[Congressional Bills 111th Congress]
[From the U.S. Government Publishing Office]
[H.R. 3258 Reported in House (RH)]

                                                 Union Calendar No. 179
111th CONGRESS
  1st Session
                                H. R. 3258

                          [Report No. 111-313]

  To amend the Safe Drinking Water Act to enhance the security of the 
               public water systems of the United States.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                             July 20, 2009

Mr. Waxman (for himself, Mr. Markey of Massachusetts, Mr. Pallone, Mrs. 
Capps, Mr. Sarbanes, and Ms. Schakowsky) introduced the following bill; 
       which was referred to the Committee on Energy and Commerce

                            October 23, 2009

  Additional sponsors: Ms. Shea-Porter, Mr. Hinchey, Mr. Cohen, Mrs. 
                        Maloney, and Mr. Berman

                            October 23, 2009

  Reported with an amendment, committed to the Committee of the Whole 
       House on the State of the Union, and ordered to be printed
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]
 [For text of introduced bill, see copy of bill as introduced on July 
                               20, 2009]

_______________________________________________________________________

                                 A BILL


 
  To amend the Safe Drinking Water Act to enhance the security of the 
               public water systems of the United States.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Drinking Water System Security Act 
of 2009''.

SEC. 2. INTENTIONAL ACTS AFFECTING THE SECURITY OF COVERED WATER 
              SYSTEMS.

    (a) Amendment of Safe Drinking Water Act.--Section 1433 of the Safe 
Drinking Water Act (42 U.S.C. 300i-2) is amended to read as follows:

``SEC. 1433. INTENTIONAL ACTS.

    ``(a) Risk-based Performance Standards; Vulnerability Assessments; 
Site Security Plans; Emergency Response Plans.--
            ``(1) In general.--The Administrator shall issue 
        regulations--
                    ``(A) establishing risk-based performance standards 
                for the security of covered water systems; and
                    ``(B) establishing requirements and deadlines for 
                each covered water system--
                            ``(i) to conduct a vulnerability assessment 
                        or, if the system already has a vulnerability 
                        assessment, to revise the assessment to be in 
                        accordance with this section;
                            ``(ii) to update the vulnerability 
                        assessment not less than every 5 years and 
                        promptly after any change at the system that 
                        could cause the reassignment of the system to a 
                        different risk-based tier under subsection (d);
                            ``(iii) to develop, implement, and, as 
                        appropriate, revise a site security plan not 
                        less than every 5 years and promptly after a 
                        revision to the vulnerability assessment;
                            ``(iv) to develop an emergency response 
                        plan (or, if the system has already developed 
                        an emergency response plan, to revise the plan 
                        to be in accordance with this section) and 
                        revise the plan not less than every 5 years 
                        thereafter; and
                            ``(v) to provide annual training to 
                        employees and contractor employees of covered 
                        water systems on implementing site security 
                        plans and emergency response plans.
            ``(2) Covered water systems.--For purposes of this section, 
        the term `covered water system' means a public water system 
        that--
                    ``(A) is a community water system serving a 
                population greater than 3,300; or
                    ``(B) in the discretion of the Administrator, 
                presents a security risk making regulation under this 
                section appropriate.
            ``(3) Consultation with state authorities.--In developing 
        and carrying out the regulations under paragraph (1), the 
        Administrator shall consult with States exercising primary 
        enforcement responsibility for public water systems.
            ``(4) Consultation with other persons.--In developing and 
        carrying out the regulations under paragraph (1), the 
        Administrator shall consult with the Secretary of Homeland 
        Security, and, as appropriate, other persons regarding--
                    ``(A) provision of threat-related and other 
                baseline information to covered water systems;
                    ``(B) designation of substances of concern;
                    ``(C) development of risk-based performance 
                standards;
                    ``(D) establishment of risk-based tiers and process 
                for the assignment of covered water systems to risk-
                based tiers;
                    ``(E) process for the development and evaluation of 
                vulnerability assessments, site security plans, and 
                emergency response plans;
                    ``(F) treatment of protected information;
                    ``(G) security at co-managed drinking water and 
                wastewater facilities; and
                    ``(H) such other matters as the Administrator 
                determines necessary.
            ``(5) Substances of concern.--For purposes of this section, 
        the Administrator, in consultation with the Secretary of 
        Homeland Security--
                    ``(A) may designate any chemical substance as a 
                substance of concern;
                    ``(B) at the time any substance is designated 
                pursuant to subparagraph (A), shall establish by rule a 
                threshold quantity for the release or theft of the 
                substance, taking into account the toxicity, 
                reactivity, volatility, dispersability, combustibility, 
                and flammability of the substance and the amount of the 
                substance that, as a result of a release, is known to 
                cause or may be reasonably anticipated to cause death, 
                injury, or serious adverse effects to human health or 
                the environment; and
                    ``(C) in making such a designation, shall take into 
                account appendix A to part 27 of title 6, Code of 
                Federal Regulations (or any successor regulations).
            ``(6) Baseline information.--The Administrator, after 
        consultation with appropriate departments and agencies of the 
        Federal Government and with State, local, and tribal 
        governments, shall, for purposes of facilitating compliance 
        with the requirements of this section, promptly after the 
        effective date of the regulations under subsection (a)(1) and 
        as appropriate thereafter, provide baseline information to 
        covered water systems regarding which kinds of intentional acts 
        are the probable threats to--
                    ``(A) substantially disrupt the ability of the 
                system to provide a safe and reliable supply of 
                drinking water;
                    ``(B) cause the release of a substance of concern 
                at the covered water system; or
                    ``(C) cause the theft, misuse, or misappropriation 
                of a substance of concern.
    ``(b) Risk-Based Performance Standards.--The regulations under 
subsection (a)(1) shall set forth risk-based performance standards for 
site security plans required by this section. The standards shall be 
separate and, as appropriate, increasingly stringent based on the level 
of risk associated with the covered water system's risk-based tier 
assignment under subsection (d). In developing such standards, the 
Administrator shall take into account section 27.230 of title 6, Code 
of Federal Regulations (or any successor regulations).
    ``(c) Vulnerability Assessment.--The regulations under subsection 
(a)(1) shall require each covered water system to assess the system's 
vulnerability to a range of intentional acts, including an intentional 
act that results in a release of a substance of concern that is known 
to cause or may be reasonably anticipated to cause death, injury, or 
serious adverse effects to human health or the environment. At a 
minimum, the vulnerability assessment shall include a review of--
            ``(1) pipes and constructed conveyances;
            ``(2) physical barriers;
            ``(3) water collection, pretreatment, treatment, storage, 
        and distribution facilities, including fire hydrants;
            ``(4) electronic, computer, and other automated systems 
        that are used by the covered water system;
            ``(5) the use, storage, or handling of various chemicals, 
        including substances of concern;
            ``(6) the operation and maintenance of the covered water 
        system; and
            ``(7) the covered water system's resiliency and ability to 
        ensure continuity of operations in the event of a disruption 
        caused by an intentional act.
    ``(d) Risk-Based Tiers.--The regulations under subsection (a)(1) 
shall provide for 4 risk-based tiers applicable to covered water 
systems, with tier one representing the highest degree of security 
risk.
            ``(1) Assignment of risk-based tiers.--
                    ``(A) Submission of information.--The Administrator 
                may require a covered water system to submit 
                information in order to determine the appropriate risk-
                based tier for the covered water system.
                    ``(B) Factors to consider.--The Administrator shall 
                assign (and reassign when appropriate) each covered 
                water system to one of the risk-based tiers established 
                pursuant to this subsection. In assigning a covered 
                water system to a risk-based tier, the Administrator 
                shall consider the potential consequences (such as 
                death, injury, or serious adverse effects to human 
                health, the environment, critical infrastructure, 
                national security, and the national economy) from--
                            ``(i) an intentional act to cause a 
                        release, including a worst-case release, of a 
                        substance of concern at the covered water 
                        system;
                            ``(ii) an intentional act to introduce a 
                        contaminant into the drinking water supply or 
                        disrupt the safe and reliable supply of 
                        drinking water; and
                            ``(iii) an intentional act to steal, 
                        misappropriate, or misuse substances of 
                        concern.
            ``(2) Explanation for risk-based tier assignment.--The 
        Administrator shall provide each covered water system assigned 
        to a risk-based tier with the reasons for the tier assignment 
        and whether such system is required to submit an assessment 
        under subsection (g)(2).
    ``(e) Development and Implementation of Site Security Plans.--The 
regulations under subsection (a)(1) shall permit each covered water 
system, in developing and implementing its site security plan required 
by this section, to select layered security and preparedness measures 
that, in combination, appropriately--
            ``(1) address the security risks identified in its 
        vulnerability assessment; and
            ``(2) comply with the applicable risk-based performance 
        standards required under this section.
    ``(f) Role of Employees.--
            ``(1) Description of role.--Site security plans and 
        emergency response plans required under this section shall 
        describe the appropriate roles or responsibilities that 
        employees and contractor employees are expected to perform to 
        deter or respond to the intentional acts described in 
        subsection (d)(1)(B).
            ``(2) Training for employees.--Each covered water system 
        shall annually provide employees and contractor employees with 
        roles or responsibilities described in paragraph (1) with a 
        minimum of 8 hours of training on carrying out those roles or 
        responsibilities.
            ``(3) Employee participation.--In developing, revising, or 
        updating a vulnerability assessment, site security plan, and 
        emergency response plan required under this section, a covered 
        water system shall include--
                    ``(A) at least one supervisory and at least one 
                non-supervisory employee of the covered water system; 
                and
                    ``(B) at least one representative of each certified 
                or recognized bargaining agent representing facility 
                employees or contractor employees with roles or 
                responsibilities described in paragraph (1), if any, in 
                a collective bargaining relationship with the private 
                or public owner or operator of the system or with a 
                contractor to that system.  
    ``(g) Methods To Reduce the Consequences of a Chemical Release From 
an Intentional Act.--
            ``(1) Definition.--In this section, the term `method to 
        reduce the consequences of a chemical release from an 
        intentional act' means a measure at a covered water system that 
        reduces or eliminates the potential consequences of a release 
        of a substance of concern from an intentional act such as--
                    ``(A) the elimination or reduction in the amount of 
                a substance of concern possessed or planned to be 
                possessed by a covered water system through the use of 
                alternate substances, formulations, or processes;
                    ``(B) the modification of pressures, temperatures, 
                or concentrations of a substance of concern; and
                    ``(C) the reduction or elimination of onsite 
                handling of a substance of concern through improvement 
                of inventory control or chemical use efficiency.
            ``(2) Assessment.--For each covered water system that 
        possesses or plans to possess a substance of concern in excess 
        of the release threshold quantity set by the Administrator 
        under subsection (a)(5), the regulations under subsection 
        (a)(1) shall require the covered water system to include in its 
        site security plan an assessment of methods to reduce the 
        consequences of a chemical release from an intentional act at 
        the covered water system. The covered water system shall 
        provide such assessment to the Administrator and the State 
        exercising primary enforcement responsibility for the covered 
        water system, if any. The regulations under subsection (a)(1) 
        shall require the system, in preparing the assessment, to 
        consider factors appropriate to the system's security, public 
        health, or environmental mission, and include--
                    ``(A) a description of the methods to reduce the 
                consequences of a chemical release from an intentional 
                act;
                    ``(B) how each described method to reduce the 
                consequences of a chemical release from an intentional 
                act could, if applied, reduce the potential extent of 
                death, injury, or serious adverse effects to human 
                health resulting from a chemical release;
                    ``(C) how each described method to reduce the 
                consequences of a chemical release from an intentional 
                act could, if applied, affect the presence of 
                contaminants in treated water, human health, or the 
                environment;
                    ``(D) whether each described method to reduce the 
                consequences of a chemical release from an intentional 
                act at the covered water system is feasible, as defined 
                in section 1412(b)(4)(D), but not including cost 
                calculations under subparagraph (E);
                    ``(E) the costs (including capital and operational 
                costs) and avoided costs (including savings and 
                liabilities) associated with applying each described 
                method to reduce the consequences of a chemical release 
                from an intentional act at the covered water system;
                    ``(F) any other relevant information that the 
                covered water system relied on in conducting the 
                assessment; and
                    ``(G) a statement of whether the covered water 
                system has implemented or plans to implement one or 
                more methods to reduce the consequences of a chemical 
                release from an intentional act, a description of any 
                such methods, and, in the case of a covered water 
                system described in paragraph (3)(A), an explanation of 
                the reasons for any decision not to implement any such 
                methods.
            ``(3) Required methods.--
                    ``(A) Application.--This paragraph applies to a 
                covered water system--
                            ``(i) that is assigned to one of the two 
                        highest risk-based tiers under subsection (d); 
                        and
                            ``(ii) that possesses or plans to possess a 
                        substance of concern in excess of the release 
                        threshold quantity set by the Administrator 
                        under subsection (a)(5).
                    ``(B) Highest-risk systems.--If, on the basis of 
                its assessment under paragraph (2), a covered water 
                system described in subparagraph (A) decides not to 
                implement methods to reduce the consequences of a 
                chemical release from an intentional act, the State 
                exercising primary enforcement responsibility for the 
                covered water system, if the system is located in such 
                a State, or the Administrator, if the covered water 
                system is not located in such a State, shall, in 
                accordance with a timeline set by the Administrator--
                            ``(i) determine whether to require the 
                        covered water system to implement the methods; 
                        and
                            ``(ii) for States exercising primary 
                        enforcement responsibility, report such 
                        determination to the Administrator.
                    ``(C) State or administrator's considerations.--
                Before requiring, pursuant to subparagraph (B), the 
                implementation of a method to reduce the consequences 
                of a chemical release from an intentional act, the 
                State exercising primary enforcement responsibility for 
                the covered water system, if the system is located in 
                such a State, or the Administrator, if the covered 
                water system is not located in such a State, shall 
                consider factors appropriate to the security, public 
                health, and environmental missions of covered water 
                systems, including an examination of whether the 
                method--
                            ``(i) would significantly reduce the risk 
                        of death, injury, or serious adverse effects to 
                        human health resulting directly from a chemical 
                        release from an intentional act at the covered 
                        water system;
                            ``(ii) would not increase the interim 
                        storage of a substance of concern by the 
                        covered water system;
                            ``(iii) would not render the covered water 
                        system unable to comply with other requirements 
                        of this Act or drinking water standards 
                        established by the State or political 
                        subdivision in which the system is located; and
                            ``(iv) is feasible, as defined in section 
                        1412(b)(4)(D), to be incorporated into the 
                        operation of the covered water system.
                    ``(D) Appeal.--Before requiring, pursuant to 
                subparagraph (B), the implementation of a method to 
                reduce the consequences of a chemical release from an 
                intentional act, the State exercising primary 
                enforcement responsibility for the covered water 
                system, if the system is located in such a State, or 
                the Administrator, if the covered water system is not 
                located in such a State, shall provide such covered 
                water system an opportunity to appeal the determination 
                to require such implementation made pursuant to 
                subparagraph (B) by such State or the Administrator.
            ``(4) Incomplete or late assessments.--
                    ``(A) Incomplete assessments.--If the Administrator 
                finds that the covered water system, in conducting its 
                assessment under paragraph (2), did not meet the 
                requirements of paragraph (2) and the applicable 
                regulations, the Administrator shall, after notifying 
                the covered water system and the State exercising 
                primary enforcement responsibility for that system, if 
                any, require the covered water system to submit a 
                revised assessment not later than 60 days after the 
                Administrator notifies such system. The Administrator 
                may require such additional revisions as are necessary 
                to ensure that the system meets the requirements of 
                paragraph (2) and the applicable regulations.
                    ``(B) Late assessments.--If the Administrator finds 
                that a covered water system, in conducting its 
                assessment pursuant to paragraph (2), did not complete 
                such assessment in accordance with the deadline set by 
                the Administrator, the Administrator may, after 
                notifying the covered water system and the State 
                exercising primary enforcement responsibility for that 
                system, if any, take appropriate enforcement action 
                under subsection (o).
                    ``(C) Review.--The State exercising primary 
                enforcement responsibility for the covered water 
                system, if the system is located in such a State, or 
                the Administrator, if the system is not located in such 
                a State, shall review a revised assessment that meets 
                the requirements of paragraph (2) and applicable 
                regulations to determine whether the covered water 
                system will be required to implement methods to reduce 
                the consequences of an intentional act pursuant to 
                paragraph (3).
            ``(5) Enforcement.--
                    ``(A) Failure by state to make determination.--
                Whenever the Administrator finds that a State 
                exercising primary enforcement responsibility for a 
                covered water system has failed to determine whether to 
                require the covered water system to implement methods 
                to reduce the consequences of a chemical release from 
                an intentional act, as required by paragraph (3)(B), 
                the Administrator shall so notify the State and covered 
                water system. If, beyond the thirtieth day after the 
                Administrator's notification under the preceding 
                sentence, the State has failed to make the 
                determination described in such sentence, the 
                Administrator shall so notify the State and covered 
                water system and shall determine whether to require the 
                covered water system to implement methods to reduce the 
                consequences of a chemical release from an intentional 
                act based on the factors described in paragraph (3)(C).
                    ``(B) Failure by state to bring enforcement 
                action.--If the Administrator finds, with respect to a 
                period in which a State has primary enforcement 
                responsibility for a covered water system, that the 
                system has failed to implement methods to reduce the 
                consequences of a chemical release from an intentional 
                act (as required by the State or the Administrator 
                under paragraph (3)(B) or the Administrator under 
                subparagraph (A)), the Administrator shall so notify 
                the State and the covered water system. If, beyond the 
                thirtieth day after the Administrator's notification 
                under the preceding sentence, the State has not 
                commenced appropriate enforcement action, the 
                Administrator shall so notify the State and may 
                commence an enforcement action against the system, 
                including by seeking or imposing civil penalties under 
                subsection (o), to require implementation of such 
                methods.
                    ``(C) Consideration of continued primary 
                enforcement responsibility.--For a State with primary 
                enforcement responsibility for a covered water system, 
                the Administrator may consider the failure of such 
                State to make a determination as described under 
                subparagraph (A) or to bring enforcement action as 
                described under subparagraph (B) when determining 
                whether a State may retain primary enforcement 
                responsibility under this Act.
            ``(6) Guidance for covered water systems assigned to tier 3 
        and tier 4.--For covered water systems required to conduct an 
        assessment under paragraph (2) and assigned by the 
        Administrator to tier 3 or tier 4 under subsection (d), the 
        Administrator shall issue guidance and, as appropriate, provide 
        or recommend tools, methodologies, or computer software, to 
        assist such covered water systems in complying with the 
        requirements of this section.
    ``(h) Review by Administrator.--
            ``(1) In general.--The regulations under subsection (a)(1) 
        shall require each covered water system to submit its 
        vulnerability assessment and site security plan to the 
        Administrator for review according to deadlines set by the 
        Administrator. The Administrator shall review each 
        vulnerability assessment and site security plan submitted under 
        this section and--
                    ``(A) if the assessment or plan has any significant 
                deficiency described in paragraph (2), require the 
                covered water system to correct the deficiency; or
                    ``(B) approve such assessment or plan.
            ``(2) Significant deficiencies.--A vulnerability assessment 
        or site security plan of a covered water system has a 
        significant deficiency under this subsection if the 
        Administrator, in consultation, as appropriate, with the State 
        exercising primary enforcement responsibility for such system, 
        if any, determines that--
                    ``(A) such assessment does not comply with the 
                regulations established under section (a)(1); or
                    ``(B) such plan--
                            ``(i) fails to address vulnerabilities 
                        identified in a vulnerability assessment; or
                            ``(ii) fails to meet applicable risk-based 
                        performance standards.     
            ``(3) State, regional, or local governmental entities.--No 
        covered water system shall be required under State, local, or 
        tribal law to provide a vulnerability assessment or site 
        security plan described in this section to any State, regional, 
        local, or tribal governmental entity solely by reason of the 
        requirement set forth in paragraph (1) that the system submit 
        such an assessment and plan to the Administrator.
    ``(i) Emergency Response Plan.--
            ``(1) In general.--Each covered water system shall prepare 
        or revise, as appropriate, an emergency response plan that 
        incorporates the results of the system's most current 
        vulnerability assessment and site security plan.
            ``(2) Certification.--Each covered water system shall 
        certify to the Administrator that the system has completed an 
        emergency response plan. The system shall submit such 
        certification to the Administrator not later than 6 months 
        after the system's first completion or revision of a 
        vulnerability assessment under this section and shall submit an 
        additional certification following any update of the emergency 
        response plan.
            ``(3) Contents.--A covered water system's emergency 
        response plan shall include--
                    ``(A) plans, procedures, and identification of 
                equipment that can be implemented or used in the event 
                of an intentional act at the covered water system; and
                    ``(B) actions, procedures, and identification of 
                equipment that can obviate or significantly lessen the 
                impact of intentional acts on public health and the 
                safety and supply of drinking water provided to 
                communities and individuals.
            ``(4) Coordination.--As part of its emergency response 
        plan, each covered water system shall provide appropriate 
        information to any local emergency planning committee, local 
        law enforcement officials, and local emergency response 
        providers to ensure an effective, collective response.
    ``(j) Maintenance of Records.--Each covered water system shall 
maintain an updated copy of its vulnerability assessment, site security 
plan, and emergency response plan.
    ``(k) Audit; Inspection.--
            ``(1) In general.--Notwithstanding section 1445(b)(2), the 
        Administrator, or duly designated representatives of the 
        Administrator, shall audit and inspect covered water systems, 
        as necessary, for purposes of determining compliance with this 
        section.
            ``(2) Access.--In conducting an audit or inspection of a 
        covered water system, the Administrator or duly designated 
        representatives of the Administrator, as appropriate, shall 
        have access to the owners, operators, employees and contractor 
        employees, and employee representatives, if any, of such 
        covered water system.
            ``(3) Confidential communication of information; aiding 
        inspections.--The Administrator, or a duly designated 
        representative of the Administrator, shall offer non-
        supervisory employees of a covered water system the opportunity 
        confidentially to communicate information relevant to the 
        employer's compliance or noncompliance with this section, 
        including compliance or noncompliance with any regulation or 
        requirement adopted by the Administrator in furtherance of the 
        purposes of this section. A representative of each certified or 
        recognized bargaining agent described in subsection (f)(3)(B), 
        if any, or, if none, a non-supervisory employee, shall be given 
        an opportunity to accompany the Administrator, or the duly 
        designated representative of the Administrator, during the 
        physical inspection of any covered water system for the purpose 
        of aiding such inspection, if representatives of the covered 
        water system will also be accompanying the Administrator or the 
        duly designated representative of the Administrator on such 
        inspection.
    ``(l) Protection of Information.--
            ``(1) Prohibition of public disclosure of protected 
        information.--Protected information shall--
                    ``(A) be exempt from disclosure under section 552 
                of title 5, United States Code; and
                    ``(B) not be made available pursuant to any State, 
                local, or tribal law requiring disclosure of 
                information or records.
            ``(2) Information sharing.--
                    ``(A) In general.--The Administrator shall 
                prescribe such regulations, and may issue such orders, 
                as necessary to prohibit the unauthorized disclosure of 
                protected information, as described in paragraph (7).
                    ``(B) Sharing of protected information.--The 
                regulations under subparagraph (A) shall provide 
                standards for and facilitate the appropriate sharing of 
                protected information with and between Federal, State, 
                local, and tribal authorities, first responders, law 
                enforcement officials, designated supervisory and non-
                supervisory covered water system personnel with 
                security, operational, or fiduciary responsibility for 
                the system, and designated facility employee 
                representatives, if any. Such standards shall include 
                procedures for the sharing of all portions of a covered 
                water system's vulnerability assessment and site 
                security plan relating to the roles and 
                responsibilities of system employees or contractor 
                employees under subsection (f)(1) with a representative 
                of each certified or recognized bargaining agent 
                representing such employees, if any, or, if none, with 
                at least one supervisory and at least one non-
                supervisory employee with roles and responsibilities 
                under subsection (f)(1).
                    ``(C) Penalties.--Protected information, as 
                described in paragraph (7), shall not be shared except 
                in accordance with the standards provided by the 
                regulations under subparagraph (A). Any person who 
                purposefully publishes, divulges, discloses, or makes 
                known protected information in any manner or to any 
                extent not authorized by the standards provided by the 
                regulations under subparagraph (A), shall, upon 
                conviction, be imprisoned for not more than one year or 
                fined in accordance with the provisions of chapter 227 
                of title 18, United States Code, applicable to class A 
                misdemeanors, or both, and, in the case of Federal 
                employees or officeholders, shall be removed from 
                Federal office or employment.
            ``(3) Treatment of information in adjudicative 
        proceedings.--In any judicial or administrative proceeding, 
        protected information, as described in paragraph (7), shall be 
        treated in a manner consistent with the treatment of Sensitive 
        Security Information under section 525 of the Department of 
        Homeland Security Appropriations Act, 2007 (Public Law 109-295; 
        120 Stat. 1381).
            ``(4) Other obligations unaffected.--Except as provided in 
        subsection (h)(3), nothing in this section amends or affects an 
        obligation of a covered water system--
                    ``(A) to submit or make available information to 
                system employees, employee organizations, or a Federal, 
                State, tribal, or local government agency under any 
                other law; or
                    ``(B) to comply with any other law.
            ``(5) Congressional oversight.--Nothing in this section 
        permits or authorizes the withholding of information from 
        Congress or any committee or subcommittee thereof.
            ``(6) Disclosure of independently furnished information.--
        Nothing in this section amends or affects any authority or 
        obligation of a Federal, State, local, or tribal agency to 
        protect or disclose any record or information that the Federal, 
        State, local, or tribal agency obtains from a covered water 
        system or the Administrator under any other law.
            ``(7) Protected information.--
                    ``(A) In general.--For purposes of this section, 
                protected information is any of the following:
                            ``(i) Vulnerability assessments and site 
                        security plans under this section, including 
                        any assessment developed pursuant to subsection 
                        (g)(2).
                            ``(ii) Documents directly related to the 
                        Administrator's review of assessments and plans 
                        described in clause (i) and, as applicable, the 
                        State's review of an assessment prepared under 
                        subsection (g)(2).
                            ``(iii) Documents directly related to 
                        inspections and audits under this section.
                            ``(iv) Orders, notices, or letters 
                        regarding the compliance of a covered water 
                        system with the requirements of this section.
                            ``(v) Information required to be provided 
                        to, or documents and records created by, the 
                        Administrator under subsection (d).
                            ``(vi) Documents directly related to 
                        security drills and training exercises, 
                        security threats and breaches of security, and 
                        maintenance, calibration, and testing of 
                        security equipment.
                            ``(vii) Other information, documents, and 
                        records developed exclusively for the purposes 
                        of this section that the Administrator 
                        determines would be detrimental to the security 
                        of one or more covered water systems if 
                        disclosed.
                    ``(B) Detriment requirement.--For purposes of 
                clauses (ii), (iii), (iv), (v), and (vi) of 
                subparagraph (A), the only portions of documents, 
                records, orders, notices, and letters that shall be 
                considered protected information are those portions 
                that--
                            ``(i) would be detrimental to the security 
                        of one or more covered water systems if 
                        disclosed; and
                            ``(ii) are developed by the Administrator, 
                        the State, or the covered water system for the 
                        purposes of this section.
                    ``(C) Exclusions.--For purposes of this section, 
                protected information does not include--
                            ``(i) information that is otherwise 
                        publicly available, including information that 
                        is required to be made publicly available under 
                        any law;
                            ``(ii) information that a covered water 
                        system has lawfully disclosed other than in 
                        accordance with this section; and
                            ``(iii) information that, if disclosed, 
                        would not be detrimental to the security of one 
                        or more covered water systems, including 
                        aggregate regulatory data that the 
                        Administrator determines appropriate to 
                        describe system compliance with the 
                        requirements of this section and the 
                        Administrator's implementation of such 
                        requirements.
    ``(m) Relation to Chemical Facility Security Requirements.--The 
following provisions (and any regulations promulgated thereunder) shall 
not apply to any public water system subject to this Act:
            ``(1) Title XXI of the Homeland Security Act of 2002 (as 
        proposed to be added by H.R. 2868, the Chemical Facility Anti-
        Terrorism Act of 2009).
            ``(2) Section 550 of the Department of Homeland Security 
        Appropriations Act, 2007 (Public Law 109-295).
            ``(3) The Chemical Facility Anti-Terrorism Act of 2009.
    ``(n) Preemption.--This section does not preclude or deny the right 
of any State or political subdivision thereof to adopt or enforce any 
regulation, requirement, or standard of performance with respect to a 
covered water system that is more stringent than a regulation, 
requirement, or standard of performance under this section.
    ``(o) Violations.--
            ``(1) In general.--A covered water system that violates any 
        requirement of this section, including by not implementing all 
        or part of its site security plan by such date as the 
        Administrator requires, shall be liable for a civil penalty of 
        not more than $25,000 for each day on which  the violation 
        occurs.
            ``(2) Procedure.--When the Administrator determines that a 
        covered water system is subject to a civil penalty under 
        paragraph (1), the Administrator, after consultation with the 
        State, for covered water systems located in a State exercising 
        primary responsibility for the covered water system, and, after 
        considering the severity of the violation or deficiency and the 
        record of the covered water system in carrying out the 
        requirements of this section, may--
                    ``(A) after notice and an opportunity for the 
                covered water system to be heard, issue an order 
                assessing a civil penalty under such paragraph for any 
                past or current violation, requiring compliance 
                immediately or within a specified time period; or
                    ``(B) commence a civil action in the United States 
                district court in the district in which the violation 
                occurred for appropriate relief, including temporary or 
                permanent injunction.
            ``(3) Methods to reduce the consequences of a chemical 
        release from an intentional act.--Except as provided in 
        subsections (g)(4) and (g)(5), if a covered water system is 
        located in a State exercising primary enforcement 
        responsibility for the system, the Administrator may not issue 
        an order or commence a civil action under this section for any 
        deficiency in the content or implementation of the portion of 
        the system's site security plan relating to methods to reduce 
        the consequences of a chemical release from an intentional act 
        (as defined in subsection (g)(1)).
    ``(p) Report to Congress.--
            ``(1) Periodic report.--Not later than 3 years after the 
        effective date of the regulations under subsection (a)(1), and 
        every 3 years thereafter, the Administrator shall transmit to 
        the Committee on Energy and Commerce of the House of 
        Representatives and the Committee on Environment and Public 
        Works of the Senate a report on progress in achieving 
        compliance with this section. Each such report shall include, 
        at a minimum, the following:
                    ``(A) A generalized summary of measures implemented 
                by covered water systems in order to meet each risk-
                based performance standard established by this section.
                    ``(B) A summary of how the covered water systems, 
                differentiated by risk-based tier assignment, are 
                complying with the requirements of this section during 
                the period covered by the report and how the 
                Administrator is implementing and enforcing such 
                requirements during such period including--
                            ``(i) the number of public water systems 
                        that provided the Administrator with 
                        information pursuant to subsection (d)(1);
                            ``(ii) the number of covered water systems 
                        assigned to each risk-based tier;
                            ``(iii) the number of vulnerability 
                        assessments and site security plans submitted 
                        by covered water systems;
                            ``(iv) the number of vulnerability 
                        assessments and site security plans approved 
                        and disapproved by the Administrator;
                            ``(v) the number of covered water systems 
                        without approved vulnerability assessments or 
                        site security plans;
                            ``(vi) the number of covered water systems 
                        that have been assigned to a different risk-
                        based tier due to implementation of a method to 
                        reduce the consequences of a chemical release 
                        from an intentional act and a description of 
                        the types of such implemented methods;
                            ``(vii) the number of audits and 
                        inspections conducted by the Administrator or 
                        duly designated representatives of the 
                        Administrator;
                            ``(viii) the number of orders for 
                        compliance issued by the Administrator;
                            ``(ix) the administrative penalties 
                        assessed by the Administrator for non-
                        compliance with the requirements of this 
                        section;
                            ``(x) the civil penalties assessed by 
                        courts for non-compliance with the requirements 
                        of this section; and
                            ``(xi) any other regulatory data the 
                        Administrator determines appropriate to 
                        describe covered water system compliance with 
                        the requirements of this section and the 
                        Administrator's implementation of such 
                        requirements.
            ``(2) Public availability.--A report submitted under this 
        section shall be made publicly available.
    ``(q) Grant Programs.--
            ``(1) Implementation grants to states.--The Administrator 
        may award grants to, or enter into cooperative agreements with, 
        States, based on an allocation formula established by the 
        Administrator, to assist the States in implementing this 
        section.
            ``(2) Research, training, and technical assistance 
        grants.--The Administrator may award grants to, or enter into 
        cooperative agreements with, non-profit organizations to 
        provide research, training, and technical assistance to covered 
        water systems to assist them in carrying out their 
        responsibilities under this section.
            ``(3) Preparation grants.--
                    ``(A) Grants.--The Administrator may award grants 
                to, or enter into cooperative agreements with, covered 
                water systems to assist such systems in--
                            ``(i) preparing and updating vulnerability 
                        assessments, site security plans, and emergency 
                        response plans;
                            ``(ii) assessing and implementing methods 
                        to reduce the consequences of a release of a 
                        substance of concern from an intentional act; 
                        and
                            ``(iii) implementing any other security 
                        reviews and enhancements necessary to comply 
                        with this section.
                    ``(B) Priority.--
                            ``(i) Need.--The Administrator, in awarding 
                        grants or entering into cooperative agreements 
                        for purposes described in subparagraph (A)(i), 
                        shall give priority to covered water systems 
                        that have the greatest need.
                            ``(ii) Security risk.--The Administrator, 
                        in awarding grants or entering into cooperative 
                        agreements for purposes described in 
                        subparagraph (A)(ii), shall give priority to 
                        covered water systems that pose the greatest 
                        security risk.
            ``(4) Worker training grants program authority.--
                    ``(A) In general.--The Administrator shall 
                establish a grant program to award grants to eligible 
                entities to provide for training and education of 
                employees and contractor employees with roles or 
                responsibilities described in subsection (f)(1) and 
                first responders and emergency response providers who 
                would respond to an intentional act at a covered water 
                system.
                    ``(B) Administration.--The Administrator shall 
                enter into an agreement with the National Institute of 
                Environmental Health Sciences to make and administer 
                grants under this paragraph.
                    ``(C) Use of funds.--The recipient of a grant under 
                this paragraph shall use the grant to provide for--
                            ``(i) training and education of employees 
                        and contractor employees with roles or 
                        responsibilities described in subsection 
                        (f)(1), including the annual mandatory training 
                        specified in subsection (f)(2) or training for 
                        first responders in protecting nearby persons, 
                        property, or the environment from the effects 
                        of a release of a substance of concern at the 
                        covered water system, with priority given to 
                        covered water systems assigned to tier one or 
                        tier two under subsection (d); and
                            ``(ii) appropriate training for first 
                        responders and emergency response providers who 
                        would respond to an intentional act at a 
                        covered water system.
                    ``(D) Eligible entities.--For purposes of this 
                paragraph, an eligible entity is a nonprofit 
                organization with demonstrated experience in 
                implementing and operating successful worker or first 
                responder health and safety or security training 
                programs.
    ``(r) Authorization of Appropriations.--
            ``(1) In general.--To carry out this section, there are 
        authorized to be appropriated--
                    ``(A) $315,000,000 for fiscal year 2011, of which 
                up to--
                            ``(i) $30,000,000 may be used for 
                        administrative costs incurred by the 
                        Administrator or the States, as appropriate; 
                        and
                            ``(ii) $125,000,000 may be used to 
                        implement methods to reduce the consequences of 
                        a chemical release from an intentional act at 
                        covered water systems with priority given to 
                        covered water systems assigned to tier one or 
                        tier two under subsection (d); and
                    ``(B) such sums as may be necessary for fiscal 
                years 2012 through 2015.
            ``(2) Security enhancements.--Funding under this subsection 
        for basic security enhancements shall not include expenditures 
        for personnel costs or monitoring, operation, or maintenance of 
        facilities, equipment, or systems.''.
    (b) Regulations; Transition.--
            (1) Regulations.--Not later than 2 years after the date of 
        the enactment of this Act, the Administrator of the 
        Environmental Protection Agency shall promulgate final 
        regulations to carry out section 1433 of the Safe Drinking 
        Water Act, as amended by subsection (a).
            (2) Effective date.--Until the effective date of the 
        regulations promulgated under paragraph (1), section 1433 of 
        the Safe Drinking Water Act, as in effect on the day before the 
        date of the enactment of this title, shall continue to apply.
            (3) Savings provision.--Nothing in this section or the 
        amendment made by this section shall affect the application of 
        section 1433 of the Safe Drinking Water Act, as in effect 
        before the effective date of the regulations promulgated under 
        paragraph (1), to any violation of such section 1433 occurring 
        before such effective date, and the requirements of such 
        section 1433 shall remain in force and effect with respect to 
        such violation until the violation has been corrected or 
        enforcement proceedings completed, whichever is later.

SEC. 3. STUDY TO ASSESS THE THREAT OF CONTAMINATION OF DRINKING WATER 
              DISTRIBUTION SYSTEMS.

    Not later than 180 days after the date of the enactment of this 
Act, the Administrator of the Environmental Protection Agency, in 
consultation with the Secretary of Homeland Security, shall--
            (1) conduct a study to assess the threat of contamination 
        of drinking water being distributed through public water 
        systems, including fire main systems; and
            (2) submit a report to the Congress on the results of such 
        study.
                                                 Union Calendar No. 179

111th CONGRESS

  1st Session

                               H. R. 3258

                          [Report No. 111-313]

_______________________________________________________________________

                                 A BILL

  To amend the Safe Drinking Water Act to enhance the security of the 
               public water systems of the United States.

_______________________________________________________________________

                            October 23, 2009

  Reported with an amendment, committed to the Committee of the Whole 
       House on the State of the Union, and ordered to be printed