Order Code RL31294
Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Updated March 13, 2007
Mary Tiemann
Specialist in Environmental Policy
Resources, Science, and Industry Division

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Summary
The events of September 11, 2001, focused heightened attention on the security
status of the nation’s drinking water supplies and the vulnerability of this critical
infrastructure sector to attack. Congress since has enacted security requirements for
public water systems and has provided funding for vulnerability assessments,
emergency planning, and drinking water research. The Environmental Protection
Agency (EPA), the lead federal agency for the water sector, has worked with water
utilities, state and local governments, and federal agencies to improve the drinking
water security.
The Public Health Security and Bioterrorism Preparedness and Response Act of
2002 (P.L. 107-188) amended the Safe Drinking Water Act to require some 8,400
community water systems to assess vulnerabilities and prepare emergency response
plans. It authorized funding for these activities and for emergency grants to states
and utilities, and it directed the EPA to review methods to prevent, detect, and
respond to threats to water safety and infrastructure security. The act did not require
water systems to make security upgrades to address potential vulnerabilities. Since
FY2002, Congress has appropriated funds annually for the EPA to work with states
and the water sector to improve the security of drinking water supplies.
In the Homeland Security Act of 2002 (P.L. 107-296), Congress created a
Department of Homeland Security (DHS) and gave the DHS responsibility for
assessing and protecting the nation’s critical infrastructures. However, the act did not
transfer the EPA’s water security functions, and the 2003 Homeland Security
Presidential Directive (HSPD-7) confirmed the EPA’s lead role in protecting the
water infrastructure. Under this directive, the EPA has responsibility for developing
and providing tools and training on improving security to roughly 53,000 community
water systems and 16,000 municipal wastewater treatment facilities.
In the 109th Congress, several bills, including a reported bill, S. 2145, proposed
to expand water security requirements for certain high-risk water systems. The
Department of Homeland Security FY2007 appropriations act (P.L. 109-295, H.R.
5441) authorized the DHS to regulate for three years high-risk chemical facilities, but
the law excluded from coverage drinking water and wastewater treatment facilities.
Although the EPA, states, localities, and water utilities have taken steps to
address security concerns, the security of the nation’s water supplies continues to
attract congressional attention. Issues receiving attention have included the status of
efforts by the water sector to improve security, whether to increase federal
requirements, funding needs for water systems to make security improvements, the
relative roles and responsibilities of the EPA and the DHS regarding the water sector,
and the status of research and development of technologies to help water systems
detect and address potential biological and chemical contaminants. This report
reviews governmental and water utility efforts to improve drinking water security.

---

Contents
Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
EPA Efforts To Increase Drinking Water Security . . . . . . . . . . . . . . . . . . . . 2
Information Sharing and Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Tools and Technical Assistance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Funding for Drinking Water Security Activities . . . . . . . . . . . . . . . . . . . . . . 6
Legislation Enacted To Address Drinking Water Security . . . . . . . . . . . . . . 9
Bioterrorism Act of 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Homeland Security Act of 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Issues for Congress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Water Facility Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
EPA and DHS Water Infrastructure Security Roles . . . . . . . . . . . . . . 15
List of Tables
Table 1. Community Water System Requirements under the
Bioterrorism Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

---

Safeguarding the Nation’s Drinking Water:
EPA and Congressional Actions
Background
Ensuring the security of the nations’ drinking water supplies poses a substantial
challenge, partly because the number of water systems is very large and also because
the responsibility for protecting drinking water safety is shared among federal, state
and local governments and utilities. Nationwide, there are more than 158,000 public
water systems, and these systems range greatly in size, serving from as few as 25
persons to more than 1 million persons. Nearly 53,000 of all public water systems
are community water systems (CWSs) that serve the same residences year-round.1
These 53,000 systems provide water to approximately 282 million people.
Approximately 400 community systems serve more than 100,000 people and provide
water to nearly half of the total population served. Because water supplies support
many uses (from drinking water to fire suppression), their disruption could have
significant impacts.2
A 1996 executive order on critical infrastructure protection (E. O. 13010),
included water supply systems as one of eight national infrastructures vital to the
security of the United States.3 In 1997, the President’s Commission on Critical
Infrastructure Protection, created by the executive order, issued a report on the
vulnerabilities of these infrastructure sectors and strategies for protecting them. The
Commission identified three attributes crucial to water supply users: water must be
available on demand, it must be delivered at sufficient pressure, and it must be safe
for use.4 Actions affecting any of these factors could be debilitating for the
infrastructure.
1 Another 19,174 public water systems are non-transient, non-community water systems
(NTNCWS), such as schools or factories, that have their own water supply and generally
serve the same individuals for more than six months but not year-round. More than 86,200
other public water systems are transient non-community water systems (TNCWS), such as
campgrounds and gas stations, that provide their own water to transitory customers.
2 For a broader review of security issues in the water resources sector (including dams and
sewage treatment plants), see CRS Report RL32189, Terrorism and Security Issues Facing
the Water Infrastructure Sector, by Claudia Copeland.
3 For a review of critical infrastructures, related security issues and protection initiatives,
and activities within the Department of Homeland Security, see CRS Report RL30153,
Critical Infrastructures: Background, Policy, and Implementation, by John D. Moteff.
4 The President’s Commission on Critical Infrastructure Protection, Critical Foundations:
Protecting America’s Infrastructures. Report of the President’s Commission on Critical
Infrastructure Protection, Appendix A, Sector Summary Reports, Oct. 1997, p. A-45.

---

CRS-2
Major threats to water supplies include physical destruction of facilities or
distribution systems, biological or chemical contamination of supplies, and cyber
attacks. The 1997 Commission found that drinking water systems had inadequate
protection against the threat of chemical or biological contamination, and that
technology was insufficient to allow detection, identification, measurement, and
treatment of highly toxic, waterborne contaminants. Water utilities were also found
to be vulnerable to cyber attacks as they rely increasingly on computers to control
water flow and pressure. Information sharing was identified as the most immediate
need, whereas warning and analytical capabilities and research and development all
were found to be insufficient.
In response to these findings and related developments, President Clinton, in
1998, issued Presidential Decision Directive (PDD) 63 on critical infrastructure
protection. Under this directive, a public/private partnership was established to put
in place prevention, response, and recovery measures to ensure the security of the
nation’s critical infrastructures against criminal or terrorist attacks. PDD-63
designated the Environmental Protection Agency (EPA) as the lead federal agency
for the water supply sector, and the EPA appointed the Association of Metropolitan
Water Agencies (AMWA) to coordinate the water sector. However, before
September 11, 2001, the main focus of PDD-63 efforts for all critical infrastructure
sectors was on cybersecurity. Subsequently, the breadth and depth of efforts to
protect the nation’s critical infrastructures has changed significantly.
EPA Efforts To Increase Drinking Water Security
In 2003, President Bush issued Homeland Security Presidential Directive 7
(HPSD-7), which affirmed the EPA as the lead federal agency for coordinating the
protection of the nation’s critical infrastructure for the water sector. Under this
directive, the EPA is responsible for developing and providing tools and training on
improving security to roughly 53,000 community water systems and 16,000
municipal wastewater treatment facilities.
To carry out its water sector responsibilities, the EPA established a Water
Security Division within the Office of Ground Water and Drinking Water. This
Division works with drinking water and wastewater utilities, states, tribes, and other
stakeholders to improve the security of these utilities and improve their ability to
respond to security threats and breaches. Among its responsibilities and activities,
the Water Security Division provides security and antiterrorism-related technical
assistance and training to the water sector. Although the Water Security Division was
established in 2003, the Office of Water has provided assistance to its stakeholders
for a number of years.
Security-related activities undertaken by the EPA and the water sector have
fallen into five general categories, including (1) establishing an information center
for drinking water alerts or incidents, (2) developing vulnerability assessment tools,
(3) identifying actions to minimize vulnerabilities, (4) revising emergency operations
plans, and (5) supporting research on biological and chemical contaminants
considered to be potential weapons of mass destruction. Several key government and
private sector efforts are reviewed below.

---

CRS-3
Information Sharing and Analysis. One goal of PDD-63 in 1998 was to
establish an Information Sharing and Analysis Center (ISAC) for each critical
infrastructure sector. With assistance from the EPA and the Federal Bureau of
Investigation (FBI), the Association of Metropolitan Water Agencies has led the
effort to develop and implement an ISAC for water utilities. The Water ISAC
provides a communications link between the water sector and federal homeland
security, law enforcement, intelligence, environmental, and public health agencies.
This secure, web-based communication system is intended to disseminate information
regarding threats against the physical and cyber systems of drinking water and
wastewater facilities, allow drinking water and wastewater utilities to share
information on security incidents, and provide an opportunity for utilities to have
security incidents analyzed by counterterrorism experts.5

Tools and Technical Assistance. The EPA has worked with its water
sector partners to provide practical tools and technical assistance to utilities on a wide
range of security matters. In 2000, the American Water Works Association Research
Foundation (AWWARF) and the Sandia National Laboratories, with EPA support,
initiated a project to develop a methodology for utilities to use to assess their
vulnerabilities and develop plans to minimize identified risks. The project was
expedited after September 11, 2001, and completed in November 2001, and many
large water systems used this risk assessment methodology to conduct vulnerability
assessments. States and drinking water organizations, in collaboration with the EPA,
developed additional vulnerability assessment tools, with a particular focus on the
needs of smaller communities. To help cover the costs of conducting vulnerability
assessments and preparing emergency response plans, the EPA awarded a total of $51
million in grants to community water systems that serve more than 100,000 persons.
While direct grants have not been available for smaller water systems, a
considerable amount of technical assistance has been aimed at helping these systems,
which typically are least likely to have the capacity to address security concerns. The
EPA has used “train-the-trainer”grants to build a pool of environmental professionals
that has provided training and technical assistance to water systems serving fewer
than 50,000 people.6 In addition, on-site assistance for vulnerability assessment and
emergency response planning has been made available to small and medium
wastewater utilities at no cost through the Wastewater Operator Training Program.
Technical assistance also has been provided through numerous guidance
documents designed to help public water suppliers address a range of security
concerns.7 A key product is the Response Protocol Toolbox: Planning for and
5 For further information on the Water ISAC, see [http://www.waterisac.org].
6 The EPA generally does not perform security training; rather, the agency has delivered
training at locations across the country through stakeholder organizations and other federal
partners. Organizations that provide training include professional associations, such as the
American Water Works Association, the Water Environment Federation, and the National
Rural Water Association. Congress has provided some grant funds to these organizations,
through the EPA, to support their water security training activities.
7 Water security reports, guidance documents, security directives, and other publications are
(continued...)

---

CRS-4
Responding to Contamination Threats to Drinking Water Systems, which is intended
to help public water systems respond to contamination threats and incidents. The
“toolbox” includes separate modules that address water utility planning,
contamination threat management, site characterization and investigation, water
sample analysis, public heath response, and remediation and recovery.8 Paralleling
the toolbox, the EPA developed response guidelines to help water utilities,
emergency responders, and other officials during the management of an ongoing
contamination threat or incident.
As a sector, drinking water utilities acted relatively quickly to assess
vulnerabilities, upgrade emergency response plans, and take some initial steps to
improve security of this critical infrastructure. The Office of Homeland Security’s
2003 National Strategy for the Physical Protection of Critical Infrastructure and Key
Assets reported that the water sector had taken great strides to protect its critical
facilities and systems, and had focused on categories of possible attacks that could
have the greatest health or economic consequences.9 However, the Homeland
Security Office noted that the water sector needed better threat information to
prioritize investments on security measures. It also reiterated the need for research
and development of new monitoring and analytic capabilities to enhance detection
of biological, chemical, and radiological contaminants that could be introduced to the
water supply.
Research. The EPA has participated in various research and development
projects related to water security, including research to evaluate the ability of drinking
water treatment systems to remove and inactivate biological and chemical agents.
The agency also has supported research efforts to determine the fate and transport of
contaminants within rivers and streams and within water treatment plants and
distribution systems, and to develop biodetectors for detecting and quantifying
biological contaminants in drinking water supplies.
To coordinate and oversee research involving the prevention and response to
terrorist attacks, the EPA’s Office of Research and Development established the
National Homeland Security Research Center (NHSRC) in 2002. The Center’s key
areas of research involve water infrastructure protection, decontamination and
consequence management, and threat and consequence assessment.
In 2004, the NHSRC’s Water Infrastructure Protection Division and the Office
of Water’s Water Security Division developed a Water Security Research and
7 (...continued)
available at [http://cfpub.epa.gov/safewater/watersecurity/publications.cfm].
8 U.S. Environmental Protection Agency, Response Protocol Toolbox: Planning for and
Responding to Drinking Water Contamination Threats and Incidents, August 2004.
Available at [http://www.epa.gov/watersecurity/pubs/rptb_response_guidelines.pdf].
9 Office of Homeland Security, The National Strategy for the Physical Protection of Critical
Infrastructures and Key Assets, February 2003, p. 39. The categories included (1) physical
damage or destruction of critical assets (including the intentional release of toxic chemicals),
(2) actual or threatened contamination of the water supply, (3) cyber attack, and (4)
interruption of services from another infrastructure (such as energy supply).

---

CRS-5
Technical Support Action Plan to define a specific program of research and technical
support for protecting drinking water and wastewater facilities from terrorist threats
and attacks. The action plan, which was reviewed by the National Research Council
(NRC), addressed drinking water supply, water treatment, finished water storage, and
distribution systems. It identified major research needs in the following areas:
! protecting physical and cyber infrastructure;
! identifying drinking water contaminants;
! improving monitoring systems and analytical methods for drinking
water;
! containing, treating, decontaminating, and disposing of contaminated
water and material;
! contingency planning;
! addressing infrastructure interdependencies;
! risk assessment and communication; and
! protecting wastewater treatment and collection systems.10
A key concern the NRC expressed regarding the action plan was that it did not
discuss the financial resources that would be required to complete the proposed
projects and to implement countermeasures needed to improve water security. The
NRC recommended that EPA try to quantify the costs and benefits associated with
the research and technical support projects. The NRC further noted that more
emphasis was needed on communicating the value of water and increased security,
because water rate increases would likely be needed to generate the resources needed
to implement counter measures.11
In a 2005 progress report on the action plan, the EPA reported that more than
100 projects had been initiated to address the needs listed in the plan.12 Projects
currently underway include a review of early warning systems, a tracer studies guide
for use by water utilities, a treatability guide for biological contaminants in water, a
review of emerging detection technologies for water contaminants, a review of the
impacts of biological toxins on water systems, devices to concentrate and analyze
water for contaminants, and performance verifications of the effectiveness of
monitoring, treatment, and decontamination technologies. The Water Infrastructure
Protection Division has lead responsibility for much of this research and is producing
tools, guides, and other products for use by water utility operators, public health
officials, and emergency responders.
For FY2006 and FY2007, the EPA requested funding for the WaterSentinel
Initiative, a demonstration project to develop a model contamination warning system
for drinking water systems. The goal of this initiative is to establish pilot early
10 U.S. Environmental Protection Agency, EPA’s Role In Water Security Research: The
Water Security Research and Technical Support Action Plan, EPA/600/R-04/063, March
2004.
11 National Academy of Sciences, A Review of the EPA Water Security Research and
Technical Support Action Plan: Parts I and II, National Academy Press, 2003.
12 U.S. Environmental Protection Agency, Water Security Research and Technical Support
Action Plan — Progress Report for 2005, p. 5-7.

---

CRS-6
warning systems through intensive water monitoring and surveillance in selected
cities. As noted below, the 109th Congress gave partial support to this initiative.
Using the resources appropriated, the EPA has established an initial pilot for this
water security initiative, and expects to publish interim guidance during 2007.
Funding for Drinking Water Security Activities
Since 2001, Congress has provided funds annually to the EPA to improve the
security of public water supplies. The Emergency Supplemental Appropriations Act
for FY2002 (P.L. 107-117) provided the EPA with $175.6 million for emergency
expenses to respond to the September 11 attacks and to support counterterrorism
activities. The accompanying conference report, H.Rept. 107-350, specified that
approximately $90 million was for improving security at EPA laboratories,
performing drinking water vulnerability assessments, and anthrax decontamination
activities. Another $5 million was for state grants for counterterrorism coordinators
to work with the EPA and water utilities in assessing drinking water safety. Congress
has continued to provide roughly $5 million for these state grants each year.
During FY2002, the EPA allocated roughly $89 million of the amount provided
in the emergency supplemental appropriation to support security enhancements at the
nation’s drinking water systems. Of this amount, the EPA targeted approximately
$80 million to: (1) provide grants to the largest drinking water systems to conduct
vulnerability assessments and enhance emergency response plans; (2) provide
technical assistance on vulnerability assessments and emergency response plans to
small and medium drinking water systems; and (3) refine security-related detection,
monitoring, and treatment tools. Another $4 million was used to accelerate the
development and testing of counterterrorism tools, support vulnerability assessment
training, provide technical assistance, and conduct and implement research on
redesign and detection for collection and treatment systems. The EPA also used
funds to develop tools and provide training for medium and small drinking water
systems to assess vulnerabilities and develop emergency response plans. In addition,
the EPA allocated $5 million to the states to support homeland security coordination
work involving the EPA and drinking water utilities.

The EPA awarded approximately $51 million in water security grants to the
community water systems that serve more than 100,000 individuals. Grants were
made to these roughly 400 publicly and privately owned community water systems
for as much as $115,000 per grant. Utilities were able to use their grants to develop
vulnerability assessments, emergency response plans, and security enhancement plans
and designs. Utilities also could use grant funds for in-house or contractor support;
however, funds could not be used for physical improvements.
Although these grants were made only to large systems, the EPA has worked
with states and utilities to help meet the security needs of small and medium-sized
drinking water systems. The EPA provided roughly $20 million of FY2002
supplemental funds directly to the states for technical assistance and training for
drinking water systems serving fewer than 100,000 people.
For FY2003, the EPA requested $16.9 million to assist small and medium-sized
systems with vulnerability assessments and emergency response plans, and $5 million

---

CRS-7
in grants to states to support homeland security coordination. The Consolidated
Appropriations Resolution for FY2003 (P.L. 108-7), provided this amount. It also
contained several drinking water security earmarks, including $2 million for the
National Rural Water Association to help small water systems conduct vulnerability
assessments and $1 million for the American Water Works Association for water
security training activities.
As requested for FY2004, the EPA received approximately $32 million for
critical water infrastructure protection, including $5 million for state homeland
security grants in P.L. 108-199. This funding supported states’ efforts to work with
water and wastewater systems to develop and enhance emergency operations plans;
conduct training in the implementation of remedial plans in small systems; and
develop detection, monitoring and treatment technology to enhance water security.
The EPA used funds to assist the nearly 8,000 community water systems that serve
water to populations between 3,300 and 100,000 and are subject to the Bioterrorism
Act. P.L. 108-199 also included $2 million for the Water ISAC to gather, analyze
and disseminate sensitive security information to water and wastewater systems.
For FY2005, the EPA requested $5 million for state water security grants and
$6.1 million for other critical infrastructure protection efforts. EPA’s budget
justification explained that the $21.3 million reduction reflected a shift in priorities
from assistance and training on vulnerability assessments. (Under the Bioterrorism
Act, community water systems were required to complete vulnerability assessments
by June 30, 2004.) Congress provided the requested amount in the Consolidated
Appropriations Act, FY2005 (P.L. 108-447). As in FY2004, the appropriated amount
included $2 million for the Water ISAC.
In the FY2006 budget request, the President again requested $5 million for state
water security grants. The President also requested $44 million to launch the
WaterSentinel Initiative, a demonstration project to develop a model contamination
warning system. The EPA initiated this project to meet its responsibilities under
Homeland Security Presidential Directive (HSPD) 9, which directed the EPA to
develop a surveillance and monitoring program to provide early detection in the event
of a terrorist attack contaminating water. The goal of the initiative is to establish
pilot early warning systems through intensive water monitoring and surveillance for
certain chemical and biological contaminants in five cities. Further responding to
HSPD-9, the EPA proposed to form a laboratory network to support the monitoring
and response requirements of the surveillance program.13
In EPA’s FY2006 appropriations act (P.L. 109-54), Congress provided $8.1
million (after rescissions) of the $44 million requested for the WaterSentinel
Initiative. In recommending a large reduction, the House Appropriations Committee
recommended that the EPA develop clear goals for the initiative, seek the advice of
the Science Advisory Board, and justify the request more clearly in the budget request
13 U.S. Environmental Protection Agency, FY2006 Annual Performance Plan and
Congressional Justification, Science and Technology, Homeland Security: Critical
Infrastructure Protection, pp. S&T-21 - S&T-23.

---

CRS-8
for FY2007.14 Congress also provided $5 million ($4.93 after rescissions) for state
water security grants.
The FY2007 budget request included $4.95 million for state water security
grants. In addition, the request again included a significant amount, $41.7 million, for
the WaterSentinel Initiative ($33.6 million more than Congress provided for
FY2006). In its justification for the request, the agency noted that the program is an
essential component of its water security activities, and explained that its purpose is
to demonstrate an effective contamination warning system that could be used by
drinking water utilities of various sizes.
The EPA FY2007 funding bill, H.R. 5386, as passed by the House, would have
provided $16.7 million, or $25 million less than requested for the WaterSentinel
Program. The Senate Appropriations Committee (S.Rept. 109-275) recommended
$18.13 million, which was $23.6 million less than requested but $10 million above
the FY2006 enacted level. The House Appropriations Committee report for H.R.
5386 (H.Rept. 109-465) stated that the committee’s recommended funding level for
the initiative included money for one additional pilot project, which should be located
in a metropolitan area that is highly vulnerable from a homeland security threat
perspective. The committee further recommended that
[a]ny future WaterSentinel funding should be requested through the Department
of Homeland Security and EPA should coordinate with the Office of
Management and Budget to ensure this happens beginning in fiscal year 2008.
While the Committee agrees that EPA’s expertise is important for program
success and that it had a critical role to play in establishing the program, the
Committee also believes strongly that continuing program funding must be
provided through the Department of Homeland Security.15
Congress did not complete action on this appropriations bill. The revised
continuing appropriations resolution for FY2007 (P.L. 110-5, H.J.Res. 20) generally
funded EPA activities, including drinking water activities, at FY2006 levels.
For FY2008, the EPA has requested $25.6 million to support its water security
initiative pilot program (formerly known as WaterSentinel) and other water sector
agency responsibilities to protect critical water infrastructure. The EPA proposes to
use the requested funding for FY2008 to support the existing pilot and the
establishment of additional pilots, with a goal of having all planned pilots underway
by 2008. The EPA also plans to continue to provide special assistance to high-
priority drinking water systems under the Water Alliance for Threat Reduction. The
goal of this assistance is to ensure that water utilities have tools and information to
prevent, detect, respond to, and recover from terrorist attacks, other intentional acts,
and natural disasters.
14 U.S. Congress, House Committee on Appropriations, Department of the Interior,
Environment, and Related Agencies Appropriation Bill, 2006, report to accompany H.R.
2361, 109th Cong., 1st sess., H.Rept. 109-80, p. 94.
15 U.S. Congress, House Committee on Appropriations, Department of the Interior,
Environment, and Related Agencies Appropriation Bill, 2007, report to accompany H.R.
5386, 109th Cong., 2nd sess., H.Rept. 109-465, p. 100-101.

---

CRS-9
Thus far, Congress has not provided funding in EPA appropriations for grants
to public water systems specifically for making security improvements. However,
the EPA has identified numerous security measures that are eligible for funding
through the Drinking Water State Revolving Fund (DWSRF) program.16 Eligible
measures include making facility improvements, such as adding fencing, cameras,
and lighting; securing chemical and fuel storage; hiring guards; and adopting
enhanced filtration and disinfection treatment. Congress has provided approximately
$845 million annually for this program in recent years. However, it is uncertain how
readily funds might become available for security measures, as the key purpose of the
DWSRF is to facilitate compliance with federal drinking water regulations, and
competition for these funds can be considerable.
Another potential source of funding for community water systems is the State
Homeland Security Grant Program, administered by the Department of Homeland
Security. This program provides assistance to states to detect, prevent, and respond
to terrorist attacks. States are required to allocate 80% of the grant funds received
under this program to localities, in accordance with their approved homeland security
plans. Funds may be used for homeland security related training and for protecting
critical infrastructure, including making physical security improvements. Local
public works agencies, including water districts, are eligible to receive funding from
the state; however, most of these funds have been used to support first responders.17
Legislation Enacted To Address Drinking Water Security
Since 2001, two key pieces of legislation have been enacted that address the
security of drinking water supplies and infrastructure: the Bioterrorism Act of 2002,
and the Homeland Security Act of 2002.
Bioterrorism Act of 2002. The Public Health Security and Bioterrorism
Preparedness and Response Act of 2002 (P.L. 107-188) was enacted in June 2002.
Title IV of the act (42 U.S.C. 300i) amended the Safe Drinking Water Act (SDWA)
to require community water systems serving more than 3,300 individuals to conduct
an assessment of their system’s vulnerability to terrorist attacks or other intentional
acts to disrupt the provision of a safe and reliable drinking water supply. These water
systems were required to certify that they had conducted a vulnerability assessment
and to submit a copy of the assessment to the EPA. The act also required the water
utilities to prepare or revise emergency response plans incorporating the results of the
vulnerability assessments no later than six months after completing them. (Table 1
outlines the schedule for the nearly 8,400 water systems that were required to submit
vulnerability assessments to the EPA and complete emergency response plans.) As
required, the EPA issued guidance on conducting vulnerability assessments,
16 See EPA Fact Sheet, Use of the Drinking Water State Revolving Fund (DWSRF) to
Implement Security Measures at Public Water Systems, EPA 816-F-02-040, November 2001.
Available at [http://www.epa.gov/safewater/dwsrf/security-fs.pdf].
17 For information on DHS grant programs and funding allocations, see CRS Report
RL33770, Department of Homeland Security Grants to State and Local Governments:
FY2003 to FY2006, by Steven Maguire and Shawn Reese.

---

CRS-10
preparing emergency response plans, and addressing threats to assist smaller water
systems that were not covered by the Bioterrorism Act.18
The act exempted the contents of the vulnerability assessments from disclosure
under the Freedom of Information Act (except for information contained in the
certification that identified the system and the date of the certification). As required
by the Bioterrorism Act, the EPA developed protocols to protect the vulnerability
assessments from unauthorized disclosure. The act provides for civil and criminal
penalties for inappropriate disclosure of information by government officials.


The Bioterrorism Act authorized $160 million for FY2002, and such sums as
may be necessary for FY2003-FY2005, to provide financial assistance to community
water systems to conduct vulnerability assessments, to prepare response plans, and
for expenses and contracts to address basic security enhancements and significant
threats. (Security enhancements may include purchase and installation of intruder
detection equipment and lighting, enhancing security of automated systems,
personnel training and security screening of employees or contractors, etc. Funding
may not be used for personnel costs, plant operations, monitoring or maintenance.)
Table 1. Community Water System Requirements under the
Bioterrorism Act
System size by
Date for completing
Date for completing
population served
vulnerability assessments
emergency response plans
(est. no. of systems)
100,000 or more
March 31, 2003
September 30, 2003
(425)
50,000 - 99,999
December 31, 2003
June 30, 2004
(460)
3,301 - 49,999
June 30, 2004
December 31, 2004
(7,500)
For grants to states and water systems to assist in responding to emergency
situations, the act authorized $35 million for FY2002, and such sums as may be
necessary thereafter. Finally, the act authorized $15 million for FY2002, and such
sums as may be necessary for FY2003 through FY2005, for the EPA to review
methods by which terrorists or others could disrupt the provision of safe water
supplies, and methods for preventing, detecting, and responding to such disruptions.
Homeland Security Act of 2002. The Homeland Security Act of 2002 (P.L.
107-296) combined the functions of all or parts of 22 federal agencies and
departments into a new Department of Homeland Security (DHS). The act gave key
18 EPA published Water Security Strategy for Systems Serving Populations Less than
100,000/15MGD or Less (July 2002).

---

CRS-11
responsibility for critical infrastructure protection to the DHS, but did not transfer
EPA water security functions to the new Department.
The Homeland Security Act established within the DHS a Directorate for
Information Analysis and Infrastructure Protection (IA/IP), headed by an
undersecretary. In 2005, Homeland Security Secretary Chertoff undertook a major
restructuring of the department that included reorganizing the IA/IP Directorate and
separating information analysis and infrastructure protection. The IA/IP Directorate
was renamed the Directorate of Preparedness, and the IA function was moved to a
new Office of Intelligence and Analysis.19
With the establishment of the Department of Homeland Security, which has
overall responsibility for critical infrastructure vulnerability assessment and
protection, the relative roles and responsibilities of the EPA and the DHS were not
clear. In late 2003, the White House issued Homeland Security Presidential Directive
(HSPD-7), which superseded PDD-63. This Directive established national policy and
outlined the roles and responsibilities of federal departments and agencies regarding
critical infrastructure protection. It identified the EPA as the federal agency with lead
responsibilities for ensuring the protection of the water infrastructure sector from
terrorist attacks or sabotage. Under HSPD-7, the DHS is responsible for overall
coordination and integration of national critical infrastructure protection efforts by
federal, state, and local governments and the private sector, whereas the EPA is
responsible for developing and providing water security tools and training for the
nation’s community water systems and municipal wastewater treatment facilities.
HSPD-9 provided some additional articulation of EPA’s role. This directive
instructed the EPA to develop a comprehensive surveillance and monitoring program
to provide early detection of contaminants in water systems. HSPD-9 further directed
the EPA to develop an integrated network of water quality laboratories to support the
surveillance program.
Issues for Congress
The 109th Congress considered a variety of bills regarding the security of public
water supplies, but legislation was not enacted. Some interest focused on
implementation of the drinking water security provisions of the Bioterrorism
Preparedness Act. S. 1426, for example, would have reauthorized appropriations for
SDWA section 1434 (addressing contaminant prevention, detection, and response),
and would have required the EPA to report to Congress on progress and problems
encountered in implementing these provisions.
An ongoing issue concerns the status and adequacy of public and private efforts
to improve the security of public water systems. Because of actions on the part of
drinking water utilities, the EPA, and Congress, vulnerability assessment and
planning efforts in the water sector appear to be ahead of those in certain other sectors
19 For further discussion, see CRS Report RL33369, Federal Emergency Management and
Homeland Security Organization: Historical Developments and Legislative Options, by
Henry Hogue and Keith Bea.

---

CRS-12
(such as chemical facilities); however, it is unclear how much has been done within
the sector to invest in security upgrades. Although the Bioterrorism Preparedness Act
required community water systems to conduct vulnerability assessment and prepare
emergency response plans, it did not require systems to make security upgrades to
address any identified vulnerabilities.20
Water Facility Security. The issue that received most attention in the past
Congress involved the security of chemical facilities, including certain water utilities,
that are located where a terrorist attack could cause harm to nearby populations. A
key concern is the onsite storage of hazardous, gaseous chemicals (such as chlorine)
that pose potential risks to local communities if released.

Several bills in the 109th Congress targeted such high-consequence facilities
within the water sector. S. 2855 proposed to amend SDWA to require community
water systems to replace hazardous, gaseous chemicals with inherently safer
technologies (for example, switching from the use of chlorine gas to liquid chlorine).
S. 2855 also would have required the EPA to provide grants to high-consequence
facilities for use in paying capital expenditures needed to make the transition to the
use of inherently safer technologies (IST). S. 2781 and S. 1995 proposed to amend
the Clean Water Act to address security at wastewater treatment facilities. The
Senate Committee on Environment and Public Works reported a wastewater
treatment facilities bill, S. 2781 (S.Rept. 109-345), which did not contain IST
requirements.21
Broader chemical facility security bills also were offered that had implications
for water utilities. These bills generally would have authorized the Secretary of the
Department of Homeland Security to regulate chemical facilities, including water
treatment plants, that pose certain risks. S. 2145, as reported by the Senate Homeland
Security and Governmental Affairs Committee (S.Rept. 109-332), and its companion
bill, H.R. 4999, would have directed the Secretary of DHS to issue rules designating
which chemical facilities would be subject to regulation, and establish security
performance standards such facilities. Under these bills, facilities would have been
required to submit to the DHS vulnerability assessments, security plans, and
emergency response plans for terrorist incidents. H.R. 5695 (H.Rept. 109-707)
shared several similarities with S. 2145 but would have exempted water facilities
covered by the legislation from redundant requirements (such as conducting
vulnerability assessments), unless the DHS determined that more stringent security
requirements were needed. S. 2486 proposed to cover a wider range of facilities and
20 SDWA §1433(b) states that emergency response plans “shall include, but not be limited
to, plans, procedures, and identification of equipment that can be implemented or utilized
in the event of a terrorist or other intentional attack on the public water system. The
emergency response plan shall also include actions, procedures, and identification of
equipment which can obviate or significantly lessen the impact of terrorist attacks or other
intentional actions on the public health and the safety and supply of drinking water provided
to communities and individuals.” (42 U.S.C. 300i-2)
21 For a detailed discussion of chemical facility legislation and issues, see CRS Report
RL31530, Chemical Facility Security, by Linda-Jo Schierow, and CRS Report RL33043,
Legislative Approaches to Chemical Facility Security, by Dana A. Shea.

---

CRS-13
establish a general duty to ensure that facilities would be designed, operated, and
maintained in safe manner; the bill defined this obligation to include use of inherently
safer technology to the maximum extent practicable. H.R. 1562 would have required
consultation between the DHS and the EPA, and would have imposed stronger
security and emergency planning measures, rather than requiring changes in
technology. H.R. 2237 would have expanded the EPA’s existing authority to oversee
chemical facilities but would require consultation with the DHS.
Several local government and water organizations, including the American
Water Works Association (AWWA), sought exemptions from S. 2145 and other bills
that proposed to give the DHS authority to regulate water utilities that use hazardous
chemicals (such as chlorine gas). These stakeholders argued that the EPA already has
an established water security program and has been designated the lead agency for
water infrastructure security. In general, the AWWA has opposed legislation that
would require water utilities to switch treatment processes without considering
specific utility circumstances and local water and climate characteristics. Others have
argued that mandating the adoption of safer technologies is warranted because of the
potential risk that hazardous chemicals, particularly gaseous chlorine, may pose to
communities.
The 109th Congress included a chemical facility security provision in the DHS
FY2007 appropriations bill (P.L. 109-295, H.R. 5441). The provision authorized the
department to regulate, for three years, high-risk chemical facilities, excluding
drinking water and wastewater treatment facilities and facilities in ports. The DHS
is required to establish risk-based security performance standards for designated
chemical facilities, and to require these facilities to prepare vulnerability assessments
and security plans. Because of the scope of this provision and related implementation
issues, chemical facility security remains an issue in the 110th Congress.22
Assistance for Security Measures. Also at issue is the availability of
funding for water systems to make security upgrades needed to address risks
identified in their vulnerability assessments. Based on a limited assessment, the EPA
estimated that community water systems will need more than $1 billion to make
security improvements.23 The AWWA has estimated that municipal water systems
would have to spend more than $1.6 billion just to ensure control of access to critical
water system assets.24 Congress has not provided funding specifically for this
22 See CRS Report RL33847, Chemical Facility Security: Regulation and Issues for
Congress, by Dana A. Shay and Todd B. Tatelman.
23 U.S. Environmental Protection Agency, Drinking Water Infrastructure Needs Survey and
Assessment: Third Report to Congress, June 2005. EPA 816-R-05-001. The EPA noted that
many water systems had not adequately captured security needs when this assessment was
conducted in 2003. The agency anticipates that security needs will be reported more
completely in the next assessment.
24 American Water Works Association, Protecting Our Water: Drinking Water Security in
American After 9/11,Executive summary, 2003.

---

CRS-14
purpose.25 Although community water systems potentially are eligible to receive
funding from the states through the DHS State Homeland Security Grant Program,
competition for funds is severe, and most funds have gone to meet the needs of first
responders. In an effort to address one element of this concern, the conference report
for the Department of Homeland Security Appropriations Act for FY2005 (P.L. 108-
334, H.Rept. 108-774) modified the definition of “local unit of government”
specifically to include water districts.26
The related question of how to set priorities for allocating homeland security
funding has been debated for several years. At a House Energy and Commerce
Committee hearing on bioterrorism and the security of water supplies, the
Government Accountability Office (GAO) testified that water security experts widely
agreed that decisions for allocating federal funding for water security improvements
should be based primarily on two criteria: (1) population density, and (2) information
from vulnerability assessments.27 Security experts also set funding priorities at the
utility level, and identified distribution systems as the most vulnerable component of
a water system. Other water system components identified as requiring protective
measures included utility computer systems, chemicals stored on-site, and source
water supplies.28
Research. A major concern for the water sector has been the need for more
research to develop real-time monitoring methods to detect contaminants, and
technologies to remove or inactivate them. The water industry and security experts
have identified a particular need for research to develop monitoring technologies that
can quickly detect contaminants in water that has already left a treatment plant for
distribution to consumers.
The EPA has focused homeland security research on the detection, containment,
and decontamination of chemical and biological agents that could be used in attacks
on water systems. These efforts received limited support during the 109th Congress.
For FY2006, the EPA had requested $44 million for the WaterSentinel program to
help address water utilities’ concerns regarding their ability to detect and respond to
chemical and biological contaminants.29 The agency has considered this initiative to
25 As discussed on page 8 above, some security projects are eligible for funding under the
EPA-administered drinking water SRF program.
26 P.L. 108-334 included $1.1 billion for this grant program for FY2005. For information on
DHS grant programs and allocation issues, see CRS Report RL33583, Homeland Security
Grants: Evolution of Program Guidance and Allocation Methods, by Shawn Reese.
27 U.S. Government Accountability Office, Drinking Water: Experts’ Views on How Future
Federal Funding Can Best Be Spent to Improve Security, Testimony before the
Subcommittee on Environment and Hazardous Materials, Committee on Energy and
Commerce, House of Representatives. Sept. 30, 2004. Testimony was based on report of
same title to the Committee on Environment and Public Works, U.S. Senate, Oct. 2003,
GAO-04-29.
28 Ibid. pp. 2-3.
29 U.S. Environmental Protection Agency, FY2006 Annual Performance Plan and
(continued...)

---

CRS-15
be a key element of its effort to meet its water security responsibilities under HSPD-
9. However, Congress provided just $8.1 million for the program in P.L. 109-54. In
recommending a large reduction, the House Appropriations Committee commented
that the EPA should develop clear goals for the WaterSentinel Initiative, and justify
the request more clearly in the budget request for FY2007.30
The EPA’s FY2007 request for the WaterSentinel Initiative again failed to
receive the requested support. Specifically, House appropriators recommended that
future WaterSentinel funding should be requested through the DHS and not the EPA.
While agreeing that the EPA’s expertise was important for program success and that
it had a critical role to play, the House Appropriations Committee expressed its strong
belief that future program funding must be provided through the DHS.31 Action was
not completed on the EPA funding bill, and EPA programs generally were funded at
FY2006 levels under the continuing resolution for FY2007, P.L. 110-5, H.J.Res. 20.
EPA and DHS Water Infrastructure Security Roles. Although the
Bioterrorism Act gave the EPA new authority and responsibilities to help water
utilities and states enhance the security of drinking water supplies and facilities, the
108th and 109th Congresses expressed concern that, overall, the EPA’s homeland
security responsibilities had not been well articulated. In the conference report for
the Consolidated Appropriations Act, 2005 (P.L. 108-447, H.Rept. 108- 792),
conferees directed the EPA to enter into a comprehensive memorandum of
understanding (MOU) with the DHS that defines the relationship and responsibilities
of the two entities regarding homeland security and protection. Conferees specified
that the MOU identify areas of responsibilities and the potential costs (including
which entity pays) for meeting those responsibilities.32 The EPA and the DHS have
taken steps to clarify their roles and have entered into agreements to coordinate on
specific activities, such as research. Perhaps unavoidably, some overlaps and
conflicts have arisen. The congressional debate on chemical facility security bills and
the House Appropriations Committee recommendations regarding FY2007 funding
for EPA’s water security initiative both suggest that the specific roles of these two
agencies continue to be articulated and refined, both within the Administration and
by the Congress.
29 (...continued)
Congressional Justification, Science and Technology, Homeland Security: Critical
Infrastructure Protection, p. S&T-21 - S&T-23.
30 U.S. Congress, House Committee on Appropriations, Department of the Interior,
Environment, and Related Agencies Appropriation Bill, 2006, report to accompany H.R.
2361, 109th Cong., 1st sess., H.Rept. 109-80, p. 94.
31 U.S. Congress, House Committee on Appropriations, Department of the Interior,
Environment, and Related Agencies Appropriation Bill, 2007, report to accompany H.R.
5386, 109th Cong., 2nd sess., H.Rept. 109-465, p. 100-101.
32 P.L. 108-447, Consolidated Appropriations Act, 2005, H.Rept. 108-792, conference
report to accompany H.R. 4818, November 20, 2004, p. 1563.

---