Nationwide, more than 16,000 POTWs serve more than 200 million people, or about 70 percent of the nation’s total population. The remaining population is served by privately-owned utilities or by on-site systems, such as septic tanks. A relative handful of large wastewater systems serve the great majority of people, as about 500 large public wastewater systems provide service to 62 percent of the population connected to a sewer system. In addition to serving residential populations, approximately 27,000 commercial and industrial facilities rely on wastewater treatment facilities to treat their wastewater. POTWs discharge treated effluent into receiving waters and are regulated under the Clean Water Act. Wastewater systems vary by size and other factors, but all include a collection system and a treatment facility. The collection system is the underground network of sewers including both sanitary and storm water collection lines. Collection systems tend to be dispersed geographically and have multiple access points, including drains, catch basins, and manholes. Lines may range from 4 inches to greater than 20 feet in diameter, and access is usually conducted through manholes that are typically 300 feet apart. Many collection systems rely on gravity to maintain the flow of sewage through the pipes toward the treatment plant. However, collection systems may also depend on pumping stations to propel the flow when gravity alone is insufficient. Nationwide, there are approximately 800,000 miles of sewer lines and 100,000 major pumping stations. The wastewater treatment facility receives wastewater from the collection system and begins the treatment process which typically involves several stages before treated effluent is released into receiving waters. Primary treatment includes removal of larger objects through a screening device or a grit removal system, and the removal of solids through sedimentation. Secondary stage treatment includes a biological process that consumes pollutants, as well as final sedimentation. Some facilities also use tertiary treatment to remove nutrients and other matter even further. Following these treatments, the wastewater is disinfected to destroy harmful bacteria and viruses. Disinfection is often accomplished with chlorine, which is stored in gaseous or liquid form on-site at the wastewater treatment plant. The collection system and treatment process is typically monitored and controlled by a Supervisory Control and Data Acquisition (SCADA) system, which allows utilities to control such things as the amount of chlorine needed for disinfection. Wastewater treatment facilities may possess certain characteristics that terrorists could exploit either to impair the wastewater treatment process or to damage surrounding communities and infrastructure. For example, the numerous storm drains, manholes, and sewers that make up a community’s wastewater collection system’s network of sewers could be used to covertly place explosives beneath a major population center or to introduce substances that may damage a wastewater treatment plant’s process. Damage to (or destruction of) tanks that hold large amounts of gaseous chlorine used to disinfect wastewater could release the potentially lethal gas into the atmosphere. Such events could result in loss of life, destruction of property, and harm to the environment. Documented accidents and intentional acts highlight the destruction that could arise from an attack on a wastewater system. In June 1977 in Akron, Ohio, an intentional release of naptha, a cleaning solvent, and alcohol into a sewer by vandals at a rubber manufacturing plant caused explosions 3.5 miles away from the plant, damaging about 5,400 feet of sewer line and resulting in more than $10 million in damage. In 1981 in Louisville, Kentucky, thousands of gallons of a highly flammable solvent, hexane, spilled into the sewer lines from a local processing plant. Fumes from the solvent ignited, and the resulting explosions collapsed a 12-foot diameter pipe and damaged more than 2 miles of streets. No one was seriously injured, but sewer line repairs took 20 months, followed by several more months to repair the streets. In 1992 in Guadalajara, Mexico, a gasoline leak into a sewer caused explosions that killed 215 people, injured 1,500 others, damaged 1,600 buildings, and destroyed 1.25 miles of sewer. In 2002 in Hagerstown, Maryland, chemicals from an unknown source entered the wastewater treatment plant and destroyed the facility’s biological treatment process. The event resulted in the discharge of millions of gallons of partially treated sewage into a major tributary of the Potomac River, less than 100 miles from a water supply intake for the Washington, D.C., metropolitan area. In January 2005, we reported the views of 50 nationally recognized experts on key issues concerning wastewater security. Our panel of experts identified five key wastewater assets as most vulnerable to terrorist attacks: the collection systems’ network of sewers (42 of 50 experts), treatment chemicals (32 of 50 experts), key components of the treatment plant (29 of 50 experts), control systems (18 of 50 experts), and pumping stations (16 of 50 experts). When asked to identify and set priorities for the security-enhancing activities most deserving of federal support, the expert panel identified 11 key actions, but ranked three as deserving highest priority—replacing gaseous chemicals used in the wastewater treatment process; improving local, state, and regional efforts to coordinate responses in advance of a potential terrorist threat; and completing vulnerability assessments for individual wastewater systems. Federal law does not address wastewater security as comprehensively as it does drinking water security. In particular, wastewater facilities are not required by law to complete vulnerability assessments. The Clean Air Act does require wastewater facilities using certain amounts of hazardous substances, such as chlorine gas, to submit to EPA a risk management plan that lays out accident prevention and emergency response activities. Also, under EPA guidance, the Clean Water State Revolving Fund can be used in many instances for certain wastewater system security enhancements. While federal law governing wastewater security is limited, in December 2003, the president issued HSPD-7. The directive designated EPA as the lead agency to oversee the security of the water sector, including both drinking water and wastewater critical infrastructures. In 2002, Congress passed the Bioterrorism Act, which amended various laws, including the Safe Drinking Water Act. The Bioterrorism Act required drinking water systems serving more than 3,300 people to complete vulnerability assessments of their facilities by June 2004 and to prepare or update an existing emergency response plan. The Bioterrorism Act required the assessments to include, but not be limited to, a review of six components: (1) pipes and constructed conveyances; (2) physical barriers; (3) water collection, pretreatment, treatment, storage, and distribution facilities; (4) electronic, computer, or other automated systems which are utilized by the public water system; (5) the use, storage, or handling of various chemicals; and (6) the operation and maintenance of such systems. Under the act, the emergency response plans were to include plans, procedures, and identification of equipment to lessen the impact on public health and the drinking water supply of terrorist attacks or other intentional acts against drinking water systems. The act authorized $210 million for fiscal year 2002, mostly to assist drinking water systems in completing vulnerability assessments, preparing or updating response plans, and making needed security improvements. Drinking water systems are not required to implement any risk-reduction actions based on their vulnerability assessments or report to EPA on measures that have been implemented. In 2003, the Congress considered alternative bills that would have encouraged or required wastewater treatment plants to assess the vulnerability of wastewater facilities, make physical security improvements, and conduct research. However, the legislation did not become law and, consequently, no such requirement or specific funding exists for wastewater facilities. While federal law does not require wastewater systems to take security measures to protect specifically against a terrorist attack, it does require certain wastewater facilities to take security precautions that could mitigate the consequences of such an attack. For example, the 1990 Clean Air Act amendments mandated EPA oversight of risk management planning at facilities that handle more than specified-threshold quantities of hazardous substances, including the gaseous chlorine often used as a disinfectant at wastewater facilities. Specifically, EPA regulations implementing the Clean Air Act require these facilities to prepare Risk Management Plans (RMPs) that summarize the potential threat of sudden, accidental, large releases of certain chemicals; including the results occurring off-site in a worst-case chemical accident, and the facility’s plan to prevent releases and mitigate any damage. RMPs are to be revised and resubmitted to EPA at least every 5 years, and EPA is required to review them and require revisions, if necessary. For a March 2003 report, EPA told us it believed the Clean Air Act could be interpreted to provide authority to address site security from terrorist attacks at RMP facilities, because the act imposes certain requirements on these facilities regarding “accidental releases.” The act defines an accidental release as an unanticipated emission of a regulated substance or other extremely hazardous substance into the air, so any chemical release caused by a terrorist attack could be considered “unanticipated” and covered under the Clean Air Act. Such an interpretation would provide EPA with authority under the act’s RMP provisions and general duty clause to require security measures or vulnerability assessments with regard to terrorism. However, EPA has not attempted to use these Clean Air Act provisions because it is concerned that such an interpretation would pose significant litigation risk and has concluded that chemical facility security would be more effectively addressed by passage of specific legislation. Wastewater facilities that store certain amounts of hazardous chemicals may also be subject to the Resource Conservation and Recovery Act. Under regulations implementing the act, facilities that house hazardous waste generally must take certain security actions, such as posting warning signs and using a 24-hour surveillance system, or surrounding the active portion of the facility with a barrier and controlled entry gates. However, according to EPA, these security measures are aimed at keeping out trespassers or wanderers, not intentional intruders. Other federal statutes impose safety requirements on certain wastewater facilities that may incidentally reduce the likelihood and mitigate the consequences of terrorist attacks. For example, the Occupational Safety and Health Act imposes a number of safety requirements, including a general duty to furnish a workplace free from recognized hazards that may cause death or serious physical harm to employees. The Emergency Planning and Community Right-to-Know Act requires owners of facilities that maintain specified quantities of certain extremely hazardous chemicals to submit information annually on their chemical inventory to state and local emergency response officials. The act also requires that each state establish a State Emergency Response Commission to oversee local emergency planning and create local emergency planning committees. These committees must develop and periodically review their communities’ emergency response plans, including the identification of chemical facilities, and outline procedures for response personnel to follow in the event of a chemical incident. Aside from statutes that address some areas of wastewater security, EPA has asserted that federal funding is available for wastewater security- related measures through the Clean Water State Revolving Fund (CWSRF) program. The CWSRF is an EPA-administered program that provides grants to the states to fund a variety of water-quality projects, including those at municipal wastewater treatment facilities. States may use the funds to provide loans to local governments to assist wastewater utilities in making infrastructure improvements needed to protect public health and ensure compliance with the Clean Water Act. According to EPA, states may use the CWSRF to assist utilities in completing a variety of security-related actions, such as vulnerability assessments, contingency plans, and emergency response plans. In addition, EPA has identified other infrastructure improvements that may be eligible for funding, such as the conversion from gaseous chemicals to alternative treatment processes, installation of fencing or security cameras, securing large sanitary sewers, and installing tamper-proof manholes. In our January 2005 report summarizing experts’ views on wastewater security, a number of experts expressed caution about relying heavily on the CWSRF program to support security enhancements, largely because of the time-lag in obtaining funds for security-related measures, and because such demands on the CWSRF would divert needed funding away from the kind of critical infrastructure investments that are the CWSRF program’s primary purpose. Another source of federal funding potentially available for wastewater security-related measures is the State Homeland Security Grant Program administered by DHS. This program’s primary objectives are to enhance the capacity of state and local emergency responders to prevent, protect against, respond to, and recover from terrorist incidents involving chemical, biological, radiological, nuclear, and explosive devices; agriculture; and cyber attacks. Under the program, grants are provided to states for a variety of purposes, including homeland security-related training and protection of critical infrastructure, although authority to make physical security improvements is limited. States are required to allocate at least 80 percent of these grant funds to “local units of governments,” which, as defined in the conference report accompanying the Department of Homeland Security Appropriations Act for fiscal year 2006, include water districts, special districts, and other political subdivisions of a state. In December 2003, the president issued HSPD-7, which established a national policy for federal departments and agencies to identify and set priorities for the nation’s critical infrastructures and to protect them from terrorist attacks. HSPD-7 established EPA as the lead federal agency to oversee the security of the water sector, both drinking water and wastewater. Presidential Decision Directive 63 had done so earlier in May 1998, with a focus primarily on water supply. Under HSPD-7, EPA is responsible for (1) identifying, prioritizing, and coordinating infrastructure protection activities for the nation's drinking water and water treatment systems; (2) working with federal departments and agencies, state and local governments, and the private sector to facilitate vulnerability assessments; (3) encouraging the development of risk management strategies to protect against and mitigate the effects of potential attacks on critical resources; and (4) developing mechanisms for information sharing and analysis. HSPD-7 also called for DHS to integrate all critical infrastructure security efforts among federal agencies and to complete a comprehensive national plan for critical infrastructure and key resource protection—now called the National Infrastructure Protection Plan. Under HSPD-7, seven federal agencies, including EPA, were designated sector-specific agencies. DHS issued guidance tasking each sector-specific agency with developing sector-specific plans for input into the comprehensive plan. Each sector- specific plan is supposed to outline strategies for (1) collaborating with all relevant federal departments and agencies, state and local governments, and the private sector; (2) identifying assets; (3) conducting or facilitating vulnerability assessments; and (4) encouraging risk management strategies to protect against and mitigate the effects of an attack. The water sector- specific plan will be an appendix to the National Infrastructure Protection Plan. On January 20, 2006, DHS issued its revised National Infrastructure Protection Plan based on comments it received on an earlier version of the plan. DHS accepted additional comments on the revised version until February 6, 2006, and expects to issue a final version of the plan later in 2006. Sector-specific agencies are required to submit their sector-specific plans to DHS within 6 months after the National Infrastructure Protection Plan is made final. Our survey of large wastewater facilities indicates that many have taken steps to improve security. Most facilities that responded to our survey have completed, have under way, or plan to complete some type of security assessment. Roughly two-thirds of facilities also reported they used a disinfectant other than gaseous chlorine or plan to switch from the gas. Of those facilities that continue to use gaseous chlorine, many have taken steps to increase security by limiting and monitoring access to gaseous chlorine storage areas or through other actions. Survey responses show that since 9/11, wastewater treatment facilities have also focused security efforts on controlling and limiting access to their treatment plants. Importantly, facilities have taken fewer security actions intended to protect treatment collection systems. Many facilities reported that taking other measures to protect their treatment plants, including converting from gaseous chlorine to a safer disinfection process, took priority over protecting infrastructure in their collection systems. Survey results show a lack of funding and federal security guidelines remain a concern for many wastewater facility managers. Seventy-four percent of facilities that responded to our survey reported they completed, were in the process of completing, or planned to complete some type of security assessment—either a vulnerability assessment, similar to that which was required of drinking water facilities under the Bioterrorism Act, or another type of security assessment. As shown in figure 1, 106 facilities—or 51 percent of those responding to our survey— indicated that they had completed a vulnerability assessment or were currently conducting a vulnerability assessment. Of the 106 facilities that indicated they had either completed a vulnerability assessment or had one under way, 80 indicated their vulnerability assessments were complete, while 26 indicated the assessment was still in process. As shown in the figure, 22 facilities—or 11 percent of all responses—indicated they had conducted another type of security assessment or were in the process of conducting another type of security assessment, while 24 facilities—or 12 percent of all responses—indicated they plan to conduct either a vulnerability or another type of security assessment. Twenty-three facilities—or 11 percent of total responses—indicated they had no plans to conduct any type of security assessment. When asked to identify reasons for not conducting a vulnerability or security assessment, 17 of these 23 facilities cited a lack of requirement to do so, while 15 noted that they considered security actions taken at their facilities adequate for their security needs. Thirteen of these facilities indicated that their emergency response plan was updated and this seemed sufficient to address potential vulnerabilities. Facilities cited several reasons for completing a vulnerability or some other type of security assessment, but most—roughly 77 percent—reported doing so on their own initiative. Thirty-seven percent of facilities reported that they did so in conjunction with the required assessment for their drinking water facility. To a lesser extent, facilities cited state, local, and utility governing-body requirements as reasons they conducted assessments. See appendix II for survey results related to vulnerability and security assessments at large wastewater facilities. As shown in figure 2, over half of large wastewater facilities in our survey reported they use an alternative to gaseous chlorine in their disinfection process. These results are consistent with studies which conclude that over the past decade, wastewater treatment facilities have moved away from gaseous chlorine as a disinfectant. Of the facilities not using gaseous chlorine, 89 reported using sodium hypochlorite as their primary disinfectant. Sodium hypochlorite is essentially a strong version of household bleach and is considered safer than gaseous chlorine. Seventeen facilities report they are using ultraviolet light as their primary disinfectant. The remaining facilities did not identify the type of disinfectant method used at their facility. In our January 2005 report, we noted that the change, for an individual plant, to sodium hypochlorite may require approximately $12.5 million for new equipment and increase annual chemical costs from $600,000 for gaseous chlorine to over $2 million for sodium hypochlorite. However, one expert noted some costs may be offset through savings in regulatory paperwork and certain emergency planning efforts. In our survey, we asked facilities that switched from gaseous chlorine if their annual costs increased, stayed the same, or decreased after switching to an alternate disinfection method. Fifty-eight facilities reported that costs increased, 11 noted that costs have stayed about the same, and one facility reported that costs decreased. Of the 85 facilities that reported use of gaseous chlorine, 20—or roughly 10 percent of all 206 reporting facilities—indicated that they have plans to switch from gaseous chlorine to another disinfectant. In addition, as shown in figure 3, many reported taking additional steps after 9/11 to mitigate the potential risks associated with continued reliance on chlorine. Forty-one facilities using gaseous chlorine reported that they instituted controls for selective access to chlorine storage areas after 9/11, while 30 facilities reported making other security improvements to the storage area, such as installing electronic surveillance of the chlorine storage area or improving gates and fencing. Fewer facilities reported that they decided to store gaseous chlorine in smaller-quantity containers, likely because most reported they already stored the gas in one-ton containers, which are among the smallest containers used at large wastewater facilities for the gas. See appendix II for survey results on gaseous chlorine use at large wastewater facilities. As shown in figure 4, many facilities reported taking basic security measures prior to 9/11, such as installing vehicle gates and security fencing. Survey respondents also indicated that many information technology security measures, such as virus protection programs, backup power supplies, and firewall and intrusion detection systems, were implemented before 9/11. The figure shows that security enhancements made or planned by large wastewater facilities after 9/11 generally focus on controlling access to the treatment plant. Such security enhancements include adding visual surveillance monitoring, increasing security lighting, implementing employee and visitor identification policies, adding guard stations, and upgrading SCADA capability and security. Importantly, few facilities reported taking measures to address collection system vulnerabilities other than having available redundant pumping devices or collection bypass systems. For example, few have installed or plan to install manhole intrusion sensors, manhole locks, or sensors to detect toxics or other biochemical threats to their collection systems. This lack of attention to collection system vulnerabilities is important because 42 of the 50 experts polled in our January 2005 report on wastewater security identified the collection systems’ network of sanitary, storm, and combined sewers as the most vulnerable asset of a wastewater utility. Several noted that sewers make underground travel from a point of entry to a potential target almost undetectable, possibly allowing sewers to be used as an underground transport system for explosive or toxic agents. Many facilities reported that other measures to protect their treatment plants, including converting from gaseous chlorine to a safer disinfection process, took priority over protecting infrastructure in their collection systems. Other managers cited the difficulty and expense in securing collection systems that, by nature, cover a large area and have many, often remote, access points. One manager expressed confusion about whether to concentrate monitoring resources on large interceptor sewer lines to prevent entry or on toxic materials that could be introduced at nearly every access point to his system. Others noted the lack of facility control over collection systems. One facility manager told us his facility treats wastewater that is collected from 17 separate collection systems. Finally, a number of respondents questioned whether the technologies purportedly available to detect potential threats introduced to collection systems are sufficiently capable of achieving this objective. Nonetheless, a few facility managers with whom we spoke told us they have made efforts to address collection system security, particularly in the protection of their pump stations. One facility manager told us his facility has a project under way to install security locks and card-access controls at all 93 of its pumping stations. According to the manager, the concentration of and need to protect capital equipment, and the potential impact of damage or destruction of that infrastructure prompted the facility to direct its capital improvement efforts to securing pumping stations. While many facilities in our survey indicated they made some security improvements after 9/11, facility managers cited limited resources and other priorities as reasons for not implementing further security measures. Facility managers and other industry experts with whom we spoke noted that security upgrades must compete with other infrastructure needs for available resources. For instance, many wastewater facilities’ collection systems are outdated, and they are already facing large costs to expand and repair their aging systems and reduce incidences of combined sewer overflows. Major U.S. cities, such as Washington, D.C., and Cincinnati, Ohio, are facing costs between $1 and $2 billion to implement necessary capital improvements. See appendix II for survey results on physical, personnel, and information technology security measures taken at large wastewater facilities. In our survey, we asked wastewater facility managers what the federal government could do to improve security at wastewater facilities. Facility manager responses are categorized in table 1. Facility managers predominantly recommended additional funding to further wastewater security improvements. Many facility managers recommended targeting funding to specific measures, such as performing vulnerability assessments, purchasing specific security equipment such as surveillance cameras, or covering costs associated with switching from gaseous chlorine to a safer disinfectant. To a much lesser extent, wastewater facility managers commented that the federal government could be of greater assistance in providing security guidance, standards, and best practices. For example, one facility manager we interviewed expressed a need for federal guidance and best practices on collection system security. For its part, in 2002, EPA provided funding to the American Society of Civil Engineers (ASCE) to develop a set of security guidance documents that cover the design of online contaminant monitoring systems, and physical security enhancements of drinking water, wastewater, and storm water infrastructure systems. ASCE sub-contracted with American Water Works Association and the Water Environment Federation (WEF) for assistance on this project. In 2004 these documents were released as interim voluntary security design standards for the water sector and finalized standards are to be established in late 2006 or early 2007. These security-focused documents are intended to serve as a foundation to help water utilities address potential vulnerabilities through sound design, construction, and operation and maintenance practices. According to a WEF representative, one set of standards is to be directed at physical security measures for wastewater collection systems. The security standards are to be published in late 2006 and are to include both prescriptive and performance-based criteria that focus on physical security upgrades that reduce risk to water, wastewater, and storm water infrastructure arising from malevolent events. EPA and DHS have a number of initiatives under way related to wastewater facility security. For example, EPA has funded programs to develop vulnerability assessment tools and provide training to wastewater facilities on the use of these tools, while DHS has conducted site assessment visits at wastewater facilities. While these initiatives are helping to address security concerns in the wastewater sector, EPA and DHS efforts could nonetheless be more effective with greater coordination over how best to convey security-related and threat information to the wastewater treatment community. Since 2002, EPA has provided more than $10 million to help address the security needs of the wastewater sector. EPA funded the development and dissemination of several risk assessment methodologies to assist water sector utilities in identifying how to better protect their critical infrastructures. In addition, EPA funded training for wastewater utilities on how to conduct risk assessments and update or complete emergency response plans. EPA provided funding to the Association of Metropolitan Sewerage Agencies to develop a software tool, called the Vulnerability Self Assessment Tool (VSAT), for drinking water utilities. In addition, through an interagency agreement with EPA, the Department of Energy’s Sandia National Laboratories provided training to selected firms in a vulnerability assessment methodology developed by the labs, called the Risk Assessment Methodology for Water Utilities (RAM-W). For vulnerability assessments at smaller water systems, EPA supported the dissemination of the Security and Emergency Management System (SEMS) software tool. Sixty-nine wastewater facilities responding to our survey indicated they used, were currently using, or planned to use the VSAT software to complete a vulnerability or security assessment; 27 facilities indicated they either used, were currently using, or planned to use the RAM-W assessment tool. Another four facilities indicated they either used, were currently using, or planned to use the SEMS software. EPA has also reorganized its own internal structure and sought input from experts outside of the agency to better assist the wastewater industry’s security efforts. In particular, in 2003, EPA created a Water Security Division to work with the states, tribes, drinking water and wastewater utilities, and other partners to enhance the security of water and wastewater utilities and the ability to respond effectively to security threats and breaches. In addition, in 2004, the National Drinking Water Advisory Council (NDWAC), at EPA’s request, established a Water Security Working Group made up of 16 members from wastewater utilities, drinking water utilities, and environmental and rate-setting organizations to advise on the development of best security practices and policies for water utilities. The group advises the NDWAC on ways to address several specific security needs of the sector. In June 2005, the working group provided NDWAC with a report that identified features of an active and effective security program and ways to measure the adoption of these practices. As noted, EPA provided funding to ASCE to develop a set of security guidance documents that cover the design of online contaminant monitoring systems, and physical security enhancements of drinking water, wastewater, and storm water infrastructure systems. This effort, called the Water Infrastructure Security Enhancement project, is to address physical infrastructure security needs in the water sector by issuing guidance documents, training materials, and voluntary standards relating to water infrastructure security. The project group is currently developing physical security standards that focus on physical security upgrades to reduce risk to water, wastewater, and storm water arising from malevolent acts. For its part, DHS has two broad initiatives that have facilitated efforts to improve wastewater security. First, the Buffer Zone Protection program is a DHS grant program designed to reduce specific vulnerabilities at a critical infrastructure or key resource site by assisting local law enforcement to develop a plan for preventative and protective measures that make it more difficult for terrorists to plan or launch attacks from the immediate vicinity of the site. They also identify equipment that could be purchased to mitigate the vulnerabilities. Upon plan approval, DHS grants funds for procuring materials and equipment necessary for implementation of the site’s buffer zone protection plan. According to DHS, as of October 31, 2005, security at 14 wastewater facilities has been reviewed under the Buffer Zone Protection program. Under its second broad initiative, the Site Assistance Visits program, DHS visits critical infrastructure sites nationwide to address key areas of concern at facilities requiring security enhancements. DHS subject matter experts in the areas of physical security measures, system interdependencies, and terrorist attack prevention conduct these visits— generally lasting 1 to 3 days—in which, among other things, the vulnerabilities of the site or facility are identified and mitigation options are discussed. According to DHS, as of October 31, 2005, a total of 350 site assessment visits have been conducted. Of this total, seven were conducted with wastewater facilities. In addition to these programs, DHS funded a NACWA project to develop a decision tree and report template to help water systems assess and examine chlorine gas alternatives for water and wastewater disinfection. The decision tree guides water systems in evaluating the potential costs and benefits of conversion and determining whether an alternative disinfection method will still enable them to meet their permit requirements. The report template is to ensure that the results of the decision tree analysis are reported in a consistent format, improving a water system’s ability to pursue and secure any available state or federal funding for conversion. According to a NACWA representative, they are in the process of finishing the design of the decision tool and, once the final product is reviewed and approved by DHS, printing of the CD tool will begin. NACWA expects to make the tool available to water and wastewater utilities free of charge no later than the end of March 2006. While EPA and DHS have these wastewater security-related initiatives under way, the Congress has expressed concerns that EPA’s homeland security responsibilities are not well articulated in relation to DHS’ responsibilities. In the conference report for the fiscal year 2005 Consolidated Appropriations Act, conferees directed EPA to enter into a memorandum of understanding (MOU) with DHS that defines the relationship and responsibilities of the two entities regarding homeland security and protection. EPA did not enter into the MOU, but instead, on November 1, 2005, issued a report to the Congress entitled “Homeland Security Roles and Responsibilities and Interactions Between EPA and the Department of Homeland Security.” The report identified the homeland security-specific authorities, core mission authorities, presidential directives, and existing MOUs EPA uses to implement its homeland security roles and responsibilities. In the report, EPA stated that it believes its homeland security roles and responsibilities are sufficiently delineated not only through statutes, presidential directives, and existing MOUs, but also through planning documents and deliverables associated with a wide variety of collaborative homeland security-related projects that EPA and DHS are carrying out. In December 2002, the Association of Metropolitan Water Agencies (AMWA) received a grant from EPA to establish a communication system to share security information with water sector utilities, known as the Water Information Sharing and Analysis Center (WaterISAC). The WaterISAC is one of thirteen critical infrastructure and key resource sector- specific information sharing and analysis centers. The WaterISAC was designed to meet the information sharing needs of both water and wastewater utilities by providing real-time alerts of possible terrorist activity, allowing for the secure reporting of incidents and the sharing of information among users, and allowing access to a library of security- related information and contaminant databases. Beginning in fiscal year 2003, EPA has annually provided AMWA with a $2 million grant to support the WaterISAC. This grant is augmented by subscription fees paid by drinking water and wastewater systems. In November 2004, the WaterISAC launched a free security advisory system known as the Water Security Channel that distributes federal advisories on security threats via e-mail to the water sector. The Water Security Channel also includes a searchable archive of federal alerts, advisories, and bulletins. However, it does not provide access to the same level of service as the subscription- based WaterISAC. WaterISAC subscribers receive additional services, including a secure communication system, access to vulnerability assessment tools and resources, access to an online library related to water security issues, and access to databases about chemical, biological, and radiological agents. DHS has also sought to enhance communication between critical infrastructure sectors and the government. Under the Homeland Security Act of 2002, DHS is responsible for reducing the vulnerability of the national infrastructure and for coordinating and communicating with all key stakeholders on homeland security-related matters. According to DHS, to fulfill this mandate, it requires a communication system that provides equal and appropriate access to security information to all owners and operators of critical infrastructure and key resources. In 2004, it piloted a new secure network, the Homeland Security Information Network (HSIN), to help achieve this mandate. HSIN is DHS’ primary conduit through which it shares information on domestic terrorist threats, suspicious activity reports, and incident management. It is composed of multiple communities of interest, including the HSIN Critical Sector (HSIN-CS) program, which is intended to enhance the protection, preparedness, and crisis communication and coordination capabilities of the nation’s 17 critical infrastructure and key resource sectors identified in HSPD-7. The HSIN platform for critical sectors is being developed and offered to each sector to provide a suite of information and communication tools to share critical information both within the sector, with DHS, and eventually across sectors. Because the water sector is one of the nation’s 17 critical infrastructure and key resources, a HSIN-CS portal for the sector, called HSIN Water Sector (HSIN-WS), is currently being developed by DHS. A Water Sector Coordinating Council was also established by the water sector with representative members of the water sector community and charged with identifying information and other needs of the sector, including the appropriate use of and the relationship among Water ISAC, the Water Security Channel, and HSIN. While these efforts are helping to improve communication, staff at EPA and DHS, as well as other industry experts with whom we spoke, have expressed concern that the evolution of the information sharing and dissemination function for the water sector has resulted in several inefficiencies. WaterISAC access is limited to drinking water and wastewater subscribers, plus a restricted number of subscribers from EPA and the state drinking water programs. For example, the agreement limits designated users to five individuals at EPA headquarters and one person in each EPA region, for a total of fifteen EPA users. States are limited to only two users. EPA staff note that access for others in the sector, such as the technical service community, universities, training centers and laboratories, would benefit the overall protection of drinking water and wastewater critical infrastructures. EPA and DHS staff told us that, depending upon the user policy established by the sector, the HSIN network could allow for broader sharing of access than currently available under the WaterISAC. Only a small portion of the water sector is reached by the WaterISAC. According to EPA staff, just over 530 utilities are reached by the WaterISAC, while over 8,000 utilities receive information through the Water Security Channel. However, the Water Security Channel does not provide the same level of notification and information sharing provided by the WaterISAC. The Water Security Channel is essentially a “push e- mail system” that sends out general security bulletins to water utilities and other users, and allows for searches of previous bulletins. This service is much more limited than that provided to WaterISAC subscribers, which provides a secure communication system for users to share information, access to vulnerability assessment tools and resources, access to an online library related to water security issues, and access to databases about chemical, biological, and radiological agents. One water industry representative told us that the WaterISAC recently lowered its subscription fees due to industry concerns that the fees were limiting WaterISAC subscriptions. EPA staff told us that the water sector generally has less funding available to support ISAC services than other sectors such as electric, financial, and transportation. WaterISAC duplicates some operational functions likely available through HSIN. EPA estimates that roughly $600,000 to $700,000 of the annual $2 million WaterISAC grant is used to support computer hardware and software for the secure web portal. Meanwhile, to support HSIN, DHS funds similar computer software and hardware and its related technical support. EPA staff noted that WaterISAC could make use of the software and hardware platform available through HSIN. EPA staff believed that WaterISAC could then better focus its resources on managing its user list, managing information content on the secure web site, and analyzing and distributing threat information, while leaving DHS to manage and run the hardware and software. The current reach and levels of service offered by the WaterISAC and the Water Security Channel do not meet DHS’ objective to establish a communication system that provides equal and appropriate access to security information to all owners and operators in this critical infrastructure area. According to EPA and DHS staff, the Water Sector Coordinating Council will consider options to improve coordination between the WaterISAC, the Water Security Channel, and HSIN. Using funding from the supporting grant from EPA, the WaterISAC is currently examining options for coordination between the WaterISAC, the Water Security Channel, and HSIN. EPA noted that this review is ongoing and will likely be presented in preliminary form to the Water Sector Coordinating Council in a mid-March 2006 meeting. However, the scope of the preliminary review is not clear, nor is a time frame set to complete the review. According to DHS, the creation of the DHS Homeland Infrastructure Threat and Risk Analysis Center will assist in information sharing of intelligence threat information between DHS and federal, state, and private sector partners. Many of the nation’s large wastewater facilities have made security improvements since the terrorist attacks of September 11, 2001. Of particular note, many have completed some type of security assessment, and additional facilities have such assessments under way. Our survey also found that wastewater facilities are continuing to move away from the use of potentially dangerous gaseous chlorine as a wastewater disinfectant. One area of continuing concern is the difficulty these facilities are having in addressing vulnerabilities associated with their collection systems. Facility managers explained that with limited funding available, other important measures considered to be more feasible and affordable were assigned greater priority. EPA is attempting to help address this difficult issue through funding the American Society of Civil Engineers project to develop voluntary physical security standards for the water sector. Despite limited federal authority over security at the nation’s wastewater facilities, EPA, as the lead agency for water sector security, has worked with DHS and industry groups to advance wastewater security by providing vulnerability assessment tools, training, guidance, and burgeoning information sharing networks. These efforts, combined with the individual initiatives of many wastewater facilities, have resulted in measurable security improvements. However, these efforts could benefit from additional coordination, and we acknowledge and support EPA’s and DHS’ commitment to do so. As these agencies move forward, we believe they should act upon the opportunities we have identified that could improve both the efficiency with which limited dollars are being spent, as well as the delivery of vital information services to the wastewater community. Specifically, a substantial part of the $2 million annual EPA grant that funds WaterISAC goes to support a computer platform that may be available at no cost through HSIN. We recommend that the Administrator of EPA work with DHS and the Water Sector Coordinating Council to identify areas where the WaterISAC and HSIN networks could be better coordinated, focusing in particular on (1) how operational duplications and overlap could be addressed, and (2) how water systems’ access to timely security threat information could be improved. We also recommend that EPA work with DHS and the Water Sector Coordinating Council to identify realistic time frames for the completion of these tasks. We provided a draft of this report to DHS and EPA for review and comment. DHS agreed with the factual content of the report, and its Office of Infrastructure Protection provided written technical comments and clarifications that have been incorporated, as appropriate. In its letter, reproduced in appendix III, EPA concurred with the results of the report. EPA’s Water Security Division in the Office of Ground Water and Drinking Water also provided technical comments and clarifications that were incorporated, as appropriate. As agreed with your office, unless you publicly release the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees; interested Members of Congress; the Administrator, Environmental Protection Agency; the Secretary, Department of Homeland Security; and other interested parties. We will also make copies available to others on request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff need further information, please contact me at (202) 512-3841 or stephensonj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To identify federal statutory authorities and directives that govern protection of wastewater treatment facilities, we reviewed applicable laws, Homeland Security Presidential Directives, and policies, guidance, and regulations related to wastewater security from the Environmental Protection Agency (EPA) and the Department of Homeland Security (DHS). In addition, we interviewed officials in EPA’s Water Security Division, as well as DHS officials in various areas of the agency. In addition, we spoke with representatives for wastewater industry associations with which EPA has collaborated to actively assist wastewater treatment facilities to address their security issues. To determine the steps critical wastewater treatment facilities have taken since 9/11 to address potential vulnerabilities, we conducted a Web-based survey of the nation’s largest wastewater treatment facilities. For the purpose of this review, we defined “critical wastewater facilities” as the 253 wastewater facilities in the United States that have service area populations of 100,000 or greater, as identified in the results of EPA’s 2004 Clean Watershed Needs Survey. As a result of Hurricane Katrina, one facility in our initial population of 253 facilities that was identified as a New Orleans facility was omitted, leaving a total 252 facilities in our survey population. We drafted the survey in consultation with our own survey professionals. In addition, we solicited the review and comment of knowledgeable officials from the National Academy of Sciences, the Water Environment Federation, and the National Association of Clean Water Agencies, as well as several wastewater security experts identified in our January 2005 report on wastewater security. We conducted seven pretests to check that (1) the questions were clear and unambiguous, (2) terminology was used correctly, (3) the information was feasible to obtain, and (4) the survey was comprehensive and unbiased. The pretest sites were chosen to include facilities representing different geographic regions, and utilities both with single and multiple facilities. One pretest was done in person and six were done over the phone. Our survey asked wastewater treatment facility representatives to provide a variety of information, such as whether their facilities had conducted security assessments; what measures, if any, they had taken or were planning to take in several security areas; and their perspectives on what role the federal government should assume in wastewater treatment facility security. The survey was made available between October 1, 2005, and January 15, 2006, and a unique user identification number and a password were provided to each surveyed facility. Three e-mail reminders were sent out to nonresponders, and then follow-up phone calls were made to all nonresponding facilities. A total of 206 of 252 wastewater treatment facilities responded to the survey, resulting in an 82 percent survey response rate. Other wastewater facilities that did not respond to the survey generally cited security concerns related to providing potentially sensitive information or a general policy of not answering surveys. Because this was not a sample survey, there are no sampling errors. However, the practical difficulties of conducting any survey may introduce errors, commonly referred to as non-sampling errors. For example, difficulties in how a particular question is interpreted or in the sources of information that are available to respondents can introduce unwanted variability into the survey results. We took steps both at the data collection and at the analysis phases to minimize these non-sampling errors. Since this was a Web-based survey, respondents entered their answers directly into the electronic questionnaire, which removes one source of error. When the data were analyzed, a second, independent analyst checked all relevant computer programs. To determine what steps EPA and DHS have taken to help wastewater facilities in their efforts to address vulnerabilities, we took several approaches. First, through semi-structured interviews with agency officials and industry association representatives, as well as document reviews, we researched various programs that EPA and DHS have under way. Second, we identified programs that require cross-agency collaboration between EPA and DHS, and we examined in depth those that wastewater treatment facility representatives identified as potentially useful. We also interviewed state and local officials with oversight for wastewater treatment operations and security. Third, one section of our survey gathered information about facility representatives’ experiences with, perspectives on, and expectations for, the federal role in wastewater treatment facility security. Responses to open-ended questions were categorized and tallied to analyze their content for subsequent research findings. Finally, to develop conclusions about the level of coordination between the two agencies in the implementation of these programs, we interviewed agency officials about their perspectives on how well the agencies are working together. Welcome to the Survey of Wastewater Treatment Facilities. The U.S. Government Accountability Office (GAO), a congressional audit and evaluation agency, is conducting this survey to identify actions wastewater treatment facilities have taken to protect their operations and infrastructures from terrorism or other threats. Why you are receiving this information: The GAO is surveying wastewater treatment facilities that serve residential populations of 100,000 or greater. An EPA database identified you as the point of contact for your wastewater treatment utility/authority. As a result, we are requesting that you or your designated representative complete the survey. Please complete this survey within two weeks of receipt. We understand that there are great demands on your time. However, your participation in our study is essential for us to provide relevant information to Congress about the actions wastewater treatment facilities have taken to protect their operations from terrorism or other security threats. We greatly appreciate your time and effort in completing this survey. Your responses will be gathered on a SECURED SERVER AND AGGREGATED WITH THOSE OF OTHER FACILITIES. They will be presented in a report to the Congress IN A SUMMARY FORM ONLY. GAO WILL NOT RELEASE INDIVIDUALLY IDENTIFIABLE DATA FROM THIS SURVEY, unless compelled by law or required to do so by the U.S. Congress. on skip instructions; some respondents were directed to answer certain survey questions and not others based on their earlier responses. 1. About Your Utility 1. What is the name of the wastewater treatment utility/authority that is responsible for the facility or facilities for which you are completing a survey(s)? (Click in the box and enter the name.) 2. Does your utility/authority manage BOTH drinking water and wastewater treatment? Check only one answer. 1. 2. 3. Don’t know/No response 3. How many wastewater treatment facilities within your utility/authority serve populations of 100,000 or more? Check only one answer. 1. 2. 3. 4. 5. 6. 6 or more (Please specify number below.) 7. Don’t know/No response 4. (If you checked "6 or more" above) What is the number of wastewater treatment facilities within your utility/authority that serve populations of 100,000 or more? (Click in the box and enter 1 or 2-digit whole number.) N = 26 2. About Your Facility 5. What is the size of the service area population served by your wastewater treatment FACILITY under regular operating conditions? Check only one answer. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Don’t know/No response *These facilities were identified in the results of EPA’s 2004 Clean Watershed Needs Survey as having service area populations of 100,000 or over and were kept in our survey. 6. Has a vulnerability assessment been completed for your wastewater treatment facility? Check only one answer. 1. Yes (GO TO QUESTION 8.) 2. Currently underway (GO TO QUESTION 8.) 3. 4. Don’t know/No response 7. Has a security or risk assessment been completed for your wastewater treatment facility? Check only one answer. 1. 2. 3. No (GO TO QUESTION 17.) 4. Don’t know/No response (GO TO QUESTION 17.) 8. When was your vulnerability/security assessment completed or most recently updated, or when is it scheduled to be completed or updated? Responses ranged from April 2001 to July 2006. Most indicated assessments were completed, updated, or scheduled to be completed or updated in 2003. 9. Were the following factors important in deciding to conduct this vulnerability/security assessment for your facility? Check one in each row. a. Required by state government b. Required by local government or c. Required by utility governing d. Required by facility insurance drinking water facility, as required g. Conducted assessment on facility's 10. What other factors, if any, were important in deciding to conduct this vulnerability/security assessment at your facility? (Click in the box and enter your response. Leave blank if all important factors are listed above.) We did not summarize the narrative responses to this question for inclusion in this appendix. 11. Who conducted or is conducting the vulnerability/security assessment for your wastewater treatment facility? Check one in each row. c. City or county staff (e.g. alarm company personnel) e. Other (Please specify in 12 below.) 12. (If you checked yes for "Other" in 11) Who else is involved in conducting the vulnerability/security assessment at your facility? We did not summarize the narrative responses to this question for inclusion in this appendix. 13. What vulnerability/security assessment tool, if any, did your wastewater facility use? Check one in each row. Tool (VSAT) b. Risk Assessment Methodology for Water (RAM-W, developed by Sandia National Laboratories) Management System (SEMS, developed by the National Rural Water Association) d. County or city developed its own e. Utility developed its own g. Other (Please specify below.) 14. (If "Other") What other vulnerability/security assessment tool did your wastewater facility use? We did not summarize the narrative responses to this question for inclusion in this appendix. 15. As a result of the vulnerability/security assessment, what were the 3 most significant measures (activities, changes and improvements) that have been completed to improve security at your wastewater treatment facility? We did not summarize the narrative responses to this question for inclusion in this appendix. 16. In which of the following time frames, if any, do you plan to update your vulnerability/security assessment? Check only one answer. 1. No plans to update (GO TO QUESTION 27.) 2. Continuous process (GO TO QUESTION 27.) 3. In about 1 year (GO TO QUESTION 27.) 4. In about 2 years (GO TO QUESTION 27.) 5. In about 3 years (GO TO QUESTION 27.) 6. In the next 4 years or more (GO TO QUESTION 27.) 7. Plan to update, but no time frame set (GO TO QUESTION 27.) 8. Don’t know/No response (GO TO QUESTION 27.) End of questions for facilities that completed vulnerability assessments/security assessments. GO TO QUESTION 27. 17. Does your facility plan to conduct a vulnerability/security assessment? Check only one answer. 1. Yes (GO TO QUESTION 20.) 2. 3. Don’t know/No response 18. Were the following factors important in your wastewater treatment facility's decision NOT to conduct a vulnerability/security assessment? Check one in each row. a. Steps we have taken are adequate b. Facility and system are not c. Other priorities and limited d. Emergency response plan was updated, and this seemed sufficient to f. Not required to do so 19. What OTHER factors, if any, were important in deciding NOT to conduct a vulnerability/security assessment? We did not summarize the narrative responses to this question for inclusion in this appendix. End of questions for facilities that have decided NOT to complete vulnerability assessments/security assessments. Click on GO TO QUESTION 30. 20. When is your facility's vulnerability/security assessment scheduled to be completed? Responses ranged from November 2005 to December 2007. Most facilities indicated assessments were scheduled to be completed in 2006. 21. Were the following factors important in deciding to conduct this vulnerability/security assessment at your facility? Check one in each row. a. Required by state government b. Required by local government or c. Required by utility governing d. Required by facility insurance drinking water facility, as required by the Bioterrorism Act 22. What OTHER factors, if any, were important in deciding to conduct this vulnerability/security assessment at your facility? We did not summarize the narrative responses to this question for inclusion in this appendix. 23. Who will conduct the vulnerability/security assessment for your wastewater treatment facility? Check one in each row. c. City or county staff (e.g. alarm company personnel) e. Other (Please specify below.) 24. (If "Other") Who else will be involved in conducting the vulnerability/security assessment at your facility? N = 0 25. What vulnerability/security assessment tool, if any, did your wastewater facility use? Check one in each row. Tool (VSAT) b. Risk Assessment Methodology for Water (RAM-W, developed Laboratories) Management System (SEMS, developed by the National Rural Water Association) d. County or city developed its own e. Utility developed its own g. Other(Please specify below.) 26. (If "Other") What other vulnerability/security assessment tool will your wastewater facility use? We did not summarize the narrative responses to this question for inclusion in this appendix. 4. Chemical Security Measures 27. Does your wastewater treatment facility use gaseous chlorine to disinfect wastewater? Check only one answer. 1. Yes (GO TO QUESTION 32.) 2. 3. 28. Did your wastewater treatment facility EVER use gaseous chlorine to disinfect wastewater? Check only one answer. 1. 2. No (GO TO QUESTION 31.) 3. Don’t know/No response (GO TO QUESTION 31.) 29. When did your wastewater treatment facility decide to discontinue its use of gaseous chlorine? Check only one answer. Responses ranged from July 1980 to October 2005. Many facilities made the decision to discontinue the use of gaseous chlorine between 1998 and 2001. 30. How have ANNUAL (as opposed to capital) costs at your wastewater treatment facility been affected by converting to an alternative disinfection process? Check only one answer. 1. 2. Costs have stayed about the same 3. 4. Don’t know/No response 31. What disinfection method does your wastewater treatment facility use? Check only one answer. 1. Sodium hypochlorite (transported to site) (GO TO QUESTION 40.) 2. Sodium hypochlorite (generated onsite) (GO TO QUESTION 40.) 3. Calcium hypochlorite (GO TO QUESTION 40.) 4. Ozone (GO TO QUESTION 40.) 5. Ultraviolet light (GO TO QUESTION 40.) 6. Other (GO TO QUESTION 40.) 7. Don’t know/No response (GO TO QUESTION 40.) End of questions for facilities that do not use gaseous chlorine. GO TO QUESTION 40. 32. How is the chlorine transported and stored? Check only one answer. 1. In 50 - 100 pound cylinders 2. 3. 4. 5. 6. Other (Please specify number below.) 7. Don’t know/No response 33. (If "Other") By what other method is the chlorine transported and stored? We did not summarize the narrative responses to this question for inclusion in this appendix. 34. Which one of the following changes, if any, has your wastewater treatment facility made in how it stores and uses gaseous chlorine and when did it make them? Check one in each row. a. Converted chlorine to 35. (If you indicated "Yes" for "Made other physical security improvements" above) What other physical security improvements to the gaseous chlorine storage area did your facility make? We did not summarize the narrative responses to this question for inclusion in this appendix. 36. Does your wastewater treatment facility PLAN to stop using gaseous chlorine? Check only one answer. 1. 2. No (GO TO QUESTION 40.) 3. Don’t know/No response (GO TO QUESTION 40.) 37. When does your wastewater treatment facility PLAN to stop using gaseous chlorine? Responses ranged from November 2005 to January 2015. Most indicated that their facilities planned to discontinue their use of gaseous chlorine in 2006 and 2007. 38. How do you expect ANNUAL (as opposed to capital) costs at your wastewater treatment facility to be affected by converting to an alternative disinfection process? Check only one answer. 1. 2. Costs will stay about the same 3. 4. Don’t know/No response 39. What disinfection method does your wastewater treatment facility plan to use? Check only one answer. 1. Sodium hypochlorite (transported to site) 2. Sodium hypochlorite (generated onsite) 3. 4. 5. 6. 7. Don’t know/No response 40. What OTHER chemicals, if any, are currently at your wastewater treatment facility, or will be in the future, that have the potential to cause significant harm and damage if used for terrorist activity? We did not summarize the narrative responses to this question for inclusion in this appendix. 41. For each chemical identified in 40, if any, please indicate its use at your wastewater treatment facility. We did not summarize the narrative responses to this question for inclusion in this appendix. 5. Physical Security Measures 42. For each of the following physical security measures that your wastewater treatment facility may have, was it completed before September 11, 2001, completed after September 11, 2001, is it planned but not yet completed, or is it NOT planned? Check one in each row. power sources operation (e.g. smart pipes) (LEL) meters or 43. What OTHER physical security improvements, that you consider significant, have been installed or are planned for your wastewater treatment facility and associated infrastructure? Be sure to include any specific changes that your wastewater facility has made to improve physical security in your COLLECTION SYSTEM, if they are not listed above. We did not summarize the narrative responses to this question for inclusion in this appendix. 6. Personnel Security Measures 44. For each of the following personnel security measures that your wastewater treatment facility may have, if any, was it completed before September 11, 2001, completed after September 11, 2001, is it planned but not yet completed, or is it NOT planned? Check one in each row. visitors, etc.) are identification visitors, etc.) may 45. What OTHER personnel security improvements, that you consider significant, have been installed or are planned for your wastewater treatment facility and associated infrastructure? We did not summarize the narrative responses to this question for inclusion in this appendix. 7. Information Technology (IT) Security Measures 46. For each of the following Information Technology (IT) security measures that your wastewater treatment facility may have, was it completed before September 11, 2001, completed after September 11, 2001, is it planned but not yet completed, or is it NOT planned? Check one in each row. b. Network protection, such as a firewall, an 47. What OTHER IT security improvements, that you consider significant, have been installed or are planned for your wastewater treatment facility and associated infrastructure? We did not summarize the narrative responses to this question for inclusion in this appendix. 48. Does your facility have a designated individual to oversee internal security initiatives at your wastewater treatment facility? Check only one answer. 1. 2. No (GO TO QUESTION 50.) 3. Don’t know/No response (GO TO QUESTION 50.) 49. Does this person oversee efforts to address security that require coordination with other organizations and governments? Check only one answer. 1. 2. 3. Don’t know/No response 50. Does your wastewater treatment facility have periodic (annually, semi annually or more often) contact about security planning with the following? Check one in each row. b. Police and fire departments Committee (LEPC) DK/NR = 23 e. Industry organizations, e.g. Water Environment Federation (WEF), National Association of Clean Water Agencies (NACWA) g. Hazardous material storage facilities h. State organizations and agencies with oversight for wastewater operations and security (Please specify below.) i. Federal organizations and agencies with oversight for wastewater operations and security (Please specify below.) 51. (If you indicated "yes" for "State organizations and agencies" above) Which state organizations and agencies with oversight for wastewater operations and security does your facility have periodic contact about security planning? We did not summarize the narrative responses to this question for inclusion in this appendix. (If you indicated "yes" for "Federal organizations and agencies" above) Which federal 52. organizations and agencies with oversight for wastewater operations and security does your facility have periodic contact about security planning We did not summarize the narrative responses to this question for inclusion in this appendix. 53. Which of the following security coordination activities has your wastewater treatment facility implemented or participated in? DK/NR = 36 k. Developed an emergency notification l. Participate in an emergency facilities in service area, with m. Participated in a security tabletop o. Developed training materials p. Created or are part of a mutual aid q. Met with FBI Field Office to discuss protocols and other security 54. What role, if any, do you think the federal government should play in COORDINATING security initiatives at wastewater treatment facilities and their associated infrastructures? We did not summarize the narrative responses to this question for inclusion in this appendix. 9. Conclusions and Additional Comments 55. What are the 3 most significant security measures that have been put in place at your wastewater treatment facility and associated infrastructure? We did not summarize the narrative responses to this question for inclusion in this appendix. 56. Of those security measures that you have PLANNED, BUT HAVE NOT YET PUT IN PLACE, which 3 measures do you anticipate will be the most useful to improving security at your wastewater treatment facility and associated infrastructure? We did not summarize the narrative responses to this question for inclusion in this appendix. 57. What 3 security measures, if any, would you put in place if you were free to implement any measures you viewed as potentially useful to improving security at your facility and associated infrastructure We did not summarize the narrative responses to this question for inclusion in this appendix. 58. For the security measures you listed in 57 above, were any of the following factors important in your facility not yet implementing these measures? (Check one in each row. Leave blank if you did not list any security measures in 57.) a. Not enough time c. Other security priorities more critical d. Technology needed not readily e. Necessary agreements not in place f. Other (Please specify below.) 59. (If you checked "yes" for Other) What other factors were important in your facility not yet implementing these measures? We did not summarize the narrative responses to this question for inclusion in this appendix. 60. What do you consider to be the major challenges to reducing vulnerabilities to the wastewater treatment collection systems' network of sanitary, storm, and combined sewer lines? We did not summarize the narrative responses to this question for inclusion in this appendix. 61. What, if any, are the most innovative or effective practices that address these challenges to reducing vulnerabilities to the wastewater treatment collection system? We did not summarize the narrative responses to this question for inclusion in this appendix. 62. What are the most important things, if any, the federal government could do to improve the security at your facility and other wastewater treatment facilities nationwide? We did not summarize the narrative responses to this question for inclusion in this appendix. 63. If you would like to provide additional comments concerning security at your wastewater treatment facility, specifically, and/or security at wastewater treatment facilities in general, please provide them in the space below. We did not summarize the narrative responses to this question for inclusion in this appendix. 64. Have you finished this questionnaire? Check only one answer. 1. 2. In addition to the contact named above, Nancy Bowser, Jenny Chanley, Steve Elstein, Greg Marchand, Tim Minelli, Cynthia Norris, Jerry Sandau, Rebecca Spithill, and Monica Wolford made key contributions to this report.

Summary: Wastewater facilities provide essential services to residential, commercial, and industrial users, yet they may possess certain characteristics that terrorists could exploit to impair the wastewater treatment process or to damage surrounding infrastructure. For example, large underground collector sewers could be accessed by terrorists for purposes of placing destructive devices beneath buildings or city streets. GAO was asked to determine (1) what federal statutory authorities and directives govern the protection of wastewater treatment facilities from terrorist attack, (2) what steps critical wastewater facilities have taken since the terrorist attacks of September 11, 2001, (9/11) to ensure that potential vulnerabilities are addressed, and (3) what steps the Environmental Protection Agency (EPA) and the Department of Homeland Security (DHS) have taken to help these facilities in their efforts to address such vulnerabilities. Federal law does not address wastewater security as comprehensively as it does drinking water security. For example, the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 required drinking water facilities serving populations greater than 3,300 to complete vulnerability assessments, but no such requirement exists for wastewater facilities. While federal law governing wastewater security is limited, Homeland Security Presidential Directive 7 designated EPA as the lead agency to oversee the security of the water sector, including both drinking water and wastewater. The directive tasked EPA with several responsibilities, including the development of mechanisms for information sharing and analysis within the water sector. Our survey of over 200 of the nation's large wastewater facilities shows that many have made security improvements since 9/11. Most facilities indicated they have completed, have under way, or plan to complete some type of security assessment. Similarly, more than half of responding facilities indicated they did not use potentially dangerous gaseous chlorine as a wastewater disinfectant. Survey responses show that other security measures taken after 9/11 have generally focused on controlling access to the treatment plant through improvements in visual surveillance, security lighting, and employee and visitor identification. Little effort, however, has been made to address collection system vulnerabilities, as many facilities cited the technical complexity and expense involved in securing collection systems that cover large areas and have many access points. Others reported that taking other measures, such as converting from gaseous chlorine, took priority over collection system protections. While EPA and DHS have initiatives to address wastewater facility security, efforts to provide critical and threat-related information would benefit from closer coordination. EPA and DHS fund multiple information services designed to communicate information to the water sector--specifically, EPA funds the Water Information Sharing and Analysis Center (WaterISAC) and its Water Security Channel, while DHS funds the Homeland Security Information Network (HSIN). EPA, DHS, and other industry experts are concerned that these multiple information services may overlap and produce inefficiencies. For example, a substantial part of the $2 million annual grant EPA uses to fund the WaterISAC is dedicated to purchasing computer services likely available through DHS and HSIN at no cost. A Water Sector Coordinating Council was established by the water sector to help determine the appropriate relationship among these information services. A preliminary review is under way to examine options for improving coordination between the WaterISAC, the Water Security Channel, and HSIN; however, the scope and time frame for completion of this review is unclear.