What Are the Top Eight Vulnerabilities in Securing our Wastewater Treatment Plants Against Terrorist Acts?

Nationwide, more than 16,000 publicly-owned wastewater treatment plants, approximately 800,000 miles of sewers, and 100,000 major pumping stations serve more than 200 million people, or about 70 per cent of the US population. The remainder of the population is served by privately-owned utilities or by on-site systems, such as septic tanks. About 500 large public wastewater systems provide service to 62 percent of the sewered population, according to data in a recent GAO report titled “Wastewater Security.”*

Waste treatment plant.
http://www.houcks.com/services/concrete-restoration.asp.

Wastewater systems include 1) a collection system and 2) treatment facilities. Collection systems are generally widely dispersed geographically and have multiple access points, including drains, catch basins, and manholes, most of which are underground and are not monitored. The underground network of sewers includes both sanitary and storm water collection lines that may range form 4 inches to greater than 20 feet in diameter. According to the GAO report, some of the nation’s older cities continue to have combined sanitary and storm water lines. Sewers are connected to all building and streets within typical communities through indoor plumbing and curb drains. (p. 18)

Diagram of components of a typical community wastewater collection system.
Source: GAO-05-165 p. 16, at www.gao.gov

Diagram of components of a typical wastewater treatment facility.
Source: GAO-05-165 p. 17, at www.gao.gov

A typical wastewater treatment plant uses a series of physical, biological and chemical processes to treat wastewater. “Primary treatment includes the removal of larger objects, such as rags, cans, or driftwood, through a screening device or a grit removal system, and solids are removed through sedimentation. Secondary treatment includes a biological process that consumes pollutants, as well as final sedimentation. Some facilities also use tertiary treatment to remove nutrients and other matter even further. Following secondary or tertiary treatment, the wastewater is disinfected to destroy harmful bacteria and viruses. Disinfection is often accomplished with chlorine gas, which is stored on-site at the wastewater treatment plant.” Wastewater systems have become increasingly computerized and rely on the use of automated controls to monitor and operate them, which, in turn, require electricity.

Even before September 11, 2001, there were attacks on wastewater systems. For example, GAO authors note that in “June 1977 in Akron, Ohio, an intentional release of naphtha, a cleaning solvent, and alcohol into a sewer by vandals at a rubber manufacturing plant caused explosions 3.5 miles away from the plant, damaging about 5,400 feet of sewer line and resulting in more than $10 million in damage.” (p. 13)

Following September 11, 2001, the US government directed attention to improving the security of the nation’s water infrastructure, meaning BOTH its drinking water AND its wastewater systems—to protect against future terrorist threats. In December 2003, the President issued Homeland Security Presidential Directive-7, which established the Environmental Protection Agency (EPA) as the lead federal agency to oversee the security of the water sector, both drinking water and waste water. The EPA and its industry partner, the Association of Metropolitan Water Agencies (AMWA) (http://www.amwa.net/) created the Water Information Sharing and Analysis Center (Water ISAC), which serves more than 1,000 users by providing real-time alerts of possible terrorist activity and access to a library of information and contaminant databases to water utilities throughout the nation. In addition, the EPA has funded nonprofit technical support and trade organizations including the Association of Metropolitan Sewerage Agencies (AMSA) (http://www.amsa-cleanwater.org/) and the Water Environment Federation to develop tools and training on conducting vulnerability assessments to reduce utility vulnerabilities and on planning for and practicing response to emergencies and incidents. (p. 20)

How well are wastewater facilities performing in improving security against potential terrorist attack? GAO conducted a survey of 50 identified wastewater experts who identified the most important vulnerabilities and the most important activities required to improve wastewater facilities’ security. The 8 most important wastewater system vulnerabilities according to the 50 solicited experts are:

1. Collection systems’ network of sewers

2. Treatment chemicals

3. Key components of a wastewater treatment plant

4. Control systems

5. Pumping stations

6. Lack of security culture

7. Interdependencies among all major wastewater assets

8. Interdependencies between wastewater systems and other critical infrastructures

1. Collection systems’ network of sewers

42/50 (84%) respondents ranked collection systems’ networks of sewers as the greatest vulnerability to wastewater systems and sewered populations. “Several [experts] noted that sewers make underground travel from a point of entry to a potential target almost undetectable. Many also suggested that adversaries could use the collection system as an underground transport system—without ever physically entering the system—for explosive or toxic agents. For example, several experts explained, an adversary could pour a highly toxic chemical into the sewer that could destroy the biological agents vital to the treatment process.” (p.6)

2. Treatment chemicals

The second greatest vulnerability of wastewater systems (32/50 or 62% respondents) is treatment chemicals, specifically, chlorine gas, which is extremely volatile and lethal when inhaled, and requires precautions for its safe transport, storage, and use. Railroad cars are designed to withstand a bullet from a normal handgun or rifle, but not explosives that are within the skill set of a terrorist.

3. Key components of a wastewater treatment plant

The third greatest vulnerability of wastewater systems (29/50 respondents) is damage to components of the wastewater treatment facility system, which would result in inadequately treated wastewater and contaminated drinking water sources, harming the environment, and causing untold economic damage. Experts noted that of all the facility components, the “headworks,” where wastewater carried through the collection system first enters the plant, is particularly vulnerable to attack.

4. Control systems

The fourth greatest vulnerability (18/50 respondents) is the automated Supervisory Control and Data Acquisition (SCADA) systems, which control vital system operations, among other functions. “These systems can be vulnerable because of loose security in the control rooms at some plants, and remote access to SCADA through the Internet, among other reasons. One expert described a breach of cyber security in Australia which caused the release of thousands of gallons of raw sewage.” (p. 7)

5. Pumping stations

The fifth greatest vulnerability (16/50) is pumping stations, which are often used to move sewage to the treatment plant when gravity alone is not sufficient. “As one expert explained, destroying or disabling a pumping station could cause the collection system to overflow raw sewage into the streets, and into surface waters, and back up sewage into homes and businesses…The remoteness and geographic distribution of pumping stations, and their lack of continuous surveillance, make them particularly vulnerable.” (p. 7)

6. Lack of security culture

Some respondents pointed out that “wastewater utilities generally do not have a security culture because they are often more focused on operational efficiency and may, therefore, be reluctant to add security procedures and access control elements to their operations. For example, one expert noted the ease with which many types of individuals (employees, contracts, and visitors) and vehicles typically enter wastewater treatment facilities. As this expert pointed out, some facilities do not check tot ensure that individuals entering the property have legitimate reasons for being there.” (p. 36) Another potential security issue is lack of inspection of incoming truckloads at some wastewater treatment plants, which could result in delivering contaminants or explosives to destroy the treatment process of the entire facility. Also, there may be little background screening of utility employees.

7. Interdependencies among all major wastewater assets

A few survey respondents pointed out that interdependence among the components of the wastewater treatment system means that the system accomplishes its purpose only when all of its components are in proper working order. One expert explained that, “because treatment plants are less able to recover from an attack, they may have a higher level of security than other assets, such as the collection system. However, because collection and treatment are part of one integrated system, securing one asset does not ensure that the system as a whole is more protected. For example, gates and fences around the main treatment plant may stop an adversary from coming onto the physical property, but it will not prevent a harmful agent from entering the facility through the collection system—an event that could destroy the facility’s entire secondary treatment process.” (p.36)

8. Interdependencies between wastewater systems and other critical infrastructures

Experts noted that interdependencies between wastewater systems and other critical infrastructures is a final major vulnerability. “Disruptions in electric power, cyber systems, and transportation of treatment chemicals can result in a failure of wastewater treatment systems. One expert cautioned that the interruption of the power grid could render the wastewater plant useless, noting ‘Several hours without power would cause the biological treatment process to halt and wastewater would back up on the collection system.’ Such an event occurred in 2003, when a major power failure caused treatment plants in Cleveland, Ohio, to release at least 60 million gallons of raw untreated wastewater into… Lake Eerie or the Cuyahoga River and other tributaries.” (p. 36)

What specific activities do wastewater experts suggest to improve wastewater security?

The three most important activities to improve wastewater security are:

1. Replacing gaseous chemicals used in wastewater treatment with less hazardous alternatives.

2. Improving local, state, and regional collaboration efforts.

3. Completing vulnerability assessments for individual wastewater systems.

1. Replacing gaseous chemicals used in wastewater treatment with less hazardous alternatives.

29/50 respondents rate replacement of gaseous chemicals at wastewater treatment facilities with less hazardous alternatives as warranting highest priority for federal funding. The availability of chlorine gas in particular makes wastewater treatment facilities an attractive target for terrorist attack. Conversion to sodium hypochlorite and ultraviolet disinfection is expensive, but an increasing number of plants are doing just that. One expert suggested that conversion of individual facilities is a good candidate for federal funding. Another expert suggested reducing the size of containers (from 90-ton railroad tanker car size to 1-ton canisters) used to transport and store gaseous chemicals to deter terrorist acts.

1-ton canisters of chlorine gas stared at a wastewater treatment plant
Source: GAO-05-165 p. 41, at www.gao.gov

2. Improving local, state, and regional collaboration efforts.

23/50 experts highly rated efforts to improve collaboration between utilities, local and state law enforcement agencies, fire departments, and other first response agencies through periodic field and tabletop exercises in advance of an emergency situation. One expert lamented that wastewater facilities remain largely disconnected from these entities, and wastewater facilities’ efforts for emergency response planning are, therefore, often undertaken independently. “This lack of collaboration perpetuates the community’s idea that ‘sewers lead to [a] magical place where [materials] simply go away without consequence. The expert added that this misperception is demonstrated by a failure of some in the medical response community to adequately plan for proper disposal of waste resulting from decontamination efforts of a chemical, biological, or radiological event. Directly discharging such material to the wastewater influent stream could significantly damage or destroy the wastewater treatment process.” (p. 42)

3. Completing vulnerability assessments for individual wastewater systems.

20/50 respondents rated vulnerability assessment completion highest. The Bioterrorism Act of 2002 required vulnerability assessments for drinking water utilities serving more than 3,300 people but did not include a comparable requirement for wastewater utilities. Software titled “Vulnerability Self Assessment Tool (VSAT), developed and released by the AMSA, provides an interactive framework for conducting vulnerability assessment. (p. 43)

Which facilities should be given highest priority for federal funding?

Utilities serving critical infrastructure, including government, commercial, industrial, and medical centers and hospitals, should receive highest priority for federal funding according to 39/50 experts. In decreasing order of priority after serving critical infrastructure (1) are facilities 2) using large quantities of gaseous chemicals, 2) serving areas with large populations, 4) where a security breach would adversely impact environmental resources (e.g., receiving waters), 5) having completed vulnerability assessments, 6) serving areas with medium or small populations, and 7) serving buildings, monuments, parks, tourist attractions, or other entities that have symbolic value. (p. 53)

Editor’s Note: This is a clean assessment of dirty water security issues. Some of the experts wisely identified the important vulnerabilities outlined in #7 and #8 above (7. Interdependencies among all major wastewater assets and 8. Interdependencies between wastewater systems and other critical infrastructures).

Source:

“Wastewater Security” (GAO-05-165) January 2005 available online by visiting www.gao.gov and entering number into search engine.

Additional reading:

“Water Supply Critical Infrastructure: Securing Elgin's Riverside Water Treatment Plant” in Securitas August/September 2004, available online at: http://www.semp.us/securitas/aug_sept04.html.