Drinking-water security.

According to a report issued by the American Water Works Association (AWWA), an immense focus on security by American water utilities has resulted in an unprecedented mobilization of effort and resources to protect America's water supply, Drinking Water Security in America After 9/11 identifies the extensive new security measures water utilities have undertaken. It also describes the new culture of security that water utilities now operate under and the challenges they still face.

Working with the U.S. Environmental Protection Agency (U.S. EPA), water utilities have ramped up security efforts at water supply systems throughout the nation. Background checks on new employees have become common, as have intensive employee training, security audits, assessments, and emergency response and communications plans. A nationwide information-sharing system has been developed. Utilities are identifying their most vulnerable traits and are working with local first responders to coordinate planning.

The drinking-water community, in partnership with U.S. EPA and others, actually began to prepare for terrorist threats before September 11, 2001. In 1998, President Clinton signed Presidential Decision Directive 63 and thereby identified water as part of America's critical infrastructure. Under that directive, U.S. EPA was assigned lead responsibility for the water sector and, in turn, designated the Association of Metropolitan Water Agencies (AMWA) as the lead for this sector. At the same time, the American Water Works Association (AWWA) began to prepare technical materials and publications for water utilities relating to water system security. These efforts went into high gear immediately after the terrorist attacks on New York and Washington.

Title IV of the Bioterrorism Act, which was signed into law in June 2002, amended the Safe Drinking Water Act (SDWA) and identified deadlines and requirements for both water utilities and U.S. EPA. The Bioterrorism Act mandated significant new security requirements for all community water systems serving more than 3,300 people. Collectively, these approximately 8,000 utilities serve over 240 million people, or about 90 percent of the population that is served by community water systems. Systems serving more titan 3,300 people must

1. conduct a vulnerability assessment,

2. certify to U.S. EPA that the vulnerability assessment was completed by a date specified in the law,

3. submit a paper copy of the assessment to U.S. EPA,

4. prepare or revise their emergency response plan on the basis of results from the vulnerability, assessment, and

5. certify to U.S. EPA that the emergency response plan has been developed or revised by a certain date.

Deadlines for submission of vulnerability assessments to U.S. EPA depend on the size of the water system:

* systems serving 100,000 or more people--March 31, 2003;

* systems serving between 50,000 and 99,999 people--December 31, 2003; and

* system serving between 3,300 and 49,999 people--June 30, 2004.

Six months after submission of the vulnerability assessment, utilities are required to certify to U.S. EPA that they have developed or revised an emergency response plan on the basis of results from the vulnerability assessment.

Under the Bioterrorism Act, both vulnerability assessments and emergency response plans have to focus on terrorist attacks or other deliberate acts intended to disrupt delivery of a safe and reliable drinking-water supply or to otherwise present a significant health concern. That requirement sets these assessments and plans apart from those that most utilities have had for years for dealing with natural disasters and vandalism.

U.S. EPA has its own set of deadlines in the Bioterrorism Act. Congress required that by August 1, 2002, U.S. EPA complete a baseline threat report with information on likely threats for utilities to consider in the development of a vulnerability assessment. U.S. EPA completed the Baseline Threat Information for Vulnerability Assessments for Community Water Systems and provided this sensitive report to water utilities in the fall of 2002.

The law requires U.S. EPA to develop a protocol for protection of the submitted vulnerability assessments by November 30, 2002. In response, the agency has completed a robust protocol with multiple levels of protection to safeguard vulnerability assessments within a controlled-access facility at U.S. EPA headquarters.

U.S. EPA also is required to conduct research on prevention, detection, and response to contamination and supply disruption. A research plan is under development. Finally, the law requires U.S. EPA to develop a guidance for systems serving fewer than 3,300 people. While these systems are not required to conduct a vulnerability assessment and revise an emergency response plan under the Bioterrorism Act, many are implementing plans to protect their customers.

Virtually all of the largest utilities--those with the earliest deadline of March 31, 2003--submitted their vulnerability assessments to U.S. EPA on or before the deadline. They are now revising their emergency response plans to reflect what they learned in the vulnerability assessment. In addition, utilities are conducting prevention-and-response training. Medium- and smaller-sized utilities across the nation are in the process of developing their vulnerability assessments.

AWWA has estimated that $1.6 billion is needed for the first steps toward greater physical protection, including better fences, locks, lights, and alarms. The cost of other necessary utility security upgrades is highly dependent on local factors such as the level of water security upgrades needed. Such costs have not been estimated at this time, but will be substantial. Without additional local, state, or federal funding, the costs will be passed on to the customer.