&EPA United States Environmental Protection Agency Wastewater Response Protocol Toolbox: Planning For and Responding To Wastewater Contamination Threats and Incidents December 2011 Module 2: Contamination Threat Management Guide ------- This page intentionally left blank. ------- Table of Contents - Module 2 1 Introduction 2-1 2 Overview of the Contamination Threat Management Process 2-2 2.1 Roles and Responsibilities 2-2 2.2 Response and Consequence 2-3 2.3 Contamination Threat Management Decision and Response Tree 2-4 3 Stage I: 'Possible' Stage of Threat Management Process 2-4 3.1 Information from the Threat Warning 2-4 3.2 Additional Information 2-7 3.3 Response Actions Considered at the 'Possible' Stage 2-8 on 4 Stage II: 'Credible' Stage of Threat Management Process 2-9 C 4.1 Information Considered at the 'Credible' Stage 2-9 4.2 Response Actions Considered at the 'Credible' Stage 2-10 5 Stage III: 'Confirmed' Stage of Threat Management Process 2-12 5.1 Information Considered at the 'Confirmed' Stage 2-13 5.2 Response Actions Considered at the 'Confirmed' Stage 2-13 6 Contamination Threat Management Matrices 2-14 +-> 6.1 Security Breach 2-15 6.2 Witness Account 2-16 6.3 Direct Notification by Perpetrator 2-17 6.4 Notification by Law Enforcement 2-18 6.5 Notification by News Media 2-19 6.6 Unusual Water Quality 2-20 6.7 Degradation of Treatment Organisms 2-21 6.8 Public Complaints 2-22 6.9 Public Health Notification 2-23 7 Summary 2-24 8 Appendices 2-24 Wastewater Response Protocol Toolbox ------- o J-» c (L> on 03 c 03 O E 03 •M O u Q O Planning and Preparation ion ) Threat Warning Initial Threat Evaluation (A to O o O c o "re "re u o I- Immediate Operational Response Actions Site Characterization and Sampling Public Health Response Actions (A c o (/) c o a at (U c ra a x UJ Sample Analysis Is Incident Confirmed Remediation and Recovery Wastewater Response Protocol Toolbox ------- 1 Introduction As discussed in Module 1, accidental and intentional contamination events involving wastewater systems have occurred in the past. In some cases, such as Guadalajara, Mexico in 1992, the results have been devastating in terms of the impact on human lives and property. Therefore, in the event of either an accidental or intentional contamination threat, there is a need to be able to evaluate the credibility of the threat and identify appropriate response actions. Also, because a large number of people and a significant amount of infrastructure and private property can be exposed to a contaminant passing through a collection and treatment system within just a few hours, there is a need to evaluate and respond in a short amount of time. While it is desirable to have complete information prior to making response decisions, the reality is that this will almost certainly not be the case when responding to contamination threats. Typically, there will not be time to conclusively determine whether the wastewater has been contaminated or definitively identify the contaminant prior to making decisions to protect health and property. However, it is also necessary to avoid false alarms that would result in undue stress on the public. Therefore, a delicate balance must be achieved between actions taken to protect public safety and property, and limiting overreaction to a perceived threat. Module 2, the Contamination Threat Management Guide, provides a framework for making decisions based on available, yet incomplete, information in response to a contamination threat. It represents the hub of the WWRPTB. The objectives of this module include: • Present a framework for evaluating a wastewater contamination threat and making appropriate decisions • Describe the type of information that may be used for conducting a threat evaluation • Describe the actions that might be implemented in response to a contamination threat (giving appropriate consideration to the potential consequences of an incident and the impacts that may result from the response actions) Based on these objectives, Module 2 is divided into the following sections: 1. Introduction 2. Overview of the Contamination Threat Management Process 3. 'Possible' Stage of the Threat Management Process 4. 'Credible' Stage of the Threat Management Process 5. 'Confirmed' Stage of the Threat Management Process 6. Contamination Threat Management Matrices 7. Summary 8. Appendices Many of the concepts described in Module 2 are similar to those for the Water Security initiative, which addresses drinking water CD CD CD CD CD 03 c 03 03 CD o '•M 03 I 03 •M c o o CM O o Wastewater Response Protocol Toolbox 2-1 ------- CD CD E CD O) CD 03 03 O -4-> 03 c E 03 4-J O O security. In particular, the Interim Guidance on Developing Consequence Management Plans for Drinking Water Utilities (CMP) (EPA 817-R-08-001, October 2008) provided for the Water Security initiative addresses the various stages of the threat management process for drinking water (possible, credible, and confirmed). See http://www.epa.gov/safewater/ watersecurity/pubs/guide_interim_cmp_wsi. pdf for additional information about the CMP. 2 Overview of the Contamination Threat Management Process 2.1 Roles and Responsibilities As discussed in Module 1, the Incident Command System (ICS) is the national model for managing emergencies, including contamination threats, involving public drinking water and wastewater systems. Organizations that may Assume Incident Command Responsibility During an Intentional Contamination Situation Wastewater Utility. May be responsible for incident command during the initial stages of an event since it will often be the first party to become aware of the threat warning. The utility will retain this responsibility, by default, unless/until another organization (with proper authority) assumes command. The Utility Incident Commander would prob- ably serve as overall Incident Commander while the utility maintains primary responsi- bility for managing the crisis. Local Fire Department/HazMat Team. May assume incident command if hazardous materials are involved. Wastewater Permitting Agency. May assume incident command, especially when a smaller utility lacks the resources to manage the threat. Public Health Agency (state or local). May assume incident command if the situation is a public health crisis. Local Law Enforcement. May assume incident command when criminal activity (ex- cluding federal crimes) is suspected. Q O FBI. Will assume incident command (of the criminal investigation) when there is a ter- rorism incident or a credible threat of terrorism. In this case, EPA's Criminal Investiga- tion Division (CID) will have a role in working with the FBI. If it is determined that a contamination threat or incident is not an act of terrorism, EPA's CID will typically be the lead federal agency for law enforcement in the response. 2-2 Wastewater Response Protocol Toolbox ------- Under this management system, incident command has overall responsibility for managing the crisis. The organization that assumes responsibility for incident command will vary with the nature and severity of the situation. During the course of managing a contamination threat, the individual designated as Incident Commander may change as different organizations assume responsibility for managing the situation. In the event of a more complex emergency, a Unified Command may be set up in which the incident command consists of representatives of the key stakeholders with jurisdictional or functional authority. The organization that assumes responsibility for incident command will vary with the nature and severity of the situation. If an organization other than the wastewater utility assumes incident command, the utility will play a supporting role during the threat management process. Regardless of which organization is in charge of managing the overall situation, the utility will always have a responsibility for the wastewater system. 2.2 Response and Consequence Response decisions regarding a wastewater system contamination threat may have consequences that significantly affect the community. While the health and safety of utility workers and the public will always be the primary concern during a contamination incident, it should be realized that the response actions taken to deal with the threat may have serious ramifications. For example, if the decision is made to completely shut down a municipal wastewater system due to concerns over a contaminant, this would seriously impact the public health of a community that can no longer safely treat sanitary waste. Additionally, any decision to bypass the wastewater treatment plant must be consistent with applicable laws and regulations including 40 CFR 122.41(m). This could seriously impact the environment and downstream water users when raw sewage containing the contaminant is released untreated into a receiving stream. Criteria for Response Decisions Response decisions concerning contamination threats and incidents should be based on the following three criteria: 1. Is the contamination threat 'Possible,' 'Credible,' or 'Confirmed?' 2. What are the potential consequences of the contamination on human health and safety, the environment, the economy, and the wastewater infrastructure? 3. What is the potential impact of the response action on public health, the economy, and the environment? A Response Planning Matrix is a tool that can help officials weigh these three criteria when making response decisions. The matrix is a simple tabular summary that lists the three levels of a threat evaluation, the potential consequences of a threat (including the number of people affected and health effects), and potential response actions along with their impacts on the public and the environment. A blank Response Planning Matrix is included in Appendix 1 at the end of the toolbox. CD CD CS O '•M I Wastewater Response Protocol Toolbox 2-3 ------- CD C7) O ~4-> c E 2.3 Contamination Threat Management Decision and Response Tree The overall threat management decision process is summarized in Figure 2-1. The remaining sections in this module describe the various steps in this decision and response tree. 3 Stage I: 'Possible' Stage of Threat Management Process A wastewater contamination threat is characterized as 'Possible' if the circumstances of the threat warning (threat warnings are discussed in section 3.1) indicate that there was an opportunity for contamination. This is the lowest threshold determination in the threat evaluation process and is the point at which a decision is made regarding whether or not to initiate an investigation. If the threat is determined to be impossible, there is no need to continue the threat evaluation or consider any response actions. However, it is likely that most contamination threats will meet this relatively low threshold and thus warrant investigation. The target time period for determining whether or not a contamination threat is 'Possible' is within one hour from the time the threat warning is received by the utility. Given the potentially severe consequences of failing to respond to an actual contamination incident in a timely and appropriate manner, it is important to determine whether or not a threat is 'Possible' in this relatively short time frame. The one hour target, however, should be treated as a flexible goal since the circumstances of a particular threat may dictate a shorter or longer period. As with all stages of the threat management process, the Incident Commander usually is responsible for determining whether or not the contamination threat is 'Possible.' In most cases, this determination will be made by the utility Incident Commander, although others may become involved in the initial evaluation as appropriate. For example, if the threat warning is reported by a law enforcement agency, they would likely play a role in determining whether or not a threat is 'Possible.' Also, the wastewater permitting agency may need to be informed about all threat warnings and may participate in this initial stage of the threat evaluation. However, given the short target time frame for the initial evaluation, the utility Incident Commander might make this determination, initiate an investigation, and initiate some preliminary operational responses. Relevant and timely information is key to determining whether or not a threat is 'Possible' in the target time period. In most cases, the information considered at this stage will be derived directly from the threat warning (e.g., nature of warning, location, time of discovery, suspected time of incident, and other details). Under some circumstances, additional information beyond the threat warning may be considered. However, there may not be sufficient time to do so in most cases, and the determination regarding whether or not the threat is 'Possible' will be based primarily on details of the threat warning. A Threat Evaluation Worksheet is provided in Appendix 2 to help organize the information used throughout the threat evaluation, beginning with a summary of information about the threat warning itself. 3.1 Information from the Threat Warning A threat warning is an unusual event, observation, or discovery that indicates the potential for intentional or accidental contamination and suggests the need for actions to address the concern. Threat warnings 2-4 Wastewater Response Protocol Toolbox ------- V / (THREAT: Review contamination threat warning information X x . / Is threat N_ *\ possible? / Investigate possible contamination Review investigation results * *» / Is threat *»_ \^ credible? S **. ^^ Preform sample analysis 0 Review additional information " * ,«••** Do results confirm **•• '*••», contamination? f»* 1 ^ Close investigation, return to normal operation, and document the threat. Consider public notification and public health / safety response Is threat still possible? Revise operational response and public health response as necessary 1 1 Revise sampling and analysis plan and continue threat evaluation CD CD CS O '•M I Develop remediation and recovery plan Figure 2-1. Contamination Threat Management Decision Tree for Wastewater Wastewater Response Protocol Toolbox 2-5 ------- CD C7> O ~4-> c E Security Breach Public Health Notification Witness Account Notification by Perpetrator Public Complaints \ / Contamination \ \ Threat ] '• Warning / Notification by Law Enforcement Degradation of Treatment Organisms Unusual Waste water Chemicals Notification by News Media Figure 2-2. Types of Threat Warnings may come from several sources both within and outside of the wastewater utility. Figure 2-2 summarizes the most likely threat warnings that a wastewater utility may expect to receive. Security Breach A security breach is an unauthorized intrusion into a secured facility or the collection system that may be discovered through direct observation (for example, through an alarm, cut fence, or open manhole). A Security Incident Report Form is included in Appendix 3 to assist in documenting the available information about a breach and support the threat evaluation. Witness Account A witness account is a threat warning from an individual who directly witnesses suspicious activity. A Witness Account Report Form is included in Appendix 4 to help document a witness account. Direct Notification by Perpetrator A threat may be made directly to the utility by a perpetrator, either verbally or in writing. Report forms for telephone and written threats are provided in Appendices 5 and 6, respectively. 2-6 Wastewater Response Protocol Toolbox ------- Notification by Law Enforcement A utility may receive notification about a contamination threat from a law enforcement agency. Notification by News Media A contamination threat might be made to the media, or the media may learn of an accidental contamination before the utility is alerted. Unusual Wastewater Chemical Characteristics Unusual wastewater chemical results could come from on-line monitoring or routine grab sampling indicating a possible contamination event. Degradation of Treatment Organisms Should a contaminant enter the treatment plant from the collection system, the first indication of its presence could be a degradation in the abundance or activity of microbes in the secondary treatment process. Public Complaints Public or utility employee complaints about unusual odors associated with the sewer system (e.g., petroleum products or industrial chemicals) may suggest the presence of a contaminant. Wastewater system personnel reporting unusual health symptoms may also indicate a threat. Notification by Public Health Agencies Notification from health agencies or health care providers that people are being negatively affected by fumes emanating from domestic sewer systems, catch basins, or the wastewater treatment plant may suggest a contamination event. A Public Health Information Report Form included in Appendix 7 is intended to organize information from public health entities to support this evaluation. 3.2 Additional Information Information extracted from details of the threat warning is critical to determining whether or not a contamination threat is 'Possible.' Different types of warnings will have different levels of initial believability. For example, widespread complaints of solvent-like odors wafting up from sanitary sewer manholes would have a higher degree of initial believability than a report of unusual wastewater chemistry based on changes in a few general parameters (e.g., pH or alkalinity). Some warnings may be judged so reliable that the threat is deemed 'Credible' solely on the basis of information about the threat warning, while others may be almost instantly dismissed as impossible. Regardless of the nature and source of the threat warning, it is critical that protocols be in place to report the warning to the utility Incident Commander as quickly as possible. Utilities should develop communications procedures to ensure that threat warnings can be rapidly and accurately reported on a 24/7 basis. While the threat warning will likely provide the most immediate and relevant information, several other resources might be considered to help make the determination as to whether a threat is 'Possible.' These may include: internal information from utility staff that are knowledgeable of the operation of the wastewater system, information from the utility's VA that is relevant to the current situation, and real time water chemistry data that might be used as an indicator of wastewater contamination. CD CD CS O '•M I Wastewater Response Protocol Toolbox 2-7 ------- CD CD E CD CJ) CD CD O -4-> CD c E 03 4-J O O Q O 3.3 Response Actions Considered at the 'Possible' Stage Once a contamination threat has been deemed 'Possible,' relatively low level response actions are appropriate since this is a very early stage in the threat management process. Two response actions that might be considered at this stage include site characterization and operational response. Site Characterization This is the process of collecting information from the site of a suspected wastewater contamination incident. This is a key activity in the ongoing threat evaluation and is intended to help determine whether or not the 'Possible' threat is 'Credible.' Site characterization includes the following activities: • Site investigation • Field safety screening • Rapid field testing of wastewater • Sample collection Detailed procedures for conducting site characterization are described in Module 3: Site Characterization and Sampling Guide. Immediate Operational Responses These are actions intended to limit the potential exposure of the public to the contaminant and reduce the risk to private property, the wastewater infrastructure, and the environment while site characterization activities are conducted. An example operational response would be diverting the flow of untreated wastewater to temporary storage, rather than exposing the treatment process, until the nature of the possible contamination event can be better characterized. Emergency pretreatment of the influent wastewater may also be considered consistent with any applicable laws and regulations. This may include the addition of powdered activated carbon, a strong oxidant such as chlorine or potassium permanganate, or the addition of caustic to neutralize or precipitate atoxic chemical. If a flammable substance is in the collection system, the utility, working with the fire department, may attempt to remove the substance using vacuum trucks and/or oil spill remediation equipment. If the flammable substance is in the plant influent, the utility may decide to turn off pumps to the treatment basins and assist the fire department in dispensing aqueous film forming foam. The decision to implement these response actions may need to be made very quickly for the actions to have their desired effect. For example, in order for diversion and storage of untreated wastewater to be effective, it may need to be implemented as quickly as feasible after a threat is deemed 'Possible.' To facilitate this, the utility Incident Commander should be aware of the regulatory and legal considerations that may apply to decisions, and be empowered to implement such response actions at the 'Possible' stage. However, the immediate response actions should then be shared with utility management. 2-8 Wastewater Response Protocol Toolbox ------- If an operational response is not feasible, the threat evaluation process should be accelerated to determine whether or not the threat is 'Credible.' 4 Stage II: 'Credible' Stage of Threat Management Process A wastewater contamination threat should be considered to be 'Credible' if additional information collected during the investigation (initiated after the 'Possible' decision was made) corroborates the threat warning, and the cumulative information indicates that contamination is likely. For example, if the threat warning comes in the form of a security breach and additional convincing signs of contamination (e.g., abnormal wastewater chemical values) are observed during site characterization, the threat could be considered 'Credible.' While many warnings may result in 'Possible' contamination threats, only a small percentage of those 'Possible' threats are expected to be elevated to the 'Credible' level. It is important to move quickly from the 'Possible' stage to the next stage of the threat management process to determine whether or not the threat is 'Credible' and warrants an elevated response. The target time period for determining whether or not a contamination threat is 'Credible' is within 2 to 8 hours from the time that the threat was deemed 'Possible.' The decision to elevate a threat from 'Possible' to 'Credible' is significant since elevated response actions may be necessary to protect public health and safety. The elevated response measures may fall outside of the authority of the utility Incident Commander, and the organizations that would be involved in these response decisions would need to be engaged in the threat evaluation process at this stage. This might include wastewater utility management, the regulatory agency, and the public health agency. If there is a possibility that the contamination event was deliberate, law enforcement may also need to be involved. The individual typically responsible for determining that a contamination threat is 'Credible' is the Incident Commander, who may not be the utility Incident Commander at this point in the threat management process. 4.1 Information Considered at the 'Credible' Stage Many of the information resources used to determine that a threat is 'Possible' may also prove relevant at the 'Credible' stage. It is important to view the investigation as a continuum. Information collected through the 'Possible' and 'Credible' stages of an investigation should be evaluated in its entirety. Additional information that might be considered to support the threat evaluation and determine whether or not a contamination threat is 'Credible' include site characterization results, previous threats and incidents, and information from external sources. CD CD CD CD 03 c 03 03 CD o '•M 03 I 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-9 ------- CD CD E CD CJ) CD 03 03 O '+-> CD c E 03 •M O O Q O Site Characterization Results This includes observations from the site investigation such as physical evidence (e.g., discarded equipment and containers) and environmental indicators (e.g., dead animals, dead vegetation, and unusual odors). This also includes results from field safety screening and rapid field testing of the wastewater. If it is suspected that a contaminant may have already entered the treatment plant, it may be useful to examine archived samples from a continuous automatic sampling program if the utility operates one. Previous Threats and Incidents Summary information derived from analysis of previous incidents similar to the current threat warning may be considered. This can include incidents that have occurred at this utility as well as incidents that have occurred previously in other parts of the country. Information from External Sources Information can also be obtained from external sources to assist incident command in determining whether a threat is 'Credible.' Some potential external information sources include: • Wastewater Permitting Agency •EPA • Water ISAC - (Water Information Sharing and Analysis Center) http://www. waterisac.org • NRC (National Response Center): Has experts trained to provide assistance in the case of a terrorist threat or incident. Also serves as a central point of contact for federal resources (1-800-424-8802). • Law Enforcement Agencies (from all levels of government) • FBI: The focus of the FBI's investigation will be the terrorism aspects of the threat. However, if the FBI determines that the event is 'Credible' from a terrorism perspective, the threat will likely also be considered 'Credible' from a utility and public health/safety perspective. • Neighboring Utilities and WARNs • Public Health Agencies •911 Call Centers • Homeland Security Warnings and Alerts If a specific contaminant is suspected during a threat, information about that contaminant should be consulted to help establish the 'Credibility' and potential consequences of the threat (e.g., toxicity and water solubility). A resource for contaminant specific information is EPA's Water Contaminant Information Tool (WCIT) at http://www.epa.gov/wcit. 4.2 Response Actions Considered at the 'Credible' Stage Once the decision has been made that the threat of contamination is 'Credible,' the response actions that are taken are designed to minimize risk to public health/safety, private property, the economy, infrastructure, and the environment. The response is also aimed at gathering additional information to ultimately decide whether the contamination threat can be 'Confirmed.' 2-10 Wastewater Response Protocol Toolbox ------- The response actions taken at the 'Credible' stage may have a greater impact on the public than those taken at the 'Possible' stage. Four response actions that may be considered at the 'Credible' stage, in conjunction with applicable laws or regulations, include the following: Sample Analysis Once a threat has been deemed 'Credible,' one of the first steps taken in an effort to confirm a contamination incident should be the analysis of samples that were collected during site characterization. The recommended analytical procedures for confirming the presence of tentatively identified contaminants, or analyzing wastewater samples for unknown contaminants, are presented in Module 4: Analytical Guide. Continuation of Site Characterization Activities Once a threat is deemed 'Credible,' additional site characterization and sampling activities may be implemented in an attempt to confirm a contamination incident. In cases where a 'Credible' contamination threat is not confirmed, the additional site characterization and sampling activities will help verify that the wastewater has not been contaminated and support the decision to return to normal operations. Law Enforcement Notification If at this stage of the threat management process it appears that an intentional act may have been associated with the apparent contamination event, law enforcement should be contacted if they have not been contacted previously. Public Notification and Public Health/Safety Response As with the immediate operational response actions taken following the decision that a threat is 'Possible,' the goal of the public health response actions taken after a threat has been deemed 'Credible' is to minimize risk to the population. However, the public health response and safety actions at this stage are elevated with respect to the impact on the public. It is at this point that officials may need to notify the public of the emergency under existing laws or regulations or they may decide to notify the public anyway in the absence of a legal requirement to do so. For example, if significant levels of flammable or explosive chemicals have entered the wastewater collection system, either accidentally or due to an intentional act, the nearby population may be instructed to evacuate the area. If the contaminant has entered the treatment plant, plant personnel may be instructed to evacuate. If the contaminant has passed through the treatment plant, or the contaminated wastewater has been released to the receiving stream, downstream users, such as drinking water treatment plants, should also be contacted. The Incident Commander (or Unified Command) will typically make decisions regarding actions taken in response to CD CD CD CD 03 c 03 03 CD o '•!-> 03 I 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-11 ------- CD E CD CJ) CD CD 03 O -4-> CD c E 03 4-J O O Q O a 'Credible' wastewater contamination threat. Due to the elevated level of actions considered at this stage, responsibility for incident command may shift from the utility Incident Commander to another individual or organization. Additionally, at this point local government may choose to activate their Emergency Operations Center (EOC) to help facilitate a coordinated response among the participating agencies. Activation of the EOC may be full or partial depending upon the circumstances. The EOC is the physical location or headquarters in which the coordination of information and resources to support incident management takes place. It is the support arm of the response effort. It is typically maintained by a community or jurisdiction (city, county, state) as part of their emergency preparedness program. The EOC is usually located in a central, permanently established facility situated some distance from the incident. It is from this location that elected officials, top agency representatives, and EOC staff coordinate information and resources to support on-scene management of the incident which occurs at the Incident Command Post. The Incident Command Post (ICP) is usually where the Incident Commander or the Unified Command, and their staff, are physically located. The ICP is normally located as close as possible to the site of the emergency. It is from this location that incident command may exercise tactical command and control over the emergency response effort. 5 Stage III: 'Confirmed' Stage of Threat Management Process Confirmation represents the transition from a contamination threat to a contamination incident and requires definitive proof that the wastewater has been contaminated. The most reliable means of confirming a contamination incident is through analytical confirmation of the presence of a contaminant. However, under some circumstances, it may be necessary to confirm a contamination incident in the absence of definitive analytical data. This is particularly true in cases where there are challenges in collecting a representative sample due to uncertainty about the point of contaminant introduction, or due to a significant amount of time having elapsed between the introduction of the contaminant and receipt of the threat warning. In cases where analytical confirmation is not possible, it will be necessary to rely upon a preponderance of evidence to confirm an incident. It may take several days to collect sufficient evidence (analytical or non-analytical) to confirm a contamination incident. If the threat evaluation yields no conclusive evidence of contamination, then there should be a determination as to whether the threat still appears to be credible. If it is still 'Credible,' then additional investigation and analysis are warranted. On the other hand, if incident command decides that the threat is no longer 'Credible,' then the incident could be brought to a close. However, the investigation at this point will have to be sufficiently thorough to demonstrate that the wastewater is safe and the system can be returned to normal operation. 2-12 Wastewater Response Protocol Toolbox ------- 5.1 Information Considered at the 'Confirmed' Stage The types of information that might help confirm a contamination incident include the following: Analytical Results Positive identification of a contaminant through sample analysis can confirm a contamination incident and provide the basis for making decisions about public health/safety responses and remediation activities. Additional Site Characterization Results At the 'Confirmed' stage of the threat management process, there will likely be results from site characterization activities performed at multiple locations. These results should be reviewed collectively to explore any potential trends in the data. Information from External Sources At this stage, external resources can be specifically targeted in light of the information already collected. Information from these resources may help to build the 'preponderance of evidence' to confirm an event in the absence of laboratory identification of a contaminant. 5.2 Response Actions Considered at the 'Confirmed' Stage Once a contamination incident has been confirmed, it should be moved into full response mode. At this point, depending on the level of risk posed by the contamination event, city, county, and/or state EOCs may be activated in order to support an effective and coordinated response (Figure 2-3). Other organizations that may be actively engaged in the response include: the wastewater permitting agency, public health officials, emergency response agencies, law enforcement, and the WARN network. All of the participating organizations will likely be coordinated under existing incident command structures designed to manage emergencies at the local or state level. One agency will likely be designated as a lead agency and be responsible for incident command. In some cases a Unified Command may established. If federal agencies are involved in the response, their roles are defined by the National Response Framework (http: //www. fema. gov/emergency/nrf/). In any case, the utility will still have a role in the implementation of full response actions. Figure 2-3. Emergency Operations Center Effective implementation of response actions at this stage is enhanced by positive identification of the contaminant and knowledge of contaminant properties. In particular, the appropriate public health protection strategies, and selection of treatment technologies, will depend on the nature of the specific contaminant. It is vital to perform a thorough investigation in order to have confidence in any decisions about response actions. This is especially true if response actions are implemented on the basis of a preponderance of evidence rather than analytical confirmation. CD CD CD CD CD c 03 CD CD o '•!-> CD I CD •M c o o CM Q O Wastewater Response Protocol Toolbox 2-13 ------- CD CD E CD CJ) CD CD Once the incident has been confirmed, and available information about the incident has been analyzed, the public health response measures already implemented should be reassessed and revised if necessary. This might include revisions to containment strategies or public notifications. Once the immediate public health crisis is under control, efforts will likely focus on remediation and recovery. 6 Contamination Threat Management Matrices Listed below is a series of Contamination Threat Management Matrices. There is a matrix (tabular summary) provided for each of the nine threat warnings discussed in Section 3.1. Each matrix lists the following items at each stage of the threat evaluation: • Information that should be considered in assessing the threat • Factors that should be considered in evaluating this information • Potential notifications • Possible response actions While these matrices are generic, they can be tailored to the needs of a specific utility and to very specific incidents (e.g., security breach at a particular wastewater facility). The actions in these matrices or additional actions may be required by any laws or regulations that apply to the situation. The customized Contamination Threat Management Matrices could then be used as an aid in development of a utility's Emergency Response Plan and site specific Response Guidelines. O E CD 4-J O O Q O 2-14 Wastewater Response Protocol Toolbox ------- Security Breach Table 2-1: Recommendation for Threat Evaluation Stage - Security Breach Possible Credible Confirmatory Information Evaluation Notifications Response • Location of security breach Time of security breach • Information from alarms Observations when security breach was discovered • Additional details from the threat \\arning Was there an opportunity for contamination? 1 las normal operational activity been ruled out? • Have other "harmless" causes been ruled out? • Notifications within utility Local law enforcement agencies Isolate affected area initiate site characterization • Estimate spread of suspected contaminant • Consult external information sources • Results of site characterization at location of security breach • Previous incidents Real time wastevvater chemical data from location of breach • Input from local law enforcement Do site characterization results reveal signs of contamination? • Is this security breach similar to previous security incidents? • Does other information (e.g., wastevvater chemical characteristics) corroborate threat? • Does law enforcement consider this a credible threat? Wastewater primacy agency • State/local public health agency • FBI (if contamination appears to be deliberate) • Implement appropriate public health/safety protection measures Consider steps to protect wastewatcr system (e.g., diversion of contaminated wastcwater) consistent with applicable laws and regulations • Results of sample analysis Contaminant information • Results of site characterization at other investigation sites Input from permitting agency and public health agency • Were unusual contaminants delected during analysis? Do they pose a risk to the public? • Do site characterization results reveal signs of contamination? • Is contamination indicated by a "preponderance of e\ idence?" • Emergency response agencies National Response Center Other state and federal assistance providers WARN network * Downstream users if receiving stream was contaminated Characterize affected area Revise public health/ safety protection measures as necessary • Plan remediation activities CD CD CD CD 03 c 03 03 CD o '•M 03 I 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-15 ------- 6.2 Witness Account Table 2-2: Recommendation for Threat Evaluation Stage - Witness Account Possible Credible Confirmatory Information Evaluation Notifications Response • Location of the suspicious activity • Witness account of the suspicious activity • Additional details from the threat warning • Was there an opportunity for contamination? • Is (he witness reliable'.' • Has normal operational activity been ruled out? • Have other "harmless" causes been ruled out? • Notifications within utility Local law enforcement Isolate affected area • Initiate site characterization Estimate spread of suspected contaminant • Consult external information sources • Interview witness for additional information • Additional information from the witness • Results ot site characterization at location of suspicious activity • Previous incidents * Real time wastewaler chemical data from the location of suspicious activity' • Input from local law enforcement • Do site characterization results reveal signs of contamination? Is the suspicious aclivitj similar to previous security incidents? • Does other information (e.g., wastewater chemical characteristics) corroborate threat? • Does law enforcement consider this a credible threat? • Wastewaler permitting agency State/local public health agency FBI (if contamination appears to be deliberate) • Implement appropriate public health/safety protection measures Consider steps to protect wastewater system (e.g., diversion of contaminated wastcwaler) consistent with applicable laws and regulations • Analyze samples • Perform site characterization at additional sites • Results of sample analysis • Contaminant information • Results ol'site characterization at other investigation sites Input from permitting agency and public health agency • Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characterization results reveal signs of contamination? • Is contamination indicated bv a "preponderance of evidence?" • Emergency response agencies • National Response Center • Other state and federal assistance providers WARN network • Downstream users if receiving stream was contaminated Characterize affected area • Review public health protection measures as necessary • Plan remediation activities 2-16 Wastewater Response Protocol Toolbox ------- 6.3 Direct Notification by Perpetrator Table 2-3: Recommendation for Threat Evaluation Stage - Direct Notification by Perpetrator Possible Credible Confirmatory Information Evaluation Notifications Response Transcript of phone (or written) threat 1 he who. what, where. when, and why of the Ihreat Additional details from the threat warning Vulnerability assessment Is the threat feasible'.' • Has the wastewater already been contaminated? • Is the location known or suspected1' • Is the identity of the perpetrator known or suspected? • 1 lave there been personnel problems at the utility? Notifications within utility • Local law en Ibrcemem • Wastewater permitting agency • Isolate affected area if identified in the threat Identify sites and initiate site characterization Consult external information sources • Gather information from law enforcement assessment • Lavs enforcement assessmenl Primacy agency assessment • Previous threats at this utility or other utilities Results Of site characterization at selected investigation sites Real time wasicwaier chemical data Reports from IS AC. RPA. etc. • Do site characterization results reveal signs of contamination? • Does other information ( e.g. ,w as Lu water chemical characteristics) corroborate Ihreat? • Does law enforcement consider this a credible threat? Does tile permitting agency consider this a credible threat? FBI (ifcontamination appears to be deliberate) * Stale/local public health agency EPA Criminal Investigation Division * Implement appropriate public health protection measures Consider steps to protect wastewater system (e.g.. diversion of contaminated wastewater) consistent with applicable laws and regulations • Analyze samples Perform site characterization at additional sites • Estimate spread of suspected contaminant • FBI assessment • Result:, of sample analysis Contaminant information • Results of site characteri/ation at other investigation sites Input from permitting agency and public health agency * Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characterization results reveal signs ol contamination? • K contamination indicaied by a "preponderance of evidence?" Emergency response agencies • National Response Center • Other state and federal assistance providers WARN network • Downstream users if receiving stream was contaminated • Characterize affected area • Revise public health protection measures as necessary • Plan remediation activities CD CD CD O) 03 c 03 03 CD 03 C E 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-17 ------- 6,4 Notification by Law Enforcement Table 2-4: Recommendation for Threat Evaluation Stage - Notification by Law Enforcement Possible Credible Confirmatory Information Evaluation Notifications Response Law enforcement report The who, what, where, when, and why of'lhe threat • Additional details from the threat warning • Vulnerability assessment • 1 low did the threat warning come to law enforcement? • Is the threat feasible? • Has the wastewater already been contaminated? Is a specific location targeted? • Notifications within utility • Wastewater permitting agency Isolate affected area if known • Identify sites and initiate site characterization • Work with law enforcement to a-sscis lllreal credibility Consult external information sources • Law enforcement asses smenl Previous security incidents • Results of site characterization at selected investigation sites • Real lime wastewater chemical data Reports from 1SAC. EPA. etc. Do site characterization results reveal signs of contamination? • Does other information (e.g., wastewater chemical characteristics) corroborate threat? Does law enforcement consider this a credible threat? • Docs the permitting agency consider this a credible threat? • FBI (if contamination appears to he deliberate) • Slate/local public health agency • Implement appropriate public health protection measures • Consider steps to protect wastewater system (e.g., diversion of contaminated waslcwatcr) consistent with applicable laws and regulations • Analy/e samples • Perform site characterization at additional sites Estimate spread of suspected contaminant • FBI assessment Results of sample analysis • Contaminant information • Results of site characterization at other investigation sites Input from permitting ngency and public health agency • Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characterization results reveal signs of contamination? Is contamination indicated by a "preponderance of evidence?" • Emergency response agencies • National Response C'enter • Other state and federal assistance providers WARN network • Downstream users it" receiving stream was contaminated • Characterize alTected area Revise public health protection measures as necessary • Plan remediation activities 2-18 Wastewater Response Protocol Toolbox ------- 6.5 Notification by News Media Table 2-5: Recommendation for Threat Evaluation Stage - Notification by News Media Possible Credible Confirmatory Information Evaluation Notifications Response Details of media report The who, what, where, when and why ol'the threat • Additional details from the llircat warning Vulnerability assessment 1 low did the threat warning come to the media? • Is the threat feasible? Mas the wastewaler ul rcadv been contaminated? • Is a specific location targeted? Notifications within utility • Local law enforcement Wastewater permitting agency • Isolate a fleeted area it known • Identify sites and initiate sile characterization Contact news media for additional details • C onsult external information sources • Additional details from media • Law enforcement assessment • Previous securit) incidents • Results of site characterization at selected investigation sites Real time wastcwater chemical data • Reports from ISAC. RPA, etc. • Do sile characterization results reveal signs of contamination',' • Does other information (e.g., \vastewalerchemieal characteristics) corroborate threat? Does law enforcement consider this a credible threat? Does the permitting agency consider this a credible threat? FBI (ifcomamination appears to be deliberate) • Slate/local public health agency • Implement appropriate public health protection measures Consider steps to protect waste water system (e.g.. diversion of contaminated wastcwater) consistent with applicable laws and regulations Analyze samples • Perform sile characterization at additional sites • Lstimalc spread of suspected contaminant • FBI assessment • Results of sample analysis • Contaminant information • Results of site characterization at other investigation sites • Input from permitting agency and public health agency * Were unusual contaminants detected during analysis? Do they pose a risk to the public? Do site eharacleri/atitiii results reveal signs ol contamination? • Is contamination indicaled by a "preponderance of evidence?" Emergency response agencies • National Response Center • Other stale and federal assistance providers WARN network • Downstream users if receiving stream vvas contaminated • Characterize affected area Revise public health protection measures as necessary • Plan remediation activities CD CD CD CD 03 C 03 03 CD o '•M 03 I 03 •M c o o CN Q O Wastewater Response Protocol Toolbox 2-19 ------- 6.6 Unusual Water Quality Table 2-6: Recommendation for Threat Evaluation Stage - Unusual Water Quality Possible Credible Confirmatory Infomistion Evaluation Notifications Response • Unusual wastewater chemical data • Baseline wastewater chemical data • Real time wastewater chemical data • Operational information corresponding to the time of the unusual water quality • Are the unusual wastewater chemical values significantly different from an established baseline? • Could operational changes be the cause? • Arc there similar results at other monitoring locations? • Notifications within utility • Identify sites and initiate site characterization • Begin analysis of available wastewater chemical data Investigate any unusual public complaints • Consult external information sources • Results ofsite characterization at selected investigation sites • Previous threat warnings triggered by changes in wastewater chemistry • Contaminant information • Public complaints Do site characterization results reveal signs of contamination? • Are these unusual data substantially different from previous episodes involving changes in wastcwaler chemistry? Are the unusual wastewaler chemical data indicative of a specific contaminant? • Are the unusual wastewater chemical results clustered in a specific area? • Are there any unusual public complaints in the area? (e.g., odors) Wastewater permitting agency Slate/local public health agency • Local law enforcement • im (if contamination appears to be deliberate) • Implement appropriate public health protection measures • Consider steps to protect waslewater system (e.g., diversion of contaminated wastewater) consistent with applicable laws and regulations * Analyze samples • Perform site characterization at additional sites • Estimate spread of suspected contain inam • Results of sample analysis • Contamination information • Results of site characterization at other investigation sites • Input from permitting agency and public health agency • Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characteri/ation results reveal signs of contamination? • Is contamination indicated by a "preponderance of evidence?" Emergency response agencies • National Response Center • ( )lhcr slate and federal assistance providers • WARN network « Downstream users if receiving stream was contaminated • Characterize affected area • Revise public health protection measures as necessary « Plan remediation activities 2-20 Wastewater Response Protocol Toolbox ------- 6.7 Degradation of Treatment Organisms Table 2-7: Recommendation for Threat Evaluation Stage - Degradation of Treatment Organisms Possible Credible Confirmatory Information Evalustion Notifications Response Extent of degradation Time of degradation • Additional signs of contamination • Was (here an opportunity tor contamination? Has normal operational activity been ruled out? * Have other "harmless" causes been ruled out? • Notifications within utility • isolate affected area • Initiate site characterization • F,stimate spread of suspected contaminant • Consult external information source • Results of site characterisation at location of suspected contamination Previous incidents Real time waste water chemical data • Input from local law enforcement • Do site characterization results reveal signs of contamination? Is this degradation of treatment organisms similar to previous contamination incidents? • Does other in formation (e.g., waslewater chemistry) corroborate threat? • Wastewaler permitting agency • State/local public health agency • Local law enforcement and FBI (if contamination appears to be deliberate) • Implement appropriate public health/safety protection measures Consider steps to protect wastewaier system (e.g. diversion of contaminated wastewater) consistent with applicable laws and regulations • Results of sample analysis • Contaminant information Results of site characterization at other investigation sites • Input from permitting agency and public health agency • Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characterisation results reveal signs of contamination? • Is contamination indicated by a "preponderance of evidence?" • limergency response agencies • National Response Center • Other state and federal assistance providers WARN network • Downstream users if receiving stream was contaminated • Characterize affected area Revise public health protection measures as necessary CD CD CD O) 03 c 03 03 CD 03 C E 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-21 ------- 6.8 Public Complaints Table 2-8: Recommendation for Threat Evaluation Stage - Public Complaints Possible Credible Confirmatory Information Evaluation Notifications Response • Compilation of public complaints, including geographic distribution (e.g., unusual odors emanating from sewers) • Recent waste water chemical dala that may be associated \vith complaints • Operational information corresponding to the time of the unusual complaints • Are the complaints unusual? • Could operational changes be the cause? * Are the complaints clustered in a specific urea? • Are complaints from habitual complainers'.' • Nolilicalions within utility Identify sites and initiate site characterizations • Begin analysis of available waslewater chemical data • Interview people in area with high numbers of complaints • Consult external information sources • Results of site characterization at selected investigation sites • Summitry of historic public complaints • Contaminant information • Do site characterization results reveal signs of contamination? • Are other people in the area making similar complaints? • Are the unusual complaints significantly different from typical complaints? • Are the complaints indicative of a specific contaminant? • Is there anything unusual about the water quality in the area? • Waslewater permitting agency • Stale/local public health agency Local law enforcement [;BI (if contamination appears to be deliberate) • Estimate affected area and isolate if possible • Implement appropriate public health/safety protection measures Consider steps to protect wastewater system (e.g., diversion of contaminated wastewater) consistent with applicable laws and regulations • Analyze samples • Perform site characterization at additional sites • Estimate spread of suspected contaminant • Results ot sample analysis Contaminant information • Results of site characterization at other investigation sites • Input from permitting agency and public health agency • Were unusual contaminants detected during analysis? Do they pose a risk to the public? • Do site characterization results reveal signs of contamination? Is contamination indicated by a "preponderance of evidence?" • Emergency response agencies • National Response Center • Other slate and federal assistance providers WARN network • Downstream users if receiving stream was contaminated • Characterize affected area • Review public health protection measures as necessary Plan remediation activities 2-22 Wastewater Response Protocol Toolbox ------- 6.9 Public Health Notification Table 2-9: Recommendation for Threat Evaluation Stage - Public Health Notification Possible Credible Confirmatory Information Evaluation Notifications Response • Details of notification from public health sector • Symptoms of health effects and causative agent, if known • Contaminant information * Why is wastewater under investigation as a possible source? Are the reported symptoms consistent with exposure to the contaminant via wastewater? • If causative agent is known, is it stable in water? • Notifications within utility • State/local public health agency • Wastewater permitting agency • Consult with public health agency and permitting agency • Consult external information sources • Geographic distribution of health effects • Recent wastewater chemical and operational data • Reports of public complaints • Contaminant information • Is the geographic pattern of exposure consistent with exposure to contaminated wastewater? • Is there a recent occurrence of unusual water quality data or public complaints? Does additional in formation about the potential contaminant indicate wastewater as a potential source? • FBI (if contamination appears to be deliberate) Local and State law enforcement agencies • Estimate affected area and isolate if possible • Implement appropriate public health/safety protection measures • Identify additional sites and initiate site characterization • Analyze samples • Results of site characterization at selected investigation sites • Results of sample analysis • Contaminant information • Law enforcement and/ or FBI assessment • Has the public health agency concluded that wastewater is the cause of the health effects? • Did sample analysis detect the causative agent? • Was another contaminant detected during sample analysis that could be the cause of the health effects? • Emergency response agencies • National Response Center Other state and federal assistance providers WARN network • Downstream users if receiving stream was contaminated • Characterize affected area Revise public health/ safety protection measures as necessary • Plan remediation activities CD CD CD CD CD 03 c 03 03 CD o '•M 03 I 03 •M c o o CM Q O Wastewater Response Protocol Toolbox 2-23 ------- 7 Summary Because of the potentially serious impacts of a wastewater contamination event on public safety/ health, private property, and wastewater infrastructure, contamination threats should be evaluated and managed in a timely and systematic manner. Improper management of a threat can lead to overreaction to a false alarm or underreaction to a dangerous situation. Module 2 of the WWRPTB presents recommendations to systematically process a suspicion of intentional or accidental contamination of a wastewater system. Utilities can use these suggestions for evaluating threats and responding accordingly when they prepare or upgrade their Emergency Response Plans and Response Guidelines. CS i_ 8 Appendices The following are examples of forms that may be used to facilitate the public health response: CD • Response Planning Matrix • Threat Evaluation Worksheet CD • Security Incident Report Form • Witness Account Report Form • Phone Threat Report Form • Written Threat Report Form LU • Public Health Information Report Form These forms can be found in the Appendices located at the end of the Toolbox. 2-24 Wastewater Response Protocol Toolbox ------- |