4
Progress in the Office of Research and Development’s Water Security Program

When the Environmental Protection Agency (EPA) established the National Homeland Security Research Center (NHSRC) in 2002 as a temporary center with a lifespan of three years, the Water Security Research and Technical Support Action Plan (Action Plan) provided a framework for identifying projects that could make timely and functional contributions to water security needs. The progress that has been made on the Action Plan by May 2006 is described in this chapter, along with some of the most significant products, tools, and guidance that have been developed out of the research program. The purpose of this chapter is to evaluate this work relative to the criteria described in Chapter 3. Because only a small percentage of the anticipated research products had been released during the committee’s review, the effectiveness of the program—that is, whether the information and data developed by the NHSRC are being used to reduce water security risks—could not be usefully evaluated. The committee based much of its analysis on information gained through discussions with EPA staff or its contractors. A critique directed at each of the Action Plan projects is neither within the scope of the committee’s charge nor possible without more detailed information than provided thus far by the EPA. Based on the evaluations in this chapter, recommendations for improving research management and priorities for future short- and long-term research are presented in Chapters 5 and 6, respectively.

The committee’s review of the EPA water security research program is organized below according to the original Action Plan research categories:

  1. protecting drinking water systems from physical and cyber attacks;

  2. identifying drinking water threats, contaminants, and other threat scenarios;



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research 4 Progress in the Office of Research and Development’s Water Security Program When the Environmental Protection Agency (EPA) established the National Homeland Security Research Center (NHSRC) in 2002 as a temporary center with a lifespan of three years, the Water Security Research and Technical Support Action Plan (Action Plan) provided a framework for identifying projects that could make timely and functional contributions to water security needs. The progress that has been made on the Action Plan by May 2006 is described in this chapter, along with some of the most significant products, tools, and guidance that have been developed out of the research program. The purpose of this chapter is to evaluate this work relative to the criteria described in Chapter 3. Because only a small percentage of the anticipated research products had been released during the committee’s review, the effectiveness of the program—that is, whether the information and data developed by the NHSRC are being used to reduce water security risks—could not be usefully evaluated. The committee based much of its analysis on information gained through discussions with EPA staff or its contractors. A critique directed at each of the Action Plan projects is neither within the scope of the committee’s charge nor possible without more detailed information than provided thus far by the EPA. Based on the evaluations in this chapter, recommendations for improving research management and priorities for future short- and long-term research are presented in Chapters 5 and 6, respectively. The committee’s review of the EPA water security research program is organized below according to the original Action Plan research categories: protecting drinking water systems from physical and cyber attacks; identifying drinking water threats, contaminants, and other threat scenarios;

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research improving analytical methodologies and monitoring systems for drinking water; containing, treating, decontaminating, and disposing of contaminated water and materials; planning for contingencies and addressing infrastructure interdependencies; targeting impacts on human health and informing the public about risks; and protecting wastewater treatment and collection systems. In each category, the discussions of progress and continued needs have been further organized in terms of advances in knowledge, new analytical tools, and the development of guidance, protocols, and training, as appropriate. The EPA’s technology testing and research communication strategies are also discussed in this chapter. PROTECTING DRINKING WATER SYSTEMS FROM PHYSICAL AND CYBER THREATS (ACTION PLAN SECTION 3.1) In Section 3.1 of the Action Plan, the EPA identified priority research and technical support on the topic of physical and cyber security in three areas: 3.1.a. Identification and prioritization of physical and cyber security threats, 3.1.b. Understanding the consequences for water systems from physical and cyber attacks, and 3.1.c. Designing countermeasures for preventing or mitigating the effects of physical or cyber attacks. The Action Plan (EPA, 2004a) described eight projects to address these issues, emphasizing blast effects as one of the most likely methods employed by terrorists. Cyber security is also addressed, although the work focuses on applying lessons learned from other industries to the water sector. Out of nine products that are planned from this work, four prod-

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research ucts1 had been produced as of May 2006 (e.g., ASCE et al., 2004a; EPA, 2004b), focusing on vulnerability assessment methodologies and interim design guidance to improve security. One tool for assessing the consequences of physical attacks (AT Planner) was also undergoing preliminary testing (see EPA, 2005a). Advances in Knowledge Security risks are a function of the likelihood of threats, potential consequences, and local vulnerabilities. The EPA and utility managers are well aware of water system vulnerabilities now that most mid- and large-sized utilities have completed vulnerability assessments, but information on threats and consequences remains incomplete. In a classified report, the EPA identified and ranked the most likely intentional contamination threats to drinking water using a risk-based method taking into account feasibility, availability of materials, and public health, economic, and environmental impacts (EPA, 2004b). However, as yet, a threat and consequence analysis of physical and cyber threat scenarios for water systems comparable to the analysis of biological and contamination threats does not seem to be available, even though numerous physical and cyber threat scenarios can be envisioned that could cause major service disruptions or flooding. Lack of EPA expertise in both the cyber and physical attack areas may be affecting more thorough analysis in these areas. Utilities need information on the threats and consequences of physical, cyber, and contaminant attacks to assess their security risks and to provide adequate justification to decision makers on any warranted security upgrades or consequence mitigation measures. The EPA also needs this information to set priorities for its own research efforts. New Analytical Tools The EPA is collaborating with the U.S. Army Corps of Engineers’ (USACE) Engineering Research and Development Center (ERDC) to develop a software tool—AT Planner—that can be used to estimate blast 1 For the purpose of this report, research products reflect those tools, reports, and substantive research articles identified in EPA (2005a) as published or planned outcomes of the Action Plan efforts.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research damage to water or wastewater facilities. The tool will be useful for utilities to estimate standoff distances and to evaluate the expected performance of planned security upgrades so that utilities can evaluate ways to reduce risk or mitigate the consequences of an attack. The software includes preliminary recommendations for facility hardening and redundancy options and provides recommendations for actions to enhance recovery. AT Planner is currently under evaluation by the EPA and select water utility operators. The Action Plan effort contributed to the refinement of two methodologies for conducting vulnerability assessments at water and wastewater utilities: the Risk Assessment Methodology for Water Utilities (RAMW) and the Vulnerability Self Assessment Tool (VSAT). These are valuable tools to assess vulnerabilities at individual utilities, so that utility managers can take steps to manage their risks. However, these existing tools for risk assessment do not contain all of the elements for a complete risk management approach. This topic is addressed further in Chapter 6. Development of Guidance, Protocols, and Training Interim voluntary design standards to improve security at water and wastewater utilities have been developed (ASCE et al., 2004a; 2004b) that offer useful guidance both for security and nonsecurity purposes (dual use). However, the design standards are specific to existing system designs and do not consider visionary designs for future water systems that could both optimize operations while reducing security concerns. The American Water Works Association Research Foundation (AwwaRF) and the Water Environment Research Foundation (WERF) are developing a guidance document to address cyber security at drinking water and wastewater utilities, applying lessons learned from other critical infrastructure sectors. Considering the importance of supervisory control and data acquisition (SCADA) systems to daily operations at many large utilities, this project is critical to improving security for water systems. Following a recommendation in NRC (2004), the EPA has established a Web site2 describing the costs and benefits of various security products that address physical, cyber, and/or contaminant threats. The 2 http://cfpub.epa.gov/safewater/watersecurity/guide/.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research Web site also provides links to technology testing data from the Environmental Technology Verification program and the Technology Testing and Evaluation Program, described later in this chapter. This Web site provides useful guidance to utility managers as they assess alternatives available for improving security. However, the risk reduction benefits of security measures need to be carefully considered in the context of other consequence mitigation options, including recovery strategies, early warning and evacuation, emergency action planning, and contingency planning. Training with industry for blast vulnerability assessment has been initiated on a limited basis using AT Planner, and additional training workshops are anticipated nationwide. This interim training/evaluation process will assist the EPA in determining whether AT Planner meets the needs of the water managers when it is eventually deployed to the owners. Assessment Overall, the EPA efforts in physical and cyber security are limited in scope, reflecting the relatively low priority of the topic to the EPA. The committee is concerned that the potential seriousness of physical attacks on a drinking water system are being overlooked, and therefore, contingencies and recovery options for physical attacks are not being addressed adequately in the research agenda. The lack of in-house expertise on the topics of physical and cyber security further limits the EPA’s ability to take a leadership role in this area, because contract management alone offers limited guidance and oversight to the work being performed. Nevertheless, the EPA has made significant progress on some key projects in this area (e.g., AT Planner). IDENTIFYING DRINKING WATER THREATS, CONTAMINANTS, AND THREAT SCENARIOS (ACTION PLAN SECTION 3.2) Priority items for the EPA to accomplish in the area of identifying drinking water contaminants are listed in Section 3.2 of the Action Plan. This section is divided into four areas:

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research 3.2.a. A manageable, prioritized list of threats, contaminants, and threat scenarios for drinking water supplies and systems; 3.2.b. A contaminant identification tool that describes critically important information on contaminants with the potential to harm drinking water supplies and systems; 3.2.c. A set of carefully selected surrogates or simulants for use in testing and evaluating fate and transport characteristics and treatment technologies for priority contaminants; and 3.2.d. Methods and means to securely maintain and transmit information on threats, contaminants, and threat scenarios applicable to drinking water supplies and systems. To address these issues, 10 projects were identified in the EPA Action Plan (see EPA, 2004a). As of May 2006, notable progress had been made in the first two subsets; a prioritized list of contaminants and a contaminant database had been produced from this work. Research on surrogates (3.2.c) is under way, and three additional products were anticipated, including training modules and improvements to the database (see EPA, 2005a). Advances in Knowledge The EPA is collaborating with other organizations to develop a set of carefully selected surrogates or simulants. For example, the EPA is working with the U.S. Army’s Edgewood Chemical Biological Center (Edgewood) to identify surrogates and simulants for six priority biological warfare agents (four bacteria and two biotoxins) and to identify or develop methods for detecting those surrogates using molecular identification procedures. Edgewood will also examine the fate and transport characteristics of the surrogates and the disinfection effectiveness of chlorine and chloramination for inactivating those surrogates. The EPA and Edgewood have recently signed an agreement to carry out similar work for one virus. The EPA is also working with the Centers for Disease Control and Prevention (CDC) on a similar surrogate project for anthrax (EPA, 2006d; Rice et al., 2005; Rose et al., 2005). The availability of surrogate organisms for highly pathogenic select agents (e.g., some microorganisms, biotoxins) could greatly facilitate and broaden research that is relevant to homeland security as well as to academia and industry. Use of attenuated or avirulent strains or organisms that are taxonomically related to pathogens generally reduces the laboratory biosafety and regu-

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research latory requirements associated with select agent work. However, from the experience to date, it appears that one surrogate per pathogen is not adequate to address all research needs. Work related to the identification of Bacillus anthracis surrogates, although not of highest priority for water security, still provides a good example of some of the difficulties and time investments required to identify suitable surrogates (see Box 4-1). Whether a surrogate is needed that matches closely or broadly the pathogen characteristics of interest is a critical question. The answer depends on the type of research question to be addressed with the surrogate. Surrogates that broadly reflect properties of a select agent or that represent the “upper bounds” or “worst case” properties of a select agent also may be useful in some types of research. For example, viral surrogates for SARS, avian flu virus, and hemorrhagic fever viruses would be useful for studying issues related to fate, transport, and disinfection of these types of viruses in drinking and wastewater. Since these viruses all have a lipid envelope, and since such envelopes can affect environmental fate and transport characteristics, initial studies could be completed rapidly if a nonpathogenic, surrogate virus could be identified with a lipid envelope similar to that present in these human pathogens. Similarly, for decontamination research a surrogate that precisely matches the disinfec- BOX 4-1 Challenges in Identifying Suitable Surrogates Substantial time and effort have been expended to identify appropriate surrogate organisms for Bacillus anthracis. B. globigii (recently renamed Bacillus subtilis var niger) was among the first surrogates identified for this organism and facilitated research on aerosol transmission of spores. In subsequent studies, it also proved to be an acceptable surrogate for chlorine disinfection studies of spores in drinking water, although it was more resistant to chlorine than B. anthracis. Further studies indicated that B. thuringiensis more closely mimics the responses of B. anthracis to chlorine exposure in drinking water (Rice et al., 2005). Much research was also required to establish that B. subtilis (globigii) is a suitable surrogate for ultraviolet susceptibility on B. anthracis spores (Nicholson and Galeano, 2003). Researchers are just beginning to understand the factors that may lead to variability in spore responses to moist heat inactivation. One of the major factors in moist heat tolerance is the core water content of spores. The core moisture content varies significantly among the different species and can be further influenced by processes used to induce sporulation (Nicholson et al., 2000). Thus most of the work on heat inactivation has been done with B. anthracis Ames or Stern strains rather than surrogates.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research tant sensitivity of the target organism is not always needed. Decontamination studies could be conducted with surrogates known to be hardier than the select agent. However, for many emergency response operations, such as a water security breach, knowing the precise disinfection criteria needed to kill or inactivate a target organism (e.g., CT, or disinfectant concentration multiplied by the contact time) is a critical asset in public health decision making. The project to develop and implement a framework within the EPA for evaluating the sensitivity of information and categorizing that information as classified, for official use only, or available for public release has been completed. The resulting document was not available for review by this committee, although this subject relates broadly to all aspects of the EPA water security program. The committee considered the information sharing issue to be of paramount importance, and the fact that the resulting EPA framework was not publicly available is illustrative of the problem. Two classified reports have been developed that are related to, but not directly associated with, Section 3.2 of the Action Plan: the Threat Scenarios for Buildings and Water Systems Report and the Wastewater Baseline Threat Document (EPA, 2004b; 2005j). The first report, as described previously in this chapter, ranked the most likely contamination threats to drinking water, and the EPA subsequently refined the contaminant priorities into a prioritized short list. Additional effort to prioritize the list is not needed. For the second report, the EPA worked with the Water Environment Federation to “identify and prioritize potential physical, cyber, and contamination (e.g. biological, chemical, radiological) threats and threat scenarios for the nation’s wastewater treatment and collection infrastructure, including consequence analysis of adverse effects” (EPA, 2005a). These list-generating exercises based on analyses of water security threats are potentially valuable, because they help focus both the EPA’s own research efforts and broader response and recovery preparedness on the most critical and probable contaminants. However, the short list of priority contaminants has not been made available to utility managers and public health departments because of security concerns, thus substantially reducing the full value of this information. Recommendations on improving information sharing of sensitive information are presented in Chapter 5.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research Development of Guidance, Protocols, and Training The Water Contaminant Information Tool (WCIT) is a Web-accessible database on contaminants for both drinking water and wastewater that has been developed to provide guidance to the broader community of utilities and public health responders. WCIT contains information such as physical properties, toxicity, fate and transport characteristics, potential early warning indicators, suggestions for sampling and analysis, likelihood of removal by drinking water and wastewater treatment, and considerations for a utility’s response to an incident. WCIT was released in November 2005. Drinking water and wastewater utilities, state drinking water and wastewater programs, drinking water and wastewater associations, and federal officials can obtain access. It currently contains information on approximately 50 contaminants. Most of the contaminants in WCIT are chemicals; population of the database with information about biologic contaminants has only recently begun. The contaminants included in this tool are intended to be those that pose a security risk, but the database includes contaminants that are commonly found in water systems. As such, the tool can be used for security issues as well as everyday problems. The contaminants identified by the EPA as the highest priorities for water security (see previous section) may or may not be included in WCIT. Although much of the information in the database is publicly available elsewhere, WCIT’s real value is the compilation in a single location of contaminant information specific to water that is readily available to the water industry. Although WCIT has been released, it has large data gaps. For example, information on the efficiency of treatment technologies is missing for a number of chemicals. The EPA utilized an expert workgroup to review the WCIT input data, but the agency will need to have a continuing mechanism to provide an ongoing review of the data, in addition to some periodic review of the data fields, to identify the need to add, revise, or delete some data as the database develops (see Chapter 6 for recommendations for future WCIT support activities). WCIT offers particular value to response and recovery applications, as well as dual-use applications, assuming that the needed data are available in the database and accurate.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research Assessment The EPA has made progress in this topical area, and many of the projects in this section of the Action Plan are nearing completion, with the exception of the surrogate project, the scope of which has expanded over time. A short list of priority contaminants has been developed, although the results of this information are classified and therefore not currently available to the water and wastewater professionals who need them. One significant accomplishment is the release of WCIT, which can be useful for responding to, recovering from, and mitigating the consequences of a terrorist attack. The database will also be useful for addressing day-to-day contamination issues for the water industry. The work on surrogates could provide guidance on the attributes of suitable surrogates as well as mechanisms to answer more easily questions about pathogenic organisms, but much more work is needed. IMPROVING ANALYTICAL METHODOLOGIES AND MONITORING SYSTEMS FOR DRINKING WATER (ACTION PLAN SECTION 3.3) Methods to detect water contaminants are essential for responding both to deliberate and natural contamination in water systems. Detection systems need sufficient accuracy and timeliness to accomplish the task of assessing the integrity and security of the system. The EPA’s research and implementation efforts related to contaminant monitoring and analysis are described in Section 3.3 of the EPA Action Plan, with Sections 3.3.b-e focusing on research and improved detection capabilities and Sections 3.3.a and 3.3.f-g focusing on implementation: 3.3.a. A “play book” (or module) for sampling and analytical response to contaminant threats and attacks on water supplies and systems; 3.3.b. New analytical hardware and associated field and laboratory analysis methodologies for biological contaminants in water, including requirements for appropriate quality assurance/quality control (QA/QC) and sampling approaches; 3.3.c. Improved analytical hardware and associated field and laboratory analysis methodologies for chemical contaminants in water, including requirements for appropriate QA/QC and sampling approaches;

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research 3.3.d. Monitoring technologies for biological, chemical, and radiological contaminants and threats; 3.3.e. Drinking water “early warning systems” and early warning systems from other sectors amenable to application in the water environment; 3.3.f. An improved and expanded, tiered laboratory capacity and capability; and 3.3.g. Training exercises, drills, and simulation modules for analytical methodologies and monitoring systems. Thirty-five projects are identified in the Action Plan to address these issues (see EPA, 2004a). Although at least 18 products are planned from this work (see EPA, 2005a), only 4 products have been released as of May 2006. The response protocol (or “play book”) outlined in the first subset of this section (EPA, 2003b) and some preliminary guidance documents (e.g., EPA, 2005e) have been completed, and work is progressing in the remaining areas (3.3.b-g). Work under this section includes both laboratory-based analytical capabilities (3.3.b and 3.3.c) and real-time (or near-real-time) field-based monitors and warning systems (3.3.d and 3.3.e). New Analytical Tools Conventional hardware and methods for detection and identification of contaminants have limitations. Standardized laboratory analytical methods for detecting many of the biological threat agents do not exist for water samples, and some existing methods need to be adapted for environmental samples that have low concentrations of target analytes and interference from background materials. Therefore, improved analytical hardware and analysis methodologies need to be developed. The EPA’s efforts in developing analytical tools fall into the categories of new analytical technologies and real-time monitoring systems. New Analytical Technologies Several new analytical technologies are being developed based on a preliminary literature review of existing analytical methods and capabilities. One project is developing and testing an automated batch-mode

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research and parallels already mature frameworks (EPA, 1998; 2005l) for assessing risk from chemicals (e.g., carcinogens, neurotoxins). Risk assessments are of high priority to any response and recovery effort. The risk assessment framework project, however, appears to be more than a year behind schedule, and it is not clear that the risk assessment/risk management projects are being integrated into the other phases of water security research rather than being isolated. Two major ongoing efforts are being supported to fuse health effects data (syndromic surveillance) and environmental information into early warning systems: Real-time Outbreak and Disease Surveillance (RODS) and Electronic Surveillance System for the Early Notification of Community-Based Epidemics (ESSENCE). RODS, which is being developed by the University of Pittsburgh, is being piloted in the city of Pittsburgh, and information on water quality is being integrated to ascertain the utility of such real-time information. ESSENCE, developed by Johns Hopkins University (Lombardo et al., 2004), is also being pilot-tested. These methods hold promise for early detection of health impacts, serve a dualuse purpose for the detection of naturally occurring waterborne contamination events, and are potentially useful in water terrorism events (Ashford et al., 2003; Meinhardt, 2005). The EPA is part of a steering committee (with the CDC) developing and beta-testing the RODS and ESSENCE systems. The EPA is hoping to pilot-test the systems until 2009. The RODS and ESSENCE surveillance research will also examine practical risk communication protocols that might be implemented when, based on surveillance data, it appears that the public’s health may be at risk from a water contamination event. The EPA has been working with Washington, DC, Cincinnati, and other municipal utilities at integrating various data streams on health and water into an integrated monitoring program (C. Sonich-Mullin, EPA, communication, 2006). Nonfederal parties (e.g., state agencies, academic or professional societies like the International Disease Surveillance Society) should also be brought into these discussions. None of the additional research projects proposed in NRC (2004) to advance the knowledge on communication of risks to the public have been initiated. Also, no new studies have been initiated related to a formal analysis of the risks and benefits of releasing or withholding of information due to security concerns. These recommended research projects are discussed further in Chapter 6.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research Development of Guidance, Protocols, and Training The EPA participated in weapons of mass destruction exercises and cosponsored tabletop exercises with the Department of Energy, the Office of Counterterrorism, and the U.S. Coast Guard. These exercises have been helpful in bringing together the water and energy communities, facilitating discussion about back-up power generation and enabling the water community to educate the energy community about what priorities are important in an emergency situation (Kathy Clayton and C. Sonich-Mullin, EPA, personal communication, 2005). Continued effort in this area is necessary—perhaps through the Office of Water—as agencies that are likely to be involved in a water security incident do not typically have experience in establishing and maintaining these types of collaborative relationships. The EPA has contracted the services of the Center for Risk Communication to develop a risk communication guidebook for likely scenarios, provide training, and conduct message mapping workshops. Message mapping is a tool “for achieving message clarity and conciseness” that serves as a “visual aid and roadmap for displaying detailed, hierarchically organized responses to anticipated high concern issues, questions, or concerns.”5 All of these activities are under way but have yet to be completed. Entities that have received training include water utilities, public health department surveillance and information officers, homeland security managers, public information officers, emergency responders, and on-scene coordinators. The message mapping workshops have not been subjected to actual situations in which water quality is compromised, so the usefulness of this particular communication tool in real-life water security situations is unknown. However, the tool has been used in other homeland security incidents, including the attack on the World Trade Center and the London subway bombings (K. Fox, EPA, personal communication, 2007). Improved risk communication has significant dual-purpose value, as these skills would also be needed in the case of a natural contamination event or a natural disaster. The EPA is developing risk communication templates for various terrorism scenarios to assist jurisdictions in their communication planning. In May 2004, the Office of Water and the NHSRC cosponsored the National Water Security Risk Communication Symposium (EPA, 2005k). This symposium served as an information exchange among various stakeholders, and recommendations coming out 5 http://www.centerforriskcommunication.org/services.htm.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research of this symposium may be useful in the development of a national training program. Data dictionaries have been developed to allow risk assessors to obtain relevant information about contaminants quickly, without having to resort to evaluating chemicals using a weight-of-evidence approach. The data dictionaries are now available to risk assessors on a secure site and will eventually be expanded for public access. No plans are in place to conduct a formal evaluation of these efforts to test the effectiveness in reaching key audiences. New Analytical Tools The EPA has developed a scenario-driven tool, the Consequence Assessment Tool (CAT), designed to work together with WCIT to evaluate risk in a contamination event. The tool allows the user to determine exposure point concentrations and assess risk, based on information on the population, pathway, receptors, exposure rate, and duration. The CAT/WCIT programs can also provide toxicity data, and with time, the EPA hopes to attach confidence intervals to the data presented. The CAT provides risk management options, treatment options, cleanup levels, and links to necessary personal protective gear. The actual utility of such tools needs to be tested directly with potential users, including first responders. The CAT/WCIT tools have gaps with respect to toxicity data for certain chemicals for which low-dose information is not available. In the Action Plan, the use of Quantitative Structure Activity Relationship (QSAR) and lethal dose, 50 percent (LD50; i.e., acute toxicity) information was indicated as one route to filling such gaps rapidly. The EPA is just starting the process of trying to adapt the databases of its National Center for Environmental Assessment on QSAR and LD50 to CAT/WCIT (K. Clayton, EPA, personal communication, 2005). NRC (2004) noted the open-ended and ambitious nature of some of the information gathering efforts, and, as predicted, the efforts are taking longer than envisioned. NRC (2004) therefore recommended that information gathering proceed in a manner that provides useful but perhaps approximate information initially, with the gaps filled in via successive revisits. Information databases are always in danger of “the perfect becoming the enemy of the good.” It is not clear whether EPA has adopted this approach or how the EPA is devoting resources to filling these information gaps, considering the size of the task and the potential time

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research required to fill those gaps with experimental data, or how data gathering efforts are being prioritized. Assessment The EPA’s work in risk assessment, risk management, and risk communication addresses important issues critical to response and recovery after a terrorist attack, and many of these issues have dual-use applications to natural water contamination concerns, including the aftermath of natural disasters. However, progress in this area has been slow, and few if any products have been publicly released. Although progress has been made on several risk communication projects, too little emphasis in the Action Plan has been devoted to investigating and utilizing interdisciplinary behavioral science research to better prepare various stakeholders for water security incidents. For example, what are the public’s beliefs, opinions, and knowledge about water security risks, how do risk perception and other psychological factors affect individual or family responses to water-related events and disease prevention messages, and how can the EPA, water and wastewater professionals, and public health officials effectively communicate these risks with the public? Suggestions for additional research needs are discussed further in Chapter 6. WASTEWATER TREATMENT AND COLLECTION SYSTEM PROJECTS (ACTION PLAN SECTION 4.0) Work on wastewater systems is now currently under way, both by the EPA alone and with a variety of partners. The principal areas of investigation identified by the EPA are as follows: 4.0.a. Identification of threats; 4.0.b. Assessment of the potential health and safety risks resulting from contaminated wastewater facilities; 4.0.c. Improved intrusion monitoring and surveillance technologies; 4.0.d. Improved designs for wastewater systems to reduce vulnerability to physical threats; 4.0.e. Enhanced prevention and response planning methods; and

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research 4.0.f. Methods and means to securely maintain and, when appropriate, transmit information on contaminants, and threat scenarios applicable to wastewater systems. Twenty-two projects are identified in the Action Plan to address these issues. Work is being conducted in all of the above subsets, and as of May 2006 three products had been produced focused on the identification of threats to wastewater systems (EPA, 2005j), the development of interim design standards (ASCE et al., 2004b), and planning guidance for utilities for handling decontamination wastewater (NACWA, 2005). Most of the effort in this area involves data gathering, analysis, and synthesis, rather than collecting new data or developing new analytical tools or technologies. At least six additional products were anticipated from this work (EPA, 2005a). Advances in Knowledge The EPA is working to identify and prioritize potential physical, cyber, and contamination threats and threat scenarios for the nation’s wastewater treatment and collection infrastructure, including consequence analysis, and has prepared a classified baseline threat document for wastewater systems (EPA, 2005j). The EPA is also planning projects to assess the current practices and methods to control intrusion into wastewater collection systems and other components of the wastewater infrastructure (including combined systems and stormwater systems) that could be used as conduits for explosive attacks on critical community targets. Work is under way with Argonne National Laboratory to assess the impacts on wastewater and drinking water from a community attack from a radiological dispersal device (A. Hais, EPA, personal communication, 2005). The data that are to be gathered are not considered groundbreaking, but the work is needed to understand more fully the nature and magnitude of the threat. Development of Guidance, Protocols, and Training A critical element in implementing new analytical tools and research findings in the wastewater sector will be the availability of accessible, readable, and easily comprehensible guidance, protocols, and training materials and their dissemination. As in the drinking water projects, the

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research EPA plans to develop a response protocol toolbox to help wastewater utilities create their own plans for responding to threats or attacks. Other guidance documents in development that may help improve response and recovery efforts include a guide to managing contamination events for wastewater, guidance on detection systems, and information on the efficacy of treatment methods for a variety of contaminants. The EPA plans to analyze potential alternatives to chlorine disinfection for wastewater because accidental or intentional releases of large quantities of chlorine gas pose serious public health and safety concerns. The National Association of Clean Water Agencies (NACWA, 2005) developed useful guidance for utilities on handling decontamination wastewater. Interim voluntary design standards for wastewater utilities have been developed (ASCE et al., 2004b) that offer guidance for new construction, reconstruction, and retrofitting for wastewater systems, with a focus on security in combination with improved operations. Consistent with the recommendation in NRC (2004), this approach recognizes the importance of dual use to the successful implementation of security measures. New Analytical Tools The EPA is working with WERF to develop a software model known as SewerNet. The software is currently under development as a tool to assess and improve emergency preparedness. The GIS-based software should allow wastewater utilities to assess the effect of a variety of malicious events, including the release of biological or chemical agents into the wastewater collection system. Much of the work being undertaken in the water sector with respect to sensor development may have applications in the wastewater sector with further development specific to the challenges of the wastewater setting. The Action Plan includes a project to test and evaluate existing monitoring and surveillance technologies in wastewater systems. Assessment The projects identified for the wastewater sector are rational, reasonable first steps that reflect the major concerns with respect to the security issues confronting the wastewater collection and treatment infrastructure.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research Some useful guidance has been developed, but the delivery of products has been slow. The proposed and ongoing EPA projects are important steps in helping to organize the disparate information that now exists related to wastewater security. As the various investigations proceed, data gaps and technology needs will likely be identified. However, how these research needs will be addressed and what strategy will be used to assign priorities to the various tasks is not clear. IMPLEMENTATION (ACTION PLAN SECTION 5.0) Section 5.0 of the Action Plan incorporates several initiatives that relate to implementation of the Action Plan. Two of these initiatives—the Technology Testing and Evaluation Program and Information Sharing—are reviewed below. Technology Testing The Technology Testing and Evaluation Program (TTEP) seeks to advance effective security-related technologies by rigorously testing their performance and making this information available to end users. To date, the TTEP program has tested such technologies as portable cyanide analyzers, rapid toxicity testing systems, reverse osmosis POU devices, and multiparameter water quality probes. TTEP is a positive outgrowth of the EPA’s Environmental Technology Verification (ETV) program, which focused entirely on commercially ready technologies, required vendor participation and partial vendor funding, and involved negotiations with vendors over how test results would be reported. However, TTEP improved the program by including testing of both commercially available technologies and technologies in various stages of research and development and not requiring vendors to pay a fee for testing. Now, the EPA can select and evaluate any commercially available technology (with or without vendor permission) and use test protocols designed to address specific security applications rather than those deemed satisfactory to the vendor. Another important objective of TTEP is to provide test data and reports that are useful to end users. Specifically, TTEP provides side-by-side performance product comparisons that enable users to evaluate their security product alternatives more easily. Lastly, the working relationship between the contractor who performs the tests (Battelle) and the EPA has been changed from a cooperative agreement under

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research ETV to a contractual relationship under TTEP. This legal relationship allows the EPA better access to specific Battelle infrastructure and personnel, more influence over which types of test protocols will be developed, and involvement in determining how specific technologies will be evaluated. While TTEP seems to be an improved mechanism for testing technologies that are touted as homeland security solutions or those that look promising to stakeholders or other government agencies, it introduces new challenges. First the scope of the agents of interest is broad (e.g., pathogenic bacteria, parasites, and viruses; bacterial toxins; chemical warfare agents; toxic industrial chemicals; radionuclides). The EPA will need to identify which technologies exist or are in development for this broad array of agents and intervention methods, identify which technologies have substantial potential for water security applications (as well as dual-use applications), and then decide how to prioritize testing for the most promising technologies under TTEP. Developing suitable test protocols is also a challenge. Test protocols may differ considerably depending on the technology being evaluated and the threat agent. Battelle’s capacity to rapidly develop new test protocols and to evaluate different types of equipment in any single year is unclear. Regardless, the EPA has limits on the funds available to support the TTEP program, which is just one component of its long-term water security research and technical support agenda. Recommendations for prioritizing TTEP’s efforts are provided in Chapter 6. Communication of Research Findings Although the EPA is in its fourth year of the Action Plan, the number of products released to date is limited. Of the more than 75 products anticipated to result from the Action Plan (not including testing reports from the TTEP program), as of September 2005, only 11 products had been released, and of these, 3 are either classified or restricted access (EPA, 2005a). As of May 2006, an additional five products had been publicly released, although several tools had been released in limited distribution for testing purposes. Assessing the success of the entire program based on a limited number of products is difficult and may not be representative. Information sharing is one of the most critical issues facing the EPA’s water security research program. EPA staff insist that the vast majority of the findings from the research program will be widely avail-

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research able to anyone (K. Nickel, EPA, personal communication, 2005), but the committee has some concerns that critical information may not be reaching those who need it. For example, the list of priority contaminants is important for utilities that may want to establish their own security-focused sampling program or simply improve their emergency response capacity, but this information has been classified and cannot be shared with utilities, even over secure dissemination mechanisms. Many of the findings are only valuable if they can be distributed in a manner that allows stakeholders to easily locate the material, recognize its value, and comprehend the relevant information. The publicly available research products are posted at the EPA’s Water Infrastructure Protection Web page,6 and fact sheets are also provided to summarize each of the products available. The EPA has also reached out to utility stakeholders through its Water Sector Security Workshops to publicize ongoing research efforts and solicit informal feedback from utilities. The vast number of anticipated reports, tools, and databases, however, will undoubtedly make it difficult for utilities to keep up with new information. To help address this concern, the NHSRC is utilizing Rich Site Summary (RSS) technology and e-mail subscriber lists to push notices of new material to registered users. These efforts are to be commended, but more work could improve the navigability of the EPA water security Web sites for a broader community of stakeholders. Currently, research products are spread across multiple NHSRC Web pages organized by subject area, and the presence of two separate EPA water security Web sites (Office of Water7 and the NHSRC) that are not clearly linked is likely to further confuse interested stakeholders. Specific recommendations for improving the information sharing strategies, including methods for disseminating sensitive materials, are discussed in Chapter 5. Among the research products produced from the program to date, the committee found a few useful products and tools that seem appropriately targeted to end users (e.g., WCIT, AT Planner; NACWA, 2005). The EPA initiated pilot-testing programs for several of its tools and databases with representative stakeholders to improve the usefulness of these products. However, the EPA should take full advantage of research opportunities to further improve the dissemination and the effectiveness of the research products (see Chapter 5). Other early documents represent exhaustive synopses of existing material that will provide important foundations for future research, but contain too many information gaps to 6 http://www.epa.gov/nhsrc/wip.htm. 7 http://www.epa.gov/safewater/security/.

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research provide direct and practical homeland security guidance to utilities (e.g., EPA, 2005e; 2006a). Some products, such as the Response Protocol Toolbox, require extensive training to be used appropriately. Other research products were not available to the general public because of security constraints (e.g., EPA, 2004b; 2005j). A principal task that remains is to prepare a meaningful synthesis of the information and data developed from the completed and ongoing research projects. The synthesis step is of critical importance if the information and data developed in the water and wastewater security research program are to be of use to individual utilities and municipal agencies. SUMMARY AND CONCLUSIONS Important progress has been made in implementing the EPA’s water security research and technical support program described in the Action Plan, but many of the projects have been delayed behind the originally anticipated timelines (see NRC, 2004; Appendix A), and relatively few products had been publicly released during the committee’s review. The reasons for the delays were varied, and many were specific to the individual circumstances of the subject matter, personnel, or contractors involved. The Action Plan was ambitious in scope and its original timelines may have been overly optimistic. With the passage of time since the last major terrorist attack on the United States, the pressure for fast results also seems to have faded, even though the anticipated Action Plan products, with careful management, could yield results useful for improving the nation’s water security and its response and recovery capacity. Overall, the EPA water security program has initiated research and technical projects that address important issues and seek to address critical gaps in knowledge. Many of the EPA projects under way could also have valuable dual-use benefits. Tools have been developed and information generated in several key areas. Priority contaminants have been identified, and this process has served as a means to prioritize the EPA’s other research efforts. Numerous tools have been developed, including WCIT, MS-EPANET, AT Planner, and the CAT, that will help users improve terrorism preparedness and response capabilities. Protocols for contaminant analysis have been identified or developed, and analytical methods for priority water security contaminants have been incorporated in the NEMI-CBR database. Research is also under way to test the application of current RTMS technologies, appropriately emphasizing nonspecific detection

OCR for page 34
Improving the Nation’s Water Security: Opportunities for Research devices with dual-use applications. Risk communication strategies have been developed and communication workshops held to improve response strategies in case of a water security event. Basic laboratory research is also under way to identify surrogates and to fill critical gaps in the current understanding of the fate and transport and exposure risks for water security agents. Among the EPA’s implementation activities, modifications have been made to the TTEP that should improve both the effectiveness of the process and the value of the results to end users. Other areas, such as physical and cyber security, contingency planning, and wastewater security, have shown weaker or somewhat disjointed progress due to the relative low priority of these areas to the EPA. Also, the EPA’s lack of expertise in these areas has meant that much of the work has taken place outside the EPA, and contract management alone affords limited oversight and guidance to the work being performed. Identifying and assessing the relative importance of physical and cyber threats remains a gap that has critical implications on the prioritization of efforts within the water security research program. Gaps also exist in developing visionary designs for water and wastewater systems and incorporating behavioral science research to better prepare stakeholders for water security incidents. These issues are addressed in more detail in Chapters 5 and 6. An important issue that remains unresolved is making water security information accessible to those who might need it. The results of the water security program will only be valuable if they are distributed in a manner that allows stakeholders to easily locate the material, recognize its value, and understand the relevant findings. The problem of information sharing in a security context is one of the most difficult the EPA faces. Currently, some important information on contaminants and threats that could improve utilities response capabilities is being withheld due to security concerns.