Order Code RS21026
Updated December 9, 2002
CRS Report for Congress
Received through the CRS Web
Terrorism and Security Issues Facing the
Water Infrastructure Sector
Claudia Copeland and Betsy Cody
Resources, Science, and Industry Division
Summary
Damage to or destruction of the nation’s water supply and water quality
infrastructure by terrorist attack could disrupt the delivery of vital human services in this
country, threatening public health and the environment, or possibly causing loss of life.
Interest in such problems has increased since the September 11, 2001, terrorist attacks.
Across the country, water infrastructure systems extend over vast areas, and ownership
and operation responsibility are both public and private but are overwhelmingly non-
federal. Since the attacks, federal dam operators and water and wastewater utilities have
been under heightened security conditions. Most (especially large facilities) have
existing emergency plans; at issue now is whether they are sufficient to address serious
terrorist threats. Policymakers are considering a number of options, including enhanced
physical security, communication and coordination, and research. A key issue is how
additional protections and resources directed at public and private sector priorities will
be funded. In response, the 107th Congress approved $345 million in funds for security
at water infrastructure facilities (P.L. 107-117) and passed a bill requiring drinking water
utilities to conduct security vulnerability assessments (P.L. 107-188). Congress also
created a Department of Homeland Security with responsibilities to coordinate
information to secure the nation’s critical infrastructure, including the water sectors
(P.L. 107-297). Continuing attention to these issues in the 108th Congress is anticipated.
This report will be updated as warranted.
The September 11, 2001, attacks on the World Trade Center and the Pentagon have
drawn attention to the security of many institutions, facilities, and systems in the United
States, including the nation’s water supply and water quality infrastructure.1 These
systems have long been recognized as being potentially vulnerable to terrorist attacks of
various types, including physical disruption, bioterrorism/chemical contamination, and
cyber attack. Damage or destruction by terrorist attack could disrupt the delivery of vital
human services in this country, threatening public health and the environment, or possibly
causing loss of life. The potential for terrorism is not new. In 1941, Federal Bureau of
1 For additional information, see the CRS Electronic Briefing Book on Terrorism
[http://www.congress.gov/brbk/html/ebter1.html]
Congressional Research Service ˜ The Library of Congress

---

CRS-2
Investigation Director J. Edgar Hoover wrote, “It has long been recognized that among
public utilities, water supply facilities offer a particularly vulnerable point of attack to the
foreign agent, due to the strategic position they occupy in keeping the wheels of industry
turning and in preserving the health and morale of the American populace.” Water
infrastructure systems also are highly linked with other infrastructures, especially electric
power and transportation, as well as the chemical industry which supplies treatment
chemicals, making security of all of them an issue of concern.
Background
Broadly speaking, water infrastructure systems include surface and ground water
sources of untreated water for municipal, industrial, agricultural, and household needs;
dams, reservoirs, aqueducts, and pipes that contain and transport raw water; treatment
facilities that remove raw water contaminants; finished water reservoirs; systems that
distribute water to users; and wastewater collection and treatment facilities. Across the
country, these systems comprise more than 75,000 dams and reservoirs, thousands of
miles of pipes and aqueducts, 168,000 public drinking water facilities (many serving as
few as 25 customers), and about 16,000 publicly owned wastewater treatment facilities.
Ownership and management are both public and private; the federal government has
ownership responsibility for hundreds of dams and diversion structures, but the vast
majority of the nation’s water infrastructure is either privately owned or owned by non-
federal units of government.
The federal government has built hundreds of water projects, primarily dams and
reservoirs for irrigation development and flood control, with municipal and industrial
water use (M&I) as an incidental, self-financed, project purpose. Many of these facilities
are critically entwined with the nation’s overall water supply, transportation, and
electricity infrastructure. The largest federal facilities were built and are managed by the
Bureau of Reclamation (Bureau) of the Department of the Interior and the U.S. Army
Corps of Engineers (Corps) of the Department of Defense.
Bureau reservoirs, particularly those along the Colorado River, supply water to
millions of people in southern California, Arizona, and Nevada via Bureau and non-
Bureau aqueducts. Bureau projects also supply water to 9 million acres of farmland and
other municipal and industrial water users in the 17 western states. The Corps supplies
water to thousands of cities, towns, and industries from the 9.5 million acre-feet of water
stored in its 116 lakes and reservoirs throughout the country, including service to
approximately one million residents of the District of Columbia, Arlington County, and
the City of Falls Church. The largest federal facilities also produce enormous amounts
of power. For example, Hoover and Glen Canyon dams on the Colorado River represent
23% of the installed electrical capacity of the Bureau of Reclamation’s 58 power plants
in the West and 7% of the total installed capacity in the Western United States. Similarly,
Corps facilities and the Bureau’s Grand Coulee Dam on the Columbia River provide 43%
of the total installed capacity in the West (25% nationwide).
A fairly small number of large drinking water and wastewater utilities located
primarily in urban areas(about 15% of the systems) provide water services to more than
75% of the U.S. population. Arguably, these systems represent the greatest targets of
opportunity for terrorist attacks, while the large number of small systems that each serve
fewer than 10,000 persons are less likely to be perceived as key targets by terrorists who

---

CRS-3
might seek to disrupt water infrastructure systems. However, the more numerous smaller
systems also tend to be less protected and, thus, are potentially more vulnerable to attack,
whether by vandals or terrorists. A successful attack could cause widespread panic,
economic impacts, and a loss of public confidence in water supply systems.
Threats resulting in physical destruction to any of these systems could include
disruption of operating or distribution system components, power or telecommunications
systems, electronic control systems, and actual damage to reservoirs and pumping
stations. A loss of flow and pressure would cause problems for customers and would
hinder firefighting efforts. Further, destruction of a large dam could result in catastrophic
flooding and loss of life. Bioterrorism or chemical threats could deliver massive
contamination by small amounts of microbiological agents or toxic chemicals, and could
endanger the public health of thousands. While some experts believe that risks to water
systems actually are small, because it would be difficult to introduce sufficient quantities
of agents to cause widespread harm, concern and heightened awareness of potential
problems are apparent. Characteristics that are relevant to a biological agent’s potential
as a weapon include its stability in a drinking water system, virulence, culturability in the
quantity required, and resistance to detection and treatment. Cyber attacks on computer
operations can affect an entire infrastructure network, and hacking in water utility systems
could result in theft or corruption of information or denial and disruption of service.
Responses to Security Concerns
Federal dam operators went on “high-alert” immediately following the September
11 terrorist attacks. The Bureau closed its visitor facilities at Grand Coulee, Hoover, and
Glen Canyon dams.2 Because of potential loss of life and property downstream if
breached, security threats are under constant review, and coordination efforts with both
the National Guard and local law enforcement officials are ongoing. The Corps also
operates under continued high defense alert, and had closed all its facilities to visitors
after September 11, although locks and dams remained operational. Many of the closed
facilities have reopened.
Although officials believe that risks to water and wastewater utilities are small,
operators have been under heightened security conditions since September 11. Local
utilities have primary responsibility to assess their vulnerabilities and prioritize them for
necessary security improvements. Most (especially in urban areas) have emergency
preparedness plans that address issues such as redundancy of operations, public
notification, and coordination with law enforcement and emergency response officials.
However, many plans were developed to respond to natural disasters, domestic threats
such as vandalism, and, in some cases, cyber attacks. Drinking water and wastewater
utilities coordinated efforts to prepare for possible Y2K impacts on their computer
systems, but these efforts focused more on cyber security than physical terrorism
concerns. Thus, it is unclear whether existing plans incorporate sufficient procedures to
address other types of terrorist threats. Utility officials are reluctant to disclose these
confidential plans, since doing so might alert terrorists to vulnerabilities.
2 Together, these three facilities make up roughly 70% of the total installed electrical capacity
(14,092 megawatts) at Bureau projects throughout the West (28% of hydropower capacity in the
West and 16% nationwide).

---

CRS-4
Water supply was one of eight critical infrastructure systems identified in President
Clinton’s 1998 Presidential Decision Directive 63 (PDD-63)3 as part of a coordinated
national effort to achieve the capability to protect the nation’s critical infrastructure from
intentional acts that would diminish them. These efforts focused primarily on the 340
large community water supply systems which each serve more than 100,000 persons. The
Environmental Protection Agency (EPA) was identified as the lead federal agency for
liaison with the water supply sector. In response, in 2000, EPA established a partnership
with the American Metropolitan Water Association (AMWA) and American Water
Works Association (AWWA) to jointly undertake measures to safeguard water supplies
from terrorist acts. AWWA’s Research Foundation has contracted with the Department
of Energy’s Sandia National Laboratory to develop a vulnerability assessment tool for
water systems (as an extension of methodology for assessing federal dams). EPA is
supporting an ongoing project with the Sandia Lab to pilot test the physical vulnerability
assessment tool and develop a cyber vulnerability assessment tool. An Information
Sharing and Analysis Center (ISAC) supported by an EPA grant has been established
under AMWA’s leadership to allow for dissemination of early warnings and alerts about
threats to the integrity and operation of water supply and wastewater systems.4
Information may include threats or vulnerabilities that have been detected and viable
resolutions. It is expected to be operating by December 2002 and will encompass
drinking water supply and wastewater.
Some research on water sector infrastructure protection is underway. The
Department of the Army is conducting research in the area of detection and treatment to
remove various chemical agents. FEMA is leading an effort to produce databases of
water distribution systems and to develop assessment tools for evaluating threats posed
by the introduction of a biological or chemical agent into a water system. The Centers for
Disease Control is developing guidance on potential biological agents and the effects of
standard water treatment practices on their persistence. However, in the January 2001
report of the President’s Commission on Critical Infrastructure Protection, ongoing water
sector research was characterized as a small effort that leaves a number of gaps and
shortfalls relative to U.S. water supplies, including development of threat/vulnerability
risk assessments and identification of biological and chemical agents of concern.5
Less attention has been focused on protecting wastewater treatment facilities than
drinking water systems, perhaps because destruction of these plants probably represents
more of an environmental threat (i.e., by release of untreated sewage into the
environment) than direct threats to life or public health and welfare. Vulnerabilities do
exist, however. Damage to a wastewater facility prevents water from being treated and
can have impact on downriver water intakes. Destruction of containers that hold large
amounts of chemicals at treatment plants could result in release of toxic chemical agents,
such as chlorine gas. Thus, to prepare for potential accidental releases of hazardous
chemicals from their facilities, 3,460 wastewater and drinking water utilities already are
subject to risk management planning requirements under the Clean Air Act. Utility
3 “The Clinton Administration’s Policy on Critical Infrastructure Protection: Presidential
Decision Directive 63.” See [http://www.ciao.gov/resource/paper598.html].
4 See [http://www.amwa.net/isac/index.html].
5 Critical Infrastructure Assurance Office. Report of the President of the United States on the
Status of Federal Critical Infrastructure Protection Activities. January 2001. See
[http://www.ciao.gov/resource/cip_2001_congrept.pdf].

---

CRS-5
organizations are implementing computer software and training materials to evaluate
vulnerabilities at large, medium, and small utility systems.
Federal officials have been reassessing federal infrastructure vulnerabilities for
several years. The Bureau of Reclamation’s site security program is aimed at ensuring
protection of the Bureau’s 362 high- and significant-hazard dams and facilities and 58
hydroelectric plants. The Corps implements a national emergency preparedness program
which assists civilian governments in responding to all regional/national emergencies,
including acts of terrorism, as well as assuring continuity of Corps operations. Both
agencies participate in the Interagency Committee on Dam Safety (ICODS), which is part
of the National Dam Safety Program that is led by the Federal Emergency Management
Agency (FEMA).
Dept. of Homeland Security. In November, Congress approved a major
government reorganization to create a Department of Homeland Security, consolidating
all or parts of 22 federal agencies (P.L. 107-297). The new department includes
coordination to secure the nation’s critical infrastructure, including water infrastructure,
through partnerships with the public and private sectors. One of its tasks is to assess
infrastructure vulnerabilities, an activity that wastewater and drinking water utilities have
been doing since September 11, under their own initiatives and congressional mandates
(P.L. 107-188, discussed below). The legislation does not transfer Corps or Bureau
responsibilities for security protection of dams or EPA’s responsibilities to assist drinking
water and wastewater utilities.
Appropriations. In P.L. 107-38, Congress appropriated $40 billion for recovery
from and response to terrorist attacks. The President allocated $20 billion of this total
(about $30 million has gone to water infrastructure), and in October 2001, he requested
allocation of the remaining $20 billion to be distributed by Congress. The request
included $245 million for federal water infrastructure programs: $30 million for security
at Bureau facilities; $139 million for security at Corps facilities; and $45.5 million to EPA
for drinking water vulnerability assessments. P.L. 107-117, the DOD and Emergency
Supplemental Appropriations Act for FY2002, provided the full amounts requested for
the Bureau and the Corps and increased funding for EPA to $176 million, including
increases for EPA’s anthrax decontamination and counterterrorism activities. The EPA
funding included $90 million to strengthen security at large drinking water systems
through vulnerability assessments and other non-structural security efforts. EPA awarded
$53 million for the first of these grants on June 7.
In July, Congress approved an FY2002 supplemental appropriations bill that
included $50 million more in EPA grants for vulnerability assessments by small and
medium-size drinking water systems (P.L. 107-206). However, on August 13, President
Bush announced that he would not spend $5.1 billion of contingent emergency funds in
the bill, including the EPA drinking water grant money. (For information, see CRS
Report RL31406.)
The President’s FY2003 budget requested $246 million for security at water
infrastructure facilities, consisting of $28.4 million for the Bureau, $94 million for the
Corps, and $124 million for EPA. The bulk of the EPA funding ($75 million) would be
directed at researching building decontamination technology, while $15 million would be
for vulnerability assessments at small and medium-size drinking water systems.
However, appropriations for these agencies were not enacted before the 107th Congress

---

CRS-6
adjourned. A continuing resolution provides funding through January 11, 2003, at the
same level as enacted for FY2002 (P.L. 107-294). Final appropriations action, including
on the requested increases for security activities, is now anticipated to occur in January.
Policy Options
Congress and other policymakers are considering a number of options in this area,
including enhanced physical security, communication and coordination, and research.
Regarding physical security, a key question is whether protective measures should be
focused on the largest water systems and facilities, where risks to the public are greatest,
or on all, since small facilities may be more vulnerable. A related question is
responsibility for additional steps, because the federal government has direct control over
only a limited portion of the water supply sector, while the majority are not federal. The
adequacy of physical and operational security safeguards is an issue for all in this sector.
One possible option for federal facilities (dams and reservoirs maintained by the Bureau
and the Corps) is to restrict visitor access, including at adjacent recreational facilities,
which could raise objections from the public. Some operators of non-federal facilities and
utilities are likewise concerned. As a precaution after September 11, New York City,
which provides water to 9 million consumers, closed its reservoirs indefinitely to all
fishing, hiking, and boating and blocked access to some roads. Another option is review
of existing preparedness plans to ensure that they address newer security concerns.
Policymakers also are examining measures that could improve coordination and
exchange of information on vulnerabilities, risks, threats, and responses. This is a key
objective of the legislation creating a Department of Homeland Security which will, for
example, include functions of the National Infrastructure Protection Center (NIPC) of the
FBI, which brings together the private sector and government agencies at all levels to
protect critical infrastructure, especially regarding cyber issues.
Among the research needs being addressed are tools for vulnerability and risk
analysis, identification and response to biological/chemical agents, real-time monitoring
of water supplies, and development of information technology. The cost of additional
protections and how to pay for them are issues of interest, and policymakers continue to
consider resource needs and how to direct them at public and private sector priorities.
The 107th Congress considered legislation to address various policy options,
including government reorganization, and additional appropriations (discussed above).
In May, Congress approved legislation, as part of the Bioterrorism Preparedness Act,
requiring drinking water systems serving more than 3,300 persons to conduct vulnerability
analyses; it authorizes grant funding to assist utilities in doing so (P.L. 107-188). (For
information, see CRS Report RL31294, Safeguarding the Nation’s Drinking Water: EPA
and Congressional Actions.) In December 2001, the House approved a bill authorizing
a 6-year grant program for research and development on security of water supply and
wastewater treatment systems (H.R. 3178). The Senate Environment and Public Works
Committee approved a similar bill in November 2001 (S. 1593). In October 2002, the
House approved a bill authorizing $220 million in grants and other assistance for
vulnerability assessments by wastewater treatment utilities (H.R. 5169), but the Senate
did not act on a related bill (S. 3037). Earlier, Congress enacted legislation authorizing
the Bureau to contract with local law enforcement to protect dams and related facilities
(P.L. 107-69). Continuing attention to these issues is anticipated in the 108th Congress.

---