... ;: \ \ \ \ \ '7 t4f-A CWS > 49,999 persons , Complete by 12/31103 50,000 persons> CWS > 99,999 persons , Complete by 3/31103 100,000 persons> CWS " " " Complete by 12/31104 Complete by 6/30/04 Complete by 9/30/03 3,300 persons> CWS > 49,999 persons 50,000 persons> CWS > 99,999 persons 100,000 persons> CWS The Law requires: I) Community Water System conduct a Vulnerability Assessment, 2) Community Water System certify and submit a copy ofVulnerability Assessment to the Administrator ofthe Environmental Protection Agency (EPA)', 3) Community Water System prepare or revise an Emergency Response Plan that incorporates the results ofthe Vulnerability Assessment and certify to the EPA Administrator that the Community Water System has completed Emergency Response Plan'" The Purposes of the Vulnerability Assessment are: I) Undertake risk-based vulnerability assessments oftheir assets; 2) Analyze potential adversarial threats; and 3) Consider potential modes ofattack. The Vulnerability Assessment includes six basic elements I) Characterization ofthe water system, including its mission and objectives; 2) Identification and prioritization ofadverse consequences to avoid; 3) Determination of critical assets that might be subject to malevolent acts that could result in undesired consequences; critical assets wiII include the following the Community Water System's infrastructure: a) pipes and constructed conveyances b) physical barriers c) water coIIection, pretreatment, treatment, d) storage and distribution facilities e) electronic, computer or other automated systems which are utilized by the public water system f) the use, storage, or handling of various chemicals g) the operation and maintenance of such system ::t 4) 5) 6) Assessment ofthe likelihood (qualitative probability) ofsuch malevolent acts from adversaries (e.g. terrorists, vandals, etc.); Evaluation of existing countermeasures; and Analysis of current risk and development of a prioritized plan for risk reduction. The Town of Addison (Town) will: I) provide DAL-Tech Engineering, Inc., (DTE) with the Baseline Threat Document received from the Environmental Protection Agency (EPA); 2) provide DTE with the complete Town's water system inventory. The inventory will include, but may not be linrited to the following components, including number, location and description of each item. The inventory document will be drafted in Microsoft Word. Main (Water) Feed Points Storage (Water) Tanks Power Primary Power (Electric Feed) Secondary Power (Back up generators) Distribution Pumps Offices Buildings Computers Files Transportation and Work Vehicles Communications Telephones Cell Phones Radio Computer Control System SCADA 3) provide DTE with four paper copies ofa 1"=200' scale map (9'x7.5') of Addison showing: a) City Linrit line, north arrow, bar scale; b) Streets showing names; c) water mains showing sizes, valves, fire hydrants, City ofDallas feed points; d) pump stations, storage tanks showing existing fences with fence description; e) emergency generators; f) Town offices (Le. fire station(s), police station(s), hospital(s), Mayor's office, Town Manager's office, Public Works office); g) SCADA facilities (i.e. where they are located, what they monitor, what they control); and h) chenrical storage and feed facilities; provide the Town with paper copy of the map on II"xl?" sheets to be included in the Vulnerability Assessment and Emergency Response Plan with all the above information. 4) provide on-site Town representative while DTE is performing investigation 5) provide DTE with the Town's policies and procedures in Microsoft Word concerning the water system. These policies and procedures will include, but not limited to the following components. Water System Facility Security -i.e. Facilities are locked, fenced, gated, with limited access doors, vents on storage tanks are screened and securely fastened, the facilities have security lighting, signs, patrol, alarm system, and secure chenrical storage, etc. Water System Personel-i.e. Personel wear uniforms, ID cards, potential employees receive background checks prior to employment, terminated employees must return ID cards, etc. Water System Computer Security -i.e. Access to computers is password protected, computers are regurlarly backed-up, the computers have internet firewall software, etc. Water System Public Relations -i.e. System has a neighborhood watch, system has a procedure to respond to a customer's odor or taste complaint, system has procedure in place to immediately advise the community in case of danger, etc. 6) provide Town senior staffand meeting facility for no less than two meetings lasting approximately four hours each, and a two-hour conclusion meeting. The meetings are described in the Preliminary Schedule portion ofthe Scope. Senior staff would include a Town representative from the Police Department, Fire Department, Local Government, Public Works, and Health Department with decision-making authority; 7) provide Town representative (preferably from Public Works) with decision making authority and familiar with the contract to assist DTE; 8) review draft documents, maps, meeting notes, and any other information assembled by DTE; 9) certify to the EPA that the Vulnerability Assessment was conducted; 10) provide a copy of the Vulnerability Assessment to the EPA; and 11) certify to the EPA that the Emergency Response Plan was completed. DAL-Tech Engineering, Inc., (DTE) will 1) provide the Town with the specific format that the written inventory should be prepared; 2) assist the Town in acquiring its inventory; 3) accumulate inventory ofTown's water system in Microsoft Word document to be included in the Vulnerability Assessment; 4) conduct meeting(s), draft meeting notes, and draft meeting agendas; 5) make final corrections to maps, draft information, for the Vulnerability Assessment to comply with the Town's review comments 6) (from the results ofthe inventory and meetings) provide Addison with four original copies and one original electronic file ofthe Vulnerability Assessment; 7) make final corrections to maps, draft information, for the Emergency Response Plan to comply with the Town's review comments , 8) (from the results of the inventory, meetings, and the Vulnerability Assessment) provide Addison with three original copies, and one original electronic file ofthe Emergency Response Plan; 9) provide security expert sub-consultant who visits water system facilities (including the pump stations, storage tanks, office facilities), assess facility weaknesses, make security recommendations, and prepare security assessment report that will be incorporated in the Vulnerability Assessment and Emergency Response Plan; and 10) provide security expert sub-consultant to participate in necessary meetings. : : Cost Breakdown for Addison Vulnerabllity Assessment and Emergency Response Plan DAlwTech Enginealing. Inc, 101D9103 Total $ 19,478.00 $ 59,042.80 DAlwTech Engineering, Inc. Total $39,564.80 Security Consultant (Kimmons Security Services. Inc.) $19.478.00 Tots! $59,042.60 Addison VA Schedule Task Begin End Sep-03 Oct·03 NQv-03 Dec-03 Jan-04 Feb-04 Mar-04 Apr.04 May·04 Jun-04Task Task Notk:e to ProcIWd iOf2oroa 10/20/03 I Addison Oata Accumulation 10120103 11117103 -consultant SocUrity Investigation 1012oroa H/t7lOa -DIE Report Preparation 10127103111t7103 •Addison Roport Review 11/18103 '2130103 .... OTE Report Revision 011OlU04 02102104 .... Meeting 1 Preparation o2IDal04 03102104 ... Meatlng 2 Prnparation 03105104 03119104 •conclus[on Meeting Preparation 03J22i04 04/02/04 •Acldlson Final Report Review 04105/04 04/16104 III DlE Final Report ReVision 04/19104 04J3OJ04 •ePA Submittal 04J30104 04130104 I -------------- Igj002OE/29/200J 18:40 􀁾􀁾􀀠􀁜􀀮􀁁􀁩􀁾􀁭􀀬􀁭􀁴􀁰􀁮􀁳􀀠Security Services, Inc. Investigations and Security Services ArJsust 29, 2063 Mr. Matthew w. Steveos,. P.E. DAl.-TECH ENGINEERING, INC. 17311 DaIIas Parkway, Suite #'200 Dallas, Texas 75248 .. BE: . VfiLNEBABJLIIY (RISK) ASSESSMENTS EMEBGENCYRESPONSE PLANS Dear Mr. Stevens: Thank you fur your interest in our:firms servia!s in reference to Vulnerability (Risk) Assessments and Emergency Respouse PlaDs fOl" MUDidpaJi.tift and MUD Distrids. Below is some additional infurmation conceming the Risk: Assessment Services we provide. Ifyou have any otb.eI" specific questions, please do DOt hesitate to contact me. The Vulnerability (Risk:) Assessment is designed to evaluate threats to utility sites and identi1Y key roi.1:igation measures that can be implemmted to address those possible threats. We believe our finn is uniquely qua1ified to provide these a5sess1I.1ents, due to 0llI'-vast experience ill the security field. Our security experts have a\so attended the AWWAIEPA (RAM-W) seminar for Vulnerability Assessment training. We work as a team when conducting a:rusk: Assessment Our team consist ofat 1east one security expert. a coIisultaDl:.from the water i.ndustIy, and law enfurcement represellta1ives. We believe this team ofsecurity experts, separates us Ii'om other firms who offi:r similar services. We also install security sysm:ns for the protection ofwater and otb.eI" utilities, which gives us llllique iDsigbl: regarding security concerns relating to these sites. .Most ofour employees are former law enforcement ofllcers with many years ofsecurity experience. . A studyfOr a site would include areview ofthe fuUowing: backgrounds on persoIlllll1, backgroonds on vendors and others who visit the site, security ofrecords (system maps, accountiD& customer list), 􀁾plan. source water storage, distribution system., electric power, tra:DSportation, transmission system cheddist, treatment titcility chec.ldist, finisbetl water storage, interdependent infi'astructure, gDide\ine information on emergency response, SCADA v.communications, emergency contacts, crisis 􀁣􀁯􀁭􀁭􀁬􀁬􀁮􀁩􀁾planning and IespOnse. Also, if available, this report would include previous crime statistics inthe an:a. in order to provide 'VlIIusble ilIsigbl:.regarding the types ofthreats to be aware ofand protect against. 'Please Dote that the below listed priees will also include an Emergency Respoase Plan for the sites. 2000 Dairy Asbforo. Snite 300 (181)679-0070 Honston, Tems 77077 Fax (281)679-0030 www.kimmonssecurity.com tal 003i/2S/2003 18:40 FA! Pagc #2 Continued: VA's & ERP Prlciog DeI-TechEnginel:riJJg, Inc. The cost fur conducting a Vulnerability (Risk) As..o:essment for a MUDieipaiity or Municipal Utmty District, including a bound iIIustJ:'ated report and the Emergency Respouse Plan, would be 55,000 for the first site plus travel and out ofpocket e:qleIlSeS. Ifa. district has mare than one site or an administrative ofIke, each additional site could be included fur a disoount of 54500 (plus out Ofpocket expenses). The out of pocket expenses would include photographs. copy cost, etc. The foU_ing total will apply to tile Town ofAddison, Teus (6 sites): *1 Elevated Storage Tank 55,000 plDS travel and ollt of poeket e:spenses *5 AdditioDal 􀁓􀁾(2 Groand Storage Tanks aDd :3 C"q BuildiDg$) 5:,;54500 5U,580 plus out ofpodi:et ttpeDBe:J. Note: The out ofpocket 􀁾woald include approximately 511 miles travel (x) .50 CeDts per mile, food,lodging, and approximately 71lours travel time (x) 575 per Iloar. It is believed that aD , sites /:GlIld be surveyed in two (2) dap. TOTAL FOR VA's AND ERP'& The J1ll!Orl woold be a tJat rate of57SO pins photo cost. (In lieu of retainer, fuD payment is due withiu 15 dayI upon delivery ofeempleted reports.) Yau can also review our firn:cs web site at www.kimmonsandassociates.com for additional. iDformmon. Ifyou have any questions please fi:eI free to contact me at 281-679-0070 or by email at iim@kimmonsandassC!Pi@!:es.com. APPROVED -DAL-TECH ENGlN';UUNG, INC. DATE 2000 Dairy Ashford, Suite 300 H01Il8toD, Teus 77077 􀁗􀀡􀁖􀁗􀀮􀁫􀁩􀁭􀁭􀁯􀁮􀁳􀁾􀁥􀁃􀀡􀀱􀁲􀁩􀁴􀁹􀀮􀁃􀁑􀁭􀀠(231)67'-0070 Fax (231)679-0080 􀁏􀁾􀀱􀀲􀀹􀀯􀀲􀀰􀀰􀁾􀀠H:07 fil 􀁾􀀰􀀰􀀴􀀠,__.tl.mons Security Services, Inc. IRVestigations andSecurity Services August 29,2003 Mr•.Ma!Ihew W. 􀁳􀁾1'2. DAL:n:CB ENGINEERING, INC. . 17311 Dallas Pm:k:wa:y, SlliIe#200 DaI.Ias, Texas 75248 BE: VULNERAB1LITY ASSESSMENTMEEIINGS Dear Mr. Stevens: Per our c:onvetSlllion 011 this dme, 1hefullowing charges wonld be 􀁾for traveliDg ftom Houston10 Dallas. Texas fur Co\lllCll 􀁍􀁾etc, in lii:fiaumce to the Vulnenlbility AsS"SSdl/!!'llS fur Addison, T5XaS. *Traveltimeftom Hooston 10 Dallas :mdIetum 3.5 hours ead1 Wlrf 7 hoUIS x $7S perhourtravel time $525.00 *Mileage fromHonsloo to DaIIas:mdretm:n lS6 miles each way 512 miles x .50 cents per mile $256.00 *MeetingwithDal-TecbFn' . and City Com:!ciI. gmeertIlg 4hoorsx $75 per hour . $300.00 *Meals $ 45.00 TOTAL FOR Iijt\CR TRIP: Sl.1l6.00 Total For 5 Trips: $5,630.00 Ifywbave any questtOllS orlleed any addidtmal infonnation, please contact me at 281-6790070. lOOB Dairy Ashfonl, Suite300 (281)'79-0070 Houston, TedS 77077 Fax (281)019-0080 www.kimmonsandassociates..eom ----Baseline Threat Information for Vulnerability Assessments of Community Water Systems Notice: Limited Distribution. This document contains information that may not be appropriate for public dissemination. Do not copy or further distribute this document. UNITED STATES ENVIRONMENTAL PROTEC11OjlAGENCY WASHINGTON, D.C. 20460 ' -OFFICE OF WATER DRINKING WATER SECURITY INFORMATION The U.S. EPA received yom request and is providing you with the document, Baseline Threat Information for Vulnerability Assessments of Community Water Systems. Although it is not a blueprint for developing a vulnerability assessment, it does present an overview of threats, methodologies, and strategies for water utilities to consider as they develop vulnerability assessments. As you probably know, vulnerability assessments are required ofail commuuity water systems that serve a population greater then 3,300 persons under the Safe Drinking Water Act, amended by the Public Health Security and Bioterrorism Preparedness and Response Act of2002. U.S. EPA requests that you take reasonable measures to: • Hold ail information contained in the document in confidence and take reasonable precautions to protect it; • Liruit access only to those with siguificant need for the information to assist with or perform water utility security planning; and • Do not photocopy ail or any portion ofthe document. Ifyou have further questions or need additionhl information, please visit the Web site'at: , http://Www.epa.gov/safewater/securitv or contact the Safe Drinking Water Hotline by phone: 1-800-426-4791 or E-mail: hotJine-sdwa@epa.gov. Intem&t Address (URL) • ht1p:IIwww,apa,gov ReeycledJRecyclab1e -Printed 􀁷􀁾􀁨􀀠Vegetable 011 8ased Inks on Recycled Paper (Minimum 30% Postconsumer) UNITED STATES ENVIRONMENTAL PROTECnON AGENCY WASHINGTON, D,C, 2Q.46() 􀁔􀁈􀁅􀁾􀁬􀁒􀁁􀁔􀁏􀁒􀀠STATEMENT FROM THE ADMINISTRATOR ram pleased to release to you this document, Baseline Threat Information for Vulnerability Assessments ofCommunity Water Systems, The primary objective of this infonnation document is to provide a framework for utility managers and their staffs to identify and evaluate vulnerabilities that eQuid place the operation ofthe water utility, staff, and/or customers in hanns way. I hope this document will be useful to drinking water utilities as they underteke the very important task ofdetcnnining their vulnerabilities to attack and taking steps to improve the safety and security oftheir operstions. The U.S. Environmental Protection Ageney (EPA) has developed this infonnation document under Congressional mandate in the Public Health Security and Bioterrorism Response Act signed into law on June 12.2002. The EPA received assistance in developing this document from other federal Agencies such as the Federal Bureau of Investigation. water industry association representatives. and experts from a peer review panel sponsored by the National Academy ofSciences. I recognize the need to provide useful infonnation and sound science. without unnecessary delay. I wish you success in this imponant endeavor to protect our nation's critical water inrrastrueture on whieh millions of our citizens depend. til J . c-.r.Jb:􀁾􀁩􀁕􀁮􀁡􀁮􀀠Internet Address (URL) • http://www,epa,gov Reoycled/Recyclable. Printed with Vegetable Oil Based Inks on Process Chlorine Free Recycled Paper (minimum 50% Po.leonsumer) ACKNOWLEDGEMENTS The Environmental Protection Agency (EPA) would like to thank the following individuals who took the time and energy to review and submit comments as a part of the Baseline Threat Information development process. They are to be commended for their perseverance and dedication. Paul Bennett, New York City Department of Environmental Protection; David Binning, Fairfax. County Water Authority; Frank Blaha, American Water Works Association Research Foundation; Peter Cook, National Association of Water Companies; Tom Curtis, American Water Works Association; Gregg Grunenfelder, Washington State Department of Health; Gerald Iwan, Connecticut Department ofPublic Health; Craig Jackson, New York State Department of Health; Bruce Larson, American Water Works Service Company; Vanessa Leiby, National Association of State Drinking Water Administration; Victor L' Esperance, Massachusetts Water Resource Authority; Jeff Mosher, Association of Metropolitan Water Agencies; Bridget O'Grady, Association of State Drinking Water Administration; Brian Ramaley, City of Newport News; Stephen Schmitt, American Water Works Service Company; Mic Stewart, Metropolitan Water District of Southern California; Ed Thomas, National Rural Water Association; Diane VanDe Hei, Association of Metropolitan Water Agencies; and Steve Via, American Water Works Association. This report was reviewed by a number of individuals chosen for their expertise relevant to this important topic. This peer review was conducted to help assure the highest possible quality report and to engage perspectives beyond those of the authors and the U.S. Environmental Protection Agency. We wish to thank the following for their contributions as reviewers of the report: Gregory B. Baecher, University of Maryland; Kenneth R. Bradbury, Wisconsin Geological and Natural History Survey; Gunther Craun, Gunther Craun & Associates; David Fries, University of South Florida; Jerome B. Gilbert, J. Gilbert Inc.; Richard G. Luthy, Stanford University; Dr. Christine 1. Moe, Emory University; David Spath, California Department of Health Services; and Rhodes Trussell, MWH, Inc. We also wish to acknowledge the role of the National Research Council's Water Science and Technology Board, especially that of its Director Stephen D. Parker, for the role played in helping to engage these experts and helping to facilitate the review. The reviewers provided many constructive comments and suggestions that were incorporated in the fmal report, but were not asked to endorse the report individually or on behalf of the National Research Council. The U.S. Environmental Protection Agency is responsible for the final content ofthe report. In addition, EPA would like to thank the following federal agencies and departments for their important contributions: Federal Bureau of Investigation, including the National Infrastructure Protection Center; Centers for Disease Control and Prevention; Central Intelligence Agency; Federal Food and Drug Administration; Lawrence Livermore National Laboratory; Sandia National Laboratory; Office of Homeland Security; US Army Corps of Engineers; US Bureau of Reclamation; US Departments of Defense; Health and Human Services; US Geological Survey; and USDA Rural Utilities Service. Finally, EPA appreciates the reviews, comments and contributions made by the National Governors Association, the National League of Cities, Jane's Information Group, Malcolm Piroie, Incorporated, and Michael Baker Jr., Incorporated. PREFACE The Environmental Protection Agency (EPA) has developed this Baseline Threat Information for Vulnerability Assessments of Community Water Systems to assist water utilities in conducting vulnerability assessments. While this report is not a vulnerability assessment tool, this document does present an overview of threats, methodologies, strategies, and responses for water utilities to consider when conducting these assessments. Additionally, as water utilities vary in their assets and system design, some elements of this document will not apply equally to all water systems. The primary objective ofthis document is to provide information for utility managers and their staffs to identify and evaluate vulnerabilities that could place the operation ofthe water utility, staff, and/or customers in harms way. The EPA recognizes that, because water systems vary in design and operations, the level of threat and types of risks also vary from system to system. In addition, technologies to protect systems continue to evolve and levels of threats and risks are dynamic. As these issues alter, utility managers should evaluate the need to periodically update their vulnerability assessments to properly manage these factors. Vulnerability assessments contain sensitive information that should be protected from inadvertent disclosure. Procedures should be established at the early stages of a vulnerability assessment to control sensitive information developed throughout the assessment process. It should be noted that this informational document does not cover the integration between a vulnerability assessment and an emergency response plan. However, EPA encourages utilities to] te (p",nM I incorporate the vulnerability assessment results into their emergency response plan. Also, EPAA'-has developed emergency response notification guidelines for water and wastewater facilities. More information is available on EPA's Web site at http://www.epa.gov.safewater/security. ii TABLE OF CONTENTS INTRODUCTION •••••n •••" •••n .....􀁾•••••u ••••••" ••n ..........n ...................................................................1 PuRPOSE .................................... .............u .......................................................u .........................U ••• 2 1.0 ASSESSING VULNERABILITIES 1.1 􀁌􀁾􀁔􀁒􀁏􀁄􀁕􀁃􀁔􀁉􀁏􀁎.................................... ......................................,.................... :2 1.2 WHAT ARE THE BASIC ELEMENTS OF VULNERABILITY ASSESSMENTS........ 2 1.3 EXAMPLES OF CURRENTLY AVAILABLE VULNERABILITY ASSESSMENT METHODOLOGIES AND TOOlS ........................................u .............................. 8 2.0 DETERMINING THE LEVELS OF THREAT 2.1 INTRODUCTION ............., .................... .....u ••••u .....................................................10 ..u 2.2 WHAT KINDS OF POTENTIAL ADVERSARIES SHOULD WATER SYSTEMS CONSIDER WHEN UNDERTAKING VULNERABILITY ASSESSMENTS? ............. 10 2.3 WHAT ARE SOME TYPICAL MOTIVATIONS MOTIVATIONS AND OBJECTIVES OF POTENTIAL ADVERSARIES? ............nn••' ............................................................ 12 2.3.1 WHAT DO TERRORISTS KNOW ABOUT WATER SYSTEMS? ............................ 12 2.3.2 WHAT TACTICS ARE TERRORIST LIKELY TO USE TO ATTACK WATER 2.4 HOW CAN UTILITIES OBTAIN MORE SPECIFIC, UP-TO-DATE INFORMATION ON THREATS? ............·...o.........u ...................................o.......... 15 2.4.1 OBTAINING LOCAL THREAT INFORMATION ................................... ..............15 2.4.2 NATIONAL RESOURCES FOR OBTAINING THREAT INFORMATION ................16 2..4.3 OTHER THREAT-RELA TED EFFORTS ................................................................. 18 3.0 MODES OF ATTACK FOR SYSTEMS TO CONSIDER WHEN ASSESSING VULNERABILITIES 3.1 INTRODUCTION .n••••u ............................................................u ••••••••••••••••••••••• 20 3.2 WHAT KINDS OF ATTACKS MIGHT RESULT IN PHYSICAL DAMAGE? ............20 3.2.1 SPECIAL CONSIDERATIONS FOR TOXIC CHEMICALS AND HAZARDOUS MATERIALS.............................u ................... ..u ........................0 .......................... 21 3.3 ATTACKSTHATCOULDRESULTINCONTAMINATlONOFWATER ................ 24 3.4 CYBER ATIACK ..................................................... .................................................. 30 3.5 ATTACK ON RELATED INFRASTRUCTURE ON WHICH THE WATER SYSTEM IS 􀁄􀁅􀁐􀁅􀁎􀁄􀁅􀁾􀁔􀀠..................................u ...............*....... ...........................................31 3.6 ADDITIONAL CONDSIDEAA TIONS .........􀁵􀀮􀁵􀁵􀁾􀁵􀀮􀁵􀁾􀀠32 ...u ............u ....u .......u .....Uu..... APPEND ICES ••􀁾..no...........uo......... ..00.......................u ........................00 ••0 ........no0 0 uo••0".'................ 33 REFERENCES ............n ......n ....􀁾􀁵...........................n .......u .................. ...........................................54 iii 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 BASELINE THREAT INFORMATION FOR VULNERABILITY ASSESSMENTS OF COMMUNITY WATER SYSTEMS INTRODUCTION On June 12, 2002, President Bush signed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Preparedness and Response Act) into law (PL 107-188). The Bioterrorism Preparedness and Response Act requires every community water system serving a population of greater than 3,300 persons to (1) conduct a vulnerability assessment (VA); (2) certifY and submit a copy of the assessment to the Administrator of the US 0t"dft Environmental Protection Agency (EPA) (within a specified schedule); and (3) prepare or revise ___ an emergency response plan (ERP) that incorporates the results of the vulnerability assessment and certifY to the EPA Administrator that the system has completed such a plan within 6 month ofcompleting the vulnerability assessment. The time frames for V As and ERPs are: 􀀭􀀭􀀭􀀭􀀭􀁾('Table 1 􀁾􀀬􀀠􀁾..... : Systems serving popUlation CertifY and submit V A by: ( CertifY ERP within 6 months • of: ofVA but no later than: 100 000 or greater March 31, 2003 September 30 2003 50,000 -99,999 December 31, 2003 I June 30 2004 3,301-49,999 June 30, 2004 \ December 31, 2004 􀁟􀀯􀁾􀀠􀁾􀁾􀀠Sec. 1433 (a)(5) of the Safe Drinking Water Act, as amended 􀁢􀁾􀁂􀁩􀁯􀁴􀁥􀁲􀁲􀁏􀁲􀁩􀁳􀁭􀀯􀀻􀁲􀁥􀁰􀁡􀁲􀁥� �􀁮􀁥􀁳􀁳􀀠and Response Act, instructs the EPA to develop protocols to protect the disclosure of submitted vulnerability assessments. Additionally, Sec. 1433 (aXl) of the Safe Drinking Water Act, as amended by the Bioterrorism Preparedness and Response Act, instructs the EPA to "provide baseline infonnation to community water systems required to conduct vulnerability assessments regarding which kinds of terrorist attacks or other intentional acts are the probable threats to: (A) substantially disrupt the ability ofthe system to provide a safe and reliable supply ofdrinking water; or (B) otherwise present significant public health concerns." Drinking water utilities today find themselves facing new responsibilities. While their mission has always been to deliver a dependable and safe supply of water to their customers, the challenges inherent in achieving that mission have expanded to new sectors of seeurity and counter-terrorism. In PL 107-188, Congress recognizes the need for drinking water systems to undertake a more comprehensive view ofwater safety and security, and set specific requirements to meet that objective. Utility managers and operators may need assistance to understand how to approach issues traditionally regarded to be the domain of law enforcement, for example, protecting their mcilities against vandalism or other ill-intended damage, or safeguarding I For Limited Distribution sensitive records and plans. It is in this new context that the information contained in this document is provided. PURPOSE This document provides the baseline threat information required by PL 107-188 and additional information to drinking water utilities to assist them in their efforts to: l Undertake risk-based vulnerability assessments of their assets (Section 1); • Analyze potential adversarial threats (Section 2); Consider potential modes of attack (Section 3); The report also provides references to resources for additional information. Information on security for water systems is evolving very quickly as the field receives increased attention and as new research and investment in technology yield useful results. EPA is committed to providing the latest information, as it becomes available. New information will be provided through the Water Information Sharing and Analysis Center (Water ISAC). See Section 2 for more information on the Water ISAC. 1.0 ASSESSING VULNERABILITIES 1.1 Introduction This section describes the basic assets of a vulnerability assessment and provides information on existing vulnerability assessment tools. The steps outlined below are appropriate to any size water system required to conduct a vulnerability assessment pursuant to PL 107-188. The vulnerability assessment process, however, will range in complexity based on the design and operation of the water system itself. These steps are conceptual in nature and not intended to serve as a detailed methodology. 1.2 What are the Basic Elements of Vulnerability Assessments? Vulnerability assessments help an organization evaluate susceptibility to potential threats and identify corrective actions that can reduce or mitigate the risk of serious consequences from adversarial actions. Such an assessment for a water system takes into account the vulnerability of the water supply (ground and surface), treatment, and distribution systems. It also considers risks posed to the surrounding community related to attacks on the water system. An effective vulnerability assessment serves as a guide to the water utility by providing a prioritized plan for security upgrades, modifications ofoperational procedures, andlor policy changes to mitigate the risks and vulnerabilities to the utility's critical assets. The vulnerability assessment provides a framework for developing risk reduction options and associated costs. Water systems should review their vulnerability assessments periodically to account for changing threats or additions to the system to ensure that security objectives are being met. Preferably, a vulnerability assessment is "performance-based," meaning that it evaluates the risk to the water system based on the effectiveness (performance) of existing and planned measures to counteract adversarial actions. For Limited Distribution 2 The nature and extent of the vulnerability assessment will differ among systems based on a number of factors, including system size, potential population affected, source water, treatment complexity, system infrastructure and other factors. Security and safety evaluations also vary based on knowledge and types of threats, available security technologies, and applicable local, state and federal regulations. Regardless of these complexities and nuances, the following are common elements of vulnerability assessments: I. Characterization of the water system, including its mission and objectives; 2. Identification and prioritization ofadverse consequences to avoid; . 3. Determination of critical assets that might be subject to malevolent acts that could result in undesired consequences; . 4. Assessment ofthe likelihood (qualitative probability) of such malevolent acts from adversaries; \ 5. Evaluation ofexisting countermeasures; and 􀁾􀀶􀀮􀀠Analysis of current risk and development ofa prioritized plan for risk reduction. Result in Vulnerability Assessment Process Elements of a Vulnerability Assessment • Characterization ofthe Water System • IdentifieatiODlPrioritization ofAdverse For Limited Distribution 3 Points to consider related to these six basic elements are included below. The manner in which the vulnerability assessment is performed is determined by each individual water utility. It will be helpful to remember throughout the assessment process that the ultimate goal is twofold: to safeguard public health and safety, and to reduce the potential for disruption of a reliable supply ofpressurized water. \. Characterization of the water system, including its mission and objectives. Answers to the following system-specific questions may be helpful in characterizing the water system. • What are the important missions ofthe system to be assessed? Define the highest priority services provided by the utility. Identify the utility's customers (e.g., public, government, military, industrial, critical care, retail operations, firefighters). • What are the most important facilities. processes. and assets of the system for achieving the mission objectives and avoiding undesired consequences? Describe the utility facilities, operating procedures, and management practices that are necessary to achieve the mission objectives. Describe how the utility operates (e.g., water source (including ground and surface water), treatment process, storage methods and capacity, chemical use and storage, and distribution system). In assessing those assets that are critical, consider critical customers, dependence on other infrastructures (e.g., electricity, transportation, other water utilities), contractual obligations, single points of failure (e.g., critical aqueducts, transmission systems, aquifers etc.), chemical hazards and other aspects of the utility's operations, or availability of other utility capabilities that may increase or decrease the criticality of specific mcilities, processes and assets. 2. Identification and prioritization of adverse consequences to avoid. When considering adverse consequences, the water system should take into account the impacts that could substantially disrupt the ability of the system to provide a safe and reliable supply of drinking water or otherwise present significant public health concerns to the surrounding community. In general, water systems should use the vulnerability assessment process to determine how to reduce risks associated with the consequences of significant concern. For Limited Distribution 4 Ranges of consequences or impacts for each of these events should be identified and defined. Factors to be considered in assessing the consequences may include: magnitude of service disruption; economic impact (such as replacement and installation costs for damaged critical assets or loss of revenue due to service outage); number of illnesses or deaths resulting from an event; impact on public confidence in the water supply; chronic problems arising from specific events; or other indicators of the impact of each event as determined by the water utility. Risk reduction recommendations at the conclusion of the vulnerability assessment should strive to prevent or reduce each of these consequences. 3. Determination of critical assets that might be subject to malevolent acts that could result in undesired consequences. • What are the malevolent acts that could reasonably cause undesired consequences? Consider the operation of critical facilities, assets andlor processes and assess what an adversary could do to disrupt these operations. Such acts may include physical damage to or destruction of critical assets, contamination of water, intentional release of stored chemicals, interruption of electricity or other infrastructure interdependencies. • Regarding water system vulnerabilities and determination of critical assets, PL 107-188 specifies that the utility should review the potential for physical damage to the water system's infrastructure, including: • Pipes and constructed conveyances • Physical baniers • Water collection, pretreatment and treatment • Storage and distribution facilities • Electronic, computer or other automated systems that are utilized by the public water system (e.g., Supervisory Control and Data Acquisition (SCAD A)) • The use, storage, or handling of various chemicals • The operation and maintenance of such systems Section 3 provides more information on the methods by which terrorists may attack systems. 4. Assessment of the likelihood (qualitative probability) of such malevolent acts from adversaries (e.g., terrorists, vandals). Based on the critical assets of the water system, one can determine the possible modes of attack that might result in consequences ofsignificant concern. However, the objective of this step of the assessment is to move beyond what is merely possible and determine the likelihood of a particular attack scenario. This is a very difficult task as there is often insufficient information to determine the likelihood of a particular event with any degree of certainty. For Limited Distribution 5 The threats (the kind of adversary and the mode of attack) selected for consideration during a vulnerability assessment will dictate, to a great extent, the risk reduction measures that should be designed to counter the threat(s). Some vulnerability assessment methodologies refer to this as a Design Basis Threat (DBT) where the threat serves as the basis for the design of countermeasures, as well as the benchmark against which vulnerabilities are assessed. It should be noted that there is no single DBT or threat profile for all water systems in the United States. Differences in geographic location, size of the utility, previous attacks in the local area and many other factors will influence the threat(s) that water systems should consider in their assessments. From this perspective, water systems should consult with the local FBI and/or other law enforcement agencies, public officials, and others to determine the threats upon which their risk reduction measures should be based. Section 2 provides more information on threats (potential adversaries and modes of attacks) that water systems should consider during the vulnerability assessment process and mutual assistance arrangements that some utilities have initiated. Utilities may also want to review their incident reports to better understand past breaches of security. 5. Evaluation ofexisting countermeasures. Having determined how various critical assets, processes, and operations are related to the system's mission and the potential for malevolent actions to cause adverse consequences, the effectiveness of existing security measures and operational practices should be considered. Depending on countermeasures already in place, some critical assets may already be sufficiently protected. This step will aid in identification of the areas ofgreatest concern, and help to focus priorities for risk reduction. • What capabilities does the system currently employ (or detection. delay and response? IdentifY and evaluate current detection capabilities such as intrusion detection systems, water quality monitoring, operational alarms, guard post orders, and employee security awareness pmgrams. IdentifY current delay mechanisms such as locks and key control, fencing, structure integrity of critical assets and vehicle access checkpoints. IdentifY existing policies and procedures for evaluation and response to intrusion and system malfunction alarms, adverse water quality indicators, and cyber system intrusions. It is important to determine the performance characteristics. Poorly operated and maintained security technologies provide little or no protection. • What cvber protection system features does the utility have in place? Assess what protective measures are in-place for the SCADA and business-related computer information systems such as firewalls, modem access, Internet and other external connections, including wireless data and voice communications, and security policies and protocols. IdentifY whether vendors have access rigbts and/or "backdoors" to conduct system diagnostics remotely. • What security policies and procedures exist. and what is the compliance record fOr them? IdentifY existing policies and procedures concerning personnel security, For Limited Distribution 6 physical security, key and access badge control, control of system configuration and operational data, chemical and other vendor deliveries, and security training and exercise records. 6. Analysis of current risk and development ofa prioritized plan for risk reduction. The information gathered on threat, critical assets, water utility operations, consequences, and existing countermeasures should be analyzed to determine the current level of risk. The utility should then determine whether current risks are acceptable or risk reduction measures should be pursued. Recommended actions should measurably reduce risks by reducing vulnerabilities and/or consequences through improved deterrence, delay, detection, and or response capabilities or by improving operational policies or procedures. Selection of specific risk reduction actions should be completed prior to considering the cost of the recommended action(s}. Utilities should carefully consider both short-and long-term solutions. An analysis ofthe cost of short-and long-term risk reduction actions may impact which actions the utility chooses to achieve its security goals. Utilities may also want to consider security improvements in light of other planned or needed improvements. Security and general infrastructure may provide significant multiple benefits. For example, improved treatment processes or system redundancies can both reduce vulnerabilities and enhance day-to-day operation. Generally, strategies for reducing vulnerabilities fall into three broad categories: I} sound business practices, 2) system upgrades, and 3) security upgrades. Sound business practices affect policies, procedures, and training to improve the overall security-related culture at the drinking water facility. For example, it is important to ensure rapid communication capabilities exist between public health authorities and local law enforcement and emergency responders. System upgrades include changes in operations, equipment, processes, or infrastructure itself that make the system fundamentally safer. Security upgrades improve capabilities for detection, delay, or response. For Limited Distribution 7 1.3 .' ,', ·R.􀁾􀀼􀁥􀀬􀁒􀀡􀁾􀁻􀁀􀀬􀁾􀀻􀁊􀁾􀁜􀀺􀁩􀀩􀀨􀀧􀁩􀀻􀁴􀁬􀂥􀀮􀁊􀁬􀁯􀀯􀁴􀁾􀁾􀀬􀀻􀀬". . Have You Already Improved Security? Consider Whether These Strategies Apply To You. Sound Business Practiees ,: " . • Adopt securitY as anintegrai part of overall operations; • Develop policies 􀁾􀁤􀁰􀁲􀁯􀁣􀁥􀁤􀁵􀁲􀁥􀁳􀀬􀀠tiainandtesiemployeeS on them; . .... . • .' Put 􀁳􀁯􀁭􀁾􀁮􀁥􀀠in charge of impiementmg an eft"ectivesecUriijpi'ogram; ........... . .... " .•... • .' Review and revise emergency ,esponse plariS-drill, diill, drill; .. ,.' .'. '. ..Cooperate with adjacent utilities or regional utility networks; :.. ' " . System Upgrades " . Eliminate 􀁳􀁩􀁮􀁧􀁬􀀨􀀺􀀻􀀮􀁰􀁯􀁩􀁮􀁴􀁳􀁾􀁯􀁦􀀭􀁦􀁡􀁩􀁬􀁵􀁲􀁥􀀻􀀠. ;.·Store back-up equipment off-site. in a secure location;, . " . Develop 􀁢􀁡􀁣􀁫􀁾􀁵􀁰􀀠systems;',. . . . ....... • . . ".Reduce risks from hljZar40us chemicals; or .. ' . " . '. Optimize treatment;'. . '. . • . '. . . . ," . . ,'􀁾􀁾􀁣􀁵􀁲􀁩􀁴􀁹 􀀠Upgrades ."... ' Employ 􀁤􀁾􀁴􀁥􀁣􀁴􀁩􀁯􀀮􀁮􀀠􀀼􀀡􀁾􀁽􀀧􀁾􀁣􀁥􀁳􀀠􀀠􀁴􀁨􀁾􀀻􀀠􀁣􀁨􀁬􀁉􀁄􀁬􀁣􀁩􀁥􀁾􀀮􀁴􀁨􀁥􀁾􀁴􀁲􀁕􀁾􀁩􀁯􀁮􀀭􀀺􀀭􀀬􀀬􀀬􀀬􀁨􀁯􀀠people, Wlthwhateqmpment. ..'.,' ..... .• Use physicalbarrleisjo delay intrugers 􀀨􀁥􀀮􀁧􀀮􀀻􀁤􀁯􀁏􀁲􀁓􀀬􀀬􀀬􀁡􀁬􀁊􀁬􀂷􀁴􀁓􀂷􀀻􀁪􀁖􀁾􀁉􀀬􀁬􀁬􀀡􀀻􀁴􀀨􀁦􀀺􀁾􀁾􀁾􀁤􀁾􀁾􀀧􀁜􀀡􀁪􀁾􀁾􀁾􀁲􀁾􀁾􀀡􀀺􀁣􀀧􀁦separation betW'eerl assets). . . ..... .' '. "j; 􀁎􀀺􀀾􀀧􀀻􀁾􀀠" 'Establish contacts and agreements with local law 􀁥􀁮􀁊􀁦􀁏􀁲􀀨􀁩􀁥􀁬􀁉􀁬􀁥􀁮􀁬􀁡􀀡􀀺􀁬􀁩􀀺􀁌􀀬􀁾􀁭􂂬􀁩􀁲􀁅􀀨􀀺􀁮􀁥􀁹􀁮􀁾􀁾􀁪􀀠 officials to ensure minimal 􀁲􀁥􀁳􀁰􀁯􀁾􀁥􀁴􀁩􀁭􀁥􀁳􀀮􀀺􀀮􀂷􀀠....... 􀂷􀀮􀀺􀀼􀀮􀀻􀁩􀂷􀀼􀁾􀀻􀀻􀀧􀀬􀂷􀂷􀀮\S.·.:e·:􀀺􀀻􀀻􀁾􀁴􀀻􀀠 , 'f; ,.".1 '_,': :.j ",,' r '. 􀀺􀁾􀀺􀀮􀀭􀀻􀀠':':/.',jJ 􀀧􀀮􀁾􀀻􀀠....j.,:....􀀧􀁟􀁾􀀬􀀠', ' ,:"'z"':" ..􀁴􀀮􀀻􀁾􀀻􀀬􀀠􀀬􀀮􀀬􀀭􀀮􀁾􀀺􀀺􀀻􀀯􀀻􀀧􀀬􀀻􀀬􀁾􀁫􀀺􀀮􀀻􀂷􀀮􀂷􀀧􀀻􀀬􀀺􀁾􀁾􀀻􀀮􀁲􀀮􀁾􀁾􀁾􀁍􀀻􀀻􀀻􀀬􀀮􀀺􀁾􀁩􀁾􀀺􀁾􀁾􀁾􀁾􀁾􀁴􀀴􀁪􀀿􀀻􀁻􀀻􀀬􀁾􀁾􀁴􀁾􀁾􀁾􀁪􀁾􀀮􀀢􀀮􀀺􀀻􀁾􀀡􀀢􀀧􀀺􀂷􀀧􀁃􀀬􀁜􀂷􀀬� �􀀬􀀻􀀬􀀬􀀧􀂷􀀺􀀮􀀬􀀮􀀢􀀧􀂷􀀺􀀺􀀬􀂷􀀺􀀠Examples of Currently Available Vulnerability Assessment Methodologies and Tools A number of methodologies and tools have been developed or are being refined to aid water utilities in performing vulnerability assessments and understanding risk and risk reduction. Several of these are nationally available and are identified below. Water systems are also encouraged to consult with their state drinking water primacy agency to obtain additional information and to determine whether any specific state requirements apply. • Sandia National Laboratory, under an Interagency Agreement between EPA and the Department of Energy, has tested and provided training on a methodology known as Risk Assessment Methodology for Water Utilities (RAM-W). RAM-W was developed in For Limited Distribution 8 cooperation with the American Water Works Association Research Foundation (AwwaRF), EPA, and municipal water utilities. This security risk assessment methodology is very comprehensive and covers most aspects of water utility operations. It was designed for large drinking water utilities. Extensive fault-trees are used throughout the analysis to assist the water utility in systematically assessing the vulnerabilities to malevolent attack. The results provide the water utility with a prioritized list of relative risks to be considered for system andlor security upgrades. Version 2, expected to be available in late September 2002, will include both physical and cyber security assessment tools. A list of firms selected as trainers on RAM-Wand more information is provided at: http://www.epa.gov/safewaterlsecuritylsandia training.pdf. • VSAT, the Vulnerability Self-Assessment Tool was completed July 2002 for wastewater systems, and is under development for drinking water utilities. The current version provides a comprehensive, easy-to-use CD-ROM package for wastewater utility professionals seeking to: 1) assess their utilities' vulnerabilities; 2) determine potential solutions for the prioritized vulnerabilities; and 3) develop priorities for security improvements based on cost and feasibility. The software tool, created with support from EPA, makes this process possible for the full suite of potential utility assets subject to a crisis event, including the physical plant, employees, information technology, communications, and utility customers. The drinking water system version will be available and distributed free of charge to drinking water utilities. Expert assistance will be provided through an on-line help desk. The tool will support vulnerability assessments at all size facilities. More information is available at http://www.VSATusers.neti • Water System Security: A Field Guide was developed by the American Water Works Association (A WWA). Managers and operations personnel of small-to medium-sized water utilities will find this guidebook helpful as they assess and upgrade the physical and operational security of their systems. It covers emergency preparedness plans; vulnerability assessments; mitigation measures for critical assets; emergency response and recovery; and crisis communications. More information is available at http://www.awwa.org!. • The Security Vulnerability Self-Assessment Guide, a result of collaboration among the Association of State Drinking Water Administrators (ASDWA), the National Rural Water Association (NRWA) with consultation from EPA, is designed for drinking water systems serving fewer than 3,300 people. The guide helps these systems assess critical assets and identify security measures. More information is available at http://www.asdwa.org!. • The National Drinking Water Clearinghouse (NDWC) at West Virginia University is a public service organization that collects, develops, and distributes timely drinking water related information. Sponsored through the U.S. Department of Agriculture's Rural Utilities Service (RUS), the EPA, NDWC provides technical assistance to America's smsll and rural drinking water treatment plants. NDWC intent is to educate governing boards and system personnel, help them prepare emergency plans, and find sources of more information. More information is' available at http://www.nesc.wvu.edul, For Limited Distribution 9 2.0 DETERMINING THE LEVEL OF THREAT 2.1 Introduction Due to recent events, potential terrorist actions are of serious concern to water utilities. People with many different motivations, both external (outsiders) and those internal (insiders) to the water utility, might intend to harm a water system or neighboring communities. Even those who are not considered to be highly skilled (e.g., vandals) may create a situation that terrorizes the community. While many kinds of threats are possible, depending on local circumstances and the nature of a specific water system, some may be more likely than others. Attacks on water systems might be undertaken by a variety of people with different motivations and objectives. Determining who poses a threat is the first step in determining the level of threat. In general, domestic terrorist groups tend to act locally and therefore, it is critical that water utility managers become aware of such groups. Likewise, when undertaking a vulnerability assessment, water systems should consider a full range of potential adversaries and, with assistance from law enforcement agencies and FBI officials, attempt to identify those that might be ofparticular concern for their facility. This section provides information on the kinds of adversaries that might attack a water system and what their motivations and objectives might be, as well as actions underway to help water systems learn more about the threat they face and how to improve coordination with law enforcement. 2.2 What Kinds of Potential Adversaries Should Water Systems Consider when Undertaking Vulnerability Assessments? There are two categories of potential adversaries (outsiders and insiders) that water systems should consider when attempting to determine the threat level for their particular facility. Outsiders could include: • Vandals; • Criminals; • Disgruntled researchers; • Computer hackers ofvarious skill levels; • Domestic terrorists; or • International terrorists. Insiders could come from the ranks of: • Disgruntled employees; • Contractors with access privileges; or • Vendors. Collusion can occur between any of the insider and outsider categories. Insiders and outsiders may employ the same or similar tactics. They might attempt to physically attack assets For Limited Distribution 10 (including employees), hack into the cyber systems, or contaminate the water by affecting the treatment processes or injecting a contaminant. The goal may not be to have a long-term effect on the water utility, but to disrupt water supply so they can attempt some other malicious act. The insider, often a disgruntled employee or former employee, may be of special concern because they could have detailed knowledge ofa system. Resources available to the attacker might include personnel, equipment, access to agents, and knowledge of the system, all of which determine the level of sophistication of an attack. The level of support available to the attacker wil1 have a significant impact on the available resources. For .example, a disgruntled employee may have intimate knowledge of the system, but would presumably not have access to biological warfate agents. On the other hand, a well funded/supplied terrorist may have the resources and access necessaty to develop, purchase, or steal biological warfare agents. Table 2.1 provides examples of the resources that might be available to various adversaty categories. .T bl e 21 ExamD1CSI 0 fResonrces AvaiIabl t Site ec ed Ad versanaI C ateeorlesa . e 0 .. Adversary I . Personnel Equipment Access to' Knowledge I Contaminants 2 1 to 3 untrained Basic hand tools, CommerciallyVandal Minimalindividuals firearms available chemicals :Work crew I untrained Disgruntled Commercially Detailedequipment,individualemployee or knowledge ofavailablepumps, on-site (unless working contractor chemicals and systemhazatdouswith outsider) treatment chemicals Possible insider chemicals Tools, pumps, Domestic Bulk quantities collusion, public Team of I to 6 terrorist flIeatms, of restricted toxic informationindividualsorganization explosives chemicals previously i available Biotoxins, toxic Some system-Disgruntled I skilled Lab equipment, chemicals and specificresearcher individual tools and pumps purified or crude information atho ens International terrorist organization Teamofl to 6 skilled individuals Note: Tools, pumps, firearms, explosives Chemical and biological warfare agents Possible insider collusion, public information previously available 1. Any ofthese groups might pose a cyber threat. 2. The listed contaminants represent the most harmful and/or restricted substance that the adversary would have access to. Any adversary is also presumed to have access to less harmful contaminants. For Limited Distribution 11 2.3 What are Some Typical Motivations and Objectives of Potential Adversaries? Depending on the kind of aggressor, motivations may vary widely. A vandal, for example, might not really intend to hann the drinking water facility. Rather, he or she might have another more general goal in mind (e.g., malicious mischief, minor damage or disruption). Some typical examples of vandalism are destruction of locks and windows to gain unauthorized access and spray painting ofgraffiti. Vandalism becomes a serious problem when the operators of a water utility determine that unauthorized entry has occurred, but the objective of the perpetrators is unknown or uncertain. Then, the utility should investigate to detennine whether the incident has created a dangerous situation. In some cases, utilities may have to shut down portions of their systems or notifY the public not to drink the water until final determinations can be made. In such situations, the vandals have raised significant concerns in the community, not unlike the concerns raised by a terrorist action. Terrorists, on the other hand, are likely to try to use the water system to achieve broader objectives in response to American political or social policy and/or practices. These might include causing widespread fear and panic by: • Creating an adverse impact on public health within a population; • Disrupting system operations and interrupting the supply of safe water; • Causing physical damage to system infrastructure; • Reducing public confidence in the water supply; or • Long tenn denial of water and economic hardship due to remediation efforts resulting from a successful contamination attack. Terrorists may be dedicated to studying the utility, gathering background infonnation, using the utility's assets as weapons, and working in multiple groups to attack multiple locations. Some may be willing to kill and be killed, as such; they are our most dangerous adversaries. Those people with detailed knowledge of a specific facility and its operations may pose some of the the most serious threats to a water system. Motivations of such people may include revenge or the venting of anger manifested because of a real or imagined problem; financial gain (bribery or other criminal activity); or sympathy for the motivation or objectives of outsiders. In addition, it is not inconceivable that an insider could be "planted" by a terrorist organization for the specific purpose of becoming an insider to collude with outsiders. 2.3.1 What do Terrorists Know about Water Systems? It is safe to assume that terrorist groups know infonnation about a water utility that was readily available through the Internet, periodicals, utility flyers, design drawings, plans distributed during a bidding process, and calls to fucilities, whether or not the infonnation has been secured since September 11, 200 I. This infonnation might include: plant capacity, methods of treatment (including disinfection), source water intake, conveyance and distribution system location, and For Limited Distribution 12 chemical analytical capabilities. Terrorists might also have detailed knowledge through collusion with disgruntled insiders. Table 2.2 summarizes a terrorist's approach to target selection, what terrorists like and do not like to see during reconnaissance activities and questions that they may be asking themselves as they review potential targets. Drive past the target once time take a more detailed look to answer questions such as: • How close can we get without arousing suspicion? • Can we get in here at night? • Can we drive straight inlup to the target during the mission? • Is this target easy to exploit? An Inquisitive take a great interest in the fact that you are water For Limited Distribution 13 2.3.2 What Tactics are Terrorists Likely to Use to Attack Water Utilities? Statistics indicate that the vast majority of terrorist attacks worldwide continue to be perpetrated with conventional weapons such as explosives. From existing data, it appears that the likelihood of a water utility being bombed is greatest, followed in likelihood by chemical, biological, cyber, and nuclear/radiological attacks. There is, however, a disturbing trend towards heightened interest in chemical and biological warfare agents. These high profile, high-impact warfare agents are often referred to as Weapons of Mass Destruction (WMD). WMD cases primarily dealing with the threatened use or procurement ofchemical, biological, or radiological materials with intent to harm, have shown a steady increase since 1995. Most of these cases have involved hoaxes rather than actual use ofa WMD. Work is ongoing to create a centralized and informative list of security events that have already taken place at drinking water utilities under an AwwaRF-sponsored project. It is expected that this information will be available to the Water Information Sharing and Analysis Center (discussed in Section 2.4.2) for threat analysis purposes. Currently over 150 security events have been identified, but experts believe that this represents only a fraction of the total of all security events that have taken place at water utilities in the recent past. In any case, this list of events is very informative. The majority of these events are trivial, trespass or common vandalism cases, or may not even have been a "security" event at all. However, there are also a number of security events that have been identified of a very serious nature, and these events cover the full range of possible attacks on a water utility. There are already examples of threatened intentional contamination of drinking water, including examples where the perpetrators were accumulating the means to follow through on this threat and even succeeded in contaminating the water, physical disruption of the drinking water supply, the use of explosives against utility structures, cyber attacks on a utility including remote operation of SCADA-controlled facilities, and threats/attacks on drinking water utility personnel. A number of the more serious events involved or are suspected to have involved disgrnntled utility personnel, a number of the events involved criminals, and some of the events involved people and groups that can clearly be defined as "terrorists." The kind of adversaries and tactics to consider during a vulnerability assessment is a decision to be made by the utility. Given that utilities will want to avoid the consequences of significant concern (described in Section 1.2) and the fact that the majority of terrorist attacks to date have employed conventional weapons, systems may want to focus on protecting single points of failure and improving security for toxic chemical and hazardous materials storage facilities. To address contamination threats, utilities should also consider enhancing water quality monitoring to aid in assessing the presence of possible contaminants in source and/or treated water and the potential benefit(s) of adding real-time analytical capabilities for chemical, biological and/or radiological contaminants. (See Section 3 for more information on the contamination threat). For Limited Distribution 14 2.4 How Can Utilities Obtain More Specific, Up-to-date Information on Threats? Obtaining infonnation on threats is critical for a utility performing a vulnerability assessment. Utilities should communicate with local, state, and federal agencies who may advise them on local and general threat considerations. Obtaining general infonnation on threats may also be useful to systems in assessing threats to be considered as a part of the vulnerability assessment. The following infonnation is provided to assist systems in the threat detennination process. 2.4.1 Obtaining Local Threat Information Local Law Enforcement Local law enforcement agencies are a valuable resource for obtaining local threat infonnation. Local agencies, such as municipal, county and/or state police, can provide infonnation relevant to local criminal activity trends and arrest data; such as the number of crimes reported to police, crime rates and arrests by age group, number, and types of offenses (violent, property, etc.). Federal Bureau oflnvestigation (FBI) The FBI is the lead federal agency for investigating terrorist acts that include the intentional release of a weapon of mass destruction (WMD), defined as high-impact warfare agents (chemical, biological, radiological, nuclear or high explosive devices). The FBI aggressively investigates any threat or incident believed to be an act of terrorism. Consequently, the FBI aedcan be an important source of infonnation on threats. The FBI has designated a WMD Coordinator in each of the 56 field offices. The primary responsibilities of the coordinators are to establish liaison with the federal, state and local response communities, and other incidentspecific responders, such as water utilities. In the case of an incident, WMD Coordinators also serve as the FBI representative for operational support, ensuring that a criminal investigation is properly perfonned and prosecuted. Most FBI offices also have a Critical Infrastructure Protection (CIP) Coordinator that is responsible for communicating with municipalities and private industry on infrastructure protection matters. Utilities should establish close relationships with their local FBI WMD and CIP coordinators. These people are important resources for up-te-date and system-specific infonnation on threats to be considered during a vulnerability assessment. Your local FBI office can be located by visiting http://www.fbi.gov/contactlfo/info.htm. EPA Criminal Investigation Division (EPA CID) As the subject matter expert in the investigation of criminal acts involving or impacting drinking water, wastewater treatment, hazardous materials, toxic substances, or other environmental media, EPA CID works closely in support of the FBI Weapons of Mass Destruction Operations Unit and other response elements within the federal law enforcement community. During a response to a suspected act of terrorism, particularly those involving drinking water and For Limited Distribution 15 wastewater critical infrastructure, EPA cm would respond accordingly in support of the FBI. EPC CID can also provide support for assessments of the potential threats for drinking water facilities. EPA cm currently has approximately 200 Special Agents located across the country in 15 area offices and 29 resident offices. One of the responsibilities of the Special Agents is to establish liaison with the federal, state and local response communities, as well as the quasi-govemmental communities that provide critical services, which EPA regulates. Certain designated Special Agents also serve as a liaison to the FBI sponsored Joint Terrorism Task Forces, U.S. Attorney's Offices Anti-Terrorism Task Forces, and EPA sponsored Environmental Crimes Task Forces. Through these organizations and others where EPA cm plays a key participatory role, EPA cm can provide assistance to drinking water utilities during vulnerability assessment process. For more information regarding the Criminal Enforcement Program's support to homeland security, visit http://www.epa.gov/compliance/criminalfhomelandsecurity/index.html Local Emergency Planning Committee (LEPC) Another source of local threat information, as well as information on emergency response planning, may be your Local Emergency Planning Committee (LEPC). The Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA) called for the establishment of local emergency planning committees (LEPCs). LEPCs have broad-based membership with responsibility to develop comprehensive emergency plans for their communities. There are now more than 3,500 LEPCs, and they reflect the diversity of our country. Most LEPCs are organized to serve a county; some are for a single large city; others cover the better part of an entire state. You can find the LEPC for your location at http://www.epa.gov!ceppollepclist.htm. 2.4.2 National Resources for Obtaining Threat Information The Water Information Sharing and Analysis Center (ISAC) The Water Information Sharing and Analysis Center, or Water ISAC, will playa critical role in communicating security information to water and wastewater utilities. The Association of Metropolitan Water Agencies (AMWA) is developing the Water ISAC with funding assistance from EPA. The mission ofthe Water ISAC is to provide water and wastewater utilities a secure forum for gathering, analyzing, and sharing security-related information. The ISAC will provide utilities timely, useable information that will support their efforts to protect our nation's critical water infrastructure. The Water ISAC will provide the following: -Alerts ofpotential and actual physical or cyber attacks; -Access to inforrnstion from the FBI, EPA, CDC, intelligence agencies and other federal agencies; -Information on chemical, biological and radiological agents; -Information on physical vulnerabilities and security solutions; Notification ofcyber vulnerabilities and technical fixes; For Limited Distribution 16 Research, reports and other information; -A secure mechanism to report security incidents; Access to vulnerability assessment tools and resources; Emergency preparedness and response resources; An electronic bulletin board and other forums on security topics; Summary of open-source security information; and Information on security products and services. Although this document was made available through the Water ISAC, it is expected that regular operation will begin in December 2002. National Infrastructure Protection Center The National Infrastructure Protection Center (NIPC), located in the FBI's headquarters building in Washington, DC, brings together representatives from the FBI, other US government agencies, state and local governments, and the private sector into a partnership to protect US critical infrastructures. Established in February 1998, the NIPC's mission is to serve as the US government's focal point for threat assessment, warning, investigation, and response for threats or attacks against our critical infrastructures. These infrastructures include telecommunications, energy, banking and finance, water systems, government operations, and emergency services. More information about the NIPC is available at http://www.nipc.gov/aboutlabout.htm InfraGard InfraGard is an information sharing and analysis effort serving the interests and combining the knowledge base of a wide range of members. At its most basic level, InfraGard is a cooperative undertaking between the U.S. Government (led by the FBI and the NIPC) and an association of businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of the United States' critical infrastructures. All InfraGard participants are committed to the proposition that a robust exchange of information about threats to, and actual attacks on, these critical infrastructures is an important element for successful infrastructure protection efforts. The goal of InfraGard is to enable that information flow so that the owners and operators of infrastructure assets can better protect themselves, and so that the U.S. government can better discharge its law enforcement and national security responsibilities, InfraGard is organized into 56 sections each associated with a field office of the FBI. More information is available at http://www.fbi.gov/contactlfo/info.htm The Water Critical Infrastructure Protection Advisory Group Under Presidential Decision Directive 63 issued in 1998, federal agencies are required to work with private sector counterparts to protect the nation's critical infrastructure from terrorist attacks. EPA was given the lead for the water sector and EPA appointed Association of Metropolitan Water Agencies as the private sector lead. In January 2000, AMWA formed the Critical Infrastructure Protection Advisory Group (CIPAG), comprised of representatives from water utilities and related organizations, to advise them in this role. The CIPAG provides an For Limited Distribution 17 important forum for discussing all aspects of water sector critical infrastructure protection. More information is available at http://www.amwa.netlisaclwatercipag.html U.S. Environmental Protection Agency (USEPA) The USEPA's Office of Water hosts a Water Security Web site located at hltp:!lwww.epa.gov/safewaterlsecurity!. Itcontains infonnation on: • Financial assistance, including Federal Grants for Large Drinking Water Utilities; • Training opportunities including workshops and Web-cast seminars; • Tools to aid in development of vulnerability assessments and emergency operation plans; • Infonnation sharing through the Infonnation Sharing and Analysis Center under development; • Research and technology initiatives; and • Links to other sources of infonnation. For more infonnation about other EPA efforts on terrorism preparedness and response, go to www.epa.gov/swercilPp/cntr-ter.htmJ. Centers for Disease Control and Prevention (CDC) The Centers for Disease Control and Prevention hosts a Web site on Public Public Health Emergency Preparedness and Response, located at http://www.bt.cdc.gov. The site provides infonnation on biological and chemical agents, radiological emergencies, whom to contact in the event of bioterrorism emergency. It includes fact sheets, CDC health alerts, advisories, and updates. Site topics include preparation and planning, emergency response, and training. 2.4.3 Other Threat-Related Efforts Interagency Efforts to Better Understand the Contamination Threat In the fall of 2001, several federal agencies with expertise in drinking water protection and weapons ofmass destruction undertook an assessment of the state of knowledge on contamioants that could be used to threaten drinking water supplies. The analysis focused on the characteristics of agents, detection technologies, analytical methods, laboratory capacity, and treatment effectiveness. Besides fonning the basis for the infonnation conceruing the contamination threat contained within this document, this analysis supports several ongoing ioitiatives to improve infonnation on drinking water protection from intentional contamination. Products under development include: • A database on contaminant characteristics to be accessible to emergency responders on a 24hours per day/7 days a week basis; • Monitoring guidance; For Limited Distribution 18 • Compendium ofanalytical methods and laboratory capabilities; and • Research to fill information gaps; As these products are completed, additional information will be provided to drinking water utilities through the Water ISAC and other appropriate means. Office of Homeland Security (OHS) Advisory System As part of a series of initiatives to improve coordination and communication among all levels of govermnent and the American public in the fight against terrorism, President Bush signed directive creating the Homeland Security Advisory System (HSAS). The advisory system provides the foundation for building a comprehensive and effective communications structure for the dissemination of information regarding the threat and risk of terrorist attacks to all levels of govermnent and the American people. For more information on how a consortium of utilities have adapted this system for water utilities, see Appendix A of this document. State Support Both State drinking water agencies and emergency response officials may have significant expertise and resources to assist utilities in vulnerabilitity assessment, security improvements and emergency preparedness. Utilities are encourage to consult with appropiate State officials. Utility Partnership -Mutual Aid Some utilities have formed partnerships to assist each other with emergency response and other security issues. These may be especially beneficial for information sharing, working with the intelligence community and providing support during emergencies. As an example, information on an existing partnership can be found at http;//www.calwam.org. For Limited Distribution 19 3.0 MODES OF ATTACK TO CONSIDER WHEN ASSESSING VULNERABILITIES 3.1 Introduction Just as drinking water systems vary in design, the kinds of attacks that could result in significant loss or consequences also vary. Water systems should consider the entirety of the system when assessing vulnerabilities. In general, there are four categories or modes of attack to consider when undertaking a vulnerability assessment of a drinking water system. These are: • Physical damage or destruction ofcritical assets, including intentional release oftoxic Chemicals; • Actual or threatened contamination ofthe water supply; • Cyber attack on information management systems (e.g., SCADA) or other electronic systems; and • Interruption of services from another infrastructure. When determining the types of attacks that are most problematic to the particular facility it is important to keep in mind both the Consequences ofSignificant Concern (discussed in Section I) and the particular characteristics of the system being assessed. It may be that some of the consequences are not possible, or are highly unlikely, due to the design of the system. For example, there may not be significant quantities of toxic chemicals on-site. Also, it may be determined that the countermeasures already in place at the utility will reduce risks sufficiently to eliminate a consequence of significant concem. The remainder of this section provides general information on the four primary types of attack to consider. Potential Consequences of Significant Concern That Could Resultfrom an Attack on Critical Physical Assets • Loss of supply of 􀀧􀁩􀁷􀁥􀁳􀁳􀁬􀁾􀁾􀁥􀀬d,water or potable 􀀿􀁾􀁩􀁬􀁴􀂢􀁊􀀻􀁓� �􀁩􀁬􀁐􀁰􀀧􀁝ly' for a significant , 􀁾􀁮􀁾􀀧􀁩􀁔􀂷􀁲􀁩􀁩􀀧􀁴􀁬􀁬􀀬􀁰􀀮􀀧􀁓􀁪􀀱􀁓􀀱􀂢􀁭􀀧􀀠' ' 􀁾􀀧􀁈􀁬􀁐􀁮􀀺􀁧􀀳􀁾􀀧􀁉􀁩􀀧􀁮'lass of ' 3.2 What Kinds of Attacks Might Result in Physical Damage? Physical attacks on source water(s), water treatment plants and distribution systems could take various forms. Damage to critical impoundments and conveyances, treatment plant processes, or pumping facilities could interfere with the utility's capability to produce safe, pressurized water for consumption flfefighting and other uses, A physical attack targeting toxic chemicals or hazardous materials stored on-site could cause a release of toxic fumes into the environment, a fife, or an explosion. Any water system asset could conceivably be a target for physical damage or destruction, however, not all parts of a system's infrastructure are equally vulnerable or crucial to the mission of the system. During a vulnerability assessment, each critical asset should be identified and described, and potential points of vulnerability identified, For Limited Distribution 20 In particular, water systems may want to examine the vulnerabilities associated with physical damage to intakes, pumps, storage tanks, impoundments (including associated valves and gates), non-redundant transmission lines, electrical supply, and treatment facilities (especially the storage of toxic chemicals and other hazardous materials used in treatment processes). Some key points to consider are: • The design of the system's physical assets, especially considering whether there IS sufficient redundancy or if there are any single points of failure; • The accessibility of critical assets, the loss of which could cause system failure; and • The availability of areas where explosives or other destructive means could be used in order to successfully disrupt the water system operations or create unsafe conditions (e.g., cause a release of toxic chemicals). The mode of attack will likely vary depending on the utility and the location within the system an adversary would attempt to attack. If the adversary's objective is to affect the largest population possible, then they are likely to attack the system in a mauner that will take the entire utility off-line. For this reason, understanding single points offailure in the system is crucial to creating safe water anda more secure utility. Have You Already'Improved 􀁓􀁾􀁣􀁉􀁩􀁲􀁩􀁴􀁹􀀿., .. , .. Consider Whether These strategies Apply To Yon. . • Redundancy for raw water. intakes, transmissionlmes, andstor!lge (consider the benef'iiS ofagreements and interconnections with a neirrbywater system e.g., 􀁭􀁵􀁴􀁵􀁡􀁬􀁾􀁤􀀬􀀠purchase agreements, etc.); .. , . . • Back up power, spare parts for pumps and, other equipment, and shared equipment; • Limited accesstq!::riticl!lassets, (e.g:?,􀁢􀁾􀁧􀀬􀀬􀁾􀁭􀁩􀁳􀁾􀁩􀀧􀀿􀀡􀁬􀀱􀁩􀁮􀁥􀁳􀀻􀁾􀁯􀁬􀁬􀁴􀁩􀀡􀀻􀁴􀁧􀁊􀁲􀁩􀁩􀁦􀁦􀁩􀁣􀀬􀀮􀀮􀀠" 􀁤􀁥􀁴􀁥􀁃􀁾􀁯􀁬􀁬􀁡􀁮� �􀀠􀁤􀁥􀁬􀁁􀁙􀁾􀁴􀂢􀁄􀁩􀁳􀂻􀀬􀀻􀀳􀀠'.' .•.• 􀀧􀀻􀀮􀀧􀀮􀀺􀀺􀁾􀀮􀁾􀁾􀀨􀀺􀀺􀁾􀁜􀀺􀀺􀀧􀀺􀀼􀀺􀀺􀀺􀀬􀀻􀀺􀀬􀁾􀀠{ .•:'. ,:: . 3.2.1 Special Considerations for Toxic Chemicals and Hazardous Materials . \ 1/I Water utilities use a wide range of toxic chemicals and hazardous materials that may be stored 􀁾􀀬􀀠.NI\tf'b on-site in large quantities, Reviewing the use, transfer, and storage of all toxic chemicals and 􀁬􀀩􀁜􀀬􀀬􀁾􀁰􀀮􀀠􀁾􀀠hazardous materials is a necessary part of the vulnerability assessment. Serious consequences 􀁾􀀬􀀮􀁥􀀬􀀨􀀱􀀮􀀠could result from an attack. Of particular concern is how an adversary might use the chemicals 6 to release toxic fumes, contaminate the water or damage or destroy critical assets. 􀁾􀁜􀁖􀀠 From a public health perspective, disinfectants are some of the most important chemicals used by drinking water utilities. They serve as one of the key barriers in the multi-barrier approach for For Limited Distribution 21 drinking water treatment. On a day-to-day basis, chemical disinfectants inactivate diseasecausing microorganisms. They may also provide some protection from intentional contamination. While a number of disinfectants such as chlorine (gaseous and hypochlorite), chloramines (chlorine and ammonia), chlorine dioxide, ozone and ultra violet light can be used in the treatment plant, generally either chlorine (gaseous or hypochlorite) or chloramines (chlorine and ammonia) disinfection is used to provide a residual for the distribution system. From a security perspective, a disadvantage of using some toxic Chemicals is the danger associated with intentional release of toxic fumes. For example, the potential impacts to public health from toxic releases ofgaseous chlorine or anhydrous ammonia are ofconcern. Ifthe utility stores chemicals such as gaseous chlorine and anhydrous ammonia on-site, then these chemicals are critical assets and should be evaluated as such. A catastrophic release of chlorine gas can result in in a significant risk to facility personnel and the surrounding population, and may result in the disrnption ofwater treatment. Therefore, it is in the best interest of the drinking water utility to reduce hazards associated with the use, transfer and storage of toxic Chemicals, especially gaseous chlorine and anhydrous ammonia. A summary of characteristics, advantages, and limitations of these disinfectants is presented in Appendix D to help utilities evaluate the risk associated with the disinfection process during the vulnerability assessments. Gaseous chlorine and anhydrous ammonia are not the only chemicals of concern. Hazards associated with other on-site chemicals should also be evaluated during the vulnerability assessment and protective measures should be identified. The following is a list of some additional chemicals that are generally used in a treatment plant. These chemicals are considered hazardous substances and should be treated as such. This list is not inclusive, but is provided to alert utilities to the need for risk reduction pertaining to the use ofchemicals. • Oxygen (used as a liquid (LOX) in the production of ozone); • Silicofluoric acid (Hydrofluosilicic acid, Hexafluosilicic acid); • Sulfuric acid; • Sodium hydroxide; • Ferric chloride; and • Hydrogen peroxide. For Limited Distribution 22 Suggestions for Reviewing Vulnerabilities Related to the Use, Transfer and Storage of Toxic Chemicals or Hazardous Materials • Define highly toxic andlor reactive chemicals as critical assets. For example, define gaseous chlorine and anhydrous ammonia as critical assets. • Evaluate the severity of the consequences of an intentional release of chemicals considering the public health and safety, environmental, and economic impacts if this critical asset is attacked. • If you are a facility that is required to develop a Risk Management Plan (RMP) under Clean Air Act Section 112r, then you art) already doing calculations to determine the risk of releases. (For example, yo,u !lTe' required'to do a RMP if you' store more than 2500 pounds ofgaseous chlorine odO,qOO pounds ofanhydrous alnmonia). Review the plan to more fully understand the consequences of ari mtentional chemical release. Ifyou are not required to do a RMP, consider going' through it' similar, analysis for yourself. (See Appendix C for more information on RMP and refer: to the Web Site at: www.epa.gov{ceppo • Consider performing.a calculation using appropriattlmodels such as ALOHA to determine the extent ofthe contamination ifa catastrophic failure in chemical storage were to occur (e.g., evaluate the consequence ofrelease of the average total amoont of gaseous chlorine andlor anhydrous ammonia stored on-site). Available at: . http:{{www.epa.gov{ct\PPo{cameo{aloha.html or . http://response.restoration.noaa.go v!cameo!aloha.html • If your analysis shows risks to public health, evaluate countermeasures that could reduce these risks. For example, evaluate the use of alternative chemicals and technologies (see Appendix D for a summary pertaining to the use of alternative disinfectants to support the vulnerability assessment). Work towards a goal of minimizing the use of hazardous chemicals when possible, without compromising public health protection. • When evaluating options consider the. following: the health risks associated with each option, the security 􀁣􀁯􀁮􀁾􀁥􀁲􀁮􀁳􀀠With starage and transpart, operational constraints (including on-site storage space), and the cost associated with each . option. Also evaluate the multiple benefits of improviI).g day-to-day water quality associated with the use of several ofthe alternatives (e.g;, ozone. and ultra ,viQlet radiaHon)... • Determine whether and where security 􀁭􀁾􀁡􀁳􀁵􀁲􀁥􀁳􀀠should be increased. Consider increasing physiqal protection of chemical use, trarisfer, and storage areas to improve the utility's ability to detect, delay and respond in a timely fashion should an attack on these assets take place. For Limited Distribution 23 3.3 Attacks That Could Result In Contamination of Water In the context of the contamination threat to drinking water systems, a "harmful contaminant" is defined as any substance that can achieve terrorist Potential Consequences objectives when introduced into water. Associated with Intentional Concerns regarding attacks using biological, chemical, or Contamination ofa Drinking radiological contaminants typically focus on death andWater System disease in a population; however, it is important to consider that other potential consequences of significant concern• Creating an adverse could be achieved through intentional contamination ofimpact on public health drinking water (See side bar). The consequences of anwithin a population attack on public health could be severe, however, as described in section 1.2, the likelihood and potential for • Disrupting system success of such an attack should be weighed in assessing operations and the overall risk. interrupting the supply of sare water In order to evaluate the the contamination threat to any section of a drinking water system, it is necessary to idcntify those • Causing physical damage characteristics ofa substance that would allow it to be used to syst"m infrastructure . in an attack on a water system and produce an adverse consequence. These attributes will vary depending on the objective of the attack. For example, it is not necessary to use a contaminant that is highly toxic or infectious if the objective of the attack is to interrupt the supply of drinking water of acceptable quality or reduce public confidence in the water supply. For example, it is not necessary to use a contaminant that is highly toxic or infectious ifthe objective of the attack is to reduce public confidence in the water supply. However, the following general characteristics are applicable to all harmful contaminants regardless of the objective of the attack: • Ability ofthe contaminant to produce an adverse consequence; • Availability and accessibility ofthe contaminant to the adversary; • Environmental stability ofthe contaminant; • Susceptibility of the contaminant to common treatment and disinfection practices; • Physical characteristics of the agent (e.g., solubility) that impact the ease with which the substance can be introduced and dispersed into water; and • Difficulty in detecting the contaminant once introduced into water. These criteria were used to develop a large list of contaminants that could potentially achieve one or more of the adverse consequences described above. Focusing on the subset of For Limited Distribution 24 contaminants that could potentially cause death and/or disease in a population, approximately 100 contaminants were identified that could be of concern from a public health perspective. Of these 100 substances, intelligence information indicates that terrorist organization have shown interest in roughly a dozen, which they have the potential means to acquire. A general discussion of the biological, chemical, and radiological contaminants posing a plausible risk to public health is presented in the following subsections to provide some insight to the contsmination threat. Given the uncertainties associated with toxicity and infectivity data as well as the other characteristics listed above, it is impossible to come up with a definitive, comprehensive list of contsminants that pose a threat to public health via drinking water. Furthermore, the potential for various agents to cause harm in a particular system will depend on a number of site-specific factors and assumptions about the location and method of contamination. Thus, it is recommended that utilities consider the contsmination threat in the context of their own facility characteristics and site-specific vulnerabilities. An approach for incorporating the contamination threat into a utility's site-specific vulnerability assessment is presented in Appendix E. This approach uses model contaminants that are intended to represent a typical contaminant in each major class. In addition to supporting a utility's vulnerability assessment, the approach in Appendix E can be used as a planning and response tool to help characterize the impact of a particular contamination scenario. Biological Contaminants Thirty-five biological contaminants were identified as potential threats to water, including bacteria, parasites, viruses, and biotoxins. Biological contaminants considered include those that are known or suspected to have been weaponized as well as pathogens that have been previously implicated in waterborne disease outbreaks. The biological warfare agents are highly infective or toxic, and while most have been weaponized for an aerosol attack, some do pose a plausible threat to public health through ingestion of contaminated drinking water. The virulence and health effects associated with many naturally occurring waterborne pathogens are typically less severe than those associated with biological warfare agents, but these organisms have a demonstrated ability to cause illness, and in some cases death, ifpresent in finished water. There is a wide range in susceptibility of biological contaminants to disinfection, and in general, viruses and vegetative bacteria are much more susceptible to inactivation by chlorine than spore forming bacteria and parasites. Of the thirty-five biological contaminants considered to be possible threats to drinking water, one-third are known to be susceptible to typical chlorine levels used in distribution systems, one-third are known to be resistant to typical chlorine levels, and disinfection information is unavailable for the fmal third. Much less information is available regarding the susceptibility of many of these biological contaminants to disinfectants other than chlorine. For those contaminants that have been evaluated during inactivation studies using disinfectants other than chlorine, stronger disinfectants, such as ozone, chlorine dioxide, and UV, have typically been shown to be more effective than chlorine, while chloramines have generally been found to be less effective. Many of the biological contaminants identified as posing a potential threat to water are highly infectious or toxic in purified form, but purification and concentration of these materials can be For Limited Distribution 25 complex. While access to purified pathogens and biotoxins might be limited to terrorists with extensive resources and capabilities, some pathogens and biotoxins can be produced using simple equipment or can be harvested from natural sources. The high potency of these biological contaminants makes them a possible threat to water even in crude form. Chemical Contaminants An assessment of chemical contaminants posing a threat to water is a significant challenge simply due to the vast number of manufactured chemicals. The problem is further complicated by the wide availability of some of these chemicals, and their accepted use in bulk quantity. If one considers chemicals capable of achieving any terror objective, including undermining consumer confidence, there are hundreds if not thousands of chemicals of concern. Many would impart an objectionable taste or odor to the water making it undrinkable, several may be capable of causing damage to infrastructure, and some could produce death and disease in a popUlation. Focusing on the latter category, and using toxicity as a primary selection criterion, 65 chemical contaminants were identified as posing a plausible threat to public health. The LDso (Lethal Dose to 50 percent of the population exposed) is used as a quantitative indicator oftoxicity and is defined as the chemical dose resulting in death of half the exposed population expressed in milligrams of chemical per kilogram of body weight. While all 65 chemicals were considered to be toxic enough to pose a threat, LDso values of these chemicals span four orders of magnitude, from 0.01 to 125 mglkg. In addition to toxicity, other characteristics, such as solubility in water, availability, taste and odor thresholds, and stability in the presence of a disinfectant residual should be considered. Much attention has been focused on classical chemical warfare agents since they are highly toxic substances; however, they may not pose a significant threat to water for a number of reasons. First, almost all chemical warfare warfare agents were developed for aerosol deployment and exhibit the most severe and widespread health effects through inhalation, dermal, and ocular exposure. While some of these materials may also be capable of causing death or other severe health impacts via ingestion, the lethal dose is typically much higher via this route compared to inhalation exposure. Another consideration is the low stability of many chemical warfare agents in water, and several are completely destroyed upon contact with water. Furthermore, synthesis of many of these chemicals is technically complex, and the agents themselves, as well as their precursor materials, are tightly controlled. Given all these considerations, it seems unlikely that a terrorist would use a chemical warfare agent in such an inefficient manner as dumping it into water. It is more likely that toxic industrial chemicals would be used in the intentional contamination of a drinking water system. These might include substances such as pesticides, herbicides, cyanide compounds, and pharmaceuticals. While most of these toxic industrial chemicals have LDso values greater than 1 mglkg, they are much more widely available than the chemical warfare agents, and thus are considered to pose a greater threat. For Limited Distribution 26 Radiological Contaminants A few radiological contaminants do pose a potential acute health risk to the public via contaminated water. The amount of radioactive material present in some large devices, such as food irradiators and medical treatment equipment, is enough to contaminate a significant volume of water at lethal levels. While there is a potential acute risk associated with radiological contamination of water, the threat of such contamination is deemed to be relatively low. This is due to a variety of mctors including the high amount of radioactivity required to produce a fatal response, the relatively small quantities of material available in most applications, the controlled nature of the material, and logistical difficulties in handling and dispersing the material in water. Furthermore, the radiological devices that contain enough material to be of concern are very large pieces of equipment in which the radioactive material has been encased to prevent any leakage. It would be difficult to obtain and move the equipment, remove the radioactive source from the equipment, and covertly transport it without immediately killing the perpetrators. While the threat of radiological contamination is assumed to be relatively low, chronic health effects associated with sublethal levels of contamination, such as cancer and birth defects, cannot be ignored. Any event involving the introduction of radionuclides into water will likely raise serious initial reactions and concerns in the public, which may not necessarily be commensurate with the actual risk. In any case, it would likely be necessary to remediate water and infrastructure contaminated with radioactive materiaL Such a decontamination effort would likely be an expensive and lengthy process, and may leave a community without a convenient source of water for some time. In some cases, the contaminated portion of the system may need to be abandoned or replaced. Summary of Contamination Threat The discussion on contamination threat is intended to characterize the threat, especially those contaminants posing a potential risk to public health. A general assessment of this threat indicates that it is possible to achieve one or more terror objectives through intentional contamination of drinking water systems. • Only a few contaminants have the potential to produce widespread death or illness in a population, such as purified biological warfare agents (including some biotoxins) and a few highly toxic chemicals that may remain stable in water long enough to produce the desired effect. • A larger group of contaminants could produce localized death or illness in a segment of a population, including several dozen toxic chemicals and a few radionuc1ides. • There are hundreds to thousands of contaminants that could potentially disrupt service or undermine consumer confidence, but which would not result in death or illness in a population. While it is important to consider the possibilities associated with an intentional contamination event, a threat assessment is typically based on the probability of such an attack. There are historical accounts of intentional contamination of drinking water supplies with biological or chemical contaminants, but most have been associated with wartime activities. The few For Limited Distribution 27 documented accounts of intentional contamination of public water systems in the U.S. have not resulted in any reported fatalities. Based on these aceouots, it would appear that the probability of a suceessful contamination attack on a drinking water system is relatively low. However, there has been a reported increase in the interest of various terrorist groups in weapons of mass destruction, including biological and chemical contaminants. Furthermore, some intelligence information indicates that terrorist organizations have considered water infrastructure as a possible target, thus the potential for such an attack does exist. While the probability of an actual contamination event is considered low relative to other modes of attack, the probability of the threat of contamination is relatively high compared to other forms of attack. Many of the apparent security breaches at drinking water utilities that have occurred since 9/11 have involved the threat of contamination. Although a few threats have been verbal, most have been circumstantial, such as a low-flying airplane over a reservoir or a lock cut from the hatch of a distribution system storage tank. Given the possibility of the contamination threat, many utilities chose to treat thcse security breaches as credible threats, and in some cases isolated the suspected area from the rest of the system until water quality analyscs confirmed the safety ofthe water. Have You Already Improved Seeurity? Consider Whether These Strategies Apply To You. • Treatment systems with both physical and chemical barriers have been shown to be highly effective for removal and inactivation ofmany microorganisms. Optimization of treatment and disinfection barriers, through steps such as reducing filtered water turbidity and improving hydraulic efficiencies in disinfectant contact chambers, can increase the level of protection against source water contamination. Additional information on treatment process can be found in Appendix D. • Maintaining a disinfectant residual at all times times and locations throughout a distribution system maximizes protection. At least one third of the biological contaminants identified as plausible threats are SUsCeptible to typical chlorine levels used in . distribution systems. Residual monitoring is an effective tool for verifying disinfectant levels at critical locations within a distribution system. Monitoring can be improved by increasing the number of sampling points and taking samples more frequently, or through the nse of continuous residual monitors . ••. 􀀧􀁅􀁩􀁳􀁹􀁡􀁣􀁾􀁳􀀮􀀩􀁯􀀠􀂷􀁲􀀮􀁴� �􀁬􀁯􀁴􀁥􀀮􀁾􀁡􀂧􀁳􀁥􀁾􀁴􀁨􀁲􀀹􀁵􀁧􀁨􀀨􀀧􀀩􀁵􀁴􀁴􀁐􀀮􀀮􀀡􀁬􀀬􀁳􀁙􀁓􀁴􀁥􀁲􀁰􀀮􀁣􀁀􀁬􀀻􀁩􀁗􀁰􀁥􀀻􀀮􀁰􀁲􀁐􀁢􀁬􀁥􀁭􀀺􀁡􀁴􀁩􀀻􀀻􀀺􀀬􀀺􀀮􀂷􀁁􀁤􀁤􀁩􀁦􀁩􀁰􀁬􀁉􀁡􀁬􀂷􀂷􀂷􀂷􀀠􀁰􀁲􀁯􀁴􀁥􀁣􀁴􀁩􀁯􀁩􀁩􀀩􀁮􀁡􀁹􀀻􀁯 􀁥􀀺􀁩􀀡􀁾􀀮􀁡􀁾􀀱􀁬􀀺􀀻􀁾􀀮􀀺􀀺􀁾􀀧􀁾􀁾􀁩􀂷􀂷􀀢􀀠···.:.<.c,"· .' ", ..... For Limited Distribution 28 Since the probability of incidental security breaches that could be considered potential contamination threats is relatively high, utilities should consider approaches to manage this threat. One strategy is to harden system assets that could be targeted by adversaries who intend to contaminate the water or by vandals whose activities while trespassing could be interpreted as a threat of contsmination. Controlling access to assets that may be attractive targets to terrorists as well as vandals, such as distribution system storage tanks and pump stations may reduce the occurrence of false contamination threats resulting from incidental security breaches. However, security improvements that may be sufficient to keep vandals away from these assets may not be sufficient to deter a motivated terrorist. It is also recommended that utilities document procedures for dealing with contamination threats in their emergency response plan. Procedures for responding to contsmination threats might include a protocol for establishing the credibility of a threat, sampling procedures, criteria for triggering public health response measure (such as issuing a boil water order), and a risk communication plan. Early Warning Systems for Intentional Contamination Events As concerns regarding the contamination threat to water have risen, there has been increasing interest in early warning systems (EWS) to detect intentional contamination events in water systems. An EWS is a monitoring strategy that is capable of detecting an event with sufficient time for an appropriate response (i.e., steps to protect public heaLth). Issues to consider in the design and implementation of an EWS are discussed in more detail in Appendix F. Some factors to consider before implementing an EWSinclude: • Currently, an ideal EWS that can monitor for all potentially harmful contaminants does not exist; however, some monitoring technologies may be able to serve as an EWS for some contaminants. • An EWS should allow for secure remote operations so that the sensors can be deployed at key locations, but managed from a central location. • Two key features of an EWS are the ability to screen for a range of contaminants and the ability to positively identify a specific contaminant. . These two feamresare often in cQmpetition with one' another, and it will " ,,·U!telybellecessar¥to strike a.balancebetyteenscreening and specificity. . -":. '"it is 􀁩􀁭􀁰􀁯􀁾􀁴to chlriacterize the performance of the monitoring technology .• 'to ensure that it is capalile of meeting the objectives of the EWS. Specific perfurtnance variables include: specificity, sensitivity, accuracy, precision, recovery, rate of false 􀀮􀁰􀁯􀁳􀁩􀁾􀁩􀁶􀁥􀁳􀀬􀀠and rate offalse negatives. • Before initiating an EWS, the objectives of the monitoring program should be clearly defmed, and a plan .should be developed for the interpretation, use, and reporting of monitoring results. This could be done in the context of a utility's emergency response plan. For Limited Distribution 29 3.4 Cyber Attack Recent trends to automate asset management programs:, linkages between asset management and maintenance scheduling databases, automated business operations such as billings, and increased use of modem Supervisory Control and Data Acquisition (SCADA) systems can increase the operational efficiency of water systems. It is also important to understand that the increased use of information management systems bring potential vulnerabilities to the water system through a cyber attack. Some of the key trends related to information management Potential Consequences of systems include: Significant Concern That Could Resuli from a Cyber Attack • Utilities are transitioning from proprietary hardware and software platforms towards commercial off-the• Loss of supply of shelf products (e.g., Windows, Unix, Cisco network pressurized water or devices etc.). potable water supply for • For business purposes, SCADA systems are beinga significant part of the connected to other information technology (IT)system system networks such as corporate Local Area Network (LAN) • Adverse impacts due to and the Internet. public healthor . . confidence fr6m ,,,'.....,,,\ • Many water utilities have "piggy-backed" their security systems on the SCADA system. There may be unique vulnerabilities inherent to SCADA applications because those applications were not designed with security as a primary requirement, as may be the case for other networked IT systems. For example, a denial-of-service attack against a SCADA system that also supports the security alarm system could put the entire utility at risk. Conceivably, a wide range of IT adversaries could be using electronic means to attack the utility and they do not need to be physically present to attack. The adversaries range from the novice hacker up to a cyber terrorist. Obviously, the goals are different for different adversaries. While a novice may attempt to hack into the system just as a challenge, the cyber terrorist will typically be more focused and may try to intentionally disrupt the utility's ability to provide treated water. Major differences in the nature of cyber attacks versus physical attacks have to do with the dynamics of the adversary capabilities. As software and/or hardware vulnerabilities are uncovered, they are often posted on the Internet and available to anyone willing to attempt an attack. Adversarial tools used in cyber attacks mature at an alarming rate, making it difficult to stay ahead of the threat. . For cyber attacks, insiders may be one of the major threats and are often overlooked. The assessment should include a review of all the administrative functions of information management and SCADA systems. Who has access and what level of access do they have? How For Limited Distribution 30 are passwords controlled? What type of remote access exists and who has privileges to use remote systems? What systems are inter-connected and who has access to them? What are the policies on installing new software? These questions as well as many others need to be answered to understand the vulnerabilities of the information and SCADA systems. Water systems should also assess Internet and Intranet access on their computer networks and whether there are linkages from these to the automated operational control and management programs. Where links are found, security patches, fuewalls and other network protection programs should be considered to reduce cyber intrusion risks . . Have.You Already 􀁉􀁾􀁰􀁩􀀺􀁯􀁾􀁥􀁤Security? ConsiderWbeilier 􀁔􀁨􀁾􀁥􀁓􀁴􀁲􀁡􀁴􀁥􀁧􀁩􀁥􀁳􀀠Apply To You. • Policies fur information management system and.SCADA administration, including protecting sensitive data; • . Employee training and security monitoring ofIT;;Ystems; • Restricted access to the SCADA control 􀁾􀁾􀁯􀁭􀀠and equipment; • Separate communication i>ystern for security fllarmsystems; • Non-shared boot-up and screen saver passwords; and • Virus-checking software, security patches on the SCADA and information management networks. 3.5 Attack on Related Infrastructure on which the Water System is Dependent The water infrastructure is highly interdependent with several other critical infrastructures, for example electric and gas utilities, transportation systems, telecommunications, and chemical manufacturers and distribution. Destruction of these interdependent infrastructures could significantly hinder or halt water utility operations for an indefinite period. Of considerable concern is the reliance on electrical power to operate the majority ofwater utilities. During the assessment the water utility should review significant electrical interfaces owned by the water utility and work with the local power utility to track assets of the system back to at least the nearest substation, The review should help the utility understand understand how the power is delivered, from where, the condition of the electrical equipment, and what plans the utility has in case ofa power outage. For Limited Distribution 31 • Loss of supply of pressurized water or potable water supply for a significant part of the system Since the water utility does not own or operate anything beyond the incoming feeders, it is important to develop a close relationship with the local power utility and develop contingency plans in the event of a loss of the substation providing incoming power. Local power utilities or other third party providers may have emergency back-up systems that could be used in the event of a power outage. Utilities should undertake periodic exercises to ensure back-up system readiness. The electrical power system can also impact the information management and SCADA and communication systems as well, so it is important to understand what works and what does not during an outage, and how long the back-up systems will operate. Similar analyses should be undertaken concerning the utility's dependence on other infrastructures as mentioned in the first paragraph ofthis section. For example, utilities may want to analyze for disruption of delivery of needed chemicals or diesel fuel for back-up generators due to interruption interruption of the transportation system. Another concern may be the loss of communications capability during an emergency due to an overload of the telecommunications networks. Have You Already Improved Security? Consider Whetber These Strategies Apply To You. • Formal agreements or joint contingency plans with related critical infrastructure; • Joint emergency response exercises; • Up-to-date emergency contacts; and • Back-up power. 3.6 Additional Considerations In addition to credible threats and suspicious incidents, water utilities, like other forms of critical infrastructure, are susceptible to the damaging consequences of psychological attacks in the form of hoaxes. For this reason, water utilities need to be prepared to manage the emotional responses that these attacks can invoke from the public, utility employees, and responders. Detection devices and monitoring protocols will be useful for responding to and recovering from hoaxes as well as actual contamination events. For Limited Distribution 32 32 · , APPENDICES For Limited Distribution 33 APPENDIX A: Homeland Security Advisory System for Water Utilities developed by the Bay Area Security Information Collaborative (BASIC) The Homeland Security Advisory System/or Water Utilities was developed in California as a joint collaboration of the Bay Area Security Infonnation Collaborative (BASIC) in an effort to establish a consistent response among the bay area water utilities. Table A.I is based on the Federal Office of Homeland Security Advisory System (HSAS), which is intended to provide a comprehensive and effective means to disseminate infonnation regarding the risk of terrorist attacks to Federal, State, and local authorities. The Homeland Security Advisory System characterizes levels of vigilance, preparedness, and readiness in a series of graduated threat conditions. The protective measures that correspond to each threat condition are examples for response, designed to be adaptable to changing threat conditions. As the threat condition changes so will the protective measures. Conduct on-going going facility assessments; develop, test, and LOW Low risk of terrorist implement emergency plans. (GREEN) attack. Activate employee and public infonnation plan as needed; exercise communication channels with response GUARDED General risk of teams and local agencies; review and exercise emergency (BLUE) terrorist attack. plans. Increase surveillance ofcritical facilities; coordinate Significant risk of response plans with allied utilities and response agencies; ELEVATED terrorist attack; water and implement emergency plans, as appropriate. (YELLOW) utilities are a potential target. Limit facility access to essential staffonly. Coordinate HIGH security efforts with armed forces or local law (ORANGE) enforcement. Decision to close specific fucilities. Redirect staff Severe risk ofattack; SEVERE resources to critical operations only. a specific utility has (RED) been identified. For Limited Distribution 34 APPENDIXB: CHEMICAL SAFETY AND EMERGENCY PLANNING REGULATIONS This appendix briefly describes the safety and emergency planning regulations that apply to the use of gaseous chlorine and other toxic Chemicals at water utilities. It is not intended as a substitute for the regulations themselves. Readers who desire more information on these or other applicable regulations should read the appropriate regulations and consult agency guidance materials and other available resources. B.1 OSHA Process Safety Management Standard Some water utilities that store or use more than 1500 pounds of gaseous chlorine (or other listed toxic Chemicals) in a process are required to comply with the OSHA Process Safety Management (PSM) rule (29 CFR Part 1910.119). This rule is designed to prevent or minimize the consequences of catastrophic releases of highly toxic Chemicals by requiring subject facilities to design and operate safe processes, and plan for emergencies. Briefly, the requirements ofthe PSM rule include: • Employee participation -employers must consult with employees in developing and implementing the various safety measures required under the rule. • Process safety information -compile complete documentation regarding hazardous chemical processes, including chemical hazard information, process technology information, and equipment information. • Process hazard analysis -perform a systematic analysis of process hazards, and implement appropriate mechanisms to control hazards that are identified. • Operating procedures -develop and implement written operating procedures that provide clear instructions for conducting activities involved in the process, accounting for each operating phase (e.g., normal operations, startup, shutdown, emergency operations, etc.). • Training -employees involved in operating the process must be trained in operating procedures, safe work practices, emergency operations, etc. • Contractors -employers must inform contract employees of hazards, explain emergency plan, evaluate the safety performance of contract employees. Contract employers must ensure that contract employees are instructed in process hazards, are trained to safely perform his or her job, and follow applicable safety procedures. • A pre-startup safety review for new facilities or significantly modified facilities. • Mechanical integrity -establish and implement written procedures to maintain the integrity of process equipment, conduct training for employees involved in equipment maintenance, conduct inspections and tests, and correct equipment deficiencies. • Hot work permits -issue permits for hot work conducted on or near a covered process to ensure that appropriate fire prevention and protection measures are taken. • Management of change -establishes and implement written procedures to manage changes to process chemicals, technology, equipment, and procedures. • Incident investigation -investigate each incident that resulted in or could have resulted in a catastrophic chemical release. For Limited Distribution 35 • Emergency planning and response -establish and implement an emergency action plan for handling chemical releases. • Compliance audits -conduct a compliance audit to certify compliance with rule requirements at least every three years. • Trade secrets -make necessary information known to those responsible for compiling process safety information, conducting process hazard analyses, developing procedures, performing incident investigations or compliance audits. The OSHA PSM rule does not apply to publicly owned facilities in states that have not been delegated authority by federal OSHA to implement the PSM rule. About half of the states have not received such delegation; publicly owned utilities in these states are not required to comply with the OSHA PSM rule. Other chemicals besides chlorine that may be present at water utilities may also trigger PSM requirements. D.2 EPA Risk Management Plan (RMP) Regulation Utility processes containing more than 2500 pounds of chlorine gas are regulated by the EPA. This This regulation requires operators of these processes to take the following actions: • Implement an accident prevention program (applicable to most RMP facilities). RMP facilities fall into one ofthree accident prevention program levels -Programs 1, 2, and 3. Program 3 is the most rigorous level, and applies to RMP-covered water utilities that present a risk to offsite public receptors and who are also covered. by the OSHA PSM standard. For these utilities, the accident prevention requirements under the RMP rule are virtually identical to those of the OSHA PSM standard. Rt\1P Program 1 applies to utilities that meet RMP applicability criteria but do not present a serious risk to offsite public receptors. These facilities are not required to implement an RMP accident prevention program in order to comply with the RMP rule. However, other RMP requirements still apply to these facilities, and they may still be required to implement accident prevention measures under OSHA PSM if they are covered by that standard. Utilities that meet the RMP chemical threshold, but fall into neither of the previous program levels are in RMP Program 2. These utilities are required to implement a streamlined set of accident prevention program measures derived from the OSHA PSM set. • Conduct a hazard assessment. All RMP facilities must perform a hypothetical estimate of the consequences of a worst-case chemical release (a worst-case scenario), and prepare a five-year accident history including information about any accidents that meet certain threshold triggers (e.g., fatalities, serious injuries, etc.). Facilities in RMP Program 2 or 3 must also perform one or more altemative release scenarios. Alternative release scenarios are hypothetical estimates of the consequences of accident scenarios that are considered more likely than the worst-case scenario. • Prepare and implement an emergency response plan. Program 2 and 3 facilities that use their own employees to respond to accidental releases must develop and implement an emergency response program and plan that include procedures for informing the public and local emergency responders about accidental releases, documentation of proper For Limited Distribution 36 treatment for chemical exposures, procedures for responding to releases, and employee training in emergency procedures and the proper use of emergency equipment. Program 2 and 3 facilities that do not use their own employees to respond to accidental releases must ensure that the facility is included in the community emergency response plan and implement appropriate mechanisms to notify emergency responders when there is a need for a response. Program I RMP facilities must coordinate emergency response with local emergency planning and response agencies. • Send a summary report, called the Risk Management Plan, to EPA. The Risk Management Plan provides government officials information about the facility's toxic Chemicals, accident prevention measures, and emergency response plans. Risk Management Plans are also available to the public (the worst-case and alternative release scenario portions of the plan are available to the public only on a restricted basis). These requirements, like the OSHA PSM requirements, are designed to prevent catastrophic chemical accidents and minimize the consequences of those that do occur. Although not specifically intended to enhance security of utility chemical processes, some of the actions taken under the Risk Management Program will effectively increase site security. For example, a wellmaintained vessel or piping system will be more difficult for a criminal or terrorist to breach than a poorly maintained one. Similarly, emergency process operations and shutdown procedures will allow a facility to safely respond to process upset conditions that may arise due to criminal activity. The Process Hazards Analysis (PHA) conducted by many RMP facilities is well suited for consideration of hazard reduction options -a critical step in reducing a facility's security vulnerability. Many facilities already use a PHA approach to evaluate hazard reduction options. A good emergency response program should help mitigate the effects of any chemical release that does occur, whether it occurs accidentally or not. Other chemicals that may be present at water utilities, including ammonia, sulfur dioxide, and chlorine dioxide, also trigger RMP regulatory requirements if they exceed certain threshold quantities in a process. The RMP threshold quantity is 10,000 pounds for anhydrous ammonia, 5000 pounds for anhydrous sulfur dioxide, and 1000 pounds for chlorine dioxide. B.3 Emergency Planning and Community Right-to-Know Act (EPCRA) and Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) The Emergency Planning and Community Right-to-Know Act of 1986 (also known as SARA Title III or EPCRA) establishes requirements for Federal, State and local governments and industry regarding emergency plarming and "Community Right-to-Know" reporting on hazardous and toxic chemicals. EPCRA has sections covering emergency planning, emergency release notification, and community right-to-know reporting requirements that are relevant to water utilities. • Emergency plarming. Water utilities holding more than a threshold planning quantity of an extremely hazardous substance (100 or more pounds for chlorine) must meet specific requirements that include having an emergency response plan and providing the local emergency plarming committee and/or fIre service with information that indicates the For Limited Distribution 37 location and maximum quantities of chemicals on-site. Presently, information must also be made available to the public upon request. • Emergency release notification. Water utilities that experience an accidental release of an EPCRA extremely hazardous substance or CERCLA hazardous substance in a quantity greater than its designated reportable quantity (10 pounds for chlorine, 100 pounds for hypochlorite) must notify local and state authorities and the National Response Center. • Community right-to-know reporting. Water utilities located in states that administer the OSHA program under a delegation from the federal government must comply with the community right-to-know provisions of EPCRA requiring facilities to submit copies of their Material Safety Data Sheets (MSDSs) or a list of MSDS chemicals to the local emergency planning committee, state emergency response commission, and the local fire department with jurisdiction over the facility. B.4 Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) Chlorine and hypochlorite are both registered under the Federal Insecticide, Fungicide, Rodenticide Act (FIFRA) as pesticides and are required to be labeled following EPA instructions when used as a disinfectant. In 1999, EPA issued a Registration Eligibility Decision (RED) on chlorine gas (1999, FR 65, 56305). The registration will classify chlorine as a restricted use chemical in water and wastewater treatment plants. The restricted use classification will require all applicators to obtain certification, which would require training in the safe handling and application of chlorine gas. This decision, if fmalized, will also impose new labeling requirements on containers of chlorine gas, as well as safety requirements for operators of chlorine gas systems. B.S Other OSHA Safety Regulations There are several other important OSHA safety regulations applicable to worksites containing toxic Chemicals such as chlorine gas. These include, but are not limited to: • The OSHA Hazard Communication Standard (29 CFR 1910.1200); • Standard for Control of Hazardous Energy (Lockout/Tag out) (29 CFR 1910.147); • Respiratory Protection Standard (29 CFR 1910.134); • Personal Protective Equipment Standard (29 CFR 1910.132); and • HAZWOPER Standard (29 CFR 1910.120). These are some of the OSHA safety regulations that may apply to water utilities, whether or not chlorine gas or other listed toxic Chemicals are present. Consult with applicable OSHA guidance, your trade association, or other available resources to determine whether particular OSHA regulations apply to your utility. For Limited Distribution 38 APPENDIXC: Summary of Characteristics, Advantages, and Limitations of Drinking Water Disinfectants and Other Hazardous Chemicals This Appendix C primarily presents a summary ofcharacteristics, advantages, and limitations of disinfectants typically used in drinking water treatment. The appendix also includes infonnation on additional hazardous chemicals used in the treatment plant. This appendix does not include every disinfectant or chemical that may be used in a treatment plant, but focuses on the most prevalent. This infonnation is provided to support the utilities' efforts to minimize the risk associated with the use, storage and transport of hazardous chemicals as they perfonn their vulnerability assessments. Disinfectants are primarily added to inactivate disease-causing microorganisms. Because oftheir strong oxidizing nature, which accounts for their microbial inactivation efficiency, they can also be used to meet other treatment objectives in water such as the control ofalgae, oxidation of taste and odor causing compounds, oxidation of iron and manganese and destruction of organic pollutants. For more details regarding inactivation efficiency, disinfection chemistry, analytical methods, and mode of application, refer to Alternative Disinfectants and Oxidants Guidance Manual, USEPA 1999 available at www.epa.gov/safewater/mdbp/alternative disinfectants guidance.pdf C.I Individual Disinfectants Chlorine gas Characteristics: Chlorine gas is the most widely used disinfection alternative for water utilities. Its effectiveness, relatively low cost, high reliability, and ease of operation contribute to its popularity. Chlorine is produced, collected, purified, compressed, cooled, packaged, and shipped as a liquefied gas under pressure. In water disinfection, chlorine gas is injected into the water stream, where the hydrolysis and ionization reactions take place. Chlorine gas is about 2.5 times denser than air, is pungent, and has a noxious odor and a greenish-yellow color. It is highly irritating to the eyes, the nasal passages, and the respiratory tract. It can be lethal if a few breaths are taken at concentrations as low as 0.1 percent (1000 ppm). While chlorine gas itself cannot bum, it does support combustion, similar to oxygen. It is not explosive but will react violently with gasoline, greases, turpentine and other hydrocarbons, ammonia, metal filings, and other flammable materials. If exposed to the atmosphere, for example via a container breach, elemental chlorine will rapidly volatilize and typically disperse in the downwind or downgrade direction, posing a real risk to site workers as well as any nearby populations. Because of its hazardous nature, chlorine gas requires special handling and storage. It is shipped and used in 150 lb cylinders, I-ton containers, or 90-ton railroad cars. In the extreme event of a release of the total contents of a I-ton container of chlorine gas, people located within as much as a mile of the point of release could For Limited Distribution 39 potentially be injured or die under the most unfavorable possible weather and topographic conditions according to the predictions of some analytical models. A larger release, such as the contents of a 90-ton chlorine railcar, could be catastrophic over a much greater area Chlorine should be stored in a cool, dry, well-ventilated area that is labeled in accordance with OSHA's Hazard Communication Standard [29 CFR 1910.1200]. More detailed infonnation on regulations related to chlorine gas (such as Risk Management Plan requirements under the Clean Air Act 112r) are described in Appendix B. Standard chlorine containers are robust, highstrength vessels, designed to DOT specifications to withstand large physical stresses without failure. Containers of chlorine should be protected from exposure to weather, extreme temperature changes, and physical damage, and they should be stored separately from flammable and combustible substances. Full and empty containers must be clearly identified, separated, and properly labeled. Workers handling and operating chlorine containers, cylinders, and tank wagons should receive special training in standard safety procedures for handling compressed corrosive gases. Each site with at least 100-lbs. of chlorine is required to have emergency response plans under SARA Title 3 which typically includes but is not limited to chlorine leak detectors, self-contained breathing apparatuses, and emergency repair kits. All pipes and containment used for chlorine service should be regularly inspected and tested. Empty chlorine containers should have secured protective covers on their valves and require appropriate handling. Advantages: Chlorine gas can be used both for primary and secondary disinfection. From a public health perspective, chlorine gas is an effective disinfectant and can inactivate many microbial contaminants. It is also a strong oxidant, which makes it effective at controlling algae, taste and odor compounds, and oxidizing iron and manganese. The use of chlorine gas as a disinfectant is not a complicated process. Once operators are trained on how to safely handle chlorine gas, few accidental problems should occur. Chlorine gas can provide a residual for the distribution system and can be used for booster disinfection. At least one third of the biological contaminants identified as plausible threats are susceptible to typical chlorine levels used in distribution systems. Maintaining a residual in the distribution system and monitoring for changes in the demand may be a protection against the risk of contamination by unknown agents in the distribution system. Additional research is necessary to confinn the efficacy of chlorine against many specific agents. Disadvantages: One of the main disadvantages of using chlorine gas is the danger associated with the release of the gas. The gas is poisonous and the release results in volatilized elemental chlorine, which will disperse downwind and pose a threat to site workers as well as to neighboring popUlations. If the release is large, this may be catastrophic resulting in injury and death. Therefore, using chlorine gas requires special handling and storage and requires special equipment to ensure safe handling and feeding of the gas. Transportation also presents a risk for accidental releases As a disinfectant, it is not effective against some microorganisms and spores. For example, chlorine is ineffective against Cryptosporidium at concentrations typically applied in drinking water treatment. For Limited Distribution 40 Another disadvantage of using chlorine gas is the formation of halogenated disinfection byproducts (DBPs) that are of health concern and should be controlled to minimize population exposure. Standards are set under the Stage 1 DisinfectantslDisinfection Byproducts (DIDBP) Rule (1998, 63 FR 69390) to ensure that DBP concentrations are less than the maximum contaminant levels (MCLs). However, utilities need to balance the risk from DBPs against the risk from pathogens. Also, smaller molecular weight oxidation byproducts are formed and if not removed by biological processes, may cause microbial regrowth in the distribution system. Sodium hypochlorite (NaOCI) Characteristics: The solution is a clear, light-yellow liquid. It is produced by reacting chlorine with sodium hydroxide and is sometimes referred to as liquid bleach. Commercial or industrial grade solutions have hypochlorite strengths of 10 to 20 percent. The sodium hypochlorite solution is alkaline with a pH of 9 to 12, depending on the amount of excess excess sodium hydroxide. The solution can be purchased in 1-or 5-gal carboys, 55-gal lined, steel drums or polyethylene barrels, and even tanker trucks. The stability of sodium hypochlorite depends on the hypochlorite concentration, storage temperature, time storage, impurities, pH, and exposure to light. At room temperature, sodium hypochlorite solutions can lose up to 2 to 4 percent of their available chlorine content per month adding to the cost of the operation due to the need to compensate for the diluted strength with increased chemical use. Advantages: Hypochlorite can be used both for primary and secondary disinfection. From a public health perspective, similar to chlorine gas, it is an effective disinfectant and can provide inactivate many microbial contaminants. It is also a strong oxidant which makes it effective at controlling algae, taste and odor compounds, oxidizing iron and manganese. Sodium hypochlorite (10 to 20 percent available chlorine) can also provide a residual for the distribution system. The use of sodium hypochlorite as a water disinfectant is increasing because it decreases the risk a of chlorine gas release. It is generally used in smaller systems because on a small scale, it is simpler to operate. It can also be used by large systems but many require more frequent intervention by operators and maintenance personnel than gaseous chlorine. It can be generated on-site, or transported as a liquid. At least one third of the biological contaminants identified as plausible threats are susceptible to typical chlorine levels used in distribution systems. Disadvantages: One of the concerns associated with the use of sodium hypochlorite is the fact that the liquid is highly alkaline with a pH of 9 to 12, and therefore requires operators to wear appropriate personal protective equipment. Although there is no fire hazard associated with sodium hypochlorite, it is very reactive with metals. If sodium hypochlorite is inadvertently mixed with an acid or other incompatible chemical, significant amounts of chlorine gas can be released, potentially resulting in serious harm to people in the vicinity. Utilities that use sodium hypochlorite should supervise the delivery process and ensure that the liquid is delivered to the correct storage tank. For Limited Distribution 41 As a disinfectant, it is not effective against some microorganisms and spores. For example, hypochlorite is ineffective against Cryptosporidium at concentrations typically applied in drinking water treatment. Another health concern is the formation of unintended DBPs including halogenated organic compounds (similar to formation reactions with chlorine gas) and chlorite and chlorate (the latter hvo DBPs are formed from the decomposition of sodium hypochlorite -chlorite is an intermediate in the formation of chlorate). Another DBP of concern is bromate, which may be formed from contaminants in the salts used for the generation of sodium hypochlorite. Bromate is regulated under the Stage I DIDBP Rule at an MCL of 0.010 mgIL (1998,63 FR 69390). These DBPs are of health concern and most are regulated under the Stage I DBP Rule. Smaller molecular weight oxidation byproducts are formed and if not removed by biological processes may cause microbial regrowth in the distribution system. From an operational perspective, a disadvantage of using sodium hypochlorite is the fact that it loses its strength over time and needs to be frequently replaced. Some utilities use a diluted solution (from the stock) that allows for longer storage times. In all scenarios, determining the actual concentration of the dosing solution is critical to meeting the demand and ensuring the presence of a residual. Given that the solutions contain about 80 to 85 percent water, large storage volume is needed for larger facilities. The use of hypochlorite may create a storage concern for large disinfection processes. Other operational difficulties are: • Given the alkaline pH of the solution, some final pH adjustment problems may be engendered, • Scale formation and possible plugging of injectors in hard waters • Increased maintenance requirements associated with the feed process, primarily because of vapor locking in the feed pumps given the incompatibility of sodium hypochlorite with some facility materials. Gas binding in feed pumps can interrupt interrupt the disinfectant flow, therefore, degassing the feed is recommended. • On-site generation generally requires significant operator attention. • There are currently no quality control requirements for the salts used in the production of hypochlorite. Calcium hypochlorite (Ca (OCI>') Characteristics: Calcium hypochlorite is a dry white or yellow-white granular solid and is also available as compressed tablets. It contains about 65 percent available chlorine by weight It can be produced by combining equivalent amounts of sodium hypochlorite and calcium chloride. A slurry of lime and caustic soda is chlorinated and cooled to form the crystals. When used in a treatment plant, it is mixed with water to form a dilute hypochlorite solution and fed in the same manner as sodium hypochlorite. For spot disinfection in pipes or small basins, tablets are deposited, water added, and a hypochlorite solution is formed. For Limited Distribution 42 Most ofthe advantages and concerns associated with the use of sodium hypochlorite apply to the use of calcium hypochlorite. Calcium hypochlorite also requires special storage to avoid contact with organic material. The reaction that results from such contact generates enough heat and oxygen to start and support a fire. Calcium hypochlorite has the added advantage of requiring no electrical power. Chloramines Characteristics: Chloramines are formed by the reaction of chlorine (gaseous or hypochlorite) and ammonia (anhydrous ammonia or aqueous salt solutions). Chloramines can be generated onsite (either by adding ammonia first followed by chlorine, or by adding chlorine first (for more effective inactivation) and then ammonia (to "quench" the chlorine and control DBP formation) or can be preformed and then added in the treatment plant. Typical application points are at open channels and basin facilities. Anhydrous ammonia is usually applied by direct feed or solution feed. Ammonia feed systems are located on-site and can either be gaseous (anhydrous ammonia) or liquid (aqueous salt solutions). The anhydrous form is a gas at ambient temperature and pressure but is generally transported as a liquid in a pressurized vessel. These cylinders are similar to chlorine cylinders and are typically 100, 150 and 800-lb. sizes. Some facilities use stationary tanks that are typically I,OOO-gallon vessels that can be used on-site and are refilled by tanker trailers. When stored outdoors, cylinders should be protected from extreme temperatures, from direct sunlight, and from extreme heat to avoid pressure increases in the tank. If stored indoors, ventilation and vapor detection devices should be located at high points in the room. From a safety and security perspective, chlorine gas and ammonia gas should never be stored in the same room and the ammonia application points should be at least 5 feet away from the chlorine feed solution lines. Advantages: Chloramines can be used for both primary and secondary disinfection and require significantly higher CTs (Concentration x Time) than chlorine for the equivalent inactivation. Chloramines are stable and very effective for controlling biofilrns (limiting microbial regrowth) in distribution systems. Another advantage of using chlorarnines is that fewer DBPs are formed compared with chlorine. Disadvantages: Chloramines are weaker disinfectants than chlorine and are not effective against protozoa and viruses. Chloramines are ineffective for the inactivation of Cryptosporidium under the typical doses used in drinking water treatment. Chloramines cannot oxidize iron, manganese, or sulfides. Given that chloramines are weak oxidants, other oxidants (primary disinfectants) may need to be added in the treatment plant to meet operational needs. Excess ammonia from the generation of mono chloramine may cause nitrification problems in the distribution system, particularly in dead ends and other low disinfectant residual locations. Distribution systems that use chloramine disinfection typically require a chlorine burnout period to prevent nitrification problems. From a security perspective, chloramines require the use of both chlorine (gas or hypochlorite) and ammonia and thus have the same security concerns that exist with the use of chlorine as well as release and corrosivity concerns associated with ammonia. For Limited Distribution 43 From a health perspective, while halogenated DBP formation is lower than when chlorine is used, the formation of nitrogenous DBPs, such as N-nitrosodimethylamine (NDMA), may be a health concern. Also, chloramines need to be removed from water that is used for kidney dialysis as they can pass through the dialysis membranes and pose a health hazard to patients. Chloramines can also be harmful to fish in aquariums. Chlorine Dioxide Characteristics: Chlorine dioxide is formed by the reaction of a sodium chlorite (NaClCh) solution with an oxidizing agent. The oxidizing agent can be any of the following: I) gaseous chlorine or hypochlorite solutions; 2) a mineral acid with or without chlorine; and 3) an acid in combination with a hypochlorite solution. The generation process occurs on-site in mechanical generators. For details on the generation of chlorine dioxide, refer to Gates (1998). The aqueous solution is generally dark to light yellow or greenish. A dark brown color is generally an indication of generator malfunction and the production of pure chlorine dioxide, which is extremely unstable and explosive as a gas. The explosive nature of highly concentrated solutions (greater than 10 gIL) depends on the partial pressure of the gas itself, the solution temperature, and the water vapor pressure in the space above the solution. Advantages: It is an effective oxidant and disinfectant, is stronger than chlorine for the inactivation of Cryptosporidium, Giardia, and viruses, and provides better inactivation at a wider pH range, particularly at higher pH. However, inactivation levels are restricted by the MCL for chlorite. Chlorine dioxide is a powerful disinfectant for primary disinfection, however it is not commonly used for secondary disinfection. From an operational perspective, chlorine dioxide is generally used for taste and odor control and for the oxidation of iron, manganese, phenolic compounds and sulfides. The disinfectant will not form trihalomethanes except if free chlorine is present, but can form some other organic halogenated DBPs (disadvantage). Therefore, the generation process should be optimized to prevent the presence ofexcess chlorine, which leads to the formation ofthese DBPs. Disadvantages: Using chlorine dioxide requires the transportation and storage of chemicals including chlorine (gaseous or hypochlorite). So, from a security perspective, chlorine dioxide has all the same security concerns associated with gaseous chlorine or hypochlorite. Additionally, the disinfectant, once formed is highly toxic and may be explosive. Because it has to be generated on-site, the production process is expensive and requires careful operation. Chlorine dioxide cannot be used as a secondary disinfectant because at concentrations needed to maintain a residual for the distribution system, a taste and odor problem occurs. It can sometimes be used for residual disinfection in low-oxidant demand waters. One of the main disadvantages of using chlorine dioxide is the production of chlorite and chlorate, as byproducts of reaction with organic matter in water. Once formed, chlorate is stable and will remain in the distributed water. Chlorite is not very stable and ultimately converts to For Limited Distribution 44 chlorate. Chlorite is regulated under the Stage 1 DBP Rule because of health concerns associated with the ingestion of this byproduct. Ozone Characteristics: Ozone exists as a gas at room temperature. The gas is colorless with a pungent odor readily detectable at concentrations as low as 0.02 to 0.05 ppm (by volume), which is below concentrations ofhealth concern. Ozone gas is highly corrosive and toxic. Because of its instability, ozone is generated at the point of use. Ozone can be generated from oxygen present in air or high purity oxygen Iliquid oxygen (LOX)] and requires considerable energy. Ozone is used for primary disinfection and chemical oxidation and cannot be used for secondary disinfection because it is highly reactive and does not maintain residual levels in the distribution system. Advantages: Ozone is one of the most potent and effective germicides used in water treatment. It is effective against bacteria, viruses, and protozoan cysts. Inactivation efficiency for bacteria and viruses is not affected by pH (at pH levels between 6 and 9). However, as pH increases, ozone decomposition increases (providing less CT). As water temperature increases, ozone disinfection efficiency increases. Ozone is a powerful oxidant and can oxidize many organic and inorganic compounds in water. Therefore, it is used for oxidation of iron, manganese, sulfides, color, taste and odor. It does not form halogenated organic DBPs except for some bromine-substituted DBPs if the precursor bromide is present in the water. Ozone's oxidation of the organic matter also decreases the potential for DBP formation upon subsequent residual disinfection (using chlorine or chlorarnines). The use of pre-ozonation as a coagulant-aid results in better organic matter removal in the coagulation/flocculation and sedimentation process, thus improving the removal of DBP precursors. Disadvantages: Ozone is unstable, particularly at higher pH, and will not provide a residual for secondary disinfection. Chlorine or chlorarnines have to be added to provide a residual for the distribution system. Ozone is a highly corrosive and toxic gas. It can be a hazard to operators if any leaks occur. Onsite monitors are used to detect leaks that may occur during operation. From an operational perspective, the process is relatively sophisticated and requires trained operators. The process is expensive, relative to chlorine, and requires power for operation. From a security perspective, ozone formed from LOX requires the storage of oxygen on-site. Oxygen can support combustion, thus the storage facility should be well protected to prevent any misuse of the gas. For Limited Distribution 45 Ozone ean oxidize bromide to form bromate, a carcinogen, and some bromine-substituted DBPs that are of health concern. Other by-products are the low molecular weight aldehydes, ketones, ketoacids, and carboxylic acids. These compounds, if not removed by biological filtration, may serve as a substrate for microorganisms and promote microbial regrowth in the distribution system. Ultraviolet Radiation (UV) Characteristics: when used as a disinfection technology, microorganisms absorb UV radiation. UV radiation penetrates the cell wall and reacts with the nucleic acids and other cell parts resulting in injury and loss of infectivity. The UV radiation waves are electromagnetic waves 100 to 400 urn long (between the X-ray and visible light spectrnms). The optimum disinfection range is between 245 and 285 urn. The process utilizes low-pressure lamps with a maximum output at 253.7 urn or medium pressure lamps that emit energy at wavelengths of 180 to 1370 urn. Lamps that emit pulsed light at high intensity have also been used. Typical disinfection lamps are made of quartz tubes filled with an inert gas (such as argon) and small quantities of mercury. Advantages: UV radiation is applied directly to the water and is only used for primary disinfection. The disinfectant is very effective for the inactivation of many microorganisms, particularly Cryptosporidium and Giardia. Moreover, UV inactivation is not pH dependent. UV light does not involve any ehemieal addition and therefore has no ehemieal storage, handling, or transportation concerns. No feed equipment is necessary either. It is not as sensitive as other disinfectants to water quality exeept to turbidity. To date, no identified byproducts of health concern have been reported. Disadvantages: UV radiation ean only be used as primary disinfectant because it does not provide residual disinfection and chlorine or chloramine need to be added to provide a residual for the distribution system. While used and tested for wastewater treatment, the teehnology has not been extensively used in drinking water treatment. The disinfection proeess requires power, which is expensive, and turbulent flow conditions are needed to ensure mixing. UV radiation is very sensitive to turbidity; particulates in turbid water prevent the UV radiation from being absorbed by the organIsms. The following factors are known to negatively impact the effectiveness ofUV radiation: • Chemical or biological films that form on the surface of the lamps; • Clumping of microorganisms; • Turbidity and color; and • Short-circuiting leading to ineffective mixing. For Limited Distribution 46 C.2 Disinfectant Combinations The above advantages and limitations apply to the individual disinfectants and do not address advantages obtained from combining these disinfectants. In drinking water treatment, combinations of these disinfectants are usually used. The disinfectant choices depend on the purpose for the application and the water quality. No general rules can be provided because the disinfectant choices are very site specific and water quality dependent. For example, a water source that is high in bromide has to chose a disinfectant and apply it in such a way to ensure that forroed bromate levels are below the MCL for the Stage I DIDBP Rule MCL. As systems examine the disinfectant choices that work best for their treatment plant, it is recommended that they select disinfectants that can accomplish multiple goals and improve public health protection. The application of sequential disinfection has been shown to provide better disinfection than individual disinfectants. Details of the benefits of using combinations of disinfectants are presented in Alternative Disinfectants and Oxidants Guidance Manual, USEP A 1999. While EPA does not recommend that systems use one disinfectant over another, EPA recommends that primary and secondary disinfectants be selected to minimize hazards from the disinfectant choice and to ensure public health protection. Disinfectant combinations should take into account the synergistic effects that can be gained. Disinfeetants shOUld be carefully chosen with the goal of minimizing contact times and high doses in order to control the forroation of DBPs. EPA also recommends that systems consult the States if a change in disinfectant is decided upon. This is done to evaluate the profiling and benchmarking requirements as described in 40 CFR, 141.172. Disinfection benchmarking is a procedure requiring certain public water systems to evaluate the impact on microbial risk from changes in disinfection practices. This is done by compiling daily measurements of disinfectant residual concentrations, contact times, temperature and pH over a period of one year to develop a disinfection profile for Giardia and virus inactivation. C.3 Other Hazardous Chemicals Used in Drinking Water Systems The following chemicals that are generally used in drinking water treatment plants are considered hazardous substances and fall under the OSHA Hazard Communication Standard 1910.1200, which requires employers to follow safe handling procedures. This listing is not allinclusive but highlights the chemicals most commonly used by drinking water systems: Ammonia Ammonia is a corrosive chemical (a colorless gas with a strong odor) that can irritate and bum the skin and eyes. Ammonia reacts with chlorine to forro chloramine, a disinfectant used to provide residual disinfection for the distribution system. Generally, either ammonia gas or an ammonium compound is used in the treatment plant to forro chloramines, with a higher percentage of plants using ammonia gas over liquid ammonia. Exposure can irritate the nose, mouth and throat causing coughing and wheezing. Breathing ammonia can irritate the lungs with higher exposure causing build-up of fluid in the lungs (pulmonary edema). Exposure can also cause headache, loss ofthe sense ofsmell, nausea, and vomiting. For Limited Distribution 47 Ammonia reacts violently or produces explosive products when in direct contact with halogens such as chlorine and bromine. It is not compatible with strong acids (such as sulfuric or hydrochloric acids), permanganates, perchlorates, peroxides, and galvanized iron. It may also react with zinc, copper, tin, and their alloys. It should be stored in tightly closed containers in a cool, well-ventilated area away from moisture, heat, and direct sunlight. Local exhaust ventilation in an enclosed operation area should be available in case of chemical release. Oxvgen (liquid oxygen (LOX) used to produce ozone) Oxygen, a colorless, odorless gas, is naturally present at a concentration of 21 percent in the air. Liquid oxygen is odorless and has a slight blue color. Ifexposure to a concentration greater than 40 percent occurs, then there are some health risks. Liquid oxygen forms explosive mixtures with organic and other readily oxidizable materials and therefore, should be stored outdoors and in a location to avoid contact with oil, grease, or other combustible material. Oxygen can support combustion and should therefore be kept away from any sources of ignition such as smoking and open flames. Silicofiuoric acid (Hydrofluosilicic acid, Hexafluosilicic acid) Silicofluoric acid is a straw colored, transparent, fuming liquid with a sharp unpleasant odor. It is available as a 20 to 35 percent aqueous solution and is used in drinking water treatment for fluoride application. It is a highly corrosive chemical (aqueous solution has a pH of 1.2) and contact can irritate and burn the skin and eyes with possible eye damage. High exposures can cause nausea, loss of appetite and nosebleeds. Very high exposures can cause poisoning with stomach pain, weakness, convulsions and sometimes death. Repeated exposures can cause fluordisis of the bones and teeth. The acid should be stored away from combustibles since violent reactions can occur. Silicofluoric acid is not compatible with acids such as hydrochloric and sulfuric acids, oxidizing agents (such as peroxides, perchlorates, permanganates, chIorates, nitrates, chlorine, bromide, and fluorine) and organic compounds. The acid should not be stored in metal containers as it will readily corrode the metal and release flammable hydrogen gas. The acid should be stored in tightly closed containers in a cool, well-ventilated area. It should not be stored or dispensed in the same area as other chemicals. Sulfuric acid Sulfuric acid is a corrcsive chemical that can severely irritate and burn the eyes and skin and may even cause blindness. Breathing vapors can irritate the nose and throat as well as the lungs, leading to coughing and shortness of breath. Higher exposures can lead to pulmonary edema (fluid build-up in the lungs). It is used in the treatment plant for pH adjustments. For Limited Distribution 48 The oily liquid is a reactive chemical and an explosion hazard. It should be stored to avoid contact with water, oxidizing agents (such as peroxides, perchlorates, permanganates, chlorates, nitrates, chlorine, bromide, and fluorine), strong bases (such as sodium hydroxide, and potassium hydroxide) and many other organic compounds. The acid should be stored in a tightly closed container in a cool dry well-ventilated area away from sunlight and combustibles. The area should have an acid resistant cement floor. Explosion-proof electrical equipment and fittings should be used when handling the acid. Contact of sulfuric acid with metal drums may cause the release of flammable and explosive hydrogen gas. Storage containers should be coated with acid resistant material. Sulfuric acid does not bum, but may ignite combustibles such as wood, paper, and oil. Sodium hydroxide Sodium hydroxide is a white, odorless pellet or solid often dissolved in water. It is a corrosive chemical and contact can severely irritate and bum the skin and eyes. Breathing vapors can result in irritation of the mouth, nose, and throat, with higher exposures leading to fluid build-up in the lungs. It is used in the treatment plant for pH adjustments. As a solid, it can react with water to release heat and contact with aluminum, tin, lead, and zinc will release flammable and explosive hydrogen gas. Sodium hydroxide is not compatible with strong acids (such as hydrochloric acid, and sulfuric acids), organic peroxides, organic halogens and flammable liquids. Ferric chloride Ferric chloride is a black-brown solid that is usually dissolved in water. The solution is acidic and corrosive to most metals. In drinking water treatment, ferric chloride is used for coagulation and stored on-site. The compound is a strong irritant to skin and tissue. Symptoms of exposure to a concentrated solution include mouth and stomach irritation. Prolonged contact can cause irritation and bums. Hydrogen peroxide Hydrogen peroxide is a colorless liquid used as a common oxidizing agent. It is a corrosive chemical and contact can irritate the eyes and skin causing damage to the eyes. Breathing fumes can irritate the nose and throat as well as irritating the lungs, It is a highly reactive chemical and a dangerous explosion hazard. Hydrogen peroxide is also a mutagen and should be handled cautiously as a possible carcinogen, The chemical should be stored in tightly closed containers in a cool well-ventilated area, stored away from oxidizing agents, organic compounds, and strong acids, If in contact with combustibles, hydrogen peroxide may result in spontaneous combustion. Other disinfection alternatives and chemicals Several other chemicals such as sulfur dioxide and alum that may be used at water utilities also present potential safety risks, Sulfur dioxide is a volatile, toxic gas that, like chlorine, can cause For Limited Distribution 49 injury or death if inhaled. Sulfur dioxide is potentially a significant transportation risk, since it must be transported to the utility site and is highly volatile and toxic. However, it is not widely used at drinking water utilities, For Limited Distribution 50 APPENDIXD: Treatment Barriers to Intentional Contamination Synopsis: Many of the treatment processes used in drinking water treatment plants may be effective for removing, inactivating, or neutralizing contaminants that could be used in a terrorist or criminal act. Appendix D provides an overview of treatment efficacy for conventional treatment (coagulation, sedimentation, filtration, and disinfection) and select advanced treatment processes with respect to various contaminant classes. The appendix also highlights the importance of the residual disinfectant as a means of maintaining distribution system protection. Notice: If you are interested in obtaining the additional information contained in this appendix, fux or mail your request on your organization's letterhead stationery signed by the community water system manager or designated security official. Provide the name of the individual designated to receive the document, mailing address, phone number, and E-mail address. Fax or mail your request to U.S. S. EPA. The fax number is 202-564-8513. The express mail delivery address is: Environmental Protection Agency, Attn: Documents Room 2104, EPA East, 1201 Constitution Ave. NW, Washington DC, 20004. Ifyou send the letter by u.s. Postal Service there will be a significant delay. You will receive the document by registered U.S. mail. As with the entire document, please hold all information contained in the appendices in confidence, and take reasonable precautions to protect it. For Limited Distribution 51 APPENDIXE: Considering Contamination Threats during a Vulnerability Assessment Synopsis: Along with physical and cyber attacks, the threat of intentional contamination should be evaluated during a vulnerability assessment; however, the complexity of the contamination threat can make this difficult. Appendix E presents a framework for evaluating the threat of intentional contamination during a vulnerability assessment. The framework is consistent with many vulnerability assessment methodologies in that vulnerabilities to attacks using contaminants are evaluated against a design basis threat. The framework establishes a systematic approach for developing contamination scenarios that can serve as design basis threats. To fully utilize this methodology, a utility will need a calibrated hydraulic model of its distribution system network. However, even if a utility does not have such a model, the methodology can still be applied in a less rigorous manner. Notice: If you are interested in obtaining the additional information contained in this appendix, fax or mail your request on your organization's letterhead stationery signed by the community water system manager or designated security official. Provide the name ofthe individual designated to receive the document, mailing address, phone number, and E-mail address. Fax or mail your request to U.S. EPA. The fax number is 202-564-8513. The express mail delivery address is: Environmental Protection Agency, Attn: Documents Room 2104, EPA East, 1201 Constitution Ave. NW, Washington DC, 20004. Ifyou send the letter by U.S. Postal Service there will be a significant delay. You will receive the document by registered U.S. mail. As with the entire document, please hold all information contained in the appendices in confidence, and take reasonable precautions to protect it. For Limited Distribution 52 APPENDIXF: Early Warning Systems for Detecting Contamination Events Synopsis: One approach for avoiding or mitigating the impacts from an intentional contamination event is to perform monitoring in the context of an early warning system (EWS). The core of an EWS is the monitoring technology, and a typical EWS for water would utilize a technology that could detect or screen for toxic substances or infectious microorganisms. However, an EWS is much more than a monitoring technology it is an integrated system for deploying the monitoring technology, analyzing and interpreting the results, and using the results in making decisions that are protective of public health while minimizing unnecessary concern and inconvenience within a community. Appendix F provides guidance on the design of EWSs and an overview ofpotential EWS monitoring technologies. Notice: If you are interested in obtaining the additional information contained in this appendix, fax or mail your request on your organization's letterhead stationery stationery signed by the community water system manager or designated security official. Provide the name of the individual designated to receive the document, mailing address, phone number, and E-mail address. Fax or mail your request to U.S. EPA. The fax number is 202-564-8513. The express mail delivery address is: Environmental Protection Agency, Attn: Documents Room 2104, EPA East, 1201 Constitution Ave. NW, Washington DC, 20004. Ifyou send the letter by u.s. Postal Service there will be a significant delay. You will receive the document by registered U.S. mail. As with the entire document, please hold all information contained in the appendices in confidence, and take reasonable precautions to protect it. For Limited Distribution 53 REFERENCES: Disinfectants and Other Hazardous Chemicals Abraham, R.G. et aI., Design and Operational Issues for Converting Disinfection Facilities from Gas Chlorine to Sodium Hypochlorite, Proceedings A WWA Annual Conference, New Orleans, La, June 16 -20,2002. AWWA, Water Ouality and Treatment, 4th Edition, McGraw Hill, Inc. 1990. [Chapters 12, 14 and 15]. AWWA, Introduction to Water Treatment Principles and Practices of Water Supply Operation Vol 2, 1984. [Module 10, Disinfection]. Gates, D. The Chlorine Dioxide Handbook. AWWA, Denver, CO.l998. Gordon, G., Adam, L., Bubnis, B. Hoyt, B., Gillette, S., Wilczak:, A. (1995) Minimizing the Chlorate Ion Formation in Drinking Water When Hypochlorite Ion is the Chlorinating Agent. American Water Works Association Research Foundation, Denver, CO. U.S. Envirorunental Protection Agency. 1996. Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7); Final Rule. 61 FR 31668. U.S. Environmental Protection Agency. 1998. National Primary Drinking Water Regulations: Disinfectants and Disinfection Byproducts; Final Rule. EPA-815-Z-98-008. U.S. Environmental Protection Agency. 1999. Alternative Disinfectants and Oxidants Guidance Manual, EPA 815-R-99-014. Contamination Daughton, C.G. 2001. One Proposal for a Nation-Wide Approach to Identii'ying Emerging, Nascent Risks: Pollutant Fingerprint Anomalies. http://www.epa.gov/nerlesdllchemistry/phannalscience-issues.htm International Life Sciences Institute Risk Science Institute. 1999. Early Warning Monitoring to Detect Hazardous Events in Water Supplies. ILSI PRESS, Washington, DC. Kessler, A, Ostfeld, A, and Sinia, G. 1998. Detecting accidental contaminations in municipal water networks. M.W. Resources Planning and Management, pp. 192-198. Lee, J.Y. and Deininger, R.A 1992. Optimal location ofmonitoring stations in water distribution systems. Jour. Environ. Eng. 118(1): 4-16. For Limited Distribution 54 Speth, T.P. and R. 1. Miltner. 1990. "Adsorption Capacity of GAC for Synthetic Organics", J. Am. Water Works Assoc., 82(2): 72-75. Speth, T.F., et.a1., Treatment Studies of CCL Contaminants, Presented at the Water Quality Technology Conference and Exhibition Conference. Nashville, Tennessee, November 11-15, 2001 Speth, T.F. and J.Q. Adams. "GAC and Air Stripping Design Support for the Safe Drinking Water Act." Strategies and Technologies for Meeting SDWA Requirements. (Ann Arbor, MI: Lewis Publishers, Inc), 47-89. U.S. EPA 1988. Methods for Aquatic Toxicity Identification Evaluations. Phase I Characterization Procedures. Duluth, MN. EPAJ600/3-88/034. U.S. EPA 1989a. Methods for Aquatic Toxicity Identification Evaluations. Phase II Toxicity Identification Procedures. Duluth, MN. EP AJ600/3-88/035. U.S. EPA 1989b. Methods for Aquatic Toxicity Identification Evaluations. Phase III Confirmation Procedures. Duluth, MN. EPAJ600/3-88/036. For Limited Distribution 55 Office of Water (4606M) EPA 810-R-02-002 www.epa.gov!safewater Printed on Recycled Paper September 2002 For Limited Distribution 56 Recelved: J B:43P Fax StatlQn' HP 3 a . ca.' ;t-To: Mr.}AichaeJ E. Murphy Town of Addison (972) 451)..2837 From: AWWA (303) 795·1989 06123103 07:35PM "tfD 6666 Well Qulnoy Av.nu. Denver, CO 80235·3098 T (303) 794-7711American Water Works F (3031795.1440 Ass()(;iation WWW.twwt,org The Authorltallve Resource for Safe Orlnklng Water 914 TO: Utility Managers FROM: Jack Hoflbuhr. executive DIrector. AWWA 􀁾􀀠DATE: June 23,2003 CONFIDENTIAL: SECURITY ADVISORY FROM THE OFFICE OF THE U.S. DEPARTMENT OF HOMELAND SECURITY The attached confidential security advisory was released today by the U.S. Department of Homeland Security. This contains sensitive information and is intended only for general managers/directors of community waler systems, DO NOT DISTRIBUTE THIS CONFIDENTIAL ADVISORY Recelved F x . JUN 23 200 • : 1 n' HP lAS R T 0 To: Mr. Mieh",,] E. Murphy Town of Addison (972) 450·2837 From: AWWA (303) 795·1989 06123103 07:35PM Advisory Potential AI Qaeda Threats to US Water Supply June 23, 2003 The following advtvoty contain.v sensitive potential threat inji!rmation. Distribution ,yhouldbe limited to utilities serving community water systems. State Drinking Water Admlnl.v/ratot'S. Federally operafedwafer systems, State and Federalpublic health agencies and their 􀁬􀁡􀁢􀁯􀁲􀁡􀁴􀁻􀁽􀁲􀁬􀁥􀀮􀁾􀀬􀀠and the Environmental Froree/llm Agency. Although the Department ofHomeland Security (DHS) has no specific infonnation indicating that an Al Qaeda attack against the US water supply is imminent, or that any specific target sy.;lems or locations have been identified, recent intelligence indicates that members ofAl Qaeda had discussed plans to attack the US drinking water supply. Two potential attack scenarios were discussed: 1) disruption ofwater delivery thmugh a phy.;ical attack on the water supply infrastructure, and 2) introduction ofchemical or biological agents into water distribution sy.;lems and post-treatment facilities. DHS assesses both types of attacks to be difficult but feasible. Moreover, Al Qaeda has considered denial ofwater availability and creating mass casualties through contamination as equally important modes of attack. Both contamination agents and a physical attack could cause a denial ofwater availability. The fonner can cause denial of water availability by contaminating water mains and distribution sy.;tems severely enough to require officials to prohibit use of the water in order to protect public health. A denial of water avaiJability attack could have cascading effects on other water-dependent sectors depending on the duration of the attack. With respect to bio-chemical contamination of the drinking water supply, Al Qaeda has shown interest in cyanide, Botulinum toxin, Salmlmella typhi (the causative agent of typhoid fever), and Bacillus anthracis (the causative agent ofAnthrax). The documents in which these agents were identified indicated that Al Qaeda was developing plans to produce or acquire these agents. [reference: DHS Sector Notification 3-J076. 17 March 2oo3J. In addition, Al Qaeda discussed plans to hyperchlorinate treated water as another means ofdi&rllpting the drinking water supply. With respect to physical attacks, Al Qaeda discussed attacks against critical components of the water infrastructure such as the primary and backup high service pumps. Even if such pumps are replaced within a week, a water sy.;tem could be out ofservice during the replacement period. Cascading effects on other water-dependent sectors could also occur as mentioned above. 1 To: Mr. Michael E. Mutphy Town ofAddison (972) 450-2837 From: AWWA (300) 795-1989 06f2j/03 07:35PM Protective/Response Measores for BiD-Chemical Attacks The nonnal US water treatment process has a number ofbuilt-in safeguards that would present challenges 10 any terrorist group aiming to create a mass contamination event. These safeguards include treatment with chlorine and other disinfectants, purification. dilution, and stringent quality control [reference: DHS Sector Notification 3-J076, 17 March 2003]. With respect to the four contaminants identiiied above, it is noled that all of these agents are threals to drinking water. Contamination ofall or a portion of the distribution system or specifica.Jly targeting the water supply for high value targets such as a military base. government offices. schools, or hospitals is of particular concern. The following protective/response measures are recommended if such contaminants are found or suspected in the post-treatment water supply: 1. Unusual drops in residual disinfectant should always be investigated 2. Ifa water contlllllination event is suspected, the credibility of the event must [rrst be evaluated in order to determine appropriate response actions. This credibility assessment must be perfonned quicldy and should be based on any infonnation available about the event that is readily available or which can be quickly collected during a site investigation and rapid field testing ofthe water. Law enforcement can also provide assistance in making credibility detenu.in.ations and may investigate the incident as a potential criminal or terrorist activity. 3. If a water contamination threat is determined to be credible, then response actions to protect public health will be necessaty. Response actions might include isolation of affected areas ofthe system or more aggressive measures such as issuance ofpublic notices to 1Iot drink or 1Iot use the water. Such public health decisions should be made in conjunction with appropriate government agencies, such as the state state or local health departments. Furthermore, contingency plans must be in place to provide water to the public for consumption and to ensure that fire protection is maintained. In !be case ofa highly credible contamination threat, it is recommended that the loca.J FBI field office and the National Response Center (NRC) be contacted in addition to the notifications made at the local and state levels. The NRC can quickly mobilize federal resources to provide assistance in the case ofan emergenoy and can be reached on a 24x 7 basis at 800-4248802. WhUe it is important to take aU contamination threllts seriously and to conduct a thorough inve!ltigation to evaluate the credibility of the threat, it is equally important not to overreact to a potential threat because lIny respoJl!ie actions carry consequences of their own. BPA, in conj1Ulction with experts from the drinlcing water treatment industry, is developing Ii more specific protocol to respond to contamination incidents that will expand upon the suggestions above and which should be available soon. With regards to the particular contaminants mentioned above. the following information may be useful. 2 1 ed Fax 2003 􀀸􀀧􀀴􀁾􀀠t1 Fax Statl • HP LAS T 3200 4 To· Mr. Michael E. Mutphy Town ofAddison (972) 450·2837 From: AWWA (303) 795·1989 06123103 07:35PM • Cyantde -Cyanide is neutralized at low concentrations by chlorine residuals particularly at pH levels greater than 8,5, However. for high levels of cyanide. levels ofchlorine much greater than those used in drinking water treatment are required to neutralize the cyanide. Cyanogen chloride, another toxic compound, is formed at low pH « 8.5), EPA has approved standard methods and rapid detection kits for cyanide (see http://www.C!lIl,goy/ctv/vcrificlltions/vccntcrl731!l,Q;\). Ifsignificant variations above the normal for cyanide are detected, immediately consult with public health officials to detennine the actions that need to be taken, including the possible issuance of110 dri1lk or 110 lise notices. • Botulinum Toxin, Stdm01lelia typhi -These biological agents can be inactivated at levels greater than 90 percent by typical chlorine residual levels. Salmonella Iypnl can be cultured, and rapid test kits are available for this organism but have not been verified for drinking water applications, If there is an elevated threat of botulinum toxin or Salmonella Iyphi in the water system, residual chlorine levels may be increased, Ifchloramines are presently used as the disinfectant, consideration should be given to reverting to chlorine residual, If the presence of either ofthese agents is suspected, immediately consult with public health officials to determine the actions that need to be taken including thepossibJe issuance of110 dri1lk notices, • BaellllJ!l 􀁡􀁬􀀱􀁴􀁨􀁬􀀧􀁴􀁬􀁣􀁩􀀬􀁾􀀠-Bacillus anfhrodr spores are not affected by normal chlorine residual levels. Baciilus anfnradf can be cultured, and rapid test kits are available for this organism but have not been verified for drinking warer applications. If Bacillus anfhracls is suspected, immediately consult with public health officials 10 delennine the actions that need to be taken, including the possible issuance of 110 drink or 110 use notices. More information on test kits is available at the Association ofAnalytical Communities (AOAC) website --http://www.aoac.ori¥lestkltslTKDATA2.HlM, • Hyperchlorlnatlon -Normal water treatment quality conttol should detect hyperchlorination quickly, Because excess chlorine would be readily identifiable at levels that would lead to adverse health effects, most consumers would refuse to consume or use over-chlorinated water due to the pungent odor. Upon detection, a temporary 'no drink' order may need to be issued until the hyperchlorinated water has been flushed or purged from the system. Further information may be found at these public web sites: Centers for Disease Control Biological Agents: 􀁨􀁴􀁴􀁰􀀻􀁌􀁌􀁽􀁗􀁾􀁴􀀮􀁣􀁱􀁣􀀧􀀱􀁉􀀰􀁶􀁬􀀡􀁾􀁮􀁴􀁬􀁾􀁴􀁬􀁩􀁳􀁴􀀮􀀡􀀡􀀬􀀧􀁜􀁴􀀡􀀠Centers for Disease Control Chemical Agents: 􀁨􀁴􀀡􀁰􀀺􀀯􀁬􀁷􀁷􀁷􀀮􀁢􀁴􀀮􀁣􀁤􀁣􀀮􀁾􀁯􀁶􀀯􀁡􀁧􀁣􀁮􀁴􀁬􀁡􀁧􀁣􀁬􀁩􀁴􀁬􀁩 􀁳􀁴􀁣􀁨􀁣􀁭􀀮􀁥􀁳􀁰􀀠3 I?W' 03 8:43Pt Fax Stat !on' H S RJET 320 To: Mr Michael B. Murphy Town ofAddison (972) 450-2837 From: AWWA (303)795-1989 06123103 07:35PM Protective Measures for Physical Attacks Protective measures span the spectrum from prevention, detection of, response to, and recovery from physical attack. These measures are well known to the industry but warrant review in light of the potential threats cited here. A comprehensive listing of measures can be found in the EPA's document Guarding Against Terrorist and Security Threats: 􀁓􀁵􀁧􀁧􀁥􀀮􀁾􀀯􀁥􀁤􀁍􀁥􀁡􀀮􀁷􀁲􀁥􀀮􀁾􀁦􀁬􀁬� �Drinking Water and Wastewater 􀁕􀁬􀁩􀁬􀁩􀁴􀁩􀁥􀀮􀁾􀀠attached as a separate document to this advisory. Examples of such measures -to be adapted based on local conditions, needs, and available security resources -might include, but are not limited to, the following: • lVIaintain and monitor disinfection residual throughout the distribution system • Close monitoring, patrols, and video surveillance ofClritical water supply nodes and links from source through distribution • Rapid communication ofsuspicious activity, including automated alarms, to local law enforcement authorities • Well-tested and maintained emergency response plans that include responses by local, State, and the Federal government • Tested and maintained protocols for quickly gaining approval and communicating 'boil water', 'no drink', or 'no use' orders to the public • Well-Iested and maintained recovery plans that include responses by neighboring water supply organizations, local. State, and the Federal agencies and private sector suppliers • Review of security procedures with facility staff • Requirements that employees change passwords periodically on critical management systems and that system administrators implement besl security practices for information teclmology systems and networks OHS encoW'age. individU!!l. to repon infoJmation ccmreming .uspmiollS or criminal activity to law enforcement or a.Ho!:ooland Security watcl1 office. Individual. may report incidents online at 􀁨􀁉􀀡􀁰􀀻􀀡􀁌􀁾􀀮􀀮� �􀀮􀁬􀁉􀀧􀀮􀁊􀁬􀀮􀁩􀁐􀀮􀂫􀀦􀁾􀁩􀁴􀁴􀁊􀁬􀁬􀁭􀀮􀀮􀀠and Federal age!lCiestdepartn'le1US may report incidents online at 􀁨􀁬􀁴􀁬􀀧􀁾􀀺􀁬􀁉􀁩􀁮􀁥􀁪􀁤􀁥􀁮􀁴􀁲􀁥􀀡􀁬􀁑􀁲􀁴􀀮􀁦􀁥􀁤􀁣􀁩􀁲􀁣􀀮􀁧􀁬􀀩􀁶􀀮􀀠Speci fic contact number. for the IAIP watch centers are, For private companie. andcitizerui, 202-323-3205, 1-SSS-585-9078, or 􀀡􀁬􀁩􀁰􀁣􀀮􀁷􀁲􀁵􀁾􀁨􀁀􀁟􀁦􀁢􀁩􀀬􀁧􀁯􀁾􀀠For Federal agenclesldepartt:ne.nts, call 888-282·0870 or email 􀁦􀁣􀁤􀁣􀁩􀁲􀁣􀁀􀁦􀁥􀁤􀀹􀁾􀀠OHS intends to update this bulletin should it receive additional relevant inforlmtion, including information provided to it by the user community. Based on tw. notification, no change to the Homeland Security Advimry Level (HSAS) is anticipated; the current HSAS level i. YELLOW. 4 DATE I J08NO.(;"(2&/1&3 ATTENTION , Public Works /Engineering 16801 Westgrove' P.O. Box 9010 Addison, Texas 75001 Telephone: 1972) 450.2871 • Fox: {972j 450·2837 A y-RE. V", Y1fFI,171 I;/q itLt: 4'05.. ' /GENTLEMAN: WE ARE SENDING YOU i!(Attached o Under separate cover via _____the following ilems: o Shop Drawings o Prints o Plans 0 Samples 0 Specifications o Copy of letter o Change order o COPIES DATE NO. DESCRIPTION I !3a,;:Mfu, Th red-􀁌􀁦􀁴􀀬􀁲􀁾􀁍+;"r Vtt ne.hab,I, 􀁾􀀠1--_--1-__+-_+.. 􀀬􀀭􀀬􀁉􀁫􀀮􀁾􀀺􀁳􀁥􀁾􀀧􀁾􀁾􀁃􀁓􀀬􀀭􀂣􀀼􀁾􀀬􀀬􀀢􀀽􀁭􀁭􀁭􀀠01=􀁾􀁵􀁮􀁬� �􀁲􀁹􀀠wd-tr ,s:;.s&m5 : /"'\ 􀁾􀀠􀁾...........􀁾􀀠-L-"""""1..􀁾􀀠\ 􀁾􀀠17 􀁾􀀠1 n A, (\ IJ I • 􀀭􀀽􀀼􀁾􀀶􀀠3 􀁾􀀠! L-__--'-___L-_-..l.._ .. _____􀁾􀀠THESE ARE TRANSMITTED as checked below: o For approval 0 Approved as submitted o Resubmit ____copies for approval b(For your use 0 Approved as noted o Submit copies for distribution o As requested 0 Returned for oorreclions o Return corrected prints o For review and comment 0 ________________________ o FOR BIDS DUE __________ 19,__ o PRINTS RETURNED AFTER LOAN TO US 􀁃􀁏􀁐􀁙􀁔􀁏􀁟􀁾􀁜􀁾􀁊􀁌􀁴􀁶􀁾􀁶􀁾􀀱􀁾􀁬􀁍􀁾􀁖􀁾􀁩􀁾􀀵 􀁾􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭SIGNED: 􀁾􀀬􀀦􀀬􀀮􀀮􀀭􀁾􀀢􀀧􀀽􀀽__________... If enclosures are not as noted, please 􀁮􀁏􀁦􀁬􀁦􀁾􀁾􀀠 cc & EPA Threat Advisory U.S. Environmental Protection Agency Office of Water Water Protection Task Force February 7, 2003 EPA's Water Protection Task Force is providing the following information to water utilities to assist in their preparations for the newly announced Threat Level Orange: . Suggested measures under Threat Level Orange Joint EP NCDC Advisory SUGGESTED MEASURES UNDER THREAT LEVEL ORANGE EPA's Water Protection Task Force has compiled a list ofsuggestions from a number of water utilities to assist in preparations at the various Homeland Security Threat Levels. The suggestions described below pertain to the Threat Level Orange and are organized in the areas ofdetection, preparedness, prevention, and protection. Water utilities should consider whether the following measures are appropriate fur their facilities: Suggested Mcasures I. Detection: • Confirm that county and slate health officials will inform water utilities ofany potential waterborne illnesses. II. Preparedness: • Post daily reminders for staff and contractors ofthe THREAT LEVEL ORANGE, along with a reminder of what events constitute security violations. • Ensure employees are fully aware of the emergency response communication protocols so that appropriate notifications can be made quickly in the event of an incident. Consider the following list oforganizations to be notified: local law law enforcement local FBI Field Office National Response Center (800-424-8802) State and local emergency management organizations Governor's office EPA cm Special Agent in Charge (SAC) other associated system authorities (wastewater, water) local government officials statellocal health, water, andlor environmental departments critical care facilities . employees EMS and fire department as deemed necessary Consider when to notify customers and what notification to issue (Additional information is available in the Model E1tU!rgency Response Guidelines at www.epa.gov/safewater/securityi) 2 • Evaluate the need for organizing an emergency operations center. III. Prevention: • Discontinue tours and prohibit public access to all operational facilities. • Consider requesting increased law enforcement surveillance, particularly of critical assets and otherwise unprotected areas. IV. Protection: • Ensure water treatment/production facility is staffed at all times. • Consider the need for additional security measures needed for surface water reservoirs. • Limit mission critical facility access to essential employees and contractors. • Increase security patrol activity to the maximum level sustainable and ensure tight security in the vicinity ofmission critical facilities. Consider varying the schedule of security patrols. • Prosecute intruders, trespassers, and those detained for tampering to the fullest extent possible under applicable laws. Joint EPA/CDC Advisory ADVISORY FOR RELEASE February 7,2003 Today, the Department ofHomeland Security upgraded the Homeland Security Advisory System from yellow level (elevated risk of terrorist attack) to orange level (high risk of terrorist attack). While there are no data to indicate that water has been specifically targeted, our nation's water infrastructure remains at risk to terrorist attacks, or acts intended to substantially disrupt the ability of a water system to provide a reiiable supply ofwater. Therefore, public health agencies and water utilities are encouraged to continue to work together, keep each other informed of any unusual activities, and confirm the proper operation of notification channels in emergency response plans. Public health agencies should immediately notify local water utilities and the state's drinking water administrator in the event of an unusual number ofcases of gastrointestinal illnesses or other indications of illness that may suggest water contamination by a biological, chemical or radiological agent Water utilities should immediately notify public health agencies 2417 emergency operations number, and the state's drinking water administrator in the event of specific threats received at a water facility, customer complaints in water quality, or if circumstances lead the utility to believe that the water has been or will be contaminated with a biological, chemical or radiological agent. The Centers for Disease Control and Prevention (CDC) and the u.S. Environmental Protection Agency (EPA) issue this advisory jointly. c'-􀀨􀁾􀀠A 􀁅􀁁􀁾United States 􀁾􀀮􀀱􀁉􀁦􀀠Environmental Protection 􀁾􀀮􀀮􀀠Agency 9. GUARDING AGAINST TERRORIST AND SECURITY THREATS Suggested Measures for Drinking Water and Wastewater Utilities (Water Utilities) The Department ofHomeland Security (DHS) established a five-tiered Homeland Security Advisory System to provide a national framework for notification about the nature and degree of terrorist threats. The system establishes a set of graduated levels that change in response to increases or decreases in terrorist threats. The threat levels are colored coded, beginning with green, and increasing in severity through blue, yellow, orange, and red. While the threat may not be specific to water utilities, the water sector, as one of the thirteen critical sectors identified by DHS, may consider themselves potential targets. Why is EPA offering these suggestions? Water utilities are in the forefront of ensuring that our nation's water systems are protected against terrorist threats. Many utilities have already developed safeguards. This document provides model guidelines for water utilities to increase security based on threat conditions described by the five-tiered Homeland Security Advisory System. Please note that the attached document is a guide; it is a not a requirement under any regulation or legislation. This document provides suggested steps water utilities should consider implementing in the areas of detection, preparedness, prevention, and protection. The suggested measures are additive in that higher threat levels should also include those measures outlined in the document for lower threat levels. These suggestions are based on practices employed by various systems across the nation. The ability to implement them at the system level will vary. Note that these general recommendations should be adapted by the utility depending on the system size, status of emergency response planning at the utility, and identified system vulnerabilities. These suggestions should not be viewed as a complete source of of information on protecting water utilities. Facility managers and utility security directors should consider the full range ofresources available, as weil as the specific nature oithe threats, when responding tn changes in threat condition levels. Based on strong recommendations from the water sector, EPA is making this document available to water utilities and to the secure WaterISAC (www.waterisac.org). EPA is also providing this document to the state drinking water administrators. Some state homeland security and emergency response programs have issued suggestions to their critical infrastructures, including water. State drinking water administrators are encouraged to coordinate with state homeland security and emergency response programs and modify these suggested measures as appropriate to ensure consistency. Please do not post this document on publicly available web sites. Detection Preparedness Prevention Protection CONSIDER ADOPTING THESE MEASURES • Monitor water quality at the source water, leaving thc plant, and in distribution and storage systems. Establish baseline results. Review operation.1 and analytical data to detect unusual variations. • Follow-up on customer complaints concerning water quality andlor suspicious behavior on the facilities. • u(;()nfifl1lcolllJllllllication protocol with public health officials concerning potential waterborne illnesses. • Post emergency evacuation plans in accessible, but secure, location near entrance for immediate access by law enforcement, fife response, and other first responders. • Inventory spare parts and on-hand chemicals. Check ifsufficient. • IdentifY sensitive populations within the service area (e.g., hospitals, nursing homes, daycare centers, schools, etc.) for notification, as appropriate, in the event of. specific threat against the utility. • Back-up critical files such as plans and drawings, as-builts, sampling results, billing, and other critical information. • Conduct appropriate background investig.lious of staff, contractors, operators, and others with access to the facility. • Prepare vulnerability assessments and revise to incorporate changes made (e.g" .ssets addedlreplaced or new countermeasures implemented). • Eusure that employees understand appropriate emergency notiJication procedures. • Train staff in safety procedures, such as handling hazardous materials and maintaining and using self-contained breathing apparatus. • Secure equipment such as vehicles and spare parts. • Monitor requests for potentially sensitive information. -------------------------------------j • Check all chemical deliveries for driver identification and verification of load. • Maintain vigilance and be alert to suspicious activity. Inspect buildings in regular use for suspicious packages and evidence of unauthorized entry, Report any suspicious activity to appropriate authorities. • Prosecute intruders, trespassers, and those detained for tampering to the fullest extent possible under applicable laws. • Review request for tours and identifY protocols for managing the tour. • Implement controls for construction activities at critical sites. • Maintain disinfectant residuals as required by regulations. • Implement best management practices for optimizing drinking water trealment. .:.;.:;' CONSIDER ADOPTING THESE MEASURES (and those at lower threat levels) ICONDITION GUARDED (BLUE) Gelleral Risk or Terrorist Attacks signifies a guarded risk of terrorisl altacks. Protective measures should focus on activating employee and public information plans; exercising communication channels with response [cams and local agencies: and reviewing and exercising emergency plans. Detection • Test security alarms and systems for reliability. Preparedness Prevention Protection • • • • • • Reaffirm conununication and coordination protocols (embedded in the utility's emergency response plan) with local authorities such as police and fire departments, HAZMAT teams, hospitals, and other first responders. Prepare and/or revise emergency response plans associated conununication protocols. Include appropriate local officials concerned with law enforcement, emergency response and public health. On a regular basis post cmployee reminders about events that constitute security violations and ensure employees understand notification protocol in the cvent ofa security breach. Prepare draft press releases, public notices and other communications for a varicty of incidents. Route through appropriate channels ofreview to ensure pieces are clcar and consistent. Secure buildings, rooms, and storage areas not in rcgular use. Maintain a list of secured areas or facilities and monitor activity in these areas: Control access to mission critical facilities. CONSIDER ADOPTING THESE MEASURES those at lower threat levels) • To the extent possible, increase the frequency and extent of monitoring activities and review results .gainst baseline. Detection • Increase review of operational and analytical data (including customer complaints) with an eye toward detecting unusual variability (as an indicator of unexpected changes in the product). Variations due to natural orroutine operational variability should be considered first. • Increase surveiUance activities in source and fmfshed water areas. Preparedness • Review and update emergency response procedures and communication protocols. • Establish unannounced security spot checks (e.g., verification ofperson. I identification and door security) at access control points for critical facilities. • Increase frequency for posting employee reminders oflbe threat situation and about events that constitute security violations. • Ensure employees understand notification protocol in the event of a security breach. • Conduct security audit ofphysical security assets, such as fencing and lights, and repair or replace missinglbroken assets. Remove debris from along fence-lines that could be stacked to facilitate scaling. • Maximize physical control ofall equipment and vehicles inoperable whcn not in-use, (e.g., lock steering wheels, secure keys, chain and padlock on front-end loaders, etc.). • Review draft communications on potential incidents, brief media relations personnel of potential for press contact andlor issuance of release. • Review and update list ofsensitive popUlations within the service area, such as hospitals, nursing homes, d.ycar. centers, schools, etc., for notification, as appropriate, in the event of a specific threat against the utility. • Contact neighboring water utilities to review coordinated response plans and mutual aid during emergencies. • are available and accessible. • Carefully review all Iilcility tour requests before approving. If allowed, implement security measures to include list of names prior to tour, request identification of each attendee prior to tour, prohibit backpacks/duffle bags, cameras Prevention and identify parking restrictions. • On a daily basis, inspect the interior and exterior of buildings in regular use for suspicious activity or pack.ges, sigus oftampering, or indications of unauthorized entry. • Implement mailroom security procedures. Follow guidance provided by the United States Postal Service. Protection • Verify the identity of all personnel entcring the water utility. Mandate visible use of identification badges. Randomiy check identification badges and cards of those on the premises. • At the discretion of the facility manager or security director, remove all vehicles and objects (e.g., trash containers) locatcd near mission critical facility security perimeters and other sensitive areas. • Verify the security of critical information systems (e.g., Supervisory Control and Data Acquisition (SCADA), Internet, email, etc.) and review safe computer and internet access procedures with employees to prevent cyber intrusion, • Consider steps necded to control access to all ateas under the jurisdiction of the water utility. • • • •• HIGH (ORANGE) IHgh Risk ofTl'rl'Qst Att....,. #',y:.-,) 􀀺􀁾􀁔􀀢􀀢􀀩􀀬􀀬􀀠i a"'"􀁾􀁾􀁾􀀠'j t: 􀁾􀀠􀁾􀀠-c!). 􀁾􀁾􀀠􀁾􀀮􀀯􀀮􀀠􀁾􀁾􀀠". 􀁾􀀱􀀼􀀡􀁦􀁴􀁣􀂷􀀠RECOVERY ACTIONS Recovery Notifications: Water I REMEDIATION ACTIONS: Recovery actions should begin once the contaminant is through the system. • customers in the area ofthe fucility ofactions to take • NotifY customers in affected area once contaminant-free clean water is re-established down-stream users such as water suppliers. irrigators. electric generating plants, etc. • Consider flushing system via hydrants in distribution systems Water Distribution/Storage • Assess need to decontaminate/replace distribution system components . Wastewater Treatment Plant • Based on sampling results -assess need to remediate storage tanks, filters, sediment basins, solids handling. • Plan for appropriate disposition of PPE and other equipment • If waste water treatment plant was by-passed -sample and establish monitoring regime for receiving stream and potential remediation based on sampling results. Annex 11-4 􀀺􀁉􀀢􀀬􀀬􀁜􀀧􀁉􀁩􀀮􀁾􀀩􀀠􀀽􀁦􀀧􀁩􀀧􀀮􀀮􀁱􀁬􀁾􀀮,.:( sa ":"; 􀁾􀀮􀁥􀀠i 􀁾􀀧􀁉􀁉􀁉􀁉􀀡􀁉􀀢􀁁􀀠W 'j 􀁾􀁩􀀡􀂭 􀁾􀀠􀁾􀁪􀁾􀀠...􀀬􀁣􀁲􀁾􀀨􀂷.e Event Description: This event is based on the water utility being notified by Public Health officials of potential contamination based on Initial Notifications: RESPONSE ACDONS • Ask notilYing official who else has been notified and request information on symptoms, potential contaminants and potential area affected Source Water • Increase sampling at or near system intakes • Consider whether to isolate • NotilY local Law Enforcement • NotiIY local FBI Field Office • NotilY National Response Center • NotilY local/state emergency management organi2ation Drinking Water • Preserve latest full battery background test result as baseline • Increase sampling efforts • Consider whether to continue nonnal operations (if determination is to reduce or stop water treatment -provide notification to customers/issue alerts) • Coordinate alternative water supply (if needed) • NotilY other other associated system authorities (wastewater, water) • NotiIY local govenunent official • NotilY Governor Water Distribution o Increase sampling in the area potentially atrected and at locations where the contaminant could have migrated to. It is important to consider the time between exposure and onset of symptoms to select sampling sites o Consider whether to isolate o Consider whether to increase residual disinfectant levels • NotilY loeal/state • NotilY employees health andlor • Consider when to environmental nolilY customers department and what • NotilY critical care notification to issue facilities • NotiIY ISAC Wastewater Wastewater Collection Treatment o Increase sampling at pumps stations and specifically in the area potentially affected • Assess what to do with potentially contaminated water within the system based on contaminant, contaminant concentration. potential for system contamination, and ability to by-pass treatment plant • If by-passed -notilY local & appropriate state authorities, downstream users (especially drinking water treatment facilities) & increase monitoring of receiving stream Annex II-5 .' ..>: ..,..,i'';}) :.rA " ''% 􀀨􀁂􀁺􀁾􀁾􀀠I q:􀁾􀀦􀀠,,'>. _,/. 􀁁􀁾􀀠./. 􀁾􀀱􀁡􀁴􀁾􀀨􀀮􀀠RECOVERY ACTIONS Recovery Notifications: Appropriate Utility Elements: REMEDIATION ACTIONS Recovery actions should begin once the contaminant is through the system. • Assist health department with notifications to customers, media, downstream users and other organizations • Sample appropriate system elements (storage tanks, filters, sediment basins, solids handling) to determine if residual contamination exists. • Based on sampling results assess need to remediate storage tanks, filters, sediment basins, solids handling and drinking water distribution • Flush system based on results of sampling • Monitor health of • Plan for appropriate disposition of PPE and other equipment • Plan for appropriate disposition of personal protection equipment (PPE) and other equipment • If waste water treatment plant was sample and establish monitoring regime for receiving stream and potential remediation based on samoline results. symptoms should be used to mllTOW the contaminants. Annex II-6 􀀮􀁾􀁜􀀱􀁏􀀻􀀺􀀺􀁟􀀧􀀩􀀠:-r... •...;:;,"'. 􀀢􀀧􀁉􀁾􀀠,;; ft. " 􀁾􀁾􀁾􀀠􀁾􀀠I ..v 􀁾􀀠􀁾􀀠􀁾􀁁􀀧􀀠􀁾􀁻􀀻􀁊·t.P1C rt("' Event Description: This event is based on internal or external intrusion ofthe SCADA sys1:cm to dismpt normal water system o NotiiY local Law o Notify National o NotiiY other o If the water is Enforcement Infrastructure associ ated system assessed to be unfit Initial • NotiiY local FBI Protection Center authorities for corunnnption, Field Office (NIPC) at 1·888·585· (wastewater, water) consider when toNotifications: 9078 (or 202·323· • NotiiY employees notiiY customers 32041516) and what notification to issue Source Water Drinking Water Water Distribution Wastewater Treatment 􀀱􀀱􀁾􀁾􀁩􀀱􀁩􀁨􀁴􀀠I Wastewater Treatment FacilitvCollection • Increase sampling o Preserve latest full • Monitor unmanned • Temporarily shut down SCADA system and at or near system battery background components (storage go to manual operation using established intakes test as baseline tanks & pumping protocol o Consider whether o Incrcase sampling o Monitor unmanned components (pumping stations)RESPONSE to isolate efforts o Consider whether to stations) -rcquired only if wastewaterACTIONS SCADA system is compromised downSCADA isolate• Temporarily shut • If SCADA intrusion caused release of system and go to improperly treated water consider whether to manual operation continue normal operations (if determination using established is made to reduce or stop water treatment protocol provide notification to customers/issue alerts) • Consider whether to shut down system and provide altemate water AlIDexIF7 􀁾􀀻􀀺􀀺􀁽􀀩􀀠l'il"li:... 􀁾􀀮􀀮􀀺􀀮􀁜􀀠""<5'_ ,,'i sa 􀁾􀀠-U"x f.:) 􀁾􀀠􀁾􀁉􀀬􀁾􀀠"" .f'􀁾􀁌􀁐􀀢􀀧􀁴􀁃􀀧􀁴􀀨􀀧􀁾􀀠RECOVERY ACTIONS Recovery Notifications: Appropriate Utility Elements: REMEDIATION ACTIONS Recovery actions should begin once the intrusion has been eliminated and the contaminant/unsafe water (ifthis occurs) is through the system. • Employees • Local law enforcement • NotifY clistomers and media ifthe event resulted in contamination and the full raQge (see scenario 1) ofstandard notifications were made • SCADA • With FBI assistance, make an image copy of all system logs to • With FBI assistance, check for implanted backdoors and other malicious code and eliminate them before re-starling SCADA system • Bring SCADA system up and monitor system evidence. • Assess/implement additional protections for SCADA system. • Check for an NIPC water sector warning based on the intrusion that may contain additional protective actions to be considered. NIPC warnings can be found at www.NIPC,goY or at Notes: Annex II-8 ...l!U :'r,4,:... .':/" 􀁾􀀠< "''''.''.',r,,''" "'􀁾􀀠." 􀁾􀀠􀁾􀀠􀁾􀀮􀀠(''''􀁾􀀯􀀻.... 􀁾􀀧􀁬􀁡􀀠,0;.:" • NotifY local Law • NotifY locallstate • NotifY other • NotifY locallstate • NotifY employees Enforcement emergency associated system health andlor • Consider when to Initial • NotifY local FBI management authorities environmental notifY eustomers and Notifications: Field Office organization (wastewater, water) department what notification to • NotifY Governor • NotifY local • NotifY critical care issue Center • NotifY ISAC government officials fucilitics Source Water Drinking Water Water Distribution Wastewater Wastewater Treatment Svstem I Storalle Collection Svstem Treatment • NotifY National • Deploy damage assessment teams, if damage appears to he intentional then treat as crime scene -Consult locallstate law RESPONSE enforcement and FBI on evidence preservation • Infom. law enforcement and FBI of potential hazardous materials ACTIONS • Coordinate alternative water supply, as needed • Consider increasing security measures • Based on extent of damage, consider alternate (interim) treatment schemes to maintain at least some Recovery actions should begin as soon as practical after damaged facility is isolated from the rest ofthe utilityRECOVERY mcilities.ACTIONS • EmployeesRecovery • Law enforcement • NotifY local FBI officeNotifications: • Dependent on the feedback from damage assessment teams • Implement damage recovery plan • Repair damage. • Assess need fur additional protection/security measures for REMEDIATION damaged facility, and other critical fucilities within theACTIONS Annex II· 9 Threat Identification Checklist Ifyour utility receives a threatening phone call, try to keep the caller on the line to obtain as much information as possible, Record as much information as possible, including: 1. What kind ofthreat is posed? A. Contamination: What kind of poison? _________________________ Howmueh? _________________________________ B. Physical Damage: What kind ofdamage? ______________________ With what kind ofdevice? __________________________ 2. Whel'e?____________________ 3. When? ___________________________________ 4. Why? ____________________ ________________________________ 5,Bywhom? _________________________________ 6. What is your (caller's) name? ___________________________ 7. What is your (caller's) affiliation, ifany? _______________________ &, What is your (caller's) address/phone w,________________________ 9. What is the exact wording ofthe threat? ______________________________ 10. Is the caller _male _female _well spoken _illiterate _foul _irrational _incoherent I L Is the caller's voice _calm _ angry _normal _slurred _nasal _clear _cracking _excited -young_old _familiar -who did it sound "h",____________________ _ accented -what nationality, region? ________________ 12, Is the connection clear? (Could it have been a wireless or cell phone?) 13. Are there baekground noises? _street noises -what kind? _______________ _ machinery -what type? _________________ _ voices -deseribe, ___________________ _ children· describe'--__________________ _ animals-what kind? _________________ _ computer keyboard/office _motors -describe, ________________ _ music -what kind? _______________ __other____________________ Name ofperson receiving 􀁣􀀮􀁉􀁉􀁾____________ Date'--______Time_____ Notify Utility manager phone:______________ Local FBlILaw Enforcement, Phone, _______________________________ Texas Natural Resource Conservation Commission Public Drinking Water System Security Evaluation Plan and Emergency Response Plan Texas Natural Resource Conservation Commission Public Water System TNRCC .. March 18.2003 Page 1 of 8 Security Evaluation Plan KNOW YOUR WATER SYSTEM o Physically locate and inventory all water system fucilities. o Tour your watershed and wellhead protection areas to identifY any changes that might have occurred that would make your source more vulnerable to contamination. o Visit and inspect surface water intakes routinely. o Review and update distribution maps. Access to these maps should be restricted, but readily available to authorized personneL Emphasis should be placed on the location ofall valves including isolation valves, •flush valves, air release valves, and fire hydrants. o Please note that you should continue to operate your system according to TNRCC rules and regulations. BE PREPARED o Make sure all employees are aware ofhow to communicate in case ofan emergency. Maintain an up to date list of emergency contacts including local law enforcement, fire, local EMS and the TNRCC (TNRCC phone numbers are attached). Provide these groups your emergency call list. o Develop emergency plan and procedures and update at least annually. o Develop a list ofall other public water systems and their contacts that you serve or that serve you. o Make sure key utility personnel (both on and off duty) have access to crucial telephone numbers and contact information at all times. o Review your emergency evacuation plan and post it in a prominent location. This is particularly important for systems that utilize chlorine gas, chlorine dioxide, ammonia or any other hazardous or incompatible chemicals that could threaten public health or the environment ifreleased. o Keep an adequate supply ofchemicals and repair parts on hand. Locate sources ofequipment supplies such as pipe, emergency generators, repair clamps, dirt-moving equipment and maintain and update these lists periodically. o Assemble a list of contacts for major repair services so they can be accessed quickly in ease of an emergency. Maintain and update these lists periodically. B Be sure staff is properly trained in how to take a bacteriological sample (correct procedures and sterile containers). o IdentifY and contact an alternate source ofwater supply, and determine the distance and what equipment and supplies would be needed to make interconnection. TNRCC • Man:h 18,2003Page 2 of 8 o Keep finished water storage levels maximized for interruptions, fire fighting and other emergencies. o Service and exercise emergency generating equipment regularly to assure it is operational. RESTRICT ACCESS TO YOUR WATER SYSTEM FACILmES o Reduce access points to water system facilities to as few as possible. o Check that boat ramps are at least 1,000 feet from surface water intakes. o Review facilities and maintain a list ofstaff that have access to the facilities. ifyou cannot account for all keys, you should consider re-keying or replacing locks. o Issue specific badges and special visitors badges. All visitors should sign in and sign out and return visitor badges when leaving the site. o Restrict all water system fucilities to authorized persounel only. Post "Employee Only" signs in at all water system facilities. o Lock all doors and set alarms at your office, pump houses, treatment plants, and vaults, and make it a rule that doors remain locked and alarms set at night and when unattended. MONITOR YOUR FACILITIES o Make sure that local law enforcement knows where all ofyour system facilities are located and ask that they include them in their patrols. Take time to explain to local law enforcement what is there and why it is important. o Ask staff and the public to be vigilant and report any suspicious activities around water system facilities immediately to local law enforcement. o Institute an ongoing testing program for all alarm and lock-up systems. o Make more frequent visits to unmanned remote water facilities to assure that existing security measure have not been compromised. o Check areas that have previously suffered damage due to vandalism as they may warrant additional security measures. o Maintain a weekly inventory of all potentially hazardous chemicals. Verify that consumption and inventory equal the prior weeks total and any additional quantities purchased during the week. Notify local law enforcement ofany missing potential hazardous chemicals. o Remove meters or ensure that corporation corporation stops are locked at inactive service connections. TNRCC • Mard! 18.2003Page 3 of 8 o 􀁐􀁬􀀺􀁬􀀧􀁊􀁴􀁬􀁾􀁥􀀦􀁾􀁾􀁮􀁲􀀮􀁭􀁯􀁾􀁴􀁯􀁲􀁩􀁮􀁧􀀠and look for decreases in chlorine residual. If needed, increase chlorine 􀁙􀁥􀁶􀁥􀁴􀁾􀁬􀁦􀁩􀀠lhe dls"lilbutlOn system. o Routinely check pressure in the distribution system and be aware ofand respond to unusual changes in pressure (high or low). Ifpressure falls below 20 psi, report to the lNRCC and follow the flowchart in the appendix ofthe Rules and Regulationsfor Public Water Systems. o Check the distribution lines frequently for visible leaks, ask customers to report suspected leaks or breaks, and repair them as soon as possible. SECURE YOUR FACILITIES and CHEMICALS o Secure hatches, meter boxes, hydrants, manholes and other access points to the water distribution system; o Make sure pumphouses, water storage tanks, treatment plants, and chemical storage facilities are secure, well lighted, locked and provided with alarms ifpossible. Alarms should sound locally and remotely to notify water system persouael and also security monitoring services, ifavailable. o Identify and inventory chlorine gas, chlorine dioxide, ammonia and any other hazardous or incompatible chemicals that could threaten human health or the enviroument. o Seclude and secure dangerous chemicals. Avoid storing chemicals near the perimeter of the facility where someone who breaches your outer barrier (fence, gate, well house, etc.) could reach them more easily and quickly. o Secure control access to computer networks and control systems, and change the passwords frequently. o Protect all SCADA (Supervisory Control and Data Aquisition) sensing devices on equipment, especially offsite, from tampering by locked metal circuit boxes, metal conduit over open wiring, etc. o Do not leave keys in equipment or vehicles at any time. PLAN ON HOW TO COMMUNICATE with your customers with your neighboring water systems with local law enforcement withlNRCC o Prepare a commuaications plan to deal with potential threats, infrastructure damage, and suspected or actual contamination incidents in advance. We We have enclosed a checklist to assist you in handling threatening phone calls. o Depending on the size ofthe water system, consider a 'communications couanand post' approach to centralize all public notices and press releases. lNRCC .. March 18,2003Page 4 of 8 D Always alert local law enforcement to potential problems immediately -help them help you! D Good customer relations is important. Make sure you do the following: Involve the public. Make your customers part ofthe process and your plans. Give your customers the correct information as soon as possible through meetings, newspapers and newsletters, local radio, and television. Keep it honest, keep it simple, and keep it consistent Keep a list of phone contacts who can provide information or service to your customers in the event ofa major water system failure. Decide who will be your contact with the media, and make sure they have the latest, most accurate information. Make sure your employees know when to direct inquiries to your media contact. For more information you can visit the following web sites: EPA Counterterrorism: http://www.epa.gov/ebtpageslecounterterrorism.html EPA Alert on Chemical Accident Prevention and Site Security: http://www.epa.gov/ceppo/pubslsecale.pdf U.S. Centers for Disease Control & Prevention: http://www.bt.cdc.gov Association ofMetropolitan Water Agencies: ht!p:/lwww.amwa.netlisac/amwacip.html American Water Works Association: ht!p://awwa.org National League ofCities: http://www.nIc.orginIc orglsite/newsroornlterrorism response Texas Natural Resource Conservation Commission Public Water System Emergency Response Plan D Immediately report the following to local law enforcement: TNRCC .. March la, 2003Page 5 of 8 -criminal threats -suspicious behavior -attacks on water facilities -suspicious containers -suspicious concentrated materials (such as powder or liquids) -breaches of your security systems o If you have evidence of suspicious containers or materials, remove water system personnel fro immediate area. NotifY local law enforcement and hazardous materials response teams emergency respo need to get updates from the personnel. Iftanks or pumps can be removed from service without ca pressure problems, it would be advisable to do so until law enforcement has made a determination validity ofthe threat. o Once law enforcement has determined there is a credible tbreat, notifY the TNRCC Public Drinking V Section and Regional Office (numbers provided in attachments). TNRCC will provide appropriate sam and additional support. o Report to TNRCC and county or State health officials any illness among the utility's customers that mi associated with water supplies. o Report any unusual or out ofthe ordinary drinking water problems or characteristics (taste, odor, c drop in chlorine residual, emulsion, changes in conductivity, low or high pressure, high turbidity) to I law enforcement and TNRCC. o Contact your appropriate water system management and officials regarding the incident. o NotifY EMS ifoperationa! staff have sustained injury or illness. o Call appropriate personnel listed on Emergency Contact phone list. o Isolate affected area ifpossible. o Ifloss ofpower, bring emergency power or alternate sources online as soon as possbile. o Don't panic. Utilize all available resources. o Document date, time and decisions and actions taken. o Cooperate fully with local, state and federal authorities. :':.":GUIDANCE FOR THREATENING CALLS uld you receive such a call, stay calm. Every effort should be made to NOTE THE EXACT TIME OF THE CALL AND THE EXA WORDS OF THE PERSON MAKING THE CALL. Additional efforts should be made to determine the following details, i already provided by the caller: 1NRCC • Match 18.2003Page 6 of 8 􀁔􀁏􀁒􀁔􀁉􀁏􀁎􀁾􀁔􀁾􀁾􀁈􀁒􀁅􀁁􀁔􀀠at facility is n d? at is the nature ofthe threat? When is the threat to occur or has tampering already occurred? What does the caller want? Will the caller call back? Ifnot, who else will be called? What is the caller's name, address andlor location? What telephone number did the caller call and from what number? BOMB THREAT When is the bomb going to explode? Where is it right now? What does it look like? What kind of bomb is it? What will cause it to explode? Where has the bomb been placed? Why? What will it damage? What is your address? What is your name? REPORT IMMEDIATELY AFTER THE CALL while information is still fresh On your mind. Note whether the caller male/female, had an accent or other speech characteristic, and the time the caller hung up. The following checklist may be helpf gathering information regarding the call. INFORM LOCAL LAW ENFORCEMENT OFFICIALS IMMEDIATELY A PREPARE A BRIEF WRITTEN REPORT. CHECK LIST TO NOTE ON CALLS: CALLER'S VOICE: ____Calm ____Slow Slow ___-'Angry __􀁾􀁒􀁡􀁰􀁩􀁤􀀠 ___􀁾􀁅􀁸􀁣􀁩􀁴􀁥􀁤􀀠 ____Soft lNRCC • March 18. 2003Page? of 8 ----Loud ____N.asal ____Laughter ___---,Crying ____Normal ____Distinct ____Slurred ____Whispered IF VOICE IS FAMILIAR, WHO DID IT SOUND LIKE? BACKGROUND SOUNDS: ____.Street Noises ----:Kitchen Sounds ____.Voices ____.PA Systems ---_.Music ----:House Noises ___Booth ___Office Machinery THREAT LANGUAGE: ___Well Spoken (articulate) ___Foul __----:Irrational ____,Stutter ____:Lisp ____.Raspy ____.Deep ____.Ragged ____Clearing Throat ____.Deep Breathing ____Cracked Voice ____Disguised ___􀁾􀁁􀁣􀁣􀁥􀁮􀁴􀀠____Familiar ___Factory Machinery __􀁾􀁁􀁮􀁩􀁭􀁡􀁬Noises ___Clear ___Static ___Long Distance ___Local ____.Motor ____Cell Phone ____Other Incoherent Taped Message read by threat maker IF ANY SUCH CALLS ARE RECEIVED ON A TELEPHONE ANSWERING DEVICE, DO NOT ERASE THE TAPE, SINCE IT MAY BECOME EVIDENCE IN AN INVESTIGATION. TNRCC • March 18, 2003Page 8 of 8 Jim Pierce From: Grover.Greg@epamail.epa.gov Sent: Friday. January 24, 20032:55 PM To: jpierce@ci.addison.tx.us Subject: Security Effort Information 020920Aug Rpt 001112plansl030.d 5 Emergency 6TI1reat 7 water 8 access letter 2.... DC Contact IIst.doc ientification CheckliJStewarer Incident rergencyResponseGui Jim, Thank you for your call! Access information for the Baseline Threat Document is attached below. At this time I am told that we need to follow non-internet access instructions. (See attached file, 020920Aug Rpt access letter 2.wpd) The latest information on vulnerability assessment tools and other EPA security effort information is located at OUr main website at: http,//www.epa.gov/safewater/security. We are aware of the following VA requirements and/or potential sources of financial assistance for public water suppliers: PL l07-1SS,known as the "Bioterrorism Act,JJ has recently been signed into law. It requires VAs for all community water systems which serve more than 3,300 people. It also authorizes $160 million for USEPA to use in assisting public water systems in conducting vulnerability assessments (VA), preparing emergency response plans, initiating basic security enhancements, and alleviating urgent vulnerabilities. However, the money has not yet been allocated. Should money be allocated (available), the funding vehicles and mechanisms for distribution, including the application process will be well-defined and publicized. The VA methodology will require the 6 basic elements outlined in the Baseline Threat Document. The complete text of the Act is located on our web site. Until grants become available, States may provide drinking water state revolving funds (DWSRF) or other assistance to public water systems to allow them to complete VA$, emergency response plans, and many types of infrastructure improvements. Drinking water source protection may also be funded through DWSRF set-asides. Ultimately, it is the statets decision whether they can or will provide assistance. More information about the DWSRF and eligible activities is available at our web site located at: http,//www.epa.gov/safewater/dwsrf/security-fs.pdf. Here is some emergency response plan guidance I promised you: The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (BT Act) includes the following language which addresses Emergency Response Plan (ERP) requirements: The emergency response plan shall include, but not be limited to, plans, procedures, and identification of equipment that can be implemented or utilized in the event of a terrorist or other intentional attack on the public water system. The emergency response plan shall also include actions, procedures, and identification of equipment which can obviate or significantly lessen the impact of terrorist attacks or other intentional actions on the public health and the safety and supply of drinking water provided to communities and individuals. Community water systems shall, to the extent pOSSible, coordinate with existing Local Emergency Planning Committees established under the Emergency Planning and Community Right-to-Know Act (42 U.S.C. 11001 et seq.) when 1 preparing or rev1s1ng an emergency response plan under this subsection. Each community water system serving a population greater than 3,300 shall prepare or revise, where necessary, an emergency response plan that incorporates the results of vulnerability assessments that have been completed. Each such community water system shall certify to the Administrator, as soon as reasonably possible after the enactment of this section, but not later than 6 months after the completion of the vulnerability assessment under subsection (a), that the system has completed such plan. The Large Water System Security Grant requires that the emergency operations plan (EOP) be a guide for water Utilities upon which actions and decisions can be based to govern the immediate response to an emergency, including how a Utility will remedy the problems caused by the emergency and recover from it. The intent of the EOP is to identify certain responsibilities delegated to various tearrw and employees, present details of notification procedures, and describe alternate measures and response actions. The EOP is not intended to be inclusive for each situation or problem that arises, and it should be updated periodically for continued relevance and viability. It must also comply with applicable state and local ordinances. In addition to EPA's Model Emergency Response Guidelineswhich is attached and can also be located at the EPA's web site listed below, a number of major water system organizations, such as the American Water Works Association (AWWA) , are offering emergency response plan (ERP) guidance which includes electronic templates. One AWWA product that we are aware of is Emergency Planning for Water Utilities (AWWA Manual MI9). Their web site is: http://www.awwa.org. We have attached additional EPA Region 6 and state of Texas (Nov. 2001) emergency response checklists/guidance for your information. Essential for any emergency response plan is a proper incident notification sequence in the event of a potentially malevolent act against a a facility. We recommend the following notification sequence: 1. Your local emergency responder (usually 911) . 2. The EPA National Emergency Response Center: 1-800-424-8802. 3. Your State Drinking Water Agency (emergency numberl: Texas Commission on Environmental Quality, 1-800-832-8224. Security checklist/emergency response templates have also been posted at our EPA Region 6 website at: http://www.epa.gov/earthlr6/6wq/swp/security/index.htm. Security Contacts: For EPA Wastewater security efforts and guidance, please call Mike Tillman at 214-665-7531. The Texas Commission on Environmental Quality drinking water security contact is Tony Bennett at 512-239-6029. Jim, I hope this information helps. Please let us know how we may further assist you. I'll talk with you soon, Greg Greg Grover Drinking Water Security Coordinator EPA Region 6 Dallas, TX 214-665-2776 (See attached file: 001112plansl030.doc) (See attached file: 5 Emergency Contact list.doc) (See attached file: 6Threat Identification Checklist.wpd) (See attached file: 7 water wastewater incident report.wpdl (See attached file: 8 2 The national organizations are part ofthe Local Officials fOr Transportation (LOT) coalition, formed to develop and advocate policy recommendations for reauthorization. At a news conference in Washington, DC, Tarrant County Commissioner Glen Whitley, Fort Worth Mayor Kenneth L. Barr and Dallas Councilrnember Sandy Greyson said that increased investment is needed to improve safetY and combat congestion. The three elected officials said that the coalition's gaals also entail protecting the strong gains ofTEA-21. including maintaining its funding fuewall" increasing the role oflocal afficials in planning tr!l!ll!jlartatian projects and fimding decisions by sub-allocating resources to the regional level. The news conference was held February 10, 2003. Coalition members include: NACo, NLC, USCM, APWA, the National Association ofCounty Engineers, the Association ofMetropolitan Planning Organizations, National Association ofRegional Councils, National Association of Development Organizations, International City/County Management Association, National Association ofCity Transportation Officials and Public Tecbnology, Inc. Pipeline Safety RULE TO REQUIRE INTEGRfTY MANAGEMENT IN mGH CONSEQUENCE AREAS The US Department ofTransportation's Research and Special Programs/Office ofPipeline Safety (RSPAlOPS) has issued a notice ofproposed rulemaking to require operators to develop integrity management programs for gas transmission pipelines that, in the event ofa failure, could impact high consequence areas (RCAs). The notice was published January 28, 2003 in the Federal Register. The deadline to submit connnents is March 31. 2003. For more information conlact Mike [srani at 202-366-4371, or mike.israni@rspa.dot.gov. General information about the RSPAIOPS programs may be obtained by accessing RSPA '8 internet page at http://RSPA.dot.gov. PROVIDE $3 BILLION ANNUALLY FOR ROAD SAFETYlNFRASTRUCTURE Representative Jay Inslee (D-WA) bas introduced legislation to provide $3 billion annnally to fund the Roadway Safety and Congestion Mitigation Improvements Act, HR 288. It would target $2.55 billion to specific risks, such as intersections, run off the road crashes, pedestrian and bicycle safety and work zones, and would provide $300 million for safety improvements on roads off of the fedetal-aid highway system. DeSign-Build Contracting FBWA ISSUES FINAL RULE FULFILLING TEA-21 REQUIREMENT The Federal Highway Administration bas issued a finsl role which implements regulations to allow design-build contracting as mandated by the Transportation Equity Act fur the 21" Century (TEA-2!). The regulation does not require the use ofdesign-build contracting, but allows state DOTs to use it as an optional technique in addition to traditional contracting methods. Effective January 9, 2003, the finsl regulations list the criteria and procedures that will be used by FHWA in approving the use ofdesign-build contracting by state transportation deparlroents. For more information contact FHWA '8 Gerald Yalrowenlro, 101-366-1362, or,for legal information. contact Harold Aikens. 202-366-1373. Highway Environmental Review QUESTION/ANSWER GUIDANCE ON INDIRECT AND CUMULATIVE EFFECTS ISSUED Interim guidance, presented as a question and answer document, on considering indirect and cumulative effects of transportation projects as part of the environmental review process was issued by FHWA January 31, 2003. Twelve questions are addressed which cover definitions of"direct secondary, indirect and cumulative effects and impacts. The guidance also provides resources including state transportation agency procedures and training opportunities. For the guidance text go to htlp:llnepaJhwa.dotgovIRENepa/ReNepa.nsjllwme and click the cumulattvldirect impacts tab. WITH ADVERSE WEATHER RESPONSE The Federal Highway Administration's new Road Weather Management website offers tools, resources and information to assist in managing weather-caused road problems. The web address is: www.ops.fhwa.dot.gov/weather/index.hlrn. ENVIRONMENT FY04 US EPA Budget PROPOSED BUDGET WOULD CUT FUNDING FUNDING FOR CLEAN WATER INFRASTRUCTURE President Bush has proposed a 2004 fiscal year budget fur the US Environmental Protection Agency (US EPA) at$7.63 billion, a decline from $7.7 billion the Administration sought in FY03 for which a request is still pending in Congress. EPA received $7.9 billion in fiscal 2002. The biggest cut would be to the clean water state revolving fund US EPA Washington Report February 2003 page 5 Adrninistraror Whitman said the agency would see an increase ofabout $280 million to about $4.25 billion for its core operating programs, an increase froni the $4.1 billion requested in PY03. The eore programs refer ro the Agency's priorities for the year-clean air, clean and safe water, land and enforcement activities. Specific allocations include: • $7.7 million for the President's Clean Air program-a plan to eliminate emissions ofsulfur dioxide, nitrogen oxides, and mercury from power plants by 70 percent, named EPA's top priority; • $850 million for Clean Water State Revolving Loan Fund, down about $360 million from the PY03 request; • $850 million for Drinking Water State Revolving Loan, same as FY03 request; • EPA will extend its commitment to the Clean Water program from 2005 to 2011, boosting the amount of money in the SRF by about $800 million to $2.8 billion in coming years; • $200 million for Clean Water Section 106 grants, an increase fromFY03 request of$180 million; • $238 million for nonpoint source funding under Section 319 ofthe Clean Water Act; • $20 million for watershed program, an increase of$15 million from the FY03 request; • $210 million for the Brownfields program; an increase oUIO million from the amount requested in FY03; • $21 million for enforcement fundiog; • $3.12 billion for state and mba! grants for FY04. Forforther EPA budget information go to http://www.epa.gov/ocfolbudgetl2004/2004bib.pdf Water Security EPA RELEASES SECURITY PROTOCOLS FOR VULNERABILITY ASSESSMENTS US EPA has developed the Protocol to Secure Vulnerability Assessments Submitted by Community Water Systems to EPA. The document is a list of strict measures developed to ensure the secnrity of vulnerability assessments lhat drinking water utilities must submit Iu the agency under a new bioterrorism law. The protocol includes keeping assessments under lock and key and only attainable by individuals designated by the Administrator. The Prorocol was required by the Public Health Secnrity and Bioterrorism Prepareduess and Response Act of2002, signed by the President on June 12, 2003. Title N of the law amends the Safe Drinking Water Act Iu require all utilities serving more than 3,300 penple to assess the vulnerability oftheir systems Iu terrorism and other harmful acts and submit their assessments ro the US EPA Six months later, utilities are required to prepare emergency response plans. Water Security Information WATER INFORMATION AND ANALYSIS CENTER LAUNCHED The Water Information Sharing and Analysis Center, or WaterlSAC, has been launcbed to provide centralized secnrity information and terrorist tboeat alerts to America's drinking water and wastewater utilities. All U.S. drinking water and wastewater systems are eligible Iu subscribe to the WaterISAC. The WaterlSAC was developed by utility managers for utility managers through Presidential direction and Executive Order 13231. A secure Web-based environment, the WaterISAC specific products and services include: • Alerts on potential terrorist activity. • Information on water security • Databases ofcbentical, biological and radiolOgical agents. • • Notification of cyber vulnerabilities and technical fixes. • Vulnerability assessment rools and resources. • Secure electronic bulletin boards and chat rooms on security topics. Analysts for the WaterISAC have goverurnent secnrity clearances and operate under strict protocols. The computer servers for the WaterISAC's secure portal reside in a protected, government-approved facility. ltiformation on subscribing /0 the WaterlSAC is available online at www.WaterISAC.org. Water Pollution US EPA PROPOSES TO WITBDRA W MAJOR CHANGES TO TMDL The U.S. Environmental Protection Agency (EPA) has announced it is proposing to withdraw the July 2000 final mle which revised EPA's Total Maximum Daily Load (TMDL) program under the Clean Water Act. EPA has claimed the mle to be "unworkable." and its schedules for completing plans, requirement ofimplementation plans and emphasis on nonpoint sources ofpollution were problematic for agriculture, state state and envirorunental interests. The proposal ro remove the 2000 TMDL rule is expected to generate comments from environmental groups who supported it. Implementation ofthe 2000 TMDL rule was barred by Congress. The Bush Administration pulled the mle back for 18 months and considered significant changes. Proposed December 20, 2002, the withduawal mle must become final before April or the 2000 regulation will become efrective. The current TMDL program continues Iu function. Washingron Report February 2003 page 6 PUBLIC WORKS DEPARTMENT (972) 450-2871 16801 Westgrove 1.02.-785-' 8''f.S February 18, 2003 US Environmental Protection Agency Washington, D.C. Attention: G. Tracy Mehan, III, Assistant Administrator Gentlemen: This is to request a copy ofBaseline Threat Information for Vunerability Assessments of Community Water Systems. I have Internet access and my E-mail addressisjpierce@ci.addi son.tx.us Thank you for your attention to this matter. Very truly yours, Town ofAddison 􀁾􀁾􀁾􀀮􀁃􀀱􀁩􀁾􀁾􀁡􀁾􀁴Public Works Director Community Water System Manager cc: Chris Terry, Assistant City Manager Michael E. Murphy, P.E., Director ofPublic Works Attachment Phone: E-mail: .eI"'Ce. 􀁾􀀠Public Water Sy tern Identification # -'.....L..:.-==--'--"-='-""--'Attachment Directions to Access the Document Baseline Threat IIIformatioII for Vulnerability Assessments ofCommunity Water Systems Provide the following infonnation on the individual designated to access the document. Follow directions below. Name 􀀨􀁰􀁲􀁩􀁮􀁴􀁥􀁤􀀩􀀺􀁟􀁊􀀽􀁯􀀮􀀮􀀮􀀢􀀮􀁖􀀧􀀡 􀁜􀁾􀁥􀀢􀀧􀀭􀀭􀀭􀀭􀀽􀀭􀀭􀀭􀀧􀀭􀀭􀀧􀀭􀀷􀀧􀀹􀀽􀀢􀀧􀀭􀁴􀀭􀁾___ Name (signature): 􀀭􀀭􀀭􀀭􀀺􀀻􀁆􀀮􀁊􀁾􀁾􀁾􀁾􀁾􀁾􀁾􀀧􀀣􀁴􀀬􀀮􀁟􀀮􀀬􀀭􀀭􀀭􀀺Title: '" L..Jt:II.ks 􀀱􀀩􀁬􀁲􀁥􀀮􀁊􀁯􀁾􀀠l.J£..tu· 􀁾􀁳􀀫􀁴􀁙􀁍􀀠M.fttAJ-lr Organization: 􀁟􀀭􀀭􀀭􀀧􀀭􀀮􀀺􀀺􀀺􀀮􀀮􀀮􀀮􀀺􀀺􀀺􀀮􀀮􀀮􀀺􀀮􀀮􀀮􀀡􀀮􀁟􀁯􀀢􀀧􀀭􀀧􀀭􀀮􀁦􀀮􀀭􀀭􀀭􀀧􀀭􀁦􀀧􀁌􀀮􀁨􀀺􀁬􀀽􀁯􀁉􀀭􀀧􀀭􀀮􀀭􀀧􀁳􀀼􀀽􀁯􀀺􀀮􀀺􀀮􀀢􀀢􀀭􀁔􀀭􀁟􀀺􀁲􀀮􀀮􀀮􀀮􀀮􀀮􀀮 􀀬􀁥􀀽􀀩􀁃􀀮􀀮􀀽􀁴􀁴􀁾􀀺􀁳􀀧􀁟􀁟􀁟􀁟􀁟7 (PWS ID) IfYou Have Internet Access Fax your request for the document on your organization's letterhead stationery along with this page with requested infonnation. The letter should be signed by the community water system manager. The fax number is: 202-785-1845. The designee will receive an encrypted E-mail reply with unique password and user identification. You will also receive an access code to open the document in Adobe Acrobat Reader. Please take all reasonable precautions to protect this infonnation. Once you have received your username and password by E-mail, go to the Web site: http://www.waterisac.orgfEPAdocument.asp and log-in. Follow directions on the web site to access the document. You may download a copy ofAdobe Acrobat Reader from the WaterISAC web site to open the document. For technical assistance in accessing the document, E-mail your question to: info@waterisac.orgorcall: 866-h20-ISAC (426-4722). For questions about the content of the document, E-mail Brian Frazer with EPA's Water Protection Task Force at, frazer.brian@epa.gov. IfYou DO NOT Have Internet Access Fax or mail your request for the document on your organization's letterhead stationery along with this page with requested infonnation. infonnation. The letter should be signed by the community water system manager. The fax number is 202-564-8513. The express mail delivery address is: Environmental Protection Agency, Attn: Documents, Room 2i04A EPA East, 1201 Constitution Ave. NW, Washington DC, 20004. Jfyou send the letter by u.s. Postal Service there will be a significant delay. You will receive the document by registered U.S. mail. Page 3 of 3 HP LaserJet 3200se TOWN Of ADDISON invent 9724502837 FEB-1B-2003 17:32 Fax Call Report Job Date Time Type Identification Duration Pages Result 16 2/18/2003 17:31:14 Send 912027851845 0:42 2 OK PlIBUC WORKS DEPAR1"Ml1\"T -'February U.2000 􀁕􀁓􀁾􀀱􀁬Ptoleaiof( 􀁾􀁭􀀻􀁹􀀠 Wuhiogton, D.C, Attnrtian: G. Tracy Mehan. Ill. 􀁁􀁵􀁩􀁾􀁴􀀠Adminlstndor Cklttlemcn: This i.e to nqutJl a copy ofBrrsehM ThttJ.tt ltfjDm/Dil(ftffor YIi1!OUMJity A;uemMM ()j Cammttnlly Wotu 5)r.rlPnl. l have Inumtt l«iC!!aad my E-nWl &ddteu il jtlim;.c@lciaddjWDlXlJ! 'l"lwlk}'(lu for your aitentiOJl to IlUJ mIlkr, VtltY ttuIy youts, T.own of AddiJon 􀁾􀁾􀀺􀁊􀁦􀁵􀁴􀁾􀁾􀁍􀀺Wow Dim;tor Ccmmuniry Wiler System Manliff et: elui, Trny, ASJIiltantCityMM.ea.er Michie! E. Murphy, ¥.E., Dim10r ofPublie Worb , WaterIWastewater System Incident Checklist NOTE: All emergencies should first be reported to 911 then to EPA's National Response Center at 1-800-424-8802 1. Nature of Incident (explain): Contamination Cyber attack Brief description of incident: Biological Bombs, explosives, etc. Chemical Wastewater treatment plant Interference andlor pass through Radiological other (explain) Phvsical Destruction 2. System Name 3. Party Responsibte for Incident (Name and Address) Address: Phone Number (from caller ID): Telephone: System Contact Name: Tille: 4. Location of Incident Raw Water Water Water Distribution Line Receilling Stream Source Treatment Storage Plan! Facilities Wastewater Collection Other andlor Treatment System (explain): s. Date and Time of Incident 6. Alternate Water Source Exists: Yes I No If yes, give name, type and location: 7. Type(s) of Contaminants, Source and Quantity: Basis of Infonnatlon: S. Celler's Name, Address, Organization and Telephone Number 9. Was an emergency crew db.patched (911 called)? Yes No 911 National Regional other Response Response Center Cenler 10. Which of the following are on scene: I ! Police Firll Ambulance FBI Other Hazardous FEMA EPA State Agency Materials Team (describe) Weather conditions at incident site: Number and types of injuries andlor fatalities (if any): , 11. Who else has been notified (Local/State Agencies, Media)? .12. PWS andlor Wastewater Resources Status: • Additional Monitoring (what , type?) Intakes (number and location) ! Wastewater Collection andlor • Treatment Svstem Status Conservation initiated , (describe) Fire Suppression Capacity Storage Capacity Treatment (describe normal trllatment and if other has been initiated) Communication (alerts to public?) other 13. Call Received By: DateJTime Call Received: ___________________________________________________ _ Threat Identification Checklist Ifyour utility receives a threatening phone call, try to keep the caller on the line to obtain as much information as possible. Record as much information as possible, including; 1. What kind ofthreat is posed? A. Contamination: What kind ofpoison? ________________________ Howmuch? ___________________________________ B. Physical Damage: What kind ofdamage? _______________________ With what kind ofdevice? ________________________ 2. 3.When? ______________________________________ 􀀴􀀮􀁗􀁾􀀿􀀠5. Bywhom? __________________________________ 6. What is your (caller's) name? ___________________________ 7. What is your (caller's) affiliation, ifany? ________________________ 8. What is your (caller's) address/phone #1____________________________ 9. What is the exact wording nfthe "...􀁾􀀬􀀮______________________________ 11. Is the caller's voice _calm _ angry _ laughing _crying _normal _slurred _nasal _clear _lisping _stuttering _cracking _excited --young __ old _familiar· who did it sound .. n ••________________________ _ accented -what nationality, .•t,.v."________. __________ 12. Is the connection clear? (Could it have been awireless or cell phone?) 13. Are there background noises? _street noises· what kind? ________________ _ machinery 􀁾􀀠what _ voices 􀁾􀀠d"';cribe.____________________ _ children. des'crib,e______________________ _ animals· what .•.•.v. ____________________ _ computer keyboard/office _motors -d"';crj,be.___________________ _ music· what kind? ______________ _ other___________________ Name ofperson receiving v ....___________________ Date,_____Time Notify Utility manager phone:._________ Local FBIILaw Enforcement, Phone.____________________________ Other______________-----'phone:______________ CONTACT L1ST1 EMERGENCY PLAN INFORMATION PUBLIC WATER SYSTEM INFORMATION PWS Name: _____________ County,-:__________ PWSID#:Address: ---------------Phone:_____ Office,______,Plant,_______,Fax,_______ Key Personnel (i.e" Mayor, City Manager, President, Owner, etc.) -Mark with * if authorized to spend money. 1. Name Position Phone: Office Home Mobile Fax Pager Radio 2. Name Position Phone: Office Home Mobile Fax Pager Radio 3. Name Position Phone: Office Home Mobile Fax Pager Radio Operations Personnel: (Manager, Operator, Superintendent, etc.) -Mark with' if authorized to spend money. Position Home Radio 2. 􀁎􀁡􀁭􀁥􀁾􀁾􀁾__________ Position Cert. Level:__-----Phone: Office,____=-__ Home___--:::--;:-_ Mobile______ Fax,_______ Pager_______ Radio 3. 􀁎􀁡􀁭􀁥􀀬􀁾􀁾􀀭􀀺 􀁟􀁟􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭POSition Cert. Level=-______ Phone: Office ____:-__ Home___--:::--;:-_ Mobile_______ Fax,_______ Pager_______ Radio 4. 8ack-up/fill-in Operator when Primary Operator is not available: 1. Prepared by EPA, Region 6 and TNRCC Satellite Downlink, produced by TX AWWA, August 6, 2002 Position_____________Name 􀁃􀁥􀁾􀁲􀁴􀁾􀀮􀁌􀁾􀁥􀀭􀁶􀀭􀁥􀁾􀁉􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭Phone: Office,______-=-___ Home_____-=--:-:___ Mobile,___________ Fax______________ Pager_____________ Radio___________ OTHER RESOURCES State Emergency Spill Line Phone ______________ Fax_________ State Program Office Phone ________________ Fax,_______ Regional State Office Phone ________________ Fax._______ LOCAL RESOURCES Police: Phone,_________---'Radio,______Other_______ Fax ________ Fire: Phone.__________Radio,______ Other_______ Fax ________ City/Community Emergency Manager: __-:-;-___________-:-:--:-::-=:--_____ Phone: Office Home,___________MobilelPager________ County Emergency Manager: _______􀁾􀀺􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀭􀀻􀀺􀀭􀀺􀀭􀀭􀀭􀀻􀀭􀀺􀀺􀀻􀁟􀀻􀀻􀀺􀀺􀀻􀁟􀁟􀀭􀀭􀀭Phone: Office Home______.Mobile/Pager_____ TV Station Person Phone Fax TV Station Person Phone Radio Station Person Phone Fax Radio Station Person Phone Fax Newspaper Person Phone Fax Newspaper Person Phone Fax MUTUAL AID AGREEMENTS Other Water Company Person____________ 2 Phone__􀁾______􀁾_____ Fax._____________ Other_______________ Summary of Agreement Other Water Company ______________________________ Person_________________ Phone,__􀁾􀁾􀀭􀀭􀀭􀀭􀁾􀀭􀀭􀀭􀀭􀂭Fax______ ______ Other________________ Summary of Agreement SUPPLIERS (Place if emergency contract is in place) Equipment 1. Equipment Supplied ______=-__________________--=-----,-.,-Company ______________---- ::Person ________----:::-::-___ Position ________________ Phone Fax______ Other_____________________ 2. Equipment Supplied Company _______________,Person'=-____________--:: Position _________________ Phone Fax Other 3. Equipment Supplied,______----;::--________________-=----:-:c,---Company _______________Person:::-_____________Position_____________ Phone Fax Other_______________ ____ Chemicals Chemicals Supplied ________________--::______________--::-----:c::--___________ Company _______________ Person_________ Position_____ Phone Fax Other__ Chemicals Supplied __________________=-______________=---:-:-:____________ _ _ Company ______________--;::-Person ________-:::-:: Position_ Phone Fax Other_______________ Chemicals Supplied ________________--::________ ______----::--:::-_______________ Company _____________ Person,________----:. Position,__ Phone Fax Other______ Construction List Heavy Equipment Available __________,,-____________________________ Company Person,_________________________ Position __________________-=-___ Phone Fax______ Other_____ Expertis-e----------------3 _____ _ List Heavy Equipment Available, ____-=_______________ Company Person Position --------, Phone _________Fax______ Other_____ Expertise____________ Utilities Gas Company Phone_________ Other______ Electric Company Phone_________ Fax______ Other______ Sewer Phone_________ Other Telephone Company Phone,_________ Other______ Alternative Water Supplies (List bottled water suppliers, tank truck owners, etc. Provides Company _______􀁾Person Position Phone,_________,Fax Other Provides Company _______􀁾Person Position Phone,_________,Fax Other Provides Company _____________􀁾Person Position Phone________________ Fax Other Engineering Services Area of Expertise Company ______________􀁾Person Position Phone________________ Fax Other Area of Expertise Company _____________􀁾Person Position Phone__________Fax Other Laboratory Services 1 : Service Provided Company Person Position --------, Phone________________, Fax Other Service Provided Company ________Person, 4 Position Phone Fax Other Repair Radio Repair Company Person Position Phone Fax Other Telemetry Repair Company Person Position Phone Fax Other Other Company Person Position Phone Fax Other 0Well Supplies/Drillers Service Company Person Position Phone Fax Other Service Company Person Position Phone Fax Other EMERGENCY EQUIPMENT AVAILABLE Transportation (List boats, trucks, etc., Type Owner Storage Location Type Owner Storage Location Type Owner Storage Location Communications (List mobile phones, pagers, radios) Type________ Owner________ Storage Location,_____ Type________ OWner Storage Location,_____ Owner Storage Location _____ Pumps Type Size _-:---:-:-_________Owne-r--------Storage Location _______________ Type ________ Size _--:_--:_________ Owner_________ Storage Location _______________ Generators Type Owner___________ 􀁳􀁲􀁯􀁲􀁡􀂷􀁾􀁧􀁾􀁥􀁾􀁌􀀭􀁯􀀭􀁣􀀭􀁡􀀷􀀮􀁴􀁩􀀭􀁯􀁮__-_-_-_-_-_-_-_-_-__=________________ 5 Type Owner Storage Location Chlorine Response Kit Type Owner Storage Location Type Owner Storage Location Other Type Owner Storage Location Type Owner Storage Location Type Owner Storage Location 6 􀁬􀁯􀀯􀁾􀀠􀁃􀁣􀀮􀁾􀀿􀁊􀀭􀀢􀀢􀁢􀀠 UNITED STATES ENVIRONMENTAL PROTECTION AGENCY &f /WASHINGTON. D.C. 20460 SEP I 3 2002 OFFICE OF WATER Dear Community Water System Manager: This letter describes how you can access important new. information concerning water security. It also provides information about new requirements for community water systems .. under the Safe Drinking Water Act, as amended by 􀁲􀁾􀁥􀁮􀁴􀀠legislation on security and bioterrorism. . .' ... On June 12,2002, President Bush signed the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Preparedness and Response Act) into law (PL 107-188). The Bioterrorism Preparedness and Response Act added Section 1433 (a)(1) to the Safe Drinking Water Act, instructing the Environmental Protection Agency (EPA) to "provide baseline information to community water systems required to conduct vulnerability assessments regarding which kinds ofterrorist attacks or other intentional acts are the probable threats to: (a) substaritially disrupt the ability ofthe system to provide a safe and reliable supply of drinking water; or (b) otherwise present significant public health concerns." In response to the new Bioterrorism Preparedness and Response Act, EPA has completed the Baseline Threat Informationfor Vulnerability Assessments ofCommunity Water Systems document to assist water utilities in conducting vulnerability assessments. This report is not a blueprint for developing a vulnerability assessment; however, it does present an overview of threats, methodologies, and strategies for water utilities to consider as you develop the vulnerability assessments required under the new law. You may obtain a copy of this document through the Water Information Sharing apd Analysis Center (WaterlSAC). The WaterISAC is a new service intended to provide a secure forum to share and convey security-related information, Directimurf-or obtaining access to the document through the Web-based WateriSAC are described in the Attachment to this letter. Hold all information contained in the document in confidence and take reasonable 'precautions to protect it. . As noted above, the Bloterrorism Preparedness and Response Act 􀁾􀁱􀁵􀁩􀁲􀁥􀁳􀀠every community water system serving a population of greater than 3,300 persons to: (1) conduct a vulnerability assessment; (2) certify and submit a copy ofthe assessment to the EPA Administrator (within a specified schedule); (3) prepare or revise an emergency response plan that incorporates the results ofthe vulnerability assessment; and (4) certify to the EPA Intomot Address (URL) • http://www.ope.gov ld wl1h Vege;lable 011 Based Inks on,RecyCled Papar (MinImum 30% P.oSlconsumcr) . Administrator, within 6 months ofcompleting the vulnerability assessment, that the system has completed such a plan. The Bioterrorism Preparedness and Response Act establishes the following due dates for certification and submission ofthe vUlnerability assessments, and for certification of the emergency response plans: Systems serving population of: . Certify and submit VA ·by: Certify ERP within 6 mos. of V A but no later than: 100,000 or greater March 31 2003 September 30, 2003 50,000 -99,999 December 31, 2003 June30 2004 i 􀁾􀀬􀀳􀀰􀀱􀀠-49 999 June 30 2004 December 31 2004 I .. Finally, the Bioterrorism Preparedness and Response Act requires EPA to conduct studies in the areas of: (1) prevention, detection, and response to the intentional introduction of contaminants into community water systems and source water for those systems; (2) methods and means by which terrorists could disrupt the supply ofsafe drinking water or take actions against drinking water infrastructure; and (3) zp.ethods and means by which alternative supplies of drinking water could be provided in the event ofthe destruction, impainnent or contamination of public water systems. As required by the Bioterrorism Preparedness and Response Act, EPA will make this information available, as appropriate, to conununity water systems through the WaterISAC or other means. I hope you find the Baseline Threat Information for Vulnerability Assessments of Community Water Systems document helpful as you undertake the very important task of improving the security ofour nation's drinking water infrastructure. Am 1If'Jl./VY1 G. Tracy an, III Assistant Administrator Attachment l .. ; Page 2 of 3 Attachment Directions to Access the Document "Baseline Threat In/ormation/or Vulnerability Assessments a/Community Water Systems Provide the following information on the individual designated to access the document. Follow directions below. Name (printed):-:--_____________ Name (signature): _____________ Title: Organization: _____-,-___________ Phone: E-mail: Public Water System Identification # _"_______ (PWS ID) IfYon Have IJ:lternet Access . • Fax your request for the document on your organization's letterhead stationery along with this page with requested information. The letter should be signed by the community water system mahager. The fax number is: 202-785-1845. • The designee will receive an encrypted E-mail reply with unique password and user identification. You will also receive an access code to open the document in Adobe Acrobat Reader. Please taIce all reasonable precautions to protect this information. • Once you have received your usemame and password by E-mail, go to' the Web site; http://www.waterisac.orgfEPAdocument.asp and log-in. Follow directions on the web site to access the document. You may download a copy ofAdobe Acrobat Reader from the WaterISAC web site to open the document. . • For technical assistance in accessing the document, E-mail your question to: info@waterisac.org or caIl:866-h20-ISAC (426-4722). For questions about the content of th<;! document, E-mail Brian Frazer with EPA's Water Protection Task Force at, frazer.brian@epa.gov. IfYou DO NOT Have Internet Access Fax or mail your request for the document on your organization's letterhead ststionery along with this page with requested information. The letter should be signed by the community water system manager. The fax number is 202-564-8513. The express mail delivery address is: Environmental Protection Agency, Attn: Documents, Room 21 04A EPA East, 1201 Constitution Ave. NW, Washington DC, 20004. Ifyou send the letter by us. Postal Service there will be a significant delay. You will receive the document by registered U.S.S.lIlaii. Page 3 of 3 -.,. _.". CERTIFIED MAIL UNtTED STATES Et-IVIQO/jMENTALP.ROTI,lCT10N MERCY 1';0, 􀀧􀀶􀀰􀁘􀀴􀀲􀀴􀀱􀁾􀀠. CJNCINNATI.OH 45242 " v II III􀁾􀁉OfF1ClAL BUSINESS I'J2!lALTY,FOR PRIVATE USE. $3.QO 7DOO 0520 0012 0621 3773 AN eOU.!lL 􀁏􀁐􀁐􀁏􀁒􀁔􀁕􀁎􀁾􀁔􀁙􀀠EMPLOYER T.:z5 /' P 125Soon . J"HE;£LER NA'r.'r:iR ..'. . CITr OF . ADDISON PO BO;'; 9010 .. ' AQD:f.$I1Nr .TX ?SQO'!-90J 0 . . . : . . 1l,..I,I,J;IL.llm"iJilIl.H . \ . PRESORTED f.II!SULASS I!lAll 􀁐􀁏􀁓􀁔􀁾􀁇􀁾􀀠􀁁􀁬􀁩􀁬􀁬􀁦􀁅􀁾􀁓􀀠􀀱􀀧􀀧􀁜􀀱􀁾􀀠EPI-PERMIT NO•.8-1I5 􀀧􀀿􀀧􀀶􀀨􀁬􀁩􀀮􀁑􀀬􀀮􀀻􀀮􀁩􀀢􀀬􀁾􀁾􀁾􀁾􀀠.....(0 1I...I,f,I.II•••U...ruUl.lu.tJ,r".,HUu,,"inlnuillll 42