Checkmate

A master strategy for securing your water treatment facility

• By Shannon D. Spence, Wendelyn S. Stoveland
• Jun 01, 2004

At the American Water Works Association (AWWA) Security Congress, which was held in Charlotte, N.C., from April 25 to April 27, 2004, it was evident that public water and wastewater utilities were no longer novices in the security arena. The events of September 11, 2001, and the subsequent mandates for the water industry contained in the Bioterrorism Act, have greatly affected the way we do business. Consequently, utilities are starting to approach security the way they approach safety -- as an integral part of day-to-day facility management and operations.

As we traveled from session to session, we were struck by the change of culture that has begun within the water industry, and yet how far we have to go. At this point, large water utilities have completed their vulnerability assessments (VAs) and their emergency response plan updates, and medium and small utilities will soon complete the same tasks. Although acting upon the findings of the VA is essentially an unfunded and unmandated activity, in the tradition of the service-minded professionals that populate this industry, we are proud to see that the water industry has risen to the challenge and is taking its responsibilities very seriously. So, the question now is, what do we do with the knowledge of our vulnerabilities and how do we take steps to protect our critical infrastructure?

Regardless of the size of a utility or community, from a 1,000-million-gallon-per-day (mgd) facility to a utility with one well and one pump, utility managers seem to be grappling with many of the same issues. Do signs draw attention to my facility? If so, is it positive attention (neighborhood awareness, law enforcement response) or negative attention (targets)? Is it appropriate to involve the local community watch programs as a part of my security plan? How do I best utilize the existing resources I have? While many of the issues may be the same from utility to utility, and all agree we must determine how to best utilize our own resources, it is clear that no single answer fits all utilities. As we gain knowledge and share our experiences, we can begin to gain trust in our decisions and apply what is best for our individual situations and resources.

The game of chess is a good metaphor for an integrated security approach. First, we must understand the "players" and their roles and responsibilities. Second, we must construct a strategy that makes the greatest use of these players and their abilities. Finally, we must approach security in a flexible manner that allows for nimble response to changes in our environment -- including national threat advisories, utility operations and facility modifications. Since our company served as a session host at the AWWA Security Congress, we focused on a multi-pronged approach to integrating security into the day-to-day operations of public utilities
-- much like the opening moves of a chess game.

Setting Up the Board: The Big Picture
In a macro-level view of public utility operations, we looked at the competing priorities that utility management must consistently balance to meet the needs of its customer base, the public at large and the business of the utility. The greatest successes we see in the industry are those utilities actively engaging in a strategic planning process that takes into account both near- and long-term facility needs and sets budgets, action plans and success scenarios to ensure the utility continues to move forward in an organized and focused fashion.

Included in this is the biggest challenge facing utilities -- funding. Repeatedly we learned from the attendees of the conference, and from utilities at large, that funding is just not aligned with the current needs of utility management. Networking among utilities, however, yielded some innovative approaches to meeting the funding challenge, which include the following examples:

• During an "orange alert" status, additional expenses relating to staffing, services and alerts may be reimbursable. Check with your local and state offices of emergency management for more information.
• Each state was required to submit a statewide emergency operations plan and budget request that allowed the U.S. Department of Homeland Security (DHS) to distribute funds accordingly. Are you on their list of first responder organizations? Contact your local and state offices of emergency management to discuss your operations and how they are critical to state security measures.
• Mandates and regulations can be challenging and can add to the competing priorities of a utility; however, mandates such as the upcoming National Incident Management System (to be promulgated by Homeland Security Presidential Directive No. 5) can provide utilities with an opportunity to raise their profile as first responders and to gain access to the funds allotted by DHS to such organizations for training, preparedness exercises and capital improvements/equipment purchases.
• It has been proven time and time again that emergency response plans are only effective when staff are trained and prepared for their use. If all other attempts to gain funding fail, utilities have been assured that coordinated training and exercise activities, especially if integrated with local fire, police and emergency response professionals, are definitely eligible for funding. Once again, contact your local and state offices of emergency management for more details.

Opening Move: Security Master Planning
Bringing this back to the questions at hand -- what do you do next to secure public utilities? We see the next logical step as the development of a targeted security master plan that is a natural outgrowth of the VA process. A master plan continues the cross-departmental communication and will work within a utility's strategic plan to reach milestones through budget-line items and integrated facility upgrades. We are working with several utilities to assist them in cost-effectively achieving this task, which includes evaluating current projects that are in the planning, design and construction phases.

Security master plans also can help facilities to better understand how security elements must be infused into every aspect of operations, human resources, communications and the general tasks of conducting business. Several of the more forward-looking utilities are developing security design guidance manuals that set firm standards for bringing facilities into the future. Essentially, the guidance manual will outline a process for screening proposed projects for potential security impacts, as well as outlining a security review process for those projects deemed to be security sensitive. In addition, the manual will provide guidance to design teams for such facilities/assets to promote "secure designs." Examples of such guidance may range from the design of built-in redundancy to the incorporation of sophisticated security systems.

In this vein, we also recommend proactive research into upcoming program requirements such as the previously mentioned National Incident Management System (NIMS). In a few short years, NIMS will prove to be the standard for emergency response activities, and compliance with this program will be required in order to receive funds from the Federal Emergency Management Agency. Revising any current incident management systems to align with this new protocol will save you time and money in the long run and is the perfect candidate for a line item in a security master plan and strategic facility plan.

We found considerable creativity amongst the participants of the AWWA Security Congress as they worked with their new partners in law enforcement and emergency response organizations. Some have allowed law enforcement to build/house a precinct on their facility grounds to increase the appearance and actual level of protection, as well as decreasing response time.

Small systems in rural areas often face unique problems; they may be strapped for resources, have less access to critical security information, have less of a sense of urgency and/or have less law enforcement resources for response. Many larger utilities are extending a helping hand to such utilities with both receiving and providing information and assistance in the emergency response, threat identification and strategic plan development. This fits with the mantra of most emergency responders, "one fight, one team, one mission."

Protecting Your King/Queen: Leadership
Last, and certainly not least, we feel it is critical to recognize the evolution of leadership in the new security culture. The leadership demonstrated by Rudy Giuliani in the face of devastating losses in infrastructure, life and emergency resources on September 11, 2001, is a prime example of the power of an emotionally intelligent leader. What is emotional intelligence? Emotional intelligence (EI) is defined as "the capacity for recognizing one's own feelings and those of others, for managing emotions both in ourselves and others, and for generating motivation in the workplace to help others to become more productive, effective and self-fulfilled" (Dan Goleman, 1988). Unlike IQ, emotional intelligence can be learned and refined with proper coaching and informed self-awareness. In today's stormy environment of workplace violence, external threats and nationwide alerts, labor/management disputes, and just the stress of day-to-day business operations, EI can become the key component that utility management turns to and can differentiate true leaders from average managers.

Checkmate: Succeeding Within the New Security Culture
Achieving a "secure facility" is much more than just adding cameras and fencing. A secure facility examines vulnerability and risk reduction through the planning and design process. Make use of the tools as we suggest in this article, such as regularly revisiting the VA, developing near- and long-term strategic plans, creating security master plans and security guidance manuals, updating emergency response plans and committing to training/exercising. Take some time to learn more about how emotional intelligence can assist your management in times of crisis as well as during daily business activities. Finally, don't forget the human element as you strive to secure your facilities -- the lives and well being of your staff are your most valuable assets. Win their support of your security activities, you will have improved your probability of success tenfold.

This article originally appeared in the 06/01/2004 issue of Environmental Protection.