New York law accelerates deadlines for drinking water system VAs, ERPs

By Ann Murray
NETCSC Contributing Writer

Dozens of drinking water utilities across New York State took steps to secure their facilities from terrorism between November 2002 and January 1, 2003. These utilities had good reason to so do—a new state law requires it.

In August 2002, Governor George Pataki signed into law an amendment to the state’s Public Health Law requiring water facilities with gross operating revenues greater than $125,000 per year and/or serving more than 3,300 people to assess their vulnerabilities to terrorist acts, update their emergency response plans (ERPs) and submit the assessments and plans to the New York State Department of Health (NYSDOH), the state’s primacy agency, by January 1, 2003.

Although similar in intent to the federal Public Health Security and Bioterrorism Preparedness and Response Act of 2002, the U.S. Congress passed last year, the New York law accelerated the deadlines for completing security vulnerability assessments (VAs) and submitting updated emergency response plans. The Bioterrorism Act allows for sliding dates for assessment completion based on the number of people the water utility serves. Nevertheless, New York’s experience may provide lessons that help others to implement the federal act.

According to Rob Swider, P.E., senior sanitary engineer with the NYSDOH Bureau of Water Supply Protection, the accelerated schedule under New York State’s Water System Emergency Planning Program has helped the state’s drinking water utilities to get a head start on meeting the federal Bioterrorism Preparedness and Response Act requirements. "The New York emergency response program is designed to meet state and federal requirements for vulnerability assessments and emergency response plans. Unless there are changes in the federal regulations, utilities in the state program with approved vulnerability assessments and emergency response plans will meet both the New York State and federal requirements."

Although vulnerability assessments have been a required component of water supply emergency response plans in New York since 1990, these assessments did not specifically evaluate the threat of terrorism. Rather, the assessments focused on the threats posed by nature (e.g., drought, flood, and ice) and on the accidental and unintentional threats posed by human activity (e.g., equipment failure, discharges, spills, etc.)

Small systems participate

Of the approximately 370 utilities required to participate in the New York State Water System Emergency Planning Program, about 200 are small systems serving fewer than 10,000 people. These smaller utilities did not receive financial assistance to determine their security vulnerabilities or update their emergency response plans. Only the largest New York systems received monies, with the U.S. Environmental Protection Agency (EPA) awarding grants of $115,000 to 19 water systems serving more than 100,000 people.

However, the NYSDOH did provide tools and training to help smaller systems perform security vulnerability assessments and develop emergency response plans. A vulnerability assessment helps water systems to evaluate susceptibility to potential threats and identify actions that can reduce the risk of serious consequences from intentional acts, such as terrorist attacks, vandalism, or insider sabotage. An emergency response plan is a written document that spells out a water system’s plan of action for responding to potential emergencies or disasters.

Steve Winkley, a NYRWA groundwater specialist, explains how to prepare a security vulnerability assessment to a group of drinking water plant operators in Alexandria Bay, New York. Photo courtesy of Steve Winkley, NYRWA.

Although utilities were not required to use a particular vulnerability assessment tool, the state provided vulnerability assessment templates that helped systems meet security-related requirements. Working with the New York Rural Water Association (NYRWA), the NYSDOH adapted the Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems Serving Between 3,300 and 10,000, which was developed by the Association of State Drinking Water Administrators (ASDWA) and the National Rural Water Association (NRWA). The adapted guide was modified to be consistent with the New York State Sanitary Code, which addresses general provisions for public water systems. (See sidebar on this page for more information about New York's vulnerability assessment tools.)

According to Swider, the state’s smallest systems—those serving fewer than 3,300 people—were not required to participate in the program, but the NYSDOH did ask these systems to assess and address their vulnerabilities. To assist them in doing so, the NYSDOH mailed each system a copy of the ASDWA/ NRWA’s Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems Serving Under 3,300 People.

"Each very small utility received a certificate of completion with their assessments," says Swider. "Upon completion of their assessments and emergency plan updates, utilities were requested to mail these certificates to local or district health department offices."

Steve Winkley, a NYRWAgroundwater specialist, notes that because many systems had outdated emergency response plans and some of the small and very small systems did not have emergency response plans in place, NYRWA also created a template for an emergency response plan. The template allows the utility to incorporate the results of its vulnerability assessment into the emergency response plan.

Multi-agency training effort

Before the state could help smaller drinking water utilities to analyze their susceptibility to terrorist acts, the NYSDOH and NYRWA trained staff members on how to deliver the modified ASDWA/NRWAvulnerability assessment tool to utilities. Staff also received instruction in handling completed security vulnerability assessments and transporting documents from county health departments to the central DOH office.

Next, the NYSDOH, with the assistance of the NYRWAand the New York Section of the American Water Works Association (NYAWWA) took this information to the field where they held regional classroom seminars with water personnel and local municipal officials. In each session, the trainers defined state and federal vulnerability assessment requirements, described the New York State Water System Emergency Planning Program, and reviewed the vulnerability assessment and emergency response plan templates.

According to Winkley, these training seminars generated a great deal of discussion among participants. "Many operators hadn’t thought about various safety precautions. Some system operators were unaware that they should lock their wells. They didn’t know how to communicate with their customers about suspicious activities or how to deal with disgruntled employees," says Winkley. "The review of the vulnerability assessment opened their eyes to these security issues."

The sessions also generated practical solutions for utility operators to increase security measures. For example, the guide’s self-assessment questions "prompted operators to think about adding or improving fencing and providing security cards for utility employees," says Winkley.

Drinking water system operators also received one-on-one help. The NYSDOH held five workshops in local health departments and community conference centers. They provided laptop computers so that operators could review vulnerability assessment and emergency response plan templates. Several of the 36 county health departments and nine district offices set up computers to allow utility personnel to access the templates at their convenience.

Winkley estimates that 40 percent of the small utilities accessed NYRWA's Web site to obtain information about assessments and development of emergency plans.

Very few of the state's small systems requested on-site assistance, notes Winkley. "Because of the short time frame, most of the small systems performed the assessments themselves."

The NYSDOH is using the EPA-designed database—the Safe Drinking Water Information System—to record and track submittal, review, and approval of vulnerability assessments, emergency response plans, and the voluntary compliance of the smallest systems. Local and district health departments, the New York City Health Department, and the NYSDOH central office review submitted documents.

To date, most utility submissions have passed the review process, says NYSDOH’s Swider. However, a few systems continue to receive ongoing help to make additions and corrections to meet state and federal vulnerability assessment and emergency response plan requirements. The NYSDOH, NYRWA, and NYAWWA agree that New York’s smallest community water systems will require additional outreach to make sure these systems remain secure from intentional threats.

Safeguarding sensitive information

According to Swider, now that systems have completed their security vulnerability assessments and emergency response plans, the challenge facing the systems and the state is how to safeguard the sensitive information contained within these documents. Information about topics such as treatment processes, the location of stored chemicals, and the discussion of "critical assets" must be closely guarded by systems and the state. To that end, the state developed a protocol for protecting against the unauthorized disclosure of such sensitive information. The protocol is part of the amended Public Health Law that established the Water System Emergency Planning Program.

According to the New York guidance document, Drinking Water Systems Vulnerability Assessments and Emergency Response Plans Protocol for Protection from Unauthorized
Disclosure, the protocol requires that systems separately bind vulnerability assessments and emergency response plans. It also prohibits the transfer of these documents by e-mail, facsimile, or wireless transmission. Documents must be transported by registered mail. Utilities may create two versions of their emergency response plans: one that contains all emergency planning information and one for public review that does not include sensitive material. However, this sensitive information must remain available to water system staff, emergency response personnel, and health agency staff for use during emergencies. According to the guidance document, sensitive information related to security contained within vulnerability assessments and emergency response plans is not subject to the state’s Freedom of Information Act.

Advice for small systems

NYRWA’s Winkley helped to create a vulnerability assessment template for non-intentional acts as well as the template for emergency response plans. He recommends that small system operators who are making plans to assess their facilities "be honest and realistic about security vulnerabilities in their utilities. It defeats the purpose if you slant information," says Winkley.

He also advises that small utilities talk with local law enforcement officials about vulnerabilities and emergency
planning. Winkley says these kinds of steps help to keep system operators and community officials from becoming overwhelmed. "Do what you can now to implement simple, cheap measures to mitigate vulnerabilities. Then start budgeting for larger and more expensive improvements," recommends Winkley.