Drinking Water (21 page)
Poisoning a water system is qualitatively different than poisoning someone’s glass of water. The material first and foremost needs to be suitable as a weapon. It must be effective when dissolved
in water and remain potent while it courses through the water mains. It needs to elude easy detection by system monitoring. It has to be procured or produced in large enough volume to contaminate a water system. It has to remain dangerous in the face of standard water treatments such as chlorination and filters. And, of course, it needs to inflict harm when drunk. Luckily for us, this is hard to do.
The threat posed by chemical contaminants is limited. While it may be theoretically possible to poison an entire community’s water supply system, the effect of dilution makes it practically impossible. Putting a few drops of cyanide in someone’s glass will lead to a gruesome death (and likely ten to twenty years for murder if you’re caught). Putting a few drops, or even a few barrels, in a reservoir is pointless. Reservoirs generally hold anywhere from three million to thirty million gallons of water. One expert has estimated that poisoning a moderate-sized reservoir with cyanide would require “millions of pounds” of the poison. Even assuming you could back several trucks up to the reservoir and dump their loads without being detected, and assuming further that the enormous number of fish floating on their sides in the likely fish kill that followed was not noticed by anyone, you would still need to get huge quantities of the poison in the first place. The Department of Homeland Security keeps track of biological and chemical agents that might be used by terrorists, and these substances are not easy to come by in large quantities. Nor are they easy to produce at home.
What about the threat from biological agents? This is probably the least likely source of harm. Chlorination is effective against many infectious agents. The alleged Japanese use of cholera to poison Chinese water supplies in World War II, for example, would not work today. The bacteria are too susceptible to chlorine. Filtration excludes parasites and most bacteria. Use of even finer filters—so-called microfiltration or ultrafiltration—screens out even more, including viruses. Biological agents cannot simply be ignored, however. Most of the research on biological and chemical threats has focused on airborne contaminants, and there are large gaps in our knowledge of their behavior in treated drinking water,
so some agents may be more dangerous than we think. Some biological agents are resistant to chlorine treatment, and not all water systems use sophisticated (and expensive) filters.
The weakest point lies in the distribution system. In an independent experts’ review of water system security carried out by the Government Accountability Office in 2003, distribution was singled out as the most vulnerable point in the system. Poisoning water in the pipes after it has passed through the reservoir avoids the problem of massive dilution and leapfrogs some of the treatment processes, such as filters, upstream. It also makes detection quite difficult, since the water is directly on its way to the consumers. There have been plenty of examples of accidental contamination through this route, so it could happen again.
In 1969, for example, most of the Holy Cross college football team mysteriously contracted hepatitis. This is not an easy disease to get, and even less likely for an entire football team. So how did they get sick? After a great deal of detective work, the answer, surprisingly, came from a golf course and a burning house. The day before the outbreak, kids playing at a nearby golf course had opened a hose on the course and made a big puddle to splash around in. One of these kids had the hepatitis virus and somehow discharged it into the pool of water. Meanwhile, elsewhere in town, a house was on fire. The fire department attached its truck to the nearby hydrant and hosed down the blaze. What links these two events? The sudden drop in water pressure in the water system from turning on the fire hose literally sucked the water from the golf course puddle, through the hose, and
back into
the pipe—the same pipe that now carried this slug of infected water to the nearby athletic building’s faucet and the football team’s water jug.
Reversing the flow of contaminants into water mains is known in the water industry as “backflow” and happens from time to time. In Woodsboro, Maryland, the failure of a water pump caused a precipitous drop of water pressure in the town mains. A hose that had been extended from a faucet into an herbicide holding tank started sucking the herbicide back into the town’s water supply. Once the pressure was restored, water started flowing back into the holding
tank but the herbicide was already in the mains. It now flowed out of faucets around the town. The Charlotte Fire Department in North Carolina accidentally back-pumped gallons of fire-retardant foam into the city’s water mains. The Sikorsky helicopter plant in Bridgeport, Connecticut, similarly pumped corrosion-proof chemicals into the town’s water system. In all these instances and many more, residents were warned not to drink the water, bathe, or wash until the contaminants had flushed through the system.
Sudden losses of pressure that actually suck contaminants into the system (known as back-siphonage) are unusual and hard to predict. A more likely scenario would involve back-pressure, akin to blowing up a balloon. Imagine someone hands you a balloon that is still being blown up with air and nearly full. If you let go of the balloon, it would go whizzing around the room like an out-of-control jet. The air pressure in the balloon is greater than the air pressure in the room, so air flows out from the high-pressure area to the low. This is what happens when a water pipe bursts. If you clamp the balloon in your mouth and start to blow, though, the balloon fills up even more. The air pressure created by contracting your lungs is greater than the air pressure pushing
back
from inside the balloon. Back-pressure is the same thing, but in this case the pressure forcing contaminants into the pipe needs to be greater than the water pressure in the pipe.
Backflows are dangerous because there are many places in the distribution system where contaminants can be introduced, so-called cross connections. Water faucets are an obvious example. As a result, water managers have long been concerned about backflows. As John Sullivan, chief engineer of the Boston Water and Sewer Commission, has bluntly stated, “There’s no question that the distribution system is the most vulnerable spot we have. Our reservoirs are really well protected. Our water treatment plants can be surrounded by cops and guards. But if there’s an intentional attempt to create a backflow, there’s no way to totally prevent it.” In 1984, well before 9/11 made water infrastructure a national concern, a group known as the American Backflow Prevention Association (ABPA) was created. Dedicated to education and technical assistance, ABPA has more than forty chapters around the country and brings together elected officials, water officials, and engineers. Seeking to popularize the issue, it has even published a comic book with the catchy character Buster Backflow. The first issue was called “A Visit from Buster Backflow.”
Traci and David are trying to give their dog a bath in an outside bucket. When the dog runs away, they leave the hose running in the soapy water. When they return, standing over the tub is Buster, wearing a skintight red costume and a lock of blond hair looping over his forehead. After explaining the fluid mechanics of backflow, Buster warns the kids, “If you don’t want to
drink it
, don’t connect your water system to it!!”
In a message aimed at an older audience, Gay Porter DeNileon, a member of the national Critical Infrastructure Protection Advisory Group, has been blunter. Writing in the journal of the American Water Works Association (AWWA), she said, “One sociopath who understands hydraulics and has access to a drum of toxic chemicals could inflict serious damage pretty quickly.”
Fortunately, introducing a large backflow is hard to do. Water mains are under very high pressure. When a main bursts, it can create a geyser that blasts up from six feet underneath a road, splintering the asphalt. Blowing up a balloon is one thing; taking a sip out of a fire hose is quite another. If you’re not careful, you can get your lips blown off. Moreover, backflow contamination will be localized, limited to the area where contaminants were introduced.
While no water system can be completely protected from attack, there obviously are steps that can be taken to minimize the threat. Since the mid-1990s, the national government has taken a serious interest in protecting water infrastructure. In 1996, President Clinton issued Executive Order 13010, creating the Commission on Critical Infrastructure Protection. The commission was charged to produce a strategy for protecting critical national infrastructure from serious threat that could incapacitate the nation’s physical or economic security. They ended up choosing eight sectors, including telecommunications, gas and oil storage, banking and finance, and water supply systems, among others.
Congress became involved following the attacks of 9/11 with passage of the Public Health Security and Bioterrorism Preparedness and Response Act of 2002. Known as the Bioterrorism Act, this law has forced water suppliers to confront explicitly the many types of threats they might face. Most important, it requires water systems serving more than 3,300 people to perform a Vulnerability Assessment and submit the assessment to the U.S. Environmental Protection Agency. These 8,600 communities’ water providers must consider the potential weaknesses in their systems, their specific vulnerabilities to terrorist attacks, and efforts they can undertake to prevent them. In practice, this means determining which components of the system are most at risk (whether pipes, treatment
facilities, or chemical storage), assessing the likelihood of attacks from terrorists or vandals, identifying current countermeasures, and creating a prioritized plan for future actions to harden the system. Some parts of the country already have useful experience through developing emergency response plans to earthquakes and hurricanes.
Yet water managers are hydraulic engineers. They are not trained to assess terrorist threats or conduct strategic assessments of the most likely means of attack. They need help, and are assisted in these efforts by other agencies. The EPA, for example, periodically issues the Baseline Threat Report. This collates current thinking on the most likely types of terrorist attack as well as useful countermeasures. For obvious reasons, this is not publicly available information.
The EPA has also created the Water Information Sharing and Analysis Center (WaterISAC). This is a secure, web-based portal that shares sensitive information among utilities, law enforcement, and intelligence agencies. It currently has as members more than three hundred utilities that collectively provide water to more than 60 percent of the country. Its products and services include alerts on potential terrorist activity; information on water security from law enforcement and public health agencies; a database on chemical, biological, and radiological threats; and resources on security solutions.
Beyond developing plans and sharing information, the primary defenses to terrorist threats are hardened infrastructure and improved system monitoring. Since 9/11, most water systems have restricted access to treatment facilities and reservoirs. But, of course, they could always do more. Perimeter security would surely benefit from higher fences, motion sensors, more patrol guards, greater use of remote cameras, etc. And, to a certain extent, this is being done.
The Coast Guard, for example, has increased its patrols of Chicago’s intake sites in Lake Michigan. New York City has spent upward of $100 million on fencing, security cameras, and other measures, while tripling the dedicated police force to guard its upstate reservoirs and lakes. Across the country, California has
closed off many of the roads and access points to its reservoirs. The Los Angeles Department of Water and Power has almost doubled its security personnel, increased its testing of water by 50 percent, acquired two helicopters for patrolling infrastructure, and started fingerprinting and background checks of its employees. Water managers have also focused on reducing threats within the system. Many utilities, for example, have replaced highly poisonous chlorine with sodium hypochlorite or even switched to nonchemical treatment like ultraviolet light.
The more innovative developments have focused on monitoring. As described above, our overall water system, from headwaters to tap, is simply too large to completely prevent contaminations, so a critical factor comes down to how quickly a contamination event can be detected, located, and the nature of the contaminant identified. Early detection and warning are key to minimizing harm by shutting down supplies and letting people know not to drink the water. That’s why the town of Blackstone acted so quickly once it learned of the break-in at the water tower.
All water systems are required by the Safe Drinking Water Act to test their water periodically for a range of contaminants. This is not often enough, however, to detect a specific attack soon after it has occurred. Some systems routinely track drug stores’ sales of antacids and diarrhea medications. These can serve as a public health proxy for wide-scale gastrointestinal upsets from drinking water. One clever approach used by both large and small systems relies on biological sensors. The town of Loveland, Colorado, for example, keeps a tank of drinking water (chlorine removed) full of trout. When the trout start to die, water manager Ralph Mullinix knows something is wrong with the water and investigates. Sure enough, after one such event a few years ago, he found that copper sulfate, added by upstream farmers to kill algae in irrigation canals, had contaminated the town’s drinking water. The trout, he said, were “like the canary in the mine.” Rather than just looking for dead fish, wealthier systems actively monitor the common bluegill fish’s respiratory behavior using electrodes linked to software programs. If six out of eight fish show signs of stress, an alert is sounded.
The sensitivity is remarkable; the fish have detected sediments disturbed by divers in a reservoir forty miles away.