Water and Wastewater Sector Perspectives

The Cybersecurity & Infrastructure Security Agency (CISA) defines the Water and Wastewater Systems Sector as one of “16 critical infrastructure sectors.” Due to the essential nature of water in so many aspects of society, this sector faces numerous challenges in maintaining the high level of service necessary to the communities they serve.

WHAT MAKES THIS SECTOR CRITICAL TO THE NATION, AND WHAT POSSIBLE EFFECTS DOES IT HAVE ON STATES AND LOCAL COMMUNITIES?

Water plays an integral role in daily life. Without a safe and sufficient supply of drinking water or proper disposal and treatment of wastewater, the daily lives of most Americans would be significantly impacted. Without access to clean water for drinking, food preparation, and bathing, individuals are more susceptible to disease from exposure to contaminants. Absent proper collection, treatment, and disposal of wastewater effluent, individuals and the nation’s water bodies could be exposed to biological and chemical contaminants. Industrial processes essential for manufacturing and other utility services, such as electricity generation, are impacted by water and wastewater service disruptions.

On August 1, 2023, the Federal Emergency Management Agency (FEMA) announced they were implementing the new “Water Systems’ Community Lifeline” construct according to the Environmental Protection Agency (EPA) Water Resilience website. FEMA explains that the implementation of this construct will help the agency “increase effectiveness in disaster operations and better position the agency to respond to catastrophic incidents.” This announcement further emphasizes the importance of the Water sector in the security of the nation’s communities.

On August 30, 2023, Florida was dealing with the landfall of Hurricane Idalia, which by that time had already caused close to 300,000 power outages. The impacts of Hurricane Idalia came less than a year after Hurricane Ian made landfall in Florida, resulting in more than 2.5 million customers in the state without power. The loss of power contributes to the loss of drinking water and wastewater services due to the need for electricity to power some treatment units.

The Texas Comptroller of Public Accounts assessed the impacts of Winter Storm Uri on the Texas Economy in a 2021 Fiscal Note to the 87^th Legislature. In the Fiscal Note, the University of Houston Hobby School of Public Affairs conducted a survey and found that almost half (49%) of Texans had a water service disruption. The disruptions were caused by the extreme cold temperatures freezing water distribution lines, customer service lines, interior commercial and residential plumbing, valves, and other equipment used in the water distribution process. Additional disruptions occurred as the frigid temperatures resulted in the loss of electrical power for several facilities. The Comptroller’s Fiscal note also indicates the impacts of Uri resulted in economic losses between $80 billion and $130 billion and claimed at least 210 lives. The disruption of water service highlighted how integral the Water and Wastewater Systems Sector is to society’s normal functions. Some of the common health impacts of water service interruptions include diarrhea and other gastrointestinal diseases. An example of an industry impacted by the disruption of water service is restaurants:

The interruption of electrical service is an imminent health hazard in any food service establishment, particularly because it can hamper a facility’s ability to refrigerate and cook foods, as well as sanitize properly. (Power Outage Preparation & Recovery, Steritech)

WHAT ARE THIS SECTOR’S KEY ASSETS AND INTERCONNECTED/INTERDEPENDENT SYSTEMS (PHYSICAL OR CYBER)?

For water supply facilities or public water systems, the key asset is the source of water that is being captured and conveyed for treatment. For example, larger cities such as Houston, Texas, obtain the majority of their water to treat and provide to their customers from a combination of lakes and rivers. Smaller communities such as Brookings, South Dakota, primarily obtain their water from wells that pump water from underground aquifers. Once treated, the sourced water is distributed to customers for one or more potable water uses. Wastewater is captured from commercial facilities and residences and then conveyed to a wastewater treatment plant to receive additional treatment prior to disposal into a waterbody or onto land through irrigation.

The collection, conveyance, distribution, and treatment systems for water and wastewater comprise various equipment and facilities such as pumps, piping systems, and treatment units. These treatment facilities transfer water through a series of units to remove contaminants through processes that include adding chemicals for enhanced solids separation, filtration, and additional chemical application of disinfectants. The treated water is then distributed to customers through a combination of storage facilities, pumps, and a network of underground pipes, commonly called the distribution system. Drinking water systems are required to treat water by using the facilities listed above to reduce or remove a standard set of contaminants called the National Primary Drinking Water Standards from water prior to serving it to customers.

In the same way, wastewater is collected from commercial facilities and residences through a separate network of underground pipes and pumped to wastewater treatment plants for treatment before discharge into a lake, river, stream, or soil through irrigation systems. Wastewater treatment plants are typically issued site-specific permits that list contaminants and the levels they must be reduced to in the wastewater before the wastewater can be discharged into a body of water or used for irrigation.

Both drinking water and wastewater treatment units are typically made up of basins to apply chemicals to water and provide detention time to allow biological and chemical reactions to remove contaminants from water. In addition, these facilities are increasingly being monitored and operated remotely using an information system known as industrial control systems (ICS) or supervisory control and data acquisition (SCADA) systems. The National Institute of Standards and Technology defines ICS as “an information system used to control industrial processes such as manufacturing, product handling, production, and distribution.” More integration of the ICS and SCADA systems into the Water and Wastewater Systems Sector has provided a point of access for cyber criminals to access and attempt to compromise the operations of the water and wastewater treatment facilities. These systems comprise the sector’s key assets and are necessary for the continued provision of safe drinking water and properly treated wastewater.

An example of how vital the ICS and SCADA systems are to water systems is the remote intrusion into the SCADA system of the City of Oldsmar’s water treatment plant in 2021. The online intruder was able to manipulate the ICS controls for the chemical dosing system. Fortunately, a water system operator noticed the changes and was able to deter the intruder. Listen to what investigators said about the Florida City water treatment system “intruder” hack.

WHAT ARE THIS SECTOR’S DEPENDENCIES (PHYSICAL, CYBER, GEOGRAPHIC, AND LOGICAL) AND INTERDEPENDENCIES WITH OTHER CRITICAL INFRASTRUCTURES?

The collection, conveyance, distribution, disposal, and treatment processes for water and wastewater depend on the Chemical, Energy, Critical Manufacturing, and Transportation Systems sectors. The treatment processes rely heavily on chemicals, electricity, equipment, and supplies to properly remove or treat contaminants. Additionally, the equipment and tools used to repair and maintain this equipment are impacted by disruptions in these sectors. Impacts on the Transportation Sector increase the time to obtain essential chemicals and parts necessary for treatment. The trend of more automation coming into the Water and Wastewater sector has significantly increased the dependency on both the Energy and Critical Manufacturing sectors. More automation has resulted in the need for different types of high-tech equipment like Smart Water meters that rely on parts that have to be manufactured and shipped to the water and wastewater systems.

Electricity is essential for producing drinking water and the treatment of wastewater. The pumps used to move water and wastewater through treatment units as well as drinking water distribution systems and wastewater collection systems, require electricity to operate. Some examples of treatment units are pumps used in a number of municipal water and wastewater treatment applications including sedimentation basins to facilitate solids separation, chemical application, and ultraviolet light for disinfection. Public health and the environment can be adversely impacted without the timely distribution of drinking water to customers or the collection of wastewater for transport to treatment plants. According to the EPA’s Power Resilience Guide, “Inoperable pumps at a drinking water utility can … make firefighting difficult, and cause local health care facilities and restaurants to close.” The guide also states, “For wastewater utilities, pump failure may lead to direct discharge of untreated sewage to rivers and streams or sewage backup into homes and businesses.”

Water systems heavily depend on the Chemical, Critical Manufacturing, and Transportation Systems sectors because of the need for chemical compounds for the treatment processes of both drinking water and wastewater. The chemical manufacturers produce the chemicals essential to the treatment processes required to treat drinking water to safe quality levels. Chemicals are also used in the processes to treat wastewater to appropriate levels for disposal. These chemicals need to be transported to drinking water and wastewater treatment facilities all over the country. Interruptions to normal transportation routes from human-caused or natural incidents can cause supply chain shortages that can impact the amount of chemicals and other equipment and supplies available for use by water and wastewater utilities.

An example of the effects of supply chain interruptions is in the EPA case study on the Des Moines Water Works (DMWW) water utility and the COVID-19 impact on Carbon Dioxide production. Carbon Dioxide is necessary for some of the treatment processes at the DMWW and is defined as a “byproduct of other processes, including the manufacture of ethanol, oil and natural gas refining, and ammonia and hydrogen production.” The case study stated that the “Lack of drivers on the road and the lowered demand for ethanol led many ethanol manufacturers to reduce their production levels or, in some cases, shut their plants. When this happened, CO₂ shortages quickly followed.”

The role of the Critical Manufacturing Sector and the impacts on that sector from the COVID-19 pandemic were also researched by the EPA, which published, “Understanding Water Treatment Chemical Supply Chains and the Risk of Disruptions, December 2022.” The report evaluated the supply chain risks of 46 chemicals used as either raw materials or direct additives in water treatment. A number of factors were evaluated including the chemicals, “Applications in Water Treatment, Manufacturing Process, Domestic Production, Trade and Tariffs and History of Shortages” (see the EPA’s Understanding Water Treatment Chemical Supply Chains and the Risk of Disruptions).

WHAT ARE THIS SECTOR’S CURRENT AND EMERGING VULNERABILITIES, HAZARDS, RISKS, AND THREATS?

The Water and Wastewater Systems Sector faces increasing threats to the mission of providing safe drinking water and adequately treated wastewater to its customers. The sector faces vulnerabilities, hazards, risks, and threats associated with aging infrastructure and the increase in extreme weather events. The impact of extreme weather events, like Hurricanes Harvey and Katrina, are familiar and costly threats to water utilities in the coastal areas of the United States. These types of events have caused significant structural damage from flooding, high winds, and power outages. The National Oceanic and Atmospheric Administration (NOAA) reports that these two events are the costliest weather events ever to impact U.S. coastal areas. NOAA’s Office for Coastal Management says, “Hurricane Harvey alone had total costs of $125 billion – second only to Hurricane Katrina in the period of record, which had an approximate cost of $161 billion.”

The August 2023 water main break in Times Square, New York, is an example of the consequence of not adequately addressing aging infrastructure. Based on a report from CBS News New York, “The pipe that broke in Midtown on Tuesday was more than 120 years old. The water main break is putting a spotlight on a major issue across the country: aging infrastructure.”

The threat caused by aging infrastructure is significant in the Water and Wastewater Systems Sector. The financial impacts can be substantial due to the rising materials and transportation costs. It has been well-documented that the cost to improve the infrastructure that makes up drinking water and wastewater treatment facilities and their distribution and collection systems is substantial. To adequately address the nation’s water infrastructure deficiencies, the EPA estimates that “the country will need to spend more than $744 billion over the next decade on water infrastructure, including pipes, treatment plants, and wastewater management facilities.”

Aging infrastructure, particularly the deterioration of drinking water distribution lines and wastewater collection lines, can threaten public health and the environment. Leaking distribution lines can provide a pathway for microbial and chemical contamination of treated water distributed to customers. Deterioration of wastewater collection lines can result in untreated sewage spilling on the ground or into creeks, lakes, rivers, and streams.

The major emerging threat for the Water and Wastewater Systems Sector is cyberattacks. Cyberattacks have occurred at all types of water and wastewater utilities. According to the HackerNoon website:

[I]n 2021, twin cyberattacks hit water sector facilities in San Francisco, California, and Oldsmar, Florida. Both attacks involved the use of a remote access program called TeamViewer. This app is commonly used in the utility industry for tasks like remotely monitoring water treatment and supply data. However, hackers abuse it to manipulate water sector companies’ systems illegally. Luckily, both attacks were stopped before they caused any harm.

The constant threat of cyberattacks has become a reality for all critical infrastructure sectors. The American Water Works Association (AWWA) Report on Cybersecurity Risk and Responsibility in the Water Sector states:

Cyber risk is the top threat facing business and critical infrastructure in the United States. Government intelligence confirms the Water and Wastewater Sector is under a direct threat as part of a foreign government’s multi-stage intrusion campaign.

The AWWA report also describes the impacts of a cyberattack on water utilities and how devasting those impacts can be for a community:

Attacks causing contamination, operational malfunction, and service outages could result in illness and casualties, compromise emergency response by firefighters and healthcare workers, and negatively impact transportation systems and food supply.

The impacts described illustrate how disruptive a cyberattack can be to a water utility and the critical role the Water and Wastewater Systems Sector plays in maintaining public health and safety. Cyberattacks on the industrial control systems can have a significant impact on the operations of a water utility. Equally as damaging are ransomware attacks on water utility billing systems. The well-publicized ransomware attack on the City of Atlanta demonstrates how a cyberattack can severely impact a utility:

For roughly a week, employees with the Atlanta Department of Watershed Management were unable to turn on their work computers or gain wireless internet access, and two weeks after the attack, Atlanta completely took down its water department website “for server maintenance and updates until further notice.”

The importance of addressing cybersecurity issues is highlighted by the recently released U.S. Environmental Protection Agency memorandum, “Addressing PWS [Public Water Systems] Cybersecurity in Sanitary Surveys or an Alternate Process” (Radhika Fox, Assistant Administrator, EPA, March 3, 2023). The memorandum outlines some approaches the EPA requires of State Drinking Water programs to ensure public water systems put in place measures to protect their facilities from cyberattacks. States and Water Associations are challenging the approach and process outlined in the memorandum, but all agree on the importance of taking actionable steps to address the growing threat of cyberattacks on water utilities.

HOW WOULD A HUMAN-CAUSED, NATURAL, OR TECHNOLOGICAL DISASTER IMPACT THIS SECTOR’S PREPAREDNESS, RESPONSE, AND RECOVERY EFFORTS?

Human-caused and natural disasters’ impact on the Water and Wastewater Systems Sector is typically significant. The preparedness, response, and recovery efforts utilized during the disaster differ based on the incident and the utility’s resilience to the hazards associated with the incident.

As mentioned above, natural disasters such as droughts, floods, hurricanes, tornadoes, and winter weather can substantially impact water and waste facilities’ ability to provide water service to their customers. A common impact of hurricanes is flooding due to excessive rainfall and storm surge. Water and wastewater treatment plants can be inundated with flood water and must be taken offline until the water recedes and repairs are made. Lack of water service can slow emergency response and recovery efforts. Responding personnel must provide alternate potable water supplies to the affected populations and themselves. Impacts to wastewater lift stations result in “untreated sewage can back up into homes, businesses, and critical facilities and flow into waterways, causing a threat to public health and the environment.”

Human-caused disasters can also have devastating impacts on water and wastewater facilities. Increased production of chemical compounds has increased the risk of accidental contamination of treated water. In the Baseline Information on Malevolent Acts for Community Water Systems report, the EPA states, “Utilities experience accidental contamination of finished water twice per year, and 10% of these incidents have significant public health or economic consequences.” These types of incidents would impact health care facilities, residential areas, manufacturing facilities, and emergency services’ water use. Response and recovery efforts would slow significantly until potable water service is restored, requiring disposal of contaminated water and decontamination of the water utility facilities.

Earlier in this article, some examples described impacts on the technological capabilities of water and wastewater systems by cyberattackers over the last few years. The increased use of automation in all critical infrastructure sectors has increased susceptibility to severe cyberattack impacts. Another example from HackerNoon is that, “in 2018, the Onslow Water and Sewer Activity Authority in North Carolina had to shut down its IT network after two back-to-back ransomware attacks.”

Due to the unique nature of each water and wastewater utility, the consequences can worsen based on each impacted utility’s preparedness, response, and recovery capabilities. The AWWA Cybersecurity Risk and Responsibility in the Water Sector report discusses how the variability in structure and governance can cause significant obstacles to managing cyber risk. The report highlights that water and wastewater utilities typically have a “fractured organizational structure, often embedded within a multifaceted municipality.” The report also mentions that “a prevalence of legacy – sometimes antiquated – systems increase the challenges of managing cyber risk.”

WHAT ELSE DO EMERGENCY PREPAREDNESS, RESPONSE, AND RECOVERY PROFESSIONALS NEED TO KNOW ABOUT THIS SECTOR?

One of the main activities that can increase the Water and Wastewater Systems Sector’s overall preparedness, response, and recovery activities is more coordination and recognition of the interdependency with other critical infrastructure sectors. Continued coordination efforts outside of response and recovery incidents between the Water and Wastewater Systems Sector and representatives from the Energy, Food and Agriculture, Chemical, Healthcare and Public Health, Emergency Services, and Transportation Systems sectors will increase overall community-level resilience. Understanding the water supply and wastewater treatment needs of each of these sectors can drastically improve resilience at the local level. The EPA’s Community-Based Water Resiliency Guide provides examples of the types of interdependencies. The key for the Water and Wastewater Systems Sector is to interact with the other critical infrastructure sectors in their communities to ensure effective information exchange and adequate planning.

The Water and Wastewater Sector can provide opportunities such as educational and public outreach campaigns for the other sector partners to understand how crucial their partnership with the Water and Wastewater Sector is to maintaining stability locally, regionally, and nationally. Regular coordination through Local Emergency Planning Committees (LEPCs) and involvement in other community-wide activities and organizations will also improve awareness and visibility of this sector.