&EPA Water Environment k Federation* SUMMARY REPORT O Water Sector Security Workshops ------- ------- EPA/600/R-06/070 June 2006 Water Sector Security Workshops U.S. Environmental Protection Agency Office of Research and Development National Homeland Security Research Center Cincinnati, OH Office of Water Water Security Division Washington, DC Water Environment Federation Alexandria, VA June 2006 Recycled/Recyclable Printed with vegetable-based ink on paper that contains a minimum of 50% post-consumer fiber content processed chlorine free ------- Table of Contents Overview: Water Sector Security Workshops 1 Workshop Participation 1 Workshop Format 3 Overarching Security Challenges for Water Sector Utilities 4 Maintaining Support for Security Investments by Water Sector Utilities 4 Addressing the Vulnerability of Water Sector Utility Distribution Systems 7 Managing Water Sector Security Information 9 Most Commonly Identified Application and Research Water Sector Security Needs 11 Conclusions and Next Steps 12 ii ------- List of Tables Table 1 Water Sector Security Workshop Participants 1 Table 2 EPA and WEF Partner Organizations 2 Table 3 Water Sector Security Workshop Sessions Overview 3 Table 4 Three Overarching Security Challenges for Water Sector Utilities 4 Table 5 Challenges in Maintaining Support in Security Investments for Water Sector Utilities 5 Table 6 Specific Needs Related to Maintaining Support in Security Investments for Water Sector Utilities 5 Table 7 Challenges in Addressing Water Sector Distribution System Vulnerabilities 7 Table 8 Specific Needs Identified to Address Water Sector Distribution Vulnerabilities 8 Table 9 Challenges in Managing Water Sector Security Information 9 Table 10 Specific Needs Identified to Manage Water Sector Security Information 10 Table 11 Most Commonly Identified Application and Research Water Sector Security Needs 11 Water Sector Security Workshops iii ------- IV ------- Overview: Water Sector Security Workshops Because safe drinking water and properly treated wastewater are critical to modern life, the federal government has identified the water sector as one of seventeen critical infrastructures/key resources in the United States (Homeland Security Presidential Directive 7). During 2005, the U.S. Environmental Protection Agency (EPA), in cooperation with the Water Environment Federation* (WEF*), hosted three Water Sector Security Workshops (workshops) involving drinking water and wastewater utility operators and other key stakeholders. The purpose of the workshops was to discuss water sector security issues in order to better gauge the current status of water security, outline common challenges, and identify what is most needed to better protect the nation's water infrastructure. WEF has published interim reports from each of the three workshops on the Water Security Channel, at www.watersc.org. These reports summarize the results of the workshops and detail specific lessons learned and critical needs related to both the application of water sector security programs and supporting research and technology development. This report will summarize the lessons learned and current needs from all three workshops. First, however, it is important to describe the stakeholder groups represented at the workshops, how participants were selected, and how the workshops were conducted. Workshop Participation Approximately 100 stakeholder group representatives participated in each of the three EPA/WEF Water Sector Security Workshops. Table 1 shows the breakdown of all participants by category. A major goal of the workshops was to ensure a balance of participation among key water sector stakeholders. This included small, medium, and large urban water sector utilities; rural water sector utilities; and other appropriate stakeholders, such as government agencies, public health organizations, and emergency responders. All Table 1 Water Sector Security Workshop Participants Trade/Professional Organizations (10%) Federal/State/Local Government (25%) Emergency Responders; Academia; Public Health; Law Enforcement (15%) Water Sector Security Workshops 1 ------- workshop invitees were approved by a steering committee of representatives from WEF, EPA, and the U.S. Department of Homeland Security (DHS). The Water Sector Coordinating Council (WSCC) played an essential role in planning and implementing the workshops. This council, formed in 2004, serves as a policy, strategy, and coordination mechanism to reduce and eliminate significant homeland security vulnerabilities to the water sector through interaction with the federal government and other critical infrastructure sectors. The WSCC consists of two owner/operator representatives along with one non-voting association staff person from each of the following associations: American Water Works Association (AWWA), Association of Metropolitan Water Agencies (AMWA), National Association of Clean Water Agencies (NACWA), National Rural Water Association (NRWA), National Association of Water Companies (NAWC), WEF, Water Environment Research Foundation (WERF), and AWWA Research Foundation (AwwaRF). Several partner organizations (see Table 2) recommended water sector utility or other stakeholder invitees. The partner organizations also reviewed and provided comments on the workshop agenda and participated in the workshops. Table 2 EPA and WEF Partner Organizations ASSOCIATION OF METROPOLITAN WATER AGENCIES ASSOCIATION OF STATE DRINKING WATER ADMINISTRATORS Aw American Water Works Association The «utiwntawe Resource for Safe Dnntons Water AMERICAN WATER WORKS ASSOCIATION AWWA RESEARCH FOUNDATION NAOA^X f\ t.omrnitmcnttt> America 'a Water-; NATIONAL ASSOCIATION OF CLEAN WATER AGENCIES NATIONAL ENVIRONMENTAL SERVICES CENTER NATIONAL RURAL WATER ASSOCIATION WERF WATER ENVIRONMENT RESEARCH FOUNDATION ------- Workshop Format Each workshop spanned two and one-half days and was organized around three major sessions, including general sessions, a series of facilitated breakout group sessions, and a final facilitated overall discussion of application and research trends and needs identified during the course of the workshop. The workshops stressed two major focus areas of water sector security: application needs and research needs. Table 3 provides a brief summary of the workshop sessions. Significantly more detail on the methodology used for the workshops and full workshop agendas are available from the three interim reports available on the Water Security Channel at www.watersc.org. Table 3 Water Sector Security Workshop Sessions Overview All sessions were focused on either water sector security applications (e.g., funding, tools, training) or water sector security research (e.g., monitoring systems, treatment technology) needs. ACTIVITIES Opening Sessions Presentations from EPA Water Security Division, EPA National Homeland Security Research Center, DHS, states, water sector utilities, and professional associations on the current state of water sector security. GOALS Opening Sessions Provide an overview to participants of the current state of water sector security and updates on application and research activities in preparation for focused breakout group sessions. Breakout Sessions Approximately 25 individuals participated in one of four facilitated breakout sessions conducted on each of the first two days. Breakout sessions on Day 1 focused on lessons learned and application needs while Day 2 sessions focused on research needs. Breakout Sessions Increase knowledge among participants regarding a wide range of current water security practices and challenges confronting water sector utilities and stakeholders, and provide stakeholder input to WEF, EPA, DHS, and others regarding priority water sector application and research needs. Facilitated Discussion of Needs Identified in Breakout Groups Workshop participants reconvened on the morning of Day 3 for additional technical presentations, a presentation by workshop facilitators summarizing results from Day 1 and Day 2 sessions, and facilitated open discussion for participant questions, comments, recommendations, and other input to workshop sponsors and others. Facilitated Discussions Provide an opportunity for workshop participants to introduce needs and ideas not already discussed; clarify important needs; share and discuss security challenges with other stakeholders; ask questions of WEF, EPA, DHS, and others; and provide input regarding how best to address needs identified during the workshops. Water Sector Security Workshops 3 ------- Overarching Security Challenges for Water Sector Utilities Although many specific issues and needs were discussed during the individual workshops, three overarching challenges for the water sector emerged (see Table 4) and participants identified specific needs associated with each challenge. While these overarching challenges are the primary focus of this summary report, the report will also highlight several other commonly identified application and research needs from the workshops. For a complete listing of issues presented during the workshops, individuals are encouraged to read the interim report from each individual workshop at wurw. watersc. org. Table 4 Three Overarching Security Challenges for Water Sector Utilities Maintaining Support for Security Investments by Water Sector Utilities Addressing Vulnerabilities of Water Sector Utility Distribution Systems Managing Water Sector Security Information Maintaining Support for Security Investments by Water Sector Utilities Issue Overview The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 mandated that every drinking water utility serving populations greater than 3,300 individuals conduct a vulnerability assessment (VA) of its facility and update its emergency response plan (ERP) based on that VA. According to EPA, 100 percent of the large and medium-sized drinking water utilities and more than 95 percent of the smaller drinking water utilities complied with this mandate. EPA continues to work with utilities to achieve full compliance. While wastewater utilities were not mandated by the federal government to conduct vulnerability assessments or update their emergency response plans, many have voluntarily completed both tasks as best business practices. Specific Challenges Identified in Water Sector Security Workshops Vulnerability assessments are designed to assist a utility in making decisions as to which specific security investments would provide the greatest benefit to the utility. According to participant input, many water sector stakeholders feel that utilities are faced with the challenge of determining which security investments are of the greatest benefit while balancing these concerns with the costs of other, nonsecurity-related investments for their utility (see Table 5). In addition, when deciding which security investments to make, utility managers and other stakeholders contend that it is difficult to determine the current state of the art in the relatively new area of water sector security. For example, deciding on when to phase in contamination detection and monitoring investments presents a challenge since detection and monitoring technologies are perceived to be rapidly changing and often unproven for broader security applications. ------- Table 5 Challenges in Maintaining Support in Security Investments for Water Sector Utilities How should priorities be set? What is the proper balance between security-related investments and nonsecurity- related needs? What is the state of the art? Which security products should be purchased when industry products are constantly changing? Whose priorities? Without a mandate from the government, industry standards, or known threats, how and when should a security program be implemented? reats. The prioritization concerns noted above are more acute, according to some workshop participants, in the absence of federal, state, or local government mandates to implement security measures; industry standards; and clearly defined threats to water sector systems. The importance of creating a "security culture" at a utility; incorporating security practices as part of normal business operations; was widely recognized at the workshops as an effective means to implement and maintain water sector security over time. This would be comparable to companies instilling safety consciousness as part of standard operating procedures in plant operations. Specific Needs Identified to Maintain Momentum and Support for Security Investments In order to address the challenges listed in Table 5, workshop participants discussed many needs for water sector utilities. In this context, participants discussed three basic water sector groups; each with unique needs as outlined in Table 6. Decision makers associated with a water sector utility (such as the board of directors, the mayor, or other elected officials) were said to need, among other things, a cost/risk model to show where to invest precious utility resources across all utility priorities, not Table 6 Specific Needs Related to Maintaining Support in Security Investments for Water Sector Utilities Decision Maker Needs • Cost/risk model of how and where to invest utility resources across all priorities (security and nonsecurity-related) • Assistance with developing a "vision for security implementation" • Strategies on how to derive multiple benefits from security programs Utility Staff Needs Increased training on strategies for creating a security culture Community Needs Increased understanding of the "psychology of a contamination event" Water Sector Security Workshops 5 ------- just security. While many methodologies have been introduced to the water sector since 9/11 on how to prioritize security-related investments, workshop participants clearly identified a need for decision makers at the utility to have a more comprehensive tool to balance all utility needs in order to make sound decisions for budget allocations. Decision makers also need better tools to assist in developing security plans for their utilities. For example, some workshop participants noted that while planning for utility upgrades is done in three-, five-, or seven-year increments, security investments are not necessarily being included in those assessments currently because reliable models do not exist to help identify what specifically should be included. Finally, water sector decision makers need a greater understanding of how to derive multiple benefits from their security investments. One of the most pressing needs for water sector utilities across the United States, for example, is the replacement and rehabilitation of aging infrastructure. Strategies on how to leverage the current emphasis placed on security by the federal government against these needs may allow for much- needed infrastructure upgrades while increasing security. Water sector utility staff members, particularly managers and operators, need training on strategies for creating and maintaining a security culture at their utilities. Those entrusted with the day-to-day operation of a water sector utility need to be consistently educated on the value and purpose of security at their facilities, as well as the multiple benefits derived from the implementation of an efficient and effective security program to the overall operation of the utility. According to many workshop participants, the communities served by water sector utilities need a better understanding of potential crisis incidents, their consequences, and measures that can be taken to reduce risks and minimize impacts. This need can be addressed in part by developing and distributing effective education tools and outreach materials. In many cases, the public would be more likely to support water sector security efforts, financially and otherwise, if the nature of crisis events and security investments and other measures to prevent or deal with them were better communicated. ------- Addressing the Vulnerability of Water Sector Utility Distribution Systems Issue Overview While most critical infrastructures are contained, such as nuclear power plants, water sector distribution systems are more widely dispersed. Contaminant and physical intrusion detection are significant challenges faced by water sector utilities in reducing the vulnerability of their distribution systems. Specific Challenges in Addressing Water Sector Utility Distribution System Vulnerabilities Water sector stakeholders participating in the workshops consistently identified three categories of distribution system vulnerabilities: access, detection, and lack of coordinated response protocols for contamination events. Table 7 defines these categories and provides brief examples from the workshops. Since water sector distribution systems have a significant number of access points, many stakeholders feel that some points will be more difficult to protect than others. For this reason, they suggest that it would be best to focus on improving detection and mitigation capabilities while also improving technologies to reduce access at known key points. As explained earlier in this report, workshop sessions covered both water sector security applications (e.g., funding, tools, training) and water sector security research (e.g., monitoring and detection technologies). While increased funding was the most noted applications need, an overwhelming number of workshop participants noted a lack of real-time detection and monitoring technology as the primary research need. Workshop participants were also consistently concerned that up-to-date response protocols be in place in their communities and noted that comprehensive decontamination procedures are often currently lacking. Not having regional response teams established ahead of time could cause significant delays in recovering from a terrorist attack or other crisis event. Table 7 Challenges in Addressing Water Sector Distribution System Vulnerabilities Access Significant number of access points and better capacity to protect some points along the system than others. Detection Without reliable, real-time detection and monitoring technologies, contaminants may go undetected or false alarms may occur. Coordinated Reponse Insufficient reliable response protocols and decontamination procedures, and often a lack of regional, cross-organizational response teams. _ Water Sector Security Workshops 7 ------- Specific Needs Identified to Address Water Sector Distribution Vulnerabilities Workshop participants cited increasing public involvement and developing a culture of security as two main needs in addressing water sector distribution vulnerabilities. The public at large can have a significant impact in helping to monitor the security of the vast water sector distribution systems in their communities by noticing and reporting any suspicious persons or situations. This could reduce the overall vulnerability of the water sector to terrorist or other incidents. While the culture of security was generally discussed in relation to promoting the importance of security among the staff of a utility, it was also noted that the presence of a security culture in the community could help the public be more aware and prepared to assist should an event occur. Table 8 summarizes these and related needs to address water sector distribution vulnerabilities. Research projects relating to real-time detection and monitoring are needed, according to water sector security stakeholder participants. Integrated, real-time contaminant monitoring and advanced, reliable intrusion detection systems were specifically mentioned as needed research projects. To address the need for a coordinated response to distribution vulnerabilities, many workshop participants described a need to establish and maintain emergency response protocols across participating organizations. Other significant needs include regional response teams, regional cross-sector training, and reliable decontamination procedures. Table 8 Specific Needs Identified to Address Water Sector Distribution Vulnerabilities Access Greater public involvement, including creation of a culture of security Detection Research projects on real-time contaminant monitoring and intrusion detection technologies Coordinated Response Regional response teams and reliable response protocols and decontamination procedures 8 ------- Managing Water Sector Security Information Issue Overview A key overarching challenge raised by all stakeholders, across all issue categories, was the need to properly manage information on water sector security issues from a variety of sources. The volume of information, the type of information, and the format of the information are all critical considerations in assisting water sector stakeholders, particularly water sector utilities, in making critical decisions regarding how to protect their customers and the general public from terrorist threats and attacks. Specific Challenges in Managing Water Sector Security Information Despite significant efforts by all levels of government, trade and professional associations, and other water sector security stakeholders, many utilities are unaware of many tools and training opportunities already available to them and of pertinent ongoing or completed research. Workshop breakout sessions provided the opportunity for utilities and other stakeholders to identify both immediate and longer-term application and research needs for effectively dealing with security issues. Stakeholders frequently mentioned a need for security applications or research projects that have already been developed or are in the process of being developed. This clearly indicates that more work needs to be done to communicate the availability of water sector security information to utilities and other stakeholders. Table 9 highlights several of the information management challenges identified in the workshops. Ironically, many stakeholders also cited an overload of information, particularly "general" information that is difficult to apply at the local level. Several examples of tools and training that have been published were cited as examples of good work, but they provided utility managers with little "actionable" information to use in implementing their day-to-day goal of building a security culture. Specific Needs Identified to Manage Water Sector Security Information One of the most common needs across all workshops was the need to refine communication efforts. As noted above, much of the information the water sector receives is viewed as too general in nature. Simple, locally relevant, actionable information was consistently cited by workshop participants as one of the major needs. Table 9 Challenges in Managing Water Sector Security Information General lack of awareness of available information (Many identified needs have been or are being addressed by current resources. Overload of general information that is hard to apply at the local level Defining what information is secure and who should have access (e.g.. Freedom of Information Act concerns) Water Sector Security Workshops 9 ------- Once again, public education tools and training, specifically on critical dependencies and interdependencies of the water sector, are needed to strengthen relationships among all critical water sector security stakeholders. Besides providing useful updates on the current state of water sector security, many participants noted that the Water Sector Security Workshops themselves provided the opportunity for much needed peer-to-peer interaction, particularly among utilities. Some participants recommended additional regional forums, perhaps with an expanded target audience including stakeholders from other critical infrastructures, such as power utilities or transportation. Finally, many stakeholders cited a general lack of knowledge and training available on crisis communication strategies. In the event of an attack or viable threat to water systems, for example, local water utilities and others involved in the response will be required to answer questions and provide information to the media and public about the situation, potential risks, and what is being done to deal with the crisis. This will often occur under difficult conditions of high stress and uncertainty. Water sector stakeholders are concerned about such issues as who the spokesperson should be, what information to share and how best to present it, how to effectively respond to questions, and how to coordinate communication both internally and with other involved organizations. These issues should be addressed in a crisis communication plan established and implemented before a crisis event occurs. Table 10 Specific Needs Identified to Manage Water Sector Security Information Refined Communication Efforts Keep information simple, locally relevant, and actionable. Targeted Information Sharing Programs Targeted among and between utilities and the emergency response community lie Education Program on the critical dependencies of the water sector and additional regional forums increase peer-to-peer access to information ns to Greater Emphasis on Crisis Communication Strategies (e.g., message mapping, which involves anticipating likely questions that will be asked and developing and practicing delivery of key messages before a crisis occurs) 10 ------- Most Commonly Identified Application and Research Water Sector Security Needs While the three categories of challenges and needs outlined above provide a convenient organization of issues raised at the three water sector security workshops, it would be inaccurate to imply that these overarching issues encompass all of the issues raised by workshop participants. As mentioned earlier, the three water sector security interim reports available at www.watersc.org pro vide a detailed listing of all issues captured during the sessions. However, Table 11 provides a list of the most commonly identified application and research needs from all three workshops. The needs are organized under the five pillars of water security defined by EPAs Water Security Division (WSD) in its "Framework for EPAs Water Security Strategy." The five pillars are entitled "overarching," "prevention," "detection," "response," and "recovery." Because response and recovery are so interrelated, they are captured in one column in the table. Table 11 Most Commonly Identified Application and Research Water Sector Security Needs OVERARCHING PREVENTION DETECTION RESPONSE/RECOVERY Guidance and support for coordinating the message and the messenger in communicating with the public during/after an event Integration of water security with other utility programs (e.g., OSHA, EMS) Improved ability to identify and characterize threats, including integrated real-time monitoring Guidance on best practices for responding to contamination incidents, the comparative efficacies of various decontamination protocols and technologies, and emergency notification Communication and outreach materials to assist utilities with funding opportunities for security program implementation Advanced intrusion detection and distribution system protection technologies Public health early warning and notification system Guidance on how to determine "how clean is clean" and how to convince the public that these determinations are correct Nationwide, peer-to- peer network of utilities to develop and share industry norms, best practices, expertise, and equipment Joint training exercises to provide better, more comprehensive consideration of water issues and water utility roles in incident response/ command "Consumers' Report" guide to physical detection tools, equipment, and methods Ways to efficiently deliver a sustainable alternative water supply (e.g., examine interconnections) Protocols for better characterizing system and infrastructure interdependencies Increased access to and awareness of analytical and laboratory capabilities and services Enhanced incident response coordination and communication. Free qualified facilitation services for utilities to conduct emergency response tabletop exercises Expanded awareness of the multiple benefits of security measures to overall utility operations Joint operations centers for monitoring utility facilities (e.g., on a regional basis) Standardized resources within the water utility sector to facilitate sharing and access to resources (e.g., people, expertise, equipment) for emergency response and recovery efforts Water Sector Security Workshops 11 ------- To better secure our nation's critical drinking water and wastewater infrastructures, the water sector focuses on having security programs in place that enhance its ability to prevent, detect, respond to, and recover from potential terrorist or other intentional acts and natural disasters. These efforts assist in ensuring the safety of the drinking water supply and protection of water quality by reducing the risk to public health, the environment, and critical infrastructure. EPA and other water sector stakeholders recognize the continued need to refine national, state, and local government water security programs and closely partner with utilities, public health, emergency response, law enforcement, and others responsible for the security of the nation's critical water sector infrastructure. The three Water Sector Security Workshops confirmed that the general direction EPA and others are heading to address the vast security challenges facing the water sector is appropriate and that work needs to continue. The following reiterate the general conclusions from the workshops: It is important that water utilities and other water sector stakeholders establish a "culture of security." It is a challenge for utilities to maintain momentum and support for security programs and investments, especially at the municipal level. Security is a concern for utilities, and it is important to recognize that multiple benefits are derived from efforts to enhance security. There is a need for additional tools and resources to assist utilities and other stakeholders in identifying and characterizing vulnerabilities to a system and the public health and economic consequences of an event. Distribution system vulnerability is viewed as a major challenge due to the number of service connections. There is a need for improved detection, response, and mitigation capabilities for water sector utilities. Physical entry and contaminant detection remain a challenge. There is a need for continued research and development of real-time detection and monitoring technologies, decontamination procedures, and analytical methodologies. Water utilities face the ongoing challenge of educating other members of the emergency preparedness community about the role that water sector utility operators play in response to an event and in explaining the critical interdependencies that exist among the water sector and other critical infrastructures. Utilities, especially smaller systems, seem unaware of many existing security-related applications, research outputs, and activities that could be better communicated. Guidance, tools, and other resources intended to help utilities and others address security-related needs should be easy to use and obtain. (This is especially relevant for smaller systems.) 12 ------- Information management, including defining what type of information is "security sensitive" remains a challenge. A community of like-minded water security professionals has emerged in recent years, and there is great value in forums that sustain this community. EPA has developed its water sector security programs with extensive stakeholder input and review. The Agency will continue to update and refine its programs, based on vulnerabilities and threats to drinking water and wastewater utilities and potential incident consequences, in an effort to assist in reducing risks to the water sector. Input from the Water Sector Security Workshops will, in part, be used to enhance current efforts and inform longer-term policy and research planning and decisions. Workshop outcomes will influence the development of the EPA Water Security Division's "Water Security Strategic Framework" and an updated EPA National Homeland Security Research Center's (NHSRC) "Research and Technical Support Action Plan." The WSD's "Strategic Framework" presents a road map of its near- and long-term programs to strengthen water security. The NHSRC's "Action Plan" summarizes key water sector security needs and describes research projects dealing with drinking water supply, water treatment, finished water storage, drinking water distribution system infrastructure, wastewater treatment and collection infrastructure, wastewater treatment, and treated wastewater discharges. It is clear that the federal government alone cannot meet the vast needs of the water sector. State and local governments, as well as other partnering organizations; including many of those who participated in this project; have a continuing responsibility to educate and cooperate with the federal government and water sector utilities in communicating the value of water and wastewater security. As the sector-specific agency for the water sector, EPA will continue to collaborate and build upon existing relationships with all parties within the sector—drinking water and wastewater utilities; the Department of Homeland Security; other critical infrastructure sectors; state, local and tribal governments; and stakeholders—to better understand interdependencies, develop tools and training, improve information sharing and exchange mechanisms, and conduct research activities with the goal of ensuring that water sector critical infrastructure operations are not interrupted by potential terrorist or other intentional acts. Water Sector Security Workshops 13 ------- &EPA United States Environmental Protection Agency Office of Research and Development National Homeland Security Research Center Cincinnati, OH 45268 Official Business Penalty for Private Use $300 EPA/600/R-06/047 June 2006 PRESORTED STANDARD POSTAGE & FEES PAID EPA PERM IT NO. G-35 Recycled/Recyclable Printed with vegetable-based ink on paper that contains a minimum of 50% post-consumer fiber content processed chlorine free ------- |