Water Vulnerability Assessment

1. Water Vulnerability Assessment • Col Lisa “SWAT” Snyder Credit to Ms. Martina Schmidt

2. Overview • Water Vulnerability Assessment (WVA) Process • OEHSA Overview

3. Water Vulnerability Assessment

4. Dilution is the Solution? EPA online Water Contaminant Information Tool (access restricted) CALCULATE the amount of water contaminated to a lethal concentration (based on 1 L consumption) by 110 lb of Sodium Cyanide.

5. Maybe dilution is not always the solution! Answer Don’t forget the other route of exposure Inhalation!

6. Why Vulnerabilities Exist • Inherent Water System Design Characteristics • Size (large geographic area and miles of pipeline) • Accessibility (numerous access points, and access points often in areas that are remote or accessible to the public) • Dependencies On Non-AF Water Suppliers/Privatization • On-line Contaminant Monitoring & Alarm Systems Not Yet Reliable or Practical • Lack Of Resources and/or Local Initiatives Dedicated To • Water System Security Measures • Water System Maintenance, Upkeep, & Modernization • Water Contingency Response Planning, Training, & Equipment 6

7. Drivers Safe Drinking Water Act – 2002 Bioterrorism Response Amendment AFI 10-246, Food and Water Protection Program AFI 48-144, Safe Drinking Water Surveillance Program DoDD 5160.54, Critical Asset Assurance Program AFPD 10-24, AF Critical Infrastructure Protection Chemical and Water Security Act of 2009

8. WVA Objectives • Reduce Unnecessary Risks to Personnel and Mission-Critical Operations • Identifying Observations (Vulnerabilities & Concerns) • Characterizing & Estimating Associated Risks • Recommending Credible Control Options

9. Observations Identified through the use of checklists that include detailed water-specific criteria that were established to ensure the security and survivability of potable water supplies. A criterion that is not met is considered a “deficiency,” and one or more deficiencies result in an observation for the respective program area or asset/access point being assessed. Water-specific criteria consist of basic administrative and physical control requirements derived from various DoD and AF directives. In the absence of specific requirements, best management practices derived from DoD and AF guidance documents, or identified by EPA’s Water Security Division and AF functional experts are applied. Additional or more restrictive criteria derived from MAJCOM, Primacy Agency, or installation regulations or policies may also apply locally

10. Observations • WVA Observations fall into the following four general areas: • Water Security • System Design & Integrity • Operations and Maintenance • Water Contingency Response

11. Common Water Security Issues • Water asset and access point entryways found unlocked/unsecured • Absence of AT provisions in contracts (water utility privatization, construction, bottled/bulk water) and insufficient control of contractors connecting to system • Off-base above ground water supply connections with no additional security connections. • Easily accessible off-base well facilities • Damaged fencing around water storage tanks and well houses

12. System Design & Integrity • No redundant water source or supply connections • Deteriorating infrastructure and lack of Capital Improvements Plan (CIP) • Inadequate looping of mains • Inadequate system pressure for fire-fighting purposes

13. Operations and Maintenance (O&M) • No valve exercising • No storage tank inspections & lack of preventive paintenance (PM) (deteriorated vents, unsealed openings, excessive corrosion, deteriorated coatings, accumulated sediment/debris) • Improper tank operation (inadequate turnover, no chlorine residual/stagnant water, improper water levels

14. Contingency Response Capability Installation Water Contingency Response Plan (WCRP) insufficient/incomplete/not executable WCRP not reviewed/updated annually Inadequate Contingency Monitoring Plans, Equip,Tng No water-related scenarios in base disaster exercises (per AFI 10-246)

15. Core Vulnerability Assessment Management Program (CVAMP) A secure, Web-based data management program accessible via SIPRNet by authorized administrators and a few other designated personnel (not BE) CVAMP enables all base AT observations to be prioritized, tracked, and reported by DoD installations, Major/Unified Commands, and Joint Staff (J3 Deputy Director for AT/Homeland Defense). CVAMP can provide an important mechanism to elevate visibility and support needed for water capital improvements, equipment and process upgrades, and other measures that improve the overall security, safety, and reliability of the potable water system.

16. WVA Process Overview Phase 1 Pre-Assessment Phase 2 Information Gathering Phase 3 Information Processing Plan Approach Assess Security & Survivability Programs Delineate Observations Coordinate With Stakeholders Assess Water Assets and Access Points Analyze Risk Document Review Identify Control Options Develop Report Coordinate With Stakeholder

17. Phase 1 - Pre-Assessment • Plan the Approach • Threat Level and Force Protection Condition • Deployment vs. Fixed Installations • Baseline Assessment and Assessment Updates • Coordinate with Stakeholders • Document and Key Reference Review

18. Phase 1 - Stakeholders Consolidated Interview Primary May Refer You To Secondary Stakeholder • Primary Stakeholders • CE Water Utilities • Contractor Privatized Water System • CE Programs • CE Asset Manager • Anti Terrorism Officer (ATO) • Secondary Stakeholder • Private/Municipal Purveyor • Contractor Privatized Housing • CE Emergency Management • CE Hearing, Ventilation & Air Conditioning • CE Power Production • CE Exterior Electric • Fleet Services • Base Contracting

19. Phase 1 – Key Documents • Key Documents • WVA • Sanitary Survey • WCRP • Primary References • AFI 10-245, Antiterrorism (AT) • AFI 10-246, Food and Water Protection Program • Secondary References • 32-1066, Backflow Prevention Program • 32-1067, Water Systems

20. Phase 2 - Information Gathering • Assess Water Security and Survivability Programs • Interview SMEs • Review Program Documentation • Checklists 1-3 Questionnaires • Checklists 4-8 Program Review • Assess Water Assets and Access Points • Checklists 9-15 Physical Assessment

21. Checklists

22. Physical Security Observations Examples Secluded area along fence line Ladder is easily accessible Corroded Lock

23. Physical Security Observations • Contractors, Base Construction, Grounds Maintenance, Pest Management, etc. who need to draw water should be directed to a non-potable water filling point if possible. • If the Potable Water System is used, then filling points must be protected against temporary Cross-Connections by use of BPDs. • Filling points should be located where activities can be observed, and preferably on a dead-end or otherwise in an area without high-value targets or with minimal consume • Absence of protected fill point(s) is a “concern” (for both intentional and accidental incidents).

24. Physical Security Observations Example Examples Examples Options: Remove exposed valve handles or at least chain them, and/or enclose valves within a locked barrier (e.g., fence or “tough cage”). Secure critical valve vaults/pits under hardened, locked covers. Use high security locks (shrouded shackle type). Benchmark (Lock and IDS) UNCLASSIFIED//FOR OFFICIAL USE ONLY

25. System Integrity Observations

26. Phase 3 - Information Processing • Delineate Observations • Vulnerability – A situation or circumstance that, if left unchanged, may result in the loss of life or damage to mission-essential resources. • Concern – An existing condition that is exploitable and can indirectly lead to the death of DoD personnel and/or damage resources. • Neutral – An existing condition that is neither exploitable nor can be reasonably assessed as leading to the death of DoD personnel and/or damage to resources, but is being identified to suggest consideration of modification and/or continuance.

27. Observation Table/CVAMP Inputs

28. Observation Risk Analysis The WVA risk analysis methodology incorporates principles, concepts, and techniques derived from ORM as well as the DoD AT tools MSHARPP and CARVER. ORM risk estimate categories of Extremely High, High, Medium, and Low provide a common frame of reference across DoD for relative risk ranking purposes (these designations are not associated with an absolute risk scale; there is no absolute scale for risk). Risk levels of Extremely High or High, however, generally indicate conditions of unacceptable risk to personnel and/or the mission due to the probability and severity of a water degradation and/or disruption incident, and warrant corrective actions on a priority basis.

29. Observation Risk Analysis • Probability • Incident History • Confidence in Existing Controls • Recovery Difficulty • Importance • Psychological Impact • Accessibility • Severity • Health and Safety • Mission-Essential Systems and Services

30. WVA Report Note: Use the example report from USAFSAM • Section 1 – Introduction • Section 2 – Overview of Potable Water System • Section 3 – Observations • Appendix A – References, Acronyms • Appendix B – Risk Analysis • Appendix C – Water Security Operational Measures • Appendix D – Representative Photographs

31. Classification Instructions • Definitions • Secret: Unauthorized disclosure could be expected to cause serious damage to national security that the original classification authority is able to identify or describe • Confidential: Unauthorized disclosure could be expected to cause damage to national security that the original classification authority is able to identify or describe • For Official Use Only: (FOUO) is a designation (not a classification) that is applied to controlled unclassified information that is exempt from mandatory release to the public under the Freedom of Information Act (FOIA)

32. Question • Have you been involved with a water vulnerability assessment?

33. Food handling and storage • Temperature control • Handling • Storage • Problematic public health concerns in a deployed location

34. The End • That was a brief overview… • Questions (your BEO can help you!)

35. Classification Instructions • Key References • AFI 10-245 • DoDI 2000.16, DOD Antiterrorism (AT) Standards • DTRA, Security Classification Guide for Vulnerability Assessments • Decision to Classify • The unauthorized disclosure of the information could reasonably be expected to cause damage to national security, and that the damage can be identified or described • Determine the probable operational, technological, and resource impact of classification

36. Classification Instructions When in doubt check with your ATO According to DTRA SCG, vulnerabilities are always classified. Concerns may or may not be classified, and neutral observations are typically not classified

37. What’s Next? Provide Observations to CVAMP administrator within 90 days All observations must be in CVAMP within 120 days Coordinate and brief results with MRC, FPWG, EMWG, or ATWG Review and validate annually Use WVA to improve upon emergency response procedures Do notsubmit the report to non-AF water suppliers or agencies, or base contractors (the commander and ATO should make that decision).

38. Questions?

39. TIC/TIM Vulnerability Assessment

40. Background Bhopal, India Disaster Fatal Ammonia incident in Swansea, SC Texas City refinery accident Train Collision in Graniteville, SC Minot Train Derailment

41. Why TIC/TIM VA? Provide valuable information to various installation personnel (e.g., emergency management, fire, medical, and antiterrorism personnel) Provides identity, quantity, and location of local TIC/TIM Identifies potential risk levels associated with local TIC/TIM Enables personnel to better plan/train for possible releases

42. Drivers AFI 41-106, Unit Level Management of Medical Readiness Programs, 14 Apr 08 (Updated 28 Jul 09). AFI 10-2501, Air Force Emergency Management (EM) Program Planning and Operations, 24 Jan 07 (Updated 6 Apr 09). BE Capability 1 (Execute SG related VA): To identify potential TIC/TIM concerns and assess the probability or potential consequences of an accidental/intentional release

43. Key Terms Toxic Industrial Material (TIM) – All toxic industrial materials manufactured, stored, transported, used in industrial or commercial processes. It includes toxic industrial chemicals, toxic industrial radiologicals, and toxic industrial biologicals. TIMs produce toxic impacts to personnel, materials, and infrastructure. Toxic Industrial Chemicals (TIC) – Chemical compounds used or produced in industrial processes that are toxic to humans and animals. Toxic Industrial Biologicals (TIB) – Biological materials found in medical research, pharmaceutical, or other manufacturing processes that are toxic to humans and animals. Toxic Industrial Radiologicals (TIR) – Radiation-emitting materials used in research, power generation, medical treatment, and other non-weapon developmental activities that are harmful to humans and animals if released outside their controlled environment.

44. TIC/TIM Overview TIC/TIM Process Planning & Coordination Data Collection Data Analysis Report

45. Planning & Coordination • Identify Lead Assessor • Manages assessment team; performs overall coordination; assigns tasks; ensures VA completion according to schedule • Identify Team • Multi-disciplinary team with strong technical background • Familiarity with overall assessment methodology, base operations/infrastructure, off-base industries, TIC/TIM characteristics & health effects, transport of contaminants • Develop List of Stakeholders • On-base stakeholders • Off-base stakeholders

46. Stakeholders • Bioenvironmental Engineering (BE) • Radiation Safety Officer (RSO) • Civil Engineering (CE): • Emergency Management • Local Emergency Planning Committee (LEPC) representative • Emergency Planning and Community Right-to-know Act (EPCRA) POC • Fire Department • Pest Management • Hazardous Waste Program Manager • Antiterrorism Officer (ATO) • Office of Special Investigations (OSI)/Intel • Security Forces • Base Contracting • Hazardous Material Pharmacy Manager • Weather Office

47. Data Collection Off-Base TIC/TIM Data (20 mile radius) Transportation TIC/TIM Data On-Base TIC/TIM Data Verify Data Compile Comprehensive TIC/TIM Inventory Obtain Base Map Collect Meteorological and Terrain Data Collect Natural Disaster and Accident Data Collect Data on TIC/TIM Characteristics

48. Data Collection Do not consider Explosives, Flammables, Weapons or Non-Respirable Solids • TIC of Concern includes toxic substances regulated under the EPA RMP and toxic chemicals that have an established NIOSH IDLH concentration value. • List of substances regulated under the EPA RMP http://frwebgate.access.gpo.gov/cgi-bin/get-cfr.cgi?TITLE=40&PART=68&SECTION=130&TYPE=TEXT • List of NIOSH IDLH chemicals http://www.cdc.gov/niosh/idlh/intridl4.html • Toxic no-volatile liquids are inventoried but not evaluated • Primary Focus • Chemicals or materials with acute toxicity • Primary route of concern: Inhalation

49. Tier 2 Data Example

50. Tier 2 Data Example