handbook of water and wastewater systems protection

Helbling Department of Environmental Chemistry, Swiss Federal Institute of Aquatic Science and Technology Eawag, Duebendorf, Switzerland,Damian.Helblig@eawag.ch Dan Kroll Hach Homeland S

Protecting Critical Infrastructure

Robert M Clark · Simon Hakim · Avi Ostfeld Editors

Handbook of Water

and Wastewater Systems Protection

123

Department of Civil and Environmental

Springer New York Dordrecht Heidelberg London

Library of Congress Control Number: 2011935004

© Springer Science+Business Media, LLC 2011

All rights reserved This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York,

NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis Use in connection with any form of information storage and retrieval, electronic adaptation, computer software,

or by similar or dissimilar methodology now known or hereafter developed is forbidden.

The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject

to proprietary rights.

Printed on acid-free paper

Springer is part of Springer Science+Business Media (www.springer.com)

We would like to dedicate this book to our wives Susan Clark, Galia Hakim, and Yael Ostfeld and to our children and

grandchildren.

We would like to acknowledge, in memoriam, Dr Paul Seidenstat who was apioneer in the field of urban economics, an advocate of protecting societies’ criticalinfrastructure, and who materially contributed to this effort We would also like

to acknowledge the individuals and institutions who contributed to this book andthe men and women who are diligently working to protect critical infrastructurethroughout the world

vii

3 EPA Drinking Water Security Research Program 47Hiba S Ernst, K Scott Minamyer, and Kim R Fox

4 Drinking Water Critical Infrastructure and Its Protection 65Rakesh Bahadur and William B Samuels

5 Wastewater Critical Infrastructure Security and Protection 87Rakesh Bahadur and William B Samuels

6 Protecting Water and Wastewater Systems 103Randy G Fischer

7 Spatial Distributed Risk Assessment for Urban Water

Infrastructure 119Michael Möderl and W Rauch

8 US Water and Wastewater Critical Infrastructure 135Robert M Clark

9 Microbial Issues in Drinking Water Security 151Eugene W Rice

10 Rapid Detection of Bacteria in Drinking Water

and Wastewater Treatment Plants 163Rolf A Deininger, Jiyoung Lee, and Robert M Clark

11 Chlorine Residual Management for Water Distribution

System Security 185Jeanne M VanBriesen, Shannon L Isovitsch Parks,

Damian E Helbling, and Stacia T McCoy

ix

12 Biosensors for the Detection of E coli O157:H7 in Source

and Finished Drinking Water 205Mark D Burr, Andreas Nocker, and Anne K Camper

13 Guidelines, Caveats, and Techniques for the Evaluation

of Water Quality Early Warning Systems 229Dan Kroll

14 Protecting Water and Wastewater Systems: Water

Distribution Systems Security Modeling 247Avi Ostfeld

15 Protecting Consumers from Contaminated Drinking Water

During Natural Disasters 265Craig L Patterson and Jeffrey Q Adams

16 Cyber Security: Protecting Water and Wastewater

Infrastructure 285Srinivas Panguluri, William Phillips, and Patrick Ellis

17 Real-World Case Studies for Sensor Network Design

of Drinking Water Contamination Warning Systems 319Regan Murray, Terra Haxton, William E Hart,

and Cynthia A Phillips

18 Enhanced Monitoring to Protect Distribution System

Water Quality 349Zia Bukhari and Mark LeChevallier

19 Testing and Evaluation of Water Quality Event Detection

Algorithms 369Sean A McKenna, David B Hart, Regan Murray, and Terra Haxton

20 Water Infrastructure Protection Against Intentional

Attacks: The Experience of Two European Research Projects 397Cristiana Di Cristo, Angelo Leopardi, and Giovanni de Marinis

21 Utility of Supercomputers in Trace-Back Algorithms

for City-Sized Distribution Systems 419Hailiang Shen and Edward McBean

22 Water/Wastewater Infrastructure Security: A Multilayered

Security Approach 435Laurie J Van Leuven

23 Vulnerability of Water and Wastewater Infrastructure and

Its Protection from Acts of Terrorism: A Business Perspective 457Dave Birkett, Jim Truscott, Helena Mala-Jetmarova,

and Andrew Barton

Contents xi

About the Editors 485

About the Principle Contributors 487

Name Index 497

Subject Index 501

Jeffrey Q Adams National Risk Management Research Laboratory, Water

Supply and Water Resources Division, USEPA, Cincinnati, OH, USA,

adams.jeff@epamail.epa.gov

Rakesh Bahadur Science Applications International Corporation Center for

Water Science and Engineering, McLean, VA, USA, bahadurr@saic.com

Andrew Barton GWMWater, Horsham, VIC, Australia; University of Ballarat,

Ballarat, VIC, Australia, andrew.barton@gwmwater.org.au

Dave Birkett Truscott Crisis Leaders, Wembley Downs, WA, Australia,

dbirkett@crisisleaders.com

Zia Bukhari American Water, Voorhees, NJ, USA, zia.bukhari@amwater.com Mark D Burr Center for Biofilm Engineering, Montana State University,

Bozeman, MT, USA, mark_b@erc.montana.edu

Anne K Camper Center for Biofilm Engineering, Montana State University,

Bozeman, MT, USA, anne_c@erc.montana.edu

Robert M Clark 9627 Lansford Drive, Cincinnati, OH, USA, rmclark@fuse.net Rolf A Deininger School of Public Health, The University of Michigan, Ann

Arbor, MI, USA, rad@umich.edu

Giovanni de Marinis Water Engineering Lab (L.I.A.), Department of Mechanics,

Structures and Environmental Engineering (Di.M.S.A.T.), University of Cassino,Cassino, Italy, demarinis@unicas.it

Cristiana Di Cristo Water Engineering Lab (L.I.A.), Department of Mechanics,

Structures and Environmental Engineering (Di.M.S.A.T.), University of Cassino,Cassino, Italy, dicristo@unicas.it

Patrick Ellis Broward County Water and Wastewater Services, 2555 West Copans

Road, Pompano Beach, FL, USA, pellis@broward.org

xiii

Hiba S Ernst US Environmental Protection Agency, National Homeland

Security Research Center, Cincinnati, OH, USA, ernst.hiba@epa.gov

Randy G Fischer Division of Public Health, Nebraska Department of Health and

Human Services (NE DHHS), Lincoln, NE, USA, randy.fischer@nebraska.gov

Kim R Fox US Environmental Protection Agency, National Homeland Security

Research Center, Cincinnati, OH, USA, fox.kim@epa.gov

Simon Hakim Center for Competitive Government, Fox School of Business &

Management, Temple University, Philadelphia, PA, USA; Department of

Economics, Temple University, Philadelphia, PA, USA, simon.hakim@temple.edu

David B Hart National Security Applications Department, Sandia National

Laboratories, Albuquerque, NM, USA, dbhart@sandia.gov

William E Hart Sandia National Laboratories, Albuquerque, NM, USA,

wehart@sandia.gov

Terra Haxton National Homeland Security Research Center, U.S Environmental

Protection Agency, Cincinnati, OH, USA, haxton.terra@epa.gov;

Haxton.Terra@epamail.epa.gov

Damian E Helbling Department of Environmental Chemistry, Swiss Federal

Institute of Aquatic Science and Technology (Eawag), Duebendorf, Switzerland,Damian.Helblig@eawag.ch

Dan Kroll Hach Homeland Security Technologies, Loveland, CO, USA,

dkroll@hach.com

Mark LeChevallier American Water, Voorhees, NJ, USA,

mark.lechevallier@amwater.com

Jiyoung Lee Division of Environmental Health Sciences, College of Public

Health, Ohio State University, Columbus, OH, USA, jlee@cph.osu.edu

Angelo Leopardi Water Engineering Lab (L.I.A.), Department of Mechanics,

Structures and Environmental Engineering (Di.M.S.A.T.), University of Cassino,Cassino, Italy, a.leopardi@unicas.it

Helena Mala-Jetmarova GWMWater, Horsham, VIC, Australia; University of

Ballarat, Ballarat, VIC, Australia, helena.jetmarova@gwmwater.org.au

Edward McBean School of Engineering, University of Guelph, Guelph, ON,

Canada, emcbean@uoguelph.ca

Stacia T McCoy Department of Civil and Environmental Engineering, Carnegie

Mellon University, Pittsburgh, PA, USA, staciatmccoy@gmail.com

Sean A McKenna National Security Applications Department, Sandia National

Laboratories, Albuquerque, NM, USA, samcken@sandia.gov

Contributors xv

K Scott Minamyer US Environmental Protection Agency, National Homeland

Security Research Center, Cincinnati, OH, USA, minamyer.scott@epa.gov

Michael Möderl Institute of Infrastructure, University of Innsbruck, Innsbruck,

Austria, Michael.Moederl@uibk.ac.at

Regan Murray National Homeland Security Research Center, U.S.

Environmental Protection Agency, Cincinnati, OH, USA, murray.regan@epa.gov;Murray.Regan@epamail.epa.gov

Andreas Nocker Centre for Water Science, Cranfield University, Cranfield,

Bedfordshire, UK, andreas.nocker@gmail.com

Avi Ostfeld Department of Civil and Environmental Engineering, Technion –

Israel Institute of Technology, Haifa, Israel, ostfeld@tx.technion.ac.il

Srinivas Panguluri Shaw Environmental & Infrastructure, Inc., 5050 Section

Avenue, Cincinnati, OH, USA, srinivas.panguluri@shawgrp.com

Shannon L Isovitsch Parks Environmental Science and Sustainable Technology

Division, Alcoa, Inc., Pittsburgh, PA, USA, Shannon.Parks@alcoa.com

Craig L Patterson National Risk Management Research Laboratory, Water

Supply and Water Resources Division, USEPA, Cincinnati, OH, USA,

Eugene W Rice National Homeland Security Research Center, U.S.

Environmental Protection Agency, Cincinnati, OH, USA, rice.gene@epa.gov

William B Samuels Science Applications International Corporation Center for

Water Science and Engineering, McLean, VA, USA, william.b.samuels@saic.com

Hailiang Shen School of Engineering, University of Guelph, Guelph, ON,

Canada, shenh@uoguelph.ca

Jim Truscott Truscott Crisis Leaders, Wembley Downs, WA, Australia,

jtruscott@crisisleaders.com

Jeanne M VanBriesen Department of Civil and Environmental Engineering,

Carnegie Mellon University, Pittsburgh, PA, USA, jeanne@andrew.cmu.edu

Laurie J Van Leuven Seattle Public Utilities/U.S Department of Homeland

Security (DHS), FEMA, Washington, DC, USA, laurie.vanleuven@gmail.com;Laurie.VanLeuven@fema.gov

There is a general, and growing, awareness that urban water systems are vulnerable

to both manmade and natural, but unpredictable, threats and disasters such asdroughts, earthquakes, and terrorist attacks Other natural disasters that can effectwater supply security and integrity include major storms such as hurricanes andflooding Earthquakes and terrorist attacks have many characteristics in common.They are almost impossible to predict and can cause major devastation and con-fusion Several recent earthquakes centered in urban areas such as the earthquakethat struck Kobe City, Japan, in 1995 have demonstrated the disastrous effectthat earthquakes can have on urban water systems Terrorism is also a majorthreat to water security, and recent attention has turned to the potential that theseattacks have for disrupting urban water supplies In the United States, govern-ment planners have been forced to consider the possibility that the nation’s criticalinfrastructure, including water systems, may in fact be vulnerable to terrorism ThePresident’s Commission on Critical Infrastructure Protection concluded that thenation’s water supply system might be vulnerable to certain biological agents (Clarkand Deininger,2001) The Public Health Security and Bioterrorism Preparedness

and Response Act of 2002 (US Congress,2002) has intensified the focus on watersecurity research in the United States After the attacks of September 11, 2001,

the US Environmental Protection Agency (EPA) developed a Homeland Security

Strategy (USEPA, 2004) Its intent was to enhance national security and tect human health and the environment Much of the research conducted as aresult of these directives is presented in this book (Ernst et al., Chapter 3, thisvolume)

pro-In addition to urban water supply natural and manmade threats are importantissues for urban wastewater systems There are approximately 16,255 publicly

R.M Clark (B)

9627 Lansford Drive, Cincinnati, OH 45242, USA

e-mail: rmclark@fuse.net

1

R.M Clark et al (eds.), Handbook of Water and Wastewater Systems Protection,

Protecting Critical Infrastructure, DOI 10.1007/978-1-4614-0189-6_1,

 Springer Science+Business Media, LLC 2011

owned treatment works (POTWs), and 100,000 major pumping stations in theUnited States According to Bahadur and Samuels (Chapters 4and5, this volume)damage to the nation’s wastewater facilities or collection systems could result

in loss of life; catastrophic environmental damage to rivers, lakes, and lands; and contamination of drinking water supplies In addition damage to thenation’s wastewater systems could result in long-term public health impacts,destruction of fish and shellfish production, and disruption to commerce and theeconomy

wet-This book contains insights and recommendations from a group of internationallyrecognized experts who review the state of the art in protecting water and wastewatersystems from natural and manmade threats These experts address the followingissues:

• Problems in protecting water and wastewater systems

• The consequences of not protecting these systems

• The state of the art in protecting water and wastewater systems

• Alternative solutions that might be employed to address water and wastewatersecurity problems

Contributed chapters from US and international experts will cover the followingareas:

• Overview of the current state of water supply and wastewater system security andthe ability to respond to threats and disasters

• Characteristics of the water supply and wastewater systems in the United States

• Chemical and microbiological threats for water system contamination

• Monitoring for natural and manmade threats in drinking water systems

• Modeling contaminant propagation and contaminant threats in drinking waterdistribution systems

• Case study applications

• Distribution system modeling, SCADA systems, security hardware, and lance systems

surveil-• Institutional and management issues in responding to natural and manmadethreats

• Progress in developing techniques and approaches for natural and manmadethreat response in water and wastewater systems since September 11

1.2 History of Water Supply Vulnerability

According to Gleick (2006) the recorded history of attacks on water systems datesfrom 4,500 years ago Urlama, King of Lagash, and his son Illater cut off the watersupply to Girsu, a city in Umma, during the period 2450–2400 BC In New York in

1 Securing Water and Wastewater Systems: An Overview 3

1748 an angry mob burned down a ferry house on the Brooklyn shore of the EastRiver It is reported that this act was revenge for unfair allocation of East River waterrights Small groups attacked small dams and reservoirs in the 1840s and 1850s inthe eastern and central United States due to concerns about threats to health and

to local water supplies In the Owens Valley of California between 1907 and 1913farmers repeatedly dynamited the aqueduct system being built to divert their water

to the growing city of Los Angeles

In New York City (New York Times,1986), low levels of plutonium were found

in the drinking water (on the order of 20 fCi) The usual background is below 1 fCi.However, a person would have to drink several million liters of water to acquire

a lethal dose estimated at about 100μCi A femtocurie is nine orders of tude smaller than a microcurie (Clark and Deininger,2000) Another case was thecontamination of salad bars in Dalles, Oregon, by the Rajneeshee religious cult,

magni-using vials of Salmonella typhimurium S typhimurium is a highly toxic bacteria

frequently carried by birds The cult also contaminated a city water supply tank

using Salmonella A community outbreak of salmonellosis resulted in which at least

751 cases were documented in a county that typically reports fewer than 5 cases peryear The cult apparently cultured the organisms in their own laboratories (Clarkand Deininger,2000; Gleick,2006)

In terms of natural threats, water shortages and droughts have led to crisesand disasters throughout history and in many parts of the world Drought mayaffect both developing and developed countries and according to the UN’s Office

of Foreign Disaster Assistance no other natural disaster has caused as many placed persons in the 20th century For example, a drought in the Great Plains

dis-in the United States dis-in the 1930s caused serve economic hardship dis-in Missouri,Kansas, Nebraska, Oklahoma, South Dakota, and Arkansas The Great Plains alsoexperienced droughts in the 1950s, 1970s, and 1990s Drought affects more peoplethan any other natural hazard; earthquakes and terrorism can affect water security

in modern urban communities According to Bruins (2000), Israel included Arabvillages to receive water from the National Carrier System in order to limit thepotential posed by terrorists Water played an important role in the Peace Treatythat Israel and Jordan signed on October 26, 1994, and to this point the worst casescenarios have not materialized over water disputes in the Middle East With theadvent of global climate change and the anticipated increase in droughts in somelocations, there is concern that water scarcity might become the basis for futurewars

Unlike droughts which are described as a creeping phenomenon the damage ciated with earthquakes is concentrated in time and space In 1906 an earthquake inSan Francisco caused numerous pipes to rupture and caused drowning of dozens ofresidents when broken water pipes flooded the Valencia hotel It was impossible tocontrol the firestorms that spread through the area, and entire buildings exploded

asso-in a huge firestorm durasso-ing which the temperature was reported to reach 2000◦F

(1093.2◦C) In 1995, a major earthquake directly hit the city of Kobe, Japan The

quake lasted 20 s and 4,069 people died, 14,679 were injured, and 222,127 peoplewere moved into evacuation shelters There were 67,421 fully collapsed structures

of which 6,985 were burned to the ground and there was a city-wide power failureand a nearly city-wide water supply failure (Clark and Deininger,2001) Floodsand major storms can pose a threat to water system security Patterson and Adams(Chapter 15, this volume) describe the problems associated with recovery fromHurricane Katrina.

Until September 11, 2001, terrorism in the United States was not generallyregarded as a serious threat because of the nation’s military strength, relative geo-graphic isolation, and secure borders However, recent attacks against targets withinthe United States by domestic and foreign terrorists forced many government plan-ners to consider the possibility that the nation’s critical infrastructure may, infact, be vulnerable to terrorist attacks In response to this concern, the President’sCommission on Critical Infrastructure was formed to evaluate the vulnerability ofthe water and wastewater infrastructure to internal and external terrorism The rapidproliferation of telecommunication and computer systems, which connect infras-tructures to one another in a complex network, compounds this vulnerability (Clarkand Deininger,2000)

Vital Human Services include community water supply systems on local andstate levels In terms of public administration, water supply systems are generallygovernmental in nature However, each supply system tends to be highly localized.Failures in one community may have little direct impact on other communities,although the problems and vulnerabilities may be similar Water supply systems arevulnerable to the full range of terrorist threats including physical attack and cyberand biological terrorism

The potential of bioterrorism as a threat to public safety is becoming increasinglyapparent For example, two epidemics of smallpox occurred in Europe in the 1970s.Each outbreak resulted from one infected individual An aerosolized anthrax dis-charge from a Russian bioweapons facility in 1979 resulted in 77 cases of anthraxand 66 deaths It is estimated that the release probably lasted no more than a fewminutes and the weight of the aerosols released may have been as little as a fewmilligrams (Clark and Deininger,2000; Gleick,2006)

1.3 Threats from Earthquakes

It is the authors’ opinion that many of the approaches adopted for earthquakeresponse would be useful in responding to a terrorist attack Specific examplesare discussed below During the San Francisco earthquake of 1906, which had amagnitude of 8.3 on the Richter scale, approximately 3,000 people lost their lives

A devastating fire swept through the city which caused more destruction than theimmediate effects of the earthquake itself As a consequence of that experienceengineers today strive to build water systems characterized by strength, flexibility,and redundancy Water systems survived much better during the Loma Prieta andNorthridge earthquakes, averting the kinds of catastrophic losses experienced in theSan Francisco earthquake (Clark and Deininger,2001)

1 Securing Water and Wastewater Systems: An Overview 5

1.3.1 The Loma Prieta Earthquake

The Loma Prieta earthquake that struck on October 17, 1989, had a reading of 7.1

on the Richter scale It caused 62 deaths and damaged over 18,000 homes Theearthquake caused water pipes to break in some areas, particularly in places witholder cast iron pipes and in areas known as liquefaction zones, where loose saturatedsandy soil is prone to intensified ground shaking A reservoir with an earthen damand a treatment plant were damaged primarily by earthquake-generated wave action.However, water distribution facilities were largely left intact

1.3.2 The Northridge Earthquake

The Northridge earthquake of January 17, 1994, had a reading of 6.7 on the Richterscale and although smaller in strength than the Loma Prieta earthquake struck aheavily populated sector in urban Los Angeles causing 57 deaths as well as the loss

of 14,600 homes Overall, the Northridge earthquake impacted more householdsand businesses than any other disaster in recent US history Two major wastewatertreatment facilities suffered significant damage due to liquefaction Abovegroundwater storage tanks suffered damage due to failures at their bases (buckling andtearing), and roof structures and pipe joints failed The earthquake jolts uncoupledthe fittings causing hundreds of breaks in the water distribution system Some areaswere without water or power and advisories to boil water went out to areas impacted

by pipe failures Water agencies made full use of mutual aid agreements and brought

in repair crews from around the state Within 10 days, all water main breaks wererepaired and the treatment plants were back in service

1.3.3 Kobe City Earthquake

At 5:46 am on January, 17, 1995, the Southern Hyogo Prefectural Earthquake(the Great Hanshin-Awaji Earthquake), the first major quake to directly hit aJapanese urban area, inflicted heavy damage on cities and their surrounding areas

in the Hanshin-Awaji region The jolt, which lasted barely 20 s, took 4,569 lives inKobe City alone and virtually reduced the harbor to a pile of rubble

Some of the existing facilities that proved to be effective during the earthquakeincluded emergency shut-off valves, a remote telemetry/telecontrol system, andearthquake-resistant pipes Some of the unexpected incidents that resulted from theearthquake were severe traffic jams, dire shortage of water, a lack of water wag-ons, frequent pipe breaks, and very slow progress in restoring water from the city’svarious sources

Based on this experience the city made drastic revisions to its community ter prevention plan that prescribes how each organization should act when disasterstrikes The new plan stipulates the role to be played by volunteers, those vulnerable

disas-to disasters, community residents, and businesses

1.3.4 Technological and Institutional Adaptation

Water management in California is unique because of the complexity of its waterdelivery system and provides an enlightening as to how states might deal withsecurity threats Three main aqueducts supply water to the more than 16 millioninhabitants in the southern part of the state where most of the population lives.However, most of the rain and snow falls in the northern half of the state Forexample, the average annual precipitation in the north is over 760 mm (30 in.),while the south receives only 50–360 mm (2–14 in.) Recurring disasters, includingearthquakes, and their effect on water systems have spurred emergency planning inCalifornia These experiences are leading to new approaches to emergency responsethat include inter-organizational coordination among various agencies that will helpthe water industry cope even more effectively with future emergencies The success

of these developments is illustrated by comparing the events that took place duringthe San Francisco earthquake to the events during the Loma Preita and Northridgeearthquakes (Clark and Deininger,2001)

1.3.4.1 Technological Adaptations

As a consequence of these experiences the water utilities in earthquake zones inCalifornia have developed innovative technologies to mitigate the impact of futureearthquakes For example, engineers at the East Bay Municipal Utilities District(EBMUD) in Oakland, California, devised a unique alternative for transporting largeamounts of water across a known earthquake fault They developed a specially con-structed flexible polyurethane hose with a large diameter (up to 12 in.) which can

be stored for long periods of time In an emergency, a small crew using light port vehicles can deploy the hose in a matter of minutes The hose can be used tobridge breaks in water mains or to bring large volumes of water from one part ofthe water system into another part Different types of fittings allow fire trucks toconnect to the hose and to add branch pipelines with a smaller diameter EBMUDhas identified key water distribution pipes that cross faults and are expected to failduring certain earthquake scenarios Following an earthquake, prepositioned valveswill allow crews to close off and isolate a broken section of pipe Crews can thenattach the polyurethane hose to prepositioned connections in undamaged sections ofthe original pipe, thereby restoring flow in the water distribution system

trans-1.3.4.2 Institutional Adaptations

The California state government has adopted a system of standardization thatencourages cooperating agencies to use common terminology, a common functionalmanagement template, a standard for liaison relationships between cooperatingagencies, a mutual aid system, and clearly defined governmental roles Californiawater utility agencies have learned to partner with government and private agencies

1 Securing Water and Wastewater Systems: An Overview 7

to devise mutual aid and mutual assistance plans, to produce collaborative gency planning guidance documents, and to arrange for reliable communicationsduring emergency response

emer-Other collaborative efforts for emergency response include the work of theCalifornia Utilities Emergency Response Association, in which water utilities maycoordinate with electricity, gas, telecommunications, and pipeline utilities The pur-pose of the Water Agency Response Network is to identify the need to help eachother in an emergency The Water Agency Response Network links the EmergencyOperations Centers of the member agencies with one another Many public agenciesincorporate amateur radio backup communication In Los Angeles the distribution

of potable water has been delegated to the fire departments in an emergency Thesepartnerships have developed through time and experience and have demonstrated anattempt to work together in an emergency or disaster and could provide a templatefor emergency response to a terrorist attack

1.4 Vulnerable Characteristics of US Water Supply Systems

The President’s Commission on Critical Infrastructure Protection identified severalfeatures of US drinking water systems that are particularly vulnerable to terroristattack For example, community water supplies in the United States are designed todeliver water under pressure and generally supply most of the water for fire-fightingpurposes Loss of water or a substantial loss of pressure could disable fire-fightingcapability, interrupt service, and disrupt public confidence (Clark and Deininger,

2000)

This loss might result from a number of different causes Many of the majorpumps and power sources in water systems have custom-designed equipment and incase of a physical attack it could take months or longer to replace them Sabotagingpumps that maintain flow and pressure or disabling electric power sources couldcause long-term disruption (Clark and Deininger,2001)

Many urban water systems rely on an aging infrastructure Temperature tions, large swings in water pressure, vibration from traffic or industrial processes,and accidents often result in broken water mains Planning for main breaks is usuallybased on historical experience However, breaks could be induced by a system-widehammer effect, which could be caused by opening or closing major control valvestoo rapidly This could result in simultaneous main breaks that might exceed thecommunity’s capability to respond in a timely manner, causing widespread outages.Recognizing this vulnerability, water systems have been incorporating valves thatcannot be opened or closed rapidly However, many urban systems still have valvesthat could cause severe water hammer effects

varia-Interrupting the water flow to agricultural and industrial users could have largeeconomic consequences For example, the California aqueduct, which carries waterfrom northern parts of the state to the Los Angeles/San Diego area, also serves toirrigate the agricultural areas in mid-state Pumping stations are used to maintain the

flow of water Loss of irrigation water for a growing season, even in years of normalrainfall, would likely result in billions of dollars of loss to California and significantlosses to US agricultural exports.

Another problem associated with many community water systems is the potentialfor release of chlorine to the air Most water systems use gaseous chlorine as adisinfectant, which is normally delivered and stored in railway tank cars Generally,there is only minimal protection against access to these cars Accidental release ofchlorine gas could cause injury to nearby populations

1.5 The Threat of Terrorism to Urban Water Systems

Unlike the earthquake experience there has never been a successful terrorist attack

on an urban water system, and until recently terrorism in the United States was notgenerally considered to be a serious threat The President’s Commission on CriticalInfrastructure was formed to evaluate the vulnerability of the nation’s infrastructure

to internal and external terrorism The Commission identified water supply systems

as vulnerable to the full range of terrorist threats including physical attack and cyberand biological terrorism

1.5.1 Bioterrorism and Chemical Contamination

A major concern with regard to water supplies is the potential of bioterrorism as athreat to public safety The US Army Combined Arms Support Command evaluated

27 agents for the potential for “weaponization.” Seven of the 27 agents are listed

as having the potential for being “weaponized” and 14 others are listed as eitherpossible or probable weapons A number of these organisms are listed as definite orprobable threats in water (Clark and Deininger,2000)

The President’s Commission concluded that there is a credible threat to thenation’s water supply system from certain known biological agents In addition,newly discovered or emerging pathogens may pose a threat to water supply systems.One such pathogen was isolated during a US Environmental Protection Agency(USEPA) study in Peru

Several chemical agents have also been identified that might constitute a crediblethreat against water supply systems Although much is known about chemical andbiological agents dispersed in air, almost nothing is known about these agents inpotable water

The amount of material needed to deliberately contaminate a water source (such

as a reservoir or aquifer) is large and generally exceeds what an individual or smallgroup of terrorists could easily acquire, produce, or transport However, contam-inants introduced into a distribution system would be less susceptible to dilutionand would reside in the system for shorter times, thus diminishing the effects ofdisinfectants and chemical decomposition and oxidation

1 Securing Water and Wastewater Systems: An Overview 9

1.6 Countermeasures Against Terrorism

As illustrated by the California and Japan experiences, there are several steps that

a water utility can and should take to protect itself against the sudden catastrophiceffect of an earthquake These approaches include both technological changes andestablishment of institutional mechanisms that will assist in mitigating against thepotential damage that might occur from such an event Based on this experiencethe authors believe that there are also several steps that a water utility can take toprotect against terrorist threats These steps will be discussed in terms of physicalcountermeasures, chemical countermeasures, and institutional countermeasures

an individual has entered a restricted area An immediate response might be to shutdown a part of the pumping system until the appropriate authorities determine thatthere is no threat to the system

An important extension of the security concept against terrorist attack would

be the planning and construction of separate water lines that are fed from a tected water supply source, which would only be activated during an emergency.Many of the older cities in the United States have separate water lines that havebeen installed for fire protection in heavily developed downtown areas These waterlines might be upgraded for possible use to supply the population with safe waterduring emergency conditions Such proactive planning for water security, includingthe continuous maintenance and monitoring of chlorine residual in the water, wouldhelp to ensure the safety of most water supply systems Nevertheless, it is of vitalimportance that system planners and managers be constantly on the alert to prohibitdeliberate sabotage of municipal water supply systems

pro-1.6.2 Sensor Networks

Among the different threats to a water distribution system a deliberate chemical

or biological contaminant injection is the most difficult to address, both because

of the uncertainty of the type of the injected contaminant and its consequences andbecause of the uncertainty of the location and injection time In principle, a pollutantcan be injected at any water distribution system connection (node) using a pump or amobile pressurized tank Although backflow preventers provide an obstacle to suchactions, they do not exist at all connections and at some might not be functional

An online contaminant monitoring system (OCMS) is considered (ASCE,2004;AWWA,2004) as the major tool to reduce the likelihood of a deliberate contaminantchemical or biological intrusion An OCMS should be designed to detect randomcontamination events and to provide information on the location of the contaminantswithin the system, including an estimation of the injection characteristics (i.e., con-taminant type, injection time and duration, concentration, and injected mass flowrate) Once the type of the contaminant and its characteristics are discovered, a con-tainment strategy can be implemented to minimize the pollutant spread throughoutthe system and to suggest for the system’s portions that need to be flushed.

However, although an OCMS is recognized as the appropriate solution to copewith a deliberate contaminant intrusion, much of the basic scientific and engineer-ing knowledge needed to construct an effective OCMS is only partially available:(1) the monitoring/sensors instrumentation tools required to accomplish the detec-tion task, (2) knowledge of the injected contaminants’ impacts on public health, and(3) modeling capabilities of sensors locations

1.7 Cyber Security

Growth in the use of the Internet throughout the world, since the 1990s, has matically changed the way that both private sector and public sector organizationscommunicate and conduct business Although it was originally developed by the

dra-US Department of Defense, the vast majority of the Internet is owned and operated

by various entitles in the public and private sector It is becoming increasingly ognized that all countries need to prepare for the potential of debilitating Internetdisruptions Therefore in the United States the Department of Homeland Security(DHS), at the Federal level, has been assigned to develop an integrated pub-lic/private plan for Internet recovery, should it be impaired The US GovernmentAccountability Office (GAO) was asked to (1) identify examples of major dis-ruptions to the Internet, (2) identify the primary laws and regulations governingrecovery of the Internet in the event of a major disruption, (3) evaluate DHS plansfor facilitating recovery from Internet disruptions, and (4) assess challenges to suchefforts (USGAO,2006)

rec-The GAO found that a major disruption to the Internet could be caused by

• A cyber incident (such as a software malfunction or a malicious virus)

• A physical incident (such as a natural disaster or an attack that affects keyfacilities)

• A combination of both cyber and physical incidents

Recent cyber and physical incidents have, in fact, caused localized or regional ruptions but have not caused a catastrophic Internet failure The GAO report presentsseveral examples of major interruptions of the Internet which will be summarizedbriefly in this chapter

dis-1 Securing Water and Wastewater Systems: An Overview 11

1.7.1 Laws and Regulations Governing the Internet

Current Federal laws and regulations addressing critical infrastructure protection,disaster recovery, and telecommunications infrastructure provide broad guidancethat applies to the Internet It is not clear, however, how useful these regulationsand authorities would be in helping to recover from a major Internet disruption Forexample, key legislation on critical infrastructure protection does not address rolesand responsibilities in the event of an Internet disruption Other laws and regulationsgoverning disaster response and emergency communications have never been usedfor Internet recovery

1.7.2 Internet Recovery

The DHS has begun efforts to develop an integrated public/private plan for Internetrecovery, but, according to GAO, these efforts are not complete or comprehensive.Specifically, DHS has developed high-level plans for infrastructure protection andincident response, but the components of these plans addressing the Internet arenot complete The department has started a variety of initiatives to improve thenation’s ability to recover from Internet disruptions, including working groups tofacilitate coordination and exercises in which government and private industriespractice responding to cyber events However, progress to date on these initiativeshas been limited, and other initiatives lack time frames for completion and the rela-tionships among these initiatives are not evident Therefore, the government is notyet adequately prepared to effectively coordinate public/private plans for recoveringfrom a major Internet disruption

Key challenges to establishing an Internet recovery plan are as follows:

• The diffuse control of the many networks making up the Internet and the privatesector ownership of core components

• A lack of consensus on DHS’ role and a clear understanding as to when thedepartment should get involved in responding to a disruption

• Legal issues affecting DHS’ ability to provide assistance to restore Internetservice

• Reluctance on the part of the private sector to share information on Internetdisruptions with DHS

• Leadership and organizational uncertainties within DHS

Until these challenges are addressed, it is anticipated that DHS will have ficulty in being a focal point for helping the Internet recover from a majordisruption

dif-1.7.3 Examples of Internet Interruption

The following five examples were cited in the GAO report to illustrate the breadthand depth of both natural and manmade disasters that could have a major effect onelectronic communications (USGAO,2006)

1.7.3.1 Case Study – The Slammer Worm

On Saturday, January 25, 2003, the Slammer worm infected more than 90% ofvulnerable computers worldwide within 10 min of its release on the Internet Itexploited a known vulnerability for which a patch had been available since July

2002 Slammer caused network outages, canceled airline flights, and caused mated teller machine failures The Nuclear Regulatory Commission confirmed thatthe Slammer worm had infected a private computer network at a nuclear powerplant, disabling a safety monitoring system for nearly 5 h and causing the plant’sprocess computer to fail The worm reportedly also affected communications on thecontrol networks of at least five utilities by propagating so quickly that control sys-tem traffic was blocked On Monday, January 27, the worm infected more networkswhen US and European business hours started Cost estimates on the impact of theworm range from $1.05 billion to $1.25 billion

auto-However, responses to Slammer worm were rapid Within 1 h, Web site operatorswere able to filter the worm and block the main communication channel that theworm was using This helped control the spread of the worm

1.7.3.2 Case Study – A Root Server Attack

On Monday, October 21, 2002, a coordinated denial-of-service attack was launchedagainst all of the root servers in the Domain Name System around the world Tworoot server operators reported that traffic was three times the normal level, whileanother reported that traffic was 10 times the normal level The attacks lasted forapproximately 1 h and 15 min While reports of the attack differ, they all agreed that

at least nine of the servers experienced degradation in service and seven failed torespond to legitimate network traffic and two others failed intermittently during theattack

The response to these attacks was handled by the server operators and theirservice providers According to experts the government did not have a role inrecovering from the attack

1.7.3.3 Case Study – The Baltimore Train Tunnel Fire

On July 18, 2001, a 60-car freight train derailed in a Baltimore tunnel, housing optic cables for seven of the largest US Internet service providers The resulting fireburned and severed fiber-optic cables, causing backbone slowdowns for at least threemajor Internet service providers Interruptions to service were sporadic For exam-ple, users in Baltimore did not suffer disrupted service, while users in Washington

fiber-1 Securing Water and Wastewater Systems: An Overview 13D.C did In addition, there were selected impacts far outside the disaster zone The

US embassy in Lusaka, Zambia, experienced problems with e-mail Two of the vice providers restored service within 2 days and despite the outages caused by thefire, the Internet continued to operate

ser-The affected Internet service providers handled the recovery and city cials also worked with telecommunications and networking companies to reroutecables Federal and local government efforts to resolve the disruption consistedextinguishing the fire, maintaining safety in the surrounding area, and reroutingtraffic

offi-1.7.3.4 Case Study – The September 11, 2001, Terrorist Attack

on the World Trade Center

On September 11, 2001, terrorists crashed two commercial airplanes into the WorldTrade Center, which led to the deaths of nearly 3,000 people and the destruction of

12 buildings and physically damaged one of the Internet’s most important hubs Thelocal communications infrastructure (including facilities, critical computer systems,and fiber-optic cables that ran under the ruined buildings) was disrupted The attackalso disrupted electrical power in Lower Manhattan Back-up power systems wereused by local telecommunications facilities until they ran out of fuel or batteries andhad to shut down their operations Repairs to key infrastructure centers were delayedbecause of structural concerns for buildings and government-ordered evacuations.The attack disrupted local financial and communications systems, which led tothe closing of financial markets for up to 1 week, and interrupted Internet con-nectivity to several universities, medical colleges, and hospitals and to the citygovernment’s official Web site Internet service providers in parts of Europe lostconnectivity and there were Domain Name System disruptions in South Africa due

to interconnections in New York City However, in general Internet functions werelargely back to normal within 15 min, and there were no widespread connectivityissues, thereby demonstrating the flexibility and adaptability of the network Internetoperators rerouted traffic to bypass the physical damage in lower Manhattan.The federal government’s efforts in restoring Internet service included facil-itating communications and providing logistical support The government alsosecured the area and provided military transport to the New York area for keytelecommunications personnel while commercial air traffic was shut down

1.7.3.5 Case Study – Hurricane Katrina

On August 29, 2005, Hurricane Katrina significantly damaged and in somecases destroyed the communications infrastructure in Louisiana, Mississippi, andAlabama According to the Federal Communications Commission, the stormresulted in outages for over 3 million telephone customers, 38 emergency 9-1-1 callcenters, hundreds of thousands of cable customers, and over 1,000 cellular sites TheCoast Guard’s computer hub in New Orleans dropped off-line, resulting in no com-puter or Internet connectivity to all coastal ports within the area This lack of Internet

service caused Coast Guard units to resort to communicating with telephones andfax machines.

A substantial number of the networks that experienced service disruptions ered relatively quickly According to the Federal Communications Commission,commercial carriers restored service to over 80% of the 3 million affected telephonecustomers within 10 days of Hurricane Katrina Despite the overall devastationcaused by Katrina, the hurricane had minimal affect on the Internet

recov-Private sector representatives stated that with the exception of the FederalCommunications Commission (which coordinated provision of some governmentalresources and information), coordination with the government was limited Virtually

no assistance was received from the Federal government and it was reported thatrequests for assistance, such as food, water, fuel, and secure access to facilities,were denied The Stafford Act (which authorizes such assistance) does not includefor-profit companies

1.7.4 Cyber Attacks in the Public Sector

Clark and Knake (2010) have explored the potential for cyber attacks from unnamedadversaries on institutions in the United States Consistent with the GAO report theyhave concluded that the civilian sector is highly vulnerable to such an attack Resultsfrom the conflict between the Republic of Georgia and Russia in 2008 provide anexample of the damage that can result from cyber attacks There was physical fight-ing between Russia and Georgia; however, before fighting broke out cyber attackswere launched against Georgian government sites in an attempt to cut off Georgiafrom connecting to the Internet As a result of these attacks the Georgian bank-ing sector shut down its servers Consequently, Georgia’s banking operations wereparalyzed and credit card systems crashed followed by the mobile phone system.Clark and Knake (2010) contend that the United States is not effective in defend-ing cyber attacks especially in the banking and electrical utility sectors Clearly,drinking water and wastewater utilities are heavily dependent upon electrical power.They cite the Slammer Worm case study, described earlier, which slowed controls

on a power grid The “worm” attack in combination with a programming “glitch” in

a widely used Supervisory Control and Data Acquisition (SCADA) System slowedutilities response to a falling tree that created a power surge in Ohio The surgeresulted in a power outage that encompassed eight states, two Canadian provinces,and 50 million people The Cleveland water system was left without electricity caus-ing their pumps to fail and placing the utility in a near crisis The authors cite adeliberate hacker attack launched against an electrical system in Brazil with similarresults

The American Water Works Association (AWWA Streamlines,2010a) reportedthat a Belarus computer security has identified a virus, called Stuxnet, which attacksSCDA systems through a vulnerability in Microsoft Windows It has been reportedthat most of the affected are in India, Indonesia, and Iran It has been characterized

1 Securing Water and Wastewater Systems: An Overview 15

as a virus, a worm, and a Trojan The American Water Works Association has alsoreported that several SCDA software programs used by utilities are raising cybersecurity concerns (AWWA Streamlines,2010b) The US Department of HomelandSecurity has issued an alert concerning the vulnerability of VT Scada software andserver system to unauthorized access To date no one has been attacked according

to the developer

1.7.4.1 The “Stuxnet” Virus

According to news reports (agent-crippled-irans-nuclear-ambitions/), in June (2010) a Belarus-based companydoing business in Iran discovered a highly sophisticated computer worm called

http://www.foxnews.com/scitech/2010/11/26/secret-“Stuxnet.” Stuxnet is an incredibly advanced, undetectable computer worm thatprobably took years to construct and was designed to jump from computer tocomputer until it found its specific target which, in this case, was Iran’s nuclearenrichment program Iran’s nuclear enrichment program is seemingly impenetrable.For security reasons, it is constructed several stories underground and is not con-nected to the World Wide Web Therefore the virus had to make its way through aset of unconnected computers It had to adapt to security measures until it reached

a computer that could bring it into the nuclear facility It was designed in such amanner that when it found its target, it would secretly manipulate it until it was

so compromised that it ceased normal functions After achieving its goals it wouldhave to destroy itself without leaving a trace

The virus was apparently successful in finding its target which was both of Iran’snuclear enrichment facilities It entered the operating systems at both facilities andthen modified itself when it was discovered What is especially interesting is thatthe nuclear facilities in Iran run an “air gap” security system, meaning they have noconnections to the Web, making them secure from outside penetration Stuxnet wasapparently designed on the assumption that someone working in the plant wouldtake work home on a flash drive, acquire the worm, and then bring it back to theplant

It is instructive to examine what the virus was able to do after it entered theoperating systems for both facilities After defeating the security systems the wormordered centrifuges to rotate extremely fast and then to slow down precipitouslydamaging the converter, the centrifuges, and the bearings, and corrupting the ura-nium in the tubes At the same time it confused Iran’s nuclear engineers and leftthem wondering what was wrong, because computer checks showed no malfunc-tions in the operating system It is estimated that this penetration went on for morethan a year, leaving the Iranian program in chaos and that the worm grew andadapted throughout the system When a new worm entered the system, it wouldadapt and become increasingly sophisticated The source of the virus has not beenidentified but the evidence points to institutions with highly sophisticated cyber warcapability This example is very instructive for the water and wastewater industrybecause the type of equipment and processes utilized in these industries is verysimilar to the type of equipment used in the chemical processing industry

1.8 Material to Be Included in This Book

Larry Mays (2004) of Arizona State University edited a book intended to summarizethe state of the art of the knowledge in securing water and wastewater systems It was

an excellent overview However, much progress has been made since that time andthis book attempts to summarize the current state of the art in water and wastewatersystems security

States (2010) published a book under the auspices of the American WaterWorks Association which intended to be a compilation of developments in waterand wastewater systems since September 11, 2001 His goal was to provide apractical reference document for use by drinking water and wastewater man-agers and operators for dealing with homeland security and general emergencyresponse

1.8.1 Current State of Water Supply and Wastewater Systems Security: An Overview

Van Leuven (Chapter 2, this volume) examines why water infrastructure is so critical

to our society and identifies the hazards that could threaten and disable an entire tem She provides illustrations of the vulnerabilities and the potential consequences

sys-of an intentional attack on a water system and provides an approach to makingvulnerability assessments

Ernst et al (Chapter 3, this volume) describe research being conducted by the

US Environmental Protection Agency (EPA) which is the lead US sector-specificagency responsible for water security Research conducted by EPA’s NationalHomeland Security Research Center (NHSRC) supports the agency’s Goal 2 “Cleanand Safe Water – Ensuring drinking water is safe” and its mission of providingdrinking water treatment plants with tools and methodologies to improve watersecurity and recover as quickly as possible should a chemical, biological, or radio-logical event occur The research also has multiple benefits in optimizing treatmentoperations and improving water quality

Bahadur and Samuels (Chapters 4 and 5, this volume) describe the nature

of water and wastewater systems in the United States They discuss the generalnature of water and wastewater systems and why an intentional attack againstthis critical infrastructure would be problematic for the citizens they serve Inaddition, they suggest several approaches to minimizing the vulnerability of thesesystems

Fischer (Chapter 6, this volume) describes the state of Nebraska’s Drinking WaterSecurity Program The program has set the following goals: (1) to encouraging pub-lic water systems to secure their facilities to the greatest extent possible, (2) trainingpublic water system personnel to develop an effective emergency response plan,(3) developing a sense of cooperation and teamwork among all emergency respon-ders that ensures effective action in the wake of a disaster, and (4) meeting and

1 Securing Water and Wastewater Systems: An Overview 17producing a video for law enforcement personnel to educate them in the particulars

of crime scene evidence related to public water systems

Möderl and Rauch (Chapter 7, this volume) from the Institute of Infrastructure,University of Innsbruck, Technikerstr in Innsbruck, Austria, suggest a new approachfor managing the risk for critical infrastructure vulnerability They suggest that amethodology is developed where the effect of functional changes of a componentare computed by means of a hydraulic simulation and expressed in terms of indicatorvalues When this is done for each individual component of the entire system, spa-tial information on the intrinsic vulnerability of the system is generated VulNet is asoftware tool that performs these computations and also the subsequent assessment

of the vulnerability The methodology has been tested for five water supply tems (WSSs) and one urban drainage system (UDS) It was demonstrated that thespatial information of the intrinsic vulnerability of WSSs offers significant informa-tion on critical sections of the supply system and indicates also how the situationcan be improved, e.g., vulnerabilities occur if different demand areas (e.g., sepa-rated by a river) are not properly connected By strengthening these connections,vulnerabilities are reduced The application of the method using VulNet is sug-gested as a valuable tool for managers and operators of water utilities to improvethe performance of their system and to consider system vulnerability in rehabili-tation planning Additionally, an alpine region including five municipalities werechosen to evaluate the public drinking water supply security A methodology wasdeveloped to identify, on a regional basis, zones with high risk by merging infor-mation on vulnerability and four potential natural hazards The methodology aidswater management to make decisions on which sites of the WSS should be chosenfor preventive measures

sys-1.8.2 Characteristics of Water and Wastewater Systems

in the United States

According to Clark (Chapter 8, this volume) substantial water supply and ater infrastructure has been constructed in the United States including extensivestorage and distribution facilities especially in the West and Southwest Drinkingwater in the United States is regulated under the Safe Drinking Water Act of 1974,and the Federal Water Pollution Control Act or Clean Water Act of 1948 is the prin-cipal law that regulates the pollution discharged into the nation’s streams, lakes, andestuaries There are over 162,000 water systems in the United States that meet thefederal definition of a public water system It is estimated that there are 980,000miles (1.6× 106km) of distribution system pipes There are 16,024 publicly ownedtreatment plants in the United States and all but 200 provide secondary treatment

wastew-In many older cities sanitary sewage and storm water runoff are collected in a gle sewage system and are vulnerable to sanitary sewer overflow during peak rainfallevents The USEPA’s 2003 Needs Assessment found that the nation’s water systemswill need to invest $276.8 billion over the next 20 years in order to continue to

sin-provide safe drinking water to their consumers The Clean Watershed Needs Survey(CWNS) 2004 Report to Congress by the USEPA estimated a need of $202.5 billion(2004) for wastewater treatment and collection facilities.

1.8.3 Chemical and Microbiological Threats for Water

System Contamination

According to Rice (Chapter 9, this volume) the presence of microbial pathogens in

a water supply following a disaster poses an urgent threat to public health There is

an extensive amount of literature available on the classical waterborne pathogens,but by contrast there is a limited amount of information on the overt bio-threat orbio-warfare agents which could be introduced into a water system A bio-terrorismincident in a municipal drinking water system would have the potential for causingwidespread disease and disruptions of vital public services which could affect largesegments of the population He reviews recent developments for assessing the role

of microbial pathogens which have the potential for being used as bio-threat agentswhen intentionally introduced into a water system

According to Deininger et al (Chapter 10, this volume) current microbiologicalstandards are focused on a single group of indicator organisms for the bacterio-logical safety of drinking water Although the current standards of water qualityhave eliminated massive outbreaks of waterborne disease, a question has been raisedabout the adequacy of the standard drinking water quality to prevent waterborne ill-nesses The present HPC method using R2A agar is known to be the most sensitivetest for enumerating the bacteria from treated water; the test takes 7 days to com-plete The authors propose an ATP bioluminescence assay allows an estimation ofbacterial populations within minutes and can be applied on a local platform Theirresearch indicates that the test they have developed could estimate bacterial popula-tions might occur in a practical and timely manner during a contamination event.VanBriesen et al (Chapter 11, this volume) discuss the importance of maintain-ing chlorine residuals in treated water to protect drinking water consumers and

to provide protection against small-scale intrusions Monitoring these residuals isimportant for operational control and has the potential for providing early warning

of contaminant intrusions In order to use online real-time chlorine detection as part

of a security system, a utility must have an accurate map of their distribution systemalong with corresponding operational parameters in order to assess vulnerabilities.Further, they must have a predictive model of chlorine concentrations throughout thesystem under many different dynamic scenarios This enables prediction of expectedchlorine at sensor locations and thus determination of “alarm” conditions Finally,

to counter the possibility of low chlorine residual concentrations, some distributionsystems have installed chlorine booster stations The authors evaluate the steps autility can take from initial vulnerability assessment through installation and oper-ation of chlorine sensors and boosters For security reasons, simulated distributionsystems are used in examples rather than an actual case study

1 Securing Water and Wastewater Systems: An Overview 19

1.8.4 Monitoring for Natural and Manmade Threats in Water and Wastewater Systems

Burr et al (Chapter 12, this volume) discuss the potential for the development ofbiosensors for warning about potential contamination to streams and watersheds

focusing on biosensors to detect Escherichia coli O157:H7 They conclude that

biosensors will not be attractive to the water industry until it has been demonstrated

in pilot studies that they can be operated over long periods of time with minimaloperator expertise, can be integrated into systems that process water volumes on theliter to cubic meter scale, achieve two to three orders of magnitude improvement indetection limits, and produce responses that are unambiguous

According to Kroll (Chapter 13, this volume) a number of studies have shownthat the utilization of multi-parameter monitoring has the potential to indicate thepresence of a wide variety of harmful agents in water at levels that would be pro-tective of human health He discusses the key elements that should be consideredwhen choosing and deploying such systems and presents a number of criteria andconsiderations for the selection and deployment of these systems These criteria canform the basis for successful selection and deployment of early warning systems forwater As the analytical science behind these systems progresses, they will increasetheir ability to satisfy all of these factors As the state of the industry stands todaythere are systems available that do a good job of addressing all of the criteria, butprogress will continue

1.8.5 Modeling Contaminant Propagation

and Contaminant Threats

Ostfeld (Chapter 14, this volume) describes a water distribution system as an connected collection of sources, pipes, and hydraulic control elements (e.g., pumps,valves, regulators, and tanks) delivering consumers prescribed water quantities atdesired pressures and qualities The behavior of a water distribution system is gov-erned by (1) the physical laws that describe the flow relationships in the pipes andthe hydraulic control elements, (2) the consumer demands, and (3) the system’slayout Interest in modeling flow and water quality in water distribution systemsstems from three types of circumstances: use of waters from sources with differentqualities in a single distribution system serving as a “treatment facility” to mix andconvey them, with a blend supplied to its consumers Simulation and optimizationalgorithms for modeling water quality in distribution systems are needed by design-ers, utilities, and regulating agencies for a number of purposes: (1) planning anddesign of networks and facilities, (2) real-time operation, (3) monitoring design andoperation, (4) simulation of contamination events, and (5) guidelines establishmentsfor planning, design, operation, and monitoring Water quality simulation model-ing is aimed at studying the changes of water quality substances in time and inspace within the distribution system The need for optimization exists whenever the

inter-solution to a problem is not unique Common examples for optimization needs inmodeling water quality in water distribution systems are design, operation, chlorinecontrol, monitoring, calibration, and since the September 11 events in the UnitedStates – water security The author describes issues related to water security withinthe context of water distribution systems modeling and highlights future needs andchallenges in this area.

1.8.6 Case Study Applications

Patterson and Adams (Chapter 15, this volume) describe EPA’s Disaster RecoveryPlan and the steps that the water industry (water utilities, government agencies, non-governmental organizations, academia, and consultants) is taking to tackle potentialthreats to safe drinking water and drinking water infrastructure A case study of EPAemergency response efforts after Hurricane Katrina is provided to bring the impact

of major natural disasters on public water systems into focus Government agenciesincluding the EPA are supporting the development of small drinking water treat-ment technologies to bring timely relief to devastated communities EPA research

is focusing on household devices, mobile treatment systems, and disinfection cesses as described to protect consumers from contamination in drinking waterwells, tanks, and distribution systems US government agencies including the EPAare planning ahead to provide temporary supplies of potable water to communitiesduring emergencies EPA is supporting the development of small drinking watertreatment technologies to bring timely relief to devastated communities

pro-1.8.7 Distribution System Modeling, SCADA Systems, Security and Surveillance Systems

Panguluri et al (Chapter 16, this volume) discuss an area that may represent majorvulnerability in the nation’s critical infrastructure Early assessments of water andwastewater systems found no evidence of an impending “cyber attack” whichcould have a debilitating effect on the nation’s critical infrastructures However,more recent studies have demonstrated that publicly available computer equipmentand hacking software could be used to infiltrate and take control of the com-puter centers at Defense Department, as well as power grids and 911 systems innine major US cities There are many other well-known hacking incidents thathave targeted the military and other critical infrastructure Since these studies havebeen publicized, many research organizations operating under various mandateshave undertaken efforts to understand the complex infrastructure interdependenciesespecially between water/wastewater infrastructure and the energy infrastructure(electric, oil, and gas) Four major categories of infrastructure interdependencies(physical, cyber, geographic, and logical) have been identified as they apply tothe water/wastewater infrastructure In addition, the proliferation of information

1 Securing Water and Wastewater Systems: An Overview 21technology (IT) for organizational efficiency and the increased use of automatedmonitoring and control systems (e.g., Supervisory Control and Data Acquisition(SCADA) systems) for operational efficiency by the water and wastewater utilitieshave created additional cyber vulnerabilities that need to be appropriately addressed.The authors cite an incident that occurred at the Maroochy Shire Sewage TreatmentPlant in Queensland, Australia, in which a disgruntled employee hacked into theSCADA system for the plant causing approximately 212,000 gallons of raw sewage

to spill out into local parks, rivers, and the grounds of a nearby hotel The authorsdiscuss current approaches (relevant standards and vendor initiatives), their keyelements, and provide a summary of the recently developed sector-specific cybersecurity roadmap Examples are presented that document various successes andchallenges faced by the water and wastewater sector to meet the requirements ofthese standards and achieve the goals identified in the sector-specific roadmap.Murray et al (Chapter 17, this volume) discuss the strategic placement of sen-sors throughout the distribution network which is a key aspect of designing aContamination Warning System There has been a large volume of research onthis topic in the last several years, including a study that compared 15 differentapproaches to solving this problem The authors focus on the sensor placementmethodologies that have been developed by EPA’s Threat Ensemble VulnerabilityAssessment (TEVA) Research Team, which is composed of researchers fromEPA, Sandia National Laboratories, the University of Cincinnati, and ArgonneNational Laboratory This team has developed TEVA-SPOT – the Threat EnsembleVulnerability Assessment Sensor Placement Optimization Tool – a collection ofsoftware tools that can help utilities design sensor networks Case studies are pre-sented using TEVA-SPOT and open challenges for application of sensor networkdesign to large-scale real-world drinking water systems are discussed

1.8.8 Institutional and Management Issues in Responding

to Natural and Manmade Threats

Bukhari and LeChevallier (Chapter 18, this volume) believe that physical ing of a drinking water plant does not eliminate vulnerabilities at the plant or inthe distribution systems, which can extend over hundreds of miles A comprehen-sive approach is required to protect distribution system water quality by employingtechnologies that facilitate “real-time” feedback and provide tools to indicate anearly warning of unanticipated changes in water quality The approach being evalu-ated by the US Environmental Protection Agency in their Water Security Initiativeconsists of integrating multi-streams of information (i.e., water quality, syndromics,eye witness, law enforcement, etc) The authors using the Water Security Initiative

harden-as the platform discuss a conceptual model that is capable of integrating tion from various technologies (i.e., Automatic Meter Readers capable of backflowand leak/tamper detection) in distribution system pipes to convey multi-streams

informa-of information to sinforma-oftware-assisted alarms, which can then integrate information

from hydraulic models to trigger automated sampling at strategically selected sitesfor laboratory-based verification of intentional or accidental contamination events.Following water quality aberrations, the utility needs to initiate a ConsequenceManagement Plan (CMP) The CMP needs to be a “living document” designed in amanner that is intuitive, self-explanatory, and is capable of guiding utilities throughthe most appropriate data collection, analysis, communication, and mitigation steps.The authors provide an overview of the wide and varied processes that a utility needs

to navigate to return an impacted system back to normal operation as quickly andsafely as possible

1.8.9 Developing Techniques and Approaches for Natural

and Manmade Threat Response

McKenna et al (Chapter 19, this volume) discuss event detection systems that vide online analysis of water quality data for identification of significant waterquality events Two different online algorithms are discussed that utilize multivari-ate data from two monitoring locations in an operating water distribution network.The data are split into training and testing sets and parameter identification is com-pleted on the training data prior to application on the testing data Water qualityevents are added to the testing data sets as perturbations from the measured waterquality using 11 different event strengths The resulting receiver operating char-acteristic curve areas quantify the relationship between probability of detectionand false detections at the time step scale Additionally, the proportion of eventscontaining at least one detection is measured Results show that both algorithmsare capable of reliably detecting events that change the background water quality

pro-by 1.5 times the standard deviation of the water quality signal while limiting thefalse-positive results to 3–4% of the time steps Trade-offs in the delay to detectionversus the number of false-positive results are examined in the context of the eventlength

According to Di Cristo et al (Chapter 20, this volume) in the last few yearsmany interesting studies have been devoted to the development of technologies andmethodologies for the protection of water supply systems against intentional attacks.However, the application to real systems is still limited for many different eco-nomic and technical reasons She and her colleagues from The Water EngineeringLab (L.I.A.) of the University of Cassino (Italy) were involved in two researchprojects financed by the European Commission in the framework of the EuropeanProgramme for Critical Infrastructure Protection (E.P.C.I.P.) Both projects had as

a common objective to provide guidelines for enhancing security in water supplysystems with respect to intentional contamination risk and they were developed

in partnership with large Italian Water Companies They present a general dure for protection systems design of water networks In particular, the procedure isdescribed through the application to real water systems, characterized by differentsize and behavior

proce-1 Securing Water and Wastewater Systems: An Overview 23Shen and McBean (Chapter 21, this volume) have developed a contaminantsource identification procedure intended to protect water distribution systems thathave to be both rapid and able to incorporate uncertainties, when identifyingpossible intrusion nodes (PINs) PINs identification has two major issues, the false-negative rate (failure to identify the true ingress location) and the false-positiveissue (falsely identifying a location which is not the true ingress location) A datamining procedure is described and applied, which involves mining an off-line-builtdatabase, to select PINs that possess first detection times within±m from the online sensor first detection time The “m” value is a statistical characterization of the array

of events of the offset values between online sensor first detection time under tainty and the one corresponding to the same intrusion event stored in the off-line

uncer-database; with “m” selected, issues of controlling false negatives and positives are

addressed The approach described herein is made possible through the power ofparallel computing in supercomputers, which demonstrates huge potential by sim-ulating scenarios simultaneously The online data mining procedure, i.e., the PINsidentification, is integrated into a geographic information system toolkit for rapidemergency response In the case studies, simulation of scenarios is reduced linearly

to the number of processors applied Results show that increasing the number of

sce-narios in the database can provide input to compute the “m” value, always reduce the

false-negative rate of each sensor, and usually reduce the number of false-positivePINs

Van Leuven (Chapter 22, this volume) discusses the need for a multilayeredsecurity approach for protecting critical water and wastewater infrastructure thatincludes policies, procedures, plans, protective countermeasures, training, exercises,relationships with intelligence agencies, and response capabilities In this chapterVan Leuven (Chapter 22, this volume) identifies common elements that drive secu-rity investments encompassing everything from a calculated risk-based approach

to the gut reactions of operators who understand the consequences of a significantasset failure She describes available countermeasures and physical security invest-ments designed to deter, delay, detect, assess, and respond to security incidents VanLeuven (Chapter 22, this volume) concludes with a synopsis of recommended pro-grammatic components to ensure a comprehensive, multilayered security approach

to protecting drinking water and wastewater systems

According to Birkett et al (Chapter 23, this volume) water and wastewater tructure has been subject to attacks and threats since ancient times Following theterrorist attack on the Twin Towers in New York in 2001, there has been increasedinterest in examining new approaches for ensuring adequate protection to water andwastewater infrastructure The investigators propose a unique approach to mitigatingthreat levels by introducing the concept of crisis leadership and crisis control Thismethodology is illustrated by regularly practicing plans and procedures in the form

infras-of scripted crisis exercises There are four major types infras-of exercises which displayprocesses, roles, and responsibilities with an accent on planning and documentation.Water and wastewater agencies which adopt these strategies will survive and pro-duce a resilient organization This chapter provides an overview of a preparednessand recovery framework suitable for water industries worldwide