Order Code RL31294
CRS Report for Congress
Received through the CRS Web
Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Updated January 25, 2006
Mary Tiemann
Specialist in Environmental Policy
Resources, Science, and Industry Division
Congressional Research Service ˜ The Library of Congress

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Summary
The events of September 11, 2001, focused attention on the security status of the
nation’s drinking water supplies and their vulnerability to attack. Since then,
Congress has enacted security requirements for public water systems and provided
funding for vulnerability assessments, emergency planning, and drinking water
research. Key issues that continue to draw congressional attention include the
capacity of water utilities and relevant first responders to prevent, detect, and respond
to attacks; and the status of efforts by water utilities to assess vulnerabilities, improve
preparedness and response capabilities, and make security improvements.
After a presidential commission on critical infrastructure protection identified
vulnerabilities in the water sector in 1997, the Environmental Protection Agency
(EPA), with other federal agencies, water utilities, and state and local governments,
began taking steps to improve the security of water systems. The 1998 Presidential
Decision Directive (PDD) 63 on protecting critical infrastructure designated EPA as
the lead federal agency for the water sector; however, efforts focused almost entirely
on cyber security. Since 2001, EPA and its water sector partners have pursued an
array of actions intended to enhance the security of water supplies and infrastructure.
The 107th Congress passed legislation to address water security issues. The
Public Health Security and Bioterrorism Preparedness and Response Act of 2002
(P.L. 107-188) required some 8,400 water systems to assess vulnerabilities and
prepare emergency response plans. The act authorized funding for these activities and
for emergency grants to states and utilities, and it directed EPA to review methods
to prevent, detect, and respond to threats to water safety and infrastructure security.
In addition, Congress has appropriated funds each year for EPA to work with the
water sector to improve the security of drinking water supplies.
In the Homeland Security Act of 2002 (P.L. 107-296), Congress created a
Department of Homeland Security (DHS) and gave DHS responsibility for assessing
and protecting the nation’s critical infrastructures. However, the act did not transfer
EPA’s water security functions, and in December 2003, the White House issued
Homeland Security Presidential Directive (HSPD-7), confirming EPA’s lead role in
protecting the water infrastructure sector from terrorist attacks or sabotage.
Although EPA, states, localities, and water utilities have taken various steps to
address security concerns, the security status of the nation’s water supplies has
continued to attract congressional interest. Issues have included the availability of
funding for public water systems to make security upgrades; the relative roles and
responsibilities of EPA and DHS regarding the water sector; and the status of
research and development of technologies to help water systems identify, remove,
and inactivate potential biological and chemical contaminants. This report reviews
governmental and water utility efforts to improve drinking water security. It will be
updated to reflect developments.

---

Contents
Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
EPA Actions to Increase Drinking Water Security . . . . . . . . . . . . . . . . . . . . 2
Information Sharing and Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Vulnerability Assessment Tools and Technical Assistance . . . . . . . . . . 3
Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Funding for Drinking Water Security Activities . . . . . . . . . . . . . . . . . . . . . . 6
Congressional Actions to Enhance Drinking Water Security . . . . . . . . . . . . 9
Bioterrorism Act of 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Homeland Security Act of 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Issues for Congress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
List of Tables
Table 1. Community Water System Requirements under the Bioterrorism Act . . 9

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Background
Ensuring the security of the nations’ drinking water supplies poses a substantial
challenge, partly because the number of water systems is very large and also because
the responsibility for protecting drinking water safety is shared among federal, state
and local governments and utilities. Nationwide, there are nearly 160,000 public
water systems, and these systems range greatly in size, serving from as few as 25
persons to more than 1 million persons. More than 131,000 of these water systems
serve 500 people or fewer. Approximately 400 systems serve more than 100,000
people and provide water to nearly half of the total population served. Because water
supplies support many uses (from drinking water to fire suppression), their disruption
could have significant impacts.
A 1996 executive order on critical infrastructure protection (E. O. 13010),
included water supply systems as one of 8 national infrastructures vital to the security
of the United States.1 In 1997, the President’s Commission on Critical Infrastructure
Protection (created by the executive order) issued a report on the vulnerabilities of
these infrastructure sectors and strategies for protecting them. The Commission
identified three attributes crucial to water supply users: water must be available on
demand, it must be delivered at sufficient pressure, and it must be safe for use.2
Actions affecting any of these factors could be debilitating for the infrastructure.
Major threats to water supplies include physical destruction of facilities or
distribution systems, biological or chemical contamination of supplies, and cyber
attacks. The 1997 Commission concluded that water supplies had inadequate
protection against the threat of chemical or biological contamination, and that
technology was insufficient to allow detection, identification, measurement, and
treatment of highly toxic, waterborne contaminants. Water utilities were also found
to be vulnerable to cyber attacks as they rely increasingly on computers to control
water flow and pressure. Information sharing was the most immediate need, and
warning and analytical capabilities and research and development all were found to
be insufficient. (For a broader review of water sector security issues (including dams
and sewage treatment plants), see CRS Report RL32189, Terrorism and Security
Issues Facing the Water Infrastructure Sector, by Claudia Copeland and Betsy Cody.)
1 For a review of critical infrastructures, related security issues and protection initiatives,
and activities within the Department of Homeland Security, see CRS Report RL30153,
Critical Infrastructures: Background, Policy, and Implementation, by John D. Moteff.
2 The President’s Commission on Critical Infrastructure Protection, Critical Foundations:
Protecting America’s Infrastructures. Report of the President’s Commission on Critical
Infrastructure Protection, Appendix A, Sector Summary Reports, Oct. 1997, p. A-45.

---

CRS-2
In response to these findings and related developments, President Clinton, in
1998, issued Presidential Decision Directive (PDD) 63 on critical infrastructure
protection. Under this directive, a public/private partnership was established to put
in place prevention, response, and recovery measures to ensure the security of the
nation’s critical infrastructures against criminal or terrorist attacks. PDD-63
designated EPA as the lead federal agency for the water supply sector, and EPA
appointed the Association of Metropolitan Water Agencies (AMWA) to coordinate
the water sector. Before September 11, however, the main focus of PDD-63 efforts
for all critical infrastructure sectors was on cyber security. Subsequently, efforts to
protect the nation’s critical infrastructures were expanded markedly.
Homeland Security Presidential Directive 7 (HPSD-7), issued in December
2003, affirmed EPA as the lead federal agency for coordinating the protection of the
nation’s critical infrastructure for the water sector. To carry out its water sector
responsibilities, EPA established a Water Security Division within the Office of
Ground Water and Drinking Water. This Division works with drinking water and
wastewater utilities, states, tribes, and other stakeholders to improve the security of
these utilities and improve their ability to respond to security threats and breaches.
Among its responsibilities and activities, the Water Security Division provides
security and antiterrorism-related technical assistance and training to the water sector.
Although the Water Security Division was established in 2003, the Office of Water
has provided security-related assistance to its stakeholders for a number of years.
Several key initiatives are discussed below.
EPA Actions to Increase Drinking Water Security
EPA believes that the threat of public harm from an attack on the nation’s water
supplies is small. Nonetheless, in October 2001, the agency set a goal to ensure that
water utilities in all communities (1) have access to scientific information and
expertise, (2) assess their vulnerability to a terrorist attack, (3) improve security, and
(4) know the immediate steps to take should an attack occur.
The Agency has worked with state, local, and tribal governments, the drinking
water industry, training organizations, and other federal agencies to improve
preparedness and increase the security of public water supplies. Security-related
activities have fallen into five general categories, including (1) establishing an
information center for drinking water alerts or incidents; (2) developing vulnerability
assessment tools; (3) identifying actions to minimize vulnerabilities; (4) revising
emergency operations plans; and (5) supporting research on biological and chemical
contaminants considered to be potential weapons of mass destruction. Several key
government and private sector efforts are described below.
Information Sharing and Analysis. One goal of PDD-63 in 1998 was to
establish an Information Sharing and Analysis Center (ISAC) for each critical
infrastructure sector. With assistance from EPA and the Federal Bureau of
Investigation (FBI), the Association of Metropolitan Water Agencies has led the
effort to develop and implement an ISAC for water utilities. The Water ISAC
provides a communications link between the water sector and federal homeland
security, law enforcement, intelligence, environmental, and public health agencies.
This secure, web-based communication system is intended to disseminate information

---

CRS-3
regarding threats against the physical and cyber systems of drinking water and
wastewater facilities, allow drinking water and wastewater utilities to share
information on security incidents, and provide an opportunity for utilities to have
security incidents analyzed by counter-terrorism experts.3
Vulnerability Assessment Tools and Technical Assistance. Concern
over the security of drinking water infrastructure and supplies had grown among
water utilities during the 1990s. In 2000, the American Water Works Association
Research Foundation (AWWARF) and the Sandia National Laboratories, with EPA
support, initiated a project to develop a methodology for utilities to use to assess their
vulnerabilities and develop plans to minimize identified risks. The project was
expedited after the September 11 attacks, and completed in November 2001. This
methodology, known as the Risk Assessment Methodology for Water Utilities
(RAM-W), has been used widely by large water systems to develop vulnerability
assessments. Subsequently, states and drinking water organizations, in collaboration
with EPA, developed several other vulnerability assessment tools to assist water
systems of various sizes, with a particular focus on the needs of medium and small
drinking water systems.
EPA also has worked with states and drinking water organizations to provide
technical assistance to utilities on a wide range of security matters. Much of this
assistance is aimed at helping smaller water systems, which typically are least likely
to have the capacity to address security concerns. The agency has used “train-the-
trainer”grants to build a pool of environmental professionals that has provided
training and technical assistance to water systems serving fewer than 50,000 people.4
In addition, on-site assistance for vulnerability assessment and emergency response
planning has been made available to small and medium wastewater utilities at no cost
through the Wastewater Operator Training Program.
In 2002, EPA issued model emergency response guidelines to provide uniform
response, recovery and remediation guidance for water utility actions in response to
man-made or technological emergencies. The guidance describes minimum actions
that EPA recommends be carried out by water utilities for various described events,
and identifies federal responsibilities and capabilities that can support local response
efforts.5 EPA also issued a water security strategy for systems serving fewer than
100,000 persons.6
3 For further information on the Water ISAC, see [http://www.waterisac.org].
4 EPA generally does not perform security training; rather, the agency delivers training at
locations across the country through stakeholder organizations and other federal partners.
Organizations that provide training include professional associations, such as the American
Water Works Association, the Water Environment Federation, and the National Rural Water
Association. Congress has provided some grant funds to these organizations, through EPA,
to support their water security training activities.
5 U.S. Environmental Protection Agency, Guidance for Water Utility Response, Recovery
& Remediation Actions for Man-Made and/or Technological Emergencies, EPA 810-R-02-
001, April 2002. Available at [http://www.epa.gov/safewater/security].
6 U.S. Environmental Protection Agency, Water Security Strategy for Systems Serving
(continued...)

---

CRS-4
In October 2003, EPA awarded a grant to several associations to support the
development of voluntary physical security guidance and standards for water and
wastewater systems. The $1.6 million grant has supported an initiative developed by
AWWA, the American Society of Civil Engineers, and the Water Environment
Federation to develop new and update existing industry guidelines and standards to
reduce risks associated with terrorist events and natural disasters. The guidance
documents are intended to help local communities mitigate potential risks when
constructing new utilities and operating existing ones.
EPA also has made available the Response Protocol Toolbox: Planning for and
Responding to Contamination Threats to Drinking Water Systems. This toolbox was
developed to help water utilities respond to intentional contamination threats and
incidents, and includes separate guides on water utility planning, contamination threat
management, site characterization and investigation, and water sample analysis.
During 2004, EPA issued two additional modules, including a public heath response
guide and a remediation and recovery guide.
Research. Questions regarding the security of water supplies often involve the
ability of water systems to identify and respond to intentional contamination
incidents. EPA has participated in various research and development activities related
to water security, including research to evaluate the ability of drinking water
treatment systems to remove and inactivate biological and chemical warfare agents.
EPA also has supported research projects to determine the fate and transport of
contaminants within rivers and streams and within water treatment plants and
distribution systems, as well as research to develop biodetectors for detecting and
quantifying biological contaminants in drinking water supplies.
During FY2002, EPA worked with the Department of Defense, the Centers for
Disease Control and Prevention, the FBI, and the Food and Drug Administration to
review what was known about potential biological, chemical, and radiological
contaminants; available detection methods; and how to respond to their presence in
drinking water. EPA drafted a water security research program built on the
information gathered in the interagency review. EPA also developed a contaminant
database listing high risk contaminants and information on the identification,
treatment, and potential health effects of such contaminants.
The Office of Homeland Security’s 2003 National Strategy for the Physical
Protection of Critical Infrastructure and Key Assets spelled out national policy and
guiding principles for key infrastructure sectors. The strategy noted that the water
sector had taken great strides to protect its critical facilities and systems, and was
focusing on four categories of possible attacks that could have the greatest health or
economic consequences.7 The categories included (1) physical damage or destruction
of critical assets (including the intentional release of toxic chemicals); (2) actual or
6 (...continued)
Populations Less Than 100,000/15 MGD or Less (for drinking water utilities and for
wastewater utilities treating 1,500 million gallons per day (MGD) or less), July 2002.
7 Office of Homeland Security, The National Strategy for the Physical Protection of Critical
Infrastructures and Key Assets, February 2003, p. 39.

---

CRS-5
threatened contamination of the water supply; (3) cyber attack; and (4) interruption
of services from another infrastructure (such as energy supply).
The strategy noted that to prioritize investments on security measures, the water
sector required better threat information. It also identified the need for research and
development of new monitoring and analytic capabilities to enhance detection of
biological, chemical, or radiological contaminants that could be introduced to the
water supply, and noted that additional resources would likely be needed.
EPA’s FY2004 budget request described a rigorous and specific agenda for
drinking water security research, which would require a number of years to execute.
Key research categories and activities reflected the priorities and concerns expressed
in the national strategy and included the following elements:
! contaminant detection and characterization (testing and verifying
devices to detect contaminants, characterizing contaminants that
pose threats, developing standard field screening and laboratory
analysis methodologies);
! contaminant containment (developing methods and procedures to
prevent the spread of contaminants in drinking water sources);
! drinking water decontamination (developing technologies and
procedures to decontaminate water, including developing point-of-
use and point-of-entry technologies for removing contaminants and
new methods to neutralize, analyze, and remediate contamination);
! scientific and technical support (including developing a database of
contaminant characteristics for first responders, refining detection,
containment, and decontamination technologies based on
vulnerability assessments, improving coordination of water managers
and public health officials, and enhancing physical security of water
systems); and
! risk communication (instituting monitoring approaches and networks
to help public health officials identify and control disease outbreaks,
and transferring techniques to utility managers and first responders).8
To coordinate and oversee research involving the prevention and response to
terrorist attacks, EPA’s Office of Research and Development established the National
Homeland Security Research Center (NHSRC). The Center’s key areas of research
involve water infrastructure protection, decontamination and consequence
management, and threat and consequence assessment.
In 2004, the NHSRC and the Office of Water’s Water Security Division issued
a Water Security Research and Technical Support Action Plan to define a specific
8 U.S. Environmental Protection Agency, FY2004 Annual Performance Plan and
Congressional Justification, pp. II-15 - II-16.

---

CRS-6
program of research and technical support for protecting drinking water and
wastewater systems from terrorist threats and attacks.9 The Action Plan, which was
reviewed by the National Research Council (NRC), identifies projects involving
physical and cyber infrastructure protection; contaminant identification; monitoring
and analysis; treatment, decontamination, and disposal; contingency planning;
infrastructure interdependencies; and risk assessment and communication.
A key concern the NRC expressed regarding the action Plan was that it did not
discuss the financial resources that would be required to complete the proposed
research and technical support projects and to implement countermeasures needed to
improve water security. The NRC recommended that EPA try to quantify the costs
and benefits associated with the research and technical support projects. The NRC
further noted that more emphasis was needed on communicating the value of water
and increased security, because water rate increases would likely be needed to
generate the resources needed to implement counter measures.10
EPA’s 2004 agency-wide Homeland Security Strategy set several goals related
to water security research. The strategy updated the 2002 strategic plan, incorporated
tasks outlined in the Homeland Security Presidential Directives, and refined EPA’s
agenda for technical assistance and research supporting the water sector. Reflecting
this strategy, the Agency’s subsequent research goals have been to increase the
availability and use of models to predict and track the transport of contaminants in
water and water distribution systems; improve water utilities’ ability to use models
to aid decision-making on security improvements; and coordinate with other agencies
to develop mobile treatment and pumping units for use during emergency situations.11
For FY2006, the agency has focused homeland security research on the detection,
containment, decontamination, and disposal of chemical and biological agents that
could be used in attacks on water systems.12
Funding for Drinking Water Security Activities
Since 2001, Congress has provided funds annually to EPA for increasing the
security of public water supplies. The Emergency Supplemental Appropriations Act
for FY2002 (P.L. 107-117) provided EPA with $175.6 million for emergency
expenses to respond to the September 11 attacks and to support counter-terrorism
activities. The accompanying conference report, H.Rept. 107-350, specified that
approximately $90 million was for improving security at EPA laboratories,
performing drinking water vulnerability assessments, and anthrax decontamination
activities. Another $5 million was for state grants for counter-terrorism coordinators
to work with EPA and water utilities in assessing drinking water safety.
9 U.S. Environmental Protection Agency, Homeland Security Strategy, October 2004.
10 National Academy of Sciences, A Review of the EPA Water Security Research and
technical Support Action Plan: Parts I and II, National Academy Press, 2003.
11 U.S. Environmental Protection Agency, Homeland Security Strategy, pp. 5-6.
12 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Goal 4: Health Communities and Ecosystems, p. 4-19.

---

CRS-7
During FY2002, EPA allocated roughly $89 million of the amount provided in
the emergency supplemental appropriation to support security enhancements at the
nation’s drinking water systems. Of this amount, EPA targeted approximately $80
million to: (1) provide grants to the largest drinking water systems to conduct
vulnerability assessments and enhance emergency response plans; (2) provide
technical assistance on vulnerability assessments and emergency response plans to
small and medium drinking water systems; and (3) refine security-related detection,
monitoring, and treatment tools. EPA targeted another $4 million to: accelerate the
development and testing of counter-terrorism tools; support training for the
development of vulnerability assessments; provide technical assistance; and conduct,
test, and implement research on redesign and detection for collection and treatment
systems. EPA also used funds to develop tools and provide training for medium and
small drinking water systems to assess vulnerabilities and develop emergency
response plans. Additionally, EPA allocated $5 million to the states to support
homeland security coordination work involving EPA and drinking water utilities.

EPA awarded approximately $51 million in water security grants to the
community water systems that serve more than 100,000 individuals (more than 400
systems). Grants were made to publicly and privately owned community water
systems for as much as $115,000 per grant. Utilities were able to use their grants to
develop vulnerability assessments, emergency response plans, and security
enhancement plans and designs. Utilities also could use grant funds for in-house or
contractor support; however, funds could not be used for physical improvements.
Although these grants were made only to large systems, EPA has worked with
states and utilities to determine the best ways to meet the security needs of small and
medium-sized drinking water systems. EPA provided roughly $20 million of
FY2002 supplemental funds directly to the states for technical assistance and training
for drinking water systems serving fewer than 100,000 people.
For FY2003, EPA requested $16.9 million to assist small and medium-sized
systems with vulnerability assessments and emergency response plans, and $5 million
in grants to states to support homeland security coordination. The Consolidated
Appropriations Resolution for FY2003 (P.L. 108-7), provided this amount. It also
contained several drinking water security earmarks, including $2 million for the
National Rural Water Association to help small water systems conduct vulnerability
assessments and $1 million for the American Water Works Association for water
security training activities.
As requested for FY2004, EPA received approximately $32 million for critical
water infrastructure protection, including $5 million for state homeland security
grants in P.L. 108-199. This funding supported states’ efforts to work with water and
wastewater systems to develop and enhance emergency operations plans; conduct
training in the implementation of remedial plans in small systems; and develop
detection, monitoring and treatment technology to enhance water security. EPA used
funds to assist the nearly 8,000 community water systems that serve water to
populations between 3,300 and 100,000 and are subject to the Bioterrorism Act. P.L.
108-199 also included $2 million for the Water ISAC to gather, analyze and
disseminate sensitive security information to water and wastewater systems.

---

CRS-8
For FY2005, EPA requested $5 million for state water security grants and $6.1
million for other critical infrastructure protection efforts. EPA’s budget justification
explained that the $21.3 million reduction reflected a shift in priorities from
assistance and training on vulnerability assessments. (The Bioterrorism Act required
community water systems to complete vulnerability assessments by June 30, 2004.)
In the Consolidated Appropriations Act, FY2005 (P.L. 108-447), Congress provided
the requested amount. As in FY2004, the appropriated amount included $2 million
for the Water ISAC, and the conferees again specified that the Water ISAC is to be
implemented through a grant to the Association of Metropolitan Water Agencies.
In the FY2006 budget request, the President again requested $5 million for state
water security grants. The President also requested $44 million to launch the Water
Sentinel Initiative in response to EPA’s responsibilities under Homeland Security
Presidential Directive (HSPD) 7, which designated EPA as the lead agency for water
infrastructure security. The goal of the initiative is to establish pilot early warning
systems through intensive water monitoring and surveillance for certain chemical and
biological contaminants in five cities. EPA also proposed to form a water laboratory
alliance to build the analytical capacity needed to support the surveillance program
to ensure that large systems would have the tools and information needed to prevent,
detect, and respond to attacks.13 In EPA’s FY2006 appropriations act (P.L. 109-54,
H.R. 2361), Congress provided $9 million for the Water Sentinel Initiative, as
proposed by the House; the Senate had proposed $5.6 million. The House
Appropriations Committee (H.Rept. 109-80) stated that EPA should develop specific
goals for the Water Sentinel Initiative and justify the request more clearly in the next
budget request. Congress also provided $5 million for state water security grants.
In addition to the above resources, EPA has identified numerous security
measures that are eligible for funding through the Drinking Water State Revolving
Fund (DWSRF) program.14 Examples of eligible measures include vulnerability
assessments, contingency plans, and various facility improvements. Congress has
provided approximately $845 million annually for this program in recent years.
However, it is uncertain how readily funds might become available for security
measures, as the key purpose of the DWSRF is to facilitate compliance with federal
drinking water regulations, and competition for these funds can be considerable.
Another potential source of funding for community water systems is the State
Homeland Security Grant Program, administered by DHS. This program provides
assistance to states to detect, prevent, and respond to terrorist attacks. Under this
program, states are required to allocate 80% of the grant funds to localities, in
accordance with their approved homeland security plans. Funds may be used for
homeland security related training and for protecting critical infrastructure, including
making physical security improvements. Local public works agencies are eligible to
13 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Science and Technology, Homeland Security: Critical Infrastructure
Protection, pp. S&T-21 - S&T-23.
14 See EPA Fact Sheet, Use of the Drinking Water State Revolving Fund (DWSRF) to
Implement Security Measures at Public Water Systems, EPA 816-F-02-040, November 2001.
Available at [http://www.epa.gov/safewater/dwsrf/security-fs.pdf], visited Jan. 24, 2006.

---

CRS-9
receive funding from the state. The conference report for the FY2005 Department
of Homeland Security Appropriations Act (P.L. 108-334, H.Rept. 108-774) provided
$1.1 billion for this grant program, and revised the definition of “local unit of
government” for purposes of this program to specifically include water districts,
special districts, and other political subdivisions of a state.
Congressional Actions to Enhance Drinking Water Security
Since September 11, 2001, Congress held multiple hearings to examine security
issues facing the water infrastructure sector15 and acted on several bills to improve
drinking water security. In the 107th Congress, two major pieces of legislation were
enacted that addressed drinking water security: the Bioterrorism Act of 2002, and the
Homeland Security Act of 2002.
Bioterrorism Act of 2002. The Public Health Security and Bioterrorism
Preparedness and Response Act of 2002 (P.L. 107-188) was enacted in June 2002.
Title IV of the act (42 U.S.C. 300i) amended the Safe Drinking Water Act (SDWA)
to require community water systems serving more than 3,300 individuals to conduct
an assessment of their system’s vulnerability to terrorist attacks or other intentional
acts to disrupt the provision of a safe and reliable drinking water supply. These
systems were required certify to EPA that they had conducted a vulnerability
assessment and submit a copy of the assessment to EPA. The act also required the
water utilities to prepare or revise emergency response plans incorporating the results
of the vulnerability assessments no later than six months after completing them.
(Table 1 outlines the schedule for the nearly 8,400 water systems that were required
to submit vulnerability assessments to EPA and complete emergency response plans.)
EPA was required to issue guidance on conducting vulnerability assessments,
preparing emergency response plans, and addressing threats to help smaller systems
not covered by the Bioterrorism Act.16
Table 1. Community Water System Requirements under the
Bioterrorism Act
System size by
Date for completing
Date for completing
population served
vulnerability assessments
emergency response plans
(est. no. of systems)
100,000 or more
March 31, 2003
September 30, 2003
(425)
50,000 - 99,999
December 31, 2003
June 30, 2004
(460)
3,301 - 49,999
June 30, 2004
December 31, 2004
(7,500)
15 See, for example: U.S. Congress. House of Representatives, Committee on Energy and
Commerce, Subcommittee on Environment and Hazardous Materials. Controlling Bioterror:
Assessing Our Nation’s Drinking Water Security. Serial No. 108-123. Sept. 30, 2004.
16 EPA published Water Security Strategy for Systems Serving Populations Less than
100,000/15MGD or Less (July 2002).

---

CRS-10
The act exempted the contents of the vulnerability assessments from disclosure
under the Freedom of Information Act (except for information contained in the
certification that identified the system and the date of the certification). As required
by the Bioterrorism Act, EPA developed protocols to protect the assessments from
unauthorized disclosure, and provides for civil and criminal penalties for
inappropriate disclosure of information by government officials.

The Bioterrorism Act authorized $160 million for FY2002, and such sums as
may be necessary for FY2003-FY2005, to provide financial assistance to community
water systems to conduct vulnerability assessments, to prepare response plans, and
for expenses and contracts to address basic security enhancements and significant
threats. (Security enhancements may include purchase and installation of intruder
detection equipment and lighting, enhancing security of automated systems,
personnel training and security screening of employees or contractors, etc. Funding
may not be used for personnel costs, plant operations, monitoring or maintenance.)
For grants to states and water systems to assist in responding to emergency
situations, the act authorized $35 million for FY2002, and such sums as may be
necessary thereafter. Finally, the act authorized $15 million for FY2002, and such
sums as may be necessary for FY2003 through FY2005, for EPA to review methods
by which terrorists or others could disrupt the provision of safe water supplies, and
methods for preventing, detecting, and responding to such disruptions.
Homeland Security Act of 2002. The Homeland Security Act of 2002 (P.L.
107-296) combined the functions of all or parts of 22 federal agencies and
departments into a new Department of Homeland Security (DHS). The act gave key
responsibility for critical infrastructure protection to DHS, but did not transfer EPA
water security functions to the new Department.
The Homeland Security Act established within DHS a Directorate for
Information Analysis and Infrastructure Protection (IA/IP), headed by an
undersecretary. The responsibilities assigned to the undersecretary included
! receiving, analyzing, and integrating law enforcement, intelligence
and other information to identify and assess the nature and scope of
terrorist threats to the United States;

! assessing vulnerabilities of key resources and critical infrastructure;
integrating information, analyses, and vulnerability assessments to
identify priorities for protective and support measures;
! ensuring timely access by DHS to necessary information; and
! developing a comprehensive national plan for securing key resources
and critical infrastructures.17
17 In 2005, Homeland Security Secretary Chertoff proposed a major restructuring of the
Department of Homeland Security that included reorganizing the IA/IP Directorate and
(continued...)

---

CRS-11
Under the Bioterrorism Act, Congress gave EPA new authorities and
responsibilities to assist water utilities and states in enhancing the security of drinking
water supplies and facilities, and directed community water systems to submit
vulnerability assessments to EPA. With the creation of DHS, which has overall
responsibility for critical infrastructure vulnerability assessment and protection, the
relative responsibilities of EPA and DHS were not clear.
In December 2003, the White House issued Homeland Security Presidential
Directive (HSPD-7), which superseded PDD-63. This Directive established national
policy and outlined the roles and responsibilities of federal departments and agencies
regarding critical infrastructure protection. It identified EPA as the federal agency
with lead responsibilities for ensuring the protection of the water infrastructure sector
from terrorist attacks or sabotage. The HSPD-7 gave DHS responsibility for overall
coordination and integration of national critical infrastructure protection efforts by
federal, state, and local governments and the private sector.
Issues for Congress
With ongoing concern over the potential for terrorist attacks, Congress has
remained attentive to the security status of the nation’s public water supplies and
infrastructure. Interest in the 109th Congress continues to focus on implementation
of the drinking water security provisions of the Bioterrorism Act and, more broadly,
on the status and adequacy of public and private efforts to enhance the security and
emergency preparedness of public water systems. Because of actions on the part of
the drinking water community, EPA and Congress, efforts to improve security in the
water sector appear to be ahead of those in certain other sectors (for example,
chemical facilities). However, a number of issues and challenges remain.
The relationship between EPA and DHS has been an issue for Congress.
Although the Bioterrorism Act helped elucidate EPA’s role in the drinking water
sector, Congress has expressed concerned that, overall, EPA’s homeland security
responsibilities have not been well articulated. EPA and DHS have taken steps to
clarify their roles, and have entered into agreements to coordinate on specific
activities, such as research. However, some overlaps and conflicts have arisen. In the
conference report for the Consolidated Appropriations Act, 2005 (P.L. 108-447,
H.Rept. 108- 792), conferees directed EPA to enter into a comprehensive
memorandum of understanding (MOU) with DHS that defines the relationship and
responsibilities of the two entities regarding homeland security and protection.
Conferees specified that the MOU identify areas of responsibilities and the potential
costs (including which entity pays) for meeting those responsibilities.18
17 (...continued)
separating information analysis and infrastructure protection. The IA/IP Directorate was
renamed the Directorate of Preparedness, and the IA function was moved to a new Office
of Intelligence and Analysis. For a detailed discussion of the review and reorganization of
DHS by Secretary Chertoff, see CRS Report RL33042, Department of Homeland Security
Reorganization: The 2SR Initiative, by Harold Relyea and Henry Hogue.
18 H.Rept. 108-792, conference report to accompany H.R. 4818, Consolidated
(continued...)

---

CRS-12
Another issue involves the availability of funding for water systems to make
security upgrades needed to address risks identified in their vulnerability assessments.
Congress has not provided funding specifically for this purpose. Although
community water systems potentially are eligible to receive funding from the states
through the DHS State Homeland Security Grant Program, competition for funds is
severe and the preponderance of funds have gone to meet the needs of first
responders. In an effort to address one element of this concern, the conference report
to the Department of Homeland Security Appropriations Act for FY2005 (P.L. 108-
334, H.Rept. 108-774) modified the definition of “local unit of government” to
specifically include water districts. This appropriations act provided $1.1 billion for
the Homeland Security Grant Program for FY2005.19 It is uncertain what portion of
homeland security grants have since been allocated to improve the security of critical
water infrastructure, as DHS has not made such information available.
The related question of how to set priorities for allocating homeland security
funding continues to be debated.20 At a September 2004 hearing held by the House
Energy and Commerce Committee on bioterrorism and the security of water supplies,
the Government Accountability Office (GAO) testified that water security experts
widely agreed that decisions for allocating federal funding for water security
improvements should be based primarily on two criteria: (1) population density, and
(2) information from vulnerability assessments.21 Security experts also set funding
priorities at the utility level, and identified distribution systems as the most vulnerable
component of a water system. Other water system components identified as requiring
protective measures included utility computer systems, chemicals stored on-site, and
source water supplies. Three broad categories of security activities were identified
as most deserving of funding, including physical and technological upgrades,
education and training, and strengthening relationships between water utilities and
agencies that would be involved in any emergency responses.22
A major concern for the water sector is the need for more research to develop
real-time monitoring methods to detect contaminants, and technologies to remove or
18 (...continued)
Appropriations Act, 2005 (P.L. 108-447), November 20, 2004, p. 1563.
19 For information on this and other homeland security grant programs, see CRS Report
RL32348, Selected Federal Homeland Security Assistance Programs: A Summary, by
Shawn Reese.
20 For a discussion of this issue and funding allocations among the states, see CRS Report
RL32696, Fiscal Year 2005 Homeland Security Grant Program: State Allocations and
Issues for Congressional Oversight, by Shawn Reese.
21 U.S. Government Accountability Office, Drinking Water: Experts’ Views on How Future
Federal Funding Can Best Be Spent to Improve Security, Testimony before the
Subcommittee on Environment and Hazardous Materials, Committee on Energy and
Commerce, House of Representatives. September 30, 2004. Testimony was based on report
of same title to the Committee on Environment and Public Works, U.S. Senate, Oct. 2003,
GAO-04-29.
22 U.S. Government Accountability Office, Drinking Water: Experts’ Views on How Future
Federal Funding Can Best Be Spent to Improve Security, Testimony, pp. 2-3.

---

CRS-13
inactivate them. The GAO survey of security experts found strongest support for
research on developing monitoring technologies that can quickly detect contaminants
in water that has already left a treatment plant for distribution to consumers.23 In its
FY2006 budget request, EPA proposed to focus homeland security research on the
detection, containment, decontamination, and disposal of chemical and biological
agents that could be used in attacks on water systems.24 Specifically, EPA requested
$44 million for a new drinking water security initiative, the Water Sentinel program,
to help address water utilities’ concerns regarding their ability to monitor, detect, and
respond to certain chemical and biological contaminants.25 The agency’s resource
request for this initiative received critical attention from appropriations committees.
In EPA’s FY2006 appropriations act (P.L. 109-54, H.R. 2361), Congress provided
$9 million for the new initiative. In recommending a large reduction, the House
Appropriations Committee commented that EPA should develop clear goals for the
Water Sentinel Initiative, seek the advice of the Science Advisory Board, and justify
the request more clearly in the budget request for FY2007.26 As this initiative is a key
element of EPA’s effort to meet its water security responsibilities under HSPD-9,
Congress is likely to give it further consideration during the second session
crsphpgw
23 Ibid. p. 7.
24 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Goal 4: Health Communities and Ecosystems, p. 4-19.
25 Environmental Protection Agency, FY2006 Annual Performance Plan and Congressional
Justification, Science and Technology, Homeland Security: Critical Infrastructure
Protection, p. S&T-21 - S&T-23.
26 U.S. Congress, House Committee on Appropriations, Department of the Interior,
Environment, and Related Agencies Appropriation Bill, 2006, report to accompany H.R.
2361, 109th Cong., 1st sess., H.Rept. 109-80, p. 94.

---