider due diligence in all of your
decisions and actions.

The first step in a field safety screening is to define
the perimeter of the site before approaching it.
The site perimeter should include the immediate
area of the incident as well as a buffer zone for
safety. Beginning at some distance outside the
site perimeter, the Site  Characterization Team
carefully proceeds towards the site perimeter with
appropriate personal protective equipment and
field monitoring equipment and notes anything
out of the ordinary. Signs of contamination could
include dead or sick animals, discarded chemical
containers, or other indicators.
O
 05
 C
"5.
 E
 CG
CO
•o
 c
 OS
 c
 o
a
 o
                                                                                                  o
                                                                                                  ฃ
                                                                                                  CO
                                   Water Security Handbook
                                           29

-------
O
 O)
_c
"5.
 E
 (0
CO
-a
 c
 CO
 c
 o
"'p
 (0
_N
a
 o
 5
 (0
O
CO
  Minimize risks by following common-
  sense safety practices, such as:

    • Approach the site from upwind;
    • Do not eat, drink or smoke at the site;
    • Do not drink, smell, touch or taste the
     suspect water;
    • Use appropriate personal protective
     gear (e.g., splash-proof goggles,
     respirator, disposable gloves,
     disposable shoe covers, and a
     disposable lab coat);
    • Avoid skin contact with suspect water;
    • Fill sample containers slowly to
     avoid splashing or creating spray or
     droplets of water that could spread the
     contamination; and
    • Do not spend any more time than
     needed to characterize the site and get
     samples.
If there are signs of hazards, the team should
stop their investigation and immediately contact
the Incident Commander (who may be you).
You should then decide how to proceed.  It
is recommended that the site be evacuated
immediately and that a properly trained and
equipped HazMat team be brought in to
investigate.

If there are no obvious signs of hazards, the team
should still contact the Incident Commander
(who may be you) before crossing the site
perimeter and entering the site. In most cases,
you should be able to tell the team to enter the
site and proceed with site characterization and
collection of water samples to determine the
nature of the threat or incident.
                                                       Characterizing the Site

                                                       After the field safety screening has been
                                                       completed and if it appears safe to proceed, the
                                                       team may continue the site characterization.
                                                       The team should also do a detailed visual
                                                       inspection of the site. They should perform
                                                       rapid field testing of the water suspected of
                                                       being contaminated. Recommended core field
                                                       testing consists of monitoring for radiation,
                                                       cyanide, chlorine residual, conductivity and pH
                                                       of the suspect water.
Rapid Field Testing and EPA's
Technology Testing and Evaluation
Program (TTEP)

Rapid field testing of water suspected of
being contaminated is done to try to identify
the type of contaminant, so that the right
laboratory analyses can be done. Equipment
and instruments for rapid field testing are
described on pages 27-30 of Module 3 of the
Toolbox.

Information on field testing technologies
is also available from the EPA's National
Homeland Security Research Center
(NHSRC), through its Technology
Testing and Evaluation Program (TTEP).
The TTEP is an outgrowth of EPA's
successful and internationally recognized
Environmental Technology Verification
(ETV) Program.  TTEP rigorously tests
technologies for detection, monitoring,
treatment, decontamination, computer
modeling, and other tools for protecting
water infrastructure and decontaminating
structures and the environment.

For more information on TTEP, visit the
NHSRC website at www.epa.gov/nhsrc/tte.
htm.
        30
                                  Water Security Handbook

-------
There is no single field testing kit that tests for
all possible radiological, chemical or biological
contaminants. Because there is no way to test
for everything, field testing should be used only
as a guide, not as the final answer.  A negative
result during field testing may mean that there is
no contaminant, or it may mean that your field
screening kit is not sensitive enough to detect the
contaminant or was not designed to measure the
particular contaminant that is present.
 Remember: To conclusively prove
 (or 'confirm') that water is either safe or
 contaminated, you must have water samples
 analyzed by a laboratory that is qualified to
 do such testing. Water samples should always
 be collected if there is any question that the
 water might be contaminated. These samples
 can be analyzed later by a laboratory.
Collecting Samples

After rapid field testing of the water, samples of
the suspect water may be collected in case they
are needed for later laboratory analysis. (Note
that if a serious hazard is apparent, a HazMat
responder may be needed to collect samples).
Depending on the outcome of the threat
evaluation, the Incident Commander (who
may be you) may decide to send the samples to
a laboratory or not.  If the threat is 'credible',
then the samples should be sent immediately
to a laboratory for analysis.  But if the threat
is not 'credible', then the samples should be
stored in a safe place for a specific period of time
in case it later becomes necessary to analyze
them. Keep in mind that sample holding
times for radiological, biological and chemical
contaminants can vary widely.
   More information on sample collection,
   packaging and transporting can be found
   on pages 20-27 of Module 3 of the Toolbox.
Exiting the Site

After finishing the site characterization, the team
should prepare to leave the site.  Before leaving,
the team should make sure that they have:

  • Documented their findings;
  • Collected all samples needed;
  • Collected all equipment; and
  • Re-secured the site (lock doors, hatches,
   gates, etc.).

There may be other actions to take before
leaving the site. If the site is a possible crime
scene, follow guidelines from law enforcement
agencies to restrict or block access to the site and
to protect any evidence from disturbance. If
the site contains hazardous materials, it may be
necessary to  decontaminate the entire team and
their equipment.

In the next chapter, you will learn about
analyzing samples for contaminants, types
of contaminants, and types of analytical
laboratories.
O
 05
 C
"5.
 E
 CG
CO
•o
 c
 OS
 c
 o
                                                  a
                                                  o
                                                  o
                                                  ฃ
                                                  CO
                                   Water Security Handbook

-------
Introduction

     Chapter 4 is aimed at water utility staff who
     will plan, order and interpret laboratory
analyses of water samples collected from the site
of a suspected incident. In this chapter, you will
learn how to plan for sample analyses before a
contamination threat or incident happens, what
to ask the lab to analyze for, how to set data
quality goals and what precautions to take when
handling or shipping samples. The following
topics are covered:

  1) What you should know about laboratory
     analyses and testing;
  2) Safety considerations for handling
     suspected contaminated water samples;
  3) Types of laboratories, the analyses they
     perform and how to access labs;
  4) Making sure that analyses are conducted in
     a manner that ensures high-quality, useable
     results;
  5) Screening approaches to  determine if
     contaminants are present in a sample; and
  6) Threat response planning for analytical
     laboratories.

Chapter 4 summarizes Module 4 of the Toolbox,
which can be obtained at EPA's Water Security
website at www.epa.gov/watersecurity.
            What  Do I Need to Know About
            Laboratory Analyses?

            To plan effectively for threat response, you
            need to  be familiar with the general types of
            contaminants, how samples are analyzed, what
            laboratories can perform such analyses, what to
            look for in the data and how to use the results
            in decision-making.  It is not enough for you to
            simply "leave it up to the lab to decide what to
            analyze" because:

              •  The threat warning, the circumstances
                surrounding the threat, or information
                collected during site characterization or field
                safety screening may provide clues to the
                nature of the contaminant or compound.
                You should pass  on such information to
                the laboratory so the right analyses can be
                performed.

              •  Different contaminants may need different
                sampling, preservation, handling or shipping
                methods, otherwise the samples may be
                compromised, resulting in poor quality
                data or useless data. You should be familiar
                with these differences so that your samples
                arrive at the laboratory in useable condition.
                Refer to Module 4 of the Response Protocol
                Toolbox for more information on sampling,
                preserving samples and shipping.

              •  In response planning and decision-making,
                you should take  into account the time
                needed by a laboratory to analyze the sample
                for contaminants. This time will vary
                depending on the analyses and the nature  of
                the contaminant and other factors.
32
Water Security Handbook

-------
  • You should work with the laboratory to
   choose the analyses to be done, determine if
   the lab can do the analyses and specify the
   data quality goals (e.g., accuracy, precision,
   range).

Most importantly, you should work together
with the laboratory to understand what the
analytical results mean and the limitations of the
data.

Safety Considerations for Water
Utilities and Others

Contact with contaminated water, soil or other
materials may pose serious threats to your health
or safety and that of
other water utility
staff, emergency
responders, Site
Characterizatio n
Team members,
transport staff,
laboratory staffer
others. Anyone
who  may be
collecting, handling
or analyzing
samples that may
contain unknown contaminants should plan
ahead of time to ensure their own safety and that
of their staff.

Utilities and laboratories should develop and
routinely use Health and Safety plans ahead of
time. You, the Site Characterization Team and
the laboratory should discuss and clearly identify
any potential risks associated with the suspect
water to allow all parties to take appropriate
safety measures. The laboratory should also
have an internal hazard communication plan to
ensure that everyone handling suspect samples is
aware of the potential danger and takes adequate
precautions.
Types of Labs and Analyses
Performed

There are several ways to classify analytical
testing laboratories in the U.S.  Labs can be
classified by sector, such as:

  • Utility labs, such as your water utility's own
    lab, which may be the first to respond to
    most contamination threats;
  • Non-utility labs, such as commercial labs
    that can analyze many kinds of contaminants
    in water, tissue, soil or air; specialized
    labs such as commercial, government or
    university labs that do highly specialized
    analyses; and government labs run by cities,
                   counties, states, the EPA,
                   FBI, Centers for Disease
                   Control and Prevention
                   (CDC) and other public
                   agencies.

                   If your utility has a lab
                   for testing water quality,
                   then your lab will probably
                   be the  first lab to analyze
                   samples suspected of being
                   contaminated. Other non-
                   utility  labs can provide
support by confirming your lab's analysis or by
performing analyses that your lab may not be
able to perform.

Sometimes your utility lab may not be able
to analyze the samples, especially if site
characterization suggests that the samples do not
fall in the "Low Hazard" category described in
Chapter 3. You may therefore decide that the
samples should not be analyzed by your utility
lab but should instead be analyzed by a non-
utility lab that is certified to handle and analyze
hazardous samples.
                                   Water Security Handbook
                                          33

-------



Guide to

Chemical Analysis

1
Radiological Environmental
Labs Chemistry Labs









Module 4
Laboratory Analysis of Samples









f
Biological Analysis





Specialty
Labs



Chemical Aiffii*
Weapons v^*V


Figure 3. Non-Utility Laboratories
Protocol Toolbox.









, 	
Lab Response
Network








1

Environmental
Microbiology Labs

Biotoxins (f\^\)

by Contaminant

Class






. From Module 4, Response
You should also keep in mind that certain
contaminants may potentially contaminate lab
equipment, which could cause contamination
of future tests. For this reason, it is important
to get as much information concerning the
possible contaminant as is feasible from the
threat warning, the field safety screening and site
characterization. This information should be
shared with the laboratory staff in order to plan
for analyses and to ensure both safety and good
results.

Non-utility analytical laboratories can be
classified according to the kinds of analyses
they perform (Figure 3). Different analytical
capabilities are briefly described below.
            Non-Utility Laboratories That
            Perform Chemical Analyses

            Radiological Labs:  Radiological labs analyze
            and identify radioactive substances and
            contaminants such as radioactive isotopes
            (also known as radioisotopes), radionuclides,
            radiochemical compounds and radiological
            weapons. The EPA, Department of Energy
            (DOE), states and some commercial firms have
            labs that can analyze radioactive materials.  The
            Federal Radiological Monitoring and Assessment
            Center (FRMAC), maintained by DOE, can
            provide information on analyzing radioactive
            materials.

            Environmental Chemistry Labs: This group
            includes many EPA, state and commercial labs
            that test water samples to see  if they meet federal
            and state drinking water standards under the
            Safe Drinking Water Act, Clean Water Act or
            other relevant environmental  laws. Under these
            regulations, government-certified labs should
            use certain analytical methods that have been
            standardized and approved for use.
34
Water Security Handbook

-------
Specialty Labs: Specialty labs include both
chemical weapons labs and biotoxin labs.
Chemical weapons, defined by the Chemical
Weapons Convention (CWC), can only be
analyzed by labs that have the appropriate
capability and legal authority. Nationwide, there
are only a few of these labs, and analyses should
usually be arranged by the proper authorities,
such as the FBI or certain other federal  agencies.
Few laboratories currently exist which can
perform chemical weapons analyses.  Biotoxins,
produced by animals or plants, can be analyzed
by certain government or university labs. Some
commercial environmental chemistry labs may
also be able to perform certain biotoxin analyses.

Non-Utility Laboratories That
Perform Biological Analyses

Laboratory Response Network (LRN) Labs:
The Laboratory Response Network (LRN) was
specifically developed to address bioterrorism
threats.  The LRN was set up by the CDC, the
Association of Public Health Laboratories and
the FBI.  LRN labs include certain city, county,
state and federal public  health labs.  Some labs
that are part of the LRN can perform analyses of
pathogens, some biotoxins and a "Select List" of
particularly dangerous pathogens. During the
planning stage, a utility should partner with such
labs in order to jointly plan for threat or incident
response; this should make it easier to quickly
access lab services during an actual incident.

Environmental Microbiology Labs: These labs
test for microbiological pathogens such as disease-
causing bacteria, certain protozoans, viruses, fungi
and other microorganisms.  An environmental
microbiology  lab, state water quality lab, hospital
lab, medical lab, public health lab or a lab that
belongs to the LRN will probably be able to
analyze pathogens in water samples.  However,
not all of these labs may be able to analyze
contaminants resulting from bioterrorism,
depending on what the contaminant is.
Diagrammatic Representation of the
Laboratory Response Network
   The LRN membership is organized
   into "Sentinel Labs" which recognize a
   contaminant, rule it out and/or refer the
   sample to the next level for confirmatory
   testing by "Reference Labs". At the top
   of the pyramid are "National Labs" (such
   as the CDC and the U.S. Army Medical
   Research Institute for Infectious Diseases,
   or USAMRIID), which are capable of
   definitive characterization of even the
   most hazardous biological agents.  See
   Module 4, Response Protocol Toolbox.
Obtaining High-Quality Lab Results

Laboratory analyses of samples are performed
to get accurate factual information on whether
samples are contaminated or not. This factual
information is needed to make important
decisions which can affect many people.  It is
crucial  that the analyses be performed in a manner
that is credible, accurate and repeatable and that
the results  are of sufficient quality to be useful for
decision-making.
                                   Water Security Handbook
                                          35

-------
(If the data will be used for a criminal
investigation, refer to Section 3.5 of Module 4 of
the Toolbox for further information).

Some steps to obtain high-quality analytical
results include the following:

  • Plan for  analyses before a threat or incident
    occurs. Some labs may be able to run certain
    analyses  with little or no advance notice.
    However, many labs should be contacted
    well before the analysis is done so they can
    prepare for the analysis;
  • Choose a reputable, experienced and certified
    laboratory;
  • Maintain communication with the Incident
    Commander, public health officials and the
    laboratory to ensure that the right analyses
    are performed;
  • Use standard protocols for sample collection,
    storage, transport and processing;
  • Use analytical methods which have been
    standardized to the greatest extent possible
    (e.g., EPA methods and other standardized
    methods);
  • Work with the lab and drinking water
    primacy agency to define both data quality
    goals to ensure good, accurate results and
    suitable detection limits that can measure
    both background and harmful, elevated
    concentrations of the compound;
  • Collect enough samples from appropriate
    locations to obtain meaningful,
    representative results; and
  • Maintain good records, such as the chain-
    of-custody, sample locations, date and
    time of sampling, who sampled, shipping
    information, lab contact information, types
    of analyses requested and any observations.
              EPA's Compendium of Environmental
              Testing Laboratories

              This database of laboratories describes
              lab analytical capacities and capabilities.
              The database is designed to assist EPA and
              other users to identify qualified and appro-
              priate laboratories that analyze chemical,
              biological, and radiological agents. Users
              must be registered to access the database.
              To log on, visit the website at www.epa.
              gov/compendium or contact your regional
              EPA laboratory.

            Approaches to Analytical
            Screening For Unknown
            Contaminants

            What should you ask the lab to analyze for when
            the contaminant is not known? Screening
            is a systematic scientific approach to try to
            identify unknown contaminants that may
            be present in a sample.  Screening involves
            progressively analyzing a sample to try to
            identify an unknown contaminant(s) through
            skilled, systematic laboratory analysis.  This can
            be very difficult when there may be thousands
            of possible contaminants.  Contaminant
            identification may be even more difficult if there
            is no information from the threat warning,
            site characterization or field safety screening to
            indicate the nature of the contaminant, if any.
36
Water Security Handbook

-------
Unfortunately, there is no one screening process
that can detect all known contaminants or
compounds. In addition, different laboratories
may have slightly different approaches to
screening. Thus, the judgment and experience
of an individual emergency response planner,
Incident Commander or public health official
can be extremely important in helping the lab
to plan and/or implement the right screening
approach that will result in identifying the
contaminant(s) present, if any.  This is another
reason why everyone involved in emergency
planning and response should understand at least
the basics of laboratory analyses of samples.

Screening a sample that may contain
contaminants involves sifting through evidence
to narrow the list of unknowns down to a few
suspected contaminants. Screening is done in
two steps. The first step is the Basic Screen and
the second step is the Expanded Screen.

The Basic Screen is a broad-spectrum screen
for  common chemical contaminants ("the usual
suspects"). The Basic Screen uses widely-used
methods to analyze the sample for a variety
of contaminants  of concern. However, these
methods do not cover all contaminants that
may potentially be used to contaminate water;
for  example, there are no standard tests for
all biotoxins in water. Make sure that the
laboratory has all the information from field
screening before it undertakes a basic screen.
Basic screening for radiological contaminants is
done by measuring radioactivity; for example,
by using a Geiger counter.  A Geiger counter
can be used as a field screening tool, or it can be
used in the lab. If radioactivity is detected, the
chemical identity of the radionuclide should be
determined through further analysis.

To cover the shortfalls of the Basic Screen,
the Expanded Screen tests for more unusual
chemical or biological contaminants. The
Expanded Screen "explores" to find out what
might be in the water sample and looks for
contaminants that the Basic Screen may have
missed.

Microbiological screening is similar to screening
for chemical contaminants or biotoxins, except
that it targets pathogenic microorganisms. It
involves four steps:

  1)  Rapid field testing. The  sample is tested in
     the field to  see if the pathogen is present.
     Keep in mind that rapid  field testing
     equipment  for pathogens may be limited.
  2)  Sample concentration and recovery in the
     field. Large volumes of suspect water are
     collected and the sample is concentrated
     down to a smaller volume to improve the
     chances of finding a pathogen;
  3)  Testing at a "Sentinel Laboratory", which is
     a laboratory certified for  analysis of certain
     pathogens; and
  4)  Testing at a "Reference Laboratory",
     if necessary, to compare the pathogen
     to known pathogens kept in "reference
     collections" (much as reference books are
     kept in a library).
                                   Water Security Handbook
                                          37

-------
Although laboratory analyses may seem complex,
it is crucial for threat response managers to be
aware of analytical capabilities and limitations
so that you can use the information to make
important decisions.  If laboratory testing
'confirms' the presence of a contaminant in the
water system, public health response actions
should be initiated. These are discussed in the
next chapter.

Why Analytical  Laboratories
Should Plan for Threat  Response

Laboratories are a key part of our nation's
response to water contamination threats and
incidents. Like water utilities and public
agencies, laboratories should be ready to
respond to  an emergency by quickly and
accurately analyzing samples suspected of being
contaminated and producing reliable results.
These results should be used by you, the Incident
Commander, Unified Command, public health
agencies  and others to make important decisions
that could have far-ranging effects.

Labs that may someday be involved in analyzing
samples during a water contamination threat
emergency  should develop their own Laboratory
Response Plans.  A Laboratory Response Plan is
a plan prepared by a laboratory detailing their
approach and capabilities for the 24/7 processing
of emergency water samples. Such a plan should
always be tailored to local needs, facilities and
skills, and it should be reviewed and accepted
before use.  Module 4 of the Toolbox describes
laboratory response planning in detail. The
"model screening procedure", for example, can
help labs plan for screening samples.

In the next chapter, public health response
activities are described.
38
Water Security Handbook

-------
 Public Health  Response  Guide
Introduction

 A primary goal of threat response planning is
-Zi-to protect public health and safety to the
greatest extent possible.  This chapter describes
public health response planning and public
notification in the event of a contamination
threat or incident. This chapter discusses:

  • Who is responsible for undertaking public
    health response actions;
  • The role of the water utility; and
  • The need for cooperation and interaction
    between public health officials, utilities,
    drinking water primacy agencies and others
    to protect public health and deliver good
    information to the public.

As a water utility manager or emergency response
manager, you should read this chapter to ensure
that you understand how to help protect public
health and safety in the event of a contamination
threat or incident.

Chapter 5 summarizes Module 5 of the Toolbox,
which can be obtained at EPA's Water Security
website at www.epa.gov/watersecurity.
Response Planning for Protection
of Public Health

Water utilities, public health agencies and other
threat response managers should plan together
for protection of public health. Such mutual
planning is crucial.

There are five steps to consider in planning for
effective public health response:

  1)  Plan the public health response to a
     contamination threat or incident before a
     threat or incident occurs;
  2)  When a threat or incident occurs,
     determine the public health consequences;
  3)  Carry out operational response actions to
     contain the contaminant and protect public
     health;
  4)  Communicate effectively with other
     agencies, utilities and the public through a
     communication and notification plan; and
  5)  Provide an  alternate short-term water
     supply (your utility's ERP should provide
     options for an alternate water supply).

Each of these steps is summarized below.

Step 1.  Plan the Public Health Response
Before A Threat Occurs

Long before a threat is received, your utility,
together with local public health agencies,
should plan and coordinate the public health
response. State and local public health agencies
typically develop Public Health Response Plans
that cover responses to all kinds of public health
emergencies, including water emergencies.
Examples of response planning are provided
below, modified  for water utilities.
O
 0)
 •m
 c
 o
 Q.
                                  Water Security Handbook
                                         39

-------
O
 0)
 (/)
 c
 o
 Q.
 <1>
I
 o
         Use public health planning in your own
         utility's Emergency Response Plan (ERP):
         Each utility should examine how public health
         response plans of local and state health agencies
         address water contamination.  Utilities should
         use relevant parts of the public health response
         plans in their own ERPs.

         Know which agencies will be involved in
         the public health response: Water utility
         emergency response planners should know
         which agencies will be involved in the public
         health response and what these agencies will be
         doing.  The appropriate responsible agencies
         can vary significantly by locality. You should
         coordinate your emergency response planning
         with appropriate agencies and  take advantage of
         training offered by others.
                                          Develop a communication and notification
                                          plan for your utility:  Fast, reliable
                                          communication is the key to success in
                                          coordinating the public health response. Before
                                          an incident occurs, water utilities should
                                          develop a communication and notification
                                          plan. Communication and notification plans
                                          should  include other agencies, utility staff, utility
                                          customers and the public.  For example, you
                                          should  report a contamination threat to the
                                          appropriate drinking water primacy agency and
                                          public health agencies. Public health agencies
                                          may in  turn alert doctors, clinics and hospitals
                                          to be on the lookout for public health symptoms
                                          and to report these to the public health agency.
                                          Public health agencies should report symptoms
                                          of contaminated drinking water to utilities.
          Agencies that may be involved in the
          public health response to a water
          contamination incident include:
Water and wastewater utilities;
Drinking water primacy agency;
Local, state and federal public health
and environmental agencies;
Hospitals, clinics, doctors and poison
control centers;
Local, state and federal emergency
services;
U.S. Environmental Protection
Agency;
Centers for Disease Control and
Prevention;
Agency for Toxic Substances and
Disease Registry;
Federal Emergency Management
Agency; and
U.S. Army Corps of Engineers,
National Guard and/or other military
organizations.
Your utility's communication and
notification plan should specify:

  • Agencies, organizations and
    individuals to contact or notify;
  • Who will send and receive
    information;
  • Contact information;
  • The kinds of information to be
    communicated;
  • When and how to notify your staff,
    drinking water primacy agency and
    other agencies and organizations;
  • When and how to notify the public;
    and
  • A backup communication and
    notification system.
                                                        Identify possible operational response actions
                                                        during the planning process: During the
                                                        planning process, your utility should identify
                                                        possible operational response actions to respond
                                                        to possible public health threats.  During an
                                                        actual contamination threat or incident, you
                                                        should act quickly to protect public health
                                                        and prevent the contaminant from spreading.
         40
                             Water Security Handbook

-------
Operational response actions are described below
in Step 3.

Step 2. When a Threat or Incident Occurs,
Determine the Public Health Consequences

Once a contamination incident has been
'confirmed', you should find out more about
the contaminant and its health effects in order
to choose the right course of action to keep the
contaminant from spreading and to protect
public health. EPA's Water Contaminant
Information Tool (WCIT) can provide useful
information to help you make these decisions.
 Water Contaminant Information Tool
 (WCIT)

 The Water Contaminant Information
 Tool is a secure, on-line database
 developed by the U.S. EPA that provides
 information on contaminants of concern
 for water security. WCIT contains the
 most up-to-date, reliable information on
 water contaminants, such as contaminant
 names, fate and transport, health effects
 and toxicity, medical information,
 drinking water treatment effectiveness,
 potential water quality and environmental
 indicators, sampling and analysis, helpful
 response activities for utilities and other
 useful  information.

 To learn more about WCIT, download
 the WCIT Fact Sheet from EPA's water
 security publications website at cfpub.
 epa.gov/safewater/watersecurity/tools.
 cfm , or connect to the WCIT website  at
 www.epa.gov/wcit. Access to the WCIT
 database is controlled.
     What You Need To Know To Make The
     Right Public Health Decision:

       • Potential acute (severe short-term)
        health effects of the contaminant;
       • Potential chronic (less severe but
        longer-lasting) health effects of the
        contaminant;
       • Contaminant concentrations that can
        cause these effects;
       • Exposure pathways (ingestion,
        inhalation or skin contact); and
       • How long the contaminant will
        remain in water, what causes the
        contaminant to break down, what the
        breakdown product is and how toxic
        this breakdown product is compared
        to the original substance.
As the utility manager, you should work with
public health agencies to determine how fast
the contaminant can spread throughout the
water system, whether there are points at which
the spread of contaminants can be stopped
and what public health response actions to
take.  For example, you should have up-to-date
information on your water distribution system,
such as water flow volumes and flow rates,
locations of shutoff valves and access points and
so on, so that you can determine where and
how fast contaminated water might spread in
the event of a contamination incident.  Getting
this information and keeping it up to date may
be challenging, but the benefit should be an
improved ability to protect public health.

If it is possible, the public health agency should
also try to estimate how much contaminant
remains after a given period of time has passed,
how dangerous this amount is, what health
precautions to take, and when and where these
precautions apply.
O
 0)
 (/)
 c
 o
 Q.
 <1>
I
 o
                                  Water Security Handbook
                                          41

-------
;o
'5
O
 c
 o
 Q.
          Estimating Terrorist Impacts on Water
          Systems:

          EPA and others have developed tools, such
          as hydraulic models, to help utilities estimate
          the effects of a terrorist incident on drinking
          water systems. If your utility decides to use
          such tools, you should be aware that such
          models may involve costs and require training
          and time to apply them.  Practice using such
          tools before an incident occurs so that you
          can  act quickly and with due diligence when
          a real incident occurs.
Step 3. Carry Out Operational Response
Actions

Operational response actions are actions that
protect public health by reducing exposure to
the suspect water.  Operational response actions
are often carried out while more information
is being collected to determine whether or not
the threat is 'credible'. It is critical to work
with local agencies and elected officials when
initiating operational response actions.

Example: The Mayor receives a call that a water
tank has  been contaminated. The Mayor then
phones you at the water utility and you decide, as
the water utility manager, that contamination of
a particular water tank is 'possible' because that
tank is on-line and the fence around the tank is
old and decrepit. Your immediate operational
response  is to shut the valves on pipes leading
into and  out of the water tank to isolate the
water tank from the rest of the water system (if
feasible),  thus preventing any contaminant from
spreading to the rest of the system. You may
need to notify your state drinking water primacy
agency immediately. Also, in addition to the
federal Public Notification Rule, local notification
rules can vary by locality and all other appropriate
parties should be notified (e.g., public health
agency, law enforcement, and others).
Containment of suspect water should be done
as soon as possible, ideally during the first stage
of threat evaluation when you are determining
if the threat is 'possible' or not. If you cannot
contain the suspect water quickly, then you
should accelerate the determination of whether
or not the contamination threat is 'credible'.

Deciding on operational responses can be tricky,
because there could be unforeseen consequences
of the action taken. For example, restricting
water use or water delivery could result in
portions of the service area, including hospitals
and schools, being deprived of water.  This could
lead to poor sanitation or a host of other effects.
To deal with these other effects, you should plan
well in advance of a contamination threat or
incident.
  For Water Utilities: Possible Operational
  Response Actions to Protect Public Health

  Q  Isolate and contain the suspect water so
      it doesn't spread and contaminate other
      parts of the water system;

  Q  Increase levels of disinfection; for
      example, by using a mobile disinfection
      unit to treat a part of the water system or
      by adding more chlorine to the system;

  Q  Notify the public to take precautions,
      such  as "Boil water", "Do not drink",
      or "Do not use" in coordination with
      your  state primacy agency, public
      health officials and other officials, as
      appropriate.

  Q  Distribute bottled water or water from
      neighboring utilities as a safe alternative
      to the contaminated or suspect water.
         42
                                   Water Security Handbook

-------
Step 4. Notify the Public

If the contamination threat is 'credible', then
you should coordinate with your drinking water
primacy agency and public health agencies to
decide whether to issue a public notice or not. It
is critical to work with local agencies and elected
officials when planning public notification.

One way to help the public minimize their
exposure to contaminated water is to issue a
public notice to avoid drinking or using the
water.  The Federal Public Notification Rule
under the National Primary Drinking Water
Regulations requires public notification when
there is a "situation with significant potential to
have serious adverse effects on human health as a
result of short term exposure"^ CFRง 141.202).

Once you have decided to notify the public to
reduce their exposure, you should decide what
type of notification to issue, based on the threat
or incident and the contaminant potentially
involved. Examples of public notices are
described in the table on page 44.
Public Notification Procedure under
the National Primary Drinking
Water Regulations, Federal Public
Notification Rule (Tier 1, 40 CFR
141.202):

  Q Notify the public as soon as
     practical, but no later than 24
     hours after you learn  of the water
     quality violation or credible
     contamination threat;

  Q Discuss the threat with your
     drinking water primacy agency as
     soon as practical, but no later than
     24 hours after you learn of the
     situation, in order to  find out if
     any additional public notification
     is required; and

  Q Provide any additional public
     notification as required by your
     drinking water primacy agency.
     Examples might be repeat notices,
     providing direction on how long
     the notices are in effect, how often
     the notices are to be issued, the
     form and timing of public notices,
     and other actions to reach all your
     water system users. Requirements
     may vary by state,  (see www.epa.
     gov/safewater/pn.html).
O
 0)
 •m
 c
 o
 Q.
                                   Water Security Handbook
                                     43

-------
         Examples of Public Notices About Drinking Water
          Type of Notice
                  When To Use This Notice
       Relative Burden on Public
          Boil Water
          Before Use
                  Use if boiling will make the water
                  safe to drink and boiling does
                  not create other health problems,
                  particularly through routes of
                  exposure other than drinking (e.g.,
                  inhalation or skin contact with water
                  vapor).
       Least burden.  Facilities which use large
       amounts of water for drinking or food
       preparation will be most affected.
          Do Not Drink
                  Use if boiling is not an option and if
                  water vapor and skin contact do not
                  pose risks.
       More burden - an alternate water
       supply for drinking and food
       preparation will be needed.
O
 CD
 W
 c
 o
 Q.
 0)
          Do Not Use
                  Use if the contaminant is unknown,
                  if treatment is not possible at the
                  moment or if the contaminant poses
                  a health risk through inhalation of
                  water vapor or through skin contact
                  with affected water.
       Greatest burden - an alternate water
       supply for all uses, including fire
       fighting and flushing toilets, will be
       needed.
Because water use restrictions can have
unintended health consequences, you should
weigh the potential public health consequences
of restricting water use against the public health
threat posed by the contaminant.

Step 5.  Provide an Alternate Water Supply for
the Short Term
that providing an alternate water supply can pose
a significant logistical challenge and should be
planned in advance. Consider the use of mutual
aid agreements to provide backup water from
other municipalities or sources, a memorandum
of understanding (MOU) with other water
suppliers, and/or contracted services to provide
alternate water.
         If the decision is made to issue a "Do Not
         Drink" or "Do Not Use" order, utilities should
         be prepared to provide alternate safe sources
         of water such as bottled water, potable water
         trucked to distribution points, or water provided
         by an interconnection. You may need assistance
         from federal, state and/or local emergency
         responders to distribute water.  Keep in mind
                                               In the next
                                               chapter, you
                                               will learn about
                                               the key issues
                                               involved in
                                               remediation and
                                               recovery of a
                                               water system.
         44
                                  Water Security Handbook

-------
 Remediation  and  Recovery Guide
Introduction

  In this chapter, you will learn about
  the key issues involved in remediation
of a contaminated water system and
how to return the system to normal, safe
operation.  Understanding the remediation
process is important because, although
you may not necessarily be responsible
for overseeing remediation, you should be
seeking ways to provide safe water while
remediation is ongoing. Other parties
involved in remediation should include
public health agencies and drinking water
agencies that will monitor water quality
and the remediation, and remediation
specialists who will conduct the technical
work of contaminant cleanup.

Once a contamination threat or incident
has been 'confirmed', the contamination
must be cleaned up, or remediated.
Remedial response actions are
actions that reduce or eliminate the
contaminant.  By this time, remediation
experts should be on hand to clean up the
contaminant.

When the remediation is completed and the
water system is demonstrated to be safe, your
responsibility should be to return the water
system to normal,  safe operation as quickly
as possible. Recovery refers to the return to
normal operations after remediation.
Chapter 6 summarizes Module 6 of the Toolbox,
which can be obtained at EPA's Water Security
website at www.epa.gov/watersecurity.
Who is Responsible?

Once a contamination threat is 'confirmed' and
the contamination has been contained, it is likely
that a Unified Command structure will oversee
remediation and recovery actions. Unified
Command will manage a team of specialists from
different agencies and organizations who know
how to remediate the particular contaminant
involved. Specialists should be able to tell you
when it is safe to return to normal operations.
                                              CD
                                              o
                                              o>
                                              O
0)
                                Water Security Handbook
                                       45

-------
 
-------
restore the water system to normal. Remediation
can also be done in stages, such as emergency
short-term remediation to reduce dangerous
levels of a contaminant to a safer level, followed
by long-term remediation to remove any
remaining low levels of the contaminant.

Step 5. Choose the Right Remediation
Technology

Unified Command should select a remediation
technology that will:

  • Protect human health and the environment;
  • Comply with all applicable regulations (such
    as the Safe Drinking Water Act); and
  • Be feasible, affordable and cost-effective to
    the extent possible.

Step 6. Design the Remediation

After remediation actions and technology are
selected, the engineering design, planning and
documentation  of the remediation begins.
Your water utility and other technical support
staff should be involved in providing technical
assistance in the design of the remediation
to help prevent unforeseen impacts on the
remaining unaffected water system.

Step 7. Do  the Remediation

Once the remedial design has been approved, the
remediation  and rehabilitation
of the contaminated parts of
the water system are carried
out. Contractors may  assist
in these procedures.  Your
expertise in the normal
operation of the water  system
will be essential  during this
step to avoid unforeseen
impacts on the water system.
Step 8.  Do Post-Remediation Monitoring

After remediation is completed, both water
quality and the water system should be
monitored to ensure that the remediation was
effective. If the remediation was not effective,
the problem should be fixed and the water tested
again.

Step 9.  Communicate with the Public to
Restore Confidence
During all stages of remediation, you and
Unified Command should keep the community
informed about the remediation process, who
is in charge, how it could affect human health,
what is being done to restore safe water, and
when things are expected to return to normal.
Otherwise, the public may continue to use
unsafe water, hoard water, or act in other ways
that could cause unforeseen problems and even
interfere with remediation.
               The Final Step - Full
               Recovery

               The final step is the resumption
               of safe, normal system
               operations and the provision of
               safe water to the public.  With
               full recovery of your water
               system, you have achieved a key
               goal of effective response.
                                                 CD
                                                 o
o>
O
0)
                                  Water Security Handbook
                                          47

-------
           Final Thoughts
              Planning for water security and emergency
              response may seem overwhelmingly complex.
          However, several key points can help you deal
          effectively with a contamination threat or
          incident:

            1)  Your first priority is protecting public
                health and safety;

            2)  There are many resources for assistance.
                These should be identified as part of
                the planning process, before a threat or
                incident occurs;

            3)  Always use due diligence in planning for
                and responding to a threat;

            4)  For a successful response, it is critical to
                have cooperation and good communication
                between your utility and other agencies and
                response organizations;
                                               5)  Plan and practice emergency response
                                                  procedures ahead of time to ensure that
                                                  an actual emergency response will go as
                                                  quickly and smoothly as possible;

                                               6)  You should make decisions in a timely
                                                  manner, based on the best information
                                                  available to you at the time; and

                                               7)  You can help to ensure legally defensible
                                                  decisions through organization, timeliness,
                                                  quality control and good record-keeping.

                                            Remember, if you manage a utility or its
                                            emergency response program, you are
                                            responsible for protecting public health and the
                                            environment.  However, you are not alone in
                                            this mission.  Establish communications now
                                            with the agencies that can help you during an
                                            emergency, and begin to plan and train for
                                            contamination threats and incidents.
                                                                                   U.S. Environmental Protection Agency
I
 O)
 3
 O
 CG
 c
                                                   EPA Home = Wetter •> - • ...<• .:• - . !.'•• i!.i .• •"•.; er > Water Security
Response Protocol Toomor
Planmns far and Responding to
Drinking waier Conlammatton
Threats and inoflon:* Response
c. firfb • •
    I he ^tL.jfit'.' moui flatten^ drinking V'^ivr and •f.^oliw.ati; ihlra^iuetuies hss become a top pr until y
since the events of 9/11. Significant actions are underway to assess and reduce vulnerabilities to potential
terrorist attacks; to plan for and practice response to emergencies and incidents; and to develop new E
technologies to detect and monitor contaminants and prevent security breaches.
                               This Web site provides rpsojrces tor vaier utilities., sUii and local governments, -ubl1: health c-tfiuais,
                               emergency responders and planners, assistance and training providers, environmental professionals,
                               researchers and engineers, and law enforcement, among others.
                                   tiaininq to aid water u!ih1>es in assessing tfl
                                   vulnerabilities to adversarial actions.
                                                                              Webcasts
                                                                              Tools and Technical Assistant
                                                                              Grants and Fundinq
                                                                              Publical
                                   Emergency / Incident Planning - T
                                   training to help water utilities develop
                                   respond to emergencies.
                                                      Security Enhancements, Research and
                                                           - Latest scientific advanc
                                                      protect drinking water and wastewate
                                                      systems.
                                                      Security Presidential Directives and
                                                      laws.
             www.epa.gov/watersecurity
          48
                              Water Security Handbook

-------
 Glossary  of Terms
Basic Screen - A broad-spectrum screen to
identify common chemical contaminants that
may be present in a suspect water sample.  The
Basic Screen employs widely-used methods to
analyze the sample for a variety of contaminants
of concern. See Chapter 4.

Commercial labs - Labs that perform
testing and analyses of samples as a business.
Commercial labs may be able to analyze many
kinds of contaminants in water, tissue, soil and
air.  See Chapter 4.

'Confirmed' - A 'confirmed' threat is a
'credible' threat that has been verified through
sample analyses that prove that the  water
is contaminated with a harmful substance.
Alternatively, in the absence of analytical data,
a threat  is 'confirmed' when a preponderance of
evidence indicates that a contamination incident
has occurred. A 'confirmed' threat  becomes a
contamination incident.  See Chapter 2.

Contamination threat - A suggestion or
an indication that water has been or will be
contaminated, but no conclusive proof has been
collected yet to confirm that contamination
has actually occurred. A threat may be written,
verbal, or based on observations or  other
evidence. See Chapters 1 and 2.

Contamination incident - A contamination
incident has occurred when the presence of
a harmful contaminant or other substance in
drinking water has been 'confirmed' (i.e., verified
through sample testing or by a preponderance of
evidence).  See definition of'confirmed' (above)
and Chapters 1 and 2.
Contamination Threat Management Matrices
- Module 2 of the Response Protocol Toolbox
contains these matrices to assist in collecting
and organizing the information needed to help
determine if a threat is 'possible', 'credible' or
'confirmed'. Each matrix covers: 1) Information
and factors to be considered in assessing a threat;
2) Possible notifications to make; and 3) Possible
response actions. These generalized matrices can
be customized to a specific utility or incident.
See Chapter 2.

Core field testing - The minimal recommended
monitoring activities to perform when
conducting a  site characterization, including
monitoring for radiation, cyanide, chlorine
residual, conductivity and pH of the suspect
water.  See Chapter 3.

'Credible' - A 'credible' threat is a 'possible'
threat that is believable and plausible, based on
reliable information that shows  there is reason
to believe that the threat warning is real and
that contamination is likely to have happened.
A 'credible' threat is a much higher threat level
than a 'possible' threat.  See Chapter 2.

Due diligence - Due diligence has been
exercised when all suitable, sensible and
responsible actions have been taken to evaluate
a contamination threat or incident and respond
appropriately. See Chapter 1.

Emergency Operations Center (EOC) - A
pre-designated facility established by an agency
or jurisdiction to coordinate the overall agency
or jurisdictional response to  an emergency.  It
is not a part of on-scene incident management,
but supports the on-scene Incident Commander
or Unified Command by arranging for needed
resources.  See Chapter 2.
 CO
 (/)
 tO
_0
O
                                   Water Security Handbook
                                          49

-------
 CO
 (/)
 tO
_0
O
Emergency Response Plans (ERPs) - The
2002 Public Health Security and Bioterrorism
Preparedness and Response Act required water
systems serving more than 3,300 customers to
develop and maintain Emergency Response
Plans (ERPs) to prepare for responding
to contamination threats and intentional
contamination incidents. See Overview.

Environmental chemistry labs - Labs that
analyze environmental samples  to see if they
contain chemical contaminants of concern or
meet federal and state regulations for quality and
safety.  Many EPA, state and commercial labs
perform environmental chemistry analyses.  Labs
performing such analyses should be government-
certified to use standardized, pre-approved
analytical procedures.  See Chapter 4.

Environmental microbiology  labs - Labs
that analyze environmental samples (usually
water, soil or food) to determine if pathogenic
microorganisms are present, such as disease-
causing bacteria, protozoans, fungi, viruses or
others. See Chapter 4.

Expanded Screen - To address  the limitations of
the Basic Screen (see above), an Expanded Screen
tests for more unusual chemical or biological
contaminants or contaminants  that may have
been missed by the Basic Screen.  See Chapter 4.

FEMA (Federal Emergency Management
Agency) - The national agency  that coordinates
emergency and disaster relief responses.
FEMA is one of several agencies included in
the Department of Homeland Security.  See
"Additional Resources".

Field safety screening - A safety screening
procedure that is performed by  the Site
Characterization Team in the field, before
entering the site of a possible threat or
contamination incident.  The field safety
screening is done to observe site conditions and
to detect any immediate threats to the team from
contaminants. It may include field testing for
radioactivity, chemical agents and/or biological
agents. See Chapter 3.

Government labs - Laboratories that are
operated by government agencies at the city,
county, state or federal level.  Examples of the
latter include labs operated by the EPA, FBI,
and Centers for Disease Control and Prevention
(CDC). A common role of government labs
is to test samples to determine if regulatory
standards are met. See Chapter 4.

Hazard categories (Low Hazard, Radiological
Hazard, Chemical Hazard, Biological Hazard)
- The hazard posed by a contamination threat or
incident may be classified according to the type
of hazard, the cause of the hazard, and the risks
posed.  Examples of hazard categories include
Low Hazard (no obvious signs of contaminants;
contaminants are probably diluted and not
widespread), Radiological Hazard (radiation is
tentatively identified at the site or in the water,
posing potential risk), Chemical Hazard (highly
toxic chemicals such as WMD or volatile toxic
industrial chemicals are tentatively identified
at the site or in the water, posing potential
risk), and Biological Hazard (pathogenic
microorganisms are tentatively identified, posing
potential risk). See Chapter 3.

Incident Command  System (ICS)  - This is
the national standard for the command, control
and coordination of a response to a threat,
incident or emergency of any kind.  It requires
that  an individual Incident Commander, from
an agency that is responsible for responding to
the emergency or threat, manage the response
activities.  See Chapter 2.

Incident Commander - In the Incident
Command System, the Incident Commander is
the individual who is responsible for managing
the overall response to the emergency.  See
Chapter 2.
        50
                                  Water Security Handbook

-------
Initial hazard assessment - Before the Site
Characterization Team is sent to investigate the
site of a threat or contamination incident, the
Incident Commander should make an initial
hazard assessment to evaluate potential risks and
the need for special protective gear or equipment
for handling hazardous materials or sampling.
This initial assessment should be based on
available information and an initial evaluation
of the threat (i.e., is  the threat 'possible' or
'credible', or not). See Chapter 3.

Laboratory Response Network (LRN) Labs
- A network of labs that was specifically set up
to address bioterrorism threats. The  LRN was
created by the Centers for Disease  Control
and Prevention (CDC), the Association of
Public Health Laboratories, and the FBI. LRN
labs include certain city, county, state and
federal public health labs that can perform
analyses of pathogens, some biotoxins, and
other particularly dangerous pathogens. In
order to have samples analyzed by  an LRN
lab, arrangements should be made during the
response planning stage. See Chapter 4.

Non-utility labs - Laboratories that  are not
run by water or wastewater utilities.  Examples
include government labs, commercial labs,
university or research labs, specialty labs and
other types of labs.  See Chapter 4.

National Response Plan (NRP) - The NRP
provides a comprehensive, all-hazards approach
to managing the response to domestic incidents
or emergencies.  It provides the basis for federal
agency coordination with state, local and tribal
governments and with the private sector to
address incidents or emergencies. The NRP is
based on the National Incident Management
System (NIMS)  for  managing incident response
(see below); together they provide  a template for
effective threat prevention and response.  See
Chapter 2 and "Additional Resources".
National Incident Management System
(NIMS) - NIMS provides a comprehensive
national framework and standard for incident
management. NIMS incorporates the Incident
Command System as the  management system to
deal with threats, emergencies and incidents.  See
Chapter 2 and "Additional Resources".

Operational response actions (also known as
immediate operational responses) - Actions
that protect public health by reducing exposure
to the suspect water.  Operational response
actions are often carried out while a threat is
being evaluated in order to protect public health
in the event that the threat is confirmed to
be an incident.  Examples include preventing
the spread of suspected contaminated water,
increasing disinfection, notifying the public to
take precautions, or distributing bottled water.
See Chapters 2 and 5.

'Possible' - After a threat  is received, the first step
in evaluating the credibility of a threat is to decide
if it is 'possible'. A 'possible' threat is one where
the circumstances suggest  that contamination
could have occurred and that further investigation
is needed. If the threat is found to be not
'possible', then the investigation is closed, the
threat is documented, and operations are returned
to normal.  See Chapter 2.

Preponderance of evidence - Most of the
available evidence points in a certain direction.
See Chapter 2.

Public notification procedures - Procedures
for notifying the public in the event that a
water contamination threat or incident has
occurred where there is "significant potential
to have serious adverse effects on human
health as a result of short-term exposure"
(40 CFR ง 141.202, known as the Federal
Public Notification Rule under the National
Primary Drinking Water Regulations). Public
notification procedures include issuing a public
 CO
 (/)
 tO
_0
O
                                   Water Security Handbook

-------
 CO
 (/)
 tO
_0
O
notice identifying the potential contaminant and
providing directions for avoiding drinking or
using the water. See Chapter 5.

Radiological labs - Labs that analyze and
identify radioactive substances and contaminants
such as radioactive isotopes, radionuclides,
radiochemical compounds and radiological
weapons. The EPA, Department of Energy
(DOE), states and some commercial firms have
radiological labs. FEMA operates the Federal
Radiological Management Center (FRMAC)
which can provide information on analyzing
samples for radioactive materials.  See Chapter 4.

Rapid field testing - Testing that is done in the
field by the Site Characterization Team to try
to identify the type of contaminant that may
be present so that the right laboratory analyses
can be done.  Field testing is done to obtain
preliminary information, and should be followed
up by laboratory testing to 'confirm' whether
contamination is present or not.  See Chapter 3
and the EPA's Technology Testing and Evaluation
Program (TTEP) in "Additional Resources"
(under EPA NHSRC) to learn about equipment
for rapid field testing.

Recovery - The return to normal operations after
remediation of a contaminated water system or
site has been completed. See Chapter 6.

Remediation, remedial response actions
- Response actions that reduce or eliminate the
contaminant from the affected water system
or site. Remediation is usually performed by
remedial specialists overseen by agencies with
remediation oversight responsibilities.  See
Chapter 6.

Response Guidelines - An EPA document
that contains all of the forms, checklists, and
report formats from the comprehensive Response
Protocol Toolbox: Planning For and Responding
to Drinking Water Contamination Threats
and Incidents. The Response Guidelines and
this Handbook were designed as companion
documents to be used together for response
planning.  See "Overview" and "Additional
Resources".

Response Protocol Toolbox:  Planning For and
Responding to Drinking Water Contamination
Threats and Incidents (Toolbox, or RPTB) - A
comprehensive guidance document developed
by the EPA for the water sector, the Toolbox
describes planning measures to prepare for and
respond to drinking water contamination threats
and incidents. The chapters in this Handbook
correspond to modules in the Toolbox. See
"Overview" and "Additional Resources".

Site characterization - Site characterization
involves the investigation of the site of a threat
or incident to find out the "what, where,
when, who, why and  how" of the threat or
incident. After the initial hazard assessment,
site characterization activities include field safety
screening, site investigation, rapid field testing
of the water, and sampling. A site could be an
entire water system or a component, such as
the distribution system, source water, treatment
facility, storage tanks  or some other area that
may have been contaminated. See Chapter 3.

Site characterization team - The group of
individuals that performs site characterization
and sampling activities following receipt of
a threat or incident report. The team may
include people from the water utility, police,
fire, HazMat specialists, environmental response
teams from government agencies, public health
officials, FBI and EPA criminal investigators,
civil support teams and representatives of other
agencies. See Chapter 3.

Specialized or specialty labs - Commercial,
government or university labs that perform
highly specialized analyses that are not
commonly performed by other labs. Examples
        52
                                  Water Security Handbook

-------
include chemical weapons labs and biotoxin
labs. Nationwide, there are only a few chemical
weapons or biotoxin labs, and analyses should
usually be arranged by the proper authorities,
such as the FBI or certain other federal agencies.
See Chapter 4.

Threat warning - An indication that something
may be wrong with water quality or the drinking
water system. Threat warnings may include
any, some or all of the following:  security
breach, witness account, direct notification
by the  perpetrator, notification by the news
media, notification by law enforcement, unusual
water quality, consumer complaints, and/or
notification by public health agencies. See
Chapter 2.

Unified Command - In ICS,  Unified Command
is a unified team effort which  allows all agencies
with responsibility for the incident, either
geographic or functional, to manage the incident
by establishing a common set  of goals and
strategies. This is accomplished without losing
or giving up agency authority, responsibility, or
accountability.  See Chapter 2.

Utility labs  - Labs that are run by water utilities.
Utility labs routinely perform  water quality
monitoring to ensure that drinking water is safe
for  customers. See Chapter 4.
                                                                                                 H
Water  Utility Emergency Response Manager
(WUERM)  - An individual who is responsible                                                       ^
for  managing the water utility's internal
emergency response procedures (also known
as the water  utility's emergency response                                                             (/)
coordinator). This individual  may also serve                                                         _
as the utility's Incident Commander during                                                          CD
emergencies. See Chapter 2.
                                   Water Security Handbook                                 53

-------
         Additional  Resources

(
o
This section provides information on resources
that may help you in planning and responding
to contamination threats and incidents.
Information was current at the time of
publication of this Handbook.

Agency for Toxic Substances and Disease
Registry (ATSDR): ATSDR is a national public
health agency which compiles information on
contaminants and disease-causing agents. See
their website at www. atsdr.cdc.gov/.

Centers for Disease Control and Prevention
(CDC): See the CDC website at www.cdc.gov/
or call the CDC Hotline at 1-800-CDC-INFO.
CDC compiles and tracks information on
diseases, illness, outbreaks, contaminants, health
effects, emergency preparedness and response,
the national Laboratory Response Network
(LRN), bioterrorism agents and other topics.

Compendium of Environmental Testing
Laboratories: This laboratory compendium is a
database of laboratories, developed by the EPA,
which describes the analytical capabilities and
capacities of labs nationwide.  The database was
designed to assist EPA and other users to identify
qualified and appropriate laboratories to analyze
chemical, biological and radiological agents.
To register on-line or to obtain additional
information, visit www.epa.gov/compendium.
Access to the laboratory compendium is
controlled.

Department of Homeland Security (DHS):
See the DHS website at www.dhs.gov/. The
website provides extensive information
concerning threats and posts threat levels and
other bulletins. It also contains links to the
National Incident Management System (NIMS),
Homeland Security Information Networks for
Critical Sectors or HSIN-CS, and information
regarding the Freedom of Information Act
(FOIA).

EPA National Homeland Security Research
Center (NHSRC):  The NHSRC provides
technical information on methods, tools and
technologies to assist in protecting public
health and safety in the event of a terrorist
attack.  Examples include the EPA's Technology
Testing and Evaluation Program (TTEP), the
Standardized Analytical Methods for Use During
Homeland Security Events and the Security
Information Collaborative — A Guide for Water
Utilities, described elsewhere in this section.
See the EPA NHSRC website at www.epa.gov/
nhsrc/.

EPA Safe Drinking Water Hotline: This
hotline is a service of the Office of Ground
Water and Drinking Water. It provides the
general public, regulators, medical and water
professionals, academia and media with
information about drinking water and ground
water programs authorized under the Safe
Drinking Water Act. You can reach the hotline
at 1-800-426-4791  or ask a question at the
Hotline's website at www.epa.gov/safewater/
hotline.

EPA Water Security Division: See EPA's
website at www.epa.gov/watersecurity for
information on emergency response planning,
training workshops, tools and useful links.
The website includes links to information on
Emergency  Response Plans (ERPs), the Response
Protocol Toolbox, this Handbook, and many other
water security resources.
        54
                                 Water Security Handbook

-------
Emergency Response Plan Guidance far Small
and Medium Systems, Emergency Response
Plan Outline, and other emergency response
planning documents can be downloaded from
EPA's water security website at www.epa.gov/
watersecurity or by calling EPA's Safe Drinking
Water Hotline at 1-800-426-4791 or by sending
an e-mail via the Hotline's website at www.epa.
gov/safewater/hotline.

Emergency Response Tabletop Exercises for
Drinking Water and Wastewater Systems
CD: This CD, developed by the EPA,
contains tabletop exercises to  help train water
and wastewater utility workers in preparing
and carrying out emergency response plans.
The exercises provided on the CD can help
strengthen relationships between a water supplier
and their emergency response team (e.g., health
officials, laboratories, fire, police, emergency
medical services, and local, state  and federal
officials).  Users can also adapt the materials for
their own needs. Explore the CD at www.epa.
gov/watersecurity.

Federal Emergency Management Agency
(FEMA):  See the FEMA website at www.fema.
gov/orcall 1-800-621-FEMA. This national
agency coordinates emergency and disaster relief
response.  Their website contains links to the
National  Response Plan, the National Incident
Management System (NIMS), the Federal
Radiological Emergency Response Plan and
many other useful emergency response links.

InfraGard: This is an FBI-sponsored
information sharing and analysis  effort serving
the interests and combining the knowledge base
of a wide range of members. At its most basic
level, InfraGard is  a partnership between the FBI
and the private sector. InfraGard is an association
of businesses, academic institutions, state
and local law enforcement agencies and other
participants dedicated to sharing  information
and intelligence to prevent hostile acts against the
United States.  Learn more at www.infragard.net.

National Response Center (NRC) and
National Response Team (NRT): The NRC
is the federal point of contact for reporting
incidents related to oil, hazardous material
discharges, suspicious activity, security
breaches or terrorism occurring in the United
States.  The NRT is an organization of 16
Federal departments and agencies responsible
for coordinating emergency preparedness
and response to oil and hazardous substance
pollution incidents. The Environmental
Protection Agency (EPA) and the U.S. Coast
Guard (USCG) serve as Chair and Vice Chair,
respectively.  Call the NRC at 1-800-424-8802
or 1-202-267-2675 or see the NRT's website at
www.nrt.org.

National Incident Management System
(NIMS): The NIMS integrates effective
practices in emergency preparedness and
response into  a comprehensive national
framework for incident management. The
NIMS will enable responders at all levels to work
together more effectively to  manage domestic
incidents no matter what the cause, size or
complexity. See the DHS website at  http://www.
dhs.gov/interweb/assetlibrary/NIMS-90-web.pdf
for the full NIMS document.

National Response Plan (NRP): The NRP
establishes a comprehensive all-hazards approach
to enhance the ability of the United States to
manage domestic incidents. It provides the
basis for federal government coordination with
state, local and tribal governments and the
private sector during incidents.  The NRP can
be downloaded from DHS's website at www.dhs.
gov/dhspublic/interapp/editorial/editorial  0566.
xml.

(
o
                                   Water Security Handbook
                                          55

-------

(
o
National Environmental Methods Index
for Chemical, Biological and Radiological
Contaminants (NEMI-CBR): NEMI and
CBR Methods Advisor are two tools which will
provide information on chemical, biological
and radiological contaminants and analytical
methods of detection, analysis and identification.
These tools are being developed by the U.S.
EPA. The National Environmental Methods
Index (NEMI) is a free, searchable Internet-
based database of environmental methods that
allows comparison of methods, performance,
cost and other information.  NEMI is already
available on the Internet at www.nemi.gov.
NEMI-CBR incorporates the CBR Methods
Advisor, which can help a user to quickly assess
a threat, evaluate the site of the incident, collect
samples and choose the best method for a given
situation when there is limited information
available regarding the possible identity of a
contaminant.

Physician On-Line Reference Guide for
Waterborne Disease: This on-line reference
provides information on water-related diseases
and other medical and health emergency
response information.  See the website at www.
WaterHealthConnection.org/index.asp.

Public Health Security and Bioterrorism
Preparedness and Response Act of 2002 (also
known as the Bioterrorism Act of 2002): Title
IV of the Act addresses drinking water security
and safety, and required drinking water systems
serving more than 3,300 persons to develop
response measures to incidents that could disrupt
safe water supplies. To learn more, visit the
EPA website on water security legislation and
directives at http://cfpub.epa.gov/safewater/
watersecurity/legislation.cfm.

Response Guidelines (Response Protocol
Toolbox: Planning For and Responding to
Drinking Water Contamination Threats and
Incidents: Response Guidelines): This EPA
document is a companion to this Handbook
and contains many forms, checklists and
report formats to help a water system organize
information for emergency response planning.
These documents can be downloaded from
EPA's Water Security website at www.epa.gov/
watersecurity.

Response Protocol Toolbox: Planning For and
Responding to Drinking Water Contamination
Threats and Incidents: The EPA developed and
wrote the Toolbox, building on the experience
and expertise of several drinking water utilities,
particularly the  Metropolitan Water District of
Southern California. Organized in modular
format, the Toolbox assists with emergency
response preparedness and will be of value to
drinking water utilities, laboratories, emergency
responders, state drinking water programs,
technical assistance providers and public
health and law enforcement officials. It can be
downloaded at www.epa.gov/watersecurity.

Security Information Collaborative — A Guide
for Water Utilities: This short (40-page)
booklet, developed by the EPA, describes how
water and wastewater utilities can form beneficial
collaboratives to share information on water
security. Case studies are combined with step-by-
step suggestions for utilities to coordinate with
key water security partners. The booklet may be
downloaded from the EPA's National Homeland
Security Research  Center's publications website at
www.epa.gov/nhsrc/pubs.htm.

Standardized Analytical Methods far Use
During Homeland Security Events: This
comprehensive compendium of analytical
methods was developed by the EPA for
use during an intentional contamination
event. The document, EPA Publication No.
EPA/600/R-04/126, is available from the EPA
NHSRC website at: www.epa.gov/nhsrc/pubs/
reportSAM092904.pdf.
        56
                                  Water Security Handbook

-------
U.S. Army Medical Research Institute of
Infectious Diseases (USAMRIID): This Army
lab conducts research on infectious diseases. For
more information, visit their website at www.
usamriid.army.mil/ or write to: Commander,
USAMRIID, 1425 Porter Street, Frederick, MD
21702-5011.

U.S. Technical Support Working Group
(TSWG):  The TSWG is a federal working
group that provides information on security
products and tools, such as the U.S. Department
of Energy's 21 Steps to Improve Cyber Security of
SCADA Networks. This document and other
useful products can be downloaded from the
TSWG's website at www.tswg.gov/tswg.

Water Contaminant Information Tool
(WCIT):  EPA developed WCIT, which is a
secure on-line database that provides information
on contaminants of concern for water security.
To learn more about WCIT, download  the
WCIT Fact Sheet from EPA's water security
publications website at http://cfpub.epa.gov/
safewater/watersecurity/tools.cfm or connect to
the WCIT website at www.epa.gov/wcit. Access
to the WCIT database is controlled.
                                                                                                <1>
                                                                                                O
Water Information Sharing and Analysis                                                          ^
Center (WaterlSAC): This is a water security
information-sharing system which is accessible
via a website at www.waterisac.org. The
WaterlSAC website has a public portion and
a secure membership-only portion available to
subscribing utility personnel. WaterlSAC is
designed for disseminating alerts and warnings,
receiving incident reports and sharing water-
related information among water and wastewater
utilities.

Water Security Channel (WaterSC): WaterSC
is a free service of the WaterlSAC which
was designed to disseminate basic security
information, as developed by the federal
government, via e-mail and a secure website. To
sign up, visit www.watersc.org.

                                  Water Security Handbook                                 57

-------
List of Contacts for States, Commonwealths, and Territories
State
Alabama
Alaska
American
Samoa
Arizona
Arkansas
California
Colorado
Connecticut
Delaware
District of
Columbia
Florida
Georgia
Guam
Hawaii
Idaho
Illinois
Indiana
Iowa
Kansas
Kentucky
Drinking Water Program Website
Department of Environmental Management: Water Supply Branch
http://www.adem.state.al.us/WaterDivision/Drinking/DWMainInfo.htm

Department of Environmental Conservation: Drinking Water Program
httt>://www.state.ak.us/dec/eh/dw/
Environmental Protection Agency
http://www.epa.ffov/Reffion9/cross pr/islands/samoa.html

Department of Environmental Quality: Safe Drinking Water Program
http://www.azdeq.ffov/environ/water/dw/index.html

Department of Health: Division of Engineering
http://www.healthvarkansas.com/eng/

Department of Health Services: Division of Drinking Water and
Environmental Managementhttp://www.dhs.ca.gov/ps/ddwem/
technical / dwp / dwpindex.htm
Department of Public Health and Environment: Drinking Water Program
http://www.cdphe.state.co.us/wq/Drinking Water/Drinking Water
Program Home.htm
Department of Public Health: Drinking Water Section
http://www.dph.state.ct.us/BRS/Water/DWD.htm
Department of Health and Social Services: Division of Public Health
http: / /www.dhss. delaware.gov/dhss/dph/about.html
Environmental Protection Agency, Region 3
http: / / www.epa.ffov/reff3wapd/drinkinffwater/DCdrinkinff /index.htm

Department of Environmental Protection: Drinking Water Program
http://www.dep.state.fl.us/water/drinkingwater/index.htm
Department of Natural Resources: Water Resources Branch
http://www.gaepd.org/Documents/index water wrb.html
Environmental Protection Agency: Water Programs Division
htto://www.ffu ameoa.ffovffuam.net/orofframs/water/sdw.html
Department of Health: Environmental Health Division, Safe Drinking
Water Branch http://www.hawaii.gov/health/environmental/water/
sdwb/index.html
Department of Environmental Quality: Drinking Water Program, Water
Quality Division http://www.deq.state.id.us/water/prog issues/
drinking water/overview.cfm
Environmental Protection Agency: Bureau of Water, Division of Public
Water Supplies htto://www.eoa.state.il.us/water/index.html
Department of Environmental Management: Drinking Water Branch
http://www.in.gov/idem/water/dwb/
Department of Natural Resources: Water Supply Program
http://www.iowadnr.com/water/drinkinff/index.html

Department of Health and Environment: Bureau of Water, Public Water
Supply Section http://www.kdhe.state.ks.us/pws/
Department for Environmental Protection: Division of Water
http: / /www. water.ky.gov/dw/
Phone
Number
(334) 271-7700
(907) 269-7647
(684) 633-2304
(602) 771-2300
(800) 234-5677
(501) 661-2623
(916)449-5577
(303) 692-3500
(860) 509-7333
(888) 459-2943
(302) 744-4700
(215)814-5781
(850) 245-8336
(404) 657-5947
(888) 373-5947
(671) 475-1638
(808) 586-4258
(208) 373-0289
(217) 785-8653
(317)232-8603
(800)451-6027
(515)725-0282
(785) 296-5503
(502) 564-3410
58
Water Security Handbook

-------
State
Louisiana
Maine
Maryland
Massachusetts
Michigan
Minnesota
Mississippi
Missouri
Montana
Nebraska
Nevada
New
Hampshire
New Jersey
New Mexico
New York
North
Carolina
North Dakota
Ohio
Oklahoma
Oregon
Pennsylvania
Puerto Rico
Rhode Island
Drinking Water Program Website
Office of Public Health: Safe Drinking Water Program
http://www.oph.dhh.louisiana.gov/engineerservice/safewater/
Maine Department of Health and Human Services: Drinking Water
Program http://www.state.me.us/dhs/eng/water/
Department of the Environment: Water Supply Program
http://wAvw.mde.state.md.us/Programs/WaterPrograms/Water
Supply /index.asp
Department of Environmental Protection: Drinking Water Program
http://www.mass.gov/dep/water/drinking.htm
Department of Environmental Quality: Water Bureau
http://www.michigan.gov/deq/04607 ,7-135-3313 3675— rOO.html
Department of Health: Drinking Water Protection Section
http://www.health.state.mn.us/divs/eh/water/index.html
Department of Health: Water Supply Division
http://www.msdh. state.ms.us/msdhsite/_static/44,0,76.html
Department of Natural Resources: Water Protection Program
http://wAvw.dnr.mo.gov/wpscd/wpcp/index.html
Department of Environmental Quality: Public Water Supply Program
htto://www.dea.state.mt.us/wainfo/Index.aso
Department of Health and Human Services: Public Water Supply
Program htto://www.hhs.state.ne.us/enh/owsindex.htm
State Health Division: Safe Drinking Water Program
http: / /ndep.nv.gov/bsdw/index.htm
Department of Environmental Services: Water Division
http: / /www.des.state.nh.us/wseb /
Department of Environmental Protection: Water Supply Administration
http: / /www.state.nj .us /dep /watersupply/
Environment Department: Drinking Water Bureau:
htto://www.nmenv.state.nm.us/dwb/dwbtoo.html
New York State Department of Health: Drinking Water Protection
Program htto://www.health.state.nv.us/nvsdoh/water/main.htm
Department of Environment and Natural Resources: Public Water
Supply Section http://www.deh.enr.state.nc.us/pws/
Department of Health: Division of Municipal Facilities, Drinking
Water Program http://www.health.state.nd.us/MF/index.html
Environmental Protection Agency: Division of Drinking and Ground
Water http://wAvw.epa.state.oh.us/ddagW/
Department of Environmental Quality: Water Quality Division
htto: / /www.dea .state.ok.us / WODnew/index.htm
Department of Human Services: Drinking Water Program
htto://ore2ron.arov/DHS/oh/dwo/index.shtml
Department of Environmental Protection: Office of Water Management
http://www.depweb.state.pa.us/watermgmt/site/default.asp
Department of Health: Public Water Supply Supervision Program
http://www.epa.gov/safewater/dwinfo/pr.htm

Department of Health: Office of Drinking Water Quality
http://www.health.ri.gov/environment/dwq/index.php

Phone
Number
(225) 765-5038
(207) 287-2070
(410) 537-3000
(800) 633-6101
(617) 292-5500
(517) 335-4176
(651)201-4700
(601) 576-7518
(573) 751-1300
(800) 361-4827
(406) 444-4071
(402) 471-0521
(402) 471-2541
(775) 687-9515
(603)271-2513
(609) 292-5550
(505) 476-8625
(877) 654-8720
(518)402-7650
(919)733-2321
(701) 328-5257
(614) 644-2752
(405) 702-8100
(971) 673-0405
(717) 772-4018
(787) 754-6010
(401) 222-6867
Water Security Handbook
59

-------
State
South
Carolina
South
Dakota
Tennessee
Texas
Utah
Vermont
Virginia
Virgin
Islands
(U.S.)
Washington
West Virginia
Wisconsin
Wyoming
Drinking Water Program Website
Department of Health and Environmental Control: Drinking Water
Program http://www.scdhec.net/eqc/water/
Department of Environment and Natural Resources: Drinking Water
Program http://www.state.sd.us/denr/des/drinking/dwprg.htm

Department of Environment and Conservation: Division of Water Supply
http: / /www.state.tn.us/environment/dws/

Texas Commission on Environmental Quality
http://wwAv.tceq.state.tx.us/nav/util water/

Department of Environmental Quality: Division of Drinking Water
http: / /www.drinkingwater.utah.gov/

Vermont Agency of Natural Resources, Water Supply Division
http: / / www.anr.state.vt. us /dec /watersup /wsd.htm

Department of Health: Office of Drinking Water
http://www.vdh.state.va.us/dw/
Department of Planning and Natural Resources: Division of
Environmental Protection http://dpnr.gov.vi/dep /PublicWaterSup.htm

Division of Environmental Health: Office of Drinking Water
http://www.doh.wa.gov/ehp/dw/
Bureau for Public Health: Department of Health and Human Resources
http://wwAv.wvdhhr.org/oehs/eed/
Department of Natural Resources: Bureau of Drinking Water and
Ground Water http://www.dnr.state.wi.us/org/water/dwg/index.htm

EPA Region 8: Wyoming Drinking Water Program
http: / / www.epa.gov/region08 /water /dwhome /wycon /wycon.html

Phone
Number
(803) 898-4300
(888) 481-0125
(605) 773-3754
(615) 532-0191
(512)239-4691
(801) 536-4200
(802) 241-3400
(800) 823-6500
(804) 864-7500
(340) 774-3320
(340) 773-1082
(360) 236-3100
(304) 558-6715
(608) 266-0821
(307) 777-7072

60
Water Security Handbook

-------
List of EPA Regional Contacts
EPA Region
EPA Region 1
EPA Region 2
EPA Region 3
EPA Region 4
EPA Region 5
EPA Region 6
EPA Region 7
EPA Region 8
EPA Region 9
EPA Region 10
EPA Region Website
http://www.epa.gov/NE/eco/drinkwater/dw-security.html

http: / /www.epa.gov/region2/water/

http: / / www.epa.gov/reg3wapd/

http://www.epa.gov/region4/water/

http://www.epa.gov/region5/water/

http: / / www.epa.gov/Arkansas/6wq /swp /security/

http://wAvw.epa.gov/region7/security/index.htm

http://www.epa.gov/region8/compliance/securitv/secure.html

http://www.epa.gov/region9/water/

http://vosemite.epa.gov/R10 /WATER.NSF/webpage/Water+Issue
s+in+Region+10

Phone
Number
(617) 918-1694
(212) 637-3879
(215) 814-5668
(404) 562-9446
(312) 886-0190
(214) 665-2776
(913) 551-7585
(303) 312-7021
(415) 947-8707
(206) 553-1389

                        Water Security Handbook

-------

-------

-------
          (Planning and Preparation )
               Threat Warning
            Initial Threat Evaluation
            Immediate Operational
              Response Actions
             Site Characterization
                and Sampling
u
                Public Health
              Response Actions
          Remediation and Recovery
   U.S. Environmental Protection Agency
Office of Ground Water and Drinking Water
         Washington, D.C. 20460

    EPA Publication No. 817-B-06-001
         www.epa.gov/watersecurity
                April, 2006

-------