rss

WaterOperator.org Blog

Preventing & Responding to Security Threats

Facility and infrastructural security are an important component of any emergency response plan. Whether the outcome can result in vandalism, theft, terrorism, or a threat to staff or community safety, suspicious activity should always be taken seriously. When the city of Woodland Hills was alerted of trespassing at their water storage tank, the utility promptly issued a boil order until they could confirm that their water was safe to drink. These actions prevented any potential harm due to contamination leaving community members safe and reassured that their utility was taking an active role in water security. Evaluating risk to malevolent acts will allow your system to initiate or upgrade preventive measures and develop an appropriate response plan to protect staff and the community.

To prevent malevolent acts, start by taking an assessment of your facility’s vulnerabilities. Consider entry points, security code accessibility, chemical tanks, storage tanks, vehicles, utility equipment, hazardous chemicals, and infrastructure within the distribution or collection system. Infrastructure essential to operations and limited in redundancy or identified to be at greater risk to malevolent acts may require more meticulous security measures. To assess physical security threats, check out the Security Vulnerability Self-Assessment Guide for Small Drinking water Systems.

The goal in a vulnerability assessment is to determine where prevention measures can be implemented and develop a response plan to suspicious activity.  According to the Minnesota Department of Health, many facilities increase security by locking entry points, using external lighting, posting warning signs, requesting law enforcement patrol, fencing in critical infrastructure, or installing motion sensors, alarm systems, and video cameras. Once all preventive measures have been taken, develop a response protocol for each potential threat. The Association of State Drinking Water Administrators has developed response guidelines for security violations. In each response scenario, utilities should plan for how they can maintain internal, interagency, and external communication.

Utilities should practice emergency response exercises regularly and keep track of necessary changes to response protocols. During these exercises reserve time to monitor which staff have access to key entry points at the utility. Successful security programs will also build and maintain a close relationship with local law enforcement. This relationship will allow utilities to respond swiftly and efficiently in coordination with law enforcement when suspicious activity does occur.

Remember that final goal of these measures is to prevent any interruption in services, damage to infrastructure, and safety threats to staff and the community. For more information on Malevolent Acts check out the EPA’s Baseline Information on Malevolent Acts for Community Water Systems.

Data Protection and Cybersecurity for Small and Medium Systems

Specify Alternate Text

Many water utilities rely on online technology and computer systems to increase their working efficiency. In the office space, data management software, pay roll systems, customer billing programs, utility websites, and social media improve customer services and provide an organized method to retain and access utility information. On the operational side, employees may rely on remote access control systems such as SCADA or smart metering to monitor or control systems while performing maintenance in the field. These control systems allow for improved response times and monitoring.

Yet as we all learned from Spiderman, with great power comes great responsibility. Without sufficient cybersecurity measures, systems risk the health and security of their customers. Successful attackers can steal customer personal data such as credit cards, social security numbers, and contact information. They may attempt to deface utility websites compromising customer confidence. If your system uses online process control systems, hackers could lock out utility access, alter treatment processes, damage equipment, and override alarms. The American Water Works Association (AWWA) has listed a variety of cyberattacks and their consequences in its 2018 Cybersecurity Risk & Responsibility in the Water Sector Report. These attacks resulted in leaked customer information, considerable financial losses, altered chemical dosing, and even source water contamination. Just recently staring in May of 2019 the City of Baltimore has been held hostage by an ongoing three week cyberattack that demands $100,000 in Bitcoin to free city files and water billing data.

There are many types of cyberattacks including password hacking, the exploitation of software vulnerabilities, denial of service, and malware. Common malware includes ransomware, spyware, trojan horse, viruses, and key loggers. Attacks can even happen through opportunity theft, improper disposal of computer equipment, or phishing attempts where thieves pose as legitimate organizations requesting confidential information.

To prevent cyberattacks, start by identifying vulnerabilities, developing a multi-tier security plan, and actively enforcing that plan. The EPA has developed a guide explaining 10 key components for a cybersecurity plan that includes planning worksheets and information on how to respond in the event of an attack. Systems should plan to update software regularly and require strong passwords that are different for each account. Installing anti-virus software and firewalls is also effective. A security plan should include measures to educate employees on cybersecurity awareness and limit access to security information based on job function.

For an in-depth list of security practices, read through WaterISAC’s 2019 guide to reduce exploitable weaknesses or the EPA’s Incident Action Checklist. The AWWA’s guide on Process Control System Security Guidance for the Water Sector can aid systems using smart technology. To improve social media and website security, start with Hootsuite’s social media security tips and Sucuri’s website security tips.

If a data breech does occur, utilities will want to have and established protocol to resolve and mitigate potential damage. The Cyber Security Adviser Program with the Department of Homeland Security (DHS) offers regional affiliates that will assist systems in vulnerability assessments, plan development, and informational support. While the costs associated with response, forensics, and legal fees can be expensive, waiting to take action can incur an even greater cost. Remember to keep an active cybersecurity plan and, if incidents should occur, report them to local law enforcement, the DHS, and WaterISAC.

Featured Video: Drought Response and Recovery in the Town of Castine, ME

Specify Alternate Text

This week's featured video tells the story of how  the small town of Castine, ME headed off recent drought and infrastructure challenges - a story that may be adaptable to other small systems nationwide. This video is featured on the USEPA's Drought Response and Recovery StoryMap Project for Water Utilities (ArcGIS) and is included as a case study resource in their recently updated Drought Response and Recovery Guide for Water Utilities guide. 

Revisiting History: How One Firefighter Protected a Town's Water Supply

Specify Alternate Text

Our featured video this week tells the story of how, 31 years ago, Dayton, OH's Fire Chief Glenn Alexander collaborated with the city's water and environment departments to make a difficult, but very crucial decision to stand aside and allow a Sherwin Williams paint factory to burn down. By doing so, he saved the city's water supply for generations to come. 

This story highlights the importance of collaborating with affected parties in order to make smart decisions during emergencies - certainly a lesson that never grows old. And among the many additional lessons gleaned from the incident: the importance of involving emergency responders in wet-field protection task forces or similar partnerships.  

Featured Video: Surviving the Quake

Specify Alternate Text

Did you know that almost half of all Americans live in areas prone to earthquakes? Water and wastewater utilities serving this population are extremely vulnerable to damage because of their vast network of underground pipes as well as their pumps, tanks, reservoirs and treatment facilities (not to mention their dependency on electricity!). This week's featured video introduces small and medium-sized water and wastewater utilities to earthquake resilience and introduces EPA tools including the Earthquake Resilience Guide and Earthquake Interactive Maps.  


After watching this video, read about the experiences of actual water utilities that have successfully implemented mitigation measures to address this threat in the EPA's new Earthquake Resilience Guide. And if you wondering if your utility is in an earthquake hazard area, you will soon be able to use a map such as this one from the California Geological Survey to find out.  

When an earthquake strikes, it can cause breaks in pipelines, cracks in storage and process tanks and even the collapse of an entire plant. When this happens, a community can experience loss of pressure, contamination and drinking water service disruption. The first step in protecting your community is to be prepared because the faster a water or wastewater utility recovers from an earthquake, the faster the community it serves can recover. 

Featured Video: The Science Behind Exploding Manhole Covers

Specify Alternate Text

Every season has its challenges for public works departments, and now that spring is just around the corner, it is pretty obvious that this past winter came with more than its fair share. Yet we are not in the clear quite yet, as this news story about two manhole explosions just a few weeks ago demonstrates. In fact, as winter winds down, accumulated road salt compounds corrode through underground electrical cables, causing sparks to ignite gases that can build up in confined spaces. With over 2,000 annual incidents in New York City alone, exploding manholes are not a joke: they can be dangerous, destructive and downright difficult to predict.

And while large cities like New York City are especially prone to these incidents due to aging infrastructure and the sheer amount of underground electrical cables present, small towns are definitely not immune. For example, in 2014 the tiny town of Sauget, Illinois (pop. 150) experienced an explosion so powerful manhold covers damaged overhead power lines.  

 Find out more about how road salt compounds contribute to this problem in this week's featured video.  

While explosions are the most dramatic hazard associated with manholes, research suggests that manholes are in general one of the most dangerous work locations for water system staff. In fact, according to AFSCME, fully one-third of all injuries/deaths of workers occur in or around manholes. Check out this safety presentation hosted by Michigan WEA for more information on the types of hazards presented by manholes and how to protect yourself from them. 

And if you have any lingering doubts about the force, and destructive power, of an expoding manhole, take a look at this video

Responding to Cold Weather Main Breaks

Recent extreme cold weather has affected a large numbers of private and public water lines across the country, resulting in low pressure, main breaks and water service disruptions, including this one at New York's JFK airport.  During the cold snap over the 2018 New Year's holiday, the St. Louis region alone had to deal with 60 breaks per day, with more than 40 crews out at a time. 

Responding to these events, both the dramatic and the more "invisible" ones, can be particularly challenging and can put utility staff at risk. Here are some resources that can help when frigid weather causes trouble: 

  • USEPA's Extreme Cold and Winter Storms Incident Action Checklist
  • Alaska Department of Environmental Conservation's Intro to Small System Systems chapter five section on methods for thawing out frozen water lines (p. 181).
  • Of course, prevention is the best cure, so here is Indiana AWWA's updated winterizing checklist for ideas on how to prepare for freezing temperatures, snow, ice and sleet at your utility and around town the next time around. For even more readiness tips, take a look at this article on how to make water infrastructure winter-ready. 

Need a good public education tool to explain the water main break repair process to the general public? Check out this video from the city of Midland, Michigan showing how water distribution crews handle main breaks during the cold winter months. And here is another example from the city of Arlington, VA.

Featured Video: TXWARN Tabletop Exercise

Specify Alternate Text

Most areas of the country will have to deal with a large-scale disaster at some point. Whether it's an earthquake, blizzard, hurricane, tornado outbreak, flooding, or large-scale drought, most regions are great places to live until they're really, really not. Water utilities play a vital role in disaster scenarios, whether they're ensuring the delivery of clean, safe drinking water or safely removing and treating wastewater. Unfortunately, just because these services are vital doesn't mean they'll remain unaffected in a disaster scenario. In 2005, the experiences of New Orleans during Hurricane Katrina drove home just how vital utilities are to the disaster response process. However, many utilities are not used to their role as emergency responders, and may not have a plan in place if their services were needed in the event of a disaster.

One way to plan for a disaster before you're in the midst of it is to participate in a tabletop exercise. In a tabletop exercise, the major players in a disaster event---police, fire, utilities, mayor, emergency response coordinator---all sit down together and consider step-by-step how they'd respond to a specific disaster if it hit their hometown. It helps to be specific: What if the tornado hit the water tower on the way into town? What if the main road through town was blocked with debris? What if there was a power outage? Specific questions like these can help you think about your resources and emergency planning in more detail.

One very detailed introduction to disaster response tabletop exercises begins with today's video. In 2011, the state-level disaster response agencies for the state of Texas met with TXWARN and tried to plan a response to a fake hurricane, as described to them by facilitators from the consulting group Horsley Witten. The exercise begins with the "hurricane" still out at sea while the agencies at the table think through how they would need to plan depending on where the hurricane makes landfull. It progresses through landfall and widespread rain and storms, and concludes with the participants talking about the exercise and identifying things they could change or improve to plan for a real emergency. This first video is an hour and a half long, and the entire run of the exercise comes to a little over 6 hours of video. But even watching selections from the videos will give you an idea of what kinds of problems and solutions might be worth considering for your own utility's disaster planning.

Watch the PT 1 TXWARN TABLE TOP video from Texas AWWA with this link.

You can also find the remaining exercises here:

Tabletop Exercise Part 2

Tabletop Exercise Part 3

Tabletop Exercise Part 4

If you'd like to perform your own tabletop exercise, the USEPA has tools and resources available here.

Featured Videos: Preparing Your System for Disasters & Emergencies

Specify Alternate Text
Boo! Halloween may be the season for spooky ghosts and spine-tingling stories, but water utility professionals have their own scary stories. A lot of them involve being knee-deep in mud at 2 AM, and most of them end (or begin) with boil orders. This week's video discusses various emergency and water security challenges that could face a utility, and offers practical suggestions to prevent or mitigate them. Your next B-movie night might not feature burst methane or chlorine tanks or vandalism by local teenagers---but maybe it could! This video is one step toward making sure your story has a happy ending. (Though the video is aimed at wastewater utilities, much of it will be relevant to drinking water utilities as well.)

Preparing Your Wastewater System for Disasters and Emergencies from RCAP on Vimeo.

For more information on water security specifically, see the USEPA's Water Security Handbook.

Hurricanes, Flooding and Wastewater Plants: What Have We Learned?

Specify Alternate Text

In recent months, there have been dozens of reports of wastewater treatment plants that have flooded due to heavy hurricane rains and storm surges in Florida, Texas, Puerto Rico and beyond. Both the sheer number of plants affected, and the extent and duration of the flooding have posed significant public health and technical challenges, often stretching communities to their limits

To add to these problems, many rural utilities were already struggling to keep their systems operating before the storms struck, so costly, complicated repairs or replacements of damaged infrastructure is simply not an option. For example, Patton Village, Texas had just completed a new wastewater plant  the first of its kind in their community — before Hurricane Harvey struck. Now they can only hope that USDA/FEMA emergency funding will be available to help repair the damage. And even once the systems are up and running again, it is not a given that water systems can count on water rate income to help with their O&M bills - many residents have fled their flood-damaged homes for good.  

The sad truth is that lately, floods have been affecting wastewater plants with unfortunate regularity, and not just in hurricane-prone areas. For example, in Central Illinois, the small town of Hutsonville's wastewater treatment plant has flooded 3 times in the last 2 years, up from once every 5 years, according to its contract operator Shannon Woodward of Connor & Connor, Inc.

Woodward's first piece of advice is not to build on a floodplain, but he also acknowledges that many communities do not have the capital funds for effective protective measures or relocation, and so operators must deal with the hand they are given. His second piece of advice: "Make sure all electrical controls, switch gears and transformers are above the flood stage. That way, when the flood waters subside, you don't have equipment loss and can get back into operation — even if it takes 3 to 6 weeks for the waters to recede." 

Mason City, another small town in Illinois, was able to fund improvements after a flood in 2008 cut off the town’s water supply and nearly overflowed the capacity of its wastewater system. The following year, the city built a stone wall around the water plant, installed flood sensors on the local river, and built effluent pumping stations for the wastewater plant. 

And this article tells the damage and recovery stories of two flooded wastewater plants in Rhode Island. According to the operators of these plants, it is essential to have a flood plan, even if you think your facility is protected. In addition, they maintain it is important to involve wastewater treatment personnel in emergency response exercises or in the incident command structure. On a practical level, the operators encourage SCADA systems to be elevated on the second floor in the operations building if possible. And lastly, they recommend you back up your files and documents electronically. Papers get wet, they say: move them to a dry storage facility. 

Finally, while every community has different characteristics and needs, there are some universal preparedness strategies for wastewater plants. The US EPA recommends practicing mitigation options as the best way to prevent floodwater from invasively appearing. Some of these options include crafting barriers around key assets, having an emergency back-up generator, and keeping key electrical equipment elevated. You can learn more about these options here, or you can watch this helpful video. In addition, many states have their own guidances, such as this one from Minnesota’s Pollution Control Agency.