Concern over terrorist attacks since 2001 has directed attention to potential vulnerabilities of the nation’s water and wastewater systems as targets of malicious attacks. An attack on the water infrastructure could cause mortality, injury, or sickness; large-scale environmental impacts; and a loss of public confidence in the safety and quality of drinking water supplies.
Since 1998, the Environmental Protection Agency (EPA) has served as the lead agency for coordinating efforts to protect the water sector—one of the nation’s critical infrastructures—from intentional attacks. In 2002, the EPA initiated a research program to address immediate research and technical support needs for water and wastewater security. Working together, the EPA’s Office of Research and Development (ORD) and Office of Water developed a focused plan (the Water Security Research and Technical Support Action Plan) with a three- to four-year time frame, consistent with the originally envisioned lifespan of the ORD’s National Homeland Security Research Center (NHSRC). Although the plan included some original research, most research projects were narrowly conceived and emphasized the mining of existing data, making information available in a more useful and accessible format, and evaluating tools and technologies for water system security. When it became clear there was much more required than could be addressed in the short term, the NHSRC was made permanent and the Water Infrastructure Protection Division was formed.
Near the end of the planning time frames used in the Action Plan, the EPA requested a National Research Council (NRC) study to assist in strategic planning for a permanent research program with a long-term vision. A committee was formed by the NRC’s Water Science and Technology Board to review progress by the EPA on its water security activities, including the Action Plan; to identify and evaluate the importance of short- and long-term research needs; and to identify opportunities for improved coordination and communication of the results (see Chapter 1 for complete statement of task). In this report, the committee
evaluates research progress to date, analyzes lessons learned from the first four years, and looks ahead to a vision of the EPA’s water security research program with specific recommendations for strengthening it.
The committee developed four criteria to guide its evaluation of the value of the EPA’s water security research projects and to provide a foundation for its recommendations for future research priorities:
Water security threats with the greatest likelihood and potential consequences (including fatalities, sickness, economic losses, and loss of public confidence) are addressed.
The effectiveness and efficiency of the nation’s response and recovery capacity are improved and/or risk reduction or consequence mitigation measures are developed.
Implementation of new technologies/methodologies is judged to be likely, taking into account their cost, usefulness, and maintenance requirements.
Dual-use benefits accrue from the research.
For this report, “dual use” refers to research that addresses both security concerns and other important water infrastructure objectives (e.g., routine monitoring, protection from natural hazards). Dual-use benefits are included among these criteria because they significantly improve the likelihood of implementation of the research products and their benefits, but the committee does not view dual use as an absolute requirement for all water security research.
The EPA has shown leadership and initiative in the area of water security research. Although it is too early to judge the success of the water security research program, progress has been made toward addressing critical knowledge gaps. To sustain its leadership role, the EPA should develop a strategic plan with long-term research program objectives, address gaps in expertise among EPA program managers and researchers, and improve its approaches to information dissemination. Specific recommendations are also provided for short- and long-term priorities for water security research.
EVALUATION OF THE EPA’S RESEARCH PROGRESS
Many of the projects have been delayed beyond the originally anticipated timelines and, thus, relatively few products were publicly released during the time frame of the committee’s review. Nevertheless, progress
has been made in implementing the EPA’s water security research and technical support program described in the Action Plan (see Chapter 4). The committee was tasked to evaluate progress, not the effectiveness and success of the program, which would not have been feasible at this point. Overall, the EPA water security program has initiated research and technical support projects that address some important issues and critical gaps in knowledge. With proper continued management, these projects could yield results that will be useful for improving the nation’s water security and its response and recovery capacity if the findings reach those who need them in a timely way. Many of the EPA projects under way also have valuable dual-use benefits, which makes dissemination of results in a useful form all the more important.
Tools have been developed and information generated in several key areas. Priority contaminants have been identified, and this process has served as a means to prioritize the EPA’s other research efforts. Numerous tools have been developed, including a contaminant information database, an exposure assessment tool, and refined distribution system models that will help users improve their terrorism preparedness and response capabilities. Protocols for contaminant analysis have been identified or developed, and research is under way to test the application of current real-time monitoring system technologies, appropriately emphasizing nonspecific detection devices with dual-use applications. Risk communication strategies have been developed and communication workshops held to improve response strategies in case of a water security event. Basic laboratory research is also under way to identify surrogates and to fill critical gaps in the current understanding of the fate and transport and exposure risks for water security agents. Among the EPA’s implementation activities, modifications have been made to the Technology Testing and Evaluation Program (TTEP) that should improve both the effectiveness of the process and the value of the results to end users.
Other areas, such as physical and cyber security, contingency planning, and wastewater security, have shown weaker or somewhat disjointed progress. The EPA’s lack of expertise in these areas has meant that much of the work has taken place outside the EPA, and contract management alone affords limited oversight and guidance.
An important overarching issue that remains unresolved is making water security information accessible to those who might need it. The problem of information sharing in a security context is one of the most difficult the EPA faces. Currently, some important information on priority contaminants and threats that could improve utilities’ response
capabilities has been classified and cannot be shared with utilities, even through secure dissemination mechanisms.
RECOMMENDATIONS FOR IMPROVING PROGRAM IMPLEMENTATION
Thoughtful research management planning is essential as the EPA moves forward to build a long-term research program in water security. To strengthen the EPA’s water security research program and utilize its limited resources in the best way, several recommendations for improving program implementation are provided.
The NHSRC’s Water Infrastructure Protection Division should formally articulate its mission and program objectives as it moves beyond the short-term time frame of the Action Plan. To enhance a vision for future research, the committee presents three strategic objectives for organizing future water security research initiatives, emphasizing research products that can guide pre-incident, incident, and post-incident water security activities. Within these objectives, priority setting will be necessary, and several criteria are presented in Chapter 5. A strategic planning exercise is a logical and necessary extension of the Action Plan that will strengthen the EPA’s leadership in the field. The EPA will need to investigate existing planning and decision-making models before embarking on this endeavor to ensure a successful and appropriately inclusive planning process.
The EPA should develop greater in-house research capability, or at least subject matter expertise, in disciplines that have been historically weak at the EPA but where long-term water security concerns are projected. Now that the NHSRC has been made permanent, it should reassess the pros and cons of using contracts as the principal management tool for conducting research in many of the areas the EPA is not currently staffed or equipped to handle. Based on the advantages of extramural funding, the EPA should continue to use contract mechansims to support some water security research, but careful attention should be given to achieving the right balance with in-house expertise. When research is conducted via contracts, the EPA still needs adequate inhouse expertise to evaluate and manage such contracts.
The NHSRC should explore alternatives to improve independent peer review of sensitive or classified work. A major challenge is independent peer review of water security research products that contain classified, or sensitive but unclassified, material. Effective independent
peer review is an important mechanism for avoiding research errors, program problems, and inefficiencies, but sensitive and classified materials and products make peer review difficult, and currently, peer review mechanisms within the NHSRC may not be sufficient. Therefore, the EPA should carefully review areas where independent peer review involving sensitive and classified material is needed and examine available mechanisms for accomplishing peer review, such as those used by other federal agencies.
The NHSRC should solicit early input and involvement from its priority audiences to improve the effectiveness of its research communication. Communication strategies are more likely to be effective if target audiences are asked for input prior to the communication effort. This can be accomplished by characterizing specific audiences in advance, getting input from audiences prior to developing a communication effort, pretesting materials on an intended audience, and soliciting feedback on communication efforts during early phases of implementation. These efforts save resources by ensuring research products are effective and reach those who need them. If the products of research are not used, the resources expended to produce them are ultimately wasted.
The NHSRC should improve its approaches to information dissemination, using both security-specific communication mechanisms and broadly applicable portal technology. The EPA wishes to make its research products widely available to the water sector, and the committee encourages this practice. However, current Web-based approaches to dissemination need to be improved because the number of anticipated research products will undoubtedly make it difficult for utilities to keep up with the information. Use of security-specific mechanisms (e.g., the Water Information Sharing and Analysis Center [WaterISAC], Water Security Channel, Homeland Security Information Network) would enable the EPA to reach out to a large portion of its intended audience and facilitate direct notification about recently published material. The EPA should continue to use the WaterISAC to alert stakeholders to the availability of sensitive materials. The EPA should also consider developing a Web-based information portal to make the research findings easily and readily accessible to the full range of stakeholders. Feedback mechanisms should be developed to learn what products have been especially useful and what improvements may be needed.
The EPA should consider methods to disseminate important but sensitive security information. The EPA should analyze the costs and benefits of keeping information secure and, if necessary, find ways to communicate important information from sensitive or classified research
products so that the research can be useful to stakeholders who need it. The EPA should also consider options for releasing classified or “for official use only” information that could improve response and recovery at the time of a water security emergency.
The EPA water security research will only reduce risk if the products are made available to and properly utilized by utilities; local, state, and federal response agencies; and the public. Therefore, the above recommendations on improving communication and addressing information security barriers are critical to the success of the research program and should be the agency’s highest priorities.
RECOMMENDATIONS FOR FUTURE RESEARCH DIRECTIONS
Based on the committee’s review of the EPA’s water security research progress in Chapter 4 and the criteria developed in Chapter 3, two key water security research gaps—behavioral science and innovative water and wastewater infrastructure designs—are identified that were not considered in the short-term planning horizon of the Action Plan. To address these gaps, the EPA should develop a program of interdisciplinary empirical research in behavioral science to better understand how to prepare stakeholders for water security incidents. The EPA should take advantage of existing behavioral science research that could be applied to water security issues to improve response and recovery efforts. At the same time, when gaps exist, the EPA should support rigorous empirical research that will help address, for example, what the public’s beliefs, opinions, and knowledge about water security risks are; how risk perception and other psychological factors affect responses to water-related events; and how to communicate these risks effectively to the public. The EPA should also take a leadership role in providing guidance for the planning, design, and implementation of new, more sustainable and resilient water and wastewater facilities for the 21st century. Given the investments necessary to upgrade and sustain the country’s water and wastewater systems, research on innovative approaches to make the infrastructure more sustainable and resilient both to routine and malicious incidents would provide substantial dual-use benefits. The EPA should help develop and test new concepts, technologies, and management structures for water and wastewater utilities to meet objectives of public health, sustainability, cost-effectiveness, and homeland security.
Specific short- and long-term water security research recommendations are presented in Chapter 6 in three areas: (1) developing products to support more resilient design and operation of facilities and systems, (2) improving the ability of operators and responders to detect and assess incidents, and (3) improving response and recovery. Recommended research topics in the area of supporting more resilient design and operation of systems include improved methods for risk assessment and innovative designs for water and wastewater systems. Physical and cyber threats specifically deserve more attention and analysis because this information could influence EPA’s future research priorities and utilities’ preparedness and response planning.
Research suggestions that improve the ability of operators and responders to detect and assess incidents build upon the EPA’s current research in the areas of analytical methodologies, monitoring, and distribution system modeling. To support the simulation models in development, a substantial amount of fundamental research is needed to improve understanding of the fate and transport of contaminants in distribution systems. Based on the number of emerging technologies and agents of interest, the EPA should develop a prioritization strategy for technology testing to optimize the resources devoted to this effort.
Recommendations for future research priorities to improve response and recovery emphasize the sustainability of tools for emergency planning and response and improving research on water security contingencies, behavioral sciences, and risk communication. The EPA should also evaluate the relative importance of future laboratory work on surrogate development and address data gaps in the knowledge of decontamination processes and behavior. So far, the EPA has not taken advantage of the many opportunities from Hurricane Katrina to harvest lessons learned related to response and recovery, despite encouragement provided by this committee in NRC (2005; see Appendix A), and the window of opportunity is rapidly closing.
Some of the committee’s research recommendations lie outside of the EPA’s traditional areas of expertise. The EPA will, therefore, need to consider how best to balance intramural and extramural approaches to carry out the research, while maintaining appropriate oversight and input into research activities. Increasing staff expertise in some key areas, such as physical security and behavioral sciences, will be necessary to build a strong and well-rounded water security research program.