EPA and the drinking water  industry launched efforts to share information on terrorist threats and  response strategies. Experts Identified Key Vulnerabilities That Could Compromise Drinking Water Systems’ Security

Our panel of experts identified several key physical assets of drinking  water systems as the most vulnerable to intentional attack. Chief among these  issues are (1) a lack of redundancy in vital systems, which increases the  likelihood that an attack could render a system inoperable; and (2) the  difficulty many systems face in understanding the nature of the threats to  which they are exposed. Nearly half the  experts (20 of 43) identified source water as among drinking water  systems’ top vulnerabilities. Also cited as vulnerabilities were the sophisticated computer systems that  drinking water utilities have come to rely upon to manage key functions. Experts’ Views on the Allocation and Distribution of Federal Funds

Many drinking water utilities have been financing at least some of their  security upgrades by passing along the costs to their customers through  rate increases. and (3) What are the most effective mechanisms for directing  these funds to recipients? Experts also  assigned high priority to utilities serving critical assets, such as national  icons representing the American image, military bases, and key  government, academic, and cultural institutions. The Drinking Water State Revolving Fund (DWSRF) received somewhat  less support as a mechanism for funding security enhancements. Activities Experts Identified as Most Deserving of Federal Support

When experts were asked to identify specific security-enhancing activities  most deserving of federal support, their responses generally fell into three  categories: (1) physical and technological upgrades to improve security  and research to develop technologies to prevent, detect, or respond to an  attack, (2) education and training to support, among other things,  simulation exercises to provide responders with experience in carrying  out emergency response plans, and specialized training of utility security  staff; and (3) strengthening key relationships between water utilities and  other agencies that may have key roles in an emergency response, such as  public health agencies, law enforcement agencies, and neighboring  drinking water systems. Regarding efforts to improve education and training, over 90 percent of  the experts (39 of 43) indicated that improved technical training for  security-related personnel warrants at least a high priority for federal  funding. As illustrated in figure 8, experts also cited the need to improve  cooperation and coordination between drinking water utilities and certain  other organizations as key to improving utilities’ security.
Why GAO Did This Study

After the events of September 11, 2001, Congress appropriated over $140 million to help drinking water systems assess their vulnerabilities to terrorist threats and to develop response plans. Utilities are asking for additional funding, however, not only to plan security upgrades but also to support their implementation. This testimony is based on GAO's report, Drinking Water: Experts' Views on How Future Federal Funding Can Best Be Spent to Improve Security ( GAO-04-29 , October 31, 2003). Specifically, GAO sought experts' views on (1) the key security-related vulnerabilities affecting drinking water systems, (2) the criteria for determining how federal funds are allocated among drinking water systems to improve their security, and the methods by which those funds should be distributed, and (3) specific activities the federal government should support to improve drinking water security.

What GAO Found

GAO's expert panel cited distribution systems as among the most vulnerable physical components of a drinking water utility, a conclusion also reached by key research organizations. Also cited were the computer systems that manage critical utility functions; treatment chemicals stored on-site; and source water supplies. Experts further identified two key factors that constitute overarching vulnerabilities: (1) a lack of the information individual utilities need to identify their most serious threats and (2) a lack of redundancy in vital system components, which increases the likelihood an attack could render an entire utility inoperable. According to over 90 percent of the experts, utilities serving high-density areas deserve at least a high priority for federal funding. Also warranting priority are utilities serving critical assets, such as military bases, national icons, and key academic institutions. Direct federal grants were clearly the most preferred funding mechanism, with over half the experts indicating that such grants would be "very effective" in distributing funds to recipients. Substantially fewer recommended using the Drinking Water State Revolving Fund for security upgrades. When asked to identify specific security-enhancing activities most deserving of federal support, experts' responses generally fell into three categories: (1) physical and technological upgrades to improve security and research to develop technologies to prevent, detect, or respond to an attack (experts most strongly supported developing near real-time monitoring technologies to quickly detect contaminants in treated drinking water on its way to consumers); (2) education and training to support, among other things, simulation exercises to provide responders with experience in carrying out emergency response plans; specialized training of utility security staff; and multidisciplinary consulting teams to independently analyze systems' security preparedness and recommend improvements; and (3) strengthening key relationships between water utilities and other agencies that may have key roles in an emergency response, such as public health agencies, law enforcement agencies, and neighboring drinking water systems; this category also includes developing protocols to encourage consistent approaches to detecting and diagnosing threats.