Wastewater treatment works security

Title II of the Federal Water Pollution Control Act (33 U.S.C. 1281 et seq.) is amended by adding at the end the following:

222.

Wastewater treatment works security

(a)

Definitions

In this section: (1)

Alternative approach

(A)

In general

The term alternative approach means a method of preventing or reducing— (i)the threat of a harmful intentional act; or (ii)the consequences of a harmful intentional act. (B)

Inclusions

The term alternative approach includes— (i)an approach at a treatment works that— (I)uses smaller quantities, or less hazardous forms, of substances of concern; (II)replaces a substance of concern with a less hazardous substance; or (III)uses a process that is less hazardous; and (ii)with respect to a treatment works that uses chlorine for disinfection, an approach that considers the use of sodium hypochlorite, ozone, ultraviolet radiation, and other appropriate treatment chemicals that are less hazardous than chlorine. (2)

Consideration

The term consideration, with respect to the consideration of an alternative approach, includes consideration of— (A)the benefits and risks of the alternative approach; (B)the potential for the alternative approach to prevent or reduce the threat or the consequences of a harmful intentional act, including hazards to human health and the environment (as described in section 112(r)(7)(B) of the Clean Air Act (42 U.S.C. 7412(r)(7)(B)); (C)the cost and technical feasibility of the alternative approach; and (D)the effect of the alternative approach on employee safety. (3)

Emergency response plan

The term emergency response plan means a plan developed by a treatment works that describes the procedures to be followed by the treatment works in the event of a harmful intentional act, including a description of, at a minimum, particular equipment, plans, and procedures that could be implemented or used by or at the treatment works in the event of a harmful intentional act. (4)

Harmful intentional Act

The term harmful intentional act means a terrorist attack or other intentional act carried out upon a treatment works that is intended— (A)to substantially disrupt the ability of the treatment works to provide safe and reliable— (i)conveyance and treatment of wastewater; (ii)disposal of effluent; or (iii)storage of a potentially hazardous chemical used to treat wastewater; (B)to damage critical infrastructure; (C)to have an adverse effect on the environment; or (D)to otherwise pose a significant threat to public health or safety. (5)

Owner or operator

The term owner or operator means any individual or entity that owns, leases, operates, controls, or supervises a treatment works. (6)

Site security plan

The term site security plan means a plan to ensure or enhance, to the maximum extent practicable, the security of a treatment works that includes— (A)security enhancements to significantly reduce the vulnerability of the treatment works covered by the plan to a harmful intentional act; (B)consideration of alternative approaches and, where practicable in the judgment of the owner or operator of the treatment works, implementation of options to reduce the threat or consequences of a harmful intentional act through the use of alternative approaches; (C)a certification by the owner or operator of the treatment works that alternative approaches were considered; (D)a description of the alternative approaches selected, if any; and (E)an explanation of the reasons why particular alternative approaches were not selected. (7)

Substance of concern

The term substance of concern means— (A)any regulated substance (as defined in section 112(r) of the Clean Air Act (42 U.S.C. 7412(r)); and (B)any substance designated by the Administrator under subsection (j). (8)

Vulnerability assessment

(A)

In general

The term vulnerability assessment means an assessment of the vulnerability of a treatment works to a harmful intentional act. (B)

Inclusions

The term vulnerability assessment includes— (i)a review of the vulnerabilities of the treatment works that identifies, with respect to the treatment works— (I)facilities, systems, and devices used in the storage, treatment, recycling, or reclamation of municipal sewage or industrial waste; (II)intercepting sewers, outfall sewers, sewage collection systems, and other constructed conveyances; (III)electronic, computer, and other automated systems; (IV)pumping, power, and other equipment; (V)use, storage, and handling of various chemicals; and (VI)operation and maintenance procedures; and (ii)the identification of procedures, countermeasures, and equipment that a treatment works may implement or use to reduce the vulnerabilities of the treatment works identified in a review described in clause (i). (b)

Grants for vulnerability assessments, site security plans, emergency response plans, security enhancements, alternative approaches, and technical assistance

(1)

In general

The Administrator may provide grants to a treatment works, State, municipality, or intermunicipal or interstate agency— (A)to conduct a vulnerability assessment of a treatment works; (B)to prepare and implement a site security plan; (C)to prepare an emergency response plan; (D)to implement security enhancements described in subsection (c) and other security enhancements to reduce vulnerabilities identified in a vulnerability assessment for treatment works that have— (i)completed a vulnerability assessment; (ii)complied with subsection (e); and (iii)received a certificate of approval from the Administrator under subsection (e)(2)(B); (E)to implement security enhancements described in subsection (c) and other security enhancements to reduce vulnerabilities identified in a vulnerability assessment for treatment works that do not meet the criteria described in subparagraph (D); (F)to implement alternative approaches at a treatment works, such as the use of an alternative treatment chemical, that would reduce the threat or consequences of a harmful intentional act; and (G)to obtain technical assistance in carrying out any of subparagraphs (A) through (F). (2)

Grant amounts

(A)

Federal share

The Federal share of the cost of an activity funded by a grant under paragraph (1) shall not exceed 55 percent, as determined by the Administrator. (B)

Maximum amount

The total amount of grants made under subparagraphs (A), (B), (C), (E), (F), and (G) of paragraph (1) for any treatment works shall not exceed $150,000, as determined by the Administrator, except in a case in which the Administrator determines that additional funds are appropriate, given the threat level and potential impact on human health, welfare, environment, critical infrastructure, and national security. (3)

Priority

The Administrator shall give— (A)priority for the provision of grants under this subsection to treatment works described in paragraph (1) that apply for grants under subsection (c); and (B)first priority for grants under subsection (c) to treatment works that have completed vulnerability assessments. (c)

Grants for security enhancements

(1)

Security enhancements

The Administrator may provide grants to the applicant under subparagraphs (D) and (E) of subsection (b)(1) for 1 or more of the uses described in paragraph (2). (2)

Uses of grant funds

The uses referred to in paragraph (1) are— (A)the purchase and installation of equipment for materials and activities relating to access control, intrusion prevention and delay, and detection of intruders and hazardous or dangerous substances, including— (i)barriers, fencing, and gates; (ii)security lighting and cameras; (iii)metal grates, wire mesh, and outfall entry barriers; (iv)securing of manhole covers and fill and vent pipes; (v)installation and rekeying of doors and locks; and (vi)smoke, chemical, and explosive mixture detection systems; (B)the conduct of activities to improve the security of electronic, computer, or other automated systems and remote security systems, including— (i)controlling access to those systems; (ii)intrusion detection and prevention; and (iii)system backup; and (C)participation in training programs, and the purchase of training manuals and guidance material, relating to security. (3)

Additional security enhancements

(A)

Grants

The Administrator may provide a grant under subsection (b) to an applicant for additional security enhancements not specified in paragraph (2). (B)

Eligibility

To be eligible for a grant under this subsection, an applicant shall— (i)submit to the Administrator an application containing a description of the security enhancement; (ii)as appropriate, submit the certificate of approval of the Administrator for the appropriate treatment works under subsection (e)(2)(B); and (iii)obtain approval of the application by the Administrator. (4)

Limitations

A grant provided under subsection (b) shall not be used for— (A)payment of personnel costs; or (B)operation or maintenance of facilities, equipment, or systems. (5)

Authorization of appropriations

(A)

In general

There are authorized to be appropriated to provide grants under subsection (b) $225,000,000, of which— (i)$25,000,000 shall be used for grants under subparagraphs (A), (B), and (C) of subsection (b)(1); (ii)$150,000,000 shall be used for grants under subparagraphs (D) and (F) of subsection (b)(1); (iii)$25,000,000 shall be used for grants under subsection (b)(1)(E); and (iv)$25,000,000 shall be used for grants under subsection (b)(1)(G). (B)

Availability

Amounts made available under this paragraph shall remain available until expended. (d)

Requirement

(1)

In general

Not later than 1 year after the date of enactment of this section, the Administrator shall promulgate regulations that require the owner or operator of each treatment works— (A)to conduct a vulnerability assessment for the treatment works; (B)to prepare and implement a site security plan for the treatment works that addresses the results of the vulnerability assessment; (C)to prepare an emergency response plan for the treatment works that addresses the results of the vulnerability assessment; and (D)to review and update the vulnerability assessment, site security plan, and emergency response plan. (2)

Regulations

Not later than 1 year after the date of enactment of this section, the Administrator shall promulgate regulations establishing procedures, protocols, and standards for vulnerability assessments, site security plans, and emergency response plans. (3)

Guidance to small entities

Not later than 1 year after the date of enactment of this section, the Administrator shall issue guidance to assist small entities in complying with paragraph (1) and regulations promulgated under that paragraph. (4)

Threat information

To the maximum extent practicable under applicable authority and in the interests of national security, the Administrator shall provide to each owner or operator of a treatment works required to prepare a vulnerability assessment, site security plan, and emergency response plan threat information that is relevant to the treatment works, including notification of any elevated threat with respect to the treatment works. (5)

Coordinated assessments and plans

The regulations promulgated under paragraph (1) shall permit the development and implementation of coordinated vulnerability assessments, site security plans, and emergency response plans in any case in which more than 1 treatment works is operating at a single location or at contiguous locations, including a case in which— (A)a treatment works is under the control of more than 1 owner or operator; or (B)a treatment works is operating with a community water system covered by sections 1433 through 1435 of the Safe Drinking Water Act (42 U.S.C. 300iq–2 through 300i–4), at a single location or at contiguous locations, including a case in which a treatment works is under the control of more than 1 owner or operator. (e)

Certification and submission

(1)

In general

Each owner or operator of a treatment works shall certify in writing to the Administrator that the owner or operator has, in accordance with this section (including regulations promulgated under this section)— (A)completed a vulnerability assessment; (B)prepared and implemented or is implementing a site security plan; and (C)prepared and implemented an emergency response plan. (2)

Submission

(A)

In general

Not later than 18 months after the date of promulgation of regulations under subsection (d)(1), an owner or operator of a treatment works shall provide to the Administrator for review copies of the vulnerability assessment, site security plan, and emergency response plan of the treatment works. (B)

Public certificate of approval

(i)

In general

Not later than 2 years after the date on which the Administrator receives the vulnerability assessment, site security plan, and emergency response plan of a treatment works under subparagraph (A), the Administrator shall determine whether the treatment works is in compliance with the requirements of this section (including paragraph (1) and regulations promulgated under this section). (ii)

Certificate

If the Administrator determines that the treatment works is in compliance with the requirements of this section (including paragraph (1) and regulations promulgated under this section), the Administrator shall provide to the treatment works and make available for public inspection a certificate of approval that contains the following statement (in which statement the first bracketed space shall include the name of the treatment works and the second bracketed space shall include the Public Law number assigned to this Act):

________ is in compliance with Public Law _______..

(iii)

Determination of noncompliance

If the Administrator determines under clause (i) that a treatment works is not in compliance with the requirements of this section (including paragraph (1) and regulations promulgated under this section), the Administrator may issue an order requiring the certification and submission of a vulnerability assessment, site security plan, or emergency response plan in accordance with this section. (iv)

Enforcement

If the Administrator determines under clause (i) that, after receiving an order from the Administrator requiring the certification and submission of a vulnerability assessment, site security plan, or emergency response plan in accordance with this section, a treatment works is not in compliance with the requirements of this section (including paragraph (1) and the regulations promulgated under this section), the Administrator may issue an order or file a civil action requiring the treatment works to comply with those requirements. (3)

Oversight

The Administrator shall, at such times and places as the Administrator determines to be appropriate, conduct or require the conduct or submission of vulnerability assessments, site security plans, emergency response plans, and other activities (including third-party audits) to ensure, to the maximum extent practicable, and evaluate compliance with this section (including paragraph (1) and regulations promulgated under this section). (f)

Protection of information

(1)

Disclosure exemption

Except with respect to any certification, description, or explanation referred to in subparagraph (C), (D), or (E), respectively, of subsection (a)(6) and certifications specified in subsection (e)(2)(B)(ii), all vulnerability assessments, site security plans, and emergency response plans obtained in accordance with this subtitle, all grant applications relating to vulnerability assessments and security enhancements (including grant applications submitted in accordance with regulations promulgated to carry out this section), and all information derived from those vulnerability assessments, site security plans, emergency response plans, and applications (including information shared with Federal, State, and local government entities), shall be exempt from disclosure under— (A)section 552 of title 5, United States Code; and (B)any State or local law providing for public access to information. (2)

Development of protocols

(A)

In general

The Administrator, in consultation with the Director of the Office of Management and Budget and appropriate Federal law enforcement and intelligence officials, and in a manner consistent with existing protections for sensitive or classified information, shall by regulation establish confidentiality protocols for maintenance and use of information that is obtained from owners or operators of treatment works and provided to the Administrator under this title. (B)

Requirements for protocols

A protocol established under subparagraph (A) shall ensure, to the maximum extent practicable, that— (i)each copy of a vulnerability assessment, site security plan, or emergency response plan submitted to the Administrator, all information contained in or derived from that assessment or plan, and other related information is maintained in a secure location; and (ii)except as provided in paragraph (1)(B), or as necessary for judicial enforcement, access to the copies of the vulnerability assessments, site security plans, and emergency response plans submitted to the Administrator, and other related information shall be limited to persons designated by the Administrator. (3)

Disclosure in civil proceedings

In any Federal or State civil or administrative proceeding in which a person seeks to compel the disclosure or the submission as evidence of sensitive information contained in the vulnerability assessments, site security plans, or emergency response plans required by subsection (a) or (b) and is not otherwise subject to disclosure under other provisions or law— (A)the information sought may be submitted to the court under seal; and (B)the court, or any other person, shall not disclose the information to any person until the court, in consultation with the Administrator, determines that the disclosure of the information does not pose a threat to public security or endanger the life or safety of any person. (4)

Penalties for unauthorized disclosure

(A)

In general

Except as provided in subparagraph (B), any person that is in possession of or acquires any information described in paragraph (2)(A) (including any reproduction of that information or any information derived from that information), and that knowingly or recklessly discloses the information— (i)shall be fined under chapter 227 of title 18, United States Code (applicable to class A misdemeanors); (ii)if the person is a Federal employee, shall be removed from Federal office or employment; and (iii)if the person is an organization (as defined in section 113(c)(5)(E) of the Clean Air Act (42 U.S.C. 7413(c)(5)(E)), shall be fined not more than $1,000,000. (B)

Exceptions

(i)

In general

Subparagraph (A) shall not apply to a person described in that subparagraph that discloses information described in paragraph (2)(A)— (I)to an individual designated by the Administrator under paragraph (2)(B)(ii); or (II)for use in any administrative or judicial proceeding to impose a penalty for failure to comply with requirements of this subtitle. (ii)

Law enforcement officials and first responders

Notwithstanding subparagraph (A), an individual referred to in paragraph (2)(B)(ii) who is an officer or employee of the United States may share with a State or local law enforcement or other official (including a first responder) the contents of a vulnerability assessment, emergency response plan, or site security plan, or other information described in that paragraph, to the extent disclosure is necessary to carry out this subtitle. (5)

No effect on other disclosure

Nothing in this subtitle affects the handling, treatment, or disclosure of information obtained from treatment works under any other law. (g)

Emergency powers

(1)

Definition of emergency threat

In this subsection, the term emergency threat means a threat of a harmful intentional act that could affect a treatment works— (A)that is beyond the scope of the site security plan as implemented at the treatment works; (B)the likelihood of the immediate occurrence of which is high; (C)the consequences of which would be severe; and (D)based on the factors described in subparagraphs (A) through (C), would not be appropriately and reasonably addressed, or addressed in a timely manner, by the Administrator under subsections (d) and (e). (2)

Initiation of action

(A)

In general

If the Administrator (in consultation with State and local law enforcement officials) determines that an emergency threat exists, the Administrator may bring a civil action in United States district court to immediately require each treatment works potentially affected by the new emergency threat to take such actions as are necessary to respond to the new emergency threat. (B)

Notice and participation

The Administrator shall provide to each treatment works that is the subject of a civil action under subparagraph (A)— (i)notice of any injunctive relief to compel compliance with this subsection that is being sought; and (ii)an opportunity to participate in any proceedings relating to the civil action. (3)

Emergency orders

(A)

In general

If the Administrator determines that it is not practicable to ensure prompt action to protect public safety from a new emergency threat by commencing a civil action under paragraph (2), the Administrator may issue such orders as are necessary to ensure public safety. (B)

Consultation

Before issuing an order under subparagraph (A), the Administrator shall— (i)attempt to confirm the accuracy of the information on which the action proposed to be taken is based; and (ii)consult with State and local law enforcement officials. (4)

Authorization of appropriations

There is authorized to be appropriated to carry out this subsection, $15,000,000, to remain available until expended. (h)

Technical assistance for small treatment works

(1)

Definition of small treatment works

In this subsection, the term small treatment works means a treatment works that serves a population of fewer than 10,000 individuals. (2)

Security assessment and planning assistance

(A)

In general

The Administrator, in coordination with the States, may provide technical guidance and assistance to small treatment works for— (i)the conduct of a vulnerability assessment; (ii)the preparation of an emergency response plan; (iii)the preparation and implementation of a site security plan; and (iv)the implementation of security enhancements to reduce vulnerabilities identified in a vulnerability assessment. (B)

Inclusions

Technical guidance and assistance provided under subparagraph (A) may include technical assistance programs, training, and preliminary engineering evaluations. (3)

Participation by nonprofit organizations

The Administrator may provide grants to nonprofit organizations to assist in accomplishing the purposes of this subsection. (4)

Authorization of appropriations

There is authorized to be appropriated to carry out this subsection, $1,000,000 for each of fiscal years 2006 through 2010, to remain available until expended. (i)

Refinement of vulnerability assessment methodology for publicly owned treatment works

(1)

Grants

The Administrator may provide to nonprofit organizations 1 or more grants to be used in improving vulnerability assessment methodologies and tools for publicly owned treatment works, including publicly owned treatment works that are part of a combined public wastewater treatment and water supply system. (2)

Eligible activities

A grant provided under this subsection may be used— (A)to develop and distribute vulnerability self-assessment methodology software upgrades; (B)to improve and enhance critical technical and user support functions; (C)to expand libraries of information addressing threats and countermeasures; and (D)to implement user training initiatives. (3)

Cost

A service described in paragraph (2) that is funded by a grant under this subsection shall be provided at no cost to the recipients of the service. (4)

Authorization of appropriations

There is authorized to be appropriated to carry out this subsection, $1,000,000 for each of fiscal years 2006 through 2010, to remain available until expended. (j)

Designation and regulation of additional substances of concern by the administrator relating to wastewater treatment works

(1)

In general

Not later than 1 year after the date of enactment of this section, the Administrator, in consultation with Federal, State, and local agencies responsible for planning for and responding to unauthorized releases and providing emergency health care, may promulgate regulations to designate certain additional substances of concern based on the severity of the threat posed by an unauthorized release from the treatment works. (2)

Factors to be considered

In designating additional substances of concern under paragraph (1), the Administrator shall consider, with respect to the substance under consideration— (A)the severity of the harm that could be caused by an unauthorized release; (B)proximity to population centers; (C)threats to national security; (D)threats to critical infrastructure; (E)threshold quantities that pose a serious threat; and (F)such other safety or security factors as the Administrator determines to be appropriate. (3)

Review and revisions

Not later than 5 years after the date of promulgation of regulations under paragraph (1), the Administrator shall review the regulations and make any necessary revisions.