Map helps small Montana utility develop vulnerability assessment, emergency response plan

By Ann Murray, NETCSC Contributing Writer

Editor's Note: The “Public Health Security and Bioterrorism Preparedness and Response Act of 2002” passed by Congress last year requires all community water systems serving more than 3,300 people to conduct an assessment of the system’s vulnerability to a terrorist or other intentional act, submit a copy of the assessment to the U.S. Environmental Protection Agency (EPA), and prepare or revise an emergency response plan that incorporates results of the vulnerability assessment. Under this new law, communities with fewer than 3,300 people are not required to perform vulnerability assessments or create emergency response plans, but EPA encourages them to
do so and is providing guidance to help smaller
communities undertake these challenging tasks. This article details how a small drinking water utility in Montana performed a vulnerability assessment and created an emergency response plan with the help of an assistance agency.

A Security camera enables the system operator to monitor activity at the plant. Photo by Sandra Fallon.

Security important for small systems
Although a thorough and effective security effort is critical in this post-September 11 era, the Montana community that Torok worked with—like many other small communities—was not thinking only about terrorist attacks when town council members contacted MAP for help.

“Small systems do not define security as the ability to prevent acts of terrorism, but rather the ability to prevent vandalism and loss of service to customers,” says Torok. He also points out that there are broader implications to man-made or natural disasters than just physical damage to facilities and service interruption. The health of system employees, the public, and the environment are potentially at stake during and after emergencies, he notes.

Small communities, says Torok, must also consider the effects of nature on their systems. Fire, floods, high winds, and extreme temperatures can wreak havoc on new and aging components. Therefore, a system’s ability to respond to many kinds of unforeseen events is critical.

But even with such high stakes in the offing, small communities often do not have the staff, the time, or the experience to route through governmental requirements, conduct evaluations, and prepare emergency response plans. Torok recommends that small utilities with limited resources follow the example of the Montana community and get help from an experienced third party. Assistance organizations, such as MAP, can help small communities with their security issues often at no charge.

The first step: assess vulnerabilities
To help the Montana community, Torok began the process by assessing what was needed to secure the water system from vandalism, natural disasters, and terrorism. The evaluation started with a walking tour of system components. Torok and the system operator looked at storage, conveyance, treatment, and operations facilities.

Torok asked very specific questions while examining the water utility.

“The idea was to ask questions that would provide answers to things that are often overlooked,” says Torok. “‘Is the wellhead locked?’ ‘If not, how do we lock it with an inexpensive device?’ ‘Are the pumps and motor controls secure?’ ‘Are controls equipped with a password?’”

Following the walking tour, Torok and community members took questions and observations back to the town hall where they met for in-depth discussions. These discussions provided what Torok calls “basic background information”—details about inventory of equipment, staff, and mutual aid agreements with adjacent communities.

According to Torok, participants understood the importance of keeping this type of information inside the meeting. “Everyone involved was very willing to share and discuss any of the issues in the assessment,” he says. “However, it was made clear—and all persons involved agreed prior to meeting—that any matters that were discussed were considered confidential and would not be discussed in any way with persons outside of the group.”

Background information and the initial tour of the facility led to a discussion of which vulnerability assessment method the community would use.

Under Torok’s guidance, the community chose to use the Security Vulnerability Self-Assessment Guide for Small Drinking Water Systems developed by the National Rural Water Association (NRWA) and the Association of State Drinking Water Administrators (ASDWA). (The self-assessment guide is available through ASDWA’s Web site at www.asdwa.org.)

The NRWA/ASDWA vulnerability self-assessment is designed to address likely threats to small systems. The guide poses a series of questions that look at the condition, operation, and maintenance of pipes and conveyances; physical barriers such as fences; water collection, pretreatment, treatment, storage, and distribution systems; electronic, computer or other automated systems; and the use, storage, or handling of various chemicals. Answers to the assessment are indicated as “Yes” or “No” and space is available to identify actions needed to improve security.

Torok also emphasizes that anyone doing an assessment needs to take the time to do the actual walk-through of the facilities. “The point is that you can’t do the security analysis using the instrument while sitting in the office,” he says. “You have to get out and actually check to see what’s in place and what’s not.”

Torok offers fencing as a good example. He says it is easy to answer the question “Are facilities fenced?” with a “Yes,” but an onsite inspection might find any number of problems with the fence or its location. For example, the ground level might drop below the fence level, there might be trees or buildings near the fence that someone could climb to get over the fence, or the fence itself could be damaged.

Clearly this type of detailed site evaluation takes time, says Torok. But deficiencies in security are often brought to light and low-cost alternatives can be implemented and incorporated into the ERP. In this case, Torok offered simple suggestions to the Montana utility about protecting its wellhead without fencing it and securing windows with available materials.

External buildings, such as this outbuilding that houses an air compressor, should be locked and secured to prevent access. Photo by Sandra Fallon.

Putting the ERP together
Torok considers the vulnerability assessment to be just part of the prep work in putting together an effective emergency response plan. He says it was important for the Montana community to get the local department of emergency services, the police department, and the fire department to the table when the utility’s plan was created.

These local officials, along with representatives of other facilities subject to emergency planning requirements, community groups, and the media, are part of a Local Emergency Planning Committee (LEPC), one of about 3,500 such committees in the country. LEPCs are designated by State Emergency Response Commissions (SERCs) to prepare for and respond to emergencies involving hazardous materials. Because water and wastewater systems use, store, or handle hazardous materials such as chlorine, these utilities fall under the comprehensive emergency response plan of LEPCs. SERCs and LEPCs are mandated under the federal “Emergency Planning and Com-munity Right-to-Know Act.” (Systems may be able to find their local LEPC by accessing EPA’s Emergency Planning Committee Database on the Web at www.epa.gov/ceppo/lepclist.htm.)

Unsecured chlorine tanks can pose a major security risk. Photo by Sandra Fallon.

Not only are systems required to coordinate their emergency response plans with LEPCs, they depend upon them during and after an emergency. Torok says it is imperative that all entities know that the safety of the utility is a collaborative effort. The Montana utility’s
completed ERP will fold into an existing county-wide disaster mitigation plan. To that end, Torok emphasized the need for good communication between the water utility and the community.

"Create a team to work on the project and stay in touch," says Torok. "The team should include every entity that can play a role in emergency response, including the schools, civic groups, police and fire departments, the media, and other water systems."

After Torok and community members sat down with local first-responders, government contacts, and other local representatives, the utility’s ERP began to take shape. The ERP was tailored to address specific types of emergencies common to the utility’s geographic location, the resulting problems, and the parts of the system that would be affected. Infor-mation obtained through the vulnerability assessment proved to be useful in developing the ERP. According to Torok, the final ERP addressed the security weaknesses that became apparent during the vulnerability assessment.

Torok and the community expect the town council to officially adopt the ERP in March or April. After that, the utility will test and evaluate its new plan to make sure it works. The best way to do that, says Torok, will be through practice drills and evaluation. This way system personnel and the community will be aware of the plan’s strengths and weaknesses and will be able to make adjustments
to the ERP.