1. MERRICK & COMPANY CHARLOTTE WATER INSTITUTE
Security of Water Distribution/Wastewater Collection Systems
John W. McLaughlin, P.E. (N.C., S.C.)
MERRICK & COMPANY
September 14, 2017

2. Who Am I? Security Involvement (Where were you on 9/11?)
NC AWWA-WEA Disaster Preparedness Committee, now Risk Management Committee
Train the Trainer Instructor for Sandia Labs RAM-WTM
Member, GAO Expert Panel on Funding for Water Security (2002)
Chair, Water Infrastructure Security Enhancements (WISE) Guidelines for the Physical Security of Water Utilities Sub- committee (2002 – 07)
Member, AWWA G430 Security Practices for Operation and Management committee and update committee (2004 – Present)
Member, AWWA J100 Risk and Resilience Management of Water and Wastewater Systems committee (2008 – 10), vice chair of update committee (2014 – Present)
Member, AWWA M19 Emergency Planning for Water Utilities committee (2011 – present)
PM or technical lead on >30 water system Vulnerability Assessments, >10 Emergency Response Plans and Table Top Exercises
Annually teach WW Security at Western WW school in Morganton

3. Security = Risk Management
When you think of System Security, think of Risk Management
Risk is the product of three elements, focused on the first two:
C - Consequences, worst reasonable case, if the threat acts on the asset – Example, cost to the utility (and community) from a pump station failure or main break
V - Vulnerabilities of the asset to the threat – Example, critical facility in a flood plain
T - Likelihood of a threat impacting an asset – Example, extent/elevation of the floodplain, recurrence interval

4. System Security = Risk Management
When you think of System Security, think of Risk Management
Ultimately it’s about prioritizing your critical assets by the type and severity of the risks to those assets, then doing something about it.
What are some risks you see that affect your distribution, or collection systems?
1999 Hurricane Floyd

5. Vulnerabilities
Distribution systems/collection systems are inherently more risky
Systems are connected and accessible to the public (your customer base)
Usually out in the open, no perimeter
Generally they are “unstaffed” facilities
Very often they are remote sites.
Often reliant on SCADA, and
Dependent on the electric grid and backup power

6. Collection System Assets
The first step is to Identify and know your assets
Collection system assets
Laterals
Collectors/Interceptors
Manholes/vaults
Exposed/aerial pipe
Pump stations
Field Ops buildings & facilities
Equipment
Staff
Others??

7. Distribution System Assets
The first step is to Identify and know your assets
Distribution system assets
Meters
Valves/Vaults
Water mains/transmission lines
Hydrants
Storage tanks (elevated & ground)
Booster pump stations
Field Ops buildings & facilities
Equipment
Staff
Others??

8. Threats/Hazards Threats are not always intentional Natural Accidental
Proximity
Dependency
All Hazards

9. Actual Incidents Specific incidents Charlotte Water Foamgate
Charlotte Water PCB contamination

10. Actual Incidents Specific incidents
DC WASA (DC Water) fumes in combined sewer tunnel
Water main breaks
Sanitary sewer overflows
Hurricanes, tornadoes, etc.
Drone overflights?

11. Best Practices Some best practices to reduce risk (be more secure)
Risk assessment and management (J100)
Emergency preparedness and response planning
Business continuity planning
Training, especially focused on highest risk assets/facilities
System modeling/use of WAM
Water quality monitoring (establish a baseline)
Table top exercises
Always capture and incorporate lessons learned

12. Best Practices Some best practices to reduce risk (be more secure)
Water/Wastewater Agency Response Network (WARN) membership
Good communication, alert systems
Water Watch, like Neighborhood Watch, i.e. alert citizens and staff
Coordination with Local Law Enforcement
Valve exercise and replacement program (distribution system)
Flushing program (distribution system)
Hydrant testing (distribution system)

13. Best Practices Some best practices to reduce risk (be more secure)
Lighting for better detection, deterrence and staff safety
Access control and perimeter detection (at staffed or unstaffed physical facilities)
Key control and visitor/vendor/contractor control policies (at staffed or unstaffed physical facilities)
CCTV system, properly planned and monitored (at staffed or unstaffed physical facilities)
Focus on being a well-managed, operated and maintained utility!

14. Questions? John W. McLaughlin, PE john.mclaughlin@merrick.com