The drinking water security and safety amendments of 2002: is America's drinking water infrastructure safer four years later?

• Author: Shermer, Steven D.

INTRODUCTION I. WHAT'S AT STAKE? EVERYBODY DRINKS BOTTLED WATER THESE DAYS ANYHOW A. The Importance of Water B. What Are We Trying to Protect? II. WHAT ARE WE TRYING TO PROTECT OURSELVES FROM? A. Biological Weapons: B. Chemical Weapons: C. Nuclear/Radiological Weapons: D. Cyber Attack: E. Conventional Weapons: F. Other Drinking Water Security Threats: III. IT'S BEEN TRIED BEFORE IV. WAS ANYONE THINKING ABOUT DRINKING WATER SECURITY BEFORE THE SDWA AMENDMENTS? A. Drinking Water Infrastructure Security Before September 11th 1. Presidential Decision Directive 63 2. Other Past Efforts Benefiting Drinking Water Security B. Criticisms of Prior Drinking Water Security Practices V. THE CURRENT LEGAL RESPONSE TO SECURING DRINKING WATER INFRASTRUCTURE: THE DRINKING WATER SECURITY AND SAFETY AMENDMENTS OF THE PUBLIC HEALTH SECURITY AND BIOTERRORISM PREPAREDNESS AND RESPONSE ACT OF 2002 A. SDWA Amendment Provisions 1. Vulnerability Assessments and Emergency Response Plans: a. Vulnerability Assessments b. ERPs 2. EPA's Regulatory and Enforcement Authority Under the SDWA Amendments 3. Research Requirements VI. ARE THE SDWA AMENDMENTS NECESSARY TO PROTECT OUR DRINKING WATER? A. Is Drinking Water Infrastructure Facing a Likely Threat? 1. There are Many Viable Threats to Drinking Water Security a. NBC, Conventional, and Cyber-Based Attacks i. Conventional Weapons ii. Cyber-Based Attacks iii. CBW iv. Radiological Contaminants b. Historical Trends 2. Better Safe Than Sorry a. Nobody Knows What the Likely Threats Are b. Severe Consequences Warrant a Conservative Approach c. Consumers May Not Care About the Actual Likelihood 3. Catastrophic Contamination or Disruption is Unlikely a. Technical Challenges of NBC Weapons i. Radiological and Nuclear Weapons ii. Chemical Weapons iii. Biological Weapons iv. Conventional Weapons b. Drinking Water Infrastructure Vulnerability is Limited i. Distribution Networks ii. Sourcewater and supply iii. Current System Protections 4. We Can Contaminate Our Own Drinking Water, Thank You B. Do Other Environmental Laws Already Adequately Protect Us? 1. Existing Emergency Planning Requirements a. CAA [section] l12(r) b. EPCRA 2. CAA [section] 112(r) and EPCRA Do Not Adequately Protect Drinking Water Infrastructure 3. Contaminating or Disrupting Drinking Water Systems is Already Illegal VII. ARE WE ADDRESSING THE LIKELY THREATS? A. Critical Threat Information Was Not Provided to Drinking Water Utilities 1. The Consequences of Inadequate Baseline Threat Information a. Vulnerability Assessments and ERPs b. Implementation of Security Enhancements c. Response Actions d. Funding Decisions e. Drinking Water Security Program Performance Goals 2. Requiring Updates Under the SDWA Amendments a. Updating Baseline Threat Information b. Updating Vulnerability Assessments and ERPs B. The SDWA Amendments Must Require Security Upgrades 1. Vulnerability Assessments and ERP's Do Not Protect Drinking Water Infrastructure 2. Voluntary Efforts Are Not Enough 3. The Revised Imminent and Substantial Endangerment Provision Does Not Provide Authority to Require Site Security Measures C. Gaps in the SDWA Amendments' Regulatory Coverage 1. Unregulated Drinking Water Systems 2. Wastewater Treatment Plants? VIII. ARE THE SDWA AMENDMENTS A FAILURE? A. The New "Culture of Security" B. Compliance with the SDWA Amendments C. Increased Research and Development D. Training, Technical Assistance, and Funding E. Government Reorganization to Address Drinking Water Security CONCLUSION INTRODUCTION

Since the devastating events of September 11, 2001, addressing the potential vulnerability of our nation's critical drinking water infrastructure to deliberate attack has become a top-priority. (2) This focus on drinking water security stems from renewed concern following September 11th regarding the undeniably severe consequences of damage to or disruption of these critical infrastructure systems. (3) By definition, maintaining the security of these systems is essential to our nation's safety and welfare; both economic and otherwise. (4) Because of how vitally important these systems are to this country's well-being, drinking water infrastructure security is now "a cornerstone of homeland security." (5)

Responding to the "great outcry" that arose after September 11th demanding better protection from terrorism, Congress took action to secure U.S. drinking water systems against future attacks. (6) In June of 2002, the Drinking Water Security and Safety Amendments (hereinafter the "SDWA Amendments") were passed to address the security of community drinking water systems serving over 3,300 people. (7) Under the SDWA Amendments, these drinking water systems must assess their vulnerability to deliberate attempts to disrupt their ability to provide a safe and reliable supply of drinking water. (8) Emergency Response Plans ("ERPs") incorporating the results of the vulnerability assessments must also be developed. (9) In addition, the SDWA Amendments require research into the methods and means that could be used to disrupt the supply of safe drinking water, as well as methods to detect and respond to contamination incidents. (10)

However, over four years after their passage, it is still uncertain whether the SDWA Amendments have made our drinking water demonstrably safer. A key debate remains over which, if any, of the numerous potential threats to drinking water infrastructure are indeed likely. Until this issue is resolved, it cannot be known whether current efforts to bolster drinking water security are properly focused. (11) Indeed, if the likelihood of a successful terrorist attack on drinking water infrastructure is remote, the drinking water industry's significant investment to comply with the SDWA Amendments may have been needless.

Other questions remain regarding whether the SDWA Amendments are a necessary, affordable, or effective measure to improve drinking water infrastructure security. The SDWA Amendments mirror other emergency planning requirements imposed under environmental laws with which cash-strapped drinking water facilities must already comply. It is estimated that complying with just the initial requirements of the SDWA Amendments will cost more than $500 million, and water infrastructure funding is severely limited. (12) This estimate does not include the cost of actually implementing the security measures at drinking water facilities needed to address identified vulnerabilities. Money spent complying with the SDWA Amendments' requirements may therefore be better spent on achieving the goals of existing laws concerning drinking and surface water integrity. (13)

To resolve these key issues, the Environmental Protection Agency (hereinafter EPA) must first fulfill its duty under the SDWA Amendments to develop and provide current "baseline information to community water systems ... regarding which kinds of terrorist attacks or other intentional acts are the probable threats ..." to such systems. (14) Many drinking water security experts believe that EPA failed to provide adequate "baseline information." (15) This rendered drinking water utilities unable to properly assess their vulnerability to relevant threats. Accordingly, EPA must develop and disseminate improved baseline information regarding the probable drinking water threats the SDWA Amendments were intended to address.

In addition, amendments must be made to the SDWA Amendments in order to better achieve the goal of ensuring a safe and reliable supply of drinking water. (16) First, the SDWA Amendments should be amended to require periodic updates of vulnerability assessments and ERPs. Presently, vulnerability assessments and ERPs never need to be updated. As a result, if proper baseline threat information is eventually developed regarding existing threats to drinking water infrastructure, or new threats emerge, drinking water facilities are not required to take such information into account to update their vulnerability assessments or ERPs.

Second, EPA should be granted additional regulatory and enforcement authority under the Safe Drinking Water Act ("SDWA") to require corrective action when unacceptable drinking water infrastructure vulnerabilities are identified. The SDWA Amendments do not provide EPA with "broad general authority to require actions to address security concerns." (17) Only when a "threatened or potential terrorist attack" presents an "imminent and substantial endangerment" to public health may EPA use its narrow "emergency powers" to require drinking water operators to take action to address infrastructure vulnerabilities. (18) However, these emergency powers are untested and uncertain in scope. Without broader general regulatory and enforcement authority, the public cannot be assured that "the necessary security enhancements are being taken" by water utilities to address critical drinking water infrastructure threats. (19)

Finally, the vulnerabilities of drinking water systems not regulated by the SDWA Amendments must be addressed. Drinking water systems serving less than 3,300 people, non-community water systems, new drinking water systems constructed after the SDWA Amendments' effective date, and drinking water systems serving populations that expand beyond 3,300 people are not subject to the SDWA Amendments' requirements. (20) These drinking water systems serve millions of people on a daily basis, yet they are among the most vulnerable to deliberate attack and receive the least funding to address security issues (21) Without a more comprehensive plan to address the security of unregulated drinking water systems, we remain susceptible to many of the same devastating consequences an attack on a larger drinking water system could cause.

Despite these concerns, the SDWA Amendments have helped usher drinking water utilities into "a whole new realm of emergency preparedness." (22) While "[n]o set of legal rules can prevent terrorism.." compliance...