Remarks of Benjamin H. Grumbles
Assistant Administrator for Water
U.S. Environmental Protection Agency
at the
American Water Works Association’s Water Security Congress
Washington, D.C.

September 11, 2006

Introduction

Today, I will answer four key, inter-related questions: What is the general risk facing the water sector? How has our sector’s approach to reducing this risk evolved? What challenges influence our ability to improve security? And, what are EPA’s priorities to address these challenges and risks?

Risk Profile

Promoting the security of the nation’s water infrastructure is one of the most significant undertakings of the Agency in a post-September 11 world. In 2006, the Department of Homeland Security (DHS) released the National Infrastructure Protection Plan. This plan presents a strategic framework for guiding security efforts across all 17 critical infrastructure sectors in the United States. Its risk-based approach helps to set the context for our work in water security.

According to the Plan, understanding the risk profile of each sector involves a characterization of three factors: vulnerabilities, consequences, and the threat of an attack.

• With respect to the first factor, vulnerability, drinking water utilities can be vulnerable to a variety of attacks through physical assault, intentional contamination, and cyber intrusion.
• As for consequences, an attack, or in some instances even the threat of an attack, could seriously jeopardize the public health, economic vitality, and the general functioning of a community. Water is the lifeblood of communities. We had an unfortunate reminder of this point during this same time last year when communities throughout the Gulf Coast were faced with disruptions of service due to Hurricanes Katrina and Rita.
• The threat part of this risk equation remains the most challenging variable to characterize and to share. However, EPA is working with DHS and others within the intelligence community to produce an unclassified report on threats, which will be available to you very soon.

When we apply DHS’s formula to these three factors, the significant risk to the water sector cannot be discounted in its significance. And, out of diligence, we must add the risks from natural disasters and unintentional events to the overall assessment of risk from terrorism.

The chance that any of these scenarios—whether it be a terrorist attack or a natural event—will occur at any given utility may be relatively slight. But their potential catastrophic scope compels us all to consider an appropriate response and to prepare accordingly.

In many of our public health and environmental programs, EPA takes a probabilistic approach to problems. However, in facilitating the protection of the water sector, we also need to engage to some degree in “possibilistic” thinking when designing and implementing our water security program, as it is the possible and not the probable that in part guides our efforts in water security.

Over the past several years, EPA has worked hard to support the water sector in improving water security, and I am pleased to note that the sector has taken its charge very seriously. Overall, we have good news to report on our progress to date. However, much work remains to be done.

Water Security: State of the Nation

In assessing where we are now in the evolution of water security, I would identify four broad themes.

First, as a sector, we are moving from risk identification to risk reduction. The Bioterrorism Act of 2002 mandated that many utilities conduct vulnerability assessments and certify the updating of emergency response plans. EPA helped utilities by making more than $50 million available to complete vulnerability assessments and developing extensive technical guidance to help with both the assessments and emergency response plans. We are pleased that 100% of medium and large utilities have completed their assessments and updated their emergency response plans. For small systems, 98% have completed assessments and 95% have certified that they have updated their emergency response plans. With utilities having largely complied with these requirements, many within the sector have begun to reduce their risks.

The progression to risk reduction occurs as we are moving away from a statutory basis towards a voluntary basis for improving security, which is my second point. Utilities and communities are taking actions because they’re inspired, rather than required. If a utility’s water security program ends at preparing a vulnerability assessment, then it has reduced its risk only to a modest degree. We must encourage utilities, in the absence of a regulatory driver, to take the next critical step of adopting security measures that will reduce those high risks identified by a vulnerability assessment.

And our encouragement should reach not just some utilities, but all utilities, which brings me to the third point. While we are pleased to see many familiar faces at national and regional security conferences, we also need to reach out to those utilities which seem less motivated to address security risks. We have often heard at meetings such as this, the tired but true cliché that we are only as strong as our weakest link; that it may only take one utility to succumb to an intentional incident, for all of the sector to suffer some loss of the public’s confidence. Therefore, our programs must appeal to all utilities, irrespective of a utility’s perception of the security threat to its operations.

This need to reach all utilities leads me to my last point. Hurricanes Katrina and Rita’s devastation speaks directly to the need to adopt an all-hazards approach—an approach which promises multiple benefits to utilities. For example, a utility may not be concerned with terrorism, but the potential for hurricanes, earthquakes, power outages, or realizing operational efficiencies may resonate strongly with that utility.

A robust security program will enable utilities to prepare for an array of trying events, not only terrorism. This point is critical, otherwise security programs will be viewed as competing for limited resources with other equally important demands, such as aging infrastructure and regulatory compliance. At EPA, we are working with our partners in the sector to identify dual benefits to show how security programs can complement, and not just compete with, other priorities.

Challenges

In speaking about how water security has evolved, I have already touched on some of the challenges with which we, as a sector, must contend. We could spend a good portion of the day identifying such challenges. In fact you are, and you’re identifying solutions too. But I will just highlight what I perceive as key issues.

As you know, the Bioterrorism Act’s mandate to prepare vulnerability assessments was a one-time only requirement. Also, the law did not apply to utilities serving fewer than 3,300 people and to wastewater utilities of any size. It is important for all utilities regardless of size to participate in the nation’s efforts to protect its critical infrastructure. That many utilities have undertaken risk assessments voluntarily signals a major commitment to fully serving their communities.

Some drinking water systems, which completed their vulnerability assessments, have predictably asked, “we have identified our weaknesses, now what do we do?” While completing a vulnerability assessment is an important step, an awareness of threats, vulnerabilities, and consequences has not always translated into action and preparedness. One of the challenges we face, therefore, is not only raising awareness within the sector, but of defining what it means to be prepared, so as to transform awareness into action.

Along the same lines, sector representatives have expressed the need for clear expectations as to what constitutes effective security programs so that they can justify and obtain the resources needed to improve security and preparedness. And to reiterate an important point, these efforts are occurring within a voluntary, not a regulatory, context.

Another challenge involves the shared responsibility among utilities, responders, associations, public health agencies, the government and others in improving security and preparedness. In general, no single actor in this scheme can achieve the ultimate desired outcome of reducing risk without help from its partners. Indeed, partnerships are absolutely a key factor to our success, not only due to the size and diversity of the sector, but also due to the voluntary nature of the effort.

EPA’s Water Security Priorities

There is an Asian proverb: Vision without action is a daydream. Action without vision is a nightmare. So, in light of these challenges, what are EPA’s water security priority activities for the next year? While our ultimate vision of the program will remain the same—reducing risk to the sector—the specific projects which we undertake will change as our understanding of the threats, vulnerabilities, and consequences evolves.

EPA is working in close collaboration with the Water Sector Coordinating Council to develop a Sector Specific Plan. DHS convened these Sector Councils, which for our sector represents drinking water and wastewater utilities and their associations, in part to serve as focal points of input to the federal government’s homeland security efforts. The draft sector plan will be available for public comment sometime this winter. It will establish specific sector goals and objectives that will guide our collective efforts in implementing the strategy of the National Infrastructure Protection Plan.

Over the coming year, EPA will focus on several important areas, four of which I will mention today.

1) Mutual Aid Agreements

Large organizations often find themselves challenged during a catastrophic event. For this reason, we are working in partnership with AWWA to promote intra-state Mutual Aid Agreements among utilities. These agreements will expedite the rapid deployment of emergency support, including equipment and personnel, to restore critical operations as quickly as possible. Subsequent efforts at EPA will focus on promoting inter-state Mutual Aid Agreements.

2) 14 Features

Another priority effort involves defining and disseminating best security practices, or what we prefer to call, active and effective security programs. As you may know, last year the National Drinking Water Advisory Council recommended 14 features which constitute an effective security program. We are presently assessing whether available tools and training address each of these features. Through this analysis, we can compile a comprehensive resource guide for the sector and develop new tools where information gaps may exist.

A related effort involves the development of national aggregate measures so that, as required by the National Infrastructure Protection Plan, we can begin to gauge the sector’s progress in improving security. As you can likely guess, this task involves many challenging issues, which we will spend the next year addressing with utilities and other key stakeholders.

3) Emergency Response Planning

EPA also will continue its successful emergency response program for the water sector. Over the last four years, we have provided key tools, such as the CD-ROM emergency response exercises, and nationwide training to upwards of 10,000 utilities. This year, we are focusing our training on the Incident Command System to promote the integration of water utilities into the response structure. Our focus is on “all hazards, all utilities.”

4) Water Sentinel

Finally, EPA will continue our project, known as Water Sentinel, to design, deploy, and test contamination warning systems at pilot utilities. EPA has identified a series of potentially useful documents from this project, such as consequence management guidance, which we intend to disseminate to the water sector on an aggressive schedule—that is, we will not wait for the project’s conclusion in a few years before sharing vital lessons learned with you.

Conclusion

In conclusion, I wish to underscore the importance of effective partnerships. Some of our partnerships are long-standing and others are initiated or strengthened in response to incidents like 9/11 and Katrina. Regardless of their origin, we know that without such partnerships, we would not have achieved what we have to date, and we will not achieve what we need to in the future. No single government agency, program or initiative will result in sustained, strengthened water security. It requires all of us, partnering, collaborating, thinking outside of the box.

For the sake of improving security and preparedness, these partnerships extend beyond EPA, DHS and you—the utilities—or your associations. Effective partnerships should involve utilities reaching out to the entire community to include emergency responders, law enforcement, local public health agencies, state drinking water and homeland security agencies, the public, and likely others. Building our strength through diversity will help us to both prevent and respond to adversity.

Given the importance of partnerships, one of the most effective actions you can take to improve security in the short-term is to participate in the mutual aid effort—whether joining a mutual aid network in your state if one is available, or in working with your peers and associations like AWWA to establish one. As many of you already know, this action, in conjunction with forging partnerships with local and state emergency responders, will serve your community well.

On behalf of EPA, thank you again for your leadership and the opportunity to address the Security Congress today. I deeply appreciate the partnership we have with AWWA and its member utilities. Together we have accomplished much to provide Americans safe, secure and sustainable water infrastructure. I look forward to future collaborative efforts to advance our security and preparedness.

Reference Information | Web Satisfaction Survey

EPA Home | Privacy and Security Notice | Contact Us