In most urbanized societies, water is taken for granted and little thought is given to how fragile the supply of this vital resource can be. A water emergency, however, such as a treatment plant outage, a water source contamination event, or natural disaster has the potential for significant disruption to society and the infrastructure that depends on water to function. Most other sectors of critical infrastructure, as well as activities of daily living, are highly dependent on the water sector. As a result, consequences of a water emergency can be significant and may occur immediately without notice depending on the nature of the event. Thus, the security and resilience of the water sector is a key component of a nation’s civil preparedness that can have military and international implications as well. Terrorist threats to water delivery or contamination of water sources as a terrorist act can impact a nation’s ability to move and sustain its military forces and project military power when required. From the perspective of the North Atlantic Treaty Organization (NATO), threats to the water sector in one member state could have ripple effects that limit or diminish NATO’s military mobility and force projection in support of its essential core tasks.

Therefore, it is important to understand water sector risks and find ways to effectively mitigate them. While this chapter focuses on the US water sector and uses a case study from one of its most important metropolitan areas, the chapter provides a helpful framework for other Allies and partners to understand, adapt, and employ to their specific circumstances.

This podcast based on Chapter 8 in Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1) provides a foundation from which to better understand the criticality of water sector resilience. While this chapter focuses on the US water sector and uses a case study from one of its most important metropolitan areas, the chapter provides a helpful framework for other Allies and partners to understand, adapt, and employ to their specific circumstances.

Watch the webinar: https://youtu.be/G1OD24HEh94

Read the book: https://press.armywarcollege.edu/monographs/955/

Keywords: critical infrastructure, crisis management, security risk assessment, water sector resilience

Episode Transcript:

“Water Sector Resilience in the Metropolitan Washington Case” from Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)

Stephanie Crider (Host)

You’re listening to Conversations on Strategy. The views and opinions expressed in this podcast are those of the authors and are not necessarily those of the Department of the Army, the US Army War College, or any other agency of the US government.

Conversations on strategy welcomes Steve Bieber, author of “Water Sector Resilience in the Metropolitan Washington Case.” Bieber has more than 30 years of experience in leading development and reform and water security, public policy, and environmental regulation. He’s currently the water resources program director for the Metropolitan Washington Council of Governments.

Welcome to Conversations on Strategy, Steve. Thanks for joining me today. You recently contributed to the book Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency. Your chapter is about water sector resilience. Give us an overview of the water sector, please.

Steve Bieber

Sure, so thanks for having me on. You know, water includes both water you drink and (water) you use for bathing and cooking and so on. But obviously when you’re done doing all of that stuff, it has to go somewhere—which is down the drain and to a wastewater treatment plant. But probably the other part that folks don’t think about a whole lot is the source of the water in the first place. When you think of the water system and working with water utilities, usually the three biggest components are the source of it, collection and treatment of that, distributing it, and then treatment at the end when you’re done using the water.

Just to give folks a little bit of perspective, here in the Metro Washington region, the average daily demand for drinking water (and it goes up and down depending on the time of year) is close to 500 million gallons a day. We’ve got over 14, 500 miles of water mains (so that’s more than the miles of roads we have in the region) and almost 120,000 fire hydrants. So if you ever think about the challenge of maintaining something like that … you know, and over 1,000,000 metered accounts and a little more than 5 million people who are served by public water and sewer.

Host

Talk to me about the risks and threats of the water sector.

Bieber

You know, I’m sure people have seen in the news lately—especially with what happened in North Carolina (electrical substation attack in Moore County on December 3, 2022)—you know, a lot of terrorism and Black Sky events are in the news. Those things can be a threat to the water sector as well. So there’s physical security threats like that but also things like climate change, rising sea level, aging infrastructure, you know. We have some infrastructure here in the Metro Washington region that dates back to the 1800s, and there are instances that sometimes they find pipes made out of wood when they’re doing main break repair.

You can imagine trying to keep up with operations maintenance. And just repairing things like that over such a vast network is pretty hard. And so, from the utility perspective, you’re dealing with all sorts of threats. You know, natural threats, man-made threats, accidents that happen (whether it’s a contractor striking a pipe and breaking it or an oil spill in your source water, all sorts of things) and you have to be prepared to deal with all of it.

Host

Speaking of dealing with it, what are the key steps in resiliency planning?

Bieber

Sure, so I’ll start out maybe by saying a little bit about what resiliency is. So for the water sector, broadly, you can define it as the ability for a water utility to maintain their operations despite a challenge like, say, a water main break, and recover from the event as soon as possible. And we already talked about the stressors. Whether it’s weather, accidents, or some kind of intentional act, the idea is to be able to bounce back as quickly as you can.

The other thing to be mindful of is resilience extends beyond just the utility and encompasses dependent and interdependent sectors, so things like the energy sector, health care. A big one in our region here is data centers, which are very dependent on water for cooling. All those local and regional assets are connected. And sometimes seemingly distant threats to resilience in another region can affect utilities here. So, for example, a spill in West Virginia could affect our water supply here in Metro DC, just as one example. And a lot of times these cross-sector dependencies are deep and complex, so it’s really important to think about those when you’re looking at doing resiliency planning.

So here in the Metro Washington region, we actually do studies routinely to look at things like adequacy of our water and wastewater infrastructure to meet demand. So say we’re forecasting out to 2050. Do we have enough treatment? Enough distribution? Enough collection system to meet growing population and employment and all of that?

We’ve historically looked at things like drought, which we know happens from time to time. And we do studies on that every five years to see do we have adequate infrastructure in place to be resilient against the drought of record. But one thing we decided to do a few years ago is expand that and take more of a system resiliency approach to look at other threats and hazards, not just drought, and see where we maybe have vulnerabilities and also see where we could make investments to buy down the risk from certain threats.

So we got some federal grant money to do that. And let’s say you could kind of break down the steps into five phases. So, the first one was data collection and establishing system capabilities. So that was working with all the water utilities in our region. We held a series of workshops and determined, sort of, what do you have in terms of water treatment? Where do you get your source water from? How much distribution capacity do you have? Collect that all into one database, so we have a good baseline of what’s the capability that we have now. And then the second step was establishing a risk framework and defining a level of service. So basically, thinking about different failures events, how likely are they to happen, and what level of service do we want to have in the event that those things did happen? That’s really an important driver because I’ve seen utilities that use as their level of service in an emergency one gallon per person per day. I’ve seen others that have planned around 20 percent of your average daily demand. So as an example, if the average household uses 100 gallons a day, being able to provide 20 gallons a day, well, that’s 20 times more than one gallon.

We used here, for our planning purposes, Average Winter Day demand, which would be even more than that. So as you can imagine, when things are changing by 20 times or 30 times, you’re planning assumption the capability you need to have to meet that demand is going to be vastly different, too. So once you’ve defined, you know kind of your level of service, the different failure events or scenarios you’re planning around (whether it’s intentional events, accidental events, weather events), you need to look at all of those and define what would the consequence be if those different things happen. For our purposes, we measured as how many days would people be out of water, and we called it people outage days. So it’s a combination of how many customers are affected? How many days would they be out before you could restore the water? And you can also use that to figure out an economic impact using some figures that FEMA and others put out. What would the cost to the region be under those different scenarios? So you can put a dollar amount on it.

There’s other ways that you could quantify consequence. It could be things like, is there some critical mission in your region that if this happened you wouldn’t be able to fulfill? So say like for a military installation or something, or a nationally significant piece of critical infrastructure, and if the water was out it would impact that nationally significant infrastructure. So there’s other ways to measure it, but that’s the way we went about it.

Once we had the scenarios we’re planning around, the likelihood of those things happening, and the impact, basically, if they happened, we identified different improvements you could make to mitigate those risks. So, it could be anything from interconnections between the different water systems and improving those to building more storage so you’re not dependent, say on just one water source, but you have storage, say in our case, like we use the Potomac River as a major source of our drinking water, having more storage off the Potomac River so if for some reason it wasn’t available, you’ve got an alternate source you can go to for a long period of time or a longer period of time. And then we used some simulation modeling to figure out which combinations of improvements (so whether it’s storage, interconnections, other types of improvements), which ones actually buy down the risk the most? Are there combinations of things you could do that buy it down even more? And you can basically put things into what I would call different buckets of combinations of scenarios, compare the benefits of one to the other, you can also see if there’s synergies of doing things in a particular sequence. And then you can find out which one basically has the best benefit-cost ratio. And once you have that information, you can come up with a plan for improvements of how you want to make your infrastructure more resilient.

We kind of put ours into three categories. One was what we called “no regrets” improvements. So those would be things that the benefit-cost ratio is very high. It’s probably something you could get done quickly, and there’s an operational benefit to it. So even if the scenario you were planning around, say, a spill event or some kind of an attack, never happened the benefits to it still make it worth doing anyway. And then we had some that were more short-term—so things that had a high benefit-cost ratio and could be accomplished pretty quickly just because either the cost was low or there’s just not a long lead time to plan it and execute the improvement. And then there were other things that were sort of longer-term. If you’re looking at, say, building a new reservoir or something like that. That’s a major capital project. It’s not going to happen quickly, and you have to build that into your risk modeling. If it’s going to take 10 years to build something, you’re carrying the risk for that 10-year period until it’s built. And so you have to factor that in in determining which things you’re going to pursue. But we ended up with a mix of things that could happen quickly, kind of medium-term and longer-term.

Host

Your chapter uses Washington DC as a case study. I would love to hear more about this.

Bieber

You know the Metro Washington region, I think we’re the 6th largest metro region in the country, and, of course, on top of that, the home of our nation’s capital, a lot of the federal agencies, and we have a number of military installations in the region, too, and some nationally significant critical infrastructure. And we also have a long history of cooperating among the water and wastewater utilities here. We have agreements that go back several decades, cooperative water supply, cooperative wastewater treatment—different things like that. So we’re used to working together in the water sector to solve big problems.

Especially since 9/11, everyone’s had more of a focus on security. But I would say in the last five or so years, that’s really shifted to not just security but security and resilience. And so that’s why we wanted to work together to look at what opportunities are there, not just at one utility alone but as a system in the region to collaborate and make improvements so that the system that serves the whole region is more resilient as a whole. And so that’s what drove us to take the systemresilience approach I talked about a moment ago—looking at things that are cross-cutting across the region, and that we could collaborate on together, which complements the individual utility vulnerability assessments and planning they’ve each done on their own. So, it was kind of another layer on top of that to identify things that are more regional system-wide, and bigger impact. And things that also, you know, you could work with your neighbor, maybe, to buy down the risk and be more resilient. More so than doing something on your own.

Host

You talked about simulations and planning and resiliency. How do you test for this? Do you have to wait for an event to happen? Is there a way to do a test run?

Bieber

Yeah, that’s a really good question. So no, you don’t have to wait for an event to happen. Most risk-based approaches, whether it’s the one we used, or there’s some slightly different ones that are used in other sectors, but they have a lot of things in common. And one of those things is getting a group of subject matter experts together.

In this case, it was our utility companies together, talk about scenarios of events they’re concerned about. In some cases, this is things that have actually happened before. So, say, like an oil spill or a water main break or a failure of equipment—like a pump failure or something like that. And they have a pretty good idea of how often does that happen? How likely is it to happen? If it happens, what are the consequences of it happening? And so those are real events that we have data on, and we can put a pretty good number to it. But then there’s other things that you also want to look at that are more hypothetical.

So how likely is it that a rail car could fall in the Potomac River? Or how likely is it that you’d have a terrorist attack? You know you can go down the list (not an endless list of scenarios, but of scenarios that are things that maybe keep utilities up at night). You know it could happen and it would be, even though it’s a low probability, a very high impact event. And using this same group of subject matter experts, kind of put a number to each of those.

So, in our case, we kind of had bins of things of like, “it happens once every 10 years,” “it happens once every 30 years,” “It happens once every 100 years.” Or maybe it’s less than one every 100 years, but you can get an idea of sort of how you would figure out how likely is it to happen. And then you can combine that with your estimate of if event A happened, how many people would be out of water? How long do we think it would be before we’d be back on our feet, and we’d restore water service? And then you can combine those things. So, the likelihood of it happening, the consequence of it happening. And you can get a sense of between those two things how worried are we about that and begin to come up with a list of which things are the most concerning, which things are the least concerning, and a bunch of stuff in between.

And you can also put costs to all of that, which allows you to get to the benefit-cost of here’s how much it would cost. Here’s how likely it is to happen, (and) the impact of it, and you can calculate a benefit-cost ratio that. We used a pretty sophisticated modeling approach, but my point of bringing this up is if you’re a smaller utility or you just don’t have the resources to do that right away, it’s not like you need to throw up your hands and go, “Oh well, I can’t do anything.” Because you can get a group of your own employees together and just use your best professional judgment on which things are we most worried about? How likely do we think they are to happen one relative to the other? What would the impact be if it happened? How much would it cost us to bounce back from it, or to mitigate it? And what’s the cost to our customers, even if it’s just how long they would be out of service? And you can use that to come up with a pretty good list of priorities that’s probably going to be very close to what you would come up with if you used the more sophisticated modeling approach. And at least it gets you started.

Host

What are your recommendations for water security and resilience?

Bieber

I’m a big proponent of data-driven decision making and using a risk-based approach. In the water sector— all public utilities—they’ve all been required already to do a vulnerability assessment to come up with security plans, different things like that. So, you already will have a lot of the data you need to get started, but, of course, the landscape is dynamic. It’s always changing. You know you may have the vulnerability assessment you did a year ago. Maybe it was five years ago. But it at least gives you a starting point. And then I would say take that, get a group of subject matter experts together, and just start going on developing a risk-based approach to planning. And there are a lot of good resources available online.

American Water Works Association actually has standards for the J 100 standard for doing this kind of planning. So that’s one standard that’s widely followed in the water industry, but there’s also tools that are available for free. So, if you go search US EPA and water resilience, you’ll find a couple of tools they have online that you can get started with today. It will ask you questions. You fill it in as you go along, and you’ll get some recommendations out at the end. They have one that’s specific to climate change and building in resilience to that and another that’s more generic and more geared toward the types of events like we’re talking about, you know, whether it’s intentional or accidental events.

Yeah, you do a little poking around online, you’ll find more tools, too. Another good resource that a lot of the utilities here in our region have taken advantage of, and if you’re in the US is available to you for free, is connecting with your protective security advisor. So, the DHS cyber and Infrastructure Security Administration they have protective security advisors in every state. In our case here in the DC metro region, we actually have three. They will come out and do a risk and resilience assessment of your infrastructure at no cost. And they can cover all sorts of things from physical security, other types of events like spill events, or other things like that. They can even come out and do a cyber assessment if you’re more worried about cyber risk and how to mitigate that. They’re free. It’s a good way to get started, rather than waiting and not doing anything.

Whether it’s online, someone coming out for free, hiring a contractor, getting started with your own employees, there’s lots of ways to get going and take a risk-based approach and see where the opportunity is to make yourself more resilient. You know, buy down the risk on things you think are either most impactful or most likely to happen.

Host

What a great list of resources. Thank you for sharing that. Also, thank you for your time today.

Bieber

Yeah, I appreciate having the chance to talk today and look forward to working on more of this in the future.

Host

Learn more about water sector resilience at press.armywarcollege.edu/monographs.

If you enjoyed this episode and would like to hear more, you can find us on any major podcast platform.

Author information: Steve Bieber has more than 30 years of experience in leading development and reform in water security, public policy, and environmental regulation. He is currently the water resources program director for the Metropolitan Washington Council of Governments (MWCOG) and is responsible for managing its water resources programs, including the regional Anacostia Restoration Partnership, water security programs, drinking water and wastewater planning, drought management, urban stream restoration, and other related environmental programs for local governments and water utilities in the Washington, DC, area. Bieber holds a bachelor of science degree in zoology from Michigan State University, a master of science degree in oceanography from Old Dominion University, and a master of public administration degree from the University of Baltimore.