This is the accessible text file for GAO report number GAO-06-390 
entitled 'Securing Wastewater Facilities: Utilities Have Made Important 
Upgrades but Further Improvements to Key System Components May Be 
Limited by Costs and Other Constraints' which was released on May 1, 
2006.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office:

GAO:

Report to the Chairman, Committee on Environment and Public Works, U.S. 
Senate:

March 2006:

Securing Wastewater Facilities:

Utilities Have Made Important Upgrades but Further Improvements to Key 
System Components May Be Limited by Costs and Other Constraints:

GAO-06-390:

GAO Highlights: 

Highlights of GAO-06-390, a report to the Chairman, Committee on 
Environment and Public Works, U.S. Senate.

Why GAO Did This Study: 

Wastewater facilities provide essential services to residential, 
commercial, and industrial users, yet they may possess certain 
characteristics that terrorists could exploit to impair the wastewater 
treatment process or to damage surrounding infrastructure.  For 
example, large underground collector sewers could be accessed by 
terrorists for purposes of placing destructive devices beneath 
buildings or city streets.  

GAO was asked to determine (1) what federal statutory authorities and 
directives govern the protection of wastewater treatment facilities 
from terrorist attack, (2) what steps critical wastewater facilities 
have taken since the terrorist attacks of September 11, 2001, (9/11) to 
ensure that potential vulnerabilities are addressed, and (3) what steps 
the Environmental Protection Agency (EPA) and the Department of 
Homeland Security (DHS) have taken to help these facilities in their 
efforts to address such vulnerabilities.
 
What GAO Found: 

Federal law does not address wastewater security as comprehensively as 
it does drinking water security.  For example, the Public Health 
Security and Bioterrorism Preparedness and Response Act of 2002 
required drinking water facilities serving populations greater than 
3,300 to complete vulnerability assessments, but no such requirement 
exists for wastewater facilities.  While federal law governing 
wastewater security is limited, Homeland Security Presidential 
Directive 7 designated EPA as the lead agency to oversee the security 
of the water sector, including both drinking water and wastewater.  The 
directive tasked EPA with several responsibilities, including the 
development of mechanisms for information sharing and analysis within 
the water sector.

Our survey of over 200 of the nation’s large wastewater facilities 
shows that many have made security improvements since 9/11.  Most 
facilities indicated they have completed, have under way, or plan to 
complete some type of security assessment.  Similarly, more than half 
of responding facilities indicated they did not use potentially 
dangerous gaseous chlorine as a wastewater disinfectant.  Survey 
responses show that other security measures taken after 9/11 have 
generally focused on controlling access to the treatment plant through 
improvements in visual surveillance, security lighting, and employee 
and visitor identification.  Little effort, however, has been made to 
address collection system vulnerabilities, as many facilities cited the 
technical complexity and expense involved in securing collection 
systems that cover large areas and have many access points.  Others 
reported that taking other measures, such as converting from gaseous 
chlorine, took priority over collection system protections.

While EPA and DHS have initiatives to address wastewater facility 
security, efforts to provide critical and threat-related information 
would benefit from closer coordination.  EPA and DHS fund multiple 
information services designed to communicate information to the water 
sector—specifically, EPA funds the Water Information Sharing and 
Analysis Center (WaterISAC) and its Water Security Channel, while DHS 
funds the Homeland Security Information Network (HSIN).  EPA, DHS, and 
other industry experts are concerned that these multiple information 
services may overlap and produce inefficiencies.  For example, a 
substantial part of the $2 million annual grant EPA uses to fund the 
WaterISAC is dedicated to purchasing computer services likely available 
through DHS and HSIN at no cost.  A Water Sector Coordinating Council 
was established by the water sector to help determine the appropriate 
relationship among these information services.  A preliminary review is 
under way to examine options for improving coordination between the 
WaterISAC, the Water Security Channel, and HSIN; however, the scope and 
time frame for completion of this review is unclear.       

What GAO Recommends: 

GAO is recommending that EPA work with DHS to identify areas where the 
WaterISAC and HSIN could be better coordinated, focusing on (1) how 
duplications and overlap could be addressed, and (2) how water systems’ 
access to critical  information could be improved.  GAO also recommends 
that EPA help identify time frames to complete these tasks.  EPA and 
DHS generally agreed with the report. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-390].

To view the full product, including the scope
and methodology, click on the link above.
For more information, contact John Stephenson at (202) 512-3841 or 
stephensonj@gao.gov. 

[End of Section]

Contents:

Letter:

Results in Brief:

Background:

Federal Laws and Directives Related to Wastewater Security Are Limited:

Many Large Wastewater Facilities Have Made Security Improvements but 
Efforts to Protect Collection Systems Have Been Limited:

EPA and DHS Have Several Initiatives to Enhance Wastewater Facility 
Security, Yet a Key Effort Requires Additional Coordination:

Conclusions:

Recommendation for Executive Action:

Agency Comments and Our Evaluation:

Appendixes:

Appendix I: Scope and Methodology:

Appendix II: Survey of Wastewater Treatment Facilities:

Appendix III: Comments from the Environmental Protection Agency:

Appendix IV: GAO Contact and Staff Acknowledgments:

Table:

Table 1: Wastewater Facility Managers' Opinions on Recommended Federal 
Role:

Figures:

Figure 1: Vulnerability and Security Assessments at Large Wastewater 
Facilities:

Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities:

Figure 3: Security Measures at Large Wastewater Facilities That Still 
Use Gaseous Chlorine:

Figure 4: Security Measures at Large Wastewater Facilities:

Abbreviations:

AMWA: Association of Metropolitan Water Agencies:

ASCE: American Society of Civil Engineers:

CWNS: Clean Watershed Needs Survey:

CWSRF: Clean Water State Revolving Fund:

DHS: Department of Homeland Security:

EPA: Environmental Protection Agency:

HSIN: Homeland Security Information Network:

HSPD: Homeland Security Presidential Directive:

ISAC: Information Sharing and Analysis Center:

MOU: memorandum of understanding:

NACWA: National Association of Clean Water Agencies:

NDWAC: National Drinking Water Advisory Council:

POTW: publicly-owned treatment works:

RAM-W: Risk Assessment Methodology for Water Utilities:

RMP: Risk Management Plan:

SCADA: Supervisory Control and Data Acquisition:

SEMS: Security and Emergency Management System:

VSAT: Vulnerability Self Assessment Tool:

WEF: Water Environment Federation: 

United States Government Accountability Office:
Washington, DC 20548:

March 31, 2006:

The Honorable James M. Inhofe: 
Chairman: 
Committee on Environment and Public Works: 
United States Senate:

Dear Mr. Chairman:

Wastewater facilities in the United States provide essential services 
to residential, commercial, and industrial users by collecting and 
treating wastewater and discharging treated effluent into receiving 
waters. These facilities may also provide opportunities for terrorists 
to either impair the wastewater treatment process or damage surrounding 
communities and infrastructure. For example, damage to a wastewater 
facility or collection system could prevent water from being treated, 
impacting downriver water intakes. Destroying tanks that hold large 
amounts of chemicals at treatment plants could release toxic chemical 
agents, such as gaseous chlorine, that can be deadly if inhaled and, at 
lower doses, could burn eyes and skin and inflame the lungs. Large 
underground collector sewers could be accessed by terrorist groups for 
purposes of placing destructive devices beneath buildings or city 
streets.

In January 2005, we reported the views of nationally recognized experts 
on key issues concerning wastewater security.[Footnote 1] The five 
assets experts considered most vulnerable included (1) the collection 
systems' network of sewer lines used to move wastewater away from its 
point of origination to the treatment plant; (2) treatment chemicals, 
such as gaseous chlorine, used to disinfect wastewater; (3) key 
components of the wastewater treatment plant, such as its headworks, 
where raw sewage first enters the plant; (4) automated control systems 
that control many vital operations, such as the amount of chlorine 
needed for disinfection; and (5) pumping stations along the collection 
system that lift or pump wastewater to the treatment plant. The experts 
noted that security-enhancing activities that most warrant federal 
support include replacing gaseous chemicals used in wastewater 
treatment with less hazardous alternatives; improving local, state, and 
regional collaboration efforts; and completing vulnerability 
assessments for individual wastewater systems. When asked how federal 
wastewater security funds should be allocated among potential 
recipients, the vast majority of experts suggested that wastewater 
utilities serving critical infrastructure (e.g., public health 
institutions, government, commercial, and industrial centers) should be 
given the highest priority. Other recipients warranting highest 
priority included utilities using large quantities of gaseous chemicals 
and utilities serving areas with large populations.

As a follow-on to that review, this report examines: (1) what federal 
statutory authorities and directives govern the protection of 
wastewater treatment facilities from terrorist attack, (2) what steps 
critical wastewater treatment facilities have taken since the terrorist 
attacks of September 11, 2001, (hereafter referred to as "9/11") to 
ensure that potential vulnerabilities are addressed, and (3) what steps 
the Environmental Protection Agency (EPA) and the Department of 
Homeland Security (DHS) have taken to help these facilities in their 
efforts to address such vulnerabilities.

To identify federal statutory authorities and directives that govern 
protection of wastewater treatment facilities, we reviewed applicable 
laws; Homeland Security Presidential Directives; and EPA and DHS 
policies, guidance, and regulations related to wastewater security. To 
determine what steps critical wastewater treatment facilities have 
taken since 9/11 to ensure that potential vulnerabilities are 
addressed, we conducted a Web-based survey of the nation's publicly- 
owned treatment works (POTWs) that serve residential populations of 
100,000 or greater. Together, these facilities provide wastewater 
service to approximately 36 percent of the U.S. population served by 
POTWs. We received an 82 percent response rate to the survey. To 
determine what steps EPA and DHS have taken to help these facilities in 
their efforts to address such vulnerabilities, we reviewed relevant EPA 
and DHS guidance and other documents, and interviewed agency personnel. 
We also interviewed state and local officials with oversight for 
wastewater treatment operations and security. Information about federal 
efforts to enhance wastewater security from the perspective of 
wastewater treatment facilities was provided to us through our Web- 
based survey. We conducted our work between May 2005 and February 2006 
in accordance with generally accepted government auditing standards. 
See appendix I for a more detailed discussion of our scope and 
methodology.

Results in Brief:

Federal law does not address wastewater security as comprehensively as 
it does drinking water security. In particular, wastewater facilities 
are not required by law to complete vulnerability assessments. This 
stands in contrast to the requirements for drinking water utilities in 
the Public Health Security and Bioterrorism Preparedness and Response 
Act of 2002 (the Bioterrorism Act),[Footnote 2] which required drinking 
water utilities serving populations greater than 3,300 to complete 
vulnerability assessments by June 2004. The Clean Air Act does require 
wastewater facilities using more than 2,500 pounds of gaseous chlorine 
to submit to EPA a risk management plan that lays out accident 
prevention and emergency response activities. Also, under EPA guidance, 
the Clean Water State Revolving Fund program, administered by the 
states with EPA funding to help local governments meet their wastewater 
treatment needs, can be used in many instances for certain wastewater 
system security enhancements. While federal statutes governing 
wastewater security are limited, in December 2003, the president issued 
Homeland Security Presidential Directive 7 (HSPD-7), designating EPA as 
the lead agency to oversee the security of the water sector (including 
both drinking water and wastewater). Under the directive, EPA is 
responsible for (1) identifying, prioritizing, and coordinating 
infrastructure protection activities for the nation's drinking water 
and water treatment systems; (2) working with federal departments and 
agencies, state and local governments, and the private sector to 
facilitate vulnerability assessments; (3) encouraging the development 
of risk management strategies to protect against, and mitigate the 
effects of, potential attacks on critical resources; and (4) developing 
mechanisms for information sharing and analysis.

Our survey of large wastewater facilities indicates that many have made 
security improvements since 9/11. While not required, most facilities 
indicated they have completed, have under way, or plan to complete some 
type of security assessment. For example, 51 percent of facilities 
responding to our survey indicated that they either completed a 
vulnerability assessment similar to that required of drinking water 
facilities under the Bioterrorism Act, or have one currently under way. 
In addition, another 23 percent of facilities reported that they have 
conducted, had under way, or planned to conduct, some type of security 
assessment. Survey responses show that security measures undertaken by 
large wastewater facilities after 9/11 have generally focused on 
controlling access to the treatment plant through improvements in 
visual surveillance, security lighting, and employee and visitor 
identification. Survey results also show that facilities are continuing 
to move away from the use of gaseous chlorine as a wastewater 
disinfectant. Fifty-six percent of facilities indicated they do not use 
chlorine gas as a wastewater disinfectant, while another ten percent 
indicated they plan to stop using the gas. Importantly, survey results 
show that facilities have taken little action to address collection 
system vulnerabilities. Many facilities cited a shortage of the 
considerable funds required to secure a collection system that covers a 
large area and has many, often remote, access points. Consequently, few 
have installed, or plan to install, manhole intrusion sensors, manhole 
locks, or sensors to detect toxics or other biochemical threats to 
their collection system. Others reported that taking other measures, 
such as converting from gaseous chlorine to a safer disinfection 
process, took priority over protecting infrastructure in their 
collection systems. Survey results show that a lack of funding and 
federal security guidelines remain a concern for many wastewater 
facility managers. For its part, EPA is funding efforts to develop 
security guidance related to wastewater collection systems that should 
help inform wastewater facility managers of security options in this 
area.

While EPA and DHS have several initiatives under way to address the 
security concerns of wastewater facility managers, efforts to provide 
critical and threat-related information would benefit from additional 
coordination. EPA and DHS fund multiple information services designed 
to communicate information to the water sector. Specifically, EPA funds 
the Water Information Sharing and Analysis Center (WaterISAC) and its 
Water Security Channel, while DHS funds the Homeland Security 
Information Network (HSIN). EPA, DHS, and other industry experts have 
expressed concern that these multiple information services may overlap 
and produce inefficiencies. A Water Sector Coordinating Council was 
created with representative members of the water community to, among 
other things, identify the appropriate use of and the relationship 
among the WaterISAC, the Water Security Channel, and HSIN. We believe 
that steps could be taken that would improve the efficiency with which 
limited available funds are being spent to communicate information to 
the water sector. For example, a substantial part of the $2 million 
annual grant EPA uses to fund the WaterISAC is dedicated to purchasing 
computer services likely available through DHS and HSIN at no cost. 
According to EPA, a preliminary review is under way by the Water Sector 
Coordinating Council that examines options for improving coordination 
between the WaterISAC, the Water Security Channel, and HSIN. However, 
the scope of the preliminary review is not clear, nor is a time frame 
set to complete the review. Consequently, we are recommending that the 
Administrator of EPA work with DHS and the Water Sector Coordinating 
Council to identify areas where the WaterISAC and HSIN networks could 
be better coordinated, focusing in particular on (1) how operational 
duplications and overlap could be addressed, and (2) how water systems' 
access to timely security threat information could be improved. We are 
also recommending that EPA work with DHS and the Water Sector 
Coordinating Council to identify realistic time frames for the 
completion of these tasks.

Background:

Nationwide, more than 16,000 POTWs serve more than 200 million people, 
or about 70 percent of the nation's total population. The remaining 
population is served by privately-owned utilities or by on-site 
systems, such as septic tanks. A relative handful of large wastewater 
systems serve the great majority of people, as about 500 large public 
wastewater systems provide service to 62 percent of the population 
connected to a sewer system. In addition to serving residential 
populations, approximately 27,000 commercial and industrial facilities 
rely on wastewater treatment facilities to treat their wastewater. 
POTWs discharge treated effluent into receiving waters and are 
regulated under the Clean Water Act.

Wastewater systems vary by size and other factors, but all include a 
collection system and a treatment facility.

* The collection system is the underground network of sewers including 
both sanitary and storm water collection lines. Collection systems tend 
to be dispersed geographically and have multiple access points, 
including drains, catch basins, and manholes. Lines may range from 4 
inches to greater than 20 feet in diameter, and access is usually 
conducted through manholes that are typically 300 feet apart. Many 
collection systems rely on gravity to maintain the flow of sewage 
through the pipes toward the treatment plant. However, collection 
systems may also depend on pumping stations to propel the flow when 
gravity alone is insufficient. Nationwide, there are approximately 
800,000 miles of sewer lines and 100,000 major pumping stations.

* The wastewater treatment facility receives wastewater from the 
collection system and begins the treatment process which typically 
involves several stages before treated effluent is released into 
receiving waters. Primary treatment includes removal of larger objects 
through a screening device or a grit removal system, and the removal of 
solids through sedimentation. Secondary stage treatment includes a 
biological process that consumes pollutants, as well as final 
sedimentation. Some facilities also use tertiary treatment to remove 
nutrients and other matter even further. Following these treatments, 
the wastewater is disinfected to destroy harmful bacteria and viruses. 
Disinfection is often accomplished with chlorine, which is stored in 
gaseous or liquid form on-site at the wastewater treatment plant. The 
collection system and treatment process is typically monitored and 
controlled by a Supervisory Control and Data Acquisition (SCADA) 
system, which allows utilities to control such things as the amount of 
chlorine needed for disinfection.

Wastewater treatment facilities may possess certain characteristics 
that terrorists could exploit either to impair the wastewater treatment 
process or to damage surrounding communities and infrastructure. For 
example, the numerous storm drains, manholes, and sewers that make up a 
community's wastewater collection system's network of sewers could be 
used to covertly place explosives beneath a major population center or 
to introduce substances that may damage a wastewater treatment plant's 
process. Damage to (or destruction of) tanks that hold large amounts of 
gaseous chlorine used to disinfect wastewater could release the 
potentially lethal gas into the atmosphere. Such events could result in 
loss of life, destruction of property, and harm to the environment.

Documented accidents and intentional acts highlight the destruction 
that could arise from an attack on a wastewater system.

* In June 1977 in Akron, Ohio, an intentional release of naptha, a 
cleaning solvent, and alcohol into a sewer by vandals at a rubber 
manufacturing plant caused explosions 3.5 miles away from the plant, 
damaging about 5,400 feet of sewer line and resulting in more than $10 
million in damage.

* In 1981 in Louisville, Kentucky, thousands of gallons of a highly 
flammable solvent, hexane, spilled into the sewer lines from a local 
processing plant. Fumes from the solvent ignited, and the resulting 
explosions collapsed a 12-foot diameter pipe and damaged more than 2 
miles of streets. No one was seriously injured, but sewer line repairs 
took 20 months, followed by several more months to repair the streets.

* In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused 
explosions that killed 215 people, injured 1,500 others, damaged 1,600 
buildings, and destroyed 1.25 miles of sewer.

* In 2002 in Hagerstown, Maryland, chemicals from an unknown source 
entered the wastewater treatment plant and destroyed the facility's 
biological treatment process. The event resulted in the discharge of 
millions of gallons of partially treated sewage into a major tributary 
of the Potomac River, less than 100 miles from a water supply intake 
for the Washington, D.C., metropolitan area.

In January 2005, we reported the views of 50 nationally recognized 
experts on key issues concerning wastewater security. Our panel of 
experts identified five key wastewater assets as most vulnerable to 
terrorist attacks: the collection systems' network of sewers (42 of 50 
experts), treatment chemicals (32 of 50 experts), key components of the 
treatment plant (29 of 50 experts), control systems (18 of 50 experts), 
and pumping stations (16 of 50 experts). When asked to identify and set 
priorities for the security-enhancing activities most deserving of 
federal support, the expert panel identified 11 key actions, but ranked 
three as deserving highest priority--replacing gaseous chemicals used 
in the wastewater treatment process; improving local, state, and 
regional efforts to coordinate responses in advance of a potential 
terrorist threat; and completing vulnerability assessments for 
individual wastewater systems.

Federal Laws and Directives Related to Wastewater Security Are Limited:

Federal law does not address wastewater security as comprehensively as 
it does drinking water security. In particular, wastewater facilities 
are not required by law to complete vulnerability assessments. The 
Clean Air Act does require wastewater facilities using certain amounts 
of hazardous substances, such as chlorine gas, to submit to EPA a risk 
management plan that lays out accident prevention and emergency 
response activities. Also, under EPA guidance, the Clean Water State 
Revolving Fund can be used in many instances for certain wastewater 
system security enhancements. While federal law governing wastewater 
security is limited, in December 2003, the president issued HSPD-7. The 
directive designated EPA as the lead agency to oversee the security of 
the water sector, including both drinking water and wastewater critical 
infrastructures.

Federal Law Does Not Address Wastewater Security As It Does Drinking 
Water:

In 2002, Congress passed the Bioterrorism Act, which amended various 
laws, including the Safe Drinking Water Act.[Footnote 3] The 
Bioterrorism Act required drinking water systems serving more than 
3,300 people to complete vulnerability assessments of their facilities 
by June 2004 and to prepare or update an existing emergency response 
plan. The Bioterrorism Act required the assessments to include, but not 
be limited to, a review of six components: (1) pipes and constructed 
conveyances; (2) physical barriers; (3) water collection, pretreatment, 
treatment, storage, and distribution facilities; (4) electronic, 
computer, or other automated systems which are utilized by the public 
water system; (5) the use, storage, or handling of various chemicals; 
and (6) the operation and maintenance of such systems.[Footnote 4] 
Under the act, the emergency response plans were to include plans, 
procedures, and identification of equipment to lessen the impact on 
public health and the drinking water supply of terrorist attacks or 
other intentional acts against drinking water systems. The act 
authorized $210 million for fiscal year 2002, mostly to assist drinking 
water systems in completing vulnerability assessments, preparing or 
updating response plans, and making needed security improvements. 
Drinking water systems are not required to implement any risk-reduction 
actions based on their vulnerability assessments or report to EPA on 
measures that have been implemented.

In 2003, the Congress considered alternative bills that would have 
encouraged or required wastewater treatment plants to assess the 
vulnerability of wastewater facilities, make physical security 
improvements, and conduct research. However, the legislation did not 
become law and, consequently, no such requirement or specific funding 
exists for wastewater facilities.

Other Federal Environmental Laws Address Some Areas of Security at 
Wastewater Facilities:

While federal law does not require wastewater systems to take security 
measures to protect specifically against a terrorist attack, it does 
require certain wastewater facilities to take security precautions that 
could mitigate the consequences of such an attack. For example, the 
1990 Clean Air Act amendments[Footnote 5] mandated EPA oversight of 
risk management planning at facilities that handle more than specified- 
threshold quantities of hazardous substances, including the gaseous 
chlorine often used as a disinfectant at wastewater 
facilities.[Footnote 6] Specifically, EPA regulations implementing the 
Clean Air Act require these facilities to prepare Risk Management Plans 
(RMPs) that summarize the potential threat of sudden, accidental, large 
releases of certain chemicals; including the results occurring off-site 
in a worst-case chemical accident, and the facility's plan to prevent 
releases and mitigate any damage. RMPs are to be revised and 
resubmitted to EPA at least every 5 years, and EPA is required to 
review them and require revisions, if necessary.

For a March 2003 report,[Footnote 7] EPA told us it believed the Clean 
Air Act could be interpreted to provide authority to address site 
security from terrorist attacks at RMP facilities, because the act 
imposes certain requirements on these facilities regarding "accidental 
releases." The act defines an accidental release as an unanticipated 
emission of a regulated substance or other extremely hazardous 
substance into the air, so any chemical release caused by a terrorist 
attack could be considered "unanticipated" and covered under the Clean 
Air Act. Such an interpretation would provide EPA with authority under 
the act's RMP provisions and general duty clause[Footnote 8] to require 
security measures or vulnerability assessments with regard to 
terrorism. However, EPA has not attempted to use these Clean Air Act 
provisions because it is concerned that such an interpretation would 
pose significant litigation risk and has concluded that chemical 
facility security would be more effectively addressed by passage of 
specific legislation.

Wastewater facilities that store certain amounts of hazardous chemicals 
may also be subject to the Resource Conservation and Recovery 
Act.[Footnote 9] Under regulations implementing the act, facilities 
that house hazardous waste generally must take certain security 
actions, such as posting warning signs and using a 24-hour surveillance 
system, or surrounding the active portion of the facility with a 
barrier and controlled entry gates.[Footnote 10] However, according to 
EPA, these security measures are aimed at keeping out trespassers or 
wanderers, not intentional intruders.

Other federal statutes impose safety requirements on certain wastewater 
facilities that may incidentally reduce the likelihood and mitigate the 
consequences of terrorist attacks. For example, the Occupational Safety 
and Health Act[Footnote 11] imposes a number of safety requirements, 
including a general duty to furnish a workplace free from recognized 
hazards that may cause death or serious physical harm to employees. The 
Emergency Planning and Community Right-to-Know Act[Footnote 12] 
requires owners of facilities that maintain specified quantities of 
certain extremely hazardous chemicals to submit information annually on 
their chemical inventory to state and local emergency response 
officials. The act also requires that each state establish a State 
Emergency Response Commission to oversee local emergency planning and 
create local emergency planning committees. These committees must 
develop and periodically review their communities' emergency response 
plans, including the identification of chemical facilities, and outline 
procedures for response personnel to follow in the event of a chemical 
incident.

Aside from statutes that address some areas of wastewater security, EPA 
has asserted that federal funding is available for wastewater security- 
related measures through the Clean Water State Revolving Fund (CWSRF) 
program.[Footnote 13] The CWSRF is an EPA-administered program that 
provides grants to the states to fund a variety of water-quality 
projects, including those at municipal wastewater treatment facilities. 
States may use the funds to provide loans to local governments to 
assist wastewater utilities in making infrastructure improvements 
needed to protect public health and ensure compliance with the Clean 
Water Act. According to EPA, states may use the CWSRF to assist 
utilities in completing a variety of security-related actions, such as 
vulnerability assessments, contingency plans, and emergency response 
plans. In addition, EPA has identified other infrastructure 
improvements that may be eligible for funding, such as the conversion 
from gaseous chemicals to alternative treatment processes, installation 
of fencing or security cameras, securing large sanitary sewers, and 
installing tamper-proof manholes.[Footnote 14] In our January 2005 
report summarizing experts' views on wastewater security, a number of 
experts expressed caution about relying heavily on the CWSRF program to 
support security enhancements, largely because of the time-lag in 
obtaining funds for security-related measures, and because such demands 
on the CWSRF would divert needed funding away from the kind of critical 
infrastructure investments that are the CWSRF program's primary purpose.

Another source of federal funding potentially available for wastewater 
security-related measures is the State Homeland Security Grant Program 
administered by DHS. This program's primary objectives are to enhance 
the capacity of state and local emergency responders to prevent, 
protect against, respond to, and recover from terrorist incidents 
involving chemical, biological, radiological, nuclear, and explosive 
devices; agriculture; and cyber attacks. Under the program, grants are 
provided to states for a variety of purposes, including homeland 
security-related training and protection of critical infrastructure, 
although authority to make physical security improvements is limited. 
States are required to allocate at least 80 percent of these grant 
funds to "local units of governments," which, as defined in the 
conference report accompanying the Department of Homeland Security 
Appropriations Act for fiscal year 2006, include water districts, 
special districts, and other political subdivisions of a state.

EPA Was Assigned Lead Federal Responsibility for Water-Sector Security 
Including Wastewater Facilities:

In December 2003, the president issued HSPD-7, which established a 
national policy for federal departments and agencies to identify and 
set priorities for the nation's critical infrastructures and to protect 
them from terrorist attacks. HSPD-7 established EPA as the lead federal 
agency to oversee the security of the water sector, both drinking water 
and wastewater. Presidential Decision Directive 63 had done so earlier 
in May 1998, with a focus primarily on water supply.

Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and 
coordinating infrastructure protection activities for the nation's 
drinking water and water treatment systems; (2) working with federal 
departments and agencies, state and local governments, and the private 
sector to facilitate vulnerability assessments; (3) encouraging the 
development of risk management strategies to protect against and 
mitigate the effects of potential attacks on critical resources; and 
(4) developing mechanisms for information sharing and analysis.

HSPD-7 also called for DHS to integrate all critical infrastructure 
security efforts among federal agencies and to complete a comprehensive 
national plan for critical infrastructure and key resource protection-
-now called the National Infrastructure Protection Plan. Under HSPD-7, 
seven federal agencies, including EPA, were designated sector-specific 
agencies. DHS issued guidance tasking each sector-specific agency with 
developing sector-specific plans for input into the comprehensive plan. 
Each sector-specific plan is supposed to outline strategies for (1) 
collaborating with all relevant federal departments and agencies, state 
and local governments, and the private sector; (2) identifying assets; 
(3) conducting or facilitating vulnerability assessments; and (4) 
encouraging risk management strategies to protect against and mitigate 
the effects of an attack. The water sector-specific plan will be an 
appendix to the National Infrastructure Protection Plan. On January 20, 
2006, DHS issued its revised National Infrastructure Protection Plan 
based on comments it received on an earlier version of the plan. DHS 
accepted additional comments on the revised version until February 6, 
2006, and expects to issue a final version of the plan later in 2006. 
Sector-specific agencies are required to submit their sector-specific 
plans to DHS within 6 months after the National Infrastructure 
Protection Plan is made final.

Many Large Wastewater Facilities Have Made Security Improvements but 
Efforts to Protect Collection Systems Have Been Limited:

Our survey of large wastewater facilities indicates that many have 
taken steps to improve security. Most facilities that responded to our 
survey have completed, have under way, or plan to complete some type of 
security assessment. Roughly two-thirds of facilities also reported 
they used a disinfectant other than gaseous chlorine or plan to switch 
from the gas. Of those facilities that continue to use gaseous 
chlorine, many have taken steps to increase security by limiting and 
monitoring access to gaseous chlorine storage areas or through other 
actions. Survey responses show that since 9/11, wastewater treatment 
facilities have also focused security efforts on controlling and 
limiting access to their treatment plants. Importantly, facilities have 
taken fewer security actions intended to protect treatment collection 
systems. Many facilities reported that taking other measures to protect 
their treatment plants, including converting from gaseous chlorine to a 
safer disinfection process, took priority over protecting 
infrastructure in their collection systems. Survey results show a lack 
of funding and federal security guidelines remain a concern for many 
wastewater facility managers.

Most Facilities Have Conducted or Plan to Conduct Some Type of Security 
Assessment:

Seventy-four percent of facilities that responded to our survey 
reported they completed, were in the process of completing, or planned 
to complete some type of security assessment--either a vulnerability 
assessment, similar to that which was required of drinking water 
facilities under the Bioterrorism Act, or another type of security 
assessment. As shown in figure 1, 106 facilities--or 51 percent of 
those responding to our survey--indicated that they had completed a 
vulnerability assessment or were currently conducting a vulnerability 
assessment.

Figure 1: Vulnerability and Security Assessments at Large Wastewater 
Facilities:

[See PDF for image] 

Source: GAO survey of wastewater facilities.

[End of figure] 

Of the 106 facilities that indicated they had either completed a 
vulnerability assessment or had one under way, 80 indicated their 
vulnerability assessments were complete, while 26 indicated the 
assessment was still in process. As shown in the figure, 22 facilities-
-or 11 percent of all responses--indicated they had conducted another 
type of security assessment or were in the process of conducting 
another type of security assessment, while 24 facilities--or 12 percent 
of all responses--indicated they plan to conduct either a vulnerability 
or another type of security assessment.

Twenty-three facilities--or 11 percent of total responses--indicated 
they had no plans to conduct any type of security assessment. When 
asked to identify reasons for not conducting a vulnerability or 
security assessment, 17 of these 23 facilities cited a lack of 
requirement to do so, while 15 noted that they considered security 
actions taken at their facilities adequate for their security needs. 
Thirteen of these facilities indicated that their emergency response 
plan was updated and this seemed sufficient to address potential 
vulnerabilities.

Facilities cited several reasons for completing a vulnerability or some 
other type of security assessment, but most--roughly 77 percent-- 
reported doing so on their own initiative. Thirty-seven percent of 
facilities reported that they did so in conjunction with the required 
assessment for their drinking water facility.[Footnote 15] To a lesser 
extent, facilities cited state, local, and utility governing-body 
requirements as reasons they conducted assessments. See appendix II for 
survey results related to vulnerability and security assessments at 
large wastewater facilities.

Most Large Facilities Have Discontinued or Plan to Discontinue Use of 
Gaseous Chlorine, and Chlorine Users Have Pursued Other Security 
Enhancements:

As shown in figure 2, over half of large wastewater facilities in our 
survey reported they use an alternative to gaseous chlorine in their 
disinfection process. These results are consistent with studies which 
conclude that over the past decade, wastewater treatment facilities 
have moved away from gaseous chlorine as a disinfectant.

Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities:

[See PDF for image] 

Source: GAO survey of wastewater facilities. 

Note: Totals do not add to 100 percent due to rounding.

[End of figure] 

Of the facilities not using gaseous chlorine, 89 reported using sodium 
hypochlorite as their primary disinfectant. Sodium hypochlorite is 
essentially a strong version of household bleach and is considered 
safer than gaseous chlorine. Seventeen facilities report they are using 
ultraviolet light as their primary disinfectant. The remaining 
facilities did not identify the type of disinfectant method used at 
their facility.

In our January 2005 report, we noted that the change, for an individual 
plant, to sodium hypochlorite may require approximately $12.5 million 
for new equipment and increase annual chemical costs from $600,000 for 
gaseous chlorine to over $2 million for sodium hypochlorite. However, 
one expert noted some costs may be offset through savings in regulatory 
paperwork and certain emergency planning efforts. In our survey, we 
asked facilities that switched from gaseous chlorine if their annual 
costs increased, stayed the same, or decreased after switching to an 
alternate disinfection method. Fifty-eight facilities reported that 
costs increased, 11 noted that costs have stayed about the same, and 
one facility reported that costs decreased.

Of the 85 facilities that reported use of gaseous chlorine, 20--or 
roughly 10 percent of all 206 reporting facilities--indicated that they 
have plans to switch from gaseous chlorine to another disinfectant. In 
addition, as shown in figure 3, many reported taking additional steps 
after 9/11 to mitigate the potential risks associated with continued 
reliance on chlorine.

Figure 3: Security Measures at Large Wastewater Facilities That Still 
Use Gaseous Chlorine:

[See PDF for image] 

Source: GAO survey of wastewater facilities. 

[A] Other physical improvements include, among others, improvements to 
gates and fencing; physical barriers, security guards, intrusion alarms 
and motion detectors; and enclosure of the chlorine storage area. 
Results are based on 85 facilities that reported using gaseous chlorine 
as a primary disinfectant.

[End of figure] 

Forty-one facilities using gaseous chlorine reported that they 
instituted controls for selective access to chlorine storage areas 
after 9/11, while 30 facilities reported making other security 
improvements to the storage area, such as installing electronic 
surveillance of the chlorine storage area or improving gates and 
fencing. Fewer facilities reported that they decided to store gaseous 
chlorine in smaller-quantity containers, likely because most reported 
they already stored the gas in one-ton containers, which are among the 
smallest containers used at large wastewater facilities for the 
gas.[Footnote 16] See appendix II for survey results on gaseous 
chlorine use at large wastewater facilities.

Security Efforts Have Generally Focused on Improved Control of 
Wastewater Treatment Plant Access, While Efforts to Protect Collection 
Systems Have Been Limited:

As shown in figure 4, many facilities reported taking basic security 
measures prior to 9/11, such as installing vehicle gates and security 
fencing. Survey respondents also indicated that many information 
technology security measures, such as virus protection programs, backup 
power supplies, and firewall and intrusion detection systems, were 
implemented before 9/11.

The figure shows that security enhancements made or planned by large 
wastewater facilities after 9/11 generally focus on controlling access 
to the treatment plant. Such security enhancements include adding 
visual surveillance monitoring, increasing security lighting, 
implementing employee and visitor identification policies, adding guard 
stations, and upgrading SCADA capability and security.

Importantly, few facilities reported taking measures to address 
collection system vulnerabilities other than having available redundant 
pumping devices or collection bypass systems. For example, few have 
installed or plan to install manhole intrusion sensors, manhole locks, 
or sensors to detect toxics or other biochemical threats to their 
collection systems. This lack of attention to collection system 
vulnerabilities is important because 42 of the 50 experts polled in our 
January 2005 report on wastewater security identified the collection 
systems' network of sanitary, storm, and combined sewers as the most 
vulnerable asset of a wastewater utility. Several noted that sewers 
make underground travel from a point of entry to a potential target 
almost undetectable, possibly allowing sewers to be used as an 
underground transport system for explosive or toxic agents.

Many facilities reported that other measures to protect their treatment 
plants, including converting from gaseous chlorine to a safer 
disinfection process, took priority over protecting infrastructure in 
their collection systems. Other managers cited the difficulty and 
expense in securing collection systems that, by nature, cover a large 
area and have many, often remote, access points. One manager expressed 
confusion about whether to concentrate monitoring resources on large 
interceptor sewer lines to prevent entry or on toxic materials that 
could be introduced at nearly every access point to his system. Others 
noted the lack of facility control over collection systems. One 
facility manager told us his facility treats wastewater that is 
collected from 17 separate collection systems. Finally, a number of 
respondents questioned whether the technologies purportedly available 
to detect potential threats introduced to collection systems are 
sufficiently capable of achieving this objective.

Figure 4: Security Measures at Large Wastewater Facilities:

[See PDF for image] 

Source: GAO survey of wastewater facilities. 

Note: Figure is based on results from 206 wastewater facilities.

[End of figure] 

Nonetheless, a few facility managers with whom we spoke told us they 
have made efforts to address collection system security, particularly 
in the protection of their pump stations. One facility manager told us 
his facility has a project under way to install security locks and card-
access controls at all 93 of its pumping stations. According to the 
manager, the concentration of and need to protect capital equipment, 
and the potential impact of damage or destruction of that 
infrastructure prompted the facility to direct its capital improvement 
efforts to securing pumping stations.

While many facilities in our survey indicated they made some security 
improvements after 9/11, facility managers cited limited resources and 
other priorities as reasons for not implementing further security 
measures. Facility managers and other industry experts with whom we 
spoke noted that security upgrades must compete with other 
infrastructure needs for available resources. For instance, many 
wastewater facilities' collection systems are outdated, and they are 
already facing large costs to expand and repair their aging systems and 
reduce incidences of combined sewer overflows.[Footnote 17] Major U.S. 
cities, such as Washington, D.C., and Cincinnati, Ohio, are facing 
costs between $1 and $2 billion to implement necessary capital 
improvements. See appendix II for survey results on physical, 
personnel, and information technology security measures taken at large 
wastewater facilities.

Many Facility Managers Reported a Need for Additional Funding and Other 
Assistance to Further Security Improvements:

In our survey, we asked wastewater facility managers what the federal 
government could do to improve security at wastewater facilities. 
Facility manager responses are categorized in table 1.

Table 1: Wastewater Facility Managers' Opinions on Recommended Federal 
Role:

Recommended federal role: Funding; 
Number of responses: 102.

Recommended federal role: Guidelines, standards, best practices, 
expertise, and information; 
Number of responses: 36.

Recommended federal role: Training and education; 
Number of responses: 14.

Recommended federal role: Requirements and mandates; 
Number of responses: 14.

Recommended federal role: Providing threat or security information; 
Number of responses: 9.

Recommended federal role: Other; 
Number of responses: 18. 

Source: GAO survey of wastewater facilities.

[End of table]

Facility managers predominantly recommended additional funding to 
further wastewater security improvements. Many facility managers 
recommended targeting funding to specific measures, such as performing 
vulnerability assessments, purchasing specific security equipment such 
as surveillance cameras, or covering costs associated with switching 
from gaseous chlorine to a safer disinfectant. To a much lesser extent, 
wastewater facility managers commented that the federal government 
could be of greater assistance in providing security guidance, 
standards, and best practices. For example, one facility manager we 
interviewed expressed a need for federal guidance and best practices on 
collection system security. For its part, in 2002, EPA provided funding 
to the American Society of Civil Engineers (ASCE) to develop a set of 
security guidance documents that cover the design of online contaminant 
monitoring systems, and physical security enhancements of drinking 
water, wastewater, and storm water infrastructure systems. ASCE sub- 
contracted with American Water Works Association and the Water 
Environment Federation (WEF) for assistance on this project. In 2004 
these documents were released as interim voluntary security design 
standards for the water sector and finalized standards are to be 
established in late 2006 or early 2007. These security-focused 
documents are intended to serve as a foundation to help water utilities 
address potential vulnerabilities through sound design, construction, 
and operation and maintenance practices. According to a WEF 
representative, one set of standards is to be directed at physical 
security measures for wastewater collection systems. The security 
standards are to be published in late 2006 and are to include both 
prescriptive and performance-based criteria that focus on physical 
security upgrades that reduce risk to water, wastewater, and storm 
water infrastructure arising from malevolent events.

EPA and DHS Have Several Initiatives to Enhance Wastewater Facility 
Security, Yet a Key Effort Requires Additional Coordination:

EPA and DHS have a number of initiatives under way related to 
wastewater facility security. For example, EPA has funded programs to 
develop vulnerability assessment tools and provide training to 
wastewater facilities on the use of these tools, while DHS has 
conducted site assessment visits at wastewater facilities. While these 
initiatives are helping to address security concerns in the wastewater 
sector, EPA and DHS efforts could nonetheless be more effective with 
greater coordination over how best to convey security-related and 
threat information to the wastewater treatment community.

EPA and DHS Have Several Initiatives Under Way Related to Wastewater 
Security:

Since 2002, EPA has provided more than $10 million to help address the 
security needs of the wastewater sector. EPA funded the development and 
dissemination of several risk assessment methodologies to assist water 
sector utilities in identifying how to better protect their critical 
infrastructures. In addition, EPA funded training for wastewater 
utilities on how to conduct risk assessments and update or complete 
emergency response plans. EPA provided funding to the Association of 
Metropolitan Sewerage Agencies[Footnote 18] to develop a software tool, 
called the Vulnerability Self Assessment Tool (VSAT), for drinking 
water utilities. In addition, through an interagency agreement with 
EPA, the Department of Energy's Sandia National Laboratories provided 
training to selected firms in a vulnerability assessment methodology 
developed by the labs, called the Risk Assessment Methodology for Water 
Utilities (RAM-W). For vulnerability assessments at smaller water 
systems, EPA supported the dissemination of the Security and Emergency 
Management System (SEMS) software tool.

Sixty-nine wastewater facilities responding to our survey indicated 
they used, were currently using, or planned to use the VSAT software to 
complete a vulnerability or security assessment; 27 facilities 
indicated they either used, were currently using, or planned to use the 
RAM-W assessment tool. Another four facilities indicated they either 
used, were currently using, or planned to use the SEMS software.

EPA has also reorganized its own internal structure and sought input 
from experts outside of the agency to better assist the wastewater 
industry's security efforts. In particular, in 2003, EPA created a 
Water Security Division to work with the states, tribes, drinking water 
and wastewater utilities, and other partners to enhance the security of 
water and wastewater utilities and the ability to respond effectively 
to security threats and breaches. In addition, in 2004, the National 
Drinking Water Advisory Council (NDWAC),[Footnote 19] at EPA's request, 
established a Water Security Working Group made up of 16 members from 
wastewater utilities, drinking water utilities, and environmental and 
rate-setting organizations to advise on the development of best 
security practices and policies for water utilities. The group advises 
the NDWAC on ways to address several specific security needs of the 
sector. In June 2005, the working group provided NDWAC with a report 
that identified features of an active and effective security program 
and ways to measure the adoption of these practices.

As noted, EPA provided funding to ASCE to develop a set of security 
guidance documents that cover the design of online contaminant 
monitoring systems, and physical security enhancements of drinking 
water, wastewater, and storm water infrastructure systems. This effort, 
called the Water Infrastructure Security Enhancement project, is to 
address physical infrastructure security needs in the water sector by 
issuing guidance documents, training materials, and voluntary standards 
relating to water infrastructure security. The project group is 
currently developing physical security standards that focus on physical 
security upgrades to reduce risk to water, wastewater, and storm water 
arising from malevolent acts.

For its part, DHS has two broad initiatives that have facilitated 
efforts to improve wastewater security. First, the Buffer Zone 
Protection program is a DHS grant program designed to reduce specific 
vulnerabilities at a critical infrastructure or key resource site by 
assisting local law enforcement to develop a plan for preventative and 
protective measures that make it more difficult for terrorists to plan 
or launch attacks from the immediate vicinity of the site. They also 
identify equipment that could be purchased to mitigate the 
vulnerabilities. Upon plan approval, DHS grants funds for procuring 
materials and equipment necessary for implementation of the site's 
buffer zone protection plan. According to DHS, as of October 31, 2005, 
security at 14 wastewater facilities has been reviewed under the Buffer 
Zone Protection program.

Under its second broad initiative, the Site Assistance Visits program, 
DHS visits critical infrastructure sites nationwide to address key 
areas of concern at facilities requiring security enhancements. DHS 
subject matter experts in the areas of physical security measures, 
system interdependencies, and terrorist attack prevention conduct these 
visits--generally lasting 1 to 3 days--in which, among other things, 
the vulnerabilities of the site or facility are identified and 
mitigation options are discussed. According to DHS, as of October 31, 
2005, a total of 350 site assessment visits have been conducted. Of 
this total, seven were conducted with wastewater facilities.

In addition to these programs, DHS funded a NACWA project to develop a 
decision tree and report template to help water systems assess and 
examine chlorine gas alternatives for water and wastewater 
disinfection. The decision tree guides water systems in evaluating the 
potential costs and benefits of conversion and determining whether an 
alternative disinfection method will still enable them to meet their 
permit requirements. The report template is to ensure that the results 
of the decision tree analysis are reported in a consistent format, 
improving a water system's ability to pursue and secure any available 
state or federal funding for conversion. According to a NACWA 
representative, they are in the process of finishing the design of the 
decision tool and, once the final product is reviewed and approved by 
DHS, printing of the CD tool will begin. NACWA expects to make the tool 
available to water and wastewater utilities free of charge no later 
than the end of March 2006.

While EPA and DHS have these wastewater security-related initiatives 
under way, the Congress has expressed concerns that EPA's homeland 
security responsibilities are not well articulated in relation to DHS' 
responsibilities. In the conference report for the fiscal year 2005 
Consolidated Appropriations Act, conferees directed EPA to enter into a 
memorandum of understanding (MOU) with DHS that defines the 
relationship and responsibilities of the two entities regarding 
homeland security and protection. EPA did not enter into the MOU, but 
instead, on November 1, 2005, issued a report to the Congress entitled 
"Homeland Security Roles and Responsibilities and Interactions Between 
EPA and the Department of Homeland Security." The report identified the 
homeland security-specific authorities, core mission authorities, 
presidential directives, and existing MOUs EPA uses to implement its 
homeland security roles and responsibilities. In the report, EPA stated 
that it believes its homeland security roles and responsibilities are 
sufficiently delineated not only through statutes, presidential 
directives, and existing MOUs, but also through planning documents and 
deliverables associated with a wide variety of collaborative homeland 
security-related projects that EPA and DHS are carrying out.

Multiple Efforts to Provide Critical and Threat-Related Information to 
the Water Sector Need Additional Coordination:

In December 2002, the Association of Metropolitan Water Agencies (AMWA) 
received a grant from EPA to establish a communication system to share 
security information with water sector utilities, known as the Water 
Information Sharing and Analysis Center (WaterISAC).[Footnote 20] The 
WaterISAC is one of thirteen critical infrastructure and key resource 
sector-specific information sharing and analysis centers. The WaterISAC 
was designed to meet the information sharing needs of both water and 
wastewater utilities by providing real-time alerts of possible 
terrorist activity, allowing for the secure reporting of incidents and 
the sharing of information among users, and allowing access to a 
library of security-related information and contaminant databases. 
Beginning in fiscal year 2003, EPA has annually provided AMWA with a $2 
million grant to support the WaterISAC. This grant is augmented by 
subscription fees paid by drinking water and wastewater 
systems.[Footnote 21] In November 2004, the WaterISAC launched a free 
security advisory system known as the Water Security Channel that 
distributes federal advisories on security threats via e-mail to the 
water sector. The Water Security Channel also includes a searchable 
archive of federal alerts, advisories, and bulletins. However, it does 
not provide access to the same level of service as the subscription- 
based WaterISAC. WaterISAC subscribers receive additional services, 
including a secure communication system, access to vulnerability 
assessment tools and resources, access to an online library related to 
water security issues, and access to databases about chemical, 
biological, and radiological agents.

DHS has also sought to enhance communication between critical 
infrastructure sectors and the government. Under the Homeland Security 
Act of 2002, DHS is responsible for reducing the vulnerability of the 
national infrastructure and for coordinating and communicating with all 
key stakeholders on homeland security-related matters. According to 
DHS, to fulfill this mandate, it requires a communication system that 
provides equal and appropriate access to security information to all 
owners and operators of critical infrastructure and key resources. In 
2004, it piloted a new secure network, the Homeland Security 
Information Network (HSIN), to help achieve this mandate.

HSIN is DHS' primary conduit through which it shares information on 
domestic terrorist threats, suspicious activity reports, and incident 
management. It is composed of multiple communities of interest, 
including the HSIN Critical Sector (HSIN-CS) program, which is intended 
to enhance the protection, preparedness, and crisis communication and 
coordination capabilities of the nation's 17 critical infrastructure 
and key resource sectors identified in HSPD-7. The HSIN platform for 
critical sectors is being developed and offered to each sector to 
provide a suite of information and communication tools to share 
critical information both within the sector, with DHS, and eventually 
across sectors. Because the water sector is one of the nation's 17 
critical infrastructure and key resources, a HSIN-CS portal for the 
sector, called HSIN Water Sector (HSIN-WS), is currently being 
developed by DHS. A Water Sector Coordinating Council was also 
established by the water sector with representative members of the 
water sector community and charged with identifying information and 
other needs of the sector, including the appropriate use of and the 
relationship among Water ISAC, the Water Security Channel, and 
HSIN.[Footnote 22]

While these efforts are helping to improve communication, staff at EPA 
and DHS, as well as other industry experts with whom we spoke, have 
expressed concern that the evolution of the information sharing and 
dissemination function for the water sector has resulted in several 
inefficiencies.

* WaterISAC access is limited to drinking water and wastewater 
subscribers, plus a restricted number of subscribers from EPA and the 
state drinking water programs. For example, the agreement limits 
designated users to five individuals at EPA headquarters and one person 
in each EPA region, for a total of fifteen EPA users. States are 
limited to only two users. EPA staff note that access for others in the 
sector, such as the technical service community, universities, training 
centers and laboratories, would benefit the overall protection of 
drinking water and wastewater critical infrastructures. EPA and DHS 
staff told us that, depending upon the user policy established by the 
sector, the HSIN network could allow for broader sharing of access than 
currently available under the WaterISAC.

* Only a small portion of the water sector is reached by the WaterISAC. 
According to EPA staff, just over 530 utilities are reached by the 
WaterISAC, while over 8,000 utilities receive information through the 
Water Security Channel. However, the Water Security Channel does not 
provide the same level of notification and information sharing provided 
by the WaterISAC. The Water Security Channel is essentially a "push e- 
mail system" that sends out general security bulletins to water 
utilities and other users, and allows for searches of previous 
bulletins. This service is much more limited than that provided to 
WaterISAC subscribers, which provides a secure communication system for 
users to share information, access to vulnerability assessment tools 
and resources, access to an online library related to water security 
issues, and access to databases about chemical, biological, and 
radiological agents. One water industry representative told us that the 
WaterISAC recently lowered its subscription fees due to industry 
concerns that the fees were limiting WaterISAC subscriptions. EPA staff 
told us that the water sector generally has less funding available to 
support ISAC services than other sectors such as electric, financial, 
and transportation.

* WaterISAC duplicates some operational functions likely available 
through HSIN. EPA estimates that roughly $600,000 to $700,000 of the 
annual $2 million WaterISAC grant is used to support computer hardware 
and software for the secure web portal. Meanwhile, to support HSIN, DHS 
funds similar computer software and hardware and its related technical 
support. EPA staff noted that WaterISAC could make use of the software 
and hardware platform available through HSIN. EPA staff believed that 
WaterISAC could then better focus its resources on managing its user 
list, managing information content on the secure web site, and 
analyzing and distributing threat information, while leaving DHS to 
manage and run the hardware and software.

The current reach and levels of service offered by the WaterISAC and 
the Water Security Channel do not meet DHS' objective to establish a 
communication system that provides equal and appropriate access to 
security information to all owners and operators in this critical 
infrastructure area. According to EPA and DHS staff, the Water Sector 
Coordinating Council will consider options to improve coordination 
between the WaterISAC, the Water Security Channel, and HSIN. Using 
funding from the supporting grant from EPA, the WaterISAC is currently 
examining options for coordination between the WaterISAC, the Water 
Security Channel, and HSIN. EPA noted that this review is ongoing and 
will likely be presented in preliminary form to the Water Sector 
Coordinating Council in a mid-March 2006 meeting. However, the scope of 
the preliminary review is not clear, nor is a time frame set to 
complete the review. According to DHS, the creation of the DHS Homeland 
Infrastructure Threat and Risk Analysis Center will assist in 
information sharing of intelligence threat information between DHS and 
federal, state, and private sector partners.

Conclusions:

Many of the nation's large wastewater facilities have made security 
improvements since the terrorist attacks of September 11, 2001. Of 
particular note, many have completed some type of security assessment, 
and additional facilities have such assessments under way. Our survey 
also found that wastewater facilities are continuing to move away from 
the use of potentially dangerous gaseous chlorine as a wastewater 
disinfectant. One area of continuing concern is the difficulty these 
facilities are having in addressing vulnerabilities associated with 
their collection systems. Facility managers explained that with limited 
funding available, other important measures considered to be more 
feasible and affordable were assigned greater priority. EPA is 
attempting to help address this difficult issue through funding the 
American Society of Civil Engineers project to develop voluntary 
physical security standards for the water sector.

Despite limited federal authority over security at the nation's 
wastewater facilities, EPA, as the lead agency for water sector 
security, has worked with DHS and industry groups to advance wastewater 
security by providing vulnerability assessment tools, training, 
guidance, and burgeoning information sharing networks. These efforts, 
combined with the individual initiatives of many wastewater facilities, 
have resulted in measurable security improvements. However, these 
efforts could benefit from additional coordination, and we acknowledge 
and support EPA's and DHS' commitment to do so. As these agencies move 
forward, we believe they should act upon the opportunities we have 
identified that could improve both the efficiency with which limited 
dollars are being spent, as well as the delivery of vital information 
services to the wastewater community. Specifically, a substantial part 
of the $2 million annual EPA grant that funds WaterISAC goes to support 
a computer platform that may be available at no cost through HSIN.

Recommendation for Executive Action:

We recommend that the Administrator of EPA work with DHS and the Water 
Sector Coordinating Council to identify areas where the WaterISAC and 
HSIN networks could be better coordinated, focusing in particular on 
(1) how operational duplications and overlap could be addressed, and 
(2) how water systems' access to timely security threat information 
could be improved. We also recommend that EPA work with DHS and the 
Water Sector Coordinating Council to identify realistic time frames for 
the completion of these tasks.

Agency Comments and Our Evaluation:

We provided a draft of this report to DHS and EPA for review and 
comment. DHS agreed with the factual content of the report, and its 
Office of Infrastructure Protection provided written technical comments 
and clarifications that have been incorporated, as appropriate. In its 
letter, reproduced in appendix III, EPA concurred with the results of 
the report. EPA's Water Security Division in the Office of Ground Water 
and Drinking Water also provided technical comments and clarifications 
that were incorporated, as appropriate.

As agreed with your office, unless you publicly release the contents of 
this report earlier, we plan no further distribution until 30 days from 
the report date. At that time, we will send copies of this report to 
the appropriate congressional committees; interested Members of 
Congress; the Administrator, Environmental Protection Agency; the 
Secretary, Department of Homeland Security; and other interested 
parties. We will also make copies available to others on request. In 
addition, the report will be available at no charge on the GAO Web site 
at [Hyperlink, http://www.gao.gov.].

Should you or your staff need further information, please contact me at 
(202) 512-3841 or [Hyperlink, stephensonj@gao.gov]. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix IV.

Sincerely yours,

Signed By:

John B. Stephenson:
Director, Natural Resources and Environment: 

[End of Section]

Appendix I: Scope and Methodology:

To identify federal statutory authorities and directives that govern 
protection of wastewater treatment facilities, we reviewed applicable 
laws, Homeland Security Presidential Directives, and policies, 
guidance, and regulations related to wastewater security from the 
Environmental Protection Agency (EPA) and the Department of Homeland 
Security (DHS). In addition, we interviewed officials in EPA's Water 
Security Division, as well as DHS officials in various areas of the 
agency. In addition, we spoke with representatives for wastewater 
industry associations with which EPA has collaborated to actively 
assist wastewater treatment facilities to address their security issues.

To determine the steps critical wastewater treatment facilities have 
taken since 9/11 to address potential vulnerabilities, we conducted a 
Web-based survey of the nation's largest wastewater treatment 
facilities. For the purpose of this review, we defined "critical 
wastewater facilities" as the 253 wastewater facilities in the United 
States that have service area populations of 100,000 or greater, as 
identified in the results of EPA's 2004 Clean Watershed Needs 
Survey.[Footnote 23] As a result of Hurricane Katrina, one facility in 
our initial population of 253 facilities that was identified as a New 
Orleans facility was omitted, leaving a total 252 facilities in our 
survey population. We drafted the survey in consultation with our own 
survey professionals. In addition, we solicited the review and comment 
of knowledgeable officials from the National Academy of Sciences, the 
Water Environment Federation, and the National Association of Clean 
Water Agencies, as well as several wastewater security experts 
identified in our January 2005 report on wastewater security.[Footnote 
24] We conducted seven pretests to check that (1) the questions were 
clear and unambiguous, (2) terminology was used correctly, (3) the 
information was feasible to obtain, and (4) the survey was 
comprehensive and unbiased. The pretest sites were chosen to include 
facilities representing different geographic regions, and utilities 
both with single and multiple facilities. One pretest was done in 
person and six were done over the phone.

Our survey asked wastewater treatment facility representatives to 
provide a variety of information, such as whether their facilities had 
conducted security assessments; what measures, if any, they had taken 
or were planning to take in several security areas; and their 
perspectives on what role the federal government should assume in 
wastewater treatment facility security. The survey was made available 
between October 1, 2005, and January 15, 2006, and a unique user 
identification number and a password were provided to each surveyed 
facility. Three e-mail reminders were sent out to nonresponders, and 
then follow-up phone calls were made to all nonresponding facilities. A 
total of 206 of 252 wastewater treatment facilities responded to the 
survey, resulting in an 82 percent survey response rate. Other 
wastewater facilities that did not respond to the survey generally 
cited security concerns related to providing potentially sensitive 
information or a general policy of not answering surveys.

Because this was not a sample survey, there are no sampling errors. 
However, the practical difficulties of conducting any survey may 
introduce errors, commonly referred to as non-sampling errors. For 
example, difficulties in how a particular question is interpreted or in 
the sources of information that are available to respondents can 
introduce unwanted variability into the survey results. We took steps 
both at the data collection and at the analysis phases to minimize 
these non-sampling errors. Since this was a Web-based survey, 
respondents entered their answers directly into the electronic 
questionnaire, which removes one source of error. When the data were 
analyzed, a second, independent analyst checked all relevant computer 
programs.

To determine what steps EPA and DHS have taken to help wastewater 
facilities in their efforts to address vulnerabilities, we took several 
approaches. First, through semi-structured interviews with agency 
officials and industry association representatives, as well as document 
reviews, we researched various programs that EPA and DHS have under 
way. Second, we identified programs that require cross-agency 
collaboration between EPA and DHS, and we examined in depth those that 
wastewater treatment facility representatives identified as potentially 
useful. We also interviewed state and local officials with oversight 
for wastewater treatment operations and security. Third, one section of 
our survey gathered information about facility representatives' 
experiences with, perspectives on, and expectations for, the federal 
role in wastewater treatment facility security. Responses to open-ended 
questions were categorized and tallied to analyze their content for 
subsequent research findings. Finally, to develop conclusions about the 
level of coordination between the two agencies in the implementation of 
these programs, we interviewed agency officials about their 
perspectives on how well the agencies are working together.

[End of section]

Appendix II: Survey of Wastewater Treatment Facilities:

[See PDF for image] 

[End of figure] 

[End of section]

Appendix III: Comments from the Environmental Protection Agency:

United States Environmental Protection Agency: 
Washington, D.C. 20460:

Office Of Water:

Mr. John B. Stephenson:
Director: 
Natural Resources and the Environment Government: 
Accountability Office:
Washington, DC 20548:

Dear Mr. Stephenson:

Thank you for the opportunity to review the draft Government 
Accountability Office (GAO) Report; Security Wastewater Facilities: 
Utilities Have Made Important Upgrades, Though Further Improvements To 
Key System Components May Be Limited by Costs and Other Constraints. We 
appreciate the information in the report and have already begun to 
address some of the concerns that you raised. Staff members from my 
program have provided GAO with technical comments on the draft under 
separate cover.

We all rely on clean, safe, and secure water. Therefore, from a public 
health and economic perspective, it is critical that we protect our 
nation's wastewater infrastructure. Your report recommends that the 
Environmental Protection Agency (EPA or Agency) work with the 
Department of Homeland Security (DHS) and the Water Sector Coordinating 
Council to identify areas where the Water Information Sharing and 
Analysis Center (WaterISAC) and the Department of Homeland Security's 
Homeland Security Information Network (HSIN) could be better 
coordinated, focusing in particular on (1) how operational duplications 
and overlap could be addressed, and (2) how water systems' access to 
timely security threat information could be improved. GAO also 
recommends that EPA work with DHS and the Water Sector Coordinating 
Council to identify realistic timeframes for the completion of these 
tasks.

The results and recommendation of the report are useful, well thought 
out, and demonstrate a well conceived and executed project. The Agency 
has a number of initiatives underway to address GAO's recommendations. 
EPA continues to encourage the Water Sector Coordinating Council to 
consider how the WaterISAC and HSIN could be integrated to be more 
useful to the sector.

The Association of Metropolitan Water Agencies (AMWA) operates the 
WaterISAC using funding from a directed grant from EPA. The most recent 
grant agreement included a term and condition to evaluate how WaterISAC 
and HSIN features might be effectively combined. As a result of this 
task in AMWA's grant agreement, the WaterISAC is in the process of 
conducting an evaluation of the two systems. Furthermore, the Water 
Sector Coordinating Council has asked AMWA to conduct a similar 
evaluation of the features of WaterISAC and HSIN. EPA continues to work 
with DHS and the Water Government Coordinating Council to seek 
opportunities to improve the features of HSIN for eventual adoption by 
the water sector.

A number of the issues raised in the document will be useful to the 
Agency as it moves forward with the wastewater and drinking water 
security program. EPA has been designated as the Sector Specific Agency 
for the Water Sector - which covers both drinking water and wastewater 
utilities. To ensure the safety of our nation's drinking water supply 
and the protection of water quality by reducing the risk to public 
health, the environment, and critical infrastructure, the Agency is 
committed to continuing to collaborate and build upon existing 
relationships with DHS and other parties - including utilities, other 
critical infrastructure sectors, state, local and tribal governments, 
and stakeholders. This coordination is critical in order to better 
understand interdependencies, develop tools and training, improve 
information sharing and exchange mechanisms, and conduct research 
activities to ensure that critical infrastructure operations in the 
water sector are not interrupted by potential terrorist or other 
intentional acts.

I appreciated the opportunity to coordinate with your staff on this 
project. Should you need additional information or have further 
questions, please contact me or Cynthia C. Dougherty, Director of the 
Office of Ground Water and Drinking Water at (202) 564-3750.

Sincerely, 

Signed By:

Benjamin H. Grumbles: 
Assistant Administrator:

[End of section]

Appendix IV: GAO Contact and Staff Acknowledgments:

GAO Contact:

John B. Stephenson (202) 512-3841:

Acknowledgments:

In addition to the contact named above, Nancy Bowser, Jenny Chanley, 
Steve Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry 
Sandau, Rebecca Spithill, and Monica Wolford made key contributions to 
this report.

(360576): 

[End of section]

FOOTNOTES

[1] GAO, Wastewater Facilities: Experts' Views on How Federal Funds 
Should Be Spent to Improve Security, GAO-05-165 (Washington, D.C.: Jan. 
31, 2005).

[2] Pub. L. No. 107-188 (2002). 

[3] 42 U.S.C. §§ 300f-300j.

[4] When we discuss vulnerability assessments in this report, we are 
referring to assessments that include the review criteria identified in 
the Bioterrorism Act and in EPA guidance. EPA issued guidance on 
vulnerability assessments for drinking water systems regulated under 
the Bioterrorism Act that stated the assessments should address six key 
elements: (1) characterization of the system, including its mission and 
objectives; (2) identification and prioritization of adverse 
consequences to avoid; (3) determination of critical assets that might 
be subject to malevolent acts that could result in undesired 
consequences; (4) assessment of the likelihood of such malevolent acts; 
(5) evaluation of existing countermeasures; and (6) analysis of current 
risk, and development of a prioritized plan for risk reduction. 

[5] Pub. L. No. 101-549 (1990).

[6] EPA requires that any facility storing at least 2,500 pounds of 
chlorine gas submit a RMP. 

[7] GAO, Homeland Security: Voluntary Initiatives Are Under Way at 
Chemical Facilities, but the Extent of Security Preparedness Is 
Unknown, GAO-03-439 (Washington, D.C.: March 14, 2003).

[8] Specifically, section 112(r)(1) of the Clean Air Act includes a 
general duty clause directing owners and operators of facilities that 
produce, process, handle, or store listed or other extremely hazardous 
substances to identify hazards, design and maintain a safe facility to 
prevent releases, and minimize the consequences of any accidental 
releases that occur.

[9] Pub. L. No. 94-580 (1976), 42 U.S.C. §§ 6901-6992k.

[10] 40 C.F.R. § 264.14.

[11] Pub. L. No. 91-596 (1970), 29 U.S.C. §§ 651-678.

[12] Pub. L. No. 99-499 (1986), 42 U.S.C. §§ 11001-11050.

[13] Pub. L. No. 100-7 (1987).

[14] EPA fact sheet, "Use of the Clean Water State Revolving Fund to 
Implement Security Measures at Publicly-owned Wastewater Treatment 
Works" (Washington, D.C., 2003).

[15] Forty-eight percent of facilities responding to our survey 
indicated they were combined systems, in that they managed both 
drinking water and wastewater treatment. 

[16] Specifically, of the 85 facilities reporting current use of 
gaseous chlorine, 59 store gaseous chlorine in one-ton containers. This 
method of storage is considered by experts to be safer than storing it 
in larger containers because ruptures or leaks would be limited to 
smaller areas. Three facilities reported storing gaseous chlorine in 
150-pound cylinders. Six facilities reported storing gaseous chlorine 
in 17-ton tractor trailers, while nine reported storing the gas in 91- 
ton rail cars. Eight facilities did not report a storage method.

[17] Combined sewer systems collect rainwater runoff, domestic sewage, 
and industrial wastewater in the same pipe. During periods of heavy 
rainfall or snowmelt the wastewater volume in a combined sewer system 
can exceed the capacity of the sewer system or treatment plant, 
resulting in an overflow and discharge of untreated wastewater directly 
to nearby streams, rivers, or other water bodies. EPA considers these 
overflows to be a major pollution concern for the approximately 772 
cities that have combined sewer systems.

[18] Now the National Association of Clean Water Agencies (NACWA).

[19] NDWAC is a federal advisory committee that supports EPA in 
performing its duties and responsibilities related to the national 
drinking water program. The council was created on December 16, 1974, 
through a provision in the Safe Drinking Water Act.

[20] Information Sharing and Analysis Centers (ISACs) are confidential 
venues for sharing security vulnerabilities and solutions within an 
industry. Presidential Decision Directive 63 and Executive Order 13231 
designated the water sector (and other industry sectors) as critical to 
the nation's well-being and called for the establishment of ISACs to 
promote the flow of security information. Additionally, HSPD-7 
encouraged creation of private-sector information sharing and analysis 
mechanisms, such as the Water ISAC, to protect drinking water and 
wastewater infrastructure from attack.

[21] Water and wastewater systems with a service population over 
100,000 pay an annual fee of $1,000, systems between 50,000 and 100,000 
pay $500, and systems serving less than 50,000 pay $200 annually. The 
annual fee pays for one user per system. Additional users are allowed, 
with limits, for additional fees.

[22] According to DHS, sector coordinating councils are to be developed 
for each critical infrastructure and key resource area and will be 
responsible to determine and support the most effective method of 
information sharing and communication for the sector, whether by using 
the current ISAC or building new mechanisms.

[23] EPA's Office of Wastewater Management conducts the Clean Watershed 
Needs Survey (CWNS) on a periodic basis. The CWNS, a joint effort 
between states and EPA, is conducted in response to Section 205(a) and 
516 of the Clean Water Act. 

[24] GAO-05-165.

GAO's Mission:

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics.

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading.

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548:

To order by Phone:

Voice: (202) 512-6000:

TDD: (202) 512-2537:

Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470:

Public Affairs:

Jeff Nelligan, managing director,

NelliganJ@gao.gov

(202) 512-4800

U.S. Government Accountability Office,

441 G Street NW, Room 7149

Washington, D.C. 20548: