Wastewater treatment facilities may possess certain characteristics that  terrorists could exploit either to impair the wastewater treatment process  or to damage surrounding communities and infrastructure. Federal Laws and Directives Related to Wastewater Security Are Limited

Federal law does not address wastewater security as comprehensively as it  does drinking water security. The directive designated EPA as the  lead agency to oversee the security of the water sector, including both  drinking water and wastewater critical infrastructures. However, the legislation did not  become law and, consequently, no such requirement or specific funding  exists for wastewater facilities. Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and  coordinating infrastructure protection activities for the nation's drinking  water and water treatment systems; (2) working with federal departments  and agencies, state and local governments, and the private sector to  facilitate vulnerability assessments; (3) encouraging the development of  risk management strategies to protect against and mitigate the effects of  potential attacks on critical resources; and (4) developing mechanisms for  information sharing and analysis. Many Large Wastewater Facilities Have Made Security Improvements but Efforts to Protect Collection Systems Have Been Limited

Our survey of large wastewater facilities indicates that many have taken  steps to improve security. Many facilities reported that taking other  measures to protect their treatment plants, including converting from  gaseous chlorine to a safer disinfection process, took priority over  protecting infrastructure in their collection systems. Most Facilities Have Conducted or Plan to Conduct Some Type of Security Assessment

Seventy-four percent of facilities that responded to our survey reported  they completed, were in the process of completing, or planned to complete  some type of security assessment—either a vulnerability assessment,  similar to that which was required of drinking water facilities under the  Bioterrorism Act, or another type of security assessment. The figure shows that security enhancements made or planned by large  wastewater facilities after 9/11 generally focus on controlling access to the  treatment plant. Other managers cited the difficulty and expense in securing  collection systems that, by nature, cover a large area and have many, often  remote, access points. While EPA and DHS have these wastewater security-related initiatives  under way, the Congress has expressed concerns that EPA’s homeland  security responsibilities are not well articulated in relation to DHS’  responsibilities. Multiple Efforts to Provide Critical and Threat-Related Information to the Water Sector Need Additional Coordination

In December 2002, the Association of Metropolitan Water Agencies  (AMWA) received a grant from EPA to establish a communication system  to share security information with water sector utilities, known as the  Water Information Sharing and Analysis Center (WaterISAC). A Water Sector Coordinating Council was also  established by the water sector with representative members of the water  sector community and charged with identifying information and other  needs of the sector, including the appropriate use of and the relationship  among Water ISAC, the Water Security Channel, and HSIN. Using  funding from the supporting grant from EPA, the WaterISAC is currently  examining options for coordination between the WaterISAC, the Water  Security Channel, and HSIN. However, the scope of the  preliminary review is not clear, nor is a time frame set to complete the  review. Conclusions

Many of the nation’s large wastewater facilities have made security  improvements since the terrorist attacks of September 11, 2001. Specifically, a substantial part of the $2 million annual EPA grant that funds  WaterISAC goes to support a computer platform that may be available at no  cost through HSIN. Scope and Methodology

To identify federal statutory authorities and directives that govern  protection of wastewater treatment facilities, we reviewed applicable laws,  Homeland Security Presidential Directives, and policies, guidance, and  regulations related to wastewater security from the Environmental  Protection Agency (EPA) and the Department of Homeland Security  (DHS). To determine what steps EPA and DHS have taken to help wastewater  facilities in their efforts to address vulnerabilities, we took several  approaches. 9. 11. 3. Information Technology (IT) Security Measures  46. Network protection,  such as a firewall, an  47. 9.
Why GAO Did This Study

Wastewater facilities provide essential services to residential, commercial, and industrial users, yet they may possess certain characteristics that terrorists could exploit to impair the wastewater treatment process or to damage surrounding infrastructure. For example, large underground collector sewers could be accessed by terrorists for purposes of placing destructive devices beneath buildings or city streets. GAO was asked to determine (1) what federal statutory authorities and directives govern the protection of wastewater treatment facilities from terrorist attack, (2) what steps critical wastewater facilities have taken since the terrorist attacks of September 11, 2001, (9/11) to ensure that potential vulnerabilities are addressed, and (3) what steps the Environmental Protection Agency (EPA) and the Department of Homeland Security (DHS) have taken to help these facilities in their efforts to address such vulnerabilities.

What GAO Found

Federal law does not address wastewater security as comprehensively as it does drinking water security. For example, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 required drinking water facilities serving populations greater than 3,300 to complete vulnerability assessments, but no such requirement exists for wastewater facilities. While federal law governing wastewater security is limited, Homeland Security Presidential Directive 7 designated EPA as the lead agency to oversee the security of the water sector, including both drinking water and wastewater. The directive tasked EPA with several responsibilities, including the development of mechanisms for information sharing and analysis within the water sector. Our survey of over 200 of the nation's large wastewater facilities shows that many have made security improvements since 9/11. Most facilities indicated they have completed, have under way, or plan to complete some type of security assessment. Similarly, more than half of responding facilities indicated they did not use potentially dangerous gaseous chlorine as a wastewater disinfectant. Survey responses show that other security measures taken after 9/11 have generally focused on controlling access to the treatment plant through improvements in visual surveillance, security lighting, and employee and visitor identification. Little effort, however, has been made to address collection system vulnerabilities, as many facilities cited the technical complexity and expense involved in securing collection systems that cover large areas and have many access points. Others reported that taking other measures, such as converting from gaseous chlorine, took priority over collection system protections. While EPA and DHS have initiatives to address wastewater facility security, efforts to provide critical and threat-related information would benefit from closer coordination. EPA and DHS fund multiple information services designed to communicate information to the water sector--specifically, EPA funds the Water Information Sharing and Analysis Center (WaterISAC) and its Water Security Channel, while DHS funds the Homeland Security Information Network (HSIN). EPA, DHS, and other industry experts are concerned that these multiple information services may overlap and produce inefficiencies. For example, a substantial part of the $2 million annual grant EPA uses to fund the WaterISAC is dedicated to purchasing computer services likely available through DHS and HSIN at no cost. A Water Sector Coordinating Council was established by the water sector to help determine the appropriate relationship among these information services. A preliminary review is under way to examine options for improving coordination between the WaterISAC, the Water Security Channel, and HSIN; however, the scope and time frame for completion of this review is unclear.