a

GAO

United States Government Accountability Office

Report to the Chairman, Committee on 

Environment and Public Works, U.S. 

Senate

March 2006 SECURING 

WASTEWATER 

FACILITIES

Utilities Have Made 

Important Upgrades 

but Further 

Improvements to Key 

System Components 

May Be Limited by 

Costs and Other 

Constraints

GAO-06-390
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

March 2006

SECURING WASTEWATER FACILITIES

Utilities Have Made Important Upgrades 

but Further Improvements to Key System 

Components May Be Limited by Costs 

and Other Constraints 

Highlights of GAO-06-390, a report to the 

Chairman, Committee on Environment 

and Public Works, U.S. Senate 

www.gao.gov/cgi-bin/getrpt?GAO-06-390.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact John

Stephenson at (202) 512-3841 or

stephensonj@gao.gov. 

Wastewater facilities provide

essential services to residential, 

commercial, and industrial users, 

yet they may possess certain 

characteristics that terrorists could

exploit to impair the wastewater

treatment process or to damage 

surrounding infrastructure. For

example, large underground

collector sewers could be accessed

by terrorists for purposes of

placing destructive devices beneath 

buildings or city streets. 

GAO was asked to determine (1) 

what federal statutory authorities 

and directives govern the 

protection of wastewater treatment 

facilities from terrorist attack, (2) 

what steps critical wastewater

facilities have taken since the

terrorist attacks of September 11, 

2001, (9/11) to ensure that potential

vulnerabilities are addressed, and 

(3) what steps the Environmental

Protection Agency (EPA) and the 

Department of Homeland Security

(DHS) have taken to help these 

facilities in their efforts to address 

such vulnerabilities. 

What GAO Recommends

GAO is recommending that EPA 

work with DHS to identify areas 

where the WaterISAC and HSIN 

could be better coordinated, 

focusing on (1) how duplications 

and overlap could be addressed,

and (2) how water systems’ access 

to critical information could be

improved. GAO also recommends 

that EPA help identify time frames

to complete these tasks. EPA and 

DHS generally agreed with the 

report. 

Federal law does not address wastewater security as comprehensively as it 

does drinking water security. For example, the Public Health Security and 

Bioterrorism Preparedness and Response Act of 2002 required drinking 

water facilities serving populations greater than 3,300 to complete 

vulnerability assessments, but no such requirement exists for wastewater 

facilities. While federal law governing wastewater security is limited, 

Homeland Security Presidential Directive 7 designated EPA as the lead 

agency to oversee the security of the water sector, including both drinking 

water and wastewater. The directive tasked EPA with several 

responsibilities, including the development of mechanisms for information 

sharing and analysis within the water sector. 

Our survey of over 200 of the nation’s large wastewater facilities shows that 

many have made security improvements since 9/11. Most facilities indicated 

they have completed, have under way, or plan to complete some type of 

security assessment. Similarly, more than half of responding facilities 

indicated they did not use potentially dangerous gaseous chlorine as a

wastewater disinfectant. Survey responses show that other security 

measures taken after 9/11 have generally focused on controlling access to 

the treatment plant through improvements in visual surveillance, security 

lighting, and employee and visitor identification. Little effort, however, has

been made to address collection system vulnerabilities, as many facilities 

cited the technical complexity and expense involved in securing collection 

systems that cover large areas and have many access points. Others 

reported that taking other measures, such as converting from gaseous 

chlorine, took priority over collection system protections. 

While EPA and DHS have initiatives to address wastewater facility security,

efforts to provide critical and threat-related information would benefit from 

closer coordination. EPA and DHS fund multiple information services 

designed to communicate information to the water sector—specifically, EPA

funds the Water Information Sharing and Analysis Center (WaterISAC) and 

its Water Security Channel, while DHS funds the Homeland Security 

Information Network (HSIN). EPA, DHS, and other industry experts are 

concerned that these multiple information services may overlap and produce 

inefficiencies. For example, a substantial part of the $2 million annual grant 

EPA uses to fund the WaterISAC is dedicated to purchasing computer 

services likely available through DHS and HSIN at no cost. A Water Sector 

Coordinating Council was established by the water sector to help determine 

the appropriate relationship among these information services. A 

preliminary review is under way to examine options for improving 

coordination between the WaterISAC, the Water Security Channel, and 

HSIN; however, the scope and time frame for completion of this review is

unclear. 
Page i GAO-06-390 Wastewater Facility Security

Contents

Letter 1

Results in Brief 3

Background 5

Federal Laws and Directives Related to Wastewater Security Are 

Limited 7

Many Large Wastewater Facilities Have Made Security 

Improvements but Efforts to Protect Collection Systems Have 

Been Limited 13

EPA and DHS Have Several Initiatives to Enhance Wastewater 

Facility Security, Yet a Key Effort Requires Additional 

Coordination 22

Conclusions 28

Recommendation for Executive Action 29

Agency Comments and Our Evaluation 29

Appendixes

Appendix I: Scope and Methodology 31

Appendix II: Survey of Wastewater Treatment Facilities 33

Appendix III: Comments from the Environmental Protection Agency 61

Appendix IV: GAO Contact and Staff Acknowledgments 63

Table Table 1: Wastewater Facility Managers’ Opinions on Recommended 

Federal Role 21

Figures Figure 1: Vulnerability and Security Assessments at Large 

Wastewater Facilities 14

Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities 15

Figure 3: Security Measures at Large Wastewater Facilities That 

Still Use Gaseous Chlorine 17

Figure 4: Security Measures at Large Wastewater Facilities 19
Contents

Page ii GAO-06-390 Wastewater Facility Security

Abbreviations

AMWA Association of Metropolitan Water Agencies

ASCE American Society of Civil Engineers

CWNS Clean Watershed Needs Survey

CWSRF Clean Water State Revolving Fund

DHS Department of Homeland Security

EPA Environmental Protection Agency

HSIN Homeland Security Information Network

HSPD Homeland Security Presidential Directive

ISAC Information Sharing and Analysis Center

MOU memorandum of understanding

NACWA National Association of Clean Water Agencies 

NDWAC National Drinking Water Advisory Council

POTW publicly-owned treatment works

RAM-W Risk Assessment Methodology for Water Utilities

RMP Risk Management Plan

SCADA Supervisory Control and Data Acquisition

SEMS Security and Emergency Management System

VSAT Vulnerability Self Assessment Tool

WEF Water Environment Federation

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.
Page 1 GAO-06-390 Wastewater Facility Security

United States Government Accountability Office

Washington, D.C. 20548

A

March 31, 2006 Letr

The Honorable James M. Inhofe

Chairman

Committee on Environment and Public Works

United States Senate

Dear Mr. Chairman:

Wastewater facilities in the United States provide essential services to 

residential, commercial, and industrial users by collecting and treating 

wastewater and discharging treated effluent into receiving waters. These 

facilities may also provide opportunities for terrorists to either impair the 

wastewater treatment process or damage surrounding communities and 

infrastructure. For example, damage to a wastewater facility or collection 

system could prevent water from being treated, impacting downriver water 

intakes. Destroying tanks that hold large amounts of chemicals at 

treatment plants could release toxic chemical agents, such as gaseous 

chlorine, that can be deadly if inhaled and, at lower doses, could burn eyes 

and skin and inflame the lungs. Large underground collector sewers could 

be accessed by terrorist groups for purposes of placing destructive devices 

beneath buildings or city streets. 

In January 2005, we reported the views of nationally recognized experts on 

key issues concerning wastewater security.1

 The five assets experts 

considered most vulnerable included (1) the collection systems’ network of 

sewer lines used to move wastewater away from its point of origination to 

the treatment plant; (2) treatment chemicals, such as gaseous chlorine, 

used to disinfect wastewater; (3) key components of the wastewater 

treatment plant, such as its headworks, where raw sewage first enters the 

plant; (4) automated control systems that control many vital operations, 

such as the amount of chlorine needed for disinfection; and (5) pumping 

stations along the collection system that lift or pump wastewater to the 

treatment plant. The experts noted that security-enhancing activities that 

most warrant federal support include replacing gaseous chemicals used in 

wastewater treatment with less hazardous alternatives; improving local, 

state, and regional collaboration efforts; and completing vulnerability 

assessments for individual wastewater systems. When asked how federal 

1

GAO, Wastewater Facilities: Experts’ Views on How Federal Funds Should Be Spent to 

Improve Security, GAO-05-165 (Washington, D.C.: Jan. 31, 2005).
Page 2 GAO-06-390 Wastewater Facility Security

wastewater security funds should be allocated among potential recipients, 

the vast majority of experts suggested that wastewater utilities serving 

critical infrastructure (e.g., public health institutions, government, 

commercial, and industrial centers) should be given the highest priority. 

Other recipients warranting highest priority included utilities using large 

quantities of gaseous chemicals and utilities serving areas with large 

populations.

As a follow-on to that review, this report examines: (1) what federal 

statutory authorities and directives govern the protection of wastewater 

treatment facilities from terrorist attack, (2) what steps critical wastewater 

treatment facilities have taken since the terrorist attacks of September 11, 

2001, (hereafter referred to as “9/11”) to ensure that potential 

vulnerabilities are addressed, and (3) what steps the Environmental 

Protection Agency (EPA) and the Department of Homeland Security (DHS) 

have taken to help these facilities in their efforts to address such 

vulnerabilities.

To identify federal statutory authorities and directives that govern 

protection of wastewater treatment facilities, we reviewed applicable laws; 

Homeland Security Presidential Directives; and EPA and DHS policies, 

guidance, and regulations related to wastewater security. To determine 

what steps critical wastewater treatment facilities have taken since 9/11 to 

ensure that potential vulnerabilities are addressed, we conducted a Webbased survey of the nation’s publicly-owned treatment works (POTWs) that 

serve residential populations of 100,000 or greater. Together, these facilities 

provide wastewater service to approximately 36 percent of the U.S. 

population served by POTWs. We received an 82 percent response rate to 

the survey. To determine what steps EPA and DHS have taken to help these 

facilities in their efforts to address such vulnerabilities, we reviewed 

relevant EPA and DHS guidance and other documents, and interviewed 

agency personnel. We also interviewed state and local officials with 

oversight for wastewater treatment operations and security. Information 

about federal efforts to enhance wastewater security from the perspective 

of wastewater treatment facilities was provided to us through our Webbased survey. We conducted our work between May 2005 and February 

2006 in accordance with generally accepted government auditing 

standards. See appendix I for a more detailed discussion of our scope and 

methodology.
Page 3 GAO-06-390 Wastewater Facility Security

Results in Brief Federal law does not address wastewater security as comprehensively as it 

does drinking water security. In particular, wastewater facilities are not 

required by law to complete vulnerability assessments. This stands in 

contrast to the requirements for drinking water utilities in the Public Health 

Security and Bioterrorism Preparedness and Response Act of 2002 (the 

Bioterrorism Act),2

 which required drinking water utilities serving 

populations greater than 3,300 to complete vulnerability assessments by 

June 2004. The Clean Air Act does require wastewater facilities using more 

than 2,500 pounds of gaseous chlorine to submit to EPA a risk management 

plan that lays out accident prevention and emergency response activities. 

Also, under EPA guidance, the Clean Water State Revolving Fund program, 

administered by the states with EPA funding to help local governments 

meet their wastewater treatment needs, can be used in many instances for 

certain wastewater system security enhancements. While federal statutes 

governing wastewater security are limited, in December 2003, the president 

issued Homeland Security Presidential Directive 7 (HSPD-7), designating 

EPA as the lead agency to oversee the security of the water sector 

(including both drinking water and wastewater). Under the directive, EPA 

is responsible for (1) identifying, prioritizing, and coordinating 

infrastructure protection activities for the nation's drinking water and 

water treatment systems; (2) working with federal departments and 

agencies, state and local governments, and the private sector to facilitate 

vulnerability assessments; (3) encouraging the development of risk 

management strategies to protect against, and mitigate the effects of, 

potential attacks on critical resources; and (4) developing mechanisms for 

information sharing and analysis. 

Our survey of large wastewater facilities indicates that many have made 

security improvements since 9/11. While not required, most facilities 

indicated they have completed, have under way, or plan to complete some 

type of security assessment. For example, 51 percent of facilities 

responding to our survey indicated that they either completed a 

vulnerability assessment similar to that required of drinking water facilities 

under the Bioterrorism Act, or have one currently under way. In addition, 

another 23 percent of facilities reported that they have conducted, had 

under way, or planned to conduct, some type of security assessment. 

Survey responses show that security measures undertaken by large 

wastewater facilities after 9/11 have generally focused on controlling 

2

Pub. L. No. 107-188 (2002). 
Page 4 GAO-06-390 Wastewater Facility Security

access to the treatment plant through improvements in visual surveillance, 

security lighting, and employee and visitor identification. Survey results 

also show that facilities are continuing to move away from the use of 

gaseous chlorine as a wastewater disinfectant. Fifty-six percent of facilities 

indicated they do not use chlorine gas as a wastewater disinfectant, while 

another ten percent indicated they plan to stop using the gas. Importantly, 

survey results show that facilities have taken little action to address 

collection system vulnerabilities. Many facilities cited a shortage of the 

considerable funds required to secure a collection system that covers a 

large area and has many, often remote, access points. Consequently, few 

have installed, or plan to install, manhole intrusion sensors, manhole locks, 

or sensors to detect toxics or other biochemical threats to their collection 

system. Others reported that taking other measures, such as converting 

from gaseous chlorine to a safer disinfection process, took priority over 

protecting infrastructure in their collection systems. Survey results show 

that a lack of funding and federal security guidelines remain a concern for 

many wastewater facility managers. For its part, EPA is funding efforts to 

develop security guidance related to wastewater collection systems that 

should help inform wastewater facility managers of security options in this 

area. 

While EPA and DHS have several initiatives under way to address the 

security concerns of wastewater facility managers, efforts to provide 

critical and threat-related information would benefit from additional 

coordination. EPA and DHS fund multiple information services designed to 

communicate information to the water sector. Specifically, EPA funds the 

Water Information Sharing and Analysis Center (WaterISAC) and its Water 

Security Channel, while DHS funds the Homeland Security Information 

Network (HSIN). EPA, DHS, and other industry experts have expressed 

concern that these multiple information services may overlap and produce 

inefficiencies. A Water Sector Coordinating Council was created with 

representative members of the water community to, among other things, 

identify the appropriate use of and the relationship among the WaterISAC, 

the Water Security Channel, and HSIN. We believe that steps could be taken 

that would improve the efficiency with which limited available funds are 

being spent to communicate information to the water sector. For example, 

a substantial part of the $2 million annual grant EPA uses to fund the 

WaterISAC is dedicated to purchasing computer services likely available 

through DHS and HSIN at no cost. According to EPA, a preliminary review 

is under way by the Water Sector Coordinating Council that examines 

options for improving coordination between the WaterISAC, the Water 

Security Channel, and HSIN. However, the scope of the preliminary review 
Page 5 GAO-06-390 Wastewater Facility Security

is not clear, nor is a time frame set to complete the review. Consequently, 

we are recommending that the Administrator of EPA work with DHS and 

the Water Sector Coordinating Council to identify areas where the 

WaterISAC and HSIN networks could be better coordinated, focusing in 

particular on (1) how operational duplications and overlap could be 

addressed, and (2) how water systems’ access to timely security threat 

information could be improved. We are also recommending that EPA work 

with DHS and the Water Sector Coordinating Council to identify realistic 

time frames for the completion of these tasks. 

Background Nationwide, more than 16,000 POTWs serve more than 200 million people, 

or about 70 percent of the nation’s total population. The remaining 

population is served by privately-owned utilities or by on-site systems, such 

as septic tanks. A relative handful of large wastewater systems serve the 

great majority of people, as about 500 large public wastewater systems 

provide service to 62 percent of the population connected to a sewer 

system. In addition to serving residential populations, approximately 

27,000 commercial and industrial facilities rely on wastewater treatment 

facilities to treat their wastewater. POTWs discharge treated effluent into 

receiving waters and are regulated under the Clean Water Act.

Wastewater systems vary by size and other factors, but all include a 

collection system and a treatment facility.

• The collection system is the underground network of sewers including 

both sanitary and storm water collection lines. Collection systems tend 

to be dispersed geographically and have multiple access points, 

including drains, catch basins, and manholes. Lines may range from 4 

inches to greater than 20 feet in diameter, and access is usually 

conducted through manholes that are typically 300 feet apart. Many 

collection systems rely on gravity to maintain the flow of sewage 

through the pipes toward the treatment plant. However, collection 

systems may also depend on pumping stations to propel the flow when 

gravity alone is insufficient. Nationwide, there are approximately 

800,000 miles of sewer lines and 100,000 major pumping stations.

• The wastewater treatment facility receives wastewater from the 

collection system and begins the treatment process which typically 

involves several stages before treated effluent is released into receiving 

waters. Primary treatment includes removal of larger objects through a 

screening device or a grit removal system, and the removal of solids 
Page 6 GAO-06-390 Wastewater Facility Security

through sedimentation. Secondary stage treatment includes a biological 

process that consumes pollutants, as well as final sedimentation. Some 

facilities also use tertiary treatment to remove nutrients and other 

matter even further. Following these treatments, the wastewater is 

disinfected to destroy harmful bacteria and viruses. Disinfection is often 

accomplished with chlorine, which is stored in gaseous or liquid form 

on-site at the wastewater treatment plant. The collection system and 

treatment process is typically monitored and controlled by a 

Supervisory Control and Data Acquisition (SCADA) system, which 

allows utilities to control such things as the amount of chlorine needed 

for disinfection. 

Wastewater treatment facilities may possess certain characteristics that 

terrorists could exploit either to impair the wastewater treatment process 

or to damage surrounding communities and infrastructure. For example, 

the numerous storm drains, manholes, and sewers that make up a 

community’s wastewater collection system’s network of sewers could be 

used to covertly place explosives beneath a major population center or to 

introduce substances that may damage a wastewater treatment plant’s 

process. Damage to (or destruction of) tanks that hold large amounts of 

gaseous chlorine used to disinfect wastewater could release the potentially 

lethal gas into the atmosphere. Such events could result in loss of life, 

destruction of property, and harm to the environment. 

Documented accidents and intentional acts highlight the destruction that 

could arise from an attack on a wastewater system. 

• In June 1977 in Akron, Ohio, an intentional release of naptha, a cleaning 

solvent, and alcohol into a sewer by vandals at a rubber manufacturing 

plant caused explosions 3.5 miles away from the plant, damaging about 

5,400 feet of sewer line and resulting in more than $10 million in 

damage.

• In 1981 in Louisville, Kentucky, thousands of gallons of a highly 

flammable solvent, hexane, spilled into the sewer lines from a local 

processing plant. Fumes from the solvent ignited, and the resulting 

explosions collapsed a 12-foot diameter pipe and damaged more than 2 

miles of streets. No one was seriously injured, but sewer line repairs 

took 20 months, followed by several more months to repair the streets.
Page 7 GAO-06-390 Wastewater Facility Security

• In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused 

explosions that killed 215 people, injured 1,500 others, damaged 1,600 

buildings, and destroyed 1.25 miles of sewer. 

• In 2002 in Hagerstown, Maryland, chemicals from an unknown source 

entered the wastewater treatment plant and destroyed the facility’s 

biological treatment process. The event resulted in the discharge of 

millions of gallons of partially treated sewage into a major tributary of 

the Potomac River, less than 100 miles from a water supply intake for 

the Washington, D.C., metropolitan area.

In January 2005, we reported the views of 50 nationally recognized experts 

on key issues concerning wastewater security. Our panel of experts 

identified five key wastewater assets as most vulnerable to terrorist 

attacks: the collection systems’ network of sewers (42 of 50 experts), 

treatment chemicals (32 of 50 experts), key components of the treatment 

plant (29 of 50 experts), control systems (18 of 50 experts), and pumping 

stations (16 of 50 experts). When asked to identify and set priorities for the 

security-enhancing activities most deserving of federal support, the expert 

panel identified 11 key actions, but ranked three as deserving highest 

priority—replacing gaseous chemicals used in the wastewater treatment 

process; improving local, state, and regional efforts to coordinate 

responses in advance of a potential terrorist threat; and completing 

vulnerability assessments for individual wastewater systems.

Federal Laws and 

Directives Related to 

Wastewater Security 

Are Limited

Federal law does not address wastewater security as comprehensively as it 

does drinking water security. In particular, wastewater facilities are not 

required by law to complete vulnerability assessments. The Clean Air Act 

does require wastewater facilities using certain amounts of hazardous 

substances, such as chlorine gas, to submit to EPA a risk management plan 

that lays out accident prevention and emergency response activities. Also, 

under EPA guidance, the Clean Water State Revolving Fund can be used in 

many instances for certain wastewater system security enhancements. 

While federal law governing wastewater security is limited, in December 

2003, the president issued HSPD-7. The directive designated EPA as the 

lead agency to oversee the security of the water sector, including both 

drinking water and wastewater critical infrastructures. 
Page 8 GAO-06-390 Wastewater Facility Security

Federal Law Does Not 

Address Wastewater 

Security As It Does Drinking 

Water

In 2002, Congress passed the Bioterrorism Act, which amended various 

laws, including the Safe Drinking Water Act.3

 The Bioterrorism Act required 

drinking water systems serving more than 3,300 people to complete 

vulnerability assessments of their facilities by June 2004 and to prepare or 

update an existing emergency response plan. The Bioterrorism Act 

required the assessments to include, but not be limited to, a review of six 

components: (1) pipes and constructed conveyances; (2) physical barriers; 

(3) water collection, pretreatment, treatment, storage, and distribution 

facilities; (4) electronic, computer, or other automated systems which are 

utilized by the public water system; (5) the use, storage, or handling of 

various chemicals; and (6) the operation and maintenance of such 

systems.4

 Under the act, the emergency response plans were to include 

plans, procedures, and identification of equipment to lessen the impact on 

public health and the drinking water supply of terrorist attacks or other 

intentional acts against drinking water systems. The act authorized $210 

million for fiscal year 2002, mostly to assist drinking water systems in 

completing vulnerability assessments, preparing or updating response 

plans, and making needed security improvements. Drinking water systems 

are not required to implement any risk-reduction actions based on their 

vulnerability assessments or report to EPA on measures that have been 

implemented. 

In 2003, the Congress considered alternative bills that would have 

encouraged or required wastewater treatment plants to assess the 

vulnerability of wastewater facilities, make physical security 

improvements, and conduct research. However, the legislation did not 

become law and, consequently, no such requirement or specific funding 

exists for wastewater facilities. 

3

42 U.S.C. §§ 300f-300j.

4

When we discuss vulnerability assessments in this report, we are referring to assessments 

that include the review criteria identified in the Bioterrorism Act and in EPA guidance. EPA 

issued guidance on vulnerability assessments for drinking water systems regulated under 

the Bioterrorism Act that stated the assessments should address six key elements: (1) 

characterization of the system, including its mission and objectives; (2) identification and 

prioritization of adverse consequences to avoid; (3) determination of critical assets that 

might be subject to malevolent acts that could result in undesired consequences; (4) 

assessment of the likelihood of such malevolent acts; (5) evaluation of existing 

countermeasures; and (6) analysis of current risk, and development of a prioritized plan for 

risk reduction. 
Page 9 GAO-06-390 Wastewater Facility Security

Other Federal 

Environmental Laws 

Address Some Areas of 

Security at Wastewater 

Facilities

While federal law does not require wastewater systems to take security 

measures to protect specifically against a terrorist attack, it does require 

certain wastewater facilities to take security precautions that could 

mitigate the consequences of such an attack. For example, the 1990 Clean 

Air Act amendments5

 mandated EPA oversight of risk management 

planning at facilities that handle more than specified-threshold quantities 

of hazardous substances, including the gaseous chlorine often used as a 

disinfectant at wastewater facilities.6

 Specifically, EPA regulations 

implementing the Clean Air Act require these facilities to prepare Risk 

Management Plans (RMPs) that summarize the potential threat of sudden, 

accidental, large releases of certain chemicals; including the results 

occurring off-site in a worst-case chemical accident, and the facility’s plan 

to prevent releases and mitigate any damage. RMPs are to be revised and 

resubmitted to EPA at least every 5 years, and EPA is required to review 

them and require revisions, if necessary. 

For a March 2003 report,7 EPA told us it believed the Clean Air Act could be 

interpreted to provide authority to address site security from terrorist 

attacks at RMP facilities, because the act imposes certain requirements on 

these facilities regarding “accidental releases.” The act defines an 

accidental release as an unanticipated emission of a regulated substance or 

other extremely hazardous substance into the air, so any chemical release 

caused by a terrorist attack could be considered “unanticipated” and 

covered under the Clean Air Act. Such an interpretation would provide EPA 

with authority under the act’s RMP provisions and general duty clause8

 to 

require security measures or vulnerability assessments with regard to 

terrorism. However, EPA has not attempted to use these Clean Air Act 

provisions because it is concerned that such an interpretation would pose 

significant litigation risk and has concluded that chemical facility security 

would be more effectively addressed by passage of specific legislation. 

5

Pub. L. No. 101-549 (1990).

6

EPA requires that any facility storing at least 2,500 pounds of chlorine gas submit a RMP. 

7

GAO, Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, 

but the Extent of Security Preparedness Is Unknown, GAO-03-439 (Washington, D.C.: 

March 14, 2003).

8

Specifically, section 112(r)(1) of the Clean Air Act includes a general duty clause directing 

owners and operators of facilities that produce, process, handle, or store listed or other 

extremely hazardous substances to identify hazards, design and maintain a safe facility to 

prevent releases, and minimize the consequences of any accidental releases that occur.
Page 10 GAO-06-390 Wastewater Facility Security

Wastewater facilities that store certain amounts of hazardous chemicals 

may also be subject to the Resource Conservation and Recovery Act.9

 

Under regulations implementing the act, facilities that house hazardous 

waste generally must take certain security actions, such as posting warning 

signs and using a 24-hour surveillance system, or surrounding the active 

portion of the facility with a barrier and controlled entry gates.10 However, 

according to EPA, these security measures are aimed at keeping out 

trespassers or wanderers, not intentional intruders.

Other federal statutes impose safety requirements on certain wastewater 

facilities that may incidentally reduce the likelihood and mitigate the 

consequences of terrorist attacks. For example, the Occupational Safety 

and Health Act11 imposes a number of safety requirements, including a 

general duty to furnish a workplace free from recognized hazards that may 

cause death or serious physical harm to employees. The Emergency 

Planning and Community Right-to-Know Act12 requires owners of facilities 

that maintain specified quantities of certain extremely hazardous 

chemicals to submit information annually on their chemical inventory to 

state and local emergency response officials. The act also requires that 

each state establish a State Emergency Response Commission to oversee 

local emergency planning and create local emergency planning 

committees. These committees must develop and periodically review their 

communities’ emergency response plans, including the identification of 

chemical facilities, and outline procedures for response personnel to 

follow in the event of a chemical incident.

Aside from statutes that address some areas of wastewater security, EPA 

has asserted that federal funding is available for wastewater securityrelated measures through the Clean Water State Revolving Fund (CWSRF) 

program.13 The CWSRF is an EPA-administered program that provides 

grants to the states to fund a variety of water-quality projects, including 

those at municipal wastewater treatment facilities. States may use the 

funds to provide loans to local governments to assist wastewater utilities in 

9

Pub. L. No. 94-580 (1976), 42 U.S.C. §§ 6901-6992k.

1040 C.F.R. § 264.14.

11Pub. L. No. 91-596 (1970), 29 U.S.C. §§ 651-678.

12Pub. L. No. 99-499 (1986), 42 U.S.C. §§ 11001-11050.

13Pub. L. No. 100-7 (1987).
Page 11 GAO-06-390 Wastewater Facility Security

making infrastructure improvements needed to protect public health and 

ensure compliance with the Clean Water Act. According to EPA, states may 

use the CWSRF to assist utilities in completing a variety of security-related 

actions, such as vulnerability assessments, contingency plans, and 

emergency response plans. In addition, EPA has identified other 

infrastructure improvements that may be eligible for funding, such as the 

conversion from gaseous chemicals to alternative treatment processes, 

installation of fencing or security cameras, securing large sanitary sewers, 

and installing tamper-proof manholes.14 In our January 2005 report 

summarizing experts’ views on wastewater security, a number of experts 

expressed caution about relying heavily on the CWSRF program to support 

security enhancements, largely because of the time-lag in obtaining funds 

for security-related measures, and because such demands on the CWSRF 

would divert needed funding away from the kind of critical infrastructure 

investments that are the CWSRF program’s primary purpose.

Another source of federal funding potentially available for wastewater 

security-related measures is the State Homeland Security Grant Program 

administered by DHS. This program’s primary objectives are to enhance the 

capacity of state and local emergency responders to prevent, protect 

against, respond to, and recover from terrorist incidents involving 

chemical, biological, radiological, nuclear, and explosive devices; 

agriculture; and cyber attacks. Under the program, grants are provided to 

states for a variety of purposes, including homeland security-related 

training and protection of critical infrastructure, although authority to 

make physical security improvements is limited. States are required to 

allocate at least 80 percent of these grant funds to “local units of 

governments,” which, as defined in the conference report accompanying 

the Department of Homeland Security Appropriations Act for fiscal year 

2006, include water districts, special districts, and other political 

subdivisions of a state.

14EPA fact sheet, “Use of the Clean Water State Revolving Fund to Implement Security 

Measures at Publicly-owned Wastewater Treatment Works” (Washington, D.C., 2003).
Page 12 GAO-06-390 Wastewater Facility Security

EPA Was Assigned Lead 

Federal Responsibility for 

Water-Sector Security 

Including Wastewater 

Facilities

In December 2003, the president issued HSPD-7, which established a 

national policy for federal departments and agencies to identify and set 

priorities for the nation’s critical infrastructures and to protect them from 

terrorist attacks. HSPD-7 established EPA as the lead federal agency to 

oversee the security of the water sector, both drinking water and 

wastewater. Presidential Decision Directive 63 had done so earlier in May 

1998, with a focus primarily on water supply. 

Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and 

coordinating infrastructure protection activities for the nation's drinking 

water and water treatment systems; (2) working with federal departments 

and agencies, state and local governments, and the private sector to 

facilitate vulnerability assessments; (3) encouraging the development of 

risk management strategies to protect against and mitigate the effects of 

potential attacks on critical resources; and (4) developing mechanisms for 

information sharing and analysis. 

HSPD-7 also called for DHS to integrate all critical infrastructure security 

efforts among federal agencies and to complete a comprehensive national 

plan for critical infrastructure and key resource protection—now called the 

National Infrastructure Protection Plan. Under HSPD-7, seven federal 

agencies, including EPA, were designated sector-specific agencies. DHS 

issued guidance tasking each sector-specific agency with developing 

sector-specific plans for input into the comprehensive plan. Each sectorspecific plan is supposed to outline strategies for (1) collaborating with all 

relevant federal departments and agencies, state and local governments, 

and the private sector; (2) identifying assets; (3) conducting or facilitating 

vulnerability assessments; and (4) encouraging risk management strategies 

to protect against and mitigate the effects of an attack. The water sectorspecific plan will be an appendix to the National Infrastructure Protection 

Plan. On January 20, 2006, DHS issued its revised National Infrastructure 

Protection Plan based on comments it received on an earlier version of the 

plan. DHS accepted additional comments on the revised version until 

February 6, 2006, and expects to issue a final version of the plan later in 

2006. Sector-specific agencies are required to submit their sector-specific 

plans to DHS within 6 months after the National Infrastructure Protection 

Plan is made final. 
Page 13 GAO-06-390 Wastewater Facility Security

Many Large 

Wastewater Facilities 

Have Made Security 

Improvements but 

Efforts to Protect 

Collection Systems 

Have Been Limited

Our survey of large wastewater facilities indicates that many have taken 

steps to improve security. Most facilities that responded to our survey have 

completed, have under way, or plan to complete some type of security 

assessment. Roughly two-thirds of facilities also reported they used a 

disinfectant other than gaseous chlorine or plan to switch from the gas. Of 

those facilities that continue to use gaseous chlorine, many have taken 

steps to increase security by limiting and monitoring access to gaseous 

chlorine storage areas or through other actions. Survey responses show 

that since 9/11, wastewater treatment facilities have also focused security 

efforts on controlling and limiting access to their treatment plants. 

Importantly, facilities have taken fewer security actions intended to protect 

treatment collection systems. Many facilities reported that taking other 

measures to protect their treatment plants, including converting from 

gaseous chlorine to a safer disinfection process, took priority over 

protecting infrastructure in their collection systems. Survey results show a 

lack of funding and federal security guidelines remain a concern for many 

wastewater facility managers.

Most Facilities Have 

Conducted or Plan to 

Conduct Some Type of 

Security Assessment

Seventy-four percent of facilities that responded to our survey reported 

they completed, were in the process of completing, or planned to complete 

some type of security assessment—either a vulnerability assessment, 

similar to that which was required of drinking water facilities under the 

Bioterrorism Act, or another type of security assessment. As shown in 

figure 1, 106 facilities—or 51 percent of those responding to our survey—

indicated that they had completed a vulnerability assessment or were 

currently conducting a vulnerability assessment.
Page 14 GAO-06-390 Wastewater Facility Security

Figure 1: Vulnerability and Security Assessments at Large Wastewater Facilities

Of the 106 facilities that indicated they had either completed a vulnerability 

assessment or had one under way, 80 indicated their vulnerability 

assessments were complete, while 26 indicated the assessment was still in 

process. As shown in the figure, 22 facilities—or 11 percent of all 

responses—indicated they had conducted another type of security 

assessment or were in the process of conducting another type of security 

assessment, while 24 facilities—or 12 percent of all responses—indicated 

they plan to conduct either a vulnerability or another type of security 

assessment. 

Twenty-three facilities—or 11 percent of total responses—indicated they 

had no plans to conduct any type of security assessment. When asked to 

identify reasons for not conducting a vulnerability or security assessment, 

17 of these 23 facilities cited a lack of requirement to do so, while 15 noted 

that they considered security actions taken at their facilities adequate for 

their security needs. Thirteen of these facilities indicated that their 

emergency response plan was updated and this seemed sufficient to 

address potential vulnerabilities. 

Vulnerability assessment 

complete or underway (106)

Don't know/no response (31)

Plan to conduct either a vulnerability 

or security assessment (24)

No plans to do either a vulnerability 

or security assessment (23)

Security assessment 

completed or underway (22)

11%

11%

12%

15%

51%

Source: GAO survey of wastewater facilities.
Page 15 GAO-06-390 Wastewater Facility Security

Facilities cited several reasons for completing a vulnerability or some other 

type of security assessment, but most—roughly 77 percent—reported 

doing so on their own initiative. Thirty-seven percent of facilities reported 

that they did so in conjunction with the required assessment for their 

drinking water facility.15 To a lesser extent, facilities cited state, local, and 

utility governing-body requirements as reasons they conducted 

assessments. See appendix II for survey results related to vulnerability and 

security assessments at large wastewater facilities. 

Most Large Facilities Have 

Discontinued or Plan to 

Discontinue Use of Gaseous 

Chlorine, and Chlorine 

Users Have Pursued Other 

Security Enhancements

As shown in figure 2, over half of large wastewater facilities in our survey 

reported they use an alternative to gaseous chlorine in their disinfection 

process. These results are consistent with studies which conclude that over 

the past decade, wastewater treatment facilities have moved away from 

gaseous chlorine as a disinfectant.

Figure 2: Gaseous Chlorine Use at Large Wastewater Facilities

Note: Totals do not add to 100 percent due to rounding. 

15Forty-eight percent of facilities responding to our survey indicated they were combined 

systems, in that they managed both drinking water and wastewater treatment. 

41%

56%

Source: GAO survey of wastewater facilities.

Does not use gaseous chlorine (116)

Currently uses gaseous chlorine (85)

2%

Does not know/no response (5)
Page 16 GAO-06-390 Wastewater Facility Security

Of the facilities not using gaseous chlorine, 89 reported using sodium 

hypochlorite as their primary disinfectant. Sodium hypochlorite is 

essentially a strong version of household bleach and is considered safer 

than gaseous chlorine. Seventeen facilities report they are using ultraviolet 

light as their primary disinfectant. The remaining facilities did not identify 

the type of disinfectant method used at their facility. 

In our January 2005 report, we noted that the change, for an individual 

plant, to sodium hypochlorite may require approximately $12.5 million for 

new equipment and increase annual chemical costs from $600,000 for 

gaseous chlorine to over $2 million for sodium hypochlorite. However, one 

expert noted some costs may be offset through savings in regulatory 

paperwork and certain emergency planning efforts. In our survey, we asked 

facilities that switched from gaseous chlorine if their annual costs 

increased, stayed the same, or decreased after switching to an alternate 

disinfection method. Fifty-eight facilities reported that costs increased, 11 

noted that costs have stayed about the same, and one facility reported that 

costs decreased.

Of the 85 facilities that reported use of gaseous chlorine, 20—or roughly 10 

percent of all 206 reporting facilities—indicated that they have plans to 

switch from gaseous chlorine to another disinfectant. In addition, as shown 

in figure 3, many reported taking additional steps after 9/11 to mitigate the 

potential risks associated with continued reliance on chlorine. 
Page 17 GAO-06-390 Wastewater Facility Security

Figure 3: Security Measures at Large Wastewater Facilities That Still Use Gaseous 

Chlorine 

a

Other physical improvements include, among others, improvements to gates and fencing; physical 

barriers, security guards, intrusion alarms and motion detectors; and enclosure of the chlorine storage 

area. Results are based on 85 facilities that reported using gaseous chlorine as a primary disinfectant.

Forty-one facilities using gaseous chlorine reported that they instituted 

controls for selective access to chlorine storage areas after 9/11, while 30 

facilities reported making other security improvements to the storage area, 

such as installing electronic surveillance of the chlorine storage area or 

improving gates and fencing. Fewer facilities reported that they decided to 

store gaseous chlorine in smaller-quantity containers, likely because most 

reported they already stored the gas in one-ton containers, which are 

among the smallest containers used at large wastewater facilities for the 

gas.16 See appendix II for survey results on gaseous chlorine use at large 

wastewater facilities. 

16Specifically, of the 85 facilities reporting current use of gaseous chlorine, 59 store gaseous 

chlorine in one-ton containers. This method of storage is considered by experts to be safer 

than storing it in larger containers because ruptures or leaks would be limited to smaller 

areas. Three facilities reported storing gaseous chlorine in 150-pound cylinders. Six facilities 

reported storing gaseous chlorine in 17-ton tractor trailers, while nine reported storing the 

gas in 91-ton rail cars. Eight facilities did not report a storage method.

Source: GAO survey of wastewater facilities.

0 10 20 30 40 50 60

After 9/11

Before 9/11

Converted from large to smaller

chlorine storage containers

Other physical improvements

to chlorine storage areaa

Installed electronic surveillance

of chlorine storage area

Restricted access to

chlorine storage area

Number of facilities

Security measure
Page 18 GAO-06-390 Wastewater Facility Security

Security Efforts Have 

Generally Focused on 

Improved Control of 

Wastewater Treatment Plant 

Access, While Efforts to 

Protect Collection Systems 

Have Been Limited

As shown in figure 4, many facilities reported taking basic security 

measures prior to 9/11, such as installing vehicle gates and security fencing. 

Survey respondents also indicated that many information technology 

security measures, such as virus protection programs, backup power 

supplies, and firewall and intrusion detection systems, were implemented 

before 9/11. 

The figure shows that security enhancements made or planned by large 

wastewater facilities after 9/11 generally focus on controlling access to the 

treatment plant. Such security enhancements include adding visual 

surveillance monitoring, increasing security lighting, implementing 

employee and visitor identification policies, adding guard stations, and 

upgrading SCADA capability and security. 

Importantly, few facilities reported taking measures to address collection 

system vulnerabilities other than having available redundant pumping 

devices or collection bypass systems. For example, few have installed or 

plan to install manhole intrusion sensors, manhole locks, or sensors to 

detect toxics or other biochemical threats to their collection systems. This 

lack of attention to collection system vulnerabilities is important because 

42 of the 50 experts polled in our January 2005 report on wastewater 

security identified the collection systems’ network of sanitary, storm, and 

combined sewers as the most vulnerable asset of a wastewater utility. 

Several noted that sewers make underground travel from a point of entry to 

a potential target almost undetectable, possibly allowing sewers to be used 

as an underground transport system for explosive or toxic agents. 

Many facilities reported that other measures to protect their treatment 

plants, including converting from gaseous chlorine to a safer disinfection 

process, took priority over protecting infrastructure in their collection 

systems. Other managers cited the difficulty and expense in securing 

collection systems that, by nature, cover a large area and have many, often 

remote, access points. One manager expressed confusion about whether to 

concentrate monitoring resources on large interceptor sewer lines to 

prevent entry or on toxic materials that could be introduced at nearly every 

access point to his system. Others noted the lack of facility control over 

collection systems. One facility manager told us his facility treats 

wastewater that is collected from 17 separate collection systems. Finally, a 

number of respondents questioned whether the technologies purportedly 

available to detect potential threats introduced to collection systems are 

sufficiently capable of achieving this objective.
Page 19 GAO-06-390 Wastewater Facility Security

Figure 4: Security Measures at Large Wastewater Facilities 

Note: Figure is based on results from 206 wastewater facilities.

Source: GAO survey of wastewater facilities.

0 50 100 150 200

Planned

After 9/11

Before 9/11

Manhole intrusion sensors

Manhole locks

Smart pipes to detect toxics

and other biochemical threats

Redundant pumping devices

or collection bypass systems

Guard stations

Identification required of

non-utility personnel

Visual surveillance

monitoring

Increased security lighting

Employee photo

identification

Hardening of

SCADA system

Vehicle gates

Network firewall, intrusion and

monitoring protections

Security fences

Number of facilities

Security measures relating to

Plant

access

Collection

system
Page 20 GAO-06-390 Wastewater Facility Security

Nonetheless, a few facility managers with whom we spoke told us they 

have made efforts to address collection system security, particularly in the 

protection of their pump stations. One facility manager told us his facility 

has a project under way to install security locks and card-access controls at 

all 93 of its pumping stations. According to the manager, the concentration 

of and need to protect capital equipment, and the potential impact of 

damage or destruction of that infrastructure prompted the facility to direct 

its capital improvement efforts to securing pumping stations.

While many facilities in our survey indicated they made some security 

improvements after 9/11, facility managers cited limited resources and 

other priorities as reasons for not implementing further security measures. 

Facility managers and other industry experts with whom we spoke noted 

that security upgrades must compete with other infrastructure needs for 

available resources. For instance, many wastewater facilities’ collection 

systems are outdated, and they are already facing large costs to expand and 

repair their aging systems and reduce incidences of combined sewer 

overflows.17 Major U.S. cities, such as Washington, D.C., and Cincinnati, 

Ohio, are facing costs between $1 and $2 billion to implement necessary 

capital improvements. See appendix II for survey results on physical, 

personnel, and information technology security measures taken at large 

wastewater facilities. 

Many Facility Managers 

Reported a Need for 

Additional Funding and 

Other Assistance to Further 

Security Improvements 

In our survey, we asked wastewater facility managers what the federal 

government could do to improve security at wastewater facilities. Facility 

manager responses are categorized in table 1.

17Combined sewer systems collect rainwater runoff, domestic sewage, and industrial 

wastewater in the same pipe. During periods of heavy rainfall or snowmelt the wastewater 

volume in a combined sewer system can exceed the capacity of the sewer system or 

treatment plant, resulting in an overflow and discharge of untreated wastewater directly to 

nearby streams, rivers, or other water bodies. EPA considers these overflows to be a major 

pollution concern for the approximately 772 cities that have combined sewer systems.
Page 21 GAO-06-390 Wastewater Facility Security

Table 1: Wastewater Facility Managers’ Opinions on Recommended Federal Role

Source: GAO survey of wastewater facilities.

Facility managers predominantly recommended additional funding to 

further wastewater security improvements. Many facility managers 

recommended targeting funding to specific measures, such as performing 

vulnerability assessments, purchasing specific security equipment such as 

surveillance cameras, or covering costs associated with switching from 

gaseous chlorine to a safer disinfectant. To a much lesser extent, 

wastewater facility managers commented that the federal government 

could be of greater assistance in providing security guidance, standards, 

and best practices. For example, one facility manager we interviewed 

expressed a need for federal guidance and best practices on collection 

system security. For its part, in 2002, EPA provided funding to the 

American Society of Civil Engineers (ASCE) to develop a set of security 

guidance documents that cover the design of online contaminant 

monitoring systems, and physical security enhancements of drinking water, 

wastewater, and storm water infrastructure systems. ASCE sub-contracted 

with American Water Works Association and the Water Environment 

Federation (WEF) for assistance on this project. In 2004 these documents 

were released as interim voluntary security design standards for the water 

sector and finalized standards are to be established in late 2006 or early 

2007. These security-focused documents are intended to serve as a 

foundation to help water utilities address potential vulnerabilities through 

sound design, construction, and operation and maintenance practices. 

According to a WEF representative, one set of standards is to be directed at 

physical security measures for wastewater collection systems. The security 

standards are to be published in late 2006 and are to include both 

prescriptive and performance-based criteria that focus on physical security 

upgrades that reduce risk to water, wastewater, and storm water 

infrastructure arising from malevolent events.

Recommended federal role

Number of 

responses

Funding 102

Guidelines, standards, best practices, expertise, and information 36

Training and education 14

Requirements and mandates 14

Providing threat or security information 9

Other 18
Page 22 GAO-06-390 Wastewater Facility Security

EPA and DHS Have 

Several Initiatives to 

Enhance Wastewater 

Facility Security, Yet a 

Key Effort Requires 

Additional 

Coordination

EPA and DHS have a number of initiatives under way related to wastewater 

facility security. For example, EPA has funded programs to develop 

vulnerability assessment tools and provide training to wastewater facilities 

on the use of these tools, while DHS has conducted site assessment visits at 

wastewater facilities. While these initiatives are helping to address security 

concerns in the wastewater sector, EPA and DHS efforts could nonetheless 

be more effective with greater coordination over how best to convey 

security-related and threat information to the wastewater treatment 

community. 

EPA and DHS Have Several 

Initiatives Under Way 

Related to Wastewater 

Security

Since 2002, EPA has provided more than $10 million to help address the 

security needs of the wastewater sector. EPA funded the development and 

dissemination of several risk assessment methodologies to assist water 

sector utilities in identifying how to better protect their critical 

infrastructures. In addition, EPA funded training for wastewater utilities on 

how to conduct risk assessments and update or complete emergency 

response plans. EPA provided funding to the Association of Metropolitan 

Sewerage Agencies18 to develop a software tool, called the Vulnerability 

Self Assessment Tool (VSAT), for drinking water utilities. In addition, 

through an interagency agreement with EPA, the Department of Energy’s 

Sandia National Laboratories provided training to selected firms in a 

vulnerability assessment methodology developed by the labs, called the 

Risk Assessment Methodology for Water Utilities (RAM-W). For 

vulnerability assessments at smaller water systems, EPA supported the 

dissemination of the Security and Emergency Management System (SEMS) 

software tool. 

Sixty-nine wastewater facilities responding to our survey indicated they 

used, were currently using, or planned to use the VSAT software to 

complete a vulnerability or security assessment; 27 facilities indicated they 

either used, were currently using, or planned to use the RAM-W assessment 

tool. Another four facilities indicated they either used, were currently 

using, or planned to use the SEMS software. 

EPA has also reorganized its own internal structure and sought input from 

experts outside of the agency to better assist the wastewater industry’s 

18Now the National Association of Clean Water Agencies (NACWA).
Page 23 GAO-06-390 Wastewater Facility Security

security efforts. In particular, in 2003, EPA created a Water Security 

Division to work with the states, tribes, drinking water and wastewater 

utilities, and other partners to enhance the security of water and 

wastewater utilities and the ability to respond effectively to security threats 

and breaches. In addition, in 2004, the National Drinking Water Advisory 

Council (NDWAC),19 at EPA’s request, established a Water Security Working 

Group made up of 16 members from wastewater utilities, drinking water 

utilities, and environmental and rate-setting organizations to advise on the 

development of best security practices and policies for water utilities. The 

group advises the NDWAC on ways to address several specific security 

needs of the sector. In June 2005, the working group provided NDWAC with 

a report that identified features of an active and effective security program 

and ways to measure the adoption of these practices.

As noted, EPA provided funding to ASCE to develop a set of security 

guidance documents that cover the design of online contaminant 

monitoring systems, and physical security enhancements of drinking water, 

wastewater, and storm water infrastructure systems. This effort, called the 

Water Infrastructure Security Enhancement project, is to address physical 

infrastructure security needs in the water sector by issuing guidance 

documents, training materials, and voluntary standards relating to water 

infrastructure security. The project group is currently developing physical 

security standards that focus on physical security upgrades to reduce risk 

to water, wastewater, and storm water arising from malevolent acts. 

For its part, DHS has two broad initiatives that have facilitated efforts to 

improve wastewater security. First, the Buffer Zone Protection program is 

a DHS grant program designed to reduce specific vulnerabilities at a critical 

infrastructure or key resource site by assisting local law enforcement to 

develop a plan for preventative and protective measures that make it more 

difficult for terrorists to plan or launch attacks from the immediate vicinity 

of the site. They also identify equipment that could be purchased to 

mitigate the vulnerabilities. Upon plan approval, DHS grants funds for 

procuring materials and equipment necessary for implementation of the 

site’s buffer zone protection plan. According to DHS, as of October 31, 

2005, security at 14 wastewater facilities has been reviewed under the 

Buffer Zone Protection program.

19NDWAC is a federal advisory committee that supports EPA in performing its duties and 

responsibilities related to the national drinking water program. The council was created on 

December 16, 1974, through a provision in the Safe Drinking Water Act.
Page 24 GAO-06-390 Wastewater Facility Security

Under its second broad initiative, the Site Assistance Visits program, DHS 

visits critical infrastructure sites nationwide to address key areas of 

concern at facilities requiring security enhancements. DHS subject matter 

experts in the areas of physical security measures, system 

interdependencies, and terrorist attack prevention conduct these visits—

generally lasting 1 to 3 days—in which, among other things, the 

vulnerabilities of the site or facility are identified and mitigation options are 

discussed. According to DHS, as of October 31, 2005, a total of 350 site 

assessment visits have been conducted. Of this total, seven were conducted 

with wastewater facilities.

In addition to these programs, DHS funded a NACWA project to develop a 

decision tree and report template to help water systems assess and 

examine chlorine gas alternatives for water and wastewater disinfection. 

The decision tree guides water systems in evaluating the potential costs 

and benefits of conversion and determining whether an alternative 

disinfection method will still enable them to meet their permit 

requirements. The report template is to ensure that the results of the 

decision tree analysis are reported in a consistent format, improving a 

water system’s ability to pursue and secure any available state or federal 

funding for conversion. According to a NACWA representative, they are in 

the process of finishing the design of the decision tool and, once the final 

product is reviewed and approved by DHS, printing of the CD tool will 

begin. NACWA expects to make the tool available to water and wastewater 

utilities free of charge no later than the end of March 2006.

While EPA and DHS have these wastewater security-related initiatives 

under way, the Congress has expressed concerns that EPA’s homeland 

security responsibilities are not well articulated in relation to DHS’ 

responsibilities. In the conference report for the fiscal year 2005 

Consolidated Appropriations Act, conferees directed EPA to enter into a 

memorandum of understanding (MOU) with DHS that defines the 

relationship and responsibilities of the two entities regarding homeland 

security and protection. EPA did not enter into the MOU, but instead, on 

November 1, 2005, issued a report to the Congress entitled “Homeland 

Security Roles and Responsibilities and Interactions Between EPA and the 

Department of Homeland Security.” The report identified the homeland 

security-specific authorities, core mission authorities, presidential 

directives, and existing MOUs EPA uses to implement its homeland 

security roles and responsibilities. In the report, EPA stated that it believes 

its homeland security roles and responsibilities are sufficiently delineated 

not only through statutes, presidential directives, and existing MOUs, but 
Page 25 GAO-06-390 Wastewater Facility Security

also through planning documents and deliverables associated with a wide 

variety of collaborative homeland security-related projects that EPA and 

DHS are carrying out.

Multiple Efforts to Provide 

Critical and Threat-Related 

Information to the Water 

Sector Need Additional 

Coordination 

In December 2002, the Association of Metropolitan Water Agencies 

(AMWA) received a grant from EPA to establish a communication system 

to share security information with water sector utilities, known as the 

Water Information Sharing and Analysis Center (WaterISAC).20 The 

WaterISAC is one of thirteen critical infrastructure and key resource sectorspecific information sharing and analysis centers. The WaterISAC was 

designed to meet the information sharing needs of both water and 

wastewater utilities by providing real-time alerts of possible terrorist 

activity, allowing for the secure reporting of incidents and the sharing of 

information among users, and allowing access to a library of securityrelated information and contaminant databases. Beginning in fiscal year 

2003, EPA has annually provided AMWA with a $2 million grant to support 

the WaterISAC. This grant is augmented by subscription fees paid by 

drinking water and wastewater systems.21 In November 2004, the 

WaterISAC launched a free security advisory system known as the Water 

Security Channel that distributes federal advisories on security threats via 

e-mail to the water sector. The Water Security Channel also includes a 

searchable archive of federal alerts, advisories, and bulletins. However, it 

does not provide access to the same level of service as the subscriptionbased WaterISAC. WaterISAC subscribers receive additional services, 

including a secure communication system, access to vulnerability 

assessment tools and resources, access to an online library related to water 

security issues, and access to databases about chemical, biological, and 

radiological agents. 

20Information Sharing and Analysis Centers (ISACs) are confidential venues for sharing 

security vulnerabilities and solutions within an industry. Presidential Decision Directive 63 

and Executive Order 13231 designated the water sector (and other industry sectors) as 

critical to the nation’s well-being and called for the establishment of ISACs to promote the 

flow of security information. Additionally, HSPD-7 encouraged creation of private-sector 

information sharing and analysis mechanisms, such as the Water ISAC, to protect drinking 

water and wastewater infrastructure from attack.

21Water and wastewater systems with a service population over 100,000 pay an annual fee of 

$1,000, systems between 50,000 and 100,000 pay $500, and systems serving less than 50,000 

pay $200 annually. The annual fee pays for one user per system. Additional users are 

allowed, with limits, for additional fees.
Page 26 GAO-06-390 Wastewater Facility Security

DHS has also sought to enhance communication between critical 

infrastructure sectors and the government. Under the Homeland Security 

Act of 2002, DHS is responsible for reducing the vulnerability of the 

national infrastructure and for coordinating and communicating with all 

key stakeholders on homeland security-related matters. According to DHS, 

to fulfill this mandate, it requires a communication system that provides 

equal and appropriate access to security information to all owners and 

operators of critical infrastructure and key resources. In 2004, it piloted a 

new secure network, the Homeland Security Information Network (HSIN), 

to help achieve this mandate. 

HSIN is DHS’ primary conduit through which it shares information on 

domestic terrorist threats, suspicious activity reports, and incident 

management. It is composed of multiple communities of interest, including 

the HSIN Critical Sector (HSIN-CS) program, which is intended to enhance 

the protection, preparedness, and crisis communication and coordination 

capabilities of the nation’s 17 critical infrastructure and key resource 

sectors identified in HSPD-7. The HSIN platform for critical sectors is being 

developed and offered to each sector to provide a suite of information and 

communication tools to share critical information both within the sector, 

with DHS, and eventually across sectors. Because the water sector is one of 

the nation’s 17 critical infrastructure and key resources, a HSIN-CS portal 

for the sector, called HSIN Water Sector (HSIN-WS), is currently being 

developed by DHS. A Water Sector Coordinating Council was also 

established by the water sector with representative members of the water 

sector community and charged with identifying information and other 

needs of the sector, including the appropriate use of and the relationship 

among Water ISAC, the Water Security Channel, and HSIN.22

While these efforts are helping to improve communication, staff at EPA and 

DHS, as well as other industry experts with whom we spoke, have 

expressed concern that the evolution of the information sharing and 

dissemination function for the water sector has resulted in several 

inefficiencies.

22According to DHS, sector coordinating councils are to be developed for each critical 

infrastructure and key resource area and will be responsible to determine and support the 

most effective method of information sharing and communication for the sector, whether by 

using the current ISAC or building new mechanisms.
Page 27 GAO-06-390 Wastewater Facility Security

• WaterISAC access is limited to drinking water and wastewater 

subscribers, plus a restricted number of subscribers from EPA and the 

state drinking water programs. For example, the agreement limits 

designated users to five individuals at EPA headquarters and one person 

in each EPA region, for a total of fifteen EPA users. States are limited to 

only two users. EPA staff note that access for others in the sector, such 

as the technical service community, universities, training centers and 

laboratories, would benefit the overall protection of drinking water and 

wastewater critical infrastructures. EPA and DHS staff told us that, 

depending upon the user policy established by the sector, the HSIN 

network could allow for broader sharing of access than currently 

available under the WaterISAC. 

• Only a small portion of the water sector is reached by the WaterISAC. 

According to EPA staff, just over 530 utilities are reached by the 

WaterISAC, while over 8,000 utilities receive information through the 

Water Security Channel. However, the Water Security Channel does not 

provide the same level of notification and information sharing provided 

by the WaterISAC. The Water Security Channel is essentially a “push email system” that sends out general security bulletins to water utilities 

and other users, and allows for searches of previous bulletins. This 

service is much more limited than that provided to WaterISAC 

subscribers, which provides a secure communication system for users 

to share information, access to vulnerability assessment tools and 

resources, access to an online library related to water security issues, 

and access to databases about chemical, biological, and radiological 

agents. One water industry representative told us that the WaterISAC 

recently lowered its subscription fees due to industry concerns that the 

fees were limiting WaterISAC subscriptions. EPA staff told us that the 

water sector generally has less funding available to support ISAC 

services than other sectors such as electric, financial, and 

transportation. 

• WaterISAC duplicates some operational functions likely available 

through HSIN. EPA estimates that roughly $600,000 to $700,000 of the 

annual $2 million WaterISAC grant is used to support computer 

hardware and software for the secure web portal. Meanwhile, to support 

HSIN, DHS funds similar computer software and hardware and its 

related technical support. EPA staff noted that WaterISAC could make 

use of the software and hardware platform available through HSIN. EPA 

staff believed that WaterISAC could then better focus its resources on 

managing its user list, managing information content on the secure web 
Page 28 GAO-06-390 Wastewater Facility Security

site, and analyzing and distributing threat information, while leaving 

DHS to manage and run the hardware and software. 

The current reach and levels of service offered by the WaterISAC and the 

Water Security Channel do not meet DHS’ objective to establish a 

communication system that provides equal and appropriate access to 

security information to all owners and operators in this critical 

infrastructure area. According to EPA and DHS staff, the Water Sector 

Coordinating Council will consider options to improve coordination 

between the WaterISAC, the Water Security Channel, and HSIN. Using 

funding from the supporting grant from EPA, the WaterISAC is currently 

examining options for coordination between the WaterISAC, the Water 

Security Channel, and HSIN. EPA noted that this review is ongoing and will 

likely be presented in preliminary form to the Water Sector Coordinating 

Council in a mid-March 2006 meeting. However, the scope of the 

preliminary review is not clear, nor is a time frame set to complete the 

review. According to DHS, the creation of the DHS Homeland 

Infrastructure Threat and Risk Analysis Center will assist in information 

sharing of intelligence threat information between DHS and federal, state, 

and private sector partners.

Conclusions Many of the nation’s large wastewater facilities have made security 

improvements since the terrorist attacks of September 11, 2001. Of 

particular note, many have completed some type of security assessment, 

and additional facilities have such assessments under way. Our survey also 

found that wastewater facilities are continuing to move away from the use 

of potentially dangerous gaseous chlorine as a wastewater disinfectant. 

One area of continuing concern is the difficulty these facilities are having in 

addressing vulnerabilities associated with their collection systems. Facility 

managers explained that with limited funding available, other important 

measures considered to be more feasible and affordable were assigned 

greater priority. EPA is attempting to help address this difficult issue 

through funding the American Society of Civil Engineers project to develop 

voluntary physical security standards for the water sector. 

Despite limited federal authority over security at the nation’s wastewater 

facilities, EPA, as the lead agency for water sector security, has worked 

with DHS and industry groups to advance wastewater security by providing 

vulnerability assessment tools, training, guidance, and burgeoning 

information sharing networks. These efforts, combined with the individual 

initiatives of many wastewater facilities, have resulted in measurable 
Page 29 GAO-06-390 Wastewater Facility Security

security improvements. However, these efforts could benefit from 

additional coordination, and we acknowledge and support EPA’s and DHS’ 

commitment to do so. As these agencies move forward, we believe they 

should act upon the opportunities we have identified that could improve 

both the efficiency with which limited dollars are being spent, as well as 

the delivery of vital information services to the wastewater community. 

Specifically, a substantial part of the $2 million annual EPA grant that funds 

WaterISAC goes to support a computer platform that may be available at no 

cost through HSIN. 

Recommendation for 

Executive Action

We recommend that the Administrator of EPA work with DHS and the 

Water Sector Coordinating Council to identify areas where the WaterISAC 

and HSIN networks could be better coordinated, focusing in particular on 

(1) how operational duplications and overlap could be addressed, and (2) 

how water systems’ access to timely security threat information could be 

improved. We also recommend that EPA work with DHS and the Water 

Sector Coordinating Council to identify realistic time frames for the 

completion of these tasks. 

Agency Comments and 

Our Evaluation

We provided a draft of this report to DHS and EPA for review and 

comment. DHS agreed with the factual content of the report, and its Office 

of Infrastructure Protection provided written technical comments and 

clarifications that have been incorporated, as appropriate. In its letter, 

reproduced in appendix III, EPA concurred with the results of the report. 

EPA’s Water Security Division in the Office of Ground Water and Drinking 

Water also provided technical comments and clarifications that were 

incorporated, as appropriate.

As agreed with your office, unless you publicly release the contents of this 

report earlier, we plan no further distribution until 30 days from the report 

date. At that time, we will send copies of this report to the appropriate 

congressional committees; interested Members of Congress; the 

Administrator, Environmental Protection Agency; the Secretary, 

Department of Homeland Security; and other interested parties. We will 

also make copies available to others on request. In addition, the report will 

be available at no charge on the GAO Web site at http://www.gao.gov.
Page 30 GAO-06-390 Wastewater Facility Security

Should you or your staff need further information, please contact me at 

(202) 512-3841 or stephensonj@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made major contributions to this report are 

listed in appendix IV. 

Sincerely yours,

John B. Stephenson

Director, Natural Resources 

and Environment
Page 31 GAO-06-390 Wastewater Facility Security

Appendix I

Scope and Methodology AAppenednxidexiIs

To identify federal statutory authorities and directives that govern 

protection of wastewater treatment facilities, we reviewed applicable laws, 

Homeland Security Presidential Directives, and policies, guidance, and 

regulations related to wastewater security from the Environmental 

Protection Agency (EPA) and the Department of Homeland Security 

(DHS). In addition, we interviewed officials in EPA’s Water Security 

Division, as well as DHS officials in various areas of the agency. In addition, 

we spoke with representatives for wastewater industry associations with 

which EPA has collaborated to actively assist wastewater treatment 

facilities to address their security issues. 

To determine the steps critical wastewater treatment facilities have taken 

since 9/11 to address potential vulnerabilities, we conducted a Web-based 

survey of the nation’s largest wastewater treatment facilities. For the 

purpose of this review, we defined “critical wastewater facilities” as the 253 

wastewater facilities in the United States that have service area 

populations of 100,000 or greater, as identified in the results of EPA’s 2004 

Clean Watershed Needs Survey.1

 As a result of Hurricane Katrina, one 

facility in our initial population of 253 facilities that was identified as a New 

Orleans facility was omitted, leaving a total 252 facilities in our survey 

population. We drafted the survey in consultation with our own survey 

professionals. In addition, we solicited the review and comment of 

knowledgeable officials from the National Academy of Sciences, the Water 

Environment Federation, and the National Association of Clean Water 

Agencies, as well as several wastewater security experts identified in our 

January 2005 report on wastewater security.2

 We conducted seven pretests 

to check that (1) the questions were clear and unambiguous, (2) 

terminology was used correctly, (3) the information was feasible to obtain, 

and (4) the survey was comprehensive and unbiased. The pretest sites were 

chosen to include facilities representing different geographic regions, and 

utilities both with single and multiple facilities. One pretest was done in 

person and six were done over the phone. 

Our survey asked wastewater treatment facility representatives to provide 

a variety of information, such as whether their facilities had conducted 

security assessments; what measures, if any, they had taken or were 

1

EPA’s Office of Wastewater Management conducts the Clean Watershed Needs Survey 

(CWNS) on a periodic basis. The CWNS, a joint effort between states and EPA, is conducted 

in response to Section 205(a) and 516 of the Clean Water Act. 

2

GAO-05-165.
Appendix I

Scope and Methodology

Page 32 GAO-06-390 Wastewater Facility Security

planning to take in several security areas; and their perspectives on what 

role the federal government should assume in wastewater treatment 

facility security. The survey was made available between October 1, 2005, 

and January 15, 2006, and a unique user identification number and a 

password were provided to each surveyed facility. Three e-mail reminders 

were sent out to nonresponders, and then follow-up phone calls were made 

to all nonresponding facilities. A total of 206 of 252 wastewater treatment 

facilities responded to the survey, resulting in an 82 percent survey 

response rate. Other wastewater facilities that did not respond to the 

survey generally cited security concerns related to providing potentially 

sensitive information or a general policy of not answering surveys. 

Because this was not a sample survey, there are no sampling errors. 

However, the practical difficulties of conducting any survey may introduce 

errors, commonly referred to as non-sampling errors. For example, 

difficulties in how a particular question is interpreted or in the sources of 

information that are available to respondents can introduce unwanted 

variability into the survey results. We took steps both at the data collection 

and at the analysis phases to minimize these non-sampling errors. Since 

this was a Web-based survey, respondents entered their answers directly 

into the electronic questionnaire, which removes one source of error. When 

the data were analyzed, a second, independent analyst checked all relevant 

computer programs.

To determine what steps EPA and DHS have taken to help wastewater 

facilities in their efforts to address vulnerabilities, we took several 

approaches. First, through semi-structured interviews with agency officials 

and industry association representatives, as well as document reviews, we 

researched various programs that EPA and DHS have under way. Second, 

we identified programs that require cross-agency collaboration between 

EPA and DHS, and we examined in depth those that wastewater treatment 

facility representatives identified as potentially useful. We also interviewed 

state and local officials with oversight for wastewater treatment operations 

and security. Third, one section of our survey gathered information about 

facility representatives’ experiences with, perspectives on, and 

expectations for, the federal role in wastewater treatment facility security. 

Responses to open-ended questions were categorized and tallied to analyze 

their content for subsequent research findings. Finally, to develop 

conclusions about the level of coordination between the two agencies in 

the implementation of these programs, we interviewed agency officials 

about their perspectives on how well the agencies are working together.
Page 33 GAO-06-390 Wastewater Facility Security

Appendix II

Survey of Wastewater Treatment Facilities ApendxiI

Survey of Wastewater Treatment 

Facilities 

U.S. Government Accountability Office 

Introduction 

Welcome to the Survey of Wastewater Treatment Facilities. 

The U.S. Government Accountability Office (GAO), a congressional audit 

and evaluation agency, is conducting this survey to identify actions 

wastewater treatment facilities have taken to protect their operations and 

infrastructures from terrorism or other threats. 

Why you are receiving this information:

The GAO is surveying wastewater treatment facilities that serve residential 

populations of 100,000 or greater. An EPA database identified you as the 

point of contact for your wastewater treatment utility/authority. As a result, 

we are requesting that you or your designated representative complete the 

survey. 

Please complete this survey within two weeks of receipt. We understand that 

there are great demands on your time. However, your participation in our 

study is essential for us to provide relevant information to Congress about the 

actions wastewater treatment facilities have taken to protect their operations 

from terrorism or other security threats. We greatly appreciate your time and 

effort in completing this survey. 

Your responses will be gathered on a SECURED SERVER AND 

AGGREGATED WITH THOSE OF OTHER FACILITIES. They will be 

presented in a report to the Congress IN A SUMMARY FORM ONLY. GAO 

WILL NOT RELEASE INDIVIDUALLY IDENTIFIABLE DATA FROM 

THIS SURVEY, unless compelled by law or required to do so by the U.S. 

Congress. 

Note: The number of survey respondents that answered each question varies based 

on skip instructions; some respondents were directed to answer certain survey 

questions and not others based on their earlier responses.
Appendix II

Survey of Wastewater Treatment Facilities

Page 34 GAO-06-390 Wastewater Facility Security

1. About Your Utility 

What is the name of the wastewater treatment utility/authority that is responsible for 

the facility or facilities for which you are completing a survey(s)? (Click in the box 

and enter the name.)

1.

Does your utility/authority manage BOTH drinking water and wastewater treatment? 

Check only one answer. 

N = 206

1. Yes [99]

2. No [99]

2.

3. Don’t know/No response [8]

How many wastewater treatment facilities within your utility/authority serve 

populations of 100,000 or more? 

Check only one answer. 

N = 206

1. 1 [98]

2. 2 [47]

3. 3 [17]

4. 4 [13]

5. 5 [2]

6. 6 or more (Please specify number below.) [21]

3.

7. Don’t know/No response [8]

4. (If you checked "6 or more" above) What is the number of wastewater treatment 

facilities within your utility/authority that serve populations of 100,000 or more?

(Click in the box and enter 1 or 2-digit whole number.)

 N = 26

 0 [6]

 3 [1]

 8 [10]

14 [9]
Appendix II

Survey of Wastewater Treatment Facilities

Page 35 GAO-06-390 Wastewater Facility Security

2. About Your Facility 

What is the size of the service area population served by your wastewater treatment 

FACILITY under regular operating conditions? 

Check only one answer. 

N = 206

1. Less than 100,000 [13]*

2. 100,000-149,999 [44]

3. 150,000-199,999 [27]

4. 200,000-249,999 [29]

5. 250,000-299,000 [11]

6. 300,000-349,999 [15]

7. 350,000-499,999 [12]

8. 500,000-649,999 [29]

9. 650,000-949,999 [13]

10. 1,000,000-1,499,999 [1]

11. 1,500,000 or more [6]

5.

12. Don’t know/No response [6]

*These facilities were identified in the results of EPA’s 2004 Clean 

Watershed Needs Survey as having service area populations of 

100,000 or over and were kept in our survey.
Appendix II

Survey of Wastewater Treatment Facilities

Page 36 GAO-06-390 Wastewater Facility Security

3. Vulnerability/Security Assessments 

Has a vulnerability assessment been completed for your wastewater treatment 

facility? 

Check only one answer. 

N = 206

1. Yes (GO TO QUESTION 8.) [80]

2. Currently underway (GO TO QUESTION 8.) [26]

3. No [89]

6.

4. Don’t know/No response [11]

Has a security or risk assessment been completed for your wastewater treatment 

facility? 

Check only one answer. 

N = 100

1. Yes [21]

2. Currently underway [1]

3. No (GO TO QUESTION 17.) [66]

7.

4. Don’t know/No response (GO TO QUESTION 17.) [12]

When was your vulnerability/security assessment completed or most recently 

updated, or when is it scheduled to be completed or updated? 

8.

N = 108

Responses ranged from April 2001 to July 2006. Most indicated assessments 

were completed, updated, or scheduled to be completed or updated in 2003.
Appendix II

Survey of Wastewater Treatment Facilities

Page 37 GAO-06-390 Wastewater Facility Security

Were the following factors important in deciding to conduct this 

vulnerability/security assessment for your facility? 

9.

Check one in each row. 

N = 128

Yes No Don’t know/No 

response

a. Required by state government 

Y = 13 N = 93 DK/NR = 22

b. Required by local government or 

local government body Y =14 N = 96 DK/NR =18

c. Required by utility governing 

body Y=19 N = 91 DK/NR =18

d. Required by facility insurance 

carrier 

Y =2 N = 102 DK/NR =24

e. Conducted assessment of 

wastewater treatment facility in 

conjunction with assessment for 

drinking water facility, as required 

by the Bioterrorism Act

Y =35 N = 75 DK/NR =18

f. Conducted assessment in 

conjunction with facility upgrade 

and/or expansion Y =20 N = 86 DK/NR =22

g. Conducted assessment on facility's 

own initiative Y =98 N = 16 DK/NR =14

 

10. What other factors, if any, were important in deciding to conduct this 

vulnerability/security assessment at your facility? (Click in the box and enter your 

response. Leave blank if all important factors are listed above.)

N = 49

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 38 GAO-06-390 Wastewater Facility Security

Who conducted or is conducting the vulnerability/security assessment for your 

wastewater treatment facility? 

11.

Check one in each row. 

N = 128

Yes No

Don’t 

know/No 

response

a. Wastewater utility staff 

Y = 99 N = 11 DK/NR =18

b. Consultant

Y = 64 N = 46 DK/NR =18

c. City or county staff 

Y =36 N = 57 DK/NR = 35

d. Manufacturer's representatives 

(e.g. alarm company personnel) Y =7 N = 81 DK/NR =40

e. Other (Please specify in 12 

below.) Y =19 N = 69 DK/NR = 40

 

12. (If you checked yes for "Other" in 11) Who else is involved in conducting the 

vulnerability/security assessment at your facility? 

N = 23

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 39 GAO-06-390 Wastewater Facility Security

What vulnerability/security assessment tool, if any, did your wastewater facility 

use? 

13.

Check one in each row. 

N = 128

Yes No Don’t know/No 

response 

a. Vulnerability Self-Assessment 

Tool (VSAT) Y =54 N = 40 DK/NR = 34

b. Risk Assessment Methodology 

for Water (RAM-W, developed 

by Sandia National Laboratories) Y =26 N = 67 DK/NR = 35

c. Security Emergency 

Management System (SEMS, 

developed by the National Rural 

Water Association) 

Y = 4 N = 76 DK/NR = 48

d. County or city developed its own 

assessment method

Y =10 N = 77 DK/NR = 41

e. Utility developed its own 

assessment method Y =14 N = 74 DK/NR = 40

f. No tool used

Y =18 N = 57 DK/NR = 53

g. Other (Please specify below.)

Y = 26 N = 55 DK/NR = 47

 

14. (If "Other") What other vulnerability/security assessment tool did your wastewater 

facility use? 

N = 30

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

15. As a result of the vulnerability/security assessment, what were the 3 most significant 

measures (activities, changes and improvements) that have been completed to improve 

security at your wastewater treatment facility?

N = 109

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 40 GAO-06-390 Wastewater Facility Security

In which of the following time frames, if any, do you plan to update your 

vulnerability/security assessment? 

Check only one answer. 

N = 128

1. No plans to update (GO TO QUESTION 27.) [12]

2. Continuous process (GO TO QUESTION 27.) [47]

3. In about 1 year (GO TO QUESTION 27.) [13]

4. In about 2 years (GO TO QUESTION 27.) [7]

5. In about 3 years (GO TO QUESTION 27.) [2]

6. In the next 4 years or more (GO TO QUESTION 27.) [0]

7. Plan to update, but no time frame set (GO TO QUESTION 27.)

[36]

16.

8. Don’t know/No response (GO TO QUESTION 27.) [11]

End of questions for facilities that completed vulnerability assessments/security 

assessments. GO TO QUESTION 27.

Does your facility plan to conduct a vulnerability/security assessment? 

Check only one answer. 

N = 78

1. Yes (GO TO QUESTION 20.) [24]

2. No [23]

17.

3. Don’t know/No response [31]
Appendix II

Survey of Wastewater Treatment Facilities

Page 41 GAO-06-390 Wastewater Facility Security

Were the following factors important in your wastewater treatment facility's 

decision NOT to conduct a vulnerability/security assessment? 

18.

Check one in each row. 

N = 23

Yes No Don’t know/No 

response

a. Steps we have taken are adequate 

for our security needs Y =15 N = 2 DK/NR = 6

b. Facility and system are not 

considered terrorist targets Y = 8 N = 8 DK/NR = 7

c. Other priorities and limited 

resources Y =11 N = 7 DK/NR = 5

d. Emergency response plan was 

updated, and this seemed sufficient to 

address potential vulnerabilities Y = 13 N = 5 DK/NR = 5

f. Not required to do so

Y =17 N = 3 DK/NR = 3

 

19. What OTHER factors, if any, were important in deciding NOT to conduct a 

vulnerability/security assessment? 

N = 7

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

End of questions for facilities that have decided NOT to complete vulnerability 

assessments/security assessments. Click on GO TO QUESTION 30.

20. When is your facility's vulnerability/security assessment scheduled to be completed? 

N = 15

Responses ranged from November 2005 to December 2007. Most facilities 

indicated assessments were scheduled to be completed in 2006.
Appendix II

Survey of Wastewater Treatment Facilities

Page 42 GAO-06-390 Wastewater Facility Security

Were the following factors important in deciding to conduct this 

vulnerability/security assessment at your facility? 

21.

Check one in each row. 

N = 24

Yes No

Don’t 

know/No 

response

a. Required by state government 

Y = 2 N = 15 DK/NR = 7

b. Required by local government or 

local government body Y = 2 N = 14 DK/NR = 8

c. Required by utility governing 

body Y = 2 N = 14 DK/NR =8

d. Required by facility insurance 

carrier 

Y = 1 N = 16 DK/NR = 7

e. Conducted assessment of 

wastewater treatment facility in 

conjunction with assessment for 

drinking water facility, as 

required by the Bioterrorism Act

Y = 1 N = 17 DK/NR = 6

f. Conducted assessment in 

conjunction with facility upgrade 

and/or expansion Y = 1 N = 17 DK/NR = 6

g. Conducted assessment on 

facility's own initiative Y = 21 N = 2 DK/NR = 1

 

22. What OTHER factors, if any, were important in deciding to conduct this 

vulnerability/security assessment at your facility? 

N = 4

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 43 GAO-06-390 Wastewater Facility Security

Who will conduct the vulnerability/security assessment for your wastewater 

treatment facility? 

23.

Check one in each row. 

N = 24

Yes No Don’t know/No 

response

a. Wastewater utility staff 

Y = 17 N = 2 DK/NR = 5

b. Consultant

Y = 9 N = 8 DK/NR = 7

c. City or county staff 

Y = 8 N = 11 DK/NR = 5

d. Manufacturer's representatives 

(e.g. alarm company personnel) Y = 0 N = 15 DK/NR = 9

e. Other (Please specify below.)

Y = 0 N = 14 DK/NR = 10

 

24. (If "Other") Who else will be involved in conducting the vulnerability/security 

assessment at your facility? 

N = 0
Appendix II

Survey of Wastewater Treatment Facilities

Page 44 GAO-06-390 Wastewater Facility Security

What vulnerability/security assessment tool, if any, did your wastewater facility 

use? 

25.

Check one in each row. 

N = 24

Yes No

Don’t 

know/No 

response

 a. Vulnerability Self-Assessment 

Tool (VSAT) Y = 15 N = 3 DK/NR =6

b. Risk Assessment Methodology 

for Water (RAM-W, developed 

by Sandia National 

Laboratories) 

Y = 1 N = 12 DK/NR = 11

c. Security Emergency 

Management System (SEMS, 

developed by the National Rural 

Water Association) 

Y = 0 N = 13 DK/NR =11

 d. County or city developed its own 

assessment method Y = 0 N = 14 DK/NR = 10

 e. Utility developed its own 

assessment method Y = 0 N = 14 DK/NR = 10

 f. No tool used 

Y = 2 N = 13 DK/NR = 9

 g. Other(Please specify below.)

Y = 3 N = 10 DK/NR = 11

 

26. (If "Other") What other vulnerability/security assessment tool will your wastewater 

facility use? 

N = 3

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 45 GAO-06-390 Wastewater Facility Security

4. Chemical Security Measures

Does your wastewater treatment facility use gaseous chlorine to disinfect 

wastewater? 

Check only one answer. 

N = 206

1. Yes (GO TO QUESTION 32.) [85]

2. No [116]

27.

3. No answer [5]

Did your wastewater treatment facility EVER use gaseous chlorine to disinfect 

wastewater? 

Check only one answer. 

N = 121

1. Yes [79]

2. No (GO TO QUESTION 31.) [34]

28.

3. Don’t know/No response (GO TO QUESTION 31.) [8]

When did your wastewater treatment facility decide to discontinue its use of 

gaseous chlorine? 

29.

Check only one answer. 

N = 55

Responses ranged from July 1980 to October 2005. Many facilities made the 

decision to discontinue the use of gaseous chlorine between 1998 and 2001.

How have ANNUAL (as opposed to capital) costs at your wastewater treatment 

facility been affected by converting to an alternative disinfection process? 

Check only one answer. 

N = 79

1. Costs have increased [58]

2. Costs have stayed about the same [11]

3. Costs have decreased [1]

30.

4. Don’t know/No response [9]
Appendix II

Survey of Wastewater Treatment Facilities

Page 46 GAO-06-390 Wastewater Facility Security

What disinfection method does your wastewater treatment facility use? 

Check only one answer. 

N = 121

1. Sodium hypochlorite (transported to site) (GO TO QUESTION 

40.) [87]

2. Sodium hypochlorite (generated onsite) (GO TO QUESTION 40.)

[2]

3. Calcium hypochlorite (GO TO QUESTION 40.) [0]

4. Ozone (GO TO QUESTION 40.) [0]

5. Ultraviolet light (GO TO QUESTION 40.) [17]

6. Other (GO TO QUESTION 40.) [3]

31.

7. Don’t know/No response (GO TO QUESTION 40.) [12]

End of questions for facilities that do not use gaseous chlorine. GO TO 

QUESTION 40.

How is the chlorine transported and stored? 

Check only one answer. 

N = 85

1. In 50 - 100 pound cylinders [0]

2. In 150-pound cylinders [3]

3. In one-ton containers [59]

4. In 17-ton tractor trailers [6]

5. In 91-ton rail cars [9]

6. Other (Please specify number below.) [7]

32.

7. Don’t know/No response [1]

33. (If "Other") By what other method is the chlorine transported and stored? 

N = 8

We did not summarize the narrative responses to this question for inclusion 

in this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 47 GAO-06-390 Wastewater Facility Security

Which one of the following changes, if any, has your wastewater treatment facility 

made in how it stores and uses gaseous chlorine and when did it make them? 

34.

Check one in each row. 

N = 85

Before 

September 

11, 2001

After 

September 

11, 2001

No

change

made

Don’t 

know/No 

response

 a. Converted chlorine to 

smaller quantity alternative 4 3 70 8

 b. Instituted controls for 

selective access to chlorine 

storage areas 14 41 24 6

 c. Installed electronic 

surveillance and detection 

of chlorine storage areas 21 30 27 7

d. Made other physical 

security improvements to 

the gaseous chlorine storage 

area 7 30 39 9

 

35. (If you indicated "Yes" for "Made other physical security improvements" above) 

What other physical security improvements to the gaseous chlorine storage area did 

your facility make? 

N = 35

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

Does your wastewater treatment facility PLAN to stop using gaseous chlorine? 

Check only one answer. 

N = 85

1. Yes [20]

2. No (GO TO QUESTION 40.) [53]

36.

3. Don’t know/No response (GO TO QUESTION 40.) [12]

37. When does your wastewater treatment facility PLAN to stop using gaseous chlorine? 

N = 14

Responses ranged from November 2005 to January 2015. Most indicated that 

their facilities planned to discontinue their use of gaseous chlorine in 2006 and 

2007.
Appendix II

Survey of Wastewater Treatment Facilities

Page 48 GAO-06-390 Wastewater Facility Security

How do you expect ANNUAL (as opposed to capital) costs at your wastewater 

treatment facility to be affected by converting to an alternative disinfection 

process? 

Check only one answer. 

N = 20

1. Costs will increase [17]

2. Costs will stay about the same [1]

3. Costs will decrease [1]

38.

4. Don’t know/No response [1]

What disinfection method does your wastewater treatment facility plan to use? 

Check only one answer. 

N = 20

1. Sodium hypochlorite (transported to site) [10]

2. Sodium hypochlorite (generated onsite) [1]

3. Calcium hypochlorite [0]

4. Ozone [0]

5. Ultraviolet light [9]

6. Other [0]

39.

7. Don’t know/No response [0]

40. What OTHER chemicals, if any, are currently at your wastewater treatment facility, 

or will be in the future, that have the potential to cause significant harm and damage 

if used for terrorist activity? 

N = 128

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

41. For each chemical identified in 40, if any, please indicate its use at your 

wastewater treatment facility. 

N = 103

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 49 GAO-06-390 Wastewater Facility Security

5. Physical Security Measures

For each of the following physical security measures that your wastewater 

treatment facility may have, was it completed before September 11, 2001, 

completed after September 11, 2001, is it planned but not yet completed, or is it 

NOT planned? 

42.

Check one in each row. 

N = 206

Completed 

BEFORE 

September 11, 

2001

Completed 

AFTER 

September 

11, 2001

Planned, 

not yet 

completed

NOT 

planned

Don’t 

know/No 

response

a. Guard stations

37 33 6 115 15

b. Vehicle gates 

149 35 6 3 13

c. Security fences 

174 11 7 3 11

d. Safeguards for 

on-site delivery 

of materials to 

the facility 

84 54 15 35 18

e. Additional site 

lighting 79 33 34 47 13

f. Motion 

detectors

15 20 33 121 17

g. Visual 

surveillance 

monitoring 55 60 51 28 12

h. Redundant

power sources 160 14 12 8 12

 
Appendix II

Survey of Wastewater Treatment Facilities

Page 50 GAO-06-390 Wastewater Facility Security

Completed 

BEFORE 

September 11, 

2001

Completed 

AFTER 

September 

11, 2001

Planned, 

not yet 

completed

NOT 

planned

Don’t 

know/No 

response

i. Sensors to 

detect toxics and 

other

biochemical

threats to the 

operation (e.g. 

smart pipes)

39 1 8 139 19

j. Lower 

explosive level 

(LEL) meters or 

other gas 

detection devices

149 8 4 27 18

k. Intrusion alarms 

Before 9/11 = 67 67 21 31 72 15

l. Manhole

intrusion sensors 2 0 7 173 24

m. Manhole locks

24 6 11 141 24

n. Redundant

pumping devices 

or collection 

bypass systems 

133 2 11 39 21

What OTHER physical security improvements, that you consider significant, have 

been installed or are planned for your wastewater treatment facility and associated 

infrastructure? Be sure to include any specific changes that your wastewater 

facility has made to improve physical security in your COLLECTION SYSTEM, if 

they are not listed above. 

N = 72

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

43.
Appendix II

Survey of Wastewater Treatment Facilities

Page 51 GAO-06-390 Wastewater Facility Security

6. Personnel Security Measures

For each of the following personnel security measures that your wastewater 

treatment facility may have, if any, was it completed before September 11, 2001, 

completed after September 11, 2001, is it planned but not yet completed, or is it 

NOT planned? 

44.

Check one in each row. 

N = 206

Completed 

BEFORE 

September 

11, 2001

Completed 

AFTER 

September 

11, 2001

Planned, 

not yet 

completed

NOT 

planned

Don’t 

know/No 

response

a. Facility maintains 

an up-to-date list of 

all employees, their 

phone numbers and 

emergency contact 

information 

179 7 0 0 20

b. Background 

checks are 

performed on new 

employees 

94 23 15 40 34

c. All employees are 

issued and required 

to display photoidentification 

84 60 10 28 24

d. Employees have 

access to and use 

communications

equipment when 

working away from 

the administrative 

setting on site or 

when working offsite 

163 6 7 6 24

e. Non-utility 

personnel

(contractors, 

vendors, and 

visitors, etc.) are 

required to show 

identification 

46 80 14 39 27

 
Appendix II

Survey of Wastewater Treatment Facilities

Page 52 GAO-06-390 Wastewater Facility Security

Completed 

BEFORE 

September 

11, 2001

Completed 

AFTER 

September 

11, 2001

Planned, 

not yet 

completed

NOT 

planned

Don’t 

know/No 

response

f. Non-utility 

personnel

(contractors, 

vendors, and 

visitors, etc.) may 

access the facility 

only with an escort 

33 50 13 85 25

g. Periodic training 

is provided on 

procedures for 

responding to events 

and incidents and 

other security-related 

issues

105 36 29 13 23

45. What OTHER personnel security improvements, that you consider significant, have 

been installed or are planned for your wastewater treatment facility and associated 

infrastructure? 

N = 41

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 53 GAO-06-390 Wastewater Facility Security

7. Information Technology (IT) Security Measures 

For each of the following Information Technology (IT) security measures that your 

wastewater treatment facility may have, was it completed before September 11, 

2001, completed after September 11, 2001, is it planned but not yet completed, or is 

it NOT planned? 

46.

Check one in each row. 

N = 206

Completed 

BEFORE 

September

 11, 2001

Completed 

AFTER 

September

 11, 2001

Planned, 

not yet 

completed

NOT 

planned

Don’t 

know/No 

response

a. Virus protection 

program 158 18 1 2 27

b. Network protection, 

such as a firewall, an 

intrusion detection 

system, and monitoring 

149 24 3 3 27

c. Backup power supply 

168 10 1 3 24

d. SCADA system 

protections, such as 

hardening of the system 

against potential 

intruders and periodic 

identification and 

backup to off-site 

facility 

93 36 25 22 30

e. Upgrading SCADA

system: Periodic 

identification and 

backup of operationalcritical applications and 

databases to an off-site 

facility 

84 28 29 33 32

47. What OTHER IT security improvements, that you consider significant, have been 

installed or are planned for your wastewater treatment facility and associated 

infrastructure? 

N = 45

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 54 GAO-06-390 Wastewater Facility Security

 

8. Coordination Activities 

Does your facility have a designated individual to oversee internal security initiatives 

at your wastewater treatment facility? 

Check only one answer. 

N = 206

1. Yes [131]

2. No (GO TO QUESTION 50.) [65]

48.

3. Don’t know/No response (GO TO QUESTION 50.) [10]

Does this person oversee efforts to address security that require coordination with 

other organizations and governments? 

Check only one answer. 

N = 131

1. Yes [110]

2. No [18]

49.

3. Don’t know/No response [3]

Does your wastewater treatment facility have periodic (annually, semi annually or 

more often) contact about security planning with the following? 

50.

Check one in each row. 

N = 206

Yes No

Don’t 

know/No 

response

a. Nearby utilities 

Y = 103 N = 86 DK/NR = 17

b. Police and fire departments

Y = 150 N = 43 DK/NR = 13

c. Public health community

Y = 99 N = 83 DK/NR = 24

d. Local Emergency Planning 

Committee (LEPC) Y = 130 N = 53 DK/NR = 23

 
Appendix II

Survey of Wastewater Treatment Facilities

Page 55 GAO-06-390 Wastewater Facility Security

Yes No

Don’t 

know/No 

response

e. Industry organizations, e.g. Water 

Environment Federation (WEF), National 

Association of Clean Water Agencies 

(NACWA)

Y = 140 N = 50 DK/NR = 16

f. Individual industrial/commercial facilities 

in service area Y = 68 N = 112 DK/NR = 26

g. Hazardous material storage facilities 

located in service area Y = 65 N = 109 DK/NR = 32

h. State organizations and agencies with 

oversight for wastewater operations and 

security (Please specify below.) Y = 99 N = 85 DK/NR = 22

i. Federal organizations and agencies with 

oversight for wastewater operations and 

security (Please specify below.) Y = 80 N = 99 DK/NR = 27

51. (If you indicated "yes" for "State organizations and agencies" above) Which state 

organizations and agencies with oversight for wastewater operations and security does 

your facility have periodic contact about security planning? 

N = 101

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

52.

(If you indicated "yes" for "Federal organizations and agencies" above) Which federal 

organizations and agencies with oversight for wastewater operations and security does 

your facility have periodic contact about security planning 

N = 77

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 56 GAO-06-390 Wastewater Facility Security

Which of the following security coordination activities has your wastewater 

treatment facility implemented or participated in? 

53.

Check one in each row. 

N = 206

Yes No Don’t know/No 

response

a. Identified all counties, cities, and 

police and fire departments with 

jurisdiction in the area where the 

wastewater system assets are located 

Y = 171 N = 23 DK/NR = 12

b. Identified all locations in service 

area at which hazardous materials are 

manufactured, used, or stored in 

significant quantities 

Y = 105 N = 72 DK/NR = 29

c. Required all hazardous material 

storage locations to develop and 

implement Spill Prevention, Control 

and Countermeasure (SPCC) Plans and 

containment facilities 

Y = 127 N = 44 DK/NR = 35

d. Evaluated SPCC Plans for adequacy 

in preventing unauthorized access to 

and release of hazardous materials Y = 115 N = 49 DK/NR = 42

e. Inspected all hazardous material 

storage locations to verify adequacy of 

SPCC Plans and containment facilities Y = 118 N = 48 DK/NR = 40

f. Addressed identified SPCC Plan and 

containment facility deficiencies Y = 115 N = 49 DK/NR = 42

g. Meet with LEPC, provide 

information about operations and 

systems, and provide maps of critical 

infrastructure and hazardous 

materials storage locations in service 

area.

Y = 98 N = 66 DK/NR = 42

h. Give facility tours to police and 

fire personnel Y = 171 N = 19 DK/NR = 16

i. Developed a response plan with 

staff Y = 181 N = 12 DK/NR = 13

j. Developed or participate in a joint 

response plan with community 

agencies, groups, or associations Y = 108 N = 62 DK/NR = 36

 
Appendix II

Survey of Wastewater Treatment Facilities

Page 57 GAO-06-390 Wastewater Facility Security

Yes No Don’t know/No 

response

k. Developed an emergency notification 

protocol for staff Y = 186 N = 9 DK/NR = 11

l. Participate in an emergency 

notification protocol for customers 

and hazardous materials storage 

facilities in service area, with 

emphasis on neighbors 

Y = 70 N = 99 DK/NR = 37

m. Participated in a security tabletop 

exercise Y = 83 N = 98 DK/NR = 25

n. Established a communication 

network Y = 159 N = 29 DK/NR =18

o. Developed training materials 

Y = 141 N = 44 DK/NR = 21

p. Created or are part of a mutual aid 

resource list Y = 108 N = 72 DK/NR = 26

q. Met with FBI Field Office to 

discuss protocols and other security 

measures Y = 51 N = 128 DK/NR = 27

 

54. What role, if any, do you think the federal government should play in 

COORDINATING security initiatives at wastewater treatment facilities and their 

associated infrastructures? 

N = 125

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 58 GAO-06-390 Wastewater Facility Security

9. Conclusions and Additional Comments 

55. What are the 3 most significant security measures that have been put in place at your 

wastewater treatment facility and associated infrastructure? 

N = 177

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

56. Of those security measures that you have PLANNED, BUT HAVE NOT YET PUT 

IN PLACE, which 3 measures do you anticipate will be the most useful to improving 

security at your wastewater treatment facility and associated infrastructure? 

N = 147

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

57. What 3 security measures, if any, would you put in place if you were free to 

implement any measures you viewed as potentially useful to improving security at 

your facility and associated infrastructure 

N = 161

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 59 GAO-06-390 Wastewater Facility Security

For the security measures you listed in 57 above, were any of the following factors 

important in your facility not yet implementing these measures? 

(Check one in each row. Leave blank if you did not list any security measures in 57.) 

58.

N = 206

Yes No Don’t know/No 

response

 a. Not enough time 

Y = 39 N = 85 DK/NR =82

 b. Limited resources 

Y = 129 N = 13 DK/NR = 64

 c. Other security priorities more critical 

Y = 62 N = 63 DK/NR = 81

 d. Technology needed not readily 

available Y = 27 N = 94 DK/NR = 85

 e. Necessary agreements not in place 

Y = 23 N = 92 DK/NR = 91

 f. Other (Please specify below.)

Y = 18 N = 52 DK/NR = 136

59. (If you checked "yes" for Other) What other factors were important in your facility not 

yet implementing these measures? 

N = 21

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

60. What do you consider to be the major challenges to reducing vulnerabilities to the 

wastewater treatment collection systems' network of sanitary, storm, and combined 

sewer lines? 

N = 151

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

61. What, if any, are the most innovative or effective practices that address these 

challenges to reducing vulnerabilities to the wastewater treatment collection system? 

N = 109

We did not summarize the narrative responses to this question for inclusion in 

this appendix.
Appendix II

Survey of Wastewater Treatment Facilities

Page 60 GAO-06-390 Wastewater Facility Security

62. What are the most important things, if any, the federal government could do to 

improve the security at your facility and other wastewater treatment facilities 

nationwide? 

N = 143

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

63. If you would like to provide additional comments concerning security at your 

wastewater treatment facility, specifically, and/or security at wastewater treatment 

facilities in general, please provide them in the space below. 

N = 40

We did not summarize the narrative responses to this question for inclusion in 

this appendix.

Have you finished this questionnaire? 

Check only one answer. 

N = 206

1. Yes [206]

64.

2. No [0]
Page 61 GAO-06-390 Wastewater Facility Security

Appendix III

Comments from the Environmental 

Protection Agency ApendxiI
Appendix III

Comments from the Environmental 

Protection Agency

Page 62 GAO-06-390 Wastewater Facility Security
Page 63 GAO-06-390 Wastewater Facility Security

Appendix IV

GAO Contact and Staff Acknowledgments ApendxiIV

GAO Contact John B. Stephenson (202) 512-3841

Acknowledgments In addition to the contact named above, Nancy Bowser, Jenny Chanley, 

Steve Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry Sandau, 

Rebecca Spithill, and Monica Wolford made key contributions to this 

report.

(360576)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548