Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Safeguarding the Nation’s Drinking Water:

EPA and Congressional Actions

-name redactedSpecialist in Environmental Policy

January 10, 2011

Congressional Research Service

7-....

www.crs.gov

RL31294

CRS Report for Congress

Prepared for Members and Committees of Congress

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Summary

The events of September 11, 2001, focused attention on the security status of the nation’s

drinking water supplies and the vulnerability of this critical infrastructure sector to attack.

Congress since has enacted security requirements for public water systems and has provided

funding for vulnerability assessments, emergency planning, and drinking water research. The

Environmental Protection Agency (EPA), the lead federal agency for the water sector, has worked

with water utilities, state and local governments, and federal agencies to improve the drinking

water security. However, water facilities have not been required to address identified risks and

vulnerabilities, and recent Congresses have considered legislation to mandate such actions.

The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (P.L. 107188) amended the Safe Drinking Water Act to require some 8,400 community water systems to

assess vulnerabilities and prepare emergency response plans. It authorized funding for these

activities and for emergency grants to states and utilities, and it directed EPA to review methods

to prevent, detect, and respond to threats to water safety and infrastructure security. The act did

not require water systems to make security upgrades to address potential vulnerabilities. In most

years since FY2002, Congress appropriated roughly $5 million annually for EPA to work with

states and the water sector to improve the security of drinking water supplies.

In creating the Department of Homeland Security (DHS) with the Homeland Security Act of 2002

(P.L. 107-296), Congress gave DHS responsibility for assessing and protecting the nation’s

critical infrastructures. However, the act did not transfer EPA’s water security functions, and the

2003 Homeland Security Presidential Directive (HSPD-7) affirmed EPA’s lead role in protecting

the water infrastructure. Under this directive, EPA has responsibility for developing and providing

tools and training on improving security to roughly 52,000 community water systems and 16,000

municipal wastewater treatment facilities.

In the 109th Congress, the Department of Homeland Security FY2007 appropriations act (P.L.

109-295) authorized DHS to regulate for three years high-risk chemical facilities, but the law

excluded from coverage drinking water and wastewater treatment facilities.

In the 111th Congress, interest in extending and expanding security requirements for the chemical

facility sector continued, as has debate over whether to include certain water utilities within the

scope of such requirements. House-passed H.R. 2868 would have imposed new security

requirements on drinking water and wastewater utilities, while retaining EPA’s regulatory

authority for water sector utilities. The substitute version of H.R. 2868 reported by the Senate

Committee on Homeland Security and Governmental Affairs excluded water utilities and

proposed to extend DHS chemical facility authority for three years, create voluntary technical

assistance and training programs, and create a best practices clearinghouse.

Although EPA, states, localities, and water utilities have taken steps to address security concerns,

the security of the nation’s water supplies has continued to attract congressional attention. Issues

have included the status of efforts by the water sector to improve security, whether to impose new

federal requirements, funding needs for water systems to make security improvements, the

relative roles and responsibilities of EPA and DHS regarding the water sector, and the status of

research and development of technologies to help water systems detect and address potential

biological and chemical contaminants. This report reviews governmental and water utility efforts

to improve drinking water security.

Congressional Research Service

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Contents

Background...................................................................................................................................... 1

EPA Efforts to Increase Drinking Water Security............................................................................ 2

Information Sharing and Analysis ............................................................................................. 2

Tools and Technical Assistance ................................................................................................. 3

Research .................................................................................................................................... 4

Funding for Drinking Water Security Activities .............................................................................. 5

Bioterrorism Preparedness and Response Act of 2002 .................................................................... 9

EPA and DHS Water Infrastructure Security Roles ....................................................................... 11

Legislation and Issues.................................................................................................................... 12

Chemical Facility Security Issues and Legislation.................................................................. 13

Chemical Facility Anti-Terrorism Standards..................................................................... 13

Administration’s Policy Principles.................................................................................... 14

The 109th Congress............................................................................................................ 15

The 110th Congress............................................................................................................ 15

The 111th Congress ............................................................................................................ 16

Water Utility Concerns...................................................................................................... 19

Assistance for Security Measures............................................................................................ 19

Tables

Table 1. Community Water System Requirements Under the Bioterrorism Act ........................... 10

Contacts

Author Contact Information........................................................................................................... 20

Congressional Research Service

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Background

Ensuring the security of the nation’s drinking water supplies poses a substantial challenge, partly

because the number of water systems is very large and also because the responsibility for

protecting drinking water safety is shared among federal, state and local governments, and public

and privately owned utilities. Nationwide, there are some 155,000 public water systems, and

these systems range greatly in size, serving from as few as 25 persons to more than 1 million

persons. Roughly 52,000 of all public water systems are community water systems (CWSs) that

serve the same residences year-round.1 These 52,000 systems provide water to approximately 292

million people. Some 400 community systems serve more than 100,000 people and provide water

to nearly half of the total population served. Because water supplies support many uses (from

drinking water to fire suppression), their disruption could have significant impacts.2

A 1996 executive order on critical infrastructure protection (E.O. 13010), included water supply

systems as one of eight national infrastructures vital to the security of the United States.3 In 1997,

the President’s Commission on Critical Infrastructure Protection, created by the executive order,

issued a report on the vulnerabilities of these infrastructure sectors and strategies for protecting

them. The Commission identified three attributes crucial to water supply users: water must be

available on demand, it must be delivered at sufficient pressure, and it must be safe for use.4

Actions affecting any of these factors could be debilitating for the infrastructure and also for the

communities that depend on it.

Major threats to water supplies include physical destruction of facilities or distribution systems,

biological or chemical contamination of supplies, and cyber attacks. The 1997 Commission found

that drinking water systems had inadequate protection against the threat of chemical or biological

contamination, and that technology was insufficient to allow detection, identification,

measurement, and treatment of highly toxic, waterborne contaminants. Water utilities were also

found to be vulnerable to cyber attacks as they rely increasingly on computers to control water

flow and pressure and treatment processes. Information sharing was identified as the most

immediate need, although warning and analytical capabilities and research and development all

were found to be insufficient.

Presidential Decision Directive (PDD) 63 on critical infrastructure protection was issued in 1988

in response to these findings and related developments. Under this directive, a public/private

partnership was established to put in place prevention, response, and recovery measures to ensure

the security of the nation’s critical infrastructures against criminal or terrorist attacks. PDD-63

1

Another 19,174 public water systems are non-transient, non-community water systems (NTNCWS), such as schools

or factories, that have their own water supply and generally serve the same individuals for more than six months but not

year-round. More than 86,000 other public water systems are transient non-community water systems (TNCWS), such

as campgrounds and gas stations, that provide their own water to transitory customers.

2

For a broader review of security issues in the water resources sector (including dams and sewage treatment plants),

see CRS Report RL32189, Terrorism and Security Issues Facing the Water Infrastructure Sector, by (name re

dacted).

3

For a review of critical infrastructures, related security issues and protection initiatives, and activities within the

Department of Homeland Security, see CRS Report RL30153, Critical Infrastructures: Background, Policy, and

Implementation, by (name redacted).

4

The President’s Commission on Critical Infrastructure Protection, Critical Foundations: Protecting America’s

Infrastructures. Report of the President’s Commission on Critical Infrastructure Protection, Appendix A, Sector

Summary Reports, October 1997, p. A-45.

Congressional Research Service

1

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

designated the Environmental Protection Agency (EPA) as the lead federal agency for the water

supply sector, and EPA appointed the Association of Metropolitan Water Agencies (AMWA) to

coordinate the water sector. However, before September 11, 2001, the main focus of PDD-63

efforts for all critical infrastructure sectors was on cyber security. Subsequently, the breadth and

depth of efforts to protect the nation’s critical infrastructures have expanded significantly.

EPA Efforts to Increase Drinking Water Security

In 2003, President Bush issued Homeland Security Presidential Directive 7 (HPSD-7), which

affirmed EPA as the lead federal agency for coordinating the protection of the nation’s critical

infrastructure for the water sector. Under this directive, EPA is responsible for developing and

providing tools and training on improving security to roughly 52,000 community water systems

and 16,000 municipal wastewater treatment facilities.

To carry out its water sector responsibilities, EPA established a Water Security Division within the

Office of Ground Water and Drinking Water. This Division works with drinking water and

wastewater utilities, states, tribes, and other stakeholders to improve the security of these utilities

and improve their ability to respond to security threats and breaches. Among its responsibilities

and activities, the Water Security Division provides security and antiterrorism-related technical

assistance and training to the water sector. Although the Water Security Division was established

in 2003, the Office of Water had provided assistance to its stakeholders for a number of years.

Security-related activities undertaken by EPA and the water sector have fallen into five general

categories, including (1) establishing an information center for drinking water alerts or incidents,

(2) developing vulnerability assessment tools, (3) identifying actions to minimize vulnerabilities,

(4) revising emergency operations plans, and (5) supporting research on biological and chemical

contaminants considered to be potential weapons of mass destruction. Several key government

and private sector efforts are reviewed below.

Information Sharing and Analysis

One goal of PDD-63 in 1998 was to establish an Information Sharing and Analysis Center (ISAC)

for each critical infrastructure sector. With assistance from EPA and the Federal Bureau of

Investigation, the Association of Metropolitan Water Agencies has led the effort to develop and

implement an ISAC for water utilities. The WaterISAC provides a secure, web-based

communications link between the water sector and federal homeland security, law enforcement,

intelligence, environmental, and public health agencies. This system gathers, analyzes, and

disseminates threat information specific to the water sector, and is a comprehensive source of

security and disaster preparedness information for drinking water and wastewater utilities.5 The

WaterISAC is supported by membership fees and EPA grants. It has been supplemented with the

Water Security Channel (WaterSC), which provides free email notification of water security alerts

and other information issued by federal government agencies.

5

For further information on the WaterISAC, see http://www.waterisac.org.

Congressional Research Service

2

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Tools and Technical Assistance

EPA has worked with its water sector partners to provide practical tools and technical assistance

to utilities on a wide range of security matters. In 2000, the American Water Works Association

Research Foundation (AWWARF) and the Sandia National Laboratories, with EPA support,

initiated a project to develop a methodology for utilities to use to assess their vulnerabilities and

develop plans to minimize identified risks. The project was expedited after September 11, 2001,

and completed in November 2001, and many large water systems used this risk assessment

methodology to conduct vulnerability assessments. States and drinking water organizations, in

collaboration with EPA, developed additional vulnerability assessment tools, with a particular

focus on the needs of smaller communities. To help cover the costs of conducting vulnerability

assessments and preparing emergency response plans, EPA awarded a total of $51 million in

grants to community water systems that serve more than 100,000 persons. (Congress provided

these funds in the Emergency Supplemental Appropriations Act for FY2002 (P.L. 107-117.)

While direct grants have not been available for smaller water systems, a considerable amount of

technical assistance has been aimed at helping these systems, which typically may have less

capacity to address security concerns. EPA used “train-the-trainer” grants to build a pool of

environmental professionals that has provided training and technical assistance to water systems

serving fewer than 50,000 people.6 In addition, on-site assistance for vulnerability assessment and

emergency response planning was made available to small and medium wastewater utilities at no

cost through the Wastewater Operator Training Program.

Technical assistance also has been provided through numerous guidance documents designed to

help water utilities address a range of security concerns.7 A key product is the Response Protocol

Toolbox: Planning for and Responding to Contamination Threats to Drinking Water Systems,

which is intended to help public water systems respond to contamination threats and incidents.

The “toolbox” includes separate modules that address water utility planning, contamination threat

management, site characterization and investigation, water sample analysis, public health

response, and remediation and recovery.8 Paralleling the toolbox, EPA developed response

guidelines to help water utilities, emergency responders, and other officials during the

management of an ongoing contamination threat or incident.

As a sector, drinking water utilities acted relatively quickly to assess vulnerabilities, upgrade

emergency response plans, and take some initial steps to improve security of this critical

infrastructure. The Office of Homeland Security’s 2003 National Strategy for the Physical

Protection of Critical Infrastructure and Key Assets reported that the water sector had taken great

strides to protect its critical facilities and systems, and had focused on categories of possible

6

EPA generally has not performed security training; rather, the agency has delivered training at locations across the

country through stakeholder organizations and other federal partners. Organizations that have provided training include

professional associations, such as the American Water Works Association, the Water Environment Federation, and the

National Rural Water Association. Congress has provided some grant funds to these organizations, through EPA, to

support their water security training activities.

7

Water security reports, guidance documents, directives, and information on EPA security activities are available at

http://cfpub.epa.gov/safewater/watersecurity/index.cfm.

8

U.S. Environmental Protection Agency, Response Protocol Toolbox: Planning for and Responding to Drinking Water

Contamination Threats and Incidents, August 2004. Available at http://www.epa.gov/watersecurity/pubs/

rptb_response_guidelines.pdf.

Congressional Research Service

3

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

attacks that could have the greatest health or economic consequences.9 However, the report noted

that the water sector needed better threat information to prioritize investments on security

measures. It also reiterated the need for research and development of new monitoring and analytic

capabilities to enhance detection of biological, chemical, and radiological contaminants that could

be introduced to the water supply.

Research

A major security concern for the water sector has been the need for research to develop real-time

monitoring methods to detect contaminants, and to develop technologies to remove or inactivate

them. The water industry and security experts have identified a particular need for research to

develop monitoring technologies that can quickly detect contaminants in water that has already

left a treatment plant for distribution to consumers.

EPA has participated in various research and development projects related to water security,

including research to evaluate the ability of drinking water treatment systems to remove and

inactivate biological and chemical agents. The agency also has supported research efforts to

determine the fate and transport of contaminants within rivers and streams and within water

treatment plants and distribution systems, and to develop biodetectors for detecting and

quantifying biological contaminants in drinking water supplies.

To coordinate and oversee research involving prevention and response to terrorist attacks, EPA’s

Office of Research and Development established the National Homeland Security Research

Center (NHSRC) in 2002. The Center’s key areas of research involve water infrastructure

protection, decontamination and consequence management, and threat and consequence

assessment.

The NHSRC’s Water Infrastructure Protection Division and the Office of Water’s Water Security

Division developed a Water Security Research and Technical Support Action Plan in 2004, to

define a specific program of research and technical support for protecting drinking water and

wastewater facilities from terrorist threats and attacks. The action plan, which was reviewed by

the National Research Council (NRC), addressed drinking water supply, water treatment, finished

water storage, and distribution systems. It identified major research needs in the following areas:

•

protecting physical and cyber infrastructure;

•

identifying drinking water contaminants;

•

improving monitoring systems and analytical methods for drinking water;

•

containing, treating, decontaminating, and disposing of contaminated water and

material;

•

contingency planning;

•

addressing infrastructure interdependencies;

9

Office of Homeland Security, The National Strategy for the Physical Protection of Critical Infrastructures and Key

Assets, February 2003, p. 39. The categories included (1) physical damage or destruction of critical assets (including

the intentional release of toxic chemicals), (2) actual or threatened contamination of the water supply, (3) cyber attack,

and (4) interruption of services from another infrastructure (such as energy supply).

Congressional Research Service

4

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

•

risk assessment and communication; and

•

protecting wastewater treatment and collection systems.10

A key issue regarding the action plan was that it did not discuss the financial resources that would

be required to complete the proposed projects and to implement countermeasures needed to

improve water security. The NRC recommended that EPA attempt to quantify the costs and

benefits associated with the research and technical support projects. The NRC further noted that

more emphasis was needed on communicating the value of water and increased security, because

water rate increases would likely be needed to generate the resources needed to implement

counter measures.11

In a progress report on the action plan, EPA reported that more than 100 projects had been

initiated to address the needs listed in the plan.12 Projects have included a review of early warning

systems, a tracer studies guide for use by water utilities, a treatability guide for biological

contaminants in water, a review of emerging detection technologies for water contaminants, a

review of the impacts of biological toxins on water systems, and performance verifications of the

effectiveness of monitoring, treatment, and decontamination technologies. The Water

Infrastructure Protection Division has lead responsibility for much of this research and has been

producing tools, guides, and other products for use by water utility operators, public health

officials, and emergency responders.

For several years, EPA’s major water security research effort has involved the Water Security

Initiative (WSI), formerly called the WaterSentinel Initiative, which is a demonstration project to

develop a model contamination warning system for drinking water systems. The goal of the

initiative is to establish pilot early warning systems through intensive water monitoring and

surveillance in selected cities. The agency has considered this initiative to be a key element of its

effort to meet its water security responsibilities under HSPD-9.13 As discussed in the following

section, Congress has partially, but not fully, supported this initiative. Using these resources, EPA

has published guidance for the WSI, and funded contaminant warning system pilots in five cities.

Funding for Drinking Water Security Activities

Since 2001, Congress has provided funds annually to EPA to improve the security of public water

supplies. The Emergency Supplemental Appropriations Act for FY2002 (P.L. 107-117) provided

EPA with $175.6 million for emergency expenses to respond to the September 11 attacks and to

support counterterrorism activities. The conference report, H.Rept. 107-350, specified that

approximately $90 million was for improving security at EPA laboratories, performing drinking

water vulnerability assessments, and anthrax decontamination activities. Another $5 million was

10

U.S. Environmental Protection Agency, EPA’s Role In Water Security Research: The Water Security Research and

Technical Support Action Plan, EPA/600/R-04/063, March 2004.

11

National Academy of Sciences, A Review of the EPA Water Security Research and Technical Support Action Plan:

Parts I and II, National Academy Press, 2003.

12

U.S. Environmental Protection Agency, Water Security Research and Technical Support Action Plan—Progress

Report for 2005, pp. 5-7.

13

Homeland Security Presidential Directive-9 directs EPA to develop a comprehensive and fully coordinated

surveillance and monitoring system for drinking water, including a laboratory network to support surveillance and

response activities.

Congressional Research Service

5

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

for state grants for counterterrorism coordinators to work with EPA and water utilities in

assessing drinking water safety. Congress has continued to provide roughly $5 million for these

state grants each year.

During FY2002, EPA allocated roughly $89 million of the amount provided in the emergency

supplemental appropriation to support security enhancements at the nation’s drinking water

systems. Of this amount, EPA targeted approximately $80 million to (1) provide grants to the

largest drinking water systems to conduct vulnerability assessments and enhance emergency

response plans; (2) provide technical assistance on vulnerability assessments and emergency

response plans to small and medium drinking water systems; and (3) refine security-related

detection, monitoring, and treatment tools. Another $4 million was used to accelerate the

development and testing of counterterrorism tools, support vulnerability assessment training,

provide technical assistance, and conduct and implement research on redesign and detection for

collection and treatment systems. EPA also used funds to develop tools and provide training for

medium and small drinking water systems to assess vulnerabilities and develop emergency

response plans. In addition, EPA allocated $5 million to the states to support homeland security

coordination work involving EPA and drinking water utilities.

EPA awarded approximately $51 million in water security grants to the community water systems

that serve more than 100,000 individuals. Grants were made to roughly 400 publicly and privately

owned community water systems for as much as $115,000 per grant. Utilities were able to use

their grants to develop vulnerability assessments, emergency response plans, and security

enhancement plans and designs. Utilities also could use grant funds for in-house or contractor

support; however, funds could not be used for physical improvements.

Although these grants were made only to large systems, EPA has worked with states and utilities

to help meet the security needs of small and medium-sized drinking water systems. EPA provided

roughly $20 million of FY2002 supplemental funds directly to the states for technical assistance

and training for drinking water systems serving fewer than 100,000 people.

For FY2003, EPA requested $16.9 million to assist small and medium-sized systems with

vulnerability assessments and emergency response plans, and $5 million in grants to states to

support homeland security coordination. The Consolidated Appropriations Resolution for FY2003

(P.L. 108-7), provided this amount. It also contained several drinking water security earmarks,

including $2 million for the National Rural Water Association to help small water systems

conduct vulnerability assessments and $1 million for the American Water Works Association for

water security training activities.

As requested for FY2004, EPA received approximately $32 million for critical water

infrastructure protection, including $5 million for state homeland security grants in P.L. 108-199.

This funding supported states’ efforts to work with water and wastewater systems to develop and

enhance emergency operations plans; conduct training in the implementation of remedial plans in

small systems; and develop detection, monitoring and treatment technology to enhance water

security. EPA used funds to assist the nearly 8,000 community water systems that serve water to

populations between 3,300 and 100,000 and are subject to the Bioterrorism Act. P.L. 108-199 also

included $2 million for the WaterISAC to gather, analyze, and disseminate sensitive security

information to water and wastewater systems.

For FY2005, EPA requested $5 million for state water security grants and $6.1 million for other

critical infrastructure protection efforts. EPA’s budget justification explained that the $21.3

Congressional Research Service

6

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

million reduction reflected a shift in priorities from assistance and training on vulnerability

assessments. (Under the Bioterrorism Act, community water systems were required to complete

vulnerability assessments by June 30, 2004.) Congress provided the requested amount in the

Consolidated Appropriations Act, FY2005 (P.L. 108-447). As in FY2004, the appropriated

amount included $2 million for the WaterISAC.

In the FY2006 budget request, the President again requested $5 million for state water security

grants. The President also requested $44 million to launch the Water Sentinel Initiative, a

demonstration project to develop a model contamination warning system, now called the Water

Security Initiative (WSI). EPA initiated this project to meet agency responsibilities under

Homeland Security Presidential Directive (HSPD) 9, which directed EPA to develop a

surveillance and monitoring program to provide early detection in the event of a terrorist attack

contaminating water. The goal of the initiative is to establish pilot early warning systems through

intensive water monitoring and surveillance for certain chemical and biological contaminants in

five cities. Further responding to HSPD-9, EPA proposed to form a laboratory network to support

the monitoring and response requirements of the surveillance program.14

In EPA’s FY2006 appropriations act (P.L. 109-54), Congress provided $8.1 million (after

rescissions) of the $44 million requested for the WSI. In recommending a large reduction, the

House Appropriations Committee recommended that EPA develop clear goals for the initiative,

seek the advice of the Science Advisory Board, and justify the request more clearly in the budget

request for FY2007.15 Congress also provided $5 million ($4.93 million after rescissions) for state

water security grants.

The FY2007 budget request included $4.95 million for state water security grants. Additionally,

the request again included a significant amount, $41.7 million ($33.6 million more than Congress

provided for FY2006), for the WSI. In its justification for the request, the agency noted that the

program is an essential component of its water security activities, and explained that its purpose is

to demonstrate an effective contamination warning system that could be used by drinking water

utilities of various sizes.

The EPA FY2007 funding bill, H.R. 5386, as passed by the House, would have provided $16.7

million (or $25 million less than requested) for the WSI. The Senate Appropriations Committee

(S.Rept. 109-275) recommended $18.13 million, which was $23.6 million less than requested but

$10 million above the FY2006 enacted level. The House Appropriations Committee report for

H.R. 5386 (H.Rept. 109-465) stated that the committee’s recommended funding level for the

initiative included money for one additional WSI pilot project, which should be located in a

metropolitan area that is highly vulnerable from a homeland security threat perspective. Congress

did not complete action on this appropriations bill. The final continuing appropriations resolution

for FY2007 (P.L. 110-5, H.J.Res. 20) generally funded EPA at the FY2006 level, but EPA used its

discretion and allocated $27 million for the WSI.

For FY2008, EPA requested $25.6 million to support its water sector responsibilities to protect

critical water infrastructure, including $21.88 million for the WSI. The agency proposed to use

14

U.S. Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional Justification, Science

and Technology, Homeland Security: Critical Infrastructure Protection, pp. S&T-21 - S&T-23.

15

U.S. Congress, House Committee on Appropriations, Department of the Interior, Environment, and Related Agencies

Appropriation Bill, 2006, report to accompany H.R. 2361, 109th Cong., 1st sess., H.Rept. 109-80, p. 94.

Congressional Research Service

7

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

the requested funds to support the existing pilot and to establish additional pilots, with a goal of

having all planned pilots under way by 2008. EPA also proposed to continue providing special

assistance to high-priority water systems under the Water Alliance for Threat Reduction (WATR)

program. The goal of this assistance is to ensure that water utilities have tools and information to

prevent, detect, respond to, and recover from terrorist attacks, other intentional acts, and natural

disasters. The request again included $4.95 million for state water security grants.

The committee report accompanying the House-passed EPA appropriations bill, H.R. 2643

(H.Rept. 110-187, p. 98), recommended reducing the amount requested for the WSI by $3.88

million. The House Appropriations Committee explained that late action on the 2007 budget had

delayed the obligation of funds for pilot projects until FY2008. In the Senate, the Appropriations

Committee recommended a $10 million decrease for the initiative (S. 1696, S.Rept. 110-91, p.

52), also noting that EPA plans to carry forward a large balance of unobligated funds. Both the

House and Senate committees urged EPA to be prepared to report to the committees on the status

and accomplishments of the WSI pilot projects. After applying the 1.56% rescission, the

Consolidated Appropriations Act for FY2008 (P.L. 110-161) provided $11.7 million for the WSI

and $4.87 million for state grants.

For FY2009, EPA requested $21.4 million for the WSI, $1.3 million for the Water Alliance for

Threat Reduction, and $4.9 million for state grants. EPA proposed to use WSI funds to support

two new surveillance and monitoring pilots, bringing the total number of pilot projects to five. In

its budget justification, the agency explained that five projects would be sufficient to generate the

range of data needed for the program to have broad application to a variety of utilities in high-risk

cities nationwide. Additionally, EPA planned to continue working with sector partners to establish

the Water Laboratory Alliance (WLA). The WLA is intended to provide a network of laboratories

that would be able to help confirm and speed responses to intentional contamination events. EPA

further proposed to use FY2009 funds to continue to support research to develop methods to

detect chemical and biological contaminants and to evaluate event detection software; the agency

estimated that 90% of high-concern contaminants lack validated analytical methods.16 Again,

Congress did not pass specific EPA appropriations, and the 2009 Omnibus Appropriations Act

(P.L. 111-8) generally funded EPA programs at FY2008 levels.

EPA’s FY2010 budget request proposed to eliminate the state homeland security grants for

drinking water and wastewater systems. The agency noted that actions required by the 2002

Bioterrorism Act (i.e., preparation of vulnerability assessments and emergency response plans)

have been completed, and demand for these funds had declined. Within the Science and

Technology Account, EPA requested $22.4 million to complete funding for cooperative

agreements supporting the fourth and fifth pilots in the WSI pilot program and to provide

technical assistance to the other pilot projects. EPA also requested $1.3 million for the Water

Alliance for Threat Reduction (WATR) program to support additional training sessions for water

systems that serve more than 100,000 people.17 The request further proposed to support research

evaluating chemical, biological, and radiological (CBR) analytical methods and detection

software, and assist with outreach efforts to transfer knowledge gained from the pilot projects to

the water sector. The conference agreement for the Department of the Interior, Environment, and

16

U.S. Environmental Protection Agency, FY2009 Annual Performance Plan and Congressional Justification, Science

and Technology, Homeland Security: Critical Infrastructure Protection, pp. 68-70.

17

U.S. Environmental Protection Agency, FY2010 Annual Performance Plan and Congressional Justification, Science

and Technology, Homeland Security: Critical Infrastructure Protection, pp. 75-78.

Congressional Research Service

8

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Related Agencies Appropriations Act, 2010 (P.L. 111-88, H.Rept. 111-316), specifies that the law

fully funds the remaining two WSI pilot projects. The WSI received $18.6 million for FY2010.

For FY2011, the President requested $11.6 million for the water security initiatives discussed

above, including $10.4 million for the WSI and $1.2 million for WATR. The agency noted that the

proposed $7 million reduction reflects completion of funding for establishing five full-scale

contamination warning system demonstration pilots. The requested FY2011 funding is primarily

being used for WSI outreach, support, and evaluation activities.18 The Continuing Appropriations

and Surface Transportation Extensions Act, 2011 (P.L. 111-322), continues funding for EPA

programs at FY2010 levels through March 4, 2011.

Thus far, Congress has not provided funding in EPA appropriations for grants to water systems

specifically for making security improvements. However, EPA has identified numerous security

measures that are eligible for funding through the state-administered Drinking Water State

Revolving Fund (DWSRF) program. Eligible measures include making facility improvements,

such as adding fencing, cameras, and lighting; securing chemical and fuel storage; hiring guards;

and adopting enhanced filtration and disinfection treatment.19 Congress has provided roughly

$830 million annually for this program in recent years. However, it is uncertain how readily funds

might become available for security measures, as the key purpose of the DWSRF is to facilitate

compliance with federal drinking water regulations, and competition for these funds can be

considerable.

Another potential source of funding for community water systems is the State Homeland Security

Grant Program, administered by the Department of Homeland Security (DHS). Congress

provided $950 million for each of FY2008 and FY2009 for this program, which provides

assistance to states to detect, prevent, and respond to terrorist attacks. States are required to

allocate 80% of the grant funds received under this program to localities, in accordance with their

approved homeland security plans. Funds may be used for homeland security-related training and

for protecting critical infrastructure, including making physical security improvements. Local

public works agencies, including water districts, are eligible to receive funding from the state;

however, most of these funds have been used to support first responders. Moreover, for FY2009

and FY2010, Congress specified that 25% must be used for law enforcement terrorism prevention

activities and $60 million for border states to address illegal immigration, thus reducing the

amount potentially available for water security purposes.20

Bioterrorism Preparedness and Response Act of 2002

In 2002, two major laws were enacted that address the security of the nation’s critical

infrastructure. While the Homeland Security Act of 2002 broadly addressed critical infrastructure

protection, the Bioterrorism Preparedness and Response Act of 2002 specifically aimed at

improving the security of drinking water supplies.

18

U.S. Environmental Protection Agency, FY2011 Budget in Brief, http://www.epa.gov/ocfo/budget/2011/2011bib.pdf.

See EPA Fact Sheet, Use of the Drinking Water State Revolving Fund (DWSRF) to Implement Security Measures at

Public Water Systems, EPA 816-F-02-040, November 2001. Available at http://www.epa.gov/safewater/dwsrf/pdfs/

security-fs.pdf.

20

For information on DHS grant programs, see CRS Report R40246, Department of Homeland Security Assistance to

States and Localities: A Summary and Issues for the 111th Congress, by (name redacted).

19

Congressional Research Service

9

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Title IV of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002

(P.L. 107-188, 42 U.S.C. 300i) amended the Safe Drinking Water Act (SDWA) to require

community water systems serving more than 3,300 individuals to conduct an assessment of their

system’s vulnerability to terrorist attacks or other intentional acts to disrupt the provision of a safe

and reliable drinking water supply. These water utilities were required to certify that they had

conducted a vulnerability assessment and to submit a copy of the assessment to EPA. The act also

required the utilities to prepare or revise emergency response plans incorporating the results of

the vulnerability assessments no later than six months after completing them. (Table 1 outlines

the schedule for the roughly 8,400 water systems that were required to submit vulnerability

assessments to EPA and complete emergency response plans.) As required, EPA issued guidance

on conducting vulnerability assessments, preparing emergency response plans, and addressing

threats to assist smaller water systems that were not covered by the Bioterrorism Act.21 EPA

reports that the large- and medium-sized water systems achieved 100% compliance with the act’s

requirements, while smaller systems achieve nearly 100% compliance.

Table 1. Community Water System Requirements Under the Bioterrorism Act

System size by population served

(est. no. of systems)

Date for completing

vulnerability assessments

Date for completing

emergency response plans

100,000 or more

(approx. 400)

March 31, 2003

September 30, 2003

50,000 - 99,999

(approx. 460)

December 31, 2003

June 30, 2004

3,301 - 49,999

(approx. 7,500)

June 30, 2004

December 31, 2004

The act exempted the contents of the vulnerability assessments from disclosure under the

Freedom of Information Act (except for information contained in the certification that identified

the system and the date of the certification). As required by the Bioterrorism Act, EPA developed

protocols to protect the vulnerability assessments from unauthorized disclosure. The act provides

for civil and criminal penalties for inappropriate disclosure of information by government

officials.

The Bioterrorism Act authorized $160 million for FY2002, and such sums as may be necessary

for FY2003-FY2005, to provide financial assistance to community water systems to conduct

vulnerability assessments, to prepare response plans, and for expenses and contracts to address

basic security enhancements and significant threats. (Security enhancements could include

purchase and installation of intruder detection equipment and lighting, enhancing security of

automated systems, personnel training and security screening of employees or contractors, etc.

Funding could not be used for personnel costs, plant operations, monitoring or maintenance.)

For grants to states and water systems to assist in responding to emergency situations, the act

authorized $35 million for FY2002, and such sums as may be necessary thereafter. Finally, the act

authorized $15 million for FY2002, and such sums as may be necessary for FY2003 through

FY2005, for EPA to review methods by which terrorists or others could disrupt the provision of

safe water supplies, and methods for preventing, detecting, and responding to such disruptions.

21

EPA published Water Security Strategy for Systems Serving Populations Less than 100,000/15MGD or Less (2002).

Congressional Research Service

10

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

EPA and DHS Water Infrastructure Security Roles

The Homeland Security Act of 2002 (P.L. 107-296) combined the functions of all or parts of 22

federal agencies and departments into a new Department of Homeland Security (DHS). The act

gave key responsibility for critical infrastructure protection to DHS, but did not transfer EPA

water security functions to the new department.22

With the establishment of DHS, which has overall responsibility for critical infrastructure

vulnerability assessment and protection, the relative roles and responsibilities of EPA and DHS

were not clear. In late 2003, the White House issued Homeland Security Presidential Directive 7

(HSPD-7), which superseded PDD-63. This Directive established national policy and outlined the

roles and responsibilities of federal departments and agencies regarding critical infrastructure

protection. It identified EPA as the federal agency (Sector-Specific Agency (SSA)) with lead

responsibilities for ensuring the protection of the water infrastructure sector from terrorist attacks

or sabotage. Under HSPD-7, DHS is responsible for overall coordination and integration of

national critical infrastructure protection efforts by federal, state, and local governments and the

private sector, whereas EPA is responsible for developing and providing water security tools and

training for the nation’s community water systems and municipal wastewater treatment facilities.

Some additional articulation of EPA’s role was provided by HSPD-9, which established a national

policy to defend the nation’s water, agriculture, and food systems against terrorist attacks, major

disasters, and other emergencies. This directive instructed EPA to develop a comprehensive

surveillance and monitoring program to provide early detection of contaminants in water systems.

HSPD-9 also directed EPA to develop an integrated network of water quality laboratories to

support the surveillance program. EPA has pursued these responsibilities through its Water

Security Initiative and Water Alliance for Threat Reduction program.

As both EPA and DHS have responsibilities for protecting critical water infrastructure, the

potential for overlap and duplication is perhaps unavoidable. EPA and DHS, for example, have

separate communications and information-sharing networks, and have had different policy

advisory groups. In recognition of the need for a coordinating entity for the water sector, the

major drinking water and wastewater organizations established the Water Sector Coordinating

Council (WSCC) in 2004. This council is associated primarily with DHS, but coordinates with

both agencies. In 2005, EPA and DHS facilitated the formation of a parallel Water Sector

Government Coordinating Council (GCC) to enable interagency and cross-jurisdictional

coordination. Members include DHS, EPA, the U.S. Army Corps of Engineers, the Bureau of

Reclamation, the Federal Energy Regulatory Commission, the Centers for Disease Control and

Prevention, state water and wastewater associations, and others. Chaired by EPA and co-chaired

by DHS, the GCC coordinates strategies, activities, policies, and communication across

government entities. The WSCC and GCC work together to coordinate critical infrastructure

protection activities within the water sector.

A key requirement for DHS under HSPD-7 was to develop a national strategy to protect all

critical infrastructure and key resources (CI/KR). Issued by DHS in June 2006 and revised in

January 2009, the National Infrastructure Protection Plan (NIPP) is intended to provide a unifying

22

For a review of DHS reorganization actions related to critical infrastructure protection, see CRS Report RL30153,

Critical Infrastructures: Background, Policy, and Implementation, by (name redacted).

Congressional Research Service

11

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

structure for integrating CI/KR protection efforts into one national program. More specifically, it

describes processes for (1) setting security goals; (2) identifying key assets; (3) assessing risks;

(4) prioritizing assets as a basis for allocating resources; (5) implementing protection programs;

and (6) measuring the effectiveness of CI/KR protection efforts.23

The NIPP called for each sector’s lead agency to work with its sector to develop Sector Specific

Plans (SSPs) consistent with the NIPP. EPA’s Water SSP is one of seven plans (out of 17) that are

publicly available.24 Taken together, the NIPP and the SSP are intended to provide the structure

necessary to coordinate and synchronize activities under various laws, presidential directives,

strategies, and initiatives into a unified national approach to protecting critical infrastructure. The

goal of the Water SSP is to develop the sector’s strategy and programs to protect CI/KR assets,

identify priorities based on risk analysis, describe the resources needed to protect CI/KR, track

progress, identify gaps, establish research and development priorities, and work with DHS to

continuously improve the NIPP. The SSP also helps define the roles and responsibilities of EPA

(as the Water Sector SSA) and other sector partners. Overall, the Water SSP is intended to assist

drinking water and wastewater utilities to be better prepared to prevent, detect, respond to, and

recover from terrorist attacks, other intentional acts, natural disasters, and other hazards.

The relative roles of EPA and DHS with regard to water sector security have also been at issue in

debates on legislation to impose security requirements at chemical facilities. Several such bills in

recent years have proposed to include certain water utilities within the scope of chemical facilities

subject to regulation by DHS. This issue continues to receive attention and is discussed below.

Legislation and Issues

A key water sector issue has involved the status and adequacy of public and private efforts to

improve the security of public water systems. Because of actions on the part of drinking water

utilities, EPA, and Congress, vulnerability assessment and planning efforts in the water sector

proceeded more rapidly than those in certain other sectors (such as chemical facilities).

Additionally, numerous water utilities have implemented various practices to improve security at

their facilities. In a 2008 survey of water and wastewater utilities 98% of roughly 300 responding

drinking water utilities reported that they have in place physical or procedural controls to

safeguard hazardous chemicals.25 However, the number of respondents was relatively small, and

it is unclear how much has been done more broadly within the sector to implement security

upgrades. Although the Bioterrorism Preparedness and Response Act required community water

systems to conduct vulnerability assessments and prepare emergency response plans, it did not

require systems to make security upgrades to address any identified vulnerabilities. 26

Consequently, interest in water sector security issues has persisted.

23

The NIPP, as revised in 2009, can be found at http://www.dhs.gov/xprevprot/programs/editorial_0827.shtm. The

revisions reflect program and procedural developments; underlying policies remain unchanged.

24

The Water Sector-Specific Plan is available at http://www.epa.gov/safewater/watersecurity/pubs/

plan_security_watersectorspecificplan.pdf.

25

Ross and Associates Environmental Consulting, Ltd., Water Sector Measures Analysis, prepared for the Water Sector

Coordinating Council and WaterISAC, December 30, 2008.

26

SDWA §1433(b) states that emergency response plans “shall include, but not be limited to, plans, procedures, and

identification of equipment that can be implemented or utilized in the event of a terrorist or other intentional attack on

the public water system. The emergency response plan shall also include actions, procedures, and identification of

(continued...)

Congressional Research Service

12

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Chemical Facility Security Issues and Legislation

An issue for the water sector that has received significant legislative attention for several years

involves the security of chemical facilities, including certain drinking water and wastewater

utilities that are located where a terrorist attack could cause harm to nearby populations. For

water utilities, the primary concern is the onsite storage of hazardous, gaseous chemicals

(particularly chlorine) that pose potential risks to local communities if released. Bills to impose

security planning and improvement requirements on such drinking water (and wastewater)

facilities have been considered in past several years, but none has been enacted.

Chemical Facility Anti-Terrorism Standards

In the DHS FY2007 appropriations act (P.L. 109-295, Section 550), the 109th Congress authorized

DHS to regulate, for three years, high-risk chemical facilities, excluding drinking water and

wastewater treatment facilities and facilities in ports. The act directed DHS to establish risk-based

security performance standards for designated chemical facilities, and to require these facilities to

prepare vulnerability assessments and security plans. To implement this provision, DHS

promulgated regulations in 2007 that established Chemical Facility Anti-Terrorism Standards

(CFATS). These standards require chemical facilities to report the amounts and types of

chemicals onsite so that DHS can determine whether a facility will be further regulated by

CFATS rules. Regulated facilities are placed into one of four tiers, based on risk and performance.

The facilities placed in the highest-risk tier are subject to the most stringent security

requirements. Pursuant to P.L. 109-295, the CFATS regulations were scheduled to expire in

October 2009.

In both the DHS FY2010 and FY2011 budget justifications, the Administration requested that the

CFATS regulations be extended for one year without change. Congress extended CFATS authority

through October 4, 2010, in the DHS appropriations bill for FY2010 (P.L. 111-83). After several

short term continuing resolutions for FY2011, Congress extended DHS authority to regulate

chemical facilities through March 4, 2011, under the Continuing Appropriations Act, 2011 (P.L.

111-322).

Also in the 111th Congress, the House passed H.R. 2868, to revise and codify security

requirements for chemical facilities and impose new security requirements on drinking water and

wastewater utilities. The bill would have given EPA regulatory authority for administering water

and wastewater utility security provisions. The drinking water and wastewater facilities titles in

H.R. 2868 essentially incorporated H.R. 3258, the Drinking Water System Security Act of 2009,

which was reported by the House Committee on Energy and Commerce. In the Senate, the

Committee on Homeland Security and Governmental Affairs reported H.R. 2868, amended in the

nature of a substitute, in December 2010. The Senate bill would have extended the current DHS

CFATS program for three years and established voluntary security training programs, but did not

address water utilities. No further action occurred on these proposals. (The bills are discussed in

more detail under the “The 111th Congress” section below.)

(...continued)

equipment which can obviate or significantly lessen the impact of terrorist attacks or other intentional actions on the

public health and the safety and supply of drinking water provided to communities and individuals.” (42 U.S.C. 300i-2)

Congressional Research Service

13

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Administration’s Policy Principles

Water sector interests generally have argued that water utilities should remain exempt from DHS

regulation of chemical facilities, as they already have been subject to several EPA requirements

under the Bioterrorism Act (i.e., vulnerability assessments and emergency response planning),

and also to the risk management planning requirements of the Clean Air Act. (The risk

management planning provisions apply to more than 2,800 of the largest water systems.27) These

stakeholders note that EPA has been designated the lead agency for water infrastructure security

and already has an established water security program.

Nonetheless, there is continued congressional interest in expanding security requirements for the

chemical facility sector, and in including certain water utilities within the scope of such

requirements. Moreover, EPA and DHS officials have testified before subcommittees of the

House Energy and Commerce Committee, the House Homeland Security Committee, the Senate

Homeland Security and Governmental Affairs Committee, and before the Senate Environment

and Public Works Committee in support of closing “the existing security gap” for drinking water

and wastewater utilities by addressing their statutory exemption from CFATS.

In March 2010, testifying before the Senate Committee on Homeland Security and Governmental

Affairs, the EPA Assistant Administrator for Water presented the Administration’s policy

principles for regulating security at water sector facilities. These principles are:

•

EPA should be the lead agency for chemical security for drinking water and

wastewater systems, with DHS supporting EPA’s efforts;

•

to address chemical security in the water sector, EPA would use, with

modifications as appropriate considering statutory requirements and the

uniqueness of the water sector, DHS’s existing risk assessment tools and

performance standards for chemical facilities;

•

DHS should be responsible for ensuring consistency of high-risk chemical

facility security across all 18 infrastructure sectors; and

•

to enhance the security of high-risk chemical storing facilities, where possible,

these facilities should use safer technology such as less toxic chemicals. Facilities

posing the highest degree of risk should be required to implement IST methods if

such methods enhance overall security, are feasible, and consider public health

and environment requirements.

In addition to these principles, EPA also supports legislative provisions that would provide states

a key role in regulating chemical security at water systems, including a prominent state role in

IST determinations and audits and inspections.28

27

Clean Air Act section 112(r) imposes risk management planning and reporting requirements for facilities storing,

using, or handling more than threshold quantities of regulated chemicals. The act’s general duty clause directs owners

and operators of stationary sources to identify hazards that may result from accidental releases, to design and maintain

a safe facility, and to minimize the consequences of releases when they occur. Under Section 112(r), EPA requires

facilities to submit a risk management plan describing the facility’s program to prevent releases of harmful chemicals

and mitigate the severity of any releases. Plans include analyses of the potential offsite consequences of a worst-case

accidental release, a release prevention program, and emergency response planning.

28

U.S. Congress, Senate Committee on Homeland Security and Governmental Affairs, hearing on Chemical Security:

Assessing Progress and Charting a Path Forward, testimony of Peter Silva, Assistant Administrator for Water,

(continued...)

Congressional Research Service

14

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

The 109th Congress

Several bills in the 109th Congress targeted high-consequence facilities within the water sector. S.

2855 proposed to amend the Safe Drinking Water Act to require community water systems to

replace hazardous, gaseous chemicals with inherently safer technologies (IST), for example, by

switching from the use of chlorine gas to liquid chlorine. S. 2855 also would have required EPA

to provide grants to high-consequence facilities for use in paying capital expenditures needed to

make the transition to the use of IST. S. 2781 and S. 1995 proposed to amend the Clean Water Act

to address security at wastewater treatment facilities.

The Senate Committee on Environment and Public Works reported a wastewater treatment

facilities bill, S. 2781 (S.Rept. 109-345), which did not contain IST requirements but did

authorize grants to wastewater treatment facilities for security-related efforts, including

conducting vulnerability assessments, preparing site security plans, and making security

upgrades. An identical bill was offered in the 110th Congress (S. 1303).

Broader chemical facility security bills also were offered in the 109th Congress that had

implications for water utilities. These bills generally would have authorized the Secretary of the

Department of Homeland Security to regulate chemical facilities, including water treatment

plants, that pose certain risks. S. 2145, as reported by the Senate Homeland Security and

Governmental Affairs Committee (S.Rept. 109-332), and its companion bill, H.R. 4999, proposed

to require the Secretary of DHS to issue rules designating which chemical facilities would be

subject to regulation, and to establish security performance standards for such facilities. Under

these bills, facilities would have been required to submit to DHS vulnerability assessments,

security plans, and emergency response plans for terrorist incidents. H.R. 5695 (H.Rept. 109-707)

shared several similarities with S. 2145, but would have exempted water facilities covered by the

legislation from redundant requirements (such as conducting vulnerability assessments), unless

the DHS determined that more stringent security requirements were needed. S. 2486 proposed to

cover a wider range of facilities and establish a general duty to ensure that facilities would be

designed, operated, and maintained in safe manner; the bill prescribed this obligation to include

use of IST to the maximum extent practicable. H.R. 1562 would have required consultation

between DHS and EPA, and would have imposed stronger security and emergency planning

measures, rather than requiring changes in technology. H.R. 2237 would have expanded EPA’s

existing authority to oversee chemical facilities but would have required consultation with DHS.

The 110th Congress

Because of the scope and time limitation of DHS authority to regulate chemical facilities, as well

as implementation issues, chemical facility security remained on the congressional agenda. In

particular, in the interim final rule, DHS stated that it might preempt future state and local

chemical facility security regulations. In response to this preemption language, the 110th Congress

amended P.L. 109-295 in the Consolidated Appropriations Act, 2008 (P.L. 110-161) to establish a

state’s right to promulgate chemical facility security regulations that are at least as stringent as the

federal chemical facility security regulations. P.L. 110-161 further provided that state regulations

would be preempted only in the case of an actual conflict between federal and state regulations.

(...continued)

USEPA, March 3, 2010.

Congressional Research Service

15

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Several other bills were introduced to modify DHS authority to regulate chemical facilities.

Perhaps of most interest to the water sector was H.R. 5577 (H.Rept. 110-550), the Chemical

Facility Anti-Terrorism Act of 2008. Reported, as amended, from the House Committee on

Homeland Security in March 2008, H.R. 5577 would have revised, expanded, and made

permanent DHS’s authority to regulate chemical facility security. As noted, water and wastewater

facilities are explicitly exempt from P.L. 109-295 and related CFATS regulations; however, these

utilities were not categorically exempt under H.R. 5577. This legislation would have directed the

DHS Secretary to maintain a list of covered chemical facilities determined to be of sufficient

security risk, based on several criteria: (1) the likelihood that the facility would be the target of an

attack; (2) the potential extent and likelihood of death or injury, or harm to the environment,

critical infrastructure, national security, or the economy that could result from an incident; and (3)

the proximity of the chemical facility to population centers. The bill also would have authorized

DHS to designate any chemical substance as a “substance of concern” and to establish and revise

the threshold quantity for designated substances.

Further, H.R. 5577 proposed to require owners and operators of covered facilities to conduct

vulnerability assessments and to develop and implement DHS-approved security plans. To

address the possibility of redundant federal requirements, DHS would have been authorized to

consider whether requirements under other laws (such as the Bioterrorism Preparedness Act)

satisfied these requirements. Another provision would have required owners and operators of

affected facilities to complete an analysis of “methods to reduce the consequences of a terrorist

attack” (the bill did not use the term “inherently safer technologies”), and would have authorized

the DHS Secretary to require higher risk facilities to implement such methods or technologies

under certain conditions. As amended in markup, the Secretary would not have been authorized to

order drinking water or wastewater facilities to implement inherently safer technologies unless

DHS provided funding to assist with the conversion. Also of relevance to the water sector was the

provision authorizing DHS to order a facility assigned to the high-risk tier to cease operations if

the facility failed to comply with a DHS compliance order. As reported, H.R. 5577 would have

authorized DHS to order the shut down of a water facility only if the facility’s continued

operation presented a clear danger to homeland security.

The House Committee on Energy and Commerce, which traditionally has held jurisdiction over

drinking water safety issues, was granted an extension for consideration of H.R. 5577. The bill

was not referred to the House Committee on Transportation and Infrastructure, which has key

jurisdiction over wastewater utilities. No further action occurred on this legislation.

The 111th Congress

Congress again moved legislation to impose new security requirements on drinking water and

wastewater utilities under broader chemical facility security legislation. In November 2009, the

House of Representatives passed, amended, H.R. 2868, which broadly addressed security at

chemical, drinking water, and wastewater facilities. As passed, this legislation included provisions

of H.R. 3258 (the Drinking Water Security Act of 2009) and H.R. 2883 (the Wastewater

Treatment Works Security Act of 2009). In July 2010, the Senate Committee on Homeland

Security and Governmental Affairs ordered H.R. 2868 to be reported with an amendment in the

nature of a substitute; the committee subsequently reported the bill in December 2010. In contrast

to the extensive House-passed bill, the Senate substitute amendment proposed to extend the

current DHS Chemical Facility Anti-terrorism Standards (CFATS) authority for three years

beyond the expiration date of October, 4, 2010, and did not cover water or wastewater utilities. A

one-year CFATS program extension was recommended in the Senate’s DHS appropriations bill

Congressional Research Service

16

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

for FY2011 (S. 3607, S.Rept. 111-222). As an interim measure while deliberations proceeded,

Congress extended CFATS authority through December 3, 2010, in P.L. 111-242, providing

continuing appropriations for FY2011. Ultimately, no chemical facility security legislation was

enacted. After two additional short-term extensions, Congress extended current CFATS authority

through March 4, 2011 (P.L. 111-322). Legislation that received action in the 111th Congress is

discussed below.

H.R. 3258

In October 2009, the House Committee on Energy and Commerce reported the Drinking Water

System Security Act of 2009 (H.R. 3258, H.Rept. 111-313). This legislation proposed to replace

SDWA section 1433 (added by the Bioterrorism Preparedness Act of 2002) and to subject covered

drinking water systems to an array of new security requirements. The bill defined a covered

system as a community water system that serves a population greater than 3,300 or that the EPA

Administrator determined presents a security risk. Under H.R. 3258, EPA would have been

required to issue regulations to (1) establish tiered, risk-based performance standards for the

security of covered systems; (2) set requirements and deadlines for covered systems to conduct

and update vulnerability assessments, and develop site security and emergency response plans;

and (3) provide annual training to system employees and contractor employees. The EPA

Administrator would have been authorized to designate any chemical substance as a substance of

concern in issuing water system security standards.

H.R. 2868

In November 2009, the House passed, as amended, H.R. 2868 (H.Rept. 111-205), the Chemical

and Water Security Act of 2009. This bill, initiated by the House Committee on Homeland

Security, essentially incorporated (as Title II) H.R. 3258 as reported by the House Energy and

Commerce Committee. H.R. 2868 addressed chemical facilities in Title I and wastewater

treatment facilities in Title III. As passed, the bill would have codified and expanded the scope of

the existing CFATS regulations; increased the types of facilities potentially subject to regulation;

required, in certain cases, the adoption of methods to reduce the consequences of a chemical

release from a terrorist attack (i.e., IST); and established a citizen-suit process for chemical

facilities (citizen enforcement provisions already exist for drinking water systems under the Safe

Drinking Water Act and for wastewater facilities under the Clean Water Act). As preferred by

various water sector stakeholders, H.R. 2868 proposed to build on existing intergovernmental

relationships and give EPA lead regulatory authority for water and wastewater facilities, while

keeping authority for chemical facilities with DHS.29

Under H.R. 2868, the EPA Administrator would have been required to develop regulations

establishing risk-based and performance-based standards for covered water systems, and would

have assigned systems to one of four risk-based tiers, with tier 1 including the highest-risk

systems. EPA would have been required to consult with states and DHS in developing and

implementing the regulations, and would have had responsibility for reviewing and approving

covered systems’ vulnerability assessments and site security plans. A provision, opposed by the

water sector because of security concerns, proposed to require water utilities to include an

29

For a more detailed discussion of chemical facility security issues and legislation, see CRS Report R40695, Chemical

Facility Security: Reauthorization, Policy Issues, and Options for Congress, by (name redacted).

Congressional Research Service

17

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

employee- or contractor-bargaining agent in developing and revising vulnerability assessments,

site security plans, and emergency response plans.

As with the House Energy and Commerce Committee bill (H.R. 3258), H.R. 2868 would have

required a covered system that possessed a substance of concern exceeding a threshold amount to

assess methods to reduce the consequences of a chemical release. For those water systems that

have threshold quantities of a substance of concern and are assigned to the two highest risk-based

tiers, the state would have determined whether a system must implement such methods

(essentially inherently safe technology). Before requiring a system to implement consequence

reduction methods, the state would have been required to determine whether the methods would

significantly reduce risks of injury from a chemical release, would not increase the interim

storage of hazardous substances, would not make the system unable to comply with drinking

water regulations, and would be technologically and financially feasible. Additionally, the state

would have been required to give the system an opportunity to appeal the determination. The bill

provided that, if a state failed to determine whether to require a system to implement methods,

EPA would have been authorized to make the determination and, also, to enforce a determination

if a state failed to do so.

Among other provisions, the House-passed version of H.R. 2868 specified that states and

localities could enact more stringent security requirements for water systems. The bill would have

established criminal penalties for the unauthorized disclosure of protected information, and

authorized EPA to make grants to systems to assist in preparing vulnerability assessments, site

security plans, and emergency response plans, and assessing and implementing methods to reduce

the consequences of a release. The bill also would have authorized a worker-training grant

program and required EPA to report to Congress on the threats to drinking water posed by an

intentional act of contamination.

On December 16, 2010, the Senate Committee on Homeland Security and Governmental Affairs

reported H.R. 2868 with an amendment in the nature of a substitute and with a new title (the

Continuing Chemical Facilities Antiterrorism Security Act of 2010, S.Rept. 111-370). The

substitute language would have extended the authorization of the current CFATS authority for

three years, and established a voluntary training program and a best-practices clearinghouse for

chemical facility security activities. The Senate version also would have authorized a DHSadministered, voluntary technical assistance program aimed at identifying and implementing

methods to reduce the consequences of a terrorist attack. Water utilities were not addressed in the

Senate-reported bill.

In contrast, S. 3598, the Secure Water Facilities Act, paralleled Titles II and III of H.R. 2868.

Introduced in July 2010, this bill proposed to authorize the EPA Administrator to regulate

community water systems and wastewater treatment facilities for security purposes. S. 3598

would have revised section 1433 of the Safe Drinking Water Act to direct EPA to issue

regulations establishing a tiered system of risk-based performance standards for covered water

systems’ site security plans, and would have authorized implementation of methods to reduce the

consequences of a chemical release from an intentional act. Among other provisions, the bill

would have required EPA to promulgate regulations to prohibit the unauthorized disclosure of

protected information, and would have authorized EPA to provide grants or enter into cooperative

agreements with states or covered systems to assist with compliance. This bill was not reported.

Congressional Research Service

18

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Water Utility Concerns

Several local government and water associations, including the American Water Works

Association (AWWA), have opposed legislation that would require water utilities to comply with

inherently safer technology (IST) requirements (for example, by switching from the use of

chlorine gas to liquid chlorine) without considering specific utility circumstances. For example,

many drinking water utilities have changed disinfection methods to comply with EPA disinfection

regulations or for other reasons, but AWWA has cautioned that for other water utilities, chlorine

gas remains the only viable form of disinfection to provide sufficient public health protection.30

AWWA has testified that new security rules would have to be reconciled with SDWA’s public

health requirements, and that any future regulations would need to maintain flexibility for utilities

to make decisions based on factors including public health requirements, maintaining reliability

of treatment, accounting for local water chemistry and environmental characteristics, and

ensuring plant worker safety, as well as addressing security concerns. Others have argued that

mandating the adoption of safer technologies is warranted because of the potential risk that

hazardous chemicals, particularly gaseous chlorine, may pose to communities. Additionally,

AWWA has opposed chemical facility security provisions that would authorize the federal

government to order closure of a noncompliant water utility, noting the critical importance of

water supplies.

The Administration has stated its support for consistent IST approaches for all high-risk chemical

facilities, regardless of sector. EPA specifically supports requiring all high-risk chemical facilities

(tiers 1-4) to assess IST methods and requiring tiers 1 and 2 facilities to implement IST methods

(provided that such methods improve overall security, are feasible, and in the case of water sector

facilities, take into consideration public health and environmental requirements). Also, EPA has

testified that any decisions on IST methods would need to involve the states.

Assistance for Security Measures

Another key issue has concerned the availability of funding for water systems to make security

upgrades needed to address risks identified in their vulnerability assessments.31 Based on a

limited assessment, EPA reported in 2005 that community water systems would need more than

$1 billion to make security improvements.32 In a 2007 survey updating that assessment, EPA

reported that utilities would require an estimated $422 million for projects to address security

needs; however, EPA concluded that security-related needs were underestimated, as many water

systems incorporate these costs into the costs of broader construction projects rather than report

them separately.33

30

Benjamin H. Grumbles, Director, Arizona Department of Environmental Quality, Testimony before the Senate

Committee on Environment and Public Works, March 3, 2010.

31

As discussed on page 9 above, some security projects are eligible for funding under the EPA-administered drinking

water SRF program.

32

U.S. Environmental Protection Agency, Drinking Water Infrastructure Needs Survey and Assessment: Third Report

to Congress, June 2005. EPA 816-R-05-001. EPA noted that many water systems had not adequately captured security

needs when this assessment was conducted in 2003. The agency anticipated that security needs would be reported more

completely in the next assessment (2007).

33

U.S. Environmental Protection Agency, 2007 Drinking Water Infrastructure Needs Survey and Assessment: Fourth

Report to Congress, EPA 816-R-09-001, March 2009, http://www.epa.gov/safewater/needs.html.

Congressional Research Service

19

Safeguarding the Nation’s Drinking Water: EPA and Congressional Actions

Congress has not provided funding specifically for water systems to make security improvements.

Although community water systems potentially are eligible to receive funding from the states

through the DHS State Homeland Security Grant Program,34 competition for funds has been

severe, and funds largely have gone to meet the needs of first responders. In an effort to address

one element of this funding issue, the conference report for the Department of Homeland Security

Appropriations Act for FY2005 (P.L. 108-334, H.Rept. 108-774) modified the definition of “local

unit of government” specifically to include water districts.35 Congress has provided $950 million

annually for this grant program since FY2008; however, most of these funds have been used to

support first responders, and the DHS appropriations acts have included specific spending

directives that further reduce the availability of these funds for water security purposes.

Water security bills in the 111th Congress proposed to authorize funding for security

improvements at drinking water and wastewater treatment facilities, as well as chemical facilities.

House-passed H.R. 2868, the Chemical and Water Security Act of 2009, would have authorized

EPA to provide grants to drinking water and wastewater systems for security-related measures

including vulnerability assessments, implementation of security enhancements, and developing or

upgrading emergency response and site security plans. For drinking water system security, H.R.

2868 would have authorized appropriations for FY2011 at a level of $315 million, of which up to

$30 million would have been available to cover EPA and state administrative costs, and $125

million for higher risk water systems to implement methods to reduce the consequences of a

chemical release from an intentional act. Additionally, the bill would have authorized such sums

as may be necessary for FY2012 through FY2015. Similarly, S. 3598, the Secure Water Facilities

Act, proposed to authorize appropriations of $340 million for each of FY2011 through FY2015,

including $30 million for administrative costs and $225 million to implement methods to reduce

the consequences of chemical releases from intentional acts at covered systems, with priority

given to higher-risk systems. An additional $200 million would have been authorized to be

appropriated for each of FY2011 through FY2015, for wastewater treatment works.

None of the water security bills were enacted, and, thus, no new appropriations were authorized

to assist utilities in making security improvements. The AWWA reports that numerous utilities

have made improvements to the security of their infrastructure, but it is not known how broadly

the sector has done so. Given the substantial fiscal challenges facing policymakers, it is unclear

whether such legislative proposals might be offered and taken up in the 112th Congress.

Author Contact Information

(name redacted)

Specialist in Environmental Policy

/redacted/@crs.loc.gov, 7-....

34

State Homeland Security Grant Program, 6 U.S.C. §605.

For information on DHS grant program funding, see CRS Report R40246, Department of Homeland Security

Assistance to States and Localities: A Summary and Issues for the 111th Congress, by (name redacted).

35

Congressional Research Service

20

EveryCRSReport.com

The Congressional Research Service (CRS) is a federal legislative branch agency, housed inside the

Library of Congress, charged with providing the United States Congress non-partisan advice on

issues that may come before Congress.

EveryCRSReport.com republishes CRS reports that are available to all Congressional staff. The

reports are not classified, and Members of Congress routinely make individual reports available to

the public.

Prior to our republication, we redacted names, phone numbers and email addresses of analysts

who produced the reports. We also added this page to the report. We have not intentionally made

any other changes to any report published on EveryCRSReport.com.

CRS reports, as a work of the United States government, are not subject to copyright protection in

the United States. Any CRS report may be reproduced and distributed in its entirety without

permission from CRS. However, as a CRS report may include copyrighted images or material from a

third party, you may need to obtain permission of the copyright holder if you wish to copy or

otherwise use copyrighted material.

Information in a CRS report should not be relied upon for purposes other than public

understanding of information that has been provided by CRS to members of Congress in

connection with CRS' institutional role.

EveryCRSReport.com is not a government website and is not affiliated with CRS. We do not claim

copyright on any CRS report we have republished.