The disruption of a safe and reliable water supply remains a long-standing concern related to the protection of public health. Several events have increased congressional attention to water system security and resilience from events that could disrupt the provision of water supply. These include a cyberattack on an automated system at a water treatment plant serving a Florida community and water service disruptions in Texas related to frigid weather and power losses. Intentional acts and natural hazards can damage water infrastructure, including automated systems that control treatment, resulting in the interruption of safe and reliable drinking water.
Water systems are one type of critical infrastructure (CI) covered by broader efforts to improve CI security. The U.S. Environmental Protection Agency (EPA) has been designated the lead agency responsible for water sector security, including cybersecurity (Executive Order 13636). (See CRS Report R45809, Critical Infrastructure: Emerging Trends and Policy Considerations for Congress.)
To address both intentional acts and extreme weather that may threaten water systems, Congress added several provisions to the Safe Drinking Water Act (SDWA) to support the safety of water supplies and resilience of water systems. Primarily found in SDWA Part D "Emergency Powers," these provisions range from risk and resilience assessment and emergency response planning, to civil and criminal penalties against those who tamper or attempt to tamper with a public water system (42 U.S.C. §300i-300i-4). The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (the Bioterrorism Preparedness Act; P.L. 107-188; Title IV) added or revised many of these SDWA provisions.
After first focusing on security, Congress expanded SDWA provisions to address water system resilience to a range of risks such as droughts, floods, wildfires, and other extreme weather/natural events. America's Water Infrastructure Act of 2018 (AWIA; P.L. 115-270) amended provisions to expand the risks that water systems evaluate and authorized grant programs to increase resilience.
In addition, as a condition of taking on primary enforcement authority, SDWA requires states to have an adequate plan for providing safe drinking water under emergency circumstances, such as "earthquakes, floods, hurricanes, and other natural disasters, as appropriate" (42 U.S.C. §300g-2(a)(5)). The act authorizes various financial assistance programs that may assist water systems in addressing threats that could disrupt water service. These authorized resilience-related financial assistance programs have yet to receive appropriations, or began receiving appropriations in FY2020.
Risk and Resilience Assessments and Emergency Response Plans
In 2002, Congress first required drinking water systems to assess risks that could disrupt the provision of a safe and reliable water supply and prepare plans to address such risks. Added by P.L. 107-188, Section 1433 required community water systems (i.e., systems that regularly serve at least 25 individuals year-round) to (1) assess their vulnerabilities to terrorist attacks or other intentional acts intended to disrupt water service, (2) submit these risk assessments to EPA, and (3) develop emergency response plans based on their assessments (42 U.S.C. §300i-2). EPA was directed to provide guidance to small systems (serving fewer than 3,300 people) on how to conduct vulnerability assessments, prepare emergency response plans, and address threats. As initially added to SDWA, Section 1433 did not require water systems to update their assessments.
AWIA rewrote Section 1433 to require community water systems serving more than 3,300 people to conduct risk and resilience assessments. Under the revised section, such water systems are required to assess their system's vulnerabilities to natural hazards, in addition to malevolent acts. As a part of their assessment, water systems are required to evaluate the resilience of their current physical infrastructure, including "electronic, computer, or other automated systems (including the security of such systems)" and their management practices, as well as financial capacity to respond to these risks. For purposes of Sections 1433 and 1459A(l), "resilience" is defined as "the ability of a community water system ... to adapt to or withstand the effects of a malevolent act or natural hazard without interruption to ... a system's function, or if function is interrupted, to rapidly return to a normal operating condition" (42 U.S.C. §300i-2(h)). Based on the assessment, water systems must also develop emergency response plans that address the risks and resilience issues that systems may face. Water systems must certify their assessments and submit the certifications to EPA by deadlines specific to the communities' size. Water systems serving 3,300 or more persons must review their risk assessments every five years and update them, if needed.
Risk and resilience assessments and emergency response plans are voluntary for small water systems. AWIA amended SDWA to authorize appropriations of $10.0 million for grants to public water systems serving fewer than 3,300 people and grants to nonprofit organizations to support risk assessment and response planning activities (42 U.S.C. §300i-2(g)). Similar to P.L. 107-188, AWIA requires EPA provide guidance and technical assistance to small water systems on how to conduct resilience assessments, prepare emergency response plans, and address threats from natural hazards and malevolent acts (42 U.S.C. §300i-2(e)).
Water System Tampering Penalties
Originally established in 1974, Section 1432 provides for civil and criminal penalties against any person who tampers, attempts to tamper, or makes a threat to tamper with a public water system (42 U.S.C. §300i-1). Amendments made by P.L. 107-188 increased criminal and civil penalties for tampering, attempting to tamper, or making threats to tamper with public water supplies. The maximum prison sentence for tampering increased from 5 to 20 years. The maximum prison sentence for attempting to tamper, or making threats to tamper, increased from 3 to 10 years. The maximum fine for tampering increased from $50,000 to $1 million. The maximum fine for attempting to tamper, or threatening to tamper, increased from $20,000 to $100,000.
Emergency Powers
When information becomes available to EPA about imminent and substantial endangerment of drinking water and state and local officials have not acted, SDWA authorizes the EPA Administrator to take actions deemed necessary to protect public health. SDWA Section 1431 allows EPA to take actions upon receipt of information that a contaminant is present in or likely to enter a water system or underground source of drinking water, or when the agency is aware of a threatened or potential terrorist attack (or other intentional act) designed to disrupt the provision of "safe" drinking water (42 U.S.C. §300i). This authority is available to EPA if the appropriate state and local authorities have not acted to protect public health. When acting under this provision, EPA is required to coordinate with state and local authorities to verify that the EPA-received information is correct, to the extent practicable. EPA has issued orders under a number of circumstances, including for "vandalism with potential for contamination."
EPA Review of Methods
The Bioterrorism Preparedness Act added new responsibilities for EPA in Sections 1434 and 1435 (42 U.S.C. §§300i-3; 300i-4). Section 1435 directs EPA to review methods by which terrorists or others could contaminate or otherwise disrupt the provision of safe water supplies. Section 1434 requires EPA to review methods for preventing, detecting, and responding to such disruptions as well as methods for providing alternative drinking water supplies if a water system is destroyed or impaired. Section 1435(e) authorized $15 million for FY2002 and such sums as may be necessary for FY2003 through FY2005 to carry out SDWA Sections 1434 and 1435.
Financial Assistance
Congress has established several financial assistance programs to support the development of systems that supply safe and reliable water.
Drinking Water State Revolving Fund (DWSRF)
Authorized by Section 1452, the Drinking Water State Revolving Fund (DWSRF) is the key federal financial assistance program to help water systems finance infrastructure projects needed to comply with drinking water regulations and to meet health protection objectives (42 U.S.C. §300j-12). The DWSRF authorizes states to receive annual capitalization grants from EPA to provide primarily subsidized loans to water systems for drinking water projects and related activities. The Consolidated Appropriations Act, 2021 (P.L. 116-260) included an appropriation of $1.12 billion for DWSRF capitalization grants. Each year, each state must match 20% of its annual capitalization grant and develop an intended use plan (IUP) indicating how the allotted funds will be used. The act requires states to give funding priority to projects that address the most serious human health risks, are necessary to ensure compliance, and assist systems most in need on a per-household basis according to state affordability criteria. EPA's guidance provides examples of types of DWSRF-eligible projects (EPA 816-B-17-001). Infrastructure improvements for water system security or resilience are among the eligible projects listed in the guidance. These include projects that address "vulnerability of a water system to disruption of safe water delivery, whether natural or of human origin, capability to recover from disruption of safe water delivery, (and/or) a range of natural events capable of disruption, including flooding, long-term drought and earthquakes."
Risk and Resilience Grants
To increase the resilience of public water systems, SDWA Section 1433(g) directs EPA to establish the Drinking Water Infrastructure Risk and Resilience Program, and authorizes appropriations of $25.0 million for each of FY2020 and FY2021 for EPA to make grants to community water systems to plan or implement projects to increase their system's resiliency (42 U.S.C. §300i-2(g)). Congress has not appropriated funds for this purpose.
Emergency Assistance Grants
SDWA Section 1442(b) authorizes EPA to provide technical assistance and make grants to states and public water systems to assist in responding to and alleviating emergency situations (42 U.S.C. §300j-1(b)). Specifically, grants authorized by this subsection may be used only to support actions that are necessary (1) to prevent, limit, or mitigate danger to the public health in an emergency, and (2) that would otherwise not be taken without such emergency assistance, as determined by the Administrator. P.L. 107-188 amended Subsection 1442(d) to authorize appropriations for such emergency assistance of not more than $35 million for FY2002 and such sums as may be necessary for each fiscal year thereafter. Congress has not appropriated funds for this purpose.
Small and Disadvantaged Communities Risk and Resilience Grants
As amended by AWIA, SDWA Section 1459A(l) authorizes EPA to establish the Drinking Water System Infrastructure Resilience and Sustainability Program for small and disadvantaged public water systems (42 U.S.C. §300j-19a(l)). This section authorizes EPA to award grant funds to eligible water systems for projects that increase resilience to natural hazards and authorized appropriations of $4 million for each of FY2019 and FY2020. This program first received funding in FY2020 ($3 million) and received $4 million for FY2021.