Order Code RL31294
CRS Report for Congress
Received through the CRS Web
Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Updated October 11, 2005
Mary Tiemann
Specialist in Environmental Policy
Resources, Science, and Industry Division
Congressional Research Service ˜ The Library of Congress

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Summary
The events of September 11, 2001, raised concerns about the security of the
nation’s drinking water supplies and their vulnerability to attack. Since then,
Congress has enacted security requirements for public water systems and provided
some funding for vulnerability assessments, emergency planning, and drinking water
research. Key issues that continue to draw congressional attention include the
readiness of water utilities and relevant first responders to prevent and respond to
attacks; and the status of efforts by water utilities to assess vulnerabilities, improve
preparedness and response capabilities, and make security improvements.
After a presidential commission on critical infrastructure protection identified
vulnerabilities in the water sector in 1997, the Environmental Protection Agency
(EPA), with other federal agencies, water utilities, and state and local governments,
began taking steps to improve the security of water systems. The 1998 Presidential
Decision Directive (PDD) 63 on protecting critical infrastructure designated EPA as
the lead federal agency for the water sector; however, efforts focused almost entirely
on computer security. Since September 2001, EPA and its water sector partners have
undertaken many actions to enhance the security of water supplies and infrastructure.
The 107th Congress passed legislation to address water security issues. The
Public Health Security and Bioterrorism Preparedness and Response Act of 2002
(P.L. 107-188) required some 8,400 water systems to assess vulnerabilities and
prepare emergency response plans. The act authorized funding for these activities and
for emergency grants to states and utilities, and it directed EPA to review methods
to prevent, detect, and respond to threats to water safety and infrastructure security.
Moreover, Congress has appropriated funds each year for EPA to work with the water
sector to improve the security of drinking water supplies.
In the Homeland Security Act of 2002 (P.L. 107-296), Congress created a
Department of Homeland Security (DHS) and gave DHS responsibility for assessing
and protecting the nation’s critical infrastructures. However, the act did not transfer
EPA’s water security functions, and in December 2003, the White House issued
Homeland Security Presidential Directive (HSPD-7), confirming EPA’s lead role in
protecting the water infrastructure sector from terrorist attacks or sabotage.
Although EPA, states, localities, and water utilities have taken various steps to
address security concerns, the security status of the nation’s water supplies has
continued to attract congressional interest. Recent issues have included the
implementation of the drinking water provisions of the Bioterrorism Act; the relative
roles and responsibilities of EPA and DHS regarding the water sector; the availability
of funding for water utilities to make security upgrades; and the status of research and
development of technologies to help utilities identify, remove, and inactivate
potential biological and chemical contaminants. This report reviews public and
private efforts to improve drinking water security, and will be updated to reflect
developments.

---

Contents
Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
EPA Actions to Increase Drinking Water Security . . . . . . . . . . . . . . . . . . . . 2
Information Sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Vulnerability Assessment Tools, Training and Technical Assistance . . 3
Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Funding for Drinking Water Security Activities . . . . . . . . . . . . . . . . . . . . . . 7
Congressional Actions to Enhance Drinking Water Security . . . . . . . . . . . . 9
Bioterrorism Preparedness Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Homeland Security Act of 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Issues for Congress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
List of Tables
Table 1. Community Water System Requirements under the Bioterrorism Act . 10

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Background
Ensuring the security of the nations’ drinking water supplies poses a substantial
challenge, partly because the number of water systems is very large and also because
the responsibility for protecting drinking water safety is shared among federal, state
and local governments and utilities. Nationwide, there are approximately 168,000
public water systems, and these systems range greatly in size, serving from as few as
25 persons to more than 1 million persons. Nearly 140,000 of these water systems
serve 500 people or fewer. Approximately 360 systems serve more than 100,000
people and provide water to nearly half of the total population served. Because water
supplies support many uses (from drinking water to fire suppression), their disruption
could have significant impacts.
A 1996 executive order on critical infrastructure protection (E. O. 13010),
included water supply systems as one of 8 national infrastructures vital to the security
of the United States.1 In 1997, the President’s Commission on Critical Infrastructure
Protection (established by the executive order) issued a report on the vulnerabilities
of these categories of infrastructures and strategies for protecting them. The
Commission identified three attributes crucial to water supply users: water must be
available on demand, it must be delivered at sufficient pressure, and it must be safe
for use. The Commission concluded that actions affecting any of these factors could
be debilitating for the infrastructure.2
Major threats to water supplies include physical destruction of facilities or
distribution systems, biological or chemical contamination of supplies, and cyber
attacks. The 1997 Commission concluded that water supplies had inadequate
protection against the threat of chemical or biological contamination, and that
technology was insufficient to allow detection, identification, measurement, and
treatment of highly toxic, waterborne contaminants. Water utilities were also found
to be vulnerable to cyber attacks as they rely increasingly on computers to control
water flow and pressure. Information sharing was the most immediate need, and
warning and analytical capabilities and research and development all were found to
be insufficient. (For a broader review of water sector security issues (including dams
1 For a review of critical infrastructures, related security issues and protection efforts, see
CRS Report RL30153, Critical Infrastructures: Background, Policy, and Implementation,
by John D. Moteff.
2 The President’s Commission on Critical Infrastructure Protection, Critical Foundations:
Protecting America’s Infrastructures. Report of the President’s Commission on Critical
Infrastructure Protection, Appendix A, Sector Summary Reports, October 1997, p. A-45.

---

CRS-2
and sewage treatment plants), see CRS Report RL32189, Terrorism and Security
Issues Facing the Water Infrastructure Sector, by Claudia Copeland and Betsy Cody.)
In response to these findings and related developments, President Clinton, in
1998, issued Presidential Decision Directive (PDD) 63 on critical infrastructure
protection. Under this directive, a public/private partnership was established to put
in place prevention, response, and recovery measures to ensure the security of the
nation’s critical infrastructures against criminal or terrorist attacks. PDD-63
designated EPA as the lead federal agency for the water supply sector, and EPA
appointed the Association of Metropolitan Water Agencies (AMWA) to coordinate
the water sector. Before September 11, however, the main focus of PDD-63 efforts
for all critical infrastructure sectors was on cyber security. Subsequently, efforts to
protect the nation’s critical infrastructures were expanded markedly.
Homeland Security Presidential Directive 7 (HPSD-7), issued in December
2003, affirmed EPA as the lead federal agency for coordinating the protection of the
nation’s critical infrastructure for the water sector. To carry out its water sector
responsibilities, EPA established a Water Security Division within the Office of
Ground Water and Drinking Water in 2003. This Division works with drinking water
and wastewater utilities, states, tribes, and other stakeholders to improve the security
of these utilities and improve their ability to respond to security threats and breaches.
Among its responsibilities and activities, the Water Security Division provides
security and antiterrorism-related technical assistance and training to the water sector.
Although the Water Security Division is new, the Office of Water has been providing
security-related assistance to its stakeholders for a number of years. Several key
initiatives are discussed below.
EPA Actions to Increase Drinking Water Security
EPA believes that the threat of public harm from an attack on the nation’s water
supplies is small. Nonetheless, in October 2001, the agency set a goal to ensure that
water utilities in all communities (1) have access to scientific information and
expertise, (2) assess their vulnerability to a terrorist attack, (3) improve security, and
(4) know the immediate steps to take should an attack occur.
For several years, EPA has worked with state, local, and tribal governments, the
drinking water industry, training organizations, and other federal agencies to improve
preparedness and increase the security of public water supplies. EPA has placed
security-related activities into five general categories, including (1) establishing an
information center for drinking water alerts or incidents; (2) developing vulnerability
assessment tools; (3) identifying actions to minimize vulnerabilities; (4) revising
emergency operations plans; and (5) supporting research on biological and chemical
contaminants considered to be potential weapons of mass destruction. Several key
government and private sector efforts are described below.
Information Sharing. One goal of PDD-63 in 1998 was to establish an
Information Sharing and Analysis Center (ISAC) for each critical infrastructure
sector. With assistance from EPA and the Federal Bureau of Investigation (FBI), the
Association of Metropolitan Water Agencies has led the effort to develop and
implement an ISAC for water utilities. The Water ISAC provides a communications

---

CRS-3
link between the water sector and federal homeland security, law enforcement,
intelligence, environmental, and public health agencies. It provides a secure, web-
based communication system that can be used to: disseminate information regarding
threats against the physical and cyber systems of drinking water and wastewater
facilities; allow water utilities to share with each other information on security
incidents; and provide an opportunity for utilities to have security incidents analyzed
by counter-terrorism experts.3
Vulnerability Assessment Tools, Training and Technical
Assistance. Concern over the security of drinking water infrastructure and supplies
had grown among water utilities during the 1990s. In June 2000, the American Water
Works Association Research Foundation (AWWARF) and the Sandia National
Laboratories, with EPA support, initiated a project to develop a methodology for
utilities to use to assess their vulnerabilities and develop plans to minimize identified
risks. The project was expedited after the September 11 attacks, and completed in
November 2001. This methodology, known as the Risk Assessment Methodology for
Water Utilities (RAM-W), has been used widely by large water systems to develop
vulnerability assessments. Subsequently, states and drinking water organizations, in
collaboration with EPA, developed several other vulnerability assessment tools.
These tools were developed to assist water systems of various sizes, with a particular
focus on the needs of medium and small drinking water systems.
EPA also has worked with states and drinking water organizations to provide
technical assistance to utilities on a wide range of security matters. Much of this
assistance is aimed at helping smaller water systems, which typically are least likely
to have the capacity to address security concerns. The agency has used “train-the-
trainer”grants to build a pool of environmental professionals that can provide training
and technical assistance to water systems serving fewer than 50,000 people.4 In
addition, on-site assistance for vulnerability assessment and emergency response
planning has been made available to small and medium wastewater utilities at no cost
through the Wastewater Operator Training Program.
In 2002, EPA issued model emergency response guidelines to provide uniform
response, recovery and remediation guidance for water utility actions in response in
response to man-made or technological emergencies. The guidance describes
minimum actions that EPA recommends be carried out by water utilities for various
described events, and identifies federal responsibilities and capabilities that can
3 For further information on the Water ISAC, see [http://www.waterisac.org].
4 EPA generally does not perform security training; rather, the agency delivers training at
locations across the country through stakeholder organizations and other federal partners.
Organizations that provide training include professional associations, such as the American
Water Works Association, the Water Environment Federation, and the National Rural Water
Association. Congress has provided some grant funds to these organizations, through EPA,
to support their water security training activities.

---

CRS-4
support local response efforts.5 EPA also issued a water security strategy for systems
serving fewer than 100,000 persons.6
In October 2003, EPA awarded a grant to several associations to support the
development of voluntary physical security guidance and standards for water and
wastewater systems. The $1.6 million grant has supported an initiative developed by
AWWA, the American Society of Civil Engineers, and the Water Environment
Federation to develop new and update existing industry guidelines and standards to
reduce risks associated with terrorist events and natural disasters. The guidance
documents are intended to help local communities mitigate potential risks when
constructing new utilities and operating existing ones.
In late 2003, EPA made available the Response Protocol Toolbox: Planning for
and Responding to Contamination Threats to Drinking Water Systems. This toolbox
was developed to help water utilities respond to intentional contamination threats and
incidents, and includes separate guides on water utility planning, contamination threat
management, site characterization and investigation, and water sample analysis.
During 2004, EPA issued two additional modules, including a public heath response
guide and a remediation and recovery guide.
Research. Since FY2002, Congress has provided funds to EPA for research
and development activities related to homeland security. EPA has used some of these
resources to evaluate the performance of drinking water treatment systems for their
ability to remove and inactivate biological and chemical warfare agents. EPA also has
supported research projects on other security-related matters, including research to
determine the fate and transport of contaminants within rivers and streams and within
water treatment plants and distribution systems, and research to develop biodetectors
for detecting and quantifying biological contaminants in drinking water supplies.
During FY2002, EPA worked with the Department of Defense, the Centers for
Disease Control and Prevention, the FBI, and the Food and Drug Administration to
review what was known about potential biological, chemical, and radiological
contaminants; available detection methods; and how to respond to their presence in
drinking water. EPA drafted a water security research program that built on
information gathered in the interagency review. EPA also developed a contaminant
database listing high risk contaminants and information on the identification,
treatment, and potential health effects of such contaminants.
In February 2003, the White House issued the National Strategy for the Physical
Protection of Critical Infrastructure and Key Assets which spelled out national policy
and guiding principles for key infrastructure sectors. The strategy noted that the water
sector “has taken great strides to protect its critical facilities and systems,” and that
5 U.S. Environmental Protection Agency, Guidance for Water Utility Response, Recovery
& Remediation Actions for Man-Made and/or Technological Emergencies, EPA 810-R-02-
001, April 2002. Available at [http://www.epa.gov/safewater/security].
6 U.S. Environmental Protection Agency, Water Security Strategy for Systems Serving
Populations Less Than 100,000/15 MGD or Less (for drinking water utilities and for
wastewater utilities treating 1,500 million gallons per day (MGD) or less), July 2002.

---

CRS-5
the sector was focusing on four categories of possible attacks that could have the
greatest human health or economic consequences.7 These areas include (1) physical
damage or destruction of critical assets (including the intentional release of toxic
chemicals); (2) actual or threatened contamination of the water supply; (3) cyber
attack; and (4) interruption of services from another infrastructure (such as energy
supply).8
To address these potential threats, the strategy noted that the water sector
required better threat information to focus investments on security measures. It also
identified the need for research and development of new monitoring and analytic
capabilities to enhance detection of biological, chemical, or radiological contaminants
that could be intentionally introduced to the water supply, and noted that additional
resources would likely be needed.
EPA’s FY2004 budget request described a rigorous and specific agenda for
drinking water security research, which would require a number of years to execute.
Key research topics and related activities reflected the priorities and concerns
expressed in the national strategy and focused on the following topics:
! contaminant detection and characterization (testing and verifying
devices to detect contaminants, characterizing contaminants that
pose threats, developing standard field screening and laboratory
analysis methodologies);
! contaminant containment (developing methods and procedures to
prevent the spread of contaminants in drinking water sources);
! drinking water decontamination (developing technologies and
procedures to decontaminate water, including developing point-of-
use and point-of-entry technologies for removing contaminants and
new methods to neutralize, analyze, and remediate contamination);
! scientific and technical support (including developing a database of
contaminant characteristics for first responders, refining detection,
containment, and decontamination technologies based on
vulnerability assessments, improving coordination of water managers
and public health officials, and enhancing physical security of water
systems); and
! risk communication (instituting monitoring approaches and networks
to help public health officials identify and control disease outbreaks,
7 Office of Homeland Security, The National Strategy for the Physical Protection of Critical
Infrastructures and Key Assets, February 2003, p. 39.
8 For example, the electrical blackout that occurred in August 2003 caused numerous
problems at drinking water and wastewater systems in New York and Michigan. Power
failures at drinking water plants required utilities to issue boil water advisories in numerous
communities. This blackout heightened questions regarding the preparedness of the nation’s
public water systems to respond to emergency situations.

---

CRS-6
and transferring techniques and technologies to utility managers and
first responders).9
To coordinate and oversee research involving the prevention and response to
terrorist attacks, EPA’s Office of Research and Development has established the
National Homeland Security Research Center (NHSRC). Three major areas of work
include water infrastructure protection, decontamination and consequence
management, and threat and consequence assessment.
In March 2004, the NHSRC and the Office of Water’s Water Security Division
issued a Water Security Research and Technical Support Action Plan to define a
program of research and technical support for protecting drinking water and
wastewater systems from terrorist threats and attacks.10 The Action Plan, which was
reviewed by the National Research Council (NRC), identifies specific projects
involving physical and cyber infrastructure protection; contaminant identification;
monitoring and analysis; treatment, decontamination, and disposal; contingency
planning; infrastructure interdependencies; and risk assessment and communication.
A key concern the NRC expressed regarding the Action Plan was that it did not
discuss the financial resources that would be required to complete the proposed
research and technical support projects and to implement countermeasures needed to
improve water security. The NRC recommended that EPA try to quantify the costs
and benefits associated with the research and technical support projects. The research
council also noted that more emphasis was needed on communicating the value of
water and increased security, because increase water rates would likely be needed to
generate the resources needed to implement counter measures.11
EPA’s 2004 Homeland Security Strategy set several goals related to water
security research. The strategy updated the 2002 strategic plan and incorporated the
tasks outlined in the Homeland Security Presidential Directives. Overall, it refined
EPA’s agenda for technical assistance and research projects to support the water
sector. Reflecting this strategy, EPA’s subsequent research goals have been to
expand the availability and use of models to predict and track the transport of
contaminants in water and water distribution systems; improve water utilities’ ability
to use models to enhance decision-making on security improvements; and coordinate
with other agencies to develop innovative mobile treatment and pumping units for
use during emergency situations.12 For FY2006, the agency has proposed to focus
homeland security research on the detection, containment, decontamination, and
9 U.S. Environmental Protection Agency, FY2004 Annual Performance Plan and
Congressional Justification, pp. II-15 - II-16.
10 U.S. Environmental Protection Agency, Homeland Security Strategy, October 2004.
11 National Academy of Sciences, A Review of the EPA Water Security Research and
technical Support Action Plan: Parts I and II, National Academy Press, 2003.
12 U.S. Environmental Protection Agency, Homeland Security Strategy, pp. 5-6.

---

CRS-7
disposal of chemical and biological agents that could be used in attacks on water
systems. 13
Funding for Drinking Water Security Activities
Since 2001, Congress has provided funds annually to EPA for improving the
security of community water supplies. The Emergency Supplemental Appropriations
Act for FY2002 (P.L. 107-117) provided EPA with $175.6 million for emergency
expenses to respond to the September 11 attacks and to support counter-terrorism
activities. The accompanying conference report, H.Rept. 107-350, specified that
approximately $90 million was for improving security at EPA laboratories,
performing drinking water vulnerability assessments, and anthrax decontamination
activities. Another $5 million was for state grants for counter-terrorism coordinators
to work with EPA and water utilities in assessing drinking water safety.
During FY2002, EPA allocated roughly $89 million of the amount provided in
the emergency supplemental appropriation to support security enhancements at the
nation’s drinking water systems. Of this amount, EPA targeted approximately $80
million to: (1) provide grants to the largest drinking water systems to conduct
vulnerability assessments and enhance emergency response plans; (2) provide
technical assistance on vulnerability assessments and emergency response plans to
small and medium drinking water systems; and (3) refine security-related detection,
monitoring, and treatment tools. EPA targeted another $4 million to: accelerate the
development and testing of counter-terrorism tools; support training for the
development of vulnerability assessments; provide technical assistance; and conduct,
test, and implement research on redesign and detection for collection and treatment
systems. EPA also used funds to develop tools and provide training for medium and
small drinking water systems to assess vulnerabilities and develop emergency
response plans. Additionally, EPA allocated $5 million to the states to support
homeland security coordination work involving EPA and drinking water utilities.

EPA awarded approximately $51 million in water security grants to 449 large
community water systems, which includes all systems that serve more than 100,000
individuals. Grants were made to publicly and privately owned community water
systems for as much as $115,000 per grant. Utilities were able to use their grants to
develop vulnerability assessments, emergency response plans, and security
enhancement plans and designs. Utilities also could use grant funds for in-house or
contractor support; however, funds could not be used for physical improvements.
Although these grants were made only to large systems, EPA has worked with
states and utilities to determine the best ways to meet the security needs of small and
medium-sized drinking water systems. EPA provided roughly $17 million of
FY2002 supplemental funds directly to the states for technical assistance and training
for drinking water systems serving fewer than 100,000 people.
13 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Goal 4: Health Communities and Ecosystems, p. 4-19.

---

CRS-8
For FY2003, EPA requested $16.9 million to assist small and medium-sized
systems with vulnerability assessments and emergency response plans, and $5 million
in grants to states to support homeland security coordination. The Consolidated
Appropriations Resolution for FY2003 (P.L. 108-7), provided this amount. It also
contained several drinking water security earmarks, including $2 million for the
National Rural Water Association to help small water systems conduct vulnerability
assessments and $1 million for the American Water Works Association for water
security training activities.
As requested for FY2004, EPA received approximately $32 million for critical
water infrastructure protection, including $5 million for state homeland security
grants in P.L. 108-199. This funding supported states’ efforts to work with water and
wastewater systems to develop and enhance emergency operations plans; conduct
training in the implementation of remedial plans in small systems; and develop
detection, monitoring and treatment technology to enhance water security. EPA used
funds to assist the nearly 8,000 community water systems that serve water to
populations between 3,300 and 100,000 and are subject to the Bioterrorism Act. P.L.
108-199 also included $2 million for the Water ISAC to gather, analyze and
disseminate sensitive security information to water and wastewater systems.
For FY2005, EPA requested $5 million for state water security grants and $6.1
million for other critical infrastructure protection efforts. EPA’s budget justification
explained that the $21.3 million reduction reflected a shift in priorities from
assistance and training on vulnerability assessments. (The Bioterrorism Act required
community water systems to complete vulnerability assessments by June 30, 2004.)
In the Consolidated Appropriations Act, FY2005 (P.L. 108-447), Congress provided
the requested amount. As in FY2004, the appropriated amount includes $2 million
for the Water ISAC, and the conferees again specified that the Water ISAC is to be
implemented through a grant to the Association of Metropolitan Water Agencies.
In the FY2006 budget request, the President again requested $5 million for state
water security grants. The President also requested $44 million to launch two new
drinking water security initiatives, the Water Sentinel and the Water Alliance for
Threat Reduction, in response to EPA’s water security responsibilities under
Homeland Security Presidential Directive (HSPD) 7, which designated EPA as the
lead agency for water infrastructure security. The goal of the Water Sentinel
initiative is to establish pilot early warning systems through intensive water
monitoring and surveillance for certain chemical and biological contaminants in five
cities, and to form a water laboratory alliance to build the analytical capacity needed
to support the surveillance program. Under the Water Alliance for Threat Reduction
initiative, EPA proposed to work to ensure that large systems have the tools and
information needed to prevent, detect, and respond to attacks.14 In EPA’s FY2006
appropriations act (P.L. 109-54, H.R. 2361), Congress provided $9 million for the
new initiatives, as proposed by the House; the Senate had proposed $5.6 million. In
H.Rept. 109-80, the House Appropriations Committee stated that EPA should
14 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Science and Technology, Homeland Security: Critical Infrastructure
Protection, pp. S&T-21 - S&T-23.

---

CRS-9
develop clear goals for the Water Sentinel program and justify the request more
clearly next year. Congress also provided the $5 million requested for state water
security grants.
In addition to the above resources, EPA has identified numerous security
measures that are eligible for funding through the Drinking Water State Revolving
Fund (DWSRF) program.15 Examples of eligible measures include vulnerability
assessments, contingency plans, and various facility improvements. Congress has
provided approximately $845 million annually for this program in recent years.
However, it is uncertain how readily funds might become available for security
measures, as the key purpose of the DWSRF is to facilitate compliance with federal
drinking water regulations, and competition for these funds can be considerable.
Another potential source of funding for community water systems is the State
Homeland Security Grant Program, administered by DHS. This program provides
assistance to states to detect, prevent, and respond to terrorist attacks. Under this
program, states are required to allocate 80% of the grant funds to localities, in
accordance with their approved homeland security plan. Funds may be used for
homeland security related training and for protecting critical infrastructure, including
making physical security improvements. Local public works agencies are eligible to
receive funding from the state. The conference report for the FY2005 Department
of Homeland Security Appropriations Act (P.L. 108-334, H.Rept. 108-774) provided
$1.1 billion for this grant program, and revised the definition of “local unit of
government” for purposes of this program to specifically include water districts,
special districts, and other political subdivisions of a state.
Congressional Actions to Enhance Drinking Water Security
Since September 11, 2001, Congress held multiple hearings to examine security
issues facing the water infrastructure sector and acted on several bills to improve
drinking water security. In the 107th Congress, two major pieces of legislation were
enacted that addressed drinking water security: the Bioterrorism Preparedness Act,
and the Homeland Security Act of 2002.
Bioterrorism Preparedness Act. The Public Health Security and
Bioterrorism Preparedness and Response Act of 2002 (P.L. 107-188) was enacted in
June 2002. Title IV of the Bioterrorism Act (42 U.S.C. 300i) amended the Safe
Drinking Water Act (SDWA) to require community water systems serving more than
3,300 individuals to conduct an assessment of their system’s vulnerability to terrorist
attacks or other intentional acts to disrupt the provision of a safe and reliable drinking
water supply. These systems were required certify to EPA that they had conducted
a vulnerability assessment and submit a copy of the assessment to EPA. The act also
required the water systems to prepare or revise emergency response plans
incorporating the results of the vulnerability assessments no later than six months
after completing them. (Table 1 outlines the schedule for water utilities to submit
15 See EPA Fact Sheet, Use of the Drinking Water State Revolving Fund (DWSRF) to
Implement Security Measures at Public Water Systems, EPA 816-F-02-040, November 2001.
Available at [http://www.epa.gov/safewater/dwsrf/security-fs.pdf], visited April 11, 2005.

---

CRS-10
vulnerability assessments to EPA and to complete emergency response plans.) EPA
was required to issue guidance on conducting vulnerability assessments, preparing
emergency response plans, and addressing threats to help smaller systems not
covered by the Bioterrorism Act.16
Table 1. Community Water System Requirements under the
Bioterrorism Act
System size by
Date for completing
Date for completing
population served
vulnerability assessments
emergency response plans
(est. no. of systems)
100,000 or more
March 31, 2003
September 30, 2003
(425)
50,000 - 99,999
December 31, 2003
June 30, 2004
(460)
3,301 - 49,999
June 30, 2004
December 31, 2004
(7,500)
The act exempts the contents of the vulnerability assessments from disclosure
under the Freedom of Information Act (except for information contained in the
certification that identified the system and the date of the certification). As required
by the Bioterrorism Act, EPA developed protocols to protect the assessments from
unauthorized disclosure, and provides for civil and criminal penalties for
inappropriate disclosure of information by government officials.

The Bioterrorism Act authorized $160 million for FY2002, and such sums as
may be necessary for FY2003-FY2005, to provide financial assistance to community
water systems to conduct vulnerability assessments, to prepare response plans, and
for expenses and contracts to address basic security enhancements and significant
threats. (Security enhancements may include purchase and installation of intruder
detection equipment and lighting, enhancing security of automated systems,
personnel training and security screening of employees or contractors, etc. Funding
may not be used for personnel costs, plant operations, monitoring or maintenance.)
For grants to states and water systems to assist in responding to emergency
situations, the act authorized $35 million for FY2002, and such sums as may be
necessary thereafter. Finally, the act authorized $15 million for FY2002, and such
sums as may be necessary for FY2003 through FY2005, for EPA to review methods
by which terrorists or others could disrupt the provision of safe water supplies, and
methods for preventing, detecting, and responding to such disruptions.
Homeland Security Act of 2002. Enacted in November 2002, the
Homeland Security Act of 2002 (P.L. 107-296) combined the functions of all or parts
of 22 federal agencies and departments into a new Department of Homeland Security
16 In July, 2002, EPA published Water Security Strategy for Systems Serving Populations
Less than 100,000/15MGD or Less.

---

CRS-11
(DHS). The act gave key responsibility for critical infrastructure protection to DHS,
but did not transfer EPA water security functions to the new Department.17
The Homeland Security Act established within DHS a Directorate for
Information Analysis and Infrastructure Protection, headed by an undersecretary. The
responsibilities of the undersecretary include:
! receiving, analyzing, and integrating law enforcement, intelligence
and other information to identify and assess the nature and scope of
terrorist threats to the United States;
! assessing vulnerabilities of key resources and critical infrastructure;
integrating information, analyses, and vulnerability assessments to
identify priorities for protective and support measures;
! ensuring timely access by DHS to all necessary information; and
! developing a comprehensive national plan for securing the key
resources and critical infrastructure of the United States.
Under the Bioterrorism Act, Congress gave EPA new authorities and
responsibilities to assist water utilities and states in enhancing the security of drinking
water supplies and facilities, and directed water utilities to assess vulnerabilities and
to submit their vulnerability assessments to EPA. With the creation of DHS, which
has overall responsibility for critical infrastructure vulnerability assessment and
protection, the relative responsibilities of EPA and DHS were not clear.
In December 2003, the White House issued Homeland Security Presidential
Directive (HSPD-7), which superseded PDD-63. This Directive established national
policy and outlined the roles and responsibilities of federal departments and agencies
regarding critical infrastructure protection. It identified EPA as the federal agency
with lead responsibilities for ensuring the protection of the water infrastructure sector
from terrorist attacks or sabotage. The Directive gave DHS responsibility for overall
coordination and integration of national critical infrastructure protection efforts by
federal, state, and local governments and the private sector.
Issues for Congress
With ongoing concern over the potential for terrorist attacks, Congress has
remained attentive to the security status of the nation’s public water supplies and
infrastructure. As in the previous Congress, interest in the 109th Congress continues
to focus on funding for, and implementation of, the drinking water security provisions
of the Bioterrorism Act, and on other efforts to enhance the security and emergency
preparedness of public water systems. Because of actions on the part of the drinking
17 For more information, see CRS Report RL31493, Homeland Security: Department
Organization and Management — Legislative Phase, by Harold C. Relyea, and CRS Report
RL31751, Homeland Security: Department Organization and Management —
Implementation Phase, by Harold C. Relyea.

---

CRS-12
water community, EPA, and Congress, efforts to improve security in the drinking
water sector appear to be ahead of those in certain other sectors (for example,
chemical facilities). However, a number of issues and challenges remain.
The relationship between EPA and DHS continues to be an issue for Congress.
Although the Bioterrorism Preparedness Act helped elucidate EPA’s role in the
drinking water sector, Congress has expressed concerned that, overall, EPA’s
homeland security responsibilities have not been well articulated. EPA and DHS have
taken steps to clarify their roles, and have entered into agreements to coordinate on
specific activities, such as research. However, some overlaps and conflicts have
arisen. In the conference report for the Consolidated Appropriations Act, 2005 (P.L.
108-447, H.Rept. 108- 792), conferees directed EPA to enter into a comprehensive
memorandum of understanding (MOU) with DHS, by August 1, 2005, that defines
the relationship and responsibilities of the two entities regarding homeland security
and protection. Conferees specified that the MOU identify areas of responsibilities
and the potential costs (including which entity pays, in whole or part) for meeting
those responsibilities.18
Another issue involves the availability of funding for water systems to make
security upgrades needed to address risks identified in their vulnerability assessments.
Congress has not provided funding specifically for this purpose. Although
community water systems potentially are eligible to receive funding from the states
through the DHS State Homeland Security Grant Program, competition for funds is
severe and the preponderance of funds have gone to meet the needs of first
responders. In an effort to address one element of this concern, the conference report
to the Department of Homeland Security Appropriations Act for FY2005 (P.L. 108-
334, H.Rept. 108-774) modified the definition of “local unit of government” to
specifically include water districts. This appropriations act provided $1.1 billion for
the Homeland Security Grant Program for FY2005.19
The related question of how to set priorities for allocating homeland security
funding continues to be debated.20 At a September 2004 hearing held by the House
Energy and Commerce Committee on bioterrorism and the security of water supplies,
the Government Accountability Office (GAO) testified that water security experts
widely agreed that decisions for allocating federal funding for water security
improvements should be based primarily on two criteria: (1) population density, and
(2) information from vulnerability assessments.21 Security experts also set funding
18 H.Rept. 108-792, conference report to accompany H.R. 4818, Consolidated
Appropriations Act, 2005 (P.L. 108-447), November 20, 2004, p. 1563.
19 For information on this and other homeland security grant programs, see CRS Report
RL32348, Selected Federal Homeland Security Assistance Programs: A Summary, by
Shawn Reese.
20 For a discussion of this issue and funding allocations among the states, see CRS Report
RL32696, Fiscal Year 2005 Homeland Security Grant Program: State Allocations and
Issues for Congressional Oversight.
21 U.S. Government Accountability Office, Drinking Water: Experts’ Views on How Future
(continued...)

---

CRS-13
priorities at the utility level, and identified distribution systems as the most vulnerable
component of a water system. Other water system components identified as requiring
protective measures included utility computer systems, chemicals stored on-site, and
source water supplies. Three broad categories of security activities were identified
as most deserving of funding, including physical and technological upgrades,
education and training, and strengthening relationships between water utilities and
agencies that would be involved in any emergency responses.22
A major concern for the water sector is the need for more research to develop
real-time monitoring methods to detect contaminants, and technologies to remove or
inactivate them. The GAO survey of security experts found strongest support for
research on developing monitoring technologies that can quickly detect contaminants
in water that has already left a treatment plant for distribution to consumers.23 In its
FY2006 budget request, EPA proposed to focus homeland security research on the
detection, containment, decontamination, and disposal of chemical and biological
agents that could be used in attacks on water systems.24 Specifically, EPA requested
$44 million for a new drinking water security initiative, the Water Sentinel program,
to help address water utilities’ concerns regarding their ability to monitor, detect, and
respond to certain chemical and biological contaminants.25 The agency’s resource
request for this initiative received critical attention from appropriations committees.
In EPA’s FY2006 appropriations act (P.L. 109-54, H.R. 2361), Congress provided
$9 million for the new initiative. In recommending a large reduction, the House
Appropriations Committee commented that EPA should develop clear goals for the
Water Sentinel program, seek the advice of the Science Advisory Board, and justify
the request more clearly next year.
21 (...continued)
Federal Funding Can Best Be Spent to Improve Security, Testimony before the
Subcommittee on Environment and Hazardous Materials, Committee on Energy and
Commerce, House of Representatives. September 30, 2004. Testimony was based on report
of same title to the Committee on Environment and Public Works, U.S. Senate, Oct. 2003,
GAO-04-29.
22 U.S. Government Accountability Office, Drinking Water: Experts’ Views on How Future
Federal Funding Can Best Be Spent to Improve Security, Testimony, pp. 2-3.
23 Ibid. p. 7.
24 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Goal 4: Health Communities and Ecosystems, p. 4-19.
25 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Science and Technology, Homeland Security: Critical Infrastructure
Protection, p. S&T-21 - S&T-23.

---