Keeping our drinking water safe

The UK water industry has more than 700,000km of mains and sewers, which is enough mileage to stretch to the moon and back. There are 1,584 boreholes, 666 reservoirs and 602 river abstractions to ensure that UK households get the water they need for drinking and a range of household activities.1 In the US there are 168,000 public water systems, including 54,000 community water systems serving 264 million people.2

Every day we turn on our taps and allow water to run freely into our homes and lives. Public trust in the safety and quality of our drinking water is implicit. But the figures above emphasise the overwhelming potential for the deliberate contamination of our household water supplies. Are the right systems in place to ensure the security of the water industry in the US and the UK? How can we protect our water supplies from terrorism?

What are the potential threats?

The primary perceived threats to drinking water are biological and chemical contaminants that could be released into source water, storage, treatment or distribution systems. There are numerous highly toxic chemicals that could be introduced into our water supplies, rendering water for drinking and cleaning extremely hazardous. Biological agents have also raised serious concerns regarding their threat to water systems and their potential public health consequences. Outbreaks of disease caused by waterborne biological contaminants have occurred in the past and still pose a considerable problem. But the nature of our water systems and the extensive treatment to which drinking water is subjected before it reaches our homes greatly reduce the possibility of contamination by chemical or biological agents. The following points should be considered when assessing the threat of contaminated water supplies:

The volume of contaminant necessary to have a recognisable effect on our water supplies presents significant logistical challenges. A terrorist would need a large storage vehicle to transport adequate amounts of a chemical or toxin, and would then have to deliver it into the water system without drawing attention.

Dilution is the solution. In addition to the enormous volumes of contaminant required to cause adverse health effects, leakage is a major problem in the water infrastructure. The average leakage rate for 2001-2002 in the UK was 154 litres per household per day.3 This leakage rate would reduce the probability of critical amounts of contaminants reaching their target households.

The rigorous disinfection process that is key to the treatment of both drinking water and waste water will eliminate most biological contaminants before they reach our homes. This imposes restrictions as to which phases of the water distribution process a terrorist can effectively contaminate.
Physical damage to water industry facilities is also a serious threat. The disruption of water supplies would not only have widespread psychological impacts on the public but could subsequently increase the risk of disease. The lack of potable water or the contamination of clean water with waste water could have devastating consequences and place enormous pressure on our public health response systems. The destruction of water storage facilities, treatment plants or distribution systems would also highlight the dependency of other utility infrastructures on water supplies - such as that of the electricity industry. In 2000, three-quarters of UK water abstracted was evenly distributed between public water supply and the electricity supply industry.4 Should a severe disruption of the water industry occur, the consequences could be disastrous.

Ironically, chlorine - the primary disinfectant chemical used throughout the water purifying process - also represents a security hazard. Chlorine fumes are toxic and the chemical is highly explosive in its compressed gas form. Chlorine used for water purification at water treatment plants is often stored in large movable tanks near the treatment facilities. A carefully placed explosive near a chlorine tank would cause significant damage to the facility. Additionally, high chlorine content in drinking water could cause adverse health effects.

Both the US and the UK are aware of the threat to the water supply industry posed by cyber attack. Many drinking water and waste water facilities are dependent on electronic and computer systems. Should an outside party gain electronic access to a facility mainframe, there is the potential that they will be able to shut down or alter the normal processes of water treatment and supply.

Who is responsible for protecting our water

supplies?

Legislative measures are firmly in place to ensure that the water security infrastructure is solid and effective. The US has three major legal acts that cover most facets of water security:

Clean Water Act;

Safe Drinking Water Act (SDWA); and

Public Health Security and Bioterrorism Preparedness and Response Act of 2002.
This last edict is particularly aggressive with regard to mandatory security and emergency preparedness actions, which water suppliers are forced to take in light of the stated terrorist threat. It highlights the new responsibilities faced by drinking water utilities regarding security and counter-terrorism and emphasises the fact that the US government recognised the need for a more comprehensive view of water safety and security. In an amendment to the SDWA, the Bioterrorism Preparedness Act 2002 specifies actions that the community water systems and the US Environmental Protection Agency (EPA) must take to improve the security of the US drinking water infrastructure. It states that all community water systems serving a population greater than 3,300 people are required to conduct an assessment of their vulnerability to terrorist attack or any other attack designed to disrupt their ability to provide a safe and reliable supply of drinking water. They will also be required to prepare or revise an emergency response plan that incorporates the results of the vulnerability assessment. Once an assessment has been conducted, each community water system must submit a certificate of completion to the EPA stating that Emergency Response Plans are in place and ready for use.

Legislation in the UK is slightly more discreet, but no less effective. The Water Industry Act 1991 states the actions to be taken in the instance of a threat to national security.5 Section 208 gives the Secretary of State the power to issue directions to the water industry, instructing it to take appropriate steps to ensure continuity and resilience should a terrorist or criminal event occur. An amendment to the Water Industry Act was instituted in 1998, outlining the initiatives to be taken by the water industry in terms of security measures. The water industry is required to revise and review both its security measures and emergency procedures and submit a valid certification of completion to the Department for Environment, Food and Rural Affairs (DEFRA) by 1 April each year. This certificate can be obtained by a variety of independent certifiers recognised by DEFRA or by the Office of Water Services (OFWAT).

A new legal initiative in the UK known as the Civil Contingencies Bill will be put forward later in 2003 and could have enormous implications for the role of the water industry in matters of national security. The draft Civil Contingencies Bill is currently being reviewed by a joint parliamentary committee to ensure that all angles of national resilience are covered - in terms of both responsibility and response to terrorist attacks and incidents with widespread national implications. The actions that the UK water industry would legally be required to take include:

the formulatio of plans to ensure that if an emergency occurs, the utility affected will be able to continue performing its functions;

the maintenance of plans to ensure that if an emergency occurs, the utility can either reduce/mitigate/control the emergency and/or take actions in connection with the emergency; and

the maintenance of arrangements to warn the public and provide appropriate advice if an emergency is likely to occur or has occurred.

Response actions in the US:

In the case of an overt attack on US water systems, the water supplier in question must immediately notify local authorities (police/Federal Bureau of Investigation [FBI]) and then contact state emergency and drinking water programmes in order to:

begin emergency response procedures;

notify consumers of the steps they must take; and

provide an alternative source of water if necessary.
If evidence points to an active incident, the US Center for Disease Control (CDC) begins an investigation. The CDC must refer to the FBI, which can provide assistance through its federal labs for the detection and identification of the contaminant. On-site EPA co-ordinators will also be present to assist in the investigation and post-incident procedures. Both the US Army Corps of Engineers and the CDC can provide health support should health effects begin to appear. The US Army Aberdeen Proving Grounds can also quickly provide expertise in chemical contaminants, while the Federal Emergency Management Agency provides co-ordination and reimbursements to agencies.

Response actions in the UK:

Following the overt release of a contaminant into UK water supplies, the utility must immediately notify the authorities. The Secretary of State will also be notified through the appropriate channels. The security services will initially define an exposed zone, but this may require some modification if cases of disease arise in people who were not included in the defined zone of exposure. The Communicable Disease Surveillance Centre's on-call doctor should also be alerted in order to activate the Drinking Water Inspectorate (DWI) emergency plans and arrange for the testing of water samples. DEFRA, the DWI and the Environmental Agency will work closely to assess the contamination and take the appropriate remedial actions. The Health Protection Agency is the public health body that addresses the health consequences of the incident and closely monitors the population for disease, offering treatment when required.

Items included in a comprehensive security assessment of public water supplies:6

The following actions should be part of any comprehensive plan to secure water industry facilities.

Co-ordination:

local law enforcement authorities should review the security measures at the public water facility;
a local emergency manager should review the response plan;

personnel at the water facility should be trained in security awareness and given explicit response actions for reporting threats or acts of terrorism;

a plan for public notification should be developed;

response plans should be practised based on a regular schedule; and

a capacity to communicate with local health care facilities should be developed.
Access to facilities:

restrict access to reservoirs, treatment system vents and intakes. Prohibit parking or stopping on roadways near facilities. Maintain integrity of barriers, fences, hatches and manholes;

lock all facilities and never leave keys in equipment;

evaluate reliability and security status of all employees and ask them to question strangers in restricted areas;

store chemicals in secure facilities. Chemical
suppliers must provide their employees with photo identification. Accept only deliveries of chemicals that have been ordered; and

security lighting, motion detectors and surveillance cameras should be used.
Access to documents:

limit access to water distribution maps and plans of facilities; and

contractors and consultants should also be required to keep their documents safe.
Access to computer systems:

obtain technology security such as firewalls, anti-virus software and intrusion detection software to protect computer systems; and

limit computer access and passwords to personnel who need to know.
Monitoring:

keep good records - discuss unusual events with law enforcement;

ask local law enforcement to routinely patrol facilities and enforce parking restrictions; and visit all facilities daily.

Water security and safety conclusions:

Is our drinking water safe from terrorist attack? While it is impossible to guarantee that an incident will not occur, it is reasonable to say that an attempt to

contaminate our water supplies is very likely to be unsuccessful. Both the legislation and enforced actions are in place to help ensure that a contamination incident does not occur. The water industry

and government are working closely together to make sure that the necessary measures are in place to prevent an emergency. It is also reassuring to know that a series of realistic and practical actions can be taken by the water industry to greatly reduce the risk of an incident.

Valerie Seefried is the Programme Co-ordinator for the Homeland Security & Resilience Programme, RUSI. She has a background in public health with a specialisation in bioterrorism preparedness and response.

1 Water UK

2 US Environmental Protection Agency (EPA)

3 UK Office of Water Services (OFWAT) - Water and Regulation: Facts and Figures October 2003

4 DEFRA

5 Scotland has its own statutory instrument known as the Water Industry (Scotland) Act 2002 (Directions in the Interests of National Security) Order 2002, which clearly defines the role of the Secretary of State in dictating the necessary measures to be taken by the Scottish water industry in the interest of national security.

6 Provided by the Minnesota Office for Emergency Management