Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 15
Chapter 2 Overarching Issues in the Review of the Water Security Research and Technical Support Action Plan This chapter discusses overarching issues in the Action Plan and suggests improvements to strengthen the document and improve the Environmental Protection Agency's (EPA) efforts to prevent and mitigate threats on the nation's water systems. Key issues addressed include presenting an overarching framework for the Action Plan, developing an effective implementation strategy for this research, improving information sharing, clarifying the roles and responsibilities of supporting agencies, assessing the costs and benefits of water security research and technical support efforts, and clearly articulating the time frame and emphasis for the EPA's research investment strategies. Other suggestions are presented related to the structure and presentation of the document. A detailed review of the individual research needs presented in the Action Plan is found in Chapter 3. OVERARCHING FRAMEWORK FOR RESEARCH AND TECHNICAL SUPPORT The EPA's mission as stated is "to protect human health and safeguard the environment," and the agency has noted that it is "committed to assessing and reducing vulnerabilities and strengthening detection and response capabilities for critical infrastructures" (EPA, 2002~. The Action Plan as currently developed intends to contribute to these goals by: identifying important water security issues for drinking water and wastewater, describing research and technical support needs that address these issues, and presenting a prioritized list of projects that are responsive to the needs (EPA, 2003). The Action Plan also includes a description of the plan's implementation. Although the Action Plan consists of a large array of drinking water and wastewater research and technical support needs and associated projects, the projects will not, in themselves, result 15

OCR for page 15
16 A Review of the EPA Water Security Action Plan in improved protection of the nation's water and wastewater systems. Improved protection will only result when the information and knowledge obtained from the projects are integrated into funded plans that are implemented by collaborations among local, state, and federal agencies and both private and public organizations. The Action Plan would be more effective if, early in the document, it explained how the individual pieces of the plan contribute to the greater goal of protecting the security of the nation's water systems. A diagram would be useful to illustrate how the individual research and technical support projects logically contribute to improved security and what roles water utilities or other agencies might play. Such a framework would also be helpful to illuminate unresolved questions regarding interagency coordination and financing for implementation of these security improvements. Figure 2-1 is a simplified example (note that feedback loops and review are not incorporated here) that could be further developed as the program evolves. The five boxes on the left of Figure 2-1 represent the results of the work proposed in the Action Plan. Each of these categories can be associated with specific "needs and associated projects" identified in the Action Plan (with references to the location in the Action Plan) as follows: · Assessments and Lessons Learned Identification and prioritization of physical threats and vuInerabilities (3. I .a) Assessment of national laboratory capabilities (3.3.;f) Assessment of water supply alternatives (3.5.a) An improved understanding of water system interdependences with other infrastructure sections (3.5.c) .................................................................................................................................................................................................................................... ................................................................................................................................................................................................. . ~ . . ~ ~ ... ..... ....................................................................................................................................................................................... . . . ............. ·-:-- | Assessments and | | Lessons Learned | New Science I | end Research l Databases Tools and Methods - : | Communication l | Strategies l Action Plan · . . . ..... ....... ............... ..... Integrated Water Security Prevention and Response Guidance {Includes EPA Communications Plan and Supporting "Play Books") 11 . . . .............. ..... Water Security Implementation Plans for Utilities and Regional Agencies Figure 2-1. Example framework for depicting the contributions of the Water Security Research and Technical Support Action Plan to the broader needs for protecting the nation's water systems.

OCR for page 15
Overarching Issues · New Science and Research · Databases 17 Improved methods and analysis methodologies (3.3.b) Requirements for monitoring technologies (3.3.c) Early warning systems (3.3.e) Improver} distribution system models (3.4.a) Improved understanding of the environmental fate of contaminants (3. 4. by Newer technologies ant! treatment processes for water and equipment that have been contaminated (3.4.c) An improved understanding of routes of contamination and the acute and chronic public health effects from contaminated drinking water (3.6.a) Development of a list of contaminants and threat scenarios (3.2.a) Development of a database of important information on the contaminants (3.2.b) Development of a surrogate/simulants database (3.2.c) · Tools and Methods Countermeasures to prevent, or mitigate efforts of physical and cyber attacks (3. 1. c) A play book for analytical response (including sampling protocols, decision trees, and analytical tools) (3. 3. a) A methodology for determining when a drinking water system is contaminated and when it is clean (3.4.c: A health surveillance network associated with contaminates! drinking water (3.6.b) A methodology for using non-traditional data for the derivation of toxicity values applied to water (3. 6. c) A risk management/risk assessment framework for identifying the impact of decontamination/treatment options and the subsequent risk assessment response (3.6.d) · Communication Strategies Means for maintaining and transmitting information (3.2.d) Methods and means to communicate risks to local communities (3. 6.c) Although the research and technical support activities implemented under the Action Plan will contribute useful information and tools toward water security efforts, utilities and regional agencies need additional and integrated guidance as they prepare their own unique implementation plans. A broad "Integrated Water Security Prevention and Response Guidance" should be developed by the EPA in partnership with other water organizations. Based on existing knowledge, this guidance would serve as a generic "game plan" for prevention of, response to, and recovery from attacks on water infrastructure. This integrated guidance should eventually weave together the play books and methodologies developed in sections 3.3.a, 3.4.a', and 3.6.d into a comprehensive prevention and response guidance that would direct a utility through possible prevention strategies, available information resources, and response and recovery actions (including detection and monitoring, risk assessment, and decontamination). This broad guidance should incorporate risk communication throughout, providing advice on communication planning. Utilities and regional agencies would then need to tailor this broad guidance into specific implementation plans (Figure 2-1) that would be developed based largely on

OCR for page 15
18 A Review of the EPA Water Security Action Plan each utility's vulnerability assessment and unique circumstances (e.g., location, contingency supplies, interddependencies). The implementation plans would identify water security goals, determine strategic actions to reach the goals (e.g., priorities, cost, implementation schedules, and responsibilities), and outline utility- or agency-specific response and recovery plans, which are supported by EPA-developed play books, tools, and databases. The implementation plans would also contain individualized local communication plans that are supported by broad guidance from the EPA national water security Communication Plan and research findings and tools developed from the Action Plan. Field and table-top exercises will be critical to test regional response plans and to help utilities and agencies develop improved coordination and response strategies. Implementation of the Action Plan, development of response guidance, and the development of water security implementation plans for utilities and regional agencies will be influenced by available financial resources and policy issues. The development and implementation of the Action Plan is driven by the Bioterrorism Act anti the EPA's Strategic Plan for Homelandt Security. Future development of prevention and response guidance could be affected by federal policy changes on information security and new government mandates for water protection. Local, regional, and organizational policy issues affect a utility's security plans on many levels, including determining public access rights to water supplies, deciding when to inform the public about threats on water safety, and negotiating increases in funding for security improvements. The framework proposed in Figure 2-1 highlights two important and immediate water security issues for drinking water and wastewater that are missing in the Action Plan. The Action Plan does not identify the need for overarching water security guidance for prevention and response, which is needed for regional agencies and utilities to develop and implement their own prevention, response, and recovery plans. The Action Plan is also silent on the financial resources required to implement improved water security, and on the importance of communicating with the public, customers, rate regulators, and local elected and appointed officials regarding increased rate structures to create the necessary financial resources to implement countermeasures and the value of water and increased water system security. These issues will require attention from EPA managers as the Action Plan moves forward. ACTION PLAN IMPLEMENTATION Section 5.0 of the Action Plan, "Providing the Means to Implement the Action Plan," discusses how to conduct the research through collaborations with other organizations, but the Action Plan does not include plans for funding this research or integrating the results into effective preparedness and response plans for the nation's utilities. Additional work is needed to further develop this section. An implementation plan should be developed that would clearly articulate the roles and responsibilities of other organizations and federal agencies in respect to implementation of this research and technical support plan. Not all water security research and technical support guidance will be the responsibility of the EPA, but in order to develop effective collaborations, clear allocations of responsibilities are needed. In order to facilitate fast and effective implementation of this research plan, the Action Plan should also include a thorough and up-to-date assessment of water security research activities that are underway in other agencies or organizations (e.g., the Department of Defense and universities) as well as a summary of related ongoing EPA efforts, beyond those outlined in the Action Plan.

OCR for page 15
Overarching Issues 19 Section 5.0 should also include plans for communicating research findings and distributing the tools resulting from the Action Plan projects to stakeholders in a timely manner. For example, risk communication is a critical component in an overall crisis management strategy. The EPA needs to consider how to incorporate the current state of the knowledge in risk communication into its guidance to water utilities and organizations. Hopefully, this will be part of the "Communication Plan" mentioned in section 5.0 that is still in early stages of development. Details on available funding will be needed when developing an implementation plan for the identified research and technical support projects, as availability of funding will likely determine the prioritization strategies for conducting the research. The NRC panel will review the prioritization of the water security projects detailed in the Action Plan in its subsequent report (Part II). COMMUNICATION, INFORMATION SHARING, AND SECURITY While the Action Plan refers to a Communication Plan that includes guidelines on communication systems and processes for properly maintaining and disseminating classified or sensitive information, the Action Plan does not define this Communication Plan or state when it will be available. Developing an effective broad communication strategy that meets the needs of the wide range of stakeholders, including response organizations, water organizations and utilities, public health agencies, and the media, while addressing security concerns, shoulc! be among the highest priorities for the EPA. The federal government's need to restrict access to confidential information versus the need for response agencies to have such information is an issue that will impact how well the public is protected in the event of a terrorist attack. Criteria for classifying and distributing sensitive information should be developed that recognize the need for local and state agencies and other critical players to have access to information that will allow them to prepare for and respond to water security threats. The dangers of keeping information too closely guarded may, in fact, be much greater than the dangers of informing an ill-intentioned person. Even secure information distribution mechanisms may do little to prevent access from a determined saboteur, because the information will need to be distributed to such a large number of stakeholders (e.g., all water utilities). The EPA should, in consultation with other agencies, thoroughly examine the consequences of various levels of information security. Formal studies on the risks and benefits of widely transmitting water-security data could also contribute valuable support for decision makers. Resources exist in the research community (both in academic and non-academic settings) that have much to contribute on the topic of water security, but their inputs to research or response plans are minimized at present because of heightened security concerns. Most of the research community is excluded from reviewing "sensitive'' material, and mechanisms should be sought to include these communities so that the best research minds are available to address the nation's security concerns. The Action Plan mentions the need to communicate the results "in an effective and efficient manner" (section 5.3) and suggests the need for a national clearinghouse to disseminate information on future water security technologies, although no specific mechanism is discussed. One means to communicate with water utilities is through databases, and references are made throughout the Action Plan to developing databases for one purpose or another. The Action Plan, however, does not address how the EPA

OCR for page 15
20 A Review of the EPIC Water Security Action Plan wild create and manage databases that are accessible to all the water stakeholders that need them. Consideration should be made as to how the databases will be accesseci, who will be granted access (and with what security clearance), who will control and update the databases, and how the databases will be integrated with current systems. The WaterISAC (Information Sharing and Analysis Center) is currently the primary mechanism for secure information sharing and incident reporting. As a secure portal communication tool, the WaterISAC is versatile and can be adapted to serve the need of communicating sensitive information to a wide variety of users, such as researchers, first- responders, and public health agencies. However, the EPA will need a comprehensive strategy for relaying security information to a wider range of stakeholders than are currently served by the WaterISAC. The WaterISAC requires a fee for information access and currently limits subscription to water and wastewater utilities (http://www.waterisac.org/WaterISACFactSheet.pdi). The WaterISAC currently serves 177 drinking water and wastewater utilities, the majority of which are large utilities (Erica Michaels, Association of Metropolitan Water Agencies, personal communication, 2003~. INTERAGENCY COORDINATION, ROLES, AND RESPONSIBILITIES The Action Plan concentrates, understandably, on matters which the EPA has traditionally handled and for which they have expertise. While there have been problems of both overlap and gaps in the activities of the EPA and other fecleral agencies uncler ordinary circumstances, the lack of urgency in most cases has allowed these issues to be addressed over an extended period of time. In the case of an emergency, however, it will be too late to discover that a critical activity that was thought to be under the control of another agency had been overlooked due to poor coordination. Although the Action Plan recognizes the importance of coordination among relevant agencies, there are assumptions made throughout the Action Plan about the activities and capabilities of other agencies that may not be correct (for example, the Action Plan overestimates the current capabilities of the Centers for Disease Control and Prevention (CDC) and health surveillance, as described in more detail in Chapter 3~. Collaboration between the EPA, the CDC, and local and state health agencies will be essential to developing an effective national surveillance network. More attention needs to be paid to coordination and communication with other federal, state and local agencies, as all will be involved in the detection and control of an emergency event involving a water supply. Clearly, coordination is a persistent problem not peculiar to water security. However, the rapidity and high stakes of the potential terrorist attacks on water supplies suggest that the EPA should pay particular attention to improving interagency coordination and to determining the roles, capabilities, and training of other agencies. The use of field and table-top exercises, where local, regional, and federal agencies collectively respond to a simulated water supply system attack, is strongly encouraged as it will reveal problems, help target resources, and allow personnel in sister agencies to meet each other and establish relationships that will be extremely valuable in case of a real emergency. All personnel who would respond to a water system attack should be involved, including water and wastewater utilities, police, public health workers, and emergency medical personnel (such as the Metropolitan Medical Response System). The kinds of events contemplated by this Action Plan will take place in a very special context, that of a potential crime. The anthrax episode brought into sharp relief what can happen when the public is not sufficiently informed because of unclear roles and

OCR for page 15
Overarching Issues 21 responsibilities between the Federal Bureau of Investigation (FBI) and the CDC. Thus, it is important that procedures be worked out in detail ahead of time concerning roles and responsibilities of various relevant parties, including local and national law enforcement. Legal issues related to criminal investigations, such as chain of custody, preservation of evidence, and control of information in the face of a contemplated arrest and prosecution, will need to be considered in advance because the need for information dissemination to environmental and public health authorities, communication with the public, and decontamination activities will likely present opposing demands. IDENTIFYING COSTS AND BENEFITS OF ENHANCED SECURITY AND RESEARCH The Action Plan as now written is silent on the question of costs accruing to the proposed research and technical support projects and water security enhancements and their associated benefits, such as reduced risk. The EPA needs to assess these costs and benefits (with assistance from its partners in water security), as utilities will face a large challenge in getting approval from governing boards or legislators for rate increases to pay for security improvements. Government agencies are also operating on limited budgets and need explanations of the products ant! benefits that will derive from their investments. An assessment of costs is relatively straightforward, having to do with (1) direct investments by federal, state, local, and private entities to support the program; and (2) the opportunity cost of diverting funds that might be used for facility improvements, operating enhancements, or other alternative priorities. Determining benefits is more complex and would incorporate risk analysis. The objective of the research program is to lower the probability of a catastrophic terrorist event, minimize and mitigate the consequences caused by an event, or avert the possibility of such an event all together. These benefits have to do both with the magnitude of the impact averted and with the ex ante probability of such an event were the research program and technical support activities not undertaken. Utilities will need assistance communicating the value of water and increased water system security to the public, rate regulators, and elected and appointed officials. The Action Plan noted that there could be a "dual-use aspect" of some of these projects wherein multiple benefits (e.g., security and water quality) would make them more cost effective. Dual-use benefits may be obtained from the spin-off effect of technology, protocols, or other products of the research that were principally developed to avert terrorism, but which may provide other returns. There may be additional ancillary benefits with respect to improved day-to-day operations and response to more likely non-terrorism events, such as natural disasters. For example, a detailed distribution system model not only could be used to assess the movement of a contaminant after a terrorist attack but also would enable the optimization an existing system and would enhance future water system development planning. Increased cyber security could also lead to potential revenue increases by providing a secure computer network with which to conduct electronic transactions with customers (CSO magazine, 2002~. Further study should be directed to better acknowledging these business-enabling benefits. Economic return on investment will be crucial if many of the countermeasures identified through the Action Plan efforts are to be implemented.

OCR for page 15
22 A Review of the EPA Water Security Action Plan TIME LINES FOR INVESTMENTS The Action Plan serves as the basis for making funding decisions on water security research and technical support in the coming three years. EPA staff in their presentations to the panel stressed that the Action Plan and the associated homeland security research were intended to provide products that would be timely, functional, and responsive to water security needs. Some of the products will be released before they are perfected or complete, in order to provide immediate improvements to water security and response capabilities; thus, the EPA is acknowledging that sometimes perfect is the enemy of the good. The pane! recognizes the need to act quickly to address these issues of water security and generally supports this approach. Nevertheless, the time frame of the Action Plan s emphasis should be more clearly and consistently articulated in the document. As currently written, several of the research needs and associated projects identified in the · . - · ... · . - . . . —. .. .. . - . - . · . Action Plan wll1 require continued support long arter the three-year time line, Wh1Ch appears inconsistent with the approach identified by EPA managers. The EPA strategy in the Action Plan to emphasize immediate usability and first approximations is a sound one, but certain research or technological advances may only be accomplished through long-term research investments. Developing a framework where research needs are organized into time frames that reflect both the priority of the activity and the time required for the effort would be helpful. For example, immediate needs (with a time frame of one year or less) could include developing tools and databases based on current research knowledge. Mid-range goals might be reached in a three-to-four year time frame, which reflects a majority of the needs in the action plan. Long-term research efforts will be required to address more complex research questions, significantly advance analytical technologies, and anticipate emerging concerns. Although the EPA has not included long-term research among its objectives for the Action Plan, long-term research needs exist in the current plan and should be identified and highlighted, so that a collaboration of agencies, perhaps including the Department of Defense, the Department of Homeland Security, and the National Science Foundation, could work to ensure that substantive, mission-oriented research questions in water security are not overlooked. The EPA s role in homeland security will not likely diminish after this three-year effort elapses. but the Action Plan and the National Homeland Security Research Center tsiatect to close In three years, focus only on making near-term contributions. This approach does not acknowledge that a strong research and technical support presence will be needed to respond! to new agents and threats, to maintain the water security databases and play books, and to identify continuing research and technical support needs. Although the pane! supports the EPA s emphasis on short-term water security needs, the EPA should consider how a longer-term agency commitment to meeting water security needs could enhance the program s effectiveness. r - - - 7 ~ ~ . ~ . ~ · .~ ~ _ — — — — — — — — _~ — — — STRUCTURE AND ORGANIZATION Several changes could be made to the Action Plan to improve its presentation in terms of structure and organization. The document should clearly state the intended audience for these research and technical support products, and whether certain sizes of water and wastewater utilities were emphasized in developing this plan. Overall, removing unnecessary duplication and making each section of the plan roughly parallel in terms of detail and justification presented could tighten the document. The front matter

OCR for page 15
Overarching Issues 23 for each section tends to be too long, and the focus for the section is confused by the presence of the Key Research or Technical Support Questions, which are mentioned and then never referenced again. To improve the readability of the document, these questions should either be better connected to the subsequent text or deleted. Like these key research questions, other needs are mentioned early in section 3.0 (p. 15-16) as projects raised by stakeholders at the February 2003 meeting, but these needs are not explicitly developed later in the document, as promised. If these needs and projects are considered to be important, these ideas should be thoroughly incorporated into each section of the Action Plan, rather than presented in a random order at the start. Also, Appendix B does not present any new information. The aviates assigned to each project should be moved to the body of the document and the appendix deleted. Detailed project descriptions were withheld from the Action Plan due to the sensitivity of the information. but some of the oroiect descriptions are so broad as to be ~ , ~ ~ ~ easily misinterpreted. For example, the project to develop a comprehensive . . . . · . . ,% · · . . · . · . . - .. database. . . on surrogates or simulates for pr10rlty contaminants 1nclucllng the relationships between the surrogate or simulant and the contaminants of interest with respect to a variety of biological, physico-chemical, and toxicological properties (3.2.c, project 1) could represent a daunting and exhaustive task or could be more narrowly interpreted. More description is needled to clarify some of these broader tasks. The scopes of the needs presented in the Action Plan tend to be widely variable, as are the projects proposed. For example, the need to improve the understanding of contaminant fate and transport (3.4.b) represents an entire field of study, while other needs are very narrow and specific, such as the need for training modules for analytical methodologies (3.3.g). The document would be easier to follow if time frames for the needs and projects were presented, and the needs were organized into immediate, mid- range, and long-term research and technical support goals. One concern in the Action Plan is that the priorities for the research needs have not been adequately described. The Action Plan states that no prioritization was assigned to any of the identified research ant} technical support needs because the stakeholders considered all of the research needs high priority. However, discussions with the EPA staff and a review of Appendix C revealer! that some areas of research are of higher importance (e.g. improving analytical methodologies, section 3.3, versus targeting the impacts on human health and informing the public about risks, section 3.6~; these priorities are not addressed in the text. In order for the panel to assess the priorities and timing of the projects presented in the Action Plan, the underlying priorities of the research needs should be clearly articulated. CONCLUSIONS AND RECOMMENDATIONS . The Action Plan should present a framework that illustrates how its individual pieces contribute to the greater goal of protecting the security of the nation s water systems (e.g., Figure 2-1). The EPA should include plans for integrating the results into effective preparedness guidance and response plans for the nation s utilities and recognize the need for developing funding strategies to accomplish these goals. . ~ . .. .. · . ~ .. Additional work is needed to address implementation of the Action Plan. This should detail the resources needed to accomplish the research, clearly articulate the roles and responsibilities of other organizations and federal agencies, and include

OCR for page 15
24 . . . . . A Review of the EPA Water Security Action Plan plans for disseminating the tools and research findings developed from the Action Plan. Attention needs to be paid to coordination and communication with other federal, state, and local agencies and organizations, as all will be involved in an emergency event involving a water supply. The special circumstances of a purposeful attack will require that the roles and responsibilities of various relevant parties (including law enforcement, FBI, and environmental and public health authorities) be worked out in detail ahead of time. The use of field and table-top exercises is strongly encouraged to help utilities and agencies develop improved coordination and response strategies. An effective broad communication strategy should be developed that meets the needs of the wide range of stakeholders, including response organizations, water organizations anc} utilities, public health agencies, and the media, while addressing security concerns. Consideration should be made as to how water security information databases will be accessed, who will be granted access (and with what security clearance), who will control and update the databases, and how the databases will be integrated with current systems. Criteria for classifying and distributing sensitive information should be developed, and the impacts of distributing sensitive information (including to a wider research community) should be thoroughly examined. . . The EPA should attempt to quantify the benefits and costs accruing to the proposed research ant! technical support projects, and further study should be directed to better acknowledging business-enabling dual-use benefits. The Action Plan should clarify which of its research activities are short-term, applied efforts and highlight important long-term research needs, so that more substantive, mission-oriented research questions in water security are not overlooked. Several changes could! be made to the Action Plan to improve its presentation in terms of structure an(l organization. The underlying priorities in the Action Plan should be clearly articulated.