As the time since Sept. 11, 2001 increases, the sense of urgency for additional water security lessens. Many water utilities are now thinking about security in the long term, and raising important new questions.
How much security is enough? Should national regulations direct security measures, or should the industry regulate itself?
To address these issues, WWD recently had the opportunity to talk with Bruce Larson, security director for American Water. As a part of North America’s largest water services provider, Larson offered his perspective on the need for consistent national standards for security in the water industry.
Water security evolution
In the four-and-a-half years since 9-11, the water industry has gone through many changes. Security has always been a factor in water utility operations, but previously, the emphasis was on deterring vandalism and other criminal activity, with most security-related funds spent on cameras and fences.
“Like many industries in the U.S., immediately after 9-11, we felt a sense of urgency to become secure quickly,” Larson said. “Almost overnight, we came to the realization that there were potential attacks that terrorists could conduct on a water utility, and we needed to do something to mitigate those risks.”
This realization spurred a flurry of physical security upgrades. In 2005, the American Water Works Association estimated that U.S. water utilities had spent more than $2 billion since 9-11 to upgrade the physical security of treatment plants and infrastructure. Most of these upgrades were implemented so quickly that there was little time for discussion among utilities or long-term planning.
When these initial upgrades were completed, utilities then had time to ask the inevitable next question: What is good security?
“That’s really where we’ve been for the better part of two years now,” Larson said. “Individually at the utility level, or maybe even at the regional level, we have been determining what are just and prudent security measures to implement and then going about implementing them.”
The next step
According to Larson, what is lacking is a set of consistent national standards that establish adequate security measures. “That consistency is really important at the national level so there is not any one utility that is weaker or stronger than the other,” Larson said. “A terrorist or any adversary is completely capable of exploiting the weakest link.”
While establishing a national protocol for water security is the goal, how to achieve that goal is now the issue.
Is regulation the answer, or are industry best practices and self-assessments adequate?
“There is great apprehension as to regulating security,” Larson said. Nearly all aspects of water quality are already regulated, and the only regulation concerning water security came in 2002, when the Bioterrorism Act mandated vulnerability assessments and emergency response plans for all water systems serving more than 3,300 customers.
“I’m not certain that regulation is the path forward on this,” Larson said. “What if the threat condition changes, as we saw between Sept. 10 and 11, 2001? Overnight, our security paradigm changed. So, if that changed again, how would we allow for regulation to keep pace with that?”
Self-regulation
According to Larson, there are many benefits to the flexibility, scalability and fit-for-purpose available in self-regulating environments.
One industry that has succeeded at self-regulation is the electrical power industry. Under the North American Energy Reliability Council (NERC), electric utilities adhere to a set of best management practices that direct how they operate. As a member of NERC, utilities get better insurance rates, more favorable viewing in public utility commission hearings, and many other benefits.
While this organization may serve as a reference point for the water industry, the water and electrical industries are too different to follow the same self-regulation model. Unlike the electrical industry, with 85% of water utilities still municipally held, the water industry is not totally deregulated, according to Larson. In addition, most water utilities do not go before state-level utility commissions for rate justifications, but rather, their rates are addressed at the mayoral or gubernatorial level.
“There is a discrepancy between the ratemaking and regulatory bodies, and therein lies the issue of how to regulate it consistently if not nationally, and if nationally, how to make it appropriate to scale because not every utility is the same,” Larson said. “There are significant challenges to regulation on the scale issue. Small utilities do not have the same risks evident, nor do they have the same resources available to them as larger utilities.”
According to Larson, a not-for-profit, non-biased organization like NERC could serve as the validation body for the water industry.
“However, we really need to work out that model to appropriately and consistently address the differential in scale and type of operations across the water industry, as well as the sheer number of utilities that make up the industry,” Larson said. “Unlike the electrical industry, where you have hundreds of utilities, here we have 68,000 plus. It’s just a daunting task. We have to set some very long-term goals.”
National consistency
Despite the inherent problems associated with both regulation and industry self-regulation, a nationally consistent approach is needed. According to Larson, agencies such as the U.S. EPA, the Department of Homeland Security and the National Drinking Water Advisory Council (NDWAC) will be integral to the development of security standards.
The U.S. EPA, industry associations and the Department of Homeland Security have released countless documents and launched various programs to help educate utilities. Additionally, in 2005, NDWAC’s Water Security Working Group defined 14 features of active and effective security programs for water utilities. With the massive amount of information available, it is difficult for utilities to decide what security measures are important to their operations.
“You have one aspect, which is NDWAC making the recommendations, but then we are lacking [direction],” Larson said. “I think it’s imperative that we take a step back and look at what our first steps on this road were, and then we can lay out what the rest of our road map is going to be.”
Partnering and practicing
While national consistency is an important issue for the industry, it is a goal that requires long-term planning. In the meantime, Larson said that some consistency can be achieved through local and regional partnerships.
All water utilities in the U.S. should have adequate and effective emergency response plans, and create partnerships with other utilities and first responders who can provide assistance in emergencies.
“I think hurricanes Katrina and Rita put into sharp relief that response to large-scale disasters and catastrophes is really a team approach,” Larson said.
Practicing emergency response plans through exercises is an important part of these partnerships. “There are many national-, state- and local-level exercises, where industry professionals can engage with their peers and partners at the local first responder level and also upstream to state and federal first responders,” Larson said.
Regional consortiums
In addition to partnerships, a higher level of consistency can be achieved though regional consortiums. Some water utilities are part of the regional consortiums because of their municipality, while others are part of statewide programs.
“Illinois is a very strong example where statewide they have come to the realization that terrorism and crisis response for critical infrastructure protection is now a high priority,” Larson said. “They make a deliberate effort to reach out through all their municipalities at the state level through a gubernatorial mandate.”
New Jersey is another example of a state taking a team approach to security. While Illinois is focusing on the utility aspect, New Jersey is deliberately reaching out to private industry under the assumption that 90% of the nation’s critical infrastructure is in private hands.
“They’ve set up a task force in the state of New Jersey that works very closely with the utilities commission to set some of those goals and standards for good security in the state,” Larson said.
Consolidation
Consolidation in the industry, whether it is into regional response organizations or into a privatized model, certainly can bring consistency as well as security benefits. For American Water, consolidation allows the company to provide adequate security measures for all types of systems, from very large municipal systems to very small systems that serve less than 3,300 people.
“Within our corporate footprint, we probably have one or more of every challenge you can imagine,” Larson said. “Therefore, because of our diversity, we’ve been able to converge on what are statements of good and consistent security for our company. From a security and crisis management perspective, we hope that there is great benefit to all of our subsidiary utilities.”
Last words
Regardless of how they are created, national best practices would benefit the water industry.
According to Larson, they would allow small utilities or utilities that don’t have many resources to be consistent not only in their assessment, but in their implementation of security measures.
“This need for consistency is the current debate, and it is what needs to be discussed,” Larson said. “We need to work together to find a solution that is consistent in the end. That is the goal; it is not to regulate or not regulate, or cost recovery. The goal is consistency.”
RSS: Roads & Bridges Articles
