Securing Wastewater Facilities: Utilities Have Made Important Upgrades but Further Improvements to Key System Components May Be Limited by Costs and Other Constraints
Published: 2006-03-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Wastewater facilities provide essential services to residential, commercial, and industrial users, yet they may possess certain characteristics that terrorists could exploit to impair the wastewater treatment process or to damage surrounding infrastructure. For example, large underground collector sewers could be accessed by terrorists for purposes of placing destructive devices beneath buildings or city streets. GAO was asked to determine (1) what federal statutory authorities and directives govern the protection of wastewater treatment facilities from terrorist attack, (2) what steps critical wastewater facilities have taken since the terrorist attacks of September 11, 2001, (9/11) to ensure that potential vulnerabilities are addressed, and (3) what steps the Environmental Protection Agency (EPA) and the Department of Homeland Security (DHS) have taken to help these facilities in their efforts to address such vulnerabilities.
section_title: What GAO Found
paragraphs: Federal law does not address wastewater security as comprehensively as it does drinking water security. For example, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 required drinking water facilities serving populations greater than 3,300 to complete vulnerability assessments, but no such requirement exists for wastewater facilities. While federal law governing wastewater security is limited, Homeland Security Presidential Directive 7 designated EPA as the lead agency to oversee the security of the water sector, including both drinking water and wastewater. The directive tasked EPA with several responsibilities, including the development of mechanisms for information sharing and analysis within the water sector. Our survey of over 200 of the nation's large wastewater facilities shows that many have made security improvements since 9/11. Most facilities indicated they have completed, have under way, or plan to complete some type of security assessment. Similarly, more than half of responding facilities indicated they did not use potentially dangerous gaseous chlorine as a wastewater disinfectant. Survey responses show that other security measures taken after 9/11 have generally focused on controlling access to the treatment plant through improvements in visual surveillance, security lighting, and employee and visitor identification. Little effort, however, has been made to address collection system vulnerabilities, as many facilities cited the technical complexity and expense involved in securing collection systems that cover large areas and have many access points. Others reported that taking other measures, such as converting from gaseous chlorine, took priority over collection system protections. While EPA and DHS have initiatives to address wastewater facility security, efforts to provide critical and threat-related information would benefit from closer coordination. EPA and DHS fund multiple information services designed to communicate information to the water sector--specifically, EPA funds the Water Information Sharing and Analysis Center (WaterISAC) and its Water Security Channel, while DHS funds the Homeland Security Information Network (HSIN). EPA, DHS, and other industry experts are concerned that these multiple information services may overlap and produce inefficiencies. For example, a substantial part of the $2 million annual grant EPA uses to fund the WaterISAC is dedicated to purchasing computer services likely available through DHS and HSIN at no cost. A Water Sector Coordinating Council was established by the water sector to help determine the appropriate relationship among these information services. A preliminary review is under way to examine options for improving coordination between the WaterISAC, the Water Security Channel, and HSIN; however, the scope and time frame for completion of this review is unclear.

section_title: Letter
paragraphs: Wastewater facilities in the United States provide essential services to  residential, commercial, and industrial users by collecting and treating  wastewater and discharging treated effluent into receiving waters. These  facilities may also provide opportunities for terrorists to either impair the  wastewater treatment process or damage surrounding communities and  infrastructure. For example, damage to a wastewater facility or collection  system could prevent water from being treated, impacting downriver water  intakes. Destroying tanks that hold large amounts of chemicals at  treatment plants could release toxic chemical agents, such as gaseous  chlorine, that can be deadly if inhaled and, at lower doses, could burn eyes  and skin and inflame the lungs. Large underground collector sewers could  be accessed by terrorist groups for purposes of placing destructive devices  beneath buildings or city streets.
In January 2005, we reported the views of nationally recognized experts on  key issues concerning wastewater security. The five assets experts  considered most vulnerable included (1) the collection systems’ network of  sewer lines used to move wastewater away from its point of origination to  the treatment plant; (2) treatment chemicals, such as gaseous chlorine,  used to disinfect wastewater; (3) key components of the wastewater  treatment plant, such as its headworks, where raw sewage first enters the  plant; (4) automated control systems that control many vital operations,  such as the amount of chlorine needed for disinfection; and (5) pumping  stations along the collection system that lift or pump wastewater to the  treatment plant. The experts noted that security-enhancing activities that  most warrant federal support include replacing gaseous chemicals used in  wastewater treatment with less hazardous alternatives; improving local,  state, and regional collaboration efforts; and completing vulnerability  assessments for individual wastewater systems. When asked how federal  wastewater security funds should be allocated among potential recipients,  the vast majority of experts suggested that wastewater utilities serving  critical infrastructure (e.g., public health institutions, government,  commercial, and industrial centers) should be given the highest priority.  Other recipients warranting highest priority included utilities using large  quantities of gaseous chemicals and utilities serving areas with large  populations.
As a follow-on to that review, this report examines: (1) what federal  statutory authorities and directives govern the protection of wastewater  treatment facilities from terrorist attack, (2) what steps critical wastewater  treatment facilities have taken since the terrorist attacks of September 11,  2001, (hereafter referred to as “9/11”) to ensure that potential  vulnerabilities are addressed, and (3) what steps the Environmental  Protection Agency (EPA) and the Department of Homeland Security (DHS)  have taken to help these facilities in their efforts to address such  vulnerabilities.
To identify federal statutory authorities and directives that govern  protection of wastewater treatment facilities, we reviewed applicable laws;  Homeland Security Presidential Directives; and EPA and DHS policies,  guidance, and regulations related to wastewater security. To determine  what steps critical wastewater treatment facilities have taken since 9/11 to  ensure that potential vulnerabilities are addressed, we conducted a Web- based survey of the nation’s publicly-owned treatment works (POTWs) that  serve residential populations of 100,000 or greater. Together, these facilities  provide wastewater service to approximately 36 percent of the U.S.  population served by POTWs. We received an 82 percent response rate to  the survey. To determine what steps EPA and DHS have taken to help these  facilities in their efforts to address such vulnerabilities, we reviewed  relevant EPA and DHS guidance and other documents, and interviewed  agency personnel. We also interviewed state and local officials with  oversight for wastewater treatment operations and security. Information  about federal efforts to enhance wastewater security from the perspective  of wastewater treatment facilities was provided to us through our Web- based survey. We conducted our work between May 2005 and February  2006 in accordance with generally accepted government auditing  standards. See appendix I for a more detailed discussion of our scope and  methodology.
subsections: section_title: Background
paragraphs: Nationwide, more than 16,000 POTWs serve more than 200 million people,  or about 70 percent of the nation’s total population. The remaining  population is served by privately-owned utilities or by on-site systems, such  as septic tanks. A relative handful of large wastewater systems serve the  great majority of people, as about 500 large public wastewater systems  provide service to 62 percent of the population connected to a sewer  system. In addition to serving residential populations, approximately  27,000 commercial and industrial facilities rely on wastewater treatment  facilities to treat their wastewater. POTWs discharge treated effluent into  receiving waters and are regulated under the Clean Water Act.
Wastewater systems vary by size and other factors, but all include a  collection system and a treatment facility.
The collection system is the underground network of sewers including  both sanitary and storm water collection lines. Collection systems tend  to be dispersed geographically and have multiple access points,  including drains, catch basins, and manholes. Lines may range from 4  inches to greater than 20 feet in diameter, and access is usually  conducted through manholes that are typically 300 feet apart. Many  collection systems rely on gravity to maintain the flow of sewage  through the pipes toward the treatment plant. However, collection  systems may also depend on pumping stations to propel the flow when  gravity alone is insufficient. Nationwide, there are approximately  800,000 miles of sewer lines and 100,000 major pumping stations.
The wastewater treatment facility receives wastewater from the  collection system and begins the treatment process which typically  involves several stages before treated effluent is released into receiving  waters. Primary treatment includes removal of larger objects through a  screening device or a grit removal system, and the removal of solids  through sedimentation. Secondary stage treatment includes a biological  process that consumes pollutants, as well as final sedimentation. Some  facilities also use tertiary treatment to remove nutrients and other  matter even further. Following these treatments, the wastewater is  disinfected to destroy harmful bacteria and viruses. Disinfection is often  accomplished with chlorine, which is stored in gaseous or liquid form  on-site at the wastewater treatment plant. The collection system and  treatment process is typically monitored and controlled by a  Supervisory Control and Data Acquisition (SCADA) system, which  allows utilities to control such things as the amount of chlorine needed  for disinfection.
Wastewater treatment facilities may possess certain characteristics that  terrorists could exploit either to impair the wastewater treatment process  or to damage surrounding communities and infrastructure. For example,  the numerous storm drains, manholes, and sewers that make up a  community’s wastewater collection system’s network of sewers could be  used to covertly place explosives beneath a major population center or to  introduce substances that may damage a wastewater treatment plant’s  process. Damage to (or destruction of) tanks that hold large amounts of  gaseous chlorine used to disinfect wastewater could release the potentially  lethal gas into the atmosphere. Such events could result in loss of life,  destruction of property, and harm to the environment.
Documented accidents and intentional acts highlight the destruction that  could arise from an attack on a wastewater system.
In June 1977 in Akron, Ohio, an intentional release of naptha, a cleaning  solvent, and alcohol into a sewer by vandals at a rubber manufacturing  plant caused explosions 3.5 miles away from the plant, damaging about  5,400 feet of sewer line and resulting in more than $10 million in  damage.
In 1981 in Louisville, Kentucky, thousands of gallons of a highly  flammable solvent, hexane, spilled into the sewer lines from a local  processing plant. Fumes from the solvent ignited, and the resulting  explosions collapsed a 12-foot diameter pipe and damaged more than 2  miles of streets. No one was seriously injured, but sewer line repairs  took 20 months, followed by several more months to repair the streets.
In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused  explosions that killed 215 people, injured 1,500 others, damaged 1,600  buildings, and destroyed 1.25 miles of sewer.
In 2002 in Hagerstown, Maryland, chemicals from an unknown source  entered the wastewater treatment plant and destroyed the facility’s  biological treatment process. The event resulted in the discharge of  millions of gallons of partially treated sewage into a major tributary of  the Potomac River, less than 100 miles from a water supply intake for  the Washington, D.C., metropolitan area.
In January 2005, we reported the views of 50 nationally recognized experts  on key issues concerning wastewater security. Our panel of experts  identified five key wastewater assets as most vulnerable to terrorist  attacks: the collection systems’ network of sewers (42 of 50 experts),  treatment chemicals (32 of 50 experts), key components of the treatment  plant (29 of 50 experts), control systems (18 of 50 experts), and pumping  stations (16 of 50 experts). When asked to identify and set priorities for the  security-enhancing activities most deserving of federal support, the expert  panel identified 11 key actions, but ranked three as deserving highest  priority—replacing gaseous chemicals used in the wastewater treatment  process; improving local, state, and regional efforts to coordinate  responses in advance of a potential terrorist threat; and completing  vulnerability assessments for individual wastewater systems.
section_title: Federal Laws and Directives Related to Wastewater Security Are Limited
paragraphs: Federal law does not address wastewater security as comprehensively as it  does drinking water security. In particular, wastewater facilities are not  required by law to complete vulnerability assessments. The Clean Air Act  does require wastewater facilities using certain amounts of hazardous  substances, such as chlorine gas, to submit to EPA a risk management plan  that lays out accident prevention and emergency response activities. Also,  under EPA guidance, the Clean Water State Revolving Fund can be used in  many instances for certain wastewater system security enhancements.  While federal law governing wastewater security is limited, in December  2003, the president issued HSPD-7. The directive designated EPA as the  lead agency to oversee the security of the water sector, including both  drinking water and wastewater critical infrastructures.
subsections: section_title: Federal Law Does Not Address Wastewater Security As It Does Drinking Water
paragraphs: In 2002, Congress passed the Bioterrorism Act, which amended various  laws, including the Safe Drinking Water Act. The Bioterrorism Act required  drinking water systems serving more than 3,300 people to complete  vulnerability assessments of their facilities by June 2004 and to prepare or  update an existing emergency response plan. The Bioterrorism Act  required the assessments to include, but not be limited to, a review of six  components: (1) pipes and constructed conveyances; (2) physical barriers;  (3) water collection, pretreatment, treatment, storage, and distribution  facilities; (4) electronic, computer, or other automated systems which are  utilized by the public water system; (5) the use, storage, or handling of  various chemicals; and (6) the operation and maintenance of such  systems. Under the act, the emergency response plans were to include  plans, procedures, and identification of equipment to lessen the impact on  public health and the drinking water supply of terrorist attacks or other  intentional acts against drinking water systems. The act authorized $210  million for fiscal year 2002, mostly to assist drinking water systems in  completing vulnerability assessments, preparing or updating response  plans, and making needed security improvements. Drinking water systems  are not required to implement any risk-reduction actions based on their  vulnerability assessments or report to EPA on measures that have been  implemented.
In 2003, the Congress considered alternative bills that would have  encouraged or required wastewater treatment plants to assess the  vulnerability of wastewater facilities, make physical security  improvements, and conduct research. However, the legislation did not  become law and, consequently, no such requirement or specific funding  exists for wastewater facilities.
section_title: Other Federal Environmental Laws Address Some Areas of Security at Wastewater Facilities
paragraphs: While federal law does not require wastewater systems to take security  measures to protect specifically against a terrorist attack, it does require  certain wastewater facilities to take security precautions that could  mitigate the consequences of such an attack. For example, the 1990 Clean  Air Act amendments mandated EPA oversight of risk management  planning at facilities that handle more than specified-threshold quantities  of hazardous substances, including the gaseous chlorine often used as a  disinfectant at wastewater facilities. Specifically, EPA regulations  implementing the Clean Air Act require these facilities to prepare Risk  Management Plans (RMPs) that summarize the potential threat of sudden,  accidental, large releases of certain chemicals; including the results  occurring off-site in a worst-case chemical accident, and the facility’s plan  to prevent releases and mitigate any damage. RMPs are to be revised and  resubmitted to EPA at least every 5 years, and EPA is required to review  them and require revisions, if necessary.
For a March 2003 report, EPA told us it believed the Clean Air Act could be  interpreted to provide authority to address site security from terrorist  attacks at RMP facilities, because the act imposes certain requirements on  these facilities regarding “accidental releases.” The act defines an  accidental release as an unanticipated emission of a regulated substance or  other extremely hazardous substance into the air, so any chemical release  caused by a terrorist attack could be considered “unanticipated” and  covered under the Clean Air Act. Such an interpretation would provide EPA  with authority under the act’s RMP provisions and general duty clause to  require security measures or vulnerability assessments with regard to  terrorism. However, EPA has not attempted to use these Clean Air Act  provisions because it is concerned that such an interpretation would pose  significant litigation risk and has concluded that chemical facility security  would be more effectively addressed by passage of specific legislation.
Wastewater facilities that store certain amounts of hazardous chemicals  may also be subject to the Resource Conservation and Recovery Act.   Under regulations implementing the act, facilities that house hazardous  waste generally must take certain security actions, such as posting warning  signs and using a 24-hour surveillance system, or surrounding the active  portion of the facility with a barrier and controlled entry gates. However,  according to EPA, these security measures are aimed at keeping out  trespassers or wanderers, not intentional intruders.
Other federal statutes impose safety requirements on certain wastewater  facilities that may incidentally reduce the likelihood and mitigate the  consequences of terrorist attacks. For example, the Occupational Safety  and Health Act imposes a number of safety requirements, including a  general duty to furnish a workplace free from recognized hazards that may  cause death or serious physical harm to employees. The Emergency  Planning and Community Right-to-Know Act requires owners of facilities  that maintain specified quantities of certain extremely hazardous  chemicals to submit information annually on their chemical inventory to  state and local emergency response officials. The act also requires that  each state establish a State Emergency Response Commission to oversee  local emergency planning and create local emergency planning  committees. These committees must develop and periodically review their  communities’ emergency response plans, including the identification of  chemical facilities, and outline procedures for response personnel to  follow in the event of a chemical incident.
Aside from statutes that address some areas of wastewater security, EPA  has asserted that federal funding is available for wastewater security- related measures through the Clean Water State Revolving Fund (CWSRF)  program. The CWSRF is an EPA-administered program that provides  grants to the states to fund a variety of water-quality projects, including  those at municipal wastewater treatment facilities. States may use the  funds to provide loans to local governments to assist wastewater utilities in  making infrastructure improvements needed to protect public health and  ensure compliance with the Clean Water Act. According to EPA, states may  use the CWSRF to assist utilities in completing a variety of security-related  actions, such as vulnerability assessments, contingency plans, and  emergency response plans. In addition, EPA has identified other  infrastructure improvements that may be eligible for funding, such as the  conversion from gaseous chemicals to alternative treatment processes,  installation of fencing or security cameras, securing large sanitary sewers,  and installing tamper-proof manholes. In our January 2005 report  summarizing experts’ views on wastewater security, a number of experts  expressed caution about relying heavily on the CWSRF program to support  security enhancements, largely because of the time-lag in obtaining funds  for security-related measures, and because such demands on the CWSRF  would divert needed funding away from the kind of critical infrastructure  investments that are the CWSRF program’s primary purpose.
Another source of federal funding potentially available for wastewater  security-related measures is the State Homeland Security Grant Program  administered by DHS. This program’s primary objectives are to enhance the  capacity of state and local emergency responders to prevent, protect  against, respond to, and recover from terrorist incidents involving  chemical, biological, radiological, nuclear, and explosive devices;  agriculture; and cyber attacks. Under the program, grants are provided to  states for a variety of purposes, including homeland security-related  training and protection of critical infrastructure, although authority to  make physical security improvements is limited. States are required to  allocate at least 80 percent of these grant funds to “local units of  governments,” which, as defined in the conference report accompanying  the Department of Homeland Security Appropriations Act for fiscal year  2006, include water districts, special districts, and other political  subdivisions of a state.
section_title: EPA Was Assigned Lead Federal Responsibility for Water-Sector Security Including Wastewater Facilities
paragraphs: In December 2003, the president issued HSPD-7, which established a  national policy for federal departments and agencies to identify and set  priorities for the nation’s critical infrastructures and to protect them from  terrorist attacks. HSPD-7 established EPA as the lead federal agency to  oversee the security of the water sector, both drinking water and  wastewater. Presidential Decision Directive 63 had done so earlier in May  1998, with a focus primarily on water supply.
Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and  coordinating infrastructure protection activities for the nation's drinking  water and water treatment systems; (2) working with federal departments  and agencies, state and local governments, and the private sector to  facilitate vulnerability assessments; (3) encouraging the development of  risk management strategies to protect against and mitigate the effects of  potential attacks on critical resources; and (4) developing mechanisms for  information sharing and analysis.
HSPD-7 also called for DHS to integrate all critical infrastructure security  efforts among federal agencies and to complete a comprehensive national  plan for critical infrastructure and key resource protection—now called the  National Infrastructure Protection Plan. Under HSPD-7, seven federal  agencies, including EPA, were designated sector-specific agencies. DHS  issued guidance tasking each sector-specific agency with developing  sector-specific plans for input into the comprehensive plan. Each sector- specific plan is supposed to outline strategies for (1) collaborating with all  relevant federal departments and agencies, state and local governments,  and the private sector; (2) identifying assets; (3) conducting or facilitating  vulnerability assessments; and (4) encouraging risk management strategies  to protect against and mitigate the effects of an attack. The water sector- specific plan will be an appendix to the National Infrastructure Protection  Plan. On January 20, 2006, DHS issued its revised National Infrastructure  Protection Plan based on comments it received on an earlier version of the  plan. DHS accepted additional comments on the revised version until  February 6, 2006, and expects to issue a final version of the plan later in  2006. Sector-specific agencies are required to submit their sector-specific  plans to DHS within 6 months after the National Infrastructure Protection  Plan is made final.
section_title: Many Large Wastewater Facilities Have Made Security Improvements but Efforts to Protect Collection Systems Have Been Limited
paragraphs: Our survey of large wastewater facilities indicates that many have taken  steps to improve security. Most facilities that responded to our survey have  completed, have under way, or plan to complete some type of security  assessment. Roughly two-thirds of facilities also reported they used a  disinfectant other than gaseous chlorine or plan to switch from the gas. Of  those facilities that continue to use gaseous chlorine, many have taken  steps to increase security by limiting and monitoring access to gaseous  chlorine storage areas or through other actions. Survey responses show  that since 9/11, wastewater treatment facilities have also focused security  efforts on controlling and limiting access to their treatment plants.  Importantly, facilities have taken fewer security actions intended to protect  treatment collection systems. Many facilities reported that taking other  measures to protect their treatment plants, including converting from  gaseous chlorine to a safer disinfection process, took priority over  protecting infrastructure in their collection systems. Survey results show a  lack of funding and federal security guidelines remain a concern for many  wastewater facility managers.
subsections: section_title: Most Facilities Have Conducted or Plan to Conduct Some Type of Security Assessment
paragraphs: Seventy-four percent of facilities that responded to our survey reported  they completed, were in the process of completing, or planned to complete  some type of security assessment—either a vulnerability assessment,  similar to that which was required of drinking water facilities under the  Bioterrorism Act, or another type of security assessment. As shown in  figure 1, 106 facilities—or 51 percent of those responding to our survey— indicated that they had completed a vulnerability assessment or were  currently conducting a vulnerability assessment.
Of the 106 facilities that indicated they had either completed a vulnerability  assessment or had one under way, 80 indicated their vulnerability  assessments were complete, while 26 indicated the assessment was still in  process. As shown in the figure, 22 facilities—or 11 percent of all  responses—indicated they had conducted another type of security  assessment or were in the process of conducting another type of security  assessment, while 24 facilities—or 12 percent of all responses—indicated  they plan to conduct either a vulnerability or another type of security  assessment.
Twenty-three facilities—or 11 percent of total responses—indicated they  had no plans to conduct any type of security assessment. When asked to  identify reasons for not conducting a vulnerability or security assessment,  17 of these 23 facilities cited a lack of requirement to do so, while 15 noted  that they considered security actions taken at their facilities adequate for  their security needs. Thirteen of these facilities indicated that their  emergency response plan was updated and this seemed sufficient to  address potential vulnerabilities.
Facilities cited several reasons for completing a vulnerability or some other  type of security assessment, but most—roughly 77 percent—reported  doing so on their own initiative. Thirty-seven percent of facilities reported  that they did so in conjunction with the required assessment for their  drinking water facility. To a lesser extent, facilities cited state, local, and  utility governing-body requirements as reasons they conducted  assessments. See appendix II for survey results related to vulnerability and  security assessments at large wastewater facilities.
section_title: Most Large Facilities Have Discontinued or Plan to Discontinue Use of Gaseous Chlorine, and Chlorine Users Have Pursued Other Security Enhancements
paragraphs: As shown in figure 2, over half of large wastewater facilities in our survey  reported they use an alternative to gaseous chlorine in their disinfection  process. These results are consistent with studies which conclude that over  the past decade, wastewater treatment facilities have moved away from  gaseous chlorine as a disinfectant.
Of the facilities not using gaseous chlorine, 89 reported using sodium  hypochlorite as their primary disinfectant. Sodium hypochlorite is  essentially a strong version of household bleach and is considered safer  than gaseous chlorine. Seventeen facilities report they are using ultraviolet  light as their primary disinfectant. The remaining facilities did not identify  the type of disinfectant method used at their facility.
In our January 2005 report, we noted that the change, for an individual  plant, to sodium hypochlorite may require approximately $12.5 million for  new equipment and increase annual chemical costs from $600,000 for  gaseous chlorine to over $2 million for sodium hypochlorite. However, one  expert noted some costs may be offset through savings in regulatory  paperwork and certain emergency planning efforts. In our survey, we asked  facilities that switched from gaseous chlorine if their annual costs  increased, stayed the same, or decreased after switching to an alternate  disinfection method. Fifty-eight facilities reported that costs increased, 11  noted that costs have stayed about the same, and one facility reported that  costs decreased.
Of the 85 facilities that reported use of gaseous chlorine, 20—or roughly 10  percent of all 206 reporting facilities—indicated that they have plans to  switch from gaseous chlorine to another disinfectant. In addition, as shown  in figure 3, many reported taking additional steps after 9/11 to mitigate the  potential risks associated with continued reliance on chlorine.
Forty-one facilities using gaseous chlorine reported that they instituted  controls for selective access to chlorine storage areas after 9/11, while 30  facilities reported making other security improvements to the storage area,  such as installing electronic surveillance of the chlorine storage area or  improving gates and fencing. Fewer facilities reported that they decided to  store gaseous chlorine in smaller-quantity containers, likely because most  reported they already stored the gas in one-ton containers, which are  among the smallest containers used at large wastewater facilities for the  gas. See appendix II for survey results on gaseous chlorine use at large  wastewater facilities.
section_title: Security Efforts Have Generally Focused on Improved Control of Wastewater Treatment Plant Access, While Efforts to Protect Collection Systems Have Been Limited
paragraphs: As shown in figure 4, many facilities reported taking basic security  measures prior to 9/11, such as installing vehicle gates and security fencing.  Survey respondents also indicated that many information technology  security measures, such as virus protection programs, backup power  supplies, and firewall and intrusion detection systems, were implemented  before 9/11.
The figure shows that security enhancements made or planned by large  wastewater facilities after 9/11 generally focus on controlling access to the  treatment plant. Such security enhancements include adding visual  surveillance monitoring, increasing security lighting, implementing  employee and visitor identification policies, adding guard stations, and  upgrading SCADA capability and security.
Importantly, few facilities reported taking measures to address collection  system vulnerabilities other than having available redundant pumping  devices or collection bypass systems. For example, few have installed or  plan to install manhole intrusion sensors, manhole locks, or sensors to  detect toxics or other biochemical threats to their collection systems. This  lack of attention to collection system vulnerabilities is important because  42 of the 50 experts polled in our January 2005 report on wastewater  security identified the collection systems’ network of sanitary, storm, and  combined sewers as the most vulnerable asset of a wastewater utility.  Several noted that sewers make underground travel from a point of entry to  a potential target almost undetectable, possibly allowing sewers to be used  as an underground transport system for explosive or toxic agents.
Many facilities reported that other measures to protect their treatment  plants, including converting from gaseous chlorine to a safer disinfection  process, took priority over protecting infrastructure in their collection  systems. Other managers cited the difficulty and expense in securing  collection systems that, by nature, cover a large area and have many, often  remote, access points. One manager expressed confusion about whether to  concentrate monitoring resources on large interceptor sewer lines to  prevent entry or on toxic materials that could be introduced at nearly every  access point to his system. Others noted the lack of facility control over  collection systems. One facility manager told us his facility treats  wastewater that is collected from 17 separate collection systems. Finally, a  number of respondents questioned whether the technologies purportedly  available to detect potential threats introduced to collection systems are  sufficiently capable of achieving this objective.
Nonetheless, a few facility managers with whom we spoke told us they  have made efforts to address collection system security, particularly in the  protection of their pump stations. One facility manager told us his facility  has a project under way to install security locks and card-access controls at  all 93 of its pumping stations. According to the manager, the concentration  of and need to protect capital equipment, and the potential impact of  damage or destruction of that infrastructure prompted the facility to direct  its capital improvement efforts to securing pumping stations.
While many facilities in our survey indicated they made some security  improvements after 9/11, facility managers cited limited resources and  other priorities as reasons for not implementing further security measures.  Facility managers and other industry experts with whom we spoke noted  that security upgrades must compete with other infrastructure needs for  available resources. For instance, many wastewater facilities’ collection  systems are outdated, and they are already facing large costs to expand and  repair their aging systems and reduce incidences of combined sewer  overflows. Major U.S. cities, such as Washington, D.C., and Cincinnati,  Ohio, are facing costs between $1 and $2 billion to implement necessary  capital improvements. See appendix II for survey results on physical,  personnel, and information technology security measures taken at large  wastewater facilities.
section_title: Many Facility Managers Reported a Need for Additional Funding and Other Assistance to Further Security Improvements
paragraphs: In our survey, we asked wastewater facility managers what the federal  government could do to improve security at wastewater facilities. Facility  manager responses are categorized in table 1.
Facility managers predominantly recommended additional funding to  further wastewater security improvements. Many facility managers  recommended targeting funding to specific measures, such as performing  vulnerability assessments, purchasing specific security equipment such as  surveillance cameras, or covering costs associated with switching from  gaseous chlorine to a safer disinfectant. To a much lesser extent,  wastewater facility managers commented that the federal government  could be of greater assistance in providing security guidance, standards,  and best practices. For example, one facility manager we interviewed  expressed a need for federal guidance and best practices on collection  system security. For its part, in 2002, EPA provided funding to the  American Society of Civil Engineers (ASCE) to develop a set of security  guidance documents that cover the design of online contaminant  monitoring systems, and physical security enhancements of drinking water,  wastewater, and storm water infrastructure systems. ASCE sub-contracted  with American Water Works Association and the Water Environment  Federation (WEF) for assistance on this project. In 2004 these documents  were released as interim voluntary security design standards for the water  sector and finalized standards are to be established in late 2006 or early  2007. These security-focused documents are intended to serve as a  foundation to help water utilities address potential vulnerabilities through  sound design, construction, and operation and maintenance practices.  According to a WEF representative, one set of standards is to be directed at  physical security measures for wastewater collection systems. The security  standards are to be published in late 2006 and are to include both  prescriptive and performance-based criteria that focus on physical security  upgrades that reduce risk to water, wastewater, and storm water  infrastructure arising from malevolent events.
section_title: EPA and DHS Have Several Initiatives to Enhance Wastewater Facility Security, Yet a Key Effort Requires Additional Coordination
paragraphs: EPA and DHS have a number of initiatives under way related to wastewater  facility security.  For example, EPA has funded programs to develop  vulnerability assessment tools and provide training to wastewater facilities  on the use of these tools, while DHS has conducted site assessment visits at  wastewater facilities. While these initiatives are helping to address security  concerns in the wastewater sector, EPA and DHS efforts could nonetheless  be more effective with greater coordination over how best to convey  security-related and threat information to the wastewater treatment  community.
subsections: section_title: EPA and DHS Have Several Initiatives Under Way Related to Wastewater Security
paragraphs: Since 2002, EPA has provided more than $10 million to help address the  security needs of the wastewater sector. EPA funded the development and  dissemination of several risk assessment methodologies to assist water  sector utilities in identifying how to better protect their critical  infrastructures. In addition, EPA funded training for wastewater utilities on  how to conduct risk assessments and update or complete emergency  response plans. EPA provided funding to the Association of Metropolitan  Sewerage Agencies to develop a software tool, called the Vulnerability  Self Assessment Tool (VSAT), for drinking water utilities. In addition,  through an interagency agreement with EPA, the Department of Energy’s  Sandia National Laboratories provided training to selected firms in a  vulnerability assessment methodology developed by the labs, called the  Risk Assessment Methodology for Water Utilities (RAM-W). For  vulnerability assessments at smaller water systems, EPA supported the  dissemination of the Security and Emergency Management System (SEMS)  software tool.
Sixty-nine wastewater facilities responding to our survey indicated they  used, were currently using, or planned to use the VSAT software to  complete a vulnerability or security assessment; 27 facilities indicated they  either used, were currently using, or planned to use the RAM-W assessment  tool. Another four facilities indicated they either used, were currently  using, or planned to use the SEMS software.
EPA has also reorganized its own internal structure and sought input from  experts outside of the agency to better assist the wastewater industry’s  security efforts. In particular, in 2003, EPA created a Water Security  Division to work with the states, tribes, drinking water and wastewater  utilities, and other partners to enhance the security of water and  wastewater utilities and the ability to respond effectively to security threats  and breaches. In addition, in 2004, the National Drinking Water Advisory  Council (NDWAC), at EPA’s request, established a Water Security Working  Group made up of 16 members from wastewater utilities, drinking water  utilities, and environmental and rate-setting organizations to advise on the  development of best security practices and policies for water utilities. The  group advises the NDWAC on ways to address several specific security  needs of the sector. In June 2005, the working group provided NDWAC with  a report that identified features of an active and effective security program  and ways to measure the adoption of these practices.
As noted, EPA provided funding to ASCE to develop a set of security  guidance documents that cover the design of online contaminant  monitoring systems, and physical security enhancements of drinking water,  wastewater, and storm water infrastructure systems. This effort, called the  Water Infrastructure Security Enhancement project, is to address physical  infrastructure security needs in the water sector by issuing guidance  documents, training materials, and voluntary standards relating to water  infrastructure security. The project group is currently developing physical  security standards that focus on physical security upgrades to reduce risk  to water, wastewater, and storm water arising from malevolent acts.
For its part, DHS has two broad initiatives that have facilitated efforts to  improve wastewater security. First, the Buffer Zone Protection program is  a DHS grant program designed to reduce specific vulnerabilities at a critical  infrastructure or key resource site by assisting local law enforcement to  develop a plan for preventative and protective measures that make it more  difficult for terrorists to plan or launch attacks from the immediate vicinity  of the site. They also identify equipment that could be purchased to  mitigate the vulnerabilities. Upon plan approval, DHS grants funds for  procuring materials and equipment necessary for implementation of the  site’s buffer zone protection plan. According to DHS, as of October 31,  2005, security at 14 wastewater facilities has been reviewed under the  Buffer Zone Protection program.
Under its second broad initiative, the Site Assistance Visits program, DHS  visits critical infrastructure sites nationwide to address key areas of  concern at facilities requiring security enhancements. DHS subject matter  experts in the areas of physical security measures, system  interdependencies, and terrorist attack prevention conduct these visits— generally lasting 1 to 3 days—in which, among other things, the  vulnerabilities of the site or facility are identified and mitigation options are  discussed. According to DHS, as of October 31, 2005, a total of 350 site  assessment visits have been conducted. Of this total, seven were conducted  with wastewater facilities.
In addition to these programs, DHS funded a NACWA project to develop a  decision tree and report template to help water systems assess and  examine chlorine gas alternatives for water and wastewater disinfection.  The decision tree guides water systems in evaluating the potential costs  and benefits of conversion and determining whether an alternative  disinfection method will still enable them to meet their permit  requirements. The report template is to ensure that the results of the  decision tree analysis are reported in a consistent format, improving a  water system’s ability to pursue and secure any available state or federal  funding for conversion. According to a NACWA representative, they are in  the process of finishing the design of the decision tool and, once the final  product is reviewed and approved by DHS, printing of the CD tool will  begin. NACWA expects to make the tool available to water and wastewater  utilities free of charge no later than the end of March 2006.
While EPA and DHS have these wastewater security-related initiatives  under way, the Congress has expressed concerns that EPA’s homeland  security responsibilities are not well articulated in relation to DHS’  responsibilities. In the conference report for the fiscal year 2005  Consolidated Appropriations Act, conferees directed EPA to enter into a  memorandum of understanding (MOU) with DHS that defines the  relationship and responsibilities of the two entities regarding homeland  security and protection. EPA did not enter into the MOU, but instead, on  November 1, 2005, issued a report to the Congress entitled “Homeland  Security Roles and Responsibilities and Interactions Between EPA and the  Department of Homeland Security.”  The report identified the homeland  security-specific authorities, core mission authorities, presidential  directives, and existing MOUs EPA uses to implement its homeland  security roles and responsibilities. In the report, EPA stated that it believes  its homeland security roles and responsibilities are sufficiently delineated  not only through statutes, presidential directives, and existing MOUs, but  also through planning documents and deliverables associated with a wide  variety of collaborative homeland security-related projects that EPA and  DHS are carrying out.
section_title: Multiple Efforts to Provide Critical and Threat-Related Information to the Water Sector Need Additional Coordination
paragraphs: In December 2002, the Association of Metropolitan Water Agencies  (AMWA) received a grant from EPA to establish a communication system  to share security information with water sector utilities, known as the  Water Information Sharing and Analysis Center (WaterISAC). The  WaterISAC is one of thirteen critical infrastructure and key resource sector- specific information sharing and analysis centers. The WaterISAC was  designed to meet the information sharing needs of both water and  wastewater utilities by providing real-time alerts of possible terrorist  activity, allowing for the secure reporting of incidents and the sharing of  information among users, and allowing access to a library of security- related information and contaminant databases. Beginning in fiscal year  2003, EPA has annually provided AMWA with a $2 million grant to support  the WaterISAC. This grant is augmented by subscription fees paid by  drinking water and wastewater systems. In November 2004, the  WaterISAC launched a free security advisory system known as the Water  Security Channel that distributes federal advisories on security threats via  e-mail to the water sector. The Water Security Channel also includes a  searchable archive of federal alerts, advisories, and bulletins. However, it  does not provide access to the same level of service as the subscription- based WaterISAC. WaterISAC subscribers receive additional services,  including a secure communication system, access to vulnerability  assessment tools and resources, access to an online library related to water  security issues, and access to databases about chemical, biological, and  radiological agents.
DHS has also sought to enhance communication between critical  infrastructure sectors and the government. Under the Homeland Security  Act of 2002, DHS is responsible for reducing the vulnerability of the  national infrastructure and for coordinating and communicating with all  key stakeholders on homeland security-related matters. According to DHS,  to fulfill this mandate, it requires a communication system that provides  equal and appropriate access to security information to all owners and  operators of critical infrastructure and key resources. In 2004, it piloted a  new secure network, the Homeland Security Information Network (HSIN),  to help achieve this mandate.
HSIN is DHS’ primary conduit through which it shares information on  domestic terrorist threats, suspicious activity reports, and incident  management. It is composed of multiple communities of interest, including  the HSIN Critical Sector (HSIN-CS) program, which is intended to enhance  the protection, preparedness, and crisis communication and coordination  capabilities of the nation’s 17 critical infrastructure and key resource  sectors identified in HSPD-7. The HSIN platform for critical sectors is being  developed and offered to each sector to provide a suite of information and  communication tools to share critical information both within the sector,  with DHS, and eventually across sectors. Because the water sector is one of  the nation’s 17 critical infrastructure and key resources, a HSIN-CS portal  for the sector, called HSIN Water Sector (HSIN-WS), is currently being  developed by DHS. A Water Sector Coordinating Council was also  established by the water sector with representative members of the water  sector community and charged with identifying information and other  needs of the sector, including the appropriate use of and the relationship  among Water ISAC, the Water Security Channel, and HSIN.
While these efforts are helping to improve communication, staff at EPA and  DHS, as well as other industry experts with whom we spoke, have  expressed concern that the evolution of the information sharing and  dissemination function for the water sector has resulted in several  inefficiencies.
WaterISAC access is limited to drinking water and wastewater  subscribers, plus a restricted number of subscribers from EPA and the  state drinking water programs. For example, the agreement limits  designated users to five individuals at EPA headquarters and one person  in each EPA region, for a total of fifteen EPA users. States are limited to  only two users. EPA staff note that access for others in the sector, such  as the technical service community, universities, training centers and  laboratories, would benefit the overall protection of drinking water and  wastewater critical infrastructures. EPA and DHS staff told us that,  depending upon the user policy established by the sector, the HSIN  network could allow for broader sharing of access than currently  available under the WaterISAC.
Only a small portion of the water sector is reached by the WaterISAC.
According to EPA staff, just over 530 utilities are reached by the  WaterISAC, while over 8,000 utilities receive information through the  Water Security Channel. However, the Water Security Channel does not  provide the same level of notification and information sharing provided  by the WaterISAC. The Water Security Channel is essentially a “push e- mail system” that sends out general security bulletins to water utilities  and other users, and allows for searches of previous bulletins. This  service is much more limited than that provided to WaterISAC  subscribers, which provides a secure communication system for users  to share information, access to vulnerability assessment tools and  resources, access to an online library related to water security issues,  and access to databases about chemical, biological, and radiological  agents. One water industry representative told us that the WaterISAC  recently lowered its subscription fees due to industry concerns that the  fees were limiting WaterISAC subscriptions. EPA staff told us that the  water sector generally has less funding available to support ISAC  services than other sectors such as electric, financial, and  transportation.
WaterISAC duplicates some operational functions likely available  through HSIN. EPA estimates that roughly $600,000 to $700,000 of the  annual $2 million WaterISAC grant is used to support computer  hardware and software for the secure web portal. Meanwhile, to support  HSIN, DHS funds similar computer software and hardware and its  related technical support. EPA staff noted that WaterISAC could make  use of the software and hardware platform available through HSIN. EPA  staff believed that WaterISAC could then better focus its resources on  managing its user list, managing information content on the secure web  site, and analyzing and distributing threat information, while leaving  DHS to manage and run the hardware and software.
The current reach and levels of service offered by the WaterISAC and the  Water Security Channel do not meet DHS’ objective to establish a  communication system that provides equal and appropriate access to  security information to all owners and operators in this critical  infrastructure area. According to EPA and DHS staff, the Water Sector  Coordinating Council will consider options to improve coordination  between the WaterISAC, the Water Security Channel, and HSIN. Using  funding from the supporting grant from EPA, the WaterISAC is currently  examining options for coordination between the WaterISAC, the Water  Security Channel, and HSIN. EPA noted that this review is ongoing and will  likely be presented in preliminary form to the Water Sector Coordinating  Council in a mid-March 2006 meeting. However, the scope of the  preliminary review is not clear, nor is a time frame set to complete the  review. According to DHS, the creation of the DHS Homeland  Infrastructure Threat and Risk Analysis Center will assist in information  sharing of intelligence threat information between DHS and federal, state,  and private sector partners.
section_title: Conclusions
paragraphs: Many of the nation’s large wastewater facilities have made security  improvements since the terrorist attacks of September 11, 2001. Of  particular note, many have completed some type of security assessment,  and additional facilities have such assessments under way. Our survey also  found that wastewater facilities are continuing to move away from the use  of potentially dangerous gaseous chlorine as a wastewater disinfectant.  One area of continuing concern is the difficulty these facilities are having in  addressing vulnerabilities associated with their collection systems. Facility  managers explained that with limited funding available, other important  measures considered to be more feasible and affordable were assigned  greater priority. EPA is attempting to help address this difficult issue  through funding the American Society of Civil Engineers project to develop  voluntary physical security standards for the water sector.
Despite limited federal authority over security at the nation’s wastewater  facilities, EPA, as the lead agency for water sector security, has worked  with DHS and industry groups to advance wastewater security by providing  vulnerability assessment tools, training, guidance, and burgeoning  information sharing networks. These efforts, combined with the individual  initiatives of many wastewater facilities, have resulted in measurable  security improvements. However, these efforts could benefit from  additional coordination, and we acknowledge and support EPA’s and DHS’  commitment to do so. As these agencies move forward, we believe they  should act upon the opportunities we have identified that could improve  both the efficiency with which limited dollars are being spent, as well as  the delivery of vital information services to the wastewater community.  Specifically, a substantial part of the $2 million annual EPA grant that funds  WaterISAC goes to support a computer platform that may be available at no  cost through HSIN.
section_title: Recommendation for Executive Action
paragraphs: We recommend that the Administrator of EPA work with DHS and the  Water Sector Coordinating Council to identify areas where the WaterISAC  and HSIN networks could be better coordinated, focusing in particular on  (1) how operational duplications and overlap could be addressed, and (2)  how water systems’ access to timely security threat information could be  improved. We also recommend that EPA work with DHS and the Water  Sector Coordinating Council to identify realistic time frames for the  completion of these tasks.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DHS and EPA for review and  comment. DHS agreed with the factual content of the report, and its Office  of Infrastructure Protection provided written technical comments and  clarifications that have been incorporated, as appropriate. In its letter,  reproduced in appendix III, EPA concurred with the results of the report.  EPA’s Water Security Division in the Office of Ground Water and Drinking  Water also provided technical comments and clarifications that were  incorporated, as appropriate.
As agreed with your office, unless you publicly release the contents of this  report earlier, we plan no further distribution until 30 days from the report  date. At that time, we will send copies of this report to the appropriate  congressional committees; interested Members of Congress; the  Administrator, Environmental Protection Agency; the Secretary,  Department of Homeland Security; and other interested parties. We will  also make copies available to others on request. In addition, the report will  be available at no charge on the GAO Web site at http://www.gao.gov.
Should you or your staff need further information, please contact me at  (202) 512-3841 or stephensonj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Scope and Methodology
paragraphs: To identify federal statutory authorities and directives that govern  protection of wastewater treatment facilities, we reviewed applicable laws,  Homeland Security Presidential Directives, and policies, guidance, and  regulations related to wastewater security from the Environmental  Protection Agency (EPA) and the Department of Homeland Security  (DHS). In addition, we interviewed officials in EPA’s Water Security  Division, as well as DHS officials in various areas of the agency. In addition,  we spoke with representatives for wastewater industry associations with  which EPA has collaborated to actively assist wastewater treatment  facilities to address their security issues.
To determine the steps critical wastewater treatment facilities have taken  since 9/11 to address potential vulnerabilities, we conducted a Web-based  survey of the nation’s largest wastewater treatment facilities. For the  purpose of this review, we defined “critical wastewater facilities” as the 253  wastewater facilities in the United States that have service area  populations of 100,000 or greater, as identified in the results of EPA’s 2004  Clean Watershed Needs Survey. As a result of Hurricane Katrina, one  facility in our initial population of 253 facilities that was identified as a New  Orleans facility was omitted, leaving a total 252 facilities in our survey  population. We drafted the survey in consultation with our own survey  professionals. In addition, we solicited the review and comment of  knowledgeable officials from the National Academy of Sciences, the Water  Environment Federation, and the National Association of Clean Water  Agencies, as well as several wastewater security experts identified in our  January 2005 report on wastewater security. We conducted seven pretests  to check that (1) the questions were clear and unambiguous, (2)  terminology was used correctly, (3) the information was feasible to obtain,  and (4) the survey was comprehensive and unbiased. The pretest sites were  chosen to include facilities representing different geographic regions, and  utilities both with single and multiple facilities. One pretest was done in  person and six were done over the phone.
Our survey asked wastewater treatment facility representatives to provide  a variety of information, such as whether their facilities had conducted  security assessments; what measures, if any, they had taken or were  planning to take in several security areas; and their perspectives on what  role the federal government should assume in wastewater treatment  facility security. The survey was made available between October 1, 2005,  and January 15, 2006, and a unique user identification number and a  password were provided to each surveyed facility. Three e-mail reminders  were sent out to nonresponders, and then follow-up phone calls were made  to all nonresponding facilities. A total of 206 of 252 wastewater treatment  facilities responded to the survey, resulting in an 82 percent survey  response rate. Other wastewater facilities that did not respond to the  survey generally cited security concerns related to providing potentially  sensitive information or a general policy of not answering surveys.
Because this was not a sample survey, there are no sampling errors.  However, the practical difficulties of conducting any survey may introduce  errors, commonly referred to as non-sampling errors. For example,  difficulties in how a particular question is interpreted or in the sources of  information that are available to respondents can introduce unwanted  variability into the survey results. We took steps both at the data collection  and at the analysis phases to minimize these non-sampling errors. Since  this was a Web-based survey, respondents entered their answers directly  into the electronic questionnaire, which removes one source of error. When  the data were analyzed, a second, independent analyst checked all relevant  computer programs.
To determine what steps EPA and DHS have taken to help wastewater  facilities in their efforts to address vulnerabilities, we took several  approaches. First, through semi-structured interviews with agency officials  and industry association representatives, as well as document reviews, we  researched various programs that EPA and DHS have under way. Second,  we identified programs that require cross-agency collaboration between  EPA and DHS, and we examined in depth those that wastewater treatment  facility representatives identified as potentially useful. We also interviewed  state and local officials with oversight for wastewater treatment operations  and security. Third, one section of our survey gathered information about  facility representatives’ experiences with, perspectives on, and  expectations for, the federal role in wastewater treatment facility security.  Responses to open-ended questions were categorized and tallied to analyze  their content for subsequent research findings. Finally, to develop  conclusions about the level of coordination between the two agencies in  the implementation of these programs, we interviewed agency officials  about their perspectives on how well the agencies are working together.
section_title: Survey of Wastewater Treatment Facilities
paragraphs: Welcome to the Survey of Wastewater Treatment Facilities.
The U.S. Government Accountability Office (GAO), a congressional audit  and evaluation agency, is conducting this survey to identify actions  wastewater treatment facilities have taken to protect their operations and  infrastructures from terrorism or other threats.
Why you are receiving this information: The GAO is surveying wastewater treatment facilities that serve residential  populations of 100,000 or greater. An EPA database identified you as the  point of contact for your wastewater treatment utility/authority. As a result,  we are requesting that you or your designated representative complete the  survey.
Please complete this survey within two weeks of receipt. We understand that  there are great demands on your time. However, your participation in our  study is essential for us to provide relevant information to Congress about the  actions wastewater treatment facilities have taken to protect their operations  from terrorism or other security threats. We greatly appreciate your time and  effort in completing this survey.
Your responses will be gathered on a SECURED SERVER AND  AGGREGATED WITH THOSE OF OTHER FACILITIES. They will be  presented in a report to the Congress IN A SUMMARY FORM ONLY. GAO  WILL NOT RELEASE INDIVIDUALLY IDENTIFIABLE DATA FROM  THIS SURVEY, unless compelled by law or required to do so by the U.S.
Congress.   on skip instructions; some respondents were directed to answer certain survey  questions and not others based on their earlier responses. 1. About Your Utility  1.
What is the name of the wastewater treatment utility/authority that is responsible for  the facility or facilities for which you are completing a survey(s)? (Click in the box  and enter the name.)
2.
Does your utility/authority manage BOTH drinking water and wastewater treatment?
Check only one answer.    1. 2. 3.
Don’t know/No response  3.
How many wastewater treatment facilities within your utility/authority serve  populations of 100,000 or more?
Check only one answer.  1. 2. 3. 4. 5. 6.
6 or more (Please specify number below.)
7.
Don’t know/No response  4. (If you checked "6 or more" above) What is the number of wastewater treatment  facilities within your utility/authority that serve populations of 100,000 or more? (Click in the box and enter 1 or 2-digit whole number.)
N = 26 2. About Your Facility  5.
What is the size of the service area population served by your wastewater treatment  FACILITY under regular operating conditions?
Check only one answer.  1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12.
Don’t know/No response  *These facilities were identified in the results of EPA’s 2004 Clean  Watershed Needs Survey as having service area populations of  100,000 or over and were kept in our survey.
subsections: section_title: 3. Vulnerability/Security Assessments
paragraphs: 6.
Has a vulnerability assessment been completed for your wastewater treatment  facility?
Check only one answer.  1.
Yes (GO TO QUESTION 8.)
2.
Currently underway (GO TO QUESTION 8.)
3. 4.
Don’t know/No response  7.
Has a security or risk assessment been completed for your wastewater treatment  facility?
Check only one answer.  1. 2. 3.
No (GO TO QUESTION 17.)
4.
Don’t know/No response (GO TO QUESTION 17.)
8.
When was your vulnerability/security assessment completed or most recently  updated, or when is it scheduled to be completed or updated?
Responses ranged from April 2001 to July 2006.  Most indicated assessments  were completed, updated, or scheduled to be completed or updated in 2003.
9.
Were the following factors important in deciding to conduct this  vulnerability/security assessment for your facility?
Check one in each row.  a. Required by state government   b. Required by local government or  c. Required by utility governing  d. Required by facility insurance  drinking water facility, as required  g. Conducted assessment on facility's  10. What other factors, if any, were important in deciding to conduct this  vulnerability/security assessment at your facility? (Click in the box and enter your  response. Leave blank if all important factors are listed above.)
We did not summarize the narrative responses to this question for inclusion in  this appendix.
11.
Who conducted or is conducting the vulnerability/security assessment for your  wastewater treatment facility?
Check one in each row.  c.       City or county staff   (e.g. alarm company personnel)   e.       Other (Please specify in 12  below.) 12. (If you checked yes for "Other" in 11) Who else is involved in conducting the  vulnerability/security assessment at your facility?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
13.
What vulnerability/security assessment tool, if any, did your wastewater facility  use?
Check one in each row.
Tool (VSAT) b.      Risk Assessment Methodology  for Water (RAM-W, developed  by Sandia National Laboratories)
Management System (SEMS,  developed by the National Rural  Water Association)   d.      County or city developed its own  e.      Utility developed its own  g.       Other (Please specify below.) 14. (If "Other") What other vulnerability/security assessment tool did your wastewater  facility use?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 15. As a result of the vulnerability/security assessment, what were the 3 most significant  measures (activities, changes and improvements) that have been completed to improve  security at your wastewater treatment facility?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
16.
In which of the following time frames, if any, do you plan to update your  vulnerability/security assessment?
Check only one answer.  1.
No plans to update (GO TO QUESTION 27.)
2.
Continuous process (GO TO QUESTION 27.)
3.
In about 1 year (GO TO QUESTION 27.)
4.
In about 2 years (GO TO QUESTION 27.)
5.
In about 3 years (GO TO QUESTION 27.)
6.
In the next 4 years or more (GO TO QUESTION 27.)
7.
Plan to update, but no time frame set (GO TO QUESTION 27.)
8.
Don’t know/No response (GO TO QUESTION 27.)
End of questions for facilities that completed vulnerability assessments/security  assessments. GO TO QUESTION 27.
17.
Does your facility plan to conduct a vulnerability/security assessment?
Check only one answer.  1.
Yes (GO TO QUESTION 20.)
2. 3.
Don’t know/No response  18.
Were the following factors important in your wastewater treatment facility's  decision NOT to conduct a vulnerability/security assessment?
Check one in each row.  a. Steps we have taken are adequate  b. Facility and system are not  c. Other priorities and limited  d. Emergency response plan was  updated, and this seemed sufficient to  f. Not required to do so 19. What OTHER factors, if any, were important in deciding NOT to conduct a  vulnerability/security assessment?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
End of questions for facilities that have decided NOT to complete vulnerability  assessments/security assessments. Click on GO TO QUESTION 30.
20.
When is your facility's vulnerability/security assessment scheduled to be completed?
Responses ranged from November 2005 to December 2007.  Most facilities  indicated assessments were scheduled to be completed in 2006.
21.
Were the following factors important in deciding to conduct this  vulnerability/security assessment at your facility?
Check one in each row.  a.       Required by state government   b.      Required by local government or  c.       Required by utility governing  d.      Required by facility insurance  drinking water facility, as  required by the Bioterrorism Act 22. What OTHER factors, if any, were important in deciding to conduct this  vulnerability/security assessment at your facility?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
23.
Who will conduct the vulnerability/security assessment for your wastewater  treatment facility?
Check one in each row.  c.       City or county staff   (e.g. alarm company personnel)   e.       Other (Please specify below.) 24. (If "Other") Who else will be involved in conducting the vulnerability/security  assessment at your facility?
N = 0 25.
What vulnerability/security assessment tool, if any, did your wastewater facility  use?
Check one in each row.
Tool (VSAT) b. Risk Assessment Methodology  for Water (RAM-W, developed  Laboratories)
Management System (SEMS,  developed by the National Rural  Water Association)     d. County or city developed its own    e. Utility developed its own    g. Other(Please specify below.) 26. (If "Other") What other vulnerability/security assessment tool will your wastewater  facility use?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 4. Chemical Security Measures 27.
Does your wastewater treatment facility use gaseous chlorine to disinfect  wastewater?
Check only one answer.  1.
Yes (GO TO QUESTION 32.)
2. 3.
28.
Did your wastewater treatment facility EVER use gaseous chlorine to disinfect  wastewater?
Check only one answer.  1. 2.
No (GO TO QUESTION 31.)
3.
Don’t know/No response (GO TO QUESTION 31.)
29.
When did your wastewater treatment facility decide to discontinue its use of  gaseous chlorine?
Check only one answer.
Responses ranged from July 1980 to October 2005.  Many facilities made the  decision to discontinue the use of gaseous chlorine between 1998 and 2001.
30.
How have ANNUAL (as opposed to capital) costs at your wastewater treatment  facility been affected by converting to an alternative disinfection process?
Check only one answer.  1. 2.
Costs have stayed about the same  3. 4.
Don’t know/No response  31.
What disinfection method does your wastewater treatment facility use?
Check only one answer.  1.
Sodium hypochlorite (transported to site) (GO TO QUESTION  40.)
2.
Sodium hypochlorite (generated onsite) (GO TO QUESTION 40.)
3.
Calcium hypochlorite (GO TO QUESTION 40.)
4.
Ozone (GO TO QUESTION 40.)
5.
Ultraviolet light (GO TO QUESTION 40.)
6.
Other (GO TO QUESTION 40.)
7.
Don’t know/No response (GO TO QUESTION 40.)
End of questions for facilities that do not use gaseous chlorine. GO TO  QUESTION 40.
32.
How is the chlorine transported and stored?
Check only one answer.  1.
In 50 - 100 pound cylinders  2. 3. 4. 5. 6.
Other (Please specify number below.)
7.
Don’t know/No response  33. (If "Other") By what other method is the chlorine transported and stored?
We did not summarize the narrative responses to this question for inclusion  in this appendix.
34.
Which one of the following changes, if any, has your wastewater treatment facility  made in how it stores and uses gaseous chlorine and when did it make them?
Check one in each row.    a. Converted chlorine to  35. (If you indicated "Yes" for "Made other physical security improvements" above)
What other physical security improvements to the gaseous chlorine storage area did  your facility make?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
36.
Does your wastewater treatment facility PLAN to stop using gaseous chlorine?
Check only one answer.  1. 2.
No (GO TO QUESTION 40.)
3.
Don’t know/No response (GO TO QUESTION 40.)
37.
When does your wastewater treatment facility PLAN to stop using gaseous chlorine?
Responses ranged from November 2005 to January 2015.  Most indicated that  their facilities planned to discontinue their use of gaseous chlorine in 2006 and  2007.
38.
How do you expect ANNUAL (as opposed to capital) costs at your wastewater  treatment facility to be affected by converting to an alternative disinfection  process?
Check only one answer.  1. 2.
Costs will stay about the same  3. 4.
Don’t know/No response  39.
What disinfection method does your wastewater treatment facility plan to use?
Check only one answer.  1.
Sodium hypochlorite (transported to site)
2.
Sodium hypochlorite (generated onsite)
3. 4. 5. 6. 7.
Don’t know/No response  40. What OTHER chemicals, if any, are currently at your wastewater treatment facility,  or will be in the future, that have the potential to cause significant harm and damage  if used for terrorist activity?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 41. For each chemical identified in 40, if any, please indicate its use at your  wastewater treatment facility.
We did not summarize the narrative responses to this question for inclusion in  this appendix. 5. Physical Security Measures 42.
For each of the following physical security measures that your wastewater  treatment facility may have, was it completed before September 11, 2001,  completed after September 11, 2001, is it planned but not yet completed, or is it  NOT planned?
Check one in each row.  power sources   operation (e.g.  smart pipes) (LEL) meters or  43.
What OTHER physical security improvements, that you consider significant, have  been installed or are planned for your wastewater treatment facility and associated  infrastructure? Be sure to include any specific changes that your wastewater  facility has made to improve physical security in your COLLECTION SYSTEM, if  they are not listed above.
We did not summarize the narrative responses to this question for inclusion in  this appendix. 6. Personnel Security Measures 44.
For each of the following personnel security measures that your wastewater  treatment facility may have, if any, was it completed before September 11, 2001,  completed after September 11, 2001, is it planned but not yet completed, or is it  NOT planned?
Check one in each row.  visitors, etc.) are  identification   visitors, etc.) may  45. What OTHER personnel security improvements, that you consider significant, have  been installed or are planned for your wastewater treatment facility and associated  infrastructure?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 7. Information Technology (IT) Security Measures  46.
For each of the following Information Technology (IT) security measures that your  wastewater treatment facility may have, was it completed before September 11,  2001, completed after September 11, 2001, is it planned but not yet completed, or is  it NOT planned?
Check one in each row.  b. Network protection,  such as a firewall, an  47. What OTHER IT security improvements, that you consider significant, have been  installed or are planned for your wastewater treatment facility and associated  infrastructure?
We did not summarize the narrative responses to this question for inclusion in  this appendix.
48.
Does your facility have a designated individual to oversee internal security initiatives  at your wastewater treatment facility?
Check only one answer.  1. 2.
No (GO TO QUESTION 50.)
3.
Don’t know/No response (GO TO QUESTION 50.)
49.
Does this person oversee efforts to address security that require coordination with  other organizations and governments?
Check only one answer.  1. 2. 3.
Don’t know/No response  50.
Does your wastewater treatment facility have periodic (annually, semi annually or  more often) contact about security planning with the following?
Check one in each row.  b. Police and fire departments Committee (LEPC)
DK/NR = 23 e. Industry organizations, e.g. Water  Environment Federation (WEF), National  Association of Clean Water Agencies  (NACWA) g. Hazardous material storage facilities  h. State organizations and agencies with  oversight for wastewater operations and  security (Please specify below.) i. Federal organizations and agencies with  oversight for wastewater operations and  security (Please specify below.) 51. (If you indicated "yes" for "State organizations and agencies" above) Which state  organizations and agencies with oversight for wastewater operations and security does  your facility have periodic contact about security planning?
We did not summarize the narrative responses to this question for inclusion in  this appendix. (If you indicated "yes" for "Federal organizations and agencies" above) Which federal  52. organizations and agencies with oversight for wastewater operations and security does  your facility have periodic contact about security planning   We did not summarize the narrative responses to this question for inclusion in  this appendix.
53.
Which of the following security coordination activities has your wastewater  treatment facility implemented or participated in?
DK/NR = 36 k. Developed an emergency notification  l. Participate in an emergency  facilities in service area, with  m. Participated in a security tabletop  o. Developed training materials   p. Created or are part of a mutual aid  q. Met with FBI Field Office to  discuss protocols and other security  54. What role, if any, do you think the federal government should play in  COORDINATING security initiatives at wastewater treatment facilities and their  associated infrastructures?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 9. Conclusions and Additional Comments  55. What are the 3 most significant security measures that have been put in place at your  wastewater treatment facility and associated infrastructure?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 56. Of those security measures that you have PLANNED, BUT HAVE NOT YET PUT  IN PLACE, which 3 measures do you anticipate will be the most useful to improving  security at your wastewater treatment facility and associated infrastructure?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 57. What 3 security measures, if any, would you put in place if you were free to  implement any measures you viewed as potentially useful to improving security at  your facility and associated infrastructure   We did not summarize the narrative responses to this question for inclusion in  this appendix.
58.
For the security measures you listed in 57 above, were any of the following factors  important in your facility not yet implementing these measures?   (Check one in each row.  Leave blank if you did not list any security measures in 57.)    a. Not enough time     c. Other security priorities more critical    d. Technology needed not readily    e. Necessary agreements not in place     f. Other (Please specify below.) 59. (If you checked "yes" for Other) What other factors were important in your facility not  yet implementing these measures?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 60. What do you consider to be the major challenges to reducing vulnerabilities to the  wastewater treatment collection systems' network of sanitary, storm, and combined  sewer lines?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 61. What, if any, are the most innovative or effective practices that address these  challenges to reducing vulnerabilities to the wastewater treatment collection system?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 62. What are the most important things, if any, the federal government could do to  improve the security at your facility and other wastewater treatment facilities  nationwide?
We did not summarize the narrative responses to this question for inclusion in  this appendix. 63. If you would like to provide additional comments concerning security at your  wastewater treatment facility, specifically, and/or security at wastewater treatment  facilities in general, please provide them in the space below.
We did not summarize the narrative responses to this question for inclusion in  this appendix.
64.
Have you finished this questionnaire?
Check only one answer.  1. 2.
section_title: Comments from the Environmental Protection Agency
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Nancy Bowser, Jenny Chanley,  Steve Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry Sandau,  Rebecca Spithill, and Monica Wolford made key contributions to this  report.