MERRICK & COMPANY CHARLOTTE WATER INSTITUTE Security of Water Distribution/Wastewater Collection Systems John W. McLaughlin, P.E. (N.C., S.C.) MERRICK & COMPANY September 14, 2017

Who Am I? Security Involvement (Where were you on 9/11?) NC AWWA-WEA Disaster Preparedness Committee, now Risk Management Committee Train the Trainer Instructor for Sandia Labs RAM-WTM Member, GAO Expert Panel on Funding for Water Security (2002) Chair, Water Infrastructure Security Enhancements (WISE) Guidelines for the Physical Security of Water Utilities Sub- committee (2002 – 07) Member, AWWA G430 Security Practices for Operation and Management committee and update committee (2004 – Present) Member, AWWA J100 Risk and Resilience Management of Water and Wastewater Systems committee (2008 – 10), vice chair of update committee (2014 – Present) Member, AWWA M19 Emergency Planning for Water Utilities committee (2011 – present) PM or technical lead on >30 water system Vulnerability Assessments, >10 Emergency Response Plans and Table Top Exercises Annually teach WW Security at Western WW school in Morganton

Security = Risk Management When you think of System Security, think of Risk Management Risk is the product of three elements, focused on the first two: C - Consequences, worst reasonable case, if the threat acts on the asset – Example, cost to the utility (and community) from a pump station failure or main break V - Vulnerabilities of the asset to the threat – Example, critical facility in a flood plain T - Likelihood of a threat impacting an asset – Example, extent/elevation of the floodplain, recurrence interval

System Security = Risk Management When you think of System Security, think of Risk Management Ultimately it’s about prioritizing your critical assets by the type and severity of the risks to those assets, then doing something about it. What are some risks you see that affect your distribution, or collection systems? 1999 Hurricane Floyd

Vulnerabilities Distribution systems/collection systems are inherently more risky Systems are connected and accessible to the public (your customer base) Usually out in the open, no perimeter Generally they are “unstaffed” facilities Very often they are remote sites. Often reliant on SCADA, and Dependent on the electric grid and backup power

Collection System Assets The first step is to Identify and know your assets Collection system assets Laterals Collectors/Interceptors Manholes/vaults Exposed/aerial pipe Pump stations Field Ops buildings & facilities Equipment Staff Others??

Distribution System Assets The first step is to Identify and know your assets Distribution system assets Meters Valves/Vaults Water mains/transmission lines Hydrants Storage tanks (elevated & ground) Booster pump stations Field Ops buildings & facilities Equipment Staff Others??

Threats/Hazards Threats are not always intentional Natural Accidental Proximity Dependency All Hazards

Actual Incidents Specific incidents Charlotte Water Foamgate Charlotte Water PCB contamination

Actual Incidents Specific incidents DC WASA (DC Water) fumes in combined sewer tunnel Water main breaks Sanitary sewer overflows Hurricanes, tornadoes, etc. Drone overflights?

Best Practices Some best practices to reduce risk (be more secure) Risk assessment and management (J100) Emergency preparedness and response planning Business continuity planning Training, especially focused on highest risk assets/facilities System modeling/use of WAM Water quality monitoring (establish a baseline) Table top exercises Always capture and incorporate lessons learned

Best Practices Some best practices to reduce risk (be more secure) Water/Wastewater Agency Response Network (WARN) membership Good communication, alert systems Water Watch, like Neighborhood Watch, i.e. alert citizens and staff Coordination with Local Law Enforcement Valve exercise and replacement program (distribution system) Flushing program (distribution system) Hydrant testing (distribution system)

Best Practices Some best practices to reduce risk (be more secure) Lighting for better detection, deterrence and staff safety Access control and perimeter detection (at staffed or unstaffed physical facilities) Key control and visitor/vendor/contractor control policies (at staffed or unstaffed physical facilities) CCTV system, properly planned and monitored (at staffed or unstaffed physical facilities) Focus on being a well-managed, operated and maintained utility!

Questions? John W. McLaughlin, PE john.mclaughlin@merrick.com 704-996-6895