Securing Wastewater Facilities: Utilities Have Made Important	 
Upgrades but Further Improvements to Key System Components May Be
Limited by Costs and Other Constraints (31-MAR-06, GAO-06-390).  
                                                                 
Wastewater facilities provide essential services to residential, 
commercial, and industrial users, yet they may possess certain	 
characteristics that terrorists could exploit to impair the	 
wastewater treatment process or to damage surrounding		 
infrastructure. For example, large underground collector sewers  
could be accessed by terrorists for purposes of placing 	 
destructive devices beneath buildings or city streets. GAO was	 
asked to determine (1) what federal statutory authorities and	 
directives govern the protection of wastewater treatment	 
facilities from terrorist attack, (2) what steps critical	 
wastewater facilities have taken since the terrorist attacks of  
September 11, 2001, (9/11) to ensure that potential		 
vulnerabilities are addressed, and (3) what steps the		 
Environmental Protection Agency (EPA) and the Department of	 
Homeland Security (DHS) have taken to help these facilities in	 
their efforts to address such vulnerabilities.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-390 					        
    ACCNO:   A50542						        
  TITLE:     Securing Wastewater Facilities: Utilities Have Made      
Important Upgrades but Further Improvements to Key System	 
Components May Be Limited by Costs and Other Constraints	 
     DATE:   03/31/2006 
  SUBJECT:   Counterterrorism					 
	     Facility security					 
	     Federal law					 
	     Homeland security					 
	     Security assessments				 
	     Security policies					 
	     Terrorism						 
	     Wastewater management				 
	     Wastewater treatment				 
	     Security threats					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-390

     

     * Report to the Chairman, Committee on Environment and Public Works,
       U.S. Senate
          * March 2006
     * SECURING WASTEWATER FACILITIES
          * Utilities Have Made Important Upgrades but Further Improvements
            to Key System Components May Be Limited by Costs and Other
            Constraints
     * Contents
          * Results in Brief
          * Background
          * Federal Laws and Directives Related to Wastewater Security Are
            Limited
               * Federal Law Does Not Address Wastewater Security As It Does
                 Drinking Water
               * Other Federal Environmental Laws Address Some Areas of
                 Security at Wastewater Facilities
               * EPA Was Assigned Lead Federal Responsibility for
                 Water-Sector Security Including Wastewater Facilities
          * Many Large Wastewater Facilities Have Made Security Improvements
            but Efforts to Protect Collection Systems Have Been Limited
               * Most Facilities Have Conducted or Plan to Conduct Some Type
                 of Security Assessment
               * Most Large Facilities Have Discontinued or Plan to
                 Discontinue Use of Gaseous Chlorine, and Chlorine Users Have
                 Pursued Other Security Enhancements
               * Security Efforts Have Generally Focused on Improved Control
                 of Wastewater Treatment Plant Access, While Efforts to
                 Protect Collection Systems Have Been Limited
               * Many Facility Managers Reported a Need for Additional
                 Funding and Other Assistance to Further Security
                 Improvements
          * EPA and DHS Have Several Initiatives to Enhance Wastewater
            Facility Security, Yet a Key Effort Requires Additional
            Coordination
               * EPA and DHS Have Several Initiatives Under Way Related to
                 Wastewater Security
               * Multiple Efforts to Provide Critical and Threat-Related
                 Information to the Water Sector Need Additional Coordination
          * Conclusions
          * Recommendation for Executive Action
          * Agency Comments and Our Evaluation
     * Scope and Methodology
     * Survey of Wastewater Treatment Facilities
     * Comments from the Environmental Protection Agency
     * GAO Contact and Staff Acknowledgments

Report to the Chairman, Committee on Environment and Public Works, U.S.
Senate

March 2006

SECURING WASTEWATER FACILITIES

Utilities Have Made Important Upgrades but Further Improvements to Key
System Components May Be Limited by Costs and Other Constraints

Contents

Table

Figures

March 31, 2006Letter

The Honorable James M. Inhofe Chairman Committee on Environment and Public
Works United States Senate

Dear Mr. Chairman:

Wastewater facilities in the United States provide essential services to
residential, commercial, and industrial users by collecting and treating
wastewater and discharging treated effluent into receiving waters. These
facilities may also provide opportunities for terrorists to either impair
the wastewater treatment process or damage surrounding communities and
infrastructure. For example, damage to a wastewater facility or collection
system could prevent water from being treated, impacting downriver water
intakes. Destroying tanks that hold large amounts of chemicals at
treatment plants could release toxic chemical agents, such as gaseous
chlorine, that can be deadly if inhaled and, at lower doses, could burn
eyes and skin and inflame the lungs. Large underground collector sewers
could be accessed by terrorist groups for purposes of placing destructive
devices beneath buildings or city streets.

In January 2005, we reported the views of nationally recognized experts on
key issues concerning wastewater security.1 The five assets experts
considered most vulnerable included (1) the collection systems' network of
sewer lines used to move wastewater away from its point of origination to
the treatment plant; (2) treatment chemicals, such as gaseous chlorine,
used to disinfect wastewater; (3) key components of the wastewater
treatment plant, such as its headworks, where raw sewage first enters the
plant; (4) automated control systems that control many vital operations,
such as the amount of chlorine needed for disinfection; and (5) pumping
stations along the collection system that lift or pump wastewater to the
treatment plant. The experts noted that security-enhancing activities that
most warrant federal support include replacing gaseous chemicals used in
wastewater treatment with less hazardous alternatives; improving local,
state, and regional collaboration efforts; and completing vulnerability
assessments for individual wastewater systems. When asked how federal
wastewater security funds should be allocated among potential recipients,
the vast majority of experts suggested that wastewater utilities serving
critical infrastructure (e.g., public health institutions, government,
commercial, and industrial centers) should be given the highest priority.
Other recipients warranting highest priority included utilities using
large quantities of gaseous chemicals and utilities serving areas with
large populations.

As a follow-on to that review, this report examines: (1) what federal
statutory authorities and directives govern the protection of wastewater
treatment facilities from terrorist attack, (2) what steps critical
wastewater treatment facilities have taken since the terrorist attacks of
September 11, 2001, (hereafter referred to as "9/11") to ensure that
potential vulnerabilities are addressed, and (3) what steps the
Environmental Protection Agency (EPA) and the Department of Homeland
Security (DHS) have taken to help these facilities in their efforts to
address such vulnerabilities.

To identify federal statutory authorities and directives that govern
protection of wastewater treatment facilities, we reviewed applicable
laws; Homeland Security Presidential Directives; and EPA and DHS policies,
guidance, and regulations related to wastewater security. To determine
what steps critical wastewater treatment facilities have taken since 9/11
to ensure that potential vulnerabilities are addressed, we conducted a
Web-based survey of the nation's publicly-owned treatment works (POTWs)
that serve residential populations of 100,000 or greater. Together, these
facilities provide wastewater service to approximately 36 percent of the
U.S. population served by POTWs. We received an 82 percent response rate
to the survey. To determine what steps EPA and DHS have taken to help
these facilities in their efforts to address such vulnerabilities, we
reviewed relevant EPA and DHS guidance and other documents, and
interviewed agency personnel. We also interviewed state and local
officials with oversight for wastewater treatment operations and security.
Information about federal efforts to enhance wastewater security from the
perspective of wastewater treatment facilities was provided to us through
our Web-based survey. We conducted our work between May 2005 and February
2006 in accordance with generally accepted government auditing standards.
See appendix I for a more detailed discussion of our scope and
methodology.

Results in Brief

Federal law does not address wastewater security as comprehensively as it
does drinking water security. In particular, wastewater facilities are not
required by law to complete vulnerability assessments. This stands in
contrast to the requirements for drinking water utilities in the Public
Health Security and Bioterrorism Preparedness and Response Act of 2002
(the Bioterrorism Act),2 which required drinking water utilities serving
populations greater than 3,300 to complete vulnerability assessments by
June 2004. The Clean Air Act does require wastewater facilities using more
than 2,500 pounds of gaseous chlorine to submit to EPA a risk management
plan that lays out accident prevention and emergency response activities.
Also, under EPA guidance, the Clean Water State Revolving Fund program,
administered by the states with EPA funding to help local governments meet
their wastewater treatment needs, can be used in many instances for
certain wastewater system security enhancements. While federal statutes
governing wastewater security are limited, in December 2003, the president
issued Homeland Security Presidential Directive 7 (HSPD-7), designating
EPA as the lead agency to oversee the security of the water sector
(including both drinking water and wastewater). Under the directive, EPA
is responsible for (1) identifying, prioritizing, and coordinating
infrastructure protection activities for the nation's drinking water and
water treatment systems; (2) working with federal departments and
agencies, state and local governments, and the private sector to
facilitate vulnerability assessments; (3) encouraging the development of
risk management strategies to protect against, and mitigate the effects
of, potential attacks on critical resources; and (4) developing mechanisms
for information sharing and analysis.

Our survey of large wastewater facilities indicates that many have made
security improvements since 9/11. While not required, most facilities
indicated they have completed, have under way, or plan to complete some
type of security assessment. For example, 51 percent of facilities
responding to our survey indicated that they either completed a
vulnerability assessment similar to that required of drinking water
facilities under the Bioterrorism Act, or have one currently under way. In
addition, another 23 percent of facilities reported that they have
conducted, had under way, or planned to conduct, some type of security
assessment. Survey responses show that security measures undertaken by
large wastewater facilities after 9/11 have generally focused on
controlling access to the treatment plant through improvements in visual
surveillance, security lighting, and employee and visitor identification.
Survey results also show that facilities are continuing to move away from
the use of gaseous chlorine as a wastewater disinfectant. Fifty-six
percent of facilities indicated they do not use chlorine gas as a
wastewater disinfectant, while another ten percent indicated they plan to
stop using the gas. Importantly, survey results show that facilities have
taken little action to address collection system vulnerabilities. Many
facilities cited a shortage of the considerable funds required to secure a
collection system that covers a large area and has many, often remote,
access points. Consequently, few have installed, or plan to install,
manhole intrusion sensors, manhole locks, or sensors to detect toxics or
other biochemical threats to their collection system. Others reported that
taking other measures, such as converting from gaseous chlorine to a safer
disinfection process, took priority over protecting infrastructure in
their collection systems. Survey results show that a lack of funding and
federal security guidelines remain a concern for many wastewater facility
managers. For its part, EPA is funding efforts to develop security
guidance related to wastewater collection systems that should help inform
wastewater facility managers of security options in this area.

While EPA and DHS have several initiatives under way to address the
security concerns of wastewater facility managers, efforts to provide
critical and threat-related information would benefit from additional
coordination. EPA and DHS fund multiple information services designed to
communicate information to the water sector. Specifically, EPA funds the
Water Information Sharing and Analysis Center (WaterISAC) and its Water
Security Channel, while DHS funds the Homeland Security Information
Network (HSIN). EPA, DHS, and other industry experts have expressed
concern that these multiple information services may overlap and produce
inefficiencies. A Water Sector Coordinating Council was created with
representative members of the water community to, among other things,
identify the appropriate use of and the relationship among the WaterISAC,
the Water Security Channel, and HSIN. We believe that steps could be taken
that would improve the efficiency with which limited available funds are
being spent to communicate information to the water sector. For example, a
substantial part of the $2 million annual grant EPA uses to fund the
WaterISAC is dedicated to purchasing computer services likely available
through DHS and HSIN at no cost. According to EPA, a preliminary review is
under way by the Water Sector Coordinating Council that examines options
for improving coordination between the WaterISAC, the Water Security
Channel, and HSIN. However, the scope of the preliminary review is not
clear, nor is a time frame set to complete the review. Consequently, we
are recommending that the Administrator of EPA work with DHS and the Water
Sector Coordinating Council to identify areas where the WaterISAC and HSIN
networks could be better coordinated, focusing in particular on (1) how
operational duplications and overlap could be addressed, and (2) how water
systems' access to timely security threat information could be improved.
We are also recommending that EPA work with DHS and the Water Sector
Coordinating Council to identify realistic time frames for the completion
of these tasks.

Background

Nationwide, more than 16,000 POTWs serve more than 200 million people, or
about 70 percent of the nation's total population. The remaining
population is served by privately-owned utilities or by on-site systems,
such as septic tanks. A relative handful of large wastewater systems serve
the great majority of people, as about 500 large public wastewater systems
provide service to 62 percent of the population connected to a sewer
system. In addition to serving residential populations, approximately
27,000 commercial and industrial facilities rely on wastewater treatment
facilities to treat their wastewater. POTWs discharge treated effluent
into receiving waters and are regulated under the Clean Water Act.

Wastewater systems vary by size and other factors, but all include a
collection system and a treatment facility.

o The collection system is the underground network of sewers including
both sanitary and storm water collection lines. Collection systems tend to
be dispersed geographically and have multiple access points, including
drains, catch basins, and manholes. Lines may range from 4 inches to
greater than 20 feet in diameter, and access is usually conducted through
manholes that are typically 300 feet apart. Many collection systems rely
on gravity to maintain the flow of sewage through the pipes toward the
treatment plant. However, collection systems may also depend on pumping
stations to propel the flow when gravity alone is insufficient.
Nationwide, there are approximately 800,000 miles of sewer lines and
100,000 major pumping stations.

o The wastewater treatment facility receives wastewater from the
collection system and begins the treatment process which typically
involves several stages before treated effluent is released into receiving
waters. Primary treatment includes removal of larger objects through a
screening device or a grit removal system, and the removal of solids
through sedimentation. Secondary stage treatment includes a biological
process that consumes pollutants, as well as final sedimentation. Some
facilities also use tertiary treatment to remove nutrients and other
matter even further. Following these treatments, the wastewater is
disinfected to destroy harmful bacteria and viruses. Disinfection is often
accomplished with chlorine, which is stored in gaseous or liquid form
on-site at the wastewater treatment plant. The collection system and
treatment process is typically monitored and controlled by a Supervisory
Control and Data Acquisition (SCADA) system, which allows utilities to
control such things as the amount of chlorine needed for disinfection.

Wastewater treatment facilities may possess certain characteristics that
terrorists could exploit either to impair the wastewater treatment process
or to damage surrounding communities and infrastructure. For example, the
numerous storm drains, manholes, and sewers that make up a community's
wastewater collection system's network of sewers could be used to covertly
place explosives beneath a major population center or to introduce
substances that may damage a wastewater treatment plant's process. Damage
to (or destruction of) tanks that hold large amounts of gaseous chlorine
used to disinfect wastewater could release the potentially lethal gas into
the atmosphere. Such events could result in loss of life, destruction of
property, and harm to the environment.

Documented accidents and intentional acts highlight the destruction that
could arise from an attack on a wastewater system.

o In June 1977 in Akron, Ohio, an intentional release of naptha, a
cleaning solvent, and alcohol into a sewer by vandals at a rubber
manufacturing plant caused explosions 3.5 miles away from the plant,
damaging about 5,400 feet of sewer line and resulting in more than $10
million in damage.

o In 1981 in Louisville, Kentucky, thousands of gallons of a highly
flammable solvent, hexane, spilled into the sewer lines from a local
processing plant. Fumes from the solvent ignited, and the resulting
explosions collapsed a 12-foot diameter pipe and damaged more than 2 miles
of streets. No one was seriously injured, but sewer line repairs took 20
months, followed by several more months to repair the streets.

o In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused
explosions that killed 215 people, injured 1,500 others, damaged 1,600
buildings, and destroyed 1.25 miles of sewer.

o In 2002 in Hagerstown, Maryland, chemicals from an unknown source
entered the wastewater treatment plant and destroyed the facility's
biological treatment process. The event resulted in the discharge of
millions of gallons of partially treated sewage into a major tributary of
the Potomac River, less than 100 miles from a water supply intake for the
Washington, D.C., metropolitan area.

In January 2005, we reported the views of 50 nationally recognized experts
on key issues concerning wastewater security. Our panel of experts
identified five key wastewater assets as most vulnerable to terrorist
attacks: the collection systems' network of sewers (42 of 50 experts),
treatment chemicals (32 of 50 experts), key components of the treatment
plant (29 of 50 experts), control systems (18 of 50 experts), and pumping
stations (16 of 50 experts). When asked to identify and set priorities for
the security-enhancing activities most deserving of federal support, the
expert panel identified 11 key actions, but ranked three as deserving
highest priority-replacing gaseous chemicals used in the wastewater
treatment process; improving local, state, and regional efforts to
coordinate responses in advance of a potential terrorist threat; and
completing vulnerability assessments for individual wastewater systems.

Federal Laws and Directives Related to Wastewater Security Are Limited

Federal law does not address wastewater security as comprehensively as it
does drinking water security. In particular, wastewater facilities are not
required by law to complete vulnerability assessments. The Clean Air Act
does require wastewater facilities using certain amounts of hazardous
substances, such as chlorine gas, to submit to EPA a risk management plan
that lays out accident prevention and emergency response activities. Also,
under EPA guidance, the Clean Water State Revolving Fund can be used in
many instances for certain wastewater system security enhancements. While
federal law governing wastewater security is limited, in December 2003,
the president issued HSPD-7. The directive designated EPA as the lead
agency to oversee the security of the water sector, including both
drinking water and wastewater critical infrastructures.

Federal Law Does Not Address Wastewater Security As It Does Drinking Water

In 2002, Congress passed the Bioterrorism Act, which amended various laws,
including the Safe Drinking Water Act.3 The Bioterrorism Act required
drinking water systems serving more than 3,300 people to complete
vulnerability assessments of their facilities by June 2004 and to prepare
or update an existing emergency response plan. The Bioterrorism Act
required the assessments to include, but not be limited to, a review of
six components: (1) pipes and constructed conveyances; (2) physical
barriers; (3) water collection, pretreatment, treatment, storage, and
distribution facilities; (4) electronic, computer, or other automated
systems which are utilized by the public water system; (5) the use,
storage, or handling of various chemicals; and (6) the operation and
maintenance of such systems.4 Under the act, the emergency response plans
were to include plans, procedures, and identification of equipment to
lessen the impact on public health and the drinking water supply of
terrorist attacks or other intentional acts against drinking water
systems. The act authorized $210 million for fiscal year 2002, mostly to
assist drinking water systems in completing vulnerability assessments,
preparing or updating response plans, and making needed security
improvements. Drinking water systems are not required to implement any
risk-reduction actions based on their vulnerability assessments or report
to EPA on measures that have been implemented.

In 2003, the Congress considered alternative bills that would have
encouraged or required wastewater treatment plants to assess the
vulnerability of wastewater facilities, make physical security
improvements, and conduct research. However, the legislation did not
become law and, consequently, no such requirement or specific funding
exists for wastewater facilities.

Other Federal Environmental Laws Address Some Areas of Security at
Wastewater Facilities

While federal law does not require wastewater systems to take security
measures to protect specifically against a terrorist attack, it does
require certain wastewater facilities to take security precautions that
could mitigate the consequences of such an attack. For example, the 1990
Clean Air Act amendments5 mandated EPA oversight of risk management
planning at facilities that handle more than specified-threshold
quantities of hazardous substances, including the gaseous chlorine often
used as a disinfectant at wastewater facilities.6 Specifically, EPA
regulations implementing the Clean Air Act require these facilities to
prepare Risk Management Plans (RMPs) that summarize the potential threat
of sudden, accidental, large releases of certain chemicals; including the
results occurring off-site in a worst-case chemical accident, and the
facility's plan to prevent releases and mitigate any damage. RMPs are to
be revised and resubmitted to EPA at least every 5 years, and EPA is
required to review them and require revisions, if necessary.

For a March 2003 report,7 EPA told us it believed the Clean Air Act could
be interpreted to provide authority to address site security from
terrorist attacks at RMP facilities, because the act imposes certain
requirements on these facilities regarding "accidental releases." The act
defines an accidental release as an unanticipated emission of a regulated
substance or other extremely hazardous substance into the air, so any
chemical release caused by a terrorist attack could be considered
"unanticipated" and covered under the Clean Air Act. Such an
interpretation would provide EPA with authority under the act's RMP
provisions and general duty clause8 to require security measures or
vulnerability assessments with regard to terrorism. However, EPA has not
attempted to use these Clean Air Act provisions because it is concerned
that such an interpretation would pose significant litigation risk and has
concluded that chemical facility security would be more effectively
addressed by passage of specific legislation.

Wastewater facilities that store certain amounts of hazardous chemicals
may also be subject to the Resource Conservation and Recovery Act.9 Under
regulations implementing the act, facilities that house hazardous waste
generally must take certain security actions, such as posting warning
signs and using a 24-hour surveillance system, or surrounding the active
portion of the facility with a barrier and controlled entry gates.10
However, according to EPA, these security measures are aimed at keeping
out trespassers or wanderers, not intentional intruders.

Other federal statutes impose safety requirements on certain wastewater
facilities that may incidentally reduce the likelihood and mitigate the
consequences of terrorist attacks. For example, the Occupational Safety
and Health Act11 imposes a number of safety requirements, including a
general duty to furnish a workplace free from recognized hazards that may
cause death or serious physical harm to employees. The Emergency Planning
and Community Right-to-Know Act12 requires owners of facilities that
maintain specified quantities of certain extremely hazardous chemicals to
submit information annually on their chemical inventory to state and local
emergency response officials. The act also requires that each state
establish a State Emergency Response Commission to oversee local emergency
planning and create local emergency planning committees. These committees
must develop and periodically review their communities' emergency response
plans, including the identification of chemical facilities, and outline
procedures for response personnel to follow in the event of a chemical
incident.

Aside from statutes that address some areas of wastewater security, EPA
has asserted that federal funding is available for wastewater
security-related measures through the Clean Water State Revolving Fund
(CWSRF) program.13 The CWSRF is an EPA-administered program that provides
grants to the states to fund a variety of water-quality projects,
including those at municipal wastewater treatment facilities. States may
use the funds to provide loans to local governments to assist wastewater
utilities in making infrastructure improvements needed to protect public
health and ensure compliance with the Clean Water Act. According to EPA,
states may use the CWSRF to assist utilities in completing a variety of
security-related actions, such as vulnerability assessments, contingency
plans, and emergency response plans. In addition, EPA has identified other
infrastructure improvements that may be eligible for funding, such as the
conversion from gaseous chemicals to alternative treatment processes,
installation of fencing or security cameras, securing large sanitary
sewers, and installing tamper-proof manholes.14 In our January 2005 report
summarizing experts' views on wastewater security, a number of experts
expressed caution about relying heavily on the CWSRF program to support
security enhancements, largely because of the time-lag in obtaining funds
for security-related measures, and because such demands on the CWSRF would
divert needed funding away from the kind of critical infrastructure
investments that are the CWSRF program's primary purpose.

Another source of federal funding potentially available for wastewater
security-related measures is the State Homeland Security Grant Program
administered by DHS. This program's primary objectives are to enhance the
capacity of state and local emergency responders to prevent, protect
against, respond to, and recover from terrorist incidents involving
chemical, biological, radiological, nuclear, and explosive devices;
agriculture; and cyber attacks. Under the program, grants are provided to
states for a variety of purposes, including homeland security-related
training and protection of critical infrastructure, although authority to
make physical security improvements is limited. States are required to
allocate at least 80 percent of these grant funds to "local units of
governments," which, as defined in the conference report accompanying the
Department of Homeland Security Appropriations Act for fiscal year 2006,
include water districts, special districts, and other political
subdivisions of a state.

EPA Was Assigned Lead Federal Responsibility for Water-Sector Security
Including Wastewater Facilities

In December 2003, the president issued HSPD-7, which established a
national policy for federal departments and agencies to identify and set
priorities for the nation's critical infrastructures and to protect them
from terrorist attacks. HSPD-7 established EPA as the lead federal agency
to oversee the security of the water sector, both drinking water and
wastewater. Presidential Decision Directive 63 had done so earlier in May
1998, with a focus primarily on water supply.

Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and
coordinating infrastructure protection activities for the nation's
drinking water and water treatment systems; (2) working with federal
departments and agencies, state and local governments, and the private
sector to facilitate vulnerability assessments; (3) encouraging the
development of risk management strategies to protect against and mitigate
the effects of potential attacks on critical resources; and (4) developing
mechanisms for information sharing and analysis.

HSPD-7 also called for DHS to integrate all critical infrastructure
security efforts among federal agencies and to complete a comprehensive
national plan for critical infrastructure and key resource protection-now
called the National Infrastructure Protection Plan. Under HSPD-7, seven
federal agencies, including EPA, were designated sector-specific agencies.
DHS issued guidance tasking each sector-specific agency with developing
sector-specific plans for input into the comprehensive plan. Each
sector-specific plan is supposed to outline strategies for (1)
collaborating with all relevant federal departments and agencies, state
and local governments, and the private sector; (2) identifying assets; (3)
conducting or facilitating vulnerability assessments; and (4) encouraging
risk management strategies to protect against and mitigate the effects of
an attack. The water sector-specific plan will be an appendix to the
National Infrastructure Protection Plan. On January 20, 2006, DHS issued
its revised National Infrastructure Protection Plan based on comments it
received on an earlier version of the plan. DHS accepted additional
comments on the revised version until February 6, 2006, and expects to
issue a final version of the plan later in 2006. Sector-specific agencies
are required to submit their sector-specific plans to DHS within 6 months
after the National Infrastructure Protection Plan is made final.

Many Large Wastewater Facilities Have Made Security Improvements but
Efforts to Protect Collection Systems Have Been Limited

Our survey of large wastewater facilities indicates that many have taken
steps to improve security. Most facilities that responded to our survey
have completed, have under way, or plan to complete some type of security
assessment. Roughly two-thirds of facilities also reported they used a
disinfectant other than gaseous chlorine or plan to switch from the gas.
Of those facilities that continue to use gaseous chlorine, many have taken
steps to increase security by limiting and monitoring access to gaseous
chlorine storage areas or through other actions. Survey responses show
that since 9/11, wastewater treatment facilities have also focused
security efforts on controlling and limiting access to their treatment
plants. Importantly, facilities have taken fewer security actions intended
to protect treatment collection systems. Many facilities reported that
taking other measures to protect their treatment plants, including
converting from gaseous chlorine to a safer disinfection process, took
priority over protecting infrastructure in their collection systems.
Survey results show a lack of funding and federal security guidelines
remain a concern for many wastewater facility managers.

Most Facilities Have Conducted or Plan to Conduct Some Type of Security
Assessment

Seventy-four percent of facilities that responded to our survey reported
they completed, were in the process of completing, or planned to complete
some type of security assessment-either a vulnerability assessment,
similar to that which was required of drinking water facilities under the
Bioterrorism Act, or another type of security assessment. As shown in
figure 1, 106 facilities-or 51 percent of those responding to our
survey-indicated that they had completed a vulnerability assessment or
were currently conducting a vulnerability assessment.

Figure 1: Vulnerability and Security Assessments at Large Wastewater
Facilities

Of the 106 facilities that indicated they had either completed a
vulnerability assessment or had one under way, 80 indicated their
vulnerability assessments were complete, while 26 indicated the assessment
was still in process. As shown in the figure, 22 facilities-or 11 percent
of all responses-indicated they had conducted another type of security
assessment or were in the process of conducting another type of security
assessment, while 24 facilities-or 12 percent of all responses-indicated
they plan to conduct either a vulnerability or another type of security
assessment.

Twenty-three facilities-or 11 percent of total responses-indicated they
had no plans to conduct any type of security assessment. When asked to
identify reasons for not conducting a vulnerability or security
assessment, 17 of these 23 facilities cited a lack of requirement to do
so, while 15 noted that they considered security actions taken at their
facilities adequate for their security needs. Thirteen of these facilities
indicated that their emergency response plan was updated and this seemed
sufficient to address potential vulnerabilities.

Facilities cited several reasons for completing a vulnerability or some
other type of security assessment, but most-roughly 77 percent-reported
doing so on their own initiative. Thirty-seven percent of facilities
reported that they did so in conjunction with the required assessment for
their drinking water facility.15 To a lesser extent, facilities cited
state, local, and utility governing-body requirements as reasons they
conducted assessments. See appendix II for survey results related to
vulnerability and security assessments at large wastewater facilities.

Most Large Facilities Have Discontinued or Plan to Discontinue Use of
Gaseous Chlorine, and Chlorine Users Have Pursued Other Security
Enhancements

As shown in figure 2, over half of large wastewater facilities in our
survey reported they use an alternative to gaseous chlorine in their
disinfection process. These results are consistent with studies which
conclude that over the past decade, wastewater treatment facilities have
moved away from gaseous chlorine as a disinfectant.

Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities

Note: Totals do not add to 100 percent due to rounding.

Of the facilities not using gaseous chlorine, 89 reported using sodium
hypochlorite as their primary disinfectant. Sodium hypochlorite is
essentially a strong version of household bleach and is considered safer
than gaseous chlorine. Seventeen facilities report they are using
ultraviolet light as their primary disinfectant. The remaining facilities
did not identify the type of disinfectant method used at their facility.

In our January 2005 report, we noted that the change, for an individual
plant, to sodium hypochlorite may require approximately $12.5 million for
new equipment and increase annual chemical costs from $600,000 for gaseous
chlorine to over $2 million for sodium hypochlorite. However, one expert
noted some costs may be offset through savings in regulatory paperwork and
certain emergency planning efforts. In our survey, we asked facilities
that switched from gaseous chlorine if their annual costs increased,
stayed the same, or decreased after switching to an alternate disinfection
method. Fifty-eight facilities reported that costs increased, 11 noted
that costs have stayed about the same, and one facility reported that
costs decreased.

Of the 85 facilities that reported use of gaseous chlorine, 20-or roughly
10 percent of all 206 reporting facilities-indicated that they have plans
to switch from gaseous chlorine to another disinfectant. In addition, as
shown in figure 3, many reported taking additional steps after 9/11 to
mitigate the potential risks associated with continued reliance on
chlorine.

Figure 3: Security Measures at Large Wastewater Facilities That Still Use
Gaseous Chlorine

aOther physical improvements include, among others, improvements to gates
and fencing; physical barriers, security guards, intrusion alarms and
motion detectors; and enclosure of the chlorine storage area. Results are
based on 85 facilities that reported using gaseous chlorine as a primary
disinfectant.

Forty-one facilities using gaseous chlorine reported that they instituted
controls for selective access to chlorine storage areas after 9/11, while
30 facilities reported making other security improvements to the storage
area, such as installing electronic surveillance of the chlorine storage
area or improving gates and fencing. Fewer facilities reported that they
decided to store gaseous chlorine in smaller-quantity containers, likely
because most reported they already stored the gas in one-ton containers,
which are among the smallest containers used at large wastewater
facilities for the gas.16 See appendix II for survey results on gaseous
chlorine use at large wastewater facilities.

Security Efforts Have Generally Focused on Improved Control of Wastewater
Treatment Plant Access, While Efforts to Protect Collection Systems Have
Been Limited

As shown in figure 4, many facilities reported taking basic security
measures prior to 9/11, such as installing vehicle gates and security
fencing. Survey respondents also indicated that many information
technology security measures, such as virus protection programs, backup
power supplies, and firewall and intrusion detection systems, were
implemented before 9/11.

The figure shows that security enhancements made or planned by large
wastewater facilities after 9/11 generally focus on controlling access to
the treatment plant. Such security enhancements include adding visual
surveillance monitoring, increasing security lighting, implementing
employee and visitor identification policies, adding guard stations, and
upgrading SCADA capability and security.

Importantly, few facilities reported taking measures to address collection
system vulnerabilities other than having available redundant pumping
devices or collection bypass systems. For example, few have installed or
plan to install manhole intrusion sensors, manhole locks, or sensors to
detect toxics or other biochemical threats to their collection systems.
This lack of attention to collection system vulnerabilities is important
because 42 of the 50 experts polled in our January 2005 report on
wastewater security identified the collection systems' network of
sanitary, storm, and combined sewers as the most vulnerable asset of a
wastewater utility. Several noted that sewers make underground travel from
a point of entry to a potential target almost undetectable, possibly
allowing sewers to be used as an underground transport system for
explosive or toxic agents.

Many facilities reported that other measures to protect their treatment
plants, including converting from gaseous chlorine to a safer disinfection
process, took priority over protecting infrastructure in their collection
systems. Other managers cited the difficulty and expense in securing
collection systems that, by nature, cover a large area and have many,
often remote, access points. One manager expressed confusion about whether
to concentrate monitoring resources on large interceptor sewer lines to
prevent entry or on toxic materials that could be introduced at nearly
every access point to his system. Others noted the lack of facility
control over collection systems. One facility manager told us his facility
treats wastewater that is collected from 17 separate collection systems.
Finally, a number of respondents questioned whether the technologies
purportedly available to detect potential threats introduced to collection
systems are sufficiently capable of achieving this objective.

Figure 4: Security Measures at Large Wastewater Facilities

Note: Figure is based on results from 206 wastewater facilities.

Nonetheless, a few facility managers with whom we spoke told us they have
made efforts to address collection system security, particularly in the
protection of their pump stations. One facility manager told us his
facility has a project under way to install security locks and card-access
controls at all 93 of its pumping stations. According to the manager, the
concentration of and need to protect capital equipment, and the potential
impact of damage or destruction of that infrastructure prompted the
facility to direct its capital improvement efforts to securing pumping
stations.

While many facilities in our survey indicated they made some security
improvements after 9/11, facility managers cited limited resources and
other priorities as reasons for not implementing further security
measures. Facility managers and other industry experts with whom we spoke
noted that security upgrades must compete with other infrastructure needs
for available resources. For instance, many wastewater facilities'
collection systems are outdated, and they are already facing large costs
to expand and repair their aging systems and reduce incidences of combined
sewer overflows.17 Major U.S. cities, such as Washington, D.C., and
Cincinnati, Ohio, are facing costs between $1 and $2 billion to implement
necessary capital improvements. See appendix II for survey results on
physical, personnel, and information technology security measures taken at
large wastewater facilities.

Many Facility Managers Reported a Need for Additional Funding and Other
Assistance to Further Security Improvements

In our survey, we asked wastewater facility managers what the federal
government could do to improve security at wastewater facilities. Facility
manager responses are categorized in table 1.

Table 1: Wastewater Facility Managers' Opinions on Recommended Federal
Role

Recommended federal role                               Number of responses 
Funding                                                                102 
Guidelines, standards, best practices, expertise, and                   36 
information                                            
Training and education                                                  14 
Requirements and mandates                                               14 
Providing threat or security information                                 9 
Other                                                                   18 

Source: GAO survey of wastewater facilities.

Facility managers predominantly recommended additional funding to further
wastewater security improvements. Many facility managers recommended
targeting funding to specific measures, such as performing vulnerability
assessments, purchasing specific security equipment such as surveillance
cameras, or covering costs associated with switching from gaseous chlorine
to a safer disinfectant. To a much lesser extent, wastewater facility
managers commented that the federal government could be of greater
assistance in providing security guidance, standards, and best practices.
For example, one facility manager we interviewed expressed a need for
federal guidance and best practices on collection system security. For its
part, in 2002, EPA provided funding to the American Society of Civil
Engineers (ASCE) to develop a set of security guidance documents that
cover the design of online contaminant monitoring systems, and physical
security enhancements of drinking water, wastewater, and storm water
infrastructure systems. ASCE sub-contracted with American Water Works
Association and the Water Environment Federation (WEF) for assistance on
this project. In 2004 these documents were released as interim voluntary
security design standards for the water sector and finalized standards are
to be established in late 2006 or early 2007. These security-focused
documents are intended to serve as a foundation to help water utilities
address potential vulnerabilities through sound design, construction, and
operation and maintenance practices. According to a WEF representative,
one set of standards is to be directed at physical security measures for
wastewater collection systems. The security standards are to be published
in late 2006 and are to include both prescriptive and performance-based
criteria that focus on physical security upgrades that reduce risk to
water, wastewater, and storm water infrastructure arising from malevolent
events.

EPA and DHS Have Several Initiatives to Enhance Wastewater Facility
Security, Yet a Key Effort Requires Additional Coordination

EPA and DHS have a number of initiatives under way related to wastewater
facility security. For example, EPA has funded programs to develop
vulnerability assessment tools and provide training to wastewater
facilities on the use of these tools, while DHS has conducted site
assessment visits at wastewater facilities. While these initiatives are
helping to address security concerns in the wastewater sector, EPA and DHS
efforts could nonetheless be more effective with greater coordination over
how best to convey security-related and threat information to the
wastewater treatment community.

EPA and DHS Have Several Initiatives Under Way Related to Wastewater
Security

Since 2002, EPA has provided more than $10 million to help address the
security needs of the wastewater sector. EPA funded the development and
dissemination of several risk assessment methodologies to assist water
sector utilities in identifying how to better protect their critical
infrastructures. In addition, EPA funded training for wastewater utilities
on how to conduct risk assessments and update or complete emergency
response plans. EPA provided funding to the Association of Metropolitan
Sewerage Agencies18 to develop a software tool, called the Vulnerability
Self Assessment Tool (VSAT), for drinking water utilities. In addition,
through an interagency agreement with EPA, the Department of Energy's
Sandia National Laboratories provided training to selected firms in a
vulnerability assessment methodology developed by the labs, called the
Risk Assessment Methodology for Water Utilities (RAM-W). For vulnerability
assessments at smaller water systems, EPA supported the dissemination of
the Security and Emergency Management System (SEMS) software tool.

Sixty-nine wastewater facilities responding to our survey indicated they
used, were currently using, or planned to use the VSAT software to
complete a vulnerability or security assessment; 27 facilities indicated
they either used, were currently using, or planned to use the RAM-W
assessment tool. Another four facilities indicated they either used, were
currently using, or planned to use the SEMS software.

EPA has also reorganized its own internal structure and sought input from
experts outside of the agency to better assist the wastewater industry's
security efforts. In particular, in 2003, EPA created a Water Security
Division to work with the states, tribes, drinking water and wastewater
utilities, and other partners to enhance the security of water and
wastewater utilities and the ability to respond effectively to security
threats and breaches. In addition, in 2004, the National Drinking Water
Advisory Council (NDWAC),19 at EPA's request, established a Water Security
Working Group made up of 16 members from wastewater utilities, drinking
water utilities, and environmental and rate-setting organizations to
advise on the development of best security practices and policies for
water utilities. The group advises the NDWAC on ways to address several
specific security needs of the sector. In June 2005, the working group
provided NDWAC with a report that identified features of an active and
effective security program and ways to measure the adoption of these
practices.

As noted, EPA provided funding to ASCE to develop a set of security
guidance documents that cover the design of online contaminant monitoring
systems, and physical security enhancements of drinking water, wastewater,
and storm water infrastructure systems. This effort, called the Water
Infrastructure Security Enhancement project, is to address physical
infrastructure security needs in the water sector by issuing guidance
documents, training materials, and voluntary standards relating to water
infrastructure security. The project group is currently developing
physical security standards that focus on physical security upgrades to
reduce risk to water, wastewater, and storm water arising from malevolent
acts.

For its part, DHS has two broad initiatives that have facilitated efforts
to improve wastewater security. First, the Buffer Zone Protection program
is a DHS grant program designed to reduce specific vulnerabilities at a
critical infrastructure or key resource site by assisting local law
enforcement to develop a plan for preventative and protective measures
that make it more difficult for terrorists to plan or launch attacks from
the immediate vicinity of the site. They also identify equipment that
could be purchased to mitigate the vulnerabilities. Upon plan approval,
DHS grants funds for procuring materials and equipment necessary for
implementation of the site's buffer zone protection plan. According to
DHS, as of October 31, 2005, security at 14 wastewater facilities has been
reviewed under the Buffer Zone Protection program.

Under its second broad initiative, the Site Assistance Visits program, DHS
visits critical infrastructure sites nationwide to address key areas of
concern at facilities requiring security enhancements. DHS subject matter
experts in the areas of physical security measures, system
interdependencies, and terrorist attack prevention conduct these
visits-generally lasting 1 to 3 days-in which, among other things, the
vulnerabilities of the site or facility are identified and mitigation
options are discussed. According to DHS, as of October 31, 2005, a total
of 350 site assessment visits have been conducted. Of this total, seven
were conducted with wastewater facilities.

In addition to these programs, DHS funded a NACWA project to develop a
decision tree and report template to help water systems assess and examine
chlorine gas alternatives for water and wastewater disinfection. The
decision tree guides water systems in evaluating the potential costs and
benefits of conversion and determining whether an alternative disinfection
method will still enable them to meet their permit requirements. The
report template is to ensure that the results of the decision tree
analysis are reported in a consistent format, improving a water system's
ability to pursue and secure any available state or federal funding for
conversion. According to a NACWA representative, they are in the process
of finishing the design of the decision tool and, once the final product
is reviewed and approved by DHS, printing of the CD tool will begin. NACWA
expects to make the tool available to water and wastewater utilities free
of charge no later than the end of March 2006.

While EPA and DHS have these wastewater security-related initiatives under
way, the Congress has expressed concerns that EPA's homeland security
responsibilities are not well articulated in relation to DHS'
responsibilities. In the conference report for the fiscal year 2005
Consolidated Appropriations Act, conferees directed EPA to enter into a
memorandum of understanding (MOU) with DHS that defines the relationship
and responsibilities of the two entities regarding homeland security and
protection. EPA did not enter into the MOU, but instead, on November 1,
2005, issued a report to the Congress entitled "Homeland Security Roles
and Responsibilities and Interactions Between EPA and the Department of
Homeland Security." The report identified the homeland security-specific
authorities, core mission authorities, presidential directives, and
existing MOUs EPA uses to implement its homeland security roles and
responsibilities. In the report, EPA stated that it believes its homeland
security roles and responsibilities are sufficiently delineated not only
through statutes, presidential directives, and existing MOUs, but also
through planning documents and deliverables associated with a wide variety
of collaborative homeland security-related projects that EPA and DHS are
carrying out.

Multiple Efforts to Provide Critical and Threat-Related Information to the
Water Sector Need Additional Coordination

In December 2002, the Association of Metropolitan Water Agencies (AMWA)
received a grant from EPA to establish a communication system to share
security information with water sector utilities, known as the Water
Information Sharing and Analysis Center (WaterISAC).20 The WaterISAC is
one of thirteen critical infrastructure and key resource sector-specific
information sharing and analysis centers. The WaterISAC was designed to
meet the information sharing needs of both water and wastewater utilities
by providing real-time alerts of possible terrorist activity, allowing for
the secure reporting of incidents and the sharing of information among
users, and allowing access to a library of security-related information
and contaminant databases. Beginning in fiscal year 2003, EPA has annually
provided AMWA with a $2 million grant to support the WaterISAC. This grant
is augmented by subscription fees paid by drinking water and wastewater
systems.21 In November 2004, the WaterISAC launched a free security
advisory system known as the Water Security Channel that distributes
federal advisories on security threats via e-mail to the water sector. The
Water Security Channel also includes a searchable archive of federal
alerts, advisories, and bulletins. However, it does not provide access to
the same level of service as the subscription-based WaterISAC. WaterISAC
subscribers receive additional services, including a secure communication
system, access to vulnerability assessment tools and resources, access to
an online library related to water security issues, and access to
databases about chemical, biological, and radiological agents.

DHS has also sought to enhance communication between critical
infrastructure sectors and the government. Under the Homeland Security Act
of 2002, DHS is responsible for reducing the vulnerability of the national
infrastructure and for coordinating and communicating with all key
stakeholders on homeland security-related matters. According to DHS, to
fulfill this mandate, it requires a communication system that provides
equal and appropriate access to security information to all owners and
operators of critical infrastructure and key resources. In 2004, it
piloted a new secure network, the Homeland Security Information Network
(HSIN), to help achieve this mandate.

HSIN is DHS' primary conduit through which it shares information on
domestic terrorist threats, suspicious activity reports, and incident
management. It is composed of multiple communities of interest, including
the HSIN Critical Sector (HSIN-CS) program, which is intended to enhance
the protection, preparedness, and crisis communication and coordination
capabilities of the nation's 17 critical infrastructure and key resource
sectors identified in HSPD-7. The HSIN platform for critical sectors is
being developed and offered to each sector to provide a suite of
information and communication tools to share critical information both
within the sector, with DHS, and eventually across sectors. Because the
water sector is one of the nation's 17 critical infrastructure and key
resources, a HSIN-CS portal for the sector, called HSIN Water Sector
(HSIN-WS), is currently being developed by DHS. A Water Sector
Coordinating Council was also established by the water sector with
representative members of the water sector community and charged with
identifying information and other needs of the sector, including the
appropriate use of and the relationship among Water ISAC, the Water
Security Channel, and HSIN.22

While these efforts are helping to improve communication, staff at EPA and
DHS, as well as other industry experts with whom we spoke, have expressed
concern that the evolution of the information sharing and dissemination
function for the water sector has resulted in several inefficiencies.

o WaterISAC access is limited to drinking water and wastewater
subscribers, plus a restricted number of subscribers from EPA and the
state drinking water programs. For example, the agreement limits
designated users to five individuals at EPA headquarters and one person in
each EPA region, for a total of fifteen EPA users. States are limited to
only two users. EPA staff note that access for others in the sector, such
as the technical service community, universities, training centers and
laboratories, would benefit the overall protection of drinking water and
wastewater critical infrastructures. EPA and DHS staff told us that,
depending upon the user policy established by the sector, the HSIN network
could allow for broader sharing of access than currently available under
the WaterISAC.

o Only a small portion of the water sector is reached by the WaterISAC.
According to EPA staff, just over 530 utilities are reached by the
WaterISAC, while over 8,000 utilities receive information through the
Water Security Channel. However, the Water Security Channel does not
provide the same level of notification and information sharing provided by
the WaterISAC. The Water Security Channel is essentially a "push e-mail
system" that sends out general security bulletins to water utilities and
other users, and allows for searches of previous bulletins. This service
is much more limited than that provided to WaterISAC subscribers, which
provides a secure communication system for users to share information,
access to vulnerability assessment tools and resources, access to an
online library related to water security issues, and access to databases
about chemical, biological, and radiological agents. One water industry
representative told us that the WaterISAC recently lowered its
subscription fees due to industry concerns that the fees were limiting
WaterISAC subscriptions. EPA staff told us that the water sector generally
has less funding available to support ISAC services than other sectors
such as electric, financial, and transportation.

o WaterISAC duplicates some operational functions likely available through
HSIN. EPA estimates that roughly $600,000 to $700,000 of the annual $2
million WaterISAC grant is used to support computer hardware and software
for the secure web portal. Meanwhile, to support HSIN, DHS funds similar
computer software and hardware and its related technical support. EPA
staff noted that WaterISAC could make use of the software and hardware
platform available through HSIN. EPA staff believed that WaterISAC could
then better focus its resources on managing its user list, managing
information content on the secure web site, and analyzing and distributing
threat information, while leaving DHS to manage and run the hardware and
software.

The current reach and levels of service offered by the WaterISAC and the
Water Security Channel do not meet DHS' objective to establish a
communication system that provides equal and appropriate access to
security information to all owners and operators in this critical
infrastructure area. According to EPA and DHS staff, the Water Sector
Coordinating Council will consider options to improve coordination between
the WaterISAC, the Water Security Channel, and HSIN. Using funding from
the supporting grant from EPA, the WaterISAC is currently examining
options for coordination between the WaterISAC, the Water Security
Channel, and HSIN. EPA noted that this review is ongoing and will likely
be presented in preliminary form to the Water Sector Coordinating Council
in a mid-March 2006 meeting. However, the scope of the preliminary review
is not clear, nor is a time frame set to complete the review. According to
DHS, the creation of the DHS Homeland Infrastructure Threat and Risk
Analysis Center will assist in information sharing of intelligence threat
information between DHS and federal, state, and private sector partners.

Conclusions

Many of the nation's large wastewater facilities have made security
improvements since the terrorist attacks of September 11, 2001. Of
particular note, many have completed some type of security assessment, and
additional facilities have such assessments under way. Our survey also
found that wastewater facilities are continuing to move away from the use
of potentially dangerous gaseous chlorine as a wastewater disinfectant.
One area of continuing concern is the difficulty these facilities are
having in addressing vulnerabilities associated with their collection
systems. Facility managers explained that with limited funding available,
other important measures considered to be more feasible and affordable
were assigned greater priority. EPA is attempting to help address this
difficult issue through funding the American Society of Civil Engineers
project to develop voluntary physical security standards for the water
sector.

Despite limited federal authority over security at the nation's wastewater
facilities, EPA, as the lead agency for water sector security, has worked
with DHS and industry groups to advance wastewater security by providing
vulnerability assessment tools, training, guidance, and burgeoning
information sharing networks. These efforts, combined with the individual
initiatives of many wastewater facilities, have resulted in measurable
security improvements. However, these efforts could benefit from
additional coordination, and we acknowledge and support EPA's and DHS'
commitment to do so. As these agencies move forward, we believe they
should act upon the opportunities we have identified that could improve
both the efficiency with which limited dollars are being spent, as well as
the delivery of vital information services to the wastewater community.
Specifically, a substantial part of the $2 million annual EPA grant that
funds WaterISAC goes to support a computer platform that may be available
at no cost through HSIN.

Recommendation for Executive Action

We recommend that the Administrator of EPA work with DHS and the Water
Sector Coordinating Council to identify areas where the WaterISAC and HSIN
networks could be better coordinated, focusing in particular on (1) how
operational duplications and overlap could be addressed, and (2) how water
systems' access to timely security threat information could be improved.
We also recommend that EPA work with DHS and the Water Sector Coordinating
Council to identify realistic time frames for the completion of these
tasks.

Agency Comments and Our Evaluation

We provided a draft of this report to DHS and EPA for review and comment.
DHS agreed with the factual content of the report, and its Office of
Infrastructure Protection provided written technical comments and
clarifications that have been incorporated, as appropriate. In its letter,
reproduced in appendix III, EPA concurred with the results of the report.
EPA's Water Security Division in the Office of Ground Water and Drinking
Water also provided technical comments and clarifications that were
incorporated, as appropriate.

As agreed with your office, unless you publicly release the contents of
this report earlier, we plan no further distribution until 30 days from
the report date. At that time, we will send copies of this report to the
appropriate congressional committees; interested Members of Congress; the
Administrator, Environmental Protection Agency; the Secretary, Department
of Homeland Security; and other interested parties. We will also make
copies available to others on request. In addition, the report will be
available at no charge on the GAO Web site at h  ttp://www.gao.gov.

Should you or your staff need further information, please contact me at
(202) 512-3841 or s  [email protected]. Contact points for our Offices of
Congressional Relations and Public Affairs may be found on the last page
of this report. GAO staff who made major contributions to this report are
listed in appendix IV.

Sincerely yours,

John B. Stephenson Director, Natural Resources and Environment

Appendix I

Scope and Methodology

To identify federal statutory authorities and directives that govern
protection of wastewater treatment facilities, we reviewed applicable
laws, Homeland Security Presidential Directives, and policies, guidance,
and regulations related to wastewater security from the Environmental
Protection Agency (EPA) and the Department of Homeland Security (DHS). In
addition, we interviewed officials in EPA's Water Security Division, as
well as DHS officials in various areas of the agency. In addition, we
spoke with representatives for wastewater industry associations with which
EPA has collaborated to actively assist wastewater treatment facilities to
address their security issues.

To determine the steps critical wastewater treatment facilities have taken
since 9/11 to address potential vulnerabilities, we conducted a Web-based
survey of the nation's largest wastewater treatment facilities. For the
purpose of this review, we defined "critical wastewater facilities" as the
253 wastewater facilities in the United States that have service area
populations of 100,000 or greater, as identified in the results of EPA's
2004 Clean Watershed Needs Survey.1 As a result of Hurricane Katrina, one
facility in our initial population of 253 facilities that was identified
as a New Orleans facility was omitted, leaving a total 252 facilities in
our survey population. We drafted the survey in consultation with our own
survey professionals. In addition, we solicited the review and comment of
knowledgeable officials from the National Academy of Sciences, the Water
Environment Federation, and the National Association of Clean Water
Agencies, as well as several wastewater security experts identified in our
January 2005 report on wastewater security.2 We conducted seven pretests
to check that (1) the questions were clear and unambiguous, (2)
terminology was used correctly, (3) the information was feasible to
obtain, and (4) the survey was comprehensive and unbiased. The pretest
sites were chosen to include facilities representing different geographic
regions, and utilities both with single and multiple facilities. One
pretest was done in person and six were done over the phone.

Our survey asked wastewater treatment facility representatives to provide
a variety of information, such as whether their facilities had conducted
security assessments; what measures, if any, they had taken or were
planning to take in several security areas; and their perspectives on what
role the federal government should assume in wastewater treatment facility
security. The survey was made available between October 1, 2005, and
January 15, 2006, and a unique user identification number and a password
were provided to each surveyed facility. Three e-mail reminders were sent
out to nonresponders, and then follow-up phone calls were made to all
nonresponding facilities. A total of 206 of 252 wastewater treatment
facilities responded to the survey, resulting in an 82 percent survey
response rate. Other wastewater facilities that did not respond to the
survey generally cited security concerns related to providing potentially
sensitive information or a general policy of not answering surveys.

Because this was not a sample survey, there are no sampling errors.
However, the practical difficulties of conducting any survey may introduce
errors, commonly referred to as non-sampling errors. For example,
difficulties in how a particular question is interpreted or in the sources
of information that are available to respondents can introduce unwanted
variability into the survey results. We took steps both at the data
collection and at the analysis phases to minimize these non-sampling
errors. Since this was a Web-based survey, respondents entered their
answers directly into the electronic questionnaire, which removes one
source of error. When the data were analyzed, a second, independent
analyst checked all relevant computer programs.

To determine what steps EPA and DHS have taken to help wastewater
facilities in their efforts to address vulnerabilities, we took several
approaches. First, through semi-structured interviews with agency
officials and industry association representatives, as well as document
reviews, we researched various programs that EPA and DHS have under way.
Second, we identified programs that require cross-agency collaboration
between EPA and DHS, and we examined in depth those that wastewater
treatment facility representatives identified as potentially useful. We
also interviewed state and local officials with oversight for wastewater
treatment operations and security. Third, one section of our survey
gathered information about facility representatives' experiences with,
perspectives on, and expectations for, the federal role in wastewater
treatment facility security. Responses to open-ended questions were
categorized and tallied to analyze their content for subsequent research
findings. Finally, to develop conclusions about the level of coordination
between the two agencies in the implementation of these programs, we
interviewed agency officials about their perspectives on how well the
agencies are working together.

Appendix II

Survey of Wastewater Treatment Facilities

Appendix III

Comments from the Environmental Protection Agency

Appendix IV

GAO Contact and Staff Acknowledgments

GAO Contact

John B. Stephenson (202) 512-3841

Acknowledgments

In addition to the contact named above, Nancy Bowser, Jenny Chanley, Steve
Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry Sandau, Rebecca
Spithill, and Monica Wolford made key contributions to this report.

(360576)

www.gao.gov/cgi-bin/getrpt?GAO-06-390.

To view the full product, including the scope and methodology, 
click on the link above.

For more information, contact John Stephenson at (202) 512-3841 or
[email protected].

Highlights of GAO-06-390, a report to the Chairman, Committee on
Environment and Public Works, U.S. Senate

March 2006

SECURING WASTEWATER FACILITIES

Utilities Have Made Important Upgrades but Further Improvements to Key
System Components May Be Limited by Costs and Other Constraints

Wastewater facilities provide essential services to residential,
commercial, and industrial users, yet they may possess certain
characteristics that terrorists could exploit to impair the wastewater
treatment process or to damage surrounding infrastructure. For example,
large underground collector sewers could be accessed by terrorists for
purposes of placing destructive devices beneath buildings or city streets.

GAO was asked to determine (1) what federal statutory authorities and
directives govern the protection of wastewater treatment facilities from
terrorist attack, (2) what steps critical wastewater facilities have taken
since the terrorist attacks of September 11, 2001, (9/11) to ensure that
potential vulnerabilities are addressed, and (3) what steps the
Environmental Protection Agency (EPA) and the Department of Homeland
Security (DHS) have taken to help these facilities in their efforts to
address such vulnerabilities.

What GAO Recommends

GAO is recommending that EPA work with DHS to identify areas where the
WaterISAC and HSIN could be better coordinated, focusing on (1) how
duplications and overlap could be addressed, and (2) how water systems'
access to critical information could be improved. GAO also recommends that
EPA help identify time frames to complete these tasks. EPA and DHS
generally agreed with the report.

Federal law does not address wastewater security as comprehensively as it
does drinking water security. For example, the Public Health Security and
Bioterrorism Preparedness and Response Act of 2002 required drinking water
facilities serving populations greater than 3,300 to complete
vulnerability assessments, but no such requirement exists for wastewater
facilities. While federal law governing wastewater security is limited,
Homeland Security Presidential Directive 7 designated EPA as the lead
agency to oversee the security of the water sector, including both
drinking water and wastewater. The directive tasked EPA with several
responsibilities, including the development of mechanisms for information
sharing and analysis within the water sector.

Our survey of over 200 of the nation's large wastewater facilities shows
that many have made security improvements since 9/11. Most facilities
indicated they have completed, have under way, or plan to complete some
type of security assessment. Similarly, more than half of responding
facilities indicated they did not use potentially dangerous gaseous
chlorine as a wastewater disinfectant. Survey responses show that other
security measures taken after 9/11 have generally focused on controlling
access to the treatment plant through improvements in visual surveillance,
security lighting, and employee and visitor identification. Little effort,
however, has been made to address collection system vulnerabilities, as
many facilities cited the technical complexity and expense involved in
securing collection systems that cover large areas and have many access
points. Others reported that taking other measures, such as converting
from gaseous chlorine, took priority over collection system protections.

While EPA and DHS have initiatives to address wastewater facility
security, efforts to provide critical and threat-related information would
benefit from closer coordination. EPA and DHS fund multiple information
services designed to communicate information to the water
sector-specifically, EPA funds the Water Information Sharing and Analysis
Center (WaterISAC) and its Water Security Channel, while DHS funds the
Homeland Security Information Network (HSIN). EPA, DHS, and other industry
experts are concerned that these multiple information services may overlap
and produce inefficiencies. For example, a substantial part of the $2
million annual grant EPA uses to fund the WaterISAC is dedicated to
purchasing computer services likely available through DHS and HSIN at no
cost. A Water Sector Coordinating Council was established by the water
sector to help determine the appropriate relationship among these
information services. A preliminary review is under way to examine options
for improving coordination between the WaterISAC, the Water Security
Channel, and HSIN; however, the scope and time frame for completion of
this review is unclear.
*** End of document. ***