Introduction

Dams may be used to provide flood control, navigation, drinking water, hydroelectric power, irrigation, recreation, fish and wildlife management, and/or waste management benefits. Construction of dams often causes environmental change (e.g., alteration of riverine habitat). Owning a dam also may require financial expenditures for operation and maintenance, rehabilitation (i.e., bringing a dam up to current safety standards), and repair. Federal agencies reported owning 3% of the more than 91,000 dams in the National Inventory of Dams (NID), including some of the country's largest dams (e.g., the Bureau of Reclamation's Hoover Dam in Nevada is 730 feet tall with storage capacity of over 30 million acre-feet of water).¹ Most dams in the United States are owned by private entities, state or local governments, or public utilities.

Dam failure and incidents—episodes that, without intervention, likely would have resulted in dam failure—may threaten public safety, local and regional economies, and the environment; they also may result in the loss of services provided by a dam.² Dams can deteriorate as they age, which may increase the risk of failures and incidents and thereby may increase the potential safety threat.³ Lack of maintenance and misoperation may amplify dam deterioration. Development in areas surrounding dams and their reservoirs may amplify the risks associated with dam deterioration. Security threats, such as cybersecurity attacks that could alter dam operations, are also a concern for dam safety. Seismic events, floods, and wildfire and associated debris flows also may impact dams. In recent years, several dam safety incidents have highlighted the public safety risks posed by the failure of dams and related facilities.

Congress has expressed an interest in dam safety over several decades, often prompted by destructive events. Dam failures in the 1970s that resulted in the loss of life and billions of dollars in property damage prompted Congress and the executive branch to establish the NID, the National Dam Safety Program (NDSP), and other federal activities related to dam safety.⁴ Following terrorist attacks on September 11, 2001, the federal government focused on dam security and the potential for acts of terrorism at major dam sites.⁵ As dams age and the population density near many dams increases, attention has turned to mitigating the risk of dam failure through dam inspection programs, rehabilitation, and repair, in addition to preventing and preparing for emergencies.⁶

This report provides an overview of dam safety and associated activities in the United States, highlighting the federal role in dam safety. The primary federal agencies involved in these activities include the Federal Emergency Management Agency (FEMA), the U.S. Army Corps of Engineers (USACE), the Bureau of Reclamation (Reclamation), and the Federal Energy Regulatory Commission (FERC). The report also discusses potential issues for Congress, such as the federal role in and funding for dam safety activities; adoption of risk-informed decisionmaking for dam safety; and awareness of dam safety risks and security issues. The report does not discuss in detail emergency response to a dam incident, dam building and removal policies, or state dam safety programs.

Safety of Dams in the United States

Dam safety generally focuses on preventing dam failure and incidents. Challenges to maintaining dam safety include aging and inadequately constructed dams, frequent or severe floods (for instance, due to climate change), misoperation of dams, and dam security.⁷ The risks associated with dam misoperation and failure also may increase as populations and development encroach on the areas upstream and downstream of some dams.⁸ Safe operation and proper maintenance of dams and associated structures is fundamental for dam safety. In addition, routine inspections by dam owners and regulators determine a dam's hazard potential (see "Hazard Potential," below) and possible needs for rehabilitation and repair.⁹

Dams by the Numbers

USACE maintains the NID, a database of dams in the United States.¹⁰ For a dam to be included in the NID, it must be an artificial barrier that has the ability to impound water, wastewater, or any liquid-borne material for the purpose of storage or control of water that (1) is at least 25 feet in height with a storage capacity of more than 15 acre-feet, (2) is greater than 6 feet in height with a storage capacity of at least 50 acre-feet, or (3) poses a significant threat to human life or property should it fail (i.e., high or significant hazard dams).¹¹ Thousands of dams do not meet these criteria; therefore, they are not included in the NID.

The most common type of dam is an earthen dam (see Figure 1), which is made from natural soil, rock, or mining waste materials. Other dam types include concrete dams, tailings dams (i.e., dams that store mining byproducts), overflow dams (i.e., dams regulating downstream flow), and dikes (i.e., dams constructed at a low point of a reservoir of water).¹² This report does not cover levees, which are manmade structures designed to control water movement along a landscape.

Figure 1. Illustration of an Earthen Dam

Source: FEMA, Pocket Safety Guide for Dams and Impoundments, 2016, at https://www.fema.gov/sites/default/files/2020-08/fema_911_pocket_safety_guide_dams_impoundments_2016.pdf. Notes: Earthen dams use natural materials, generally with minimum processing, and can be built with primitive equipment under conditions where any other construction material would be impracticable. Other dam types (e.g., concrete dams, tailings dams that store byproducts of mining operations) may have alternative design and structural components.

The nation's dams have been constructed for various purposes: recreation, flood control, ecological management (e.g., fisheries management), irrigation and water supply, hydroelectricity, mining, navigation, and others (see Figure 2). A dam may serve multiple purposes. Although some dams were built before 1900s (e.g., ~2,300 of the dams in the NID), nearly half of dams in the NID were built between 1950 and 1980 (over 43,000 NID dams).¹³ After this period, construction of new dams slowed (e.g., the NID lists a little over 4,700 dams built since 2000). Dams are built to the engineering and construction standards and regulations that apply at the time of their construction. As a result, some dams may not meet current dam safety standards, which have evolved over time as scientific data and engineering have improved.¹⁴ These dams may not operate properly or may even fail from certain flooding and seismic events that are now known to be possible at the site based on improved understanding of weather and flood data, such as probable maximum flood, and seismic data.

Figure 2. National Dam Statistics

Source: Congressional Research Service (CRS) with National Inventory of Dams (NID) data accessed at https://nid.sec.usace.army.mil on January 24, 2023, with data last updated on January 18, 2023. Notes: Some dams have multiple purposes. The "Ecological Purposes" category includes dams used for various fish and wildlife ponds or fire protection, and the "Other" category may include dams used for debris control and grade stabilization. A total of 17,577 dams in the NID had no age of construction reported.

Dam Failures and Incidents

Dam failures and incidents may occur for various reasons. Potential causes include floods that may exceed design capacity; faulty design or construction; misoperation or inadequate operation plans; overtopping, with water spilling over the top of the dam; foundation defects, including settlement and slope instability; cracking caused by movements, including seismic activity; inadequate maintenance and upkeep; and piping, when seepage through a dam forms holes in the dam (see Figure 3).¹⁵

Figure 3. Selected Potential Failure Modes of Dams

Source: FEMA, Pocket Safety Guide for Dams and Impoundments, 2016, at https://www.fema.gov/sites/default/files/2020-08/fema_911_pocket_safety_guide_dams_impoundments_2016.pdf. Notes: The figure is of an earthen dam; other dams may have different potential modes of failure. Some potential failure modes are not illustrated, such as spillway damage and sinkholes.

Engineers and organizations have documented dam failure in an ad hoc manner for decades.¹⁶ Some report over 1,600 dam failures resulting in approximately 3,500 casualties in the United States since the middle of the 19^th century, although these numbers are difficult to confirm.¹⁷ Between 2000 and 2020, states reported 270 failures and 581 non-failure dam safety incidents.¹⁸

A number of more recent dam incident and failure events have led to increased attention on the condition of dams and the federal role in dam safety. Many failures are of spillways and small dams, which may result in limited flooding and downstream impact compared to large dam failures. Flooding that occurs when a dam is breached may not result in life safety consequences or significant property damage.¹⁹ Still, some dam failures have resulted in notable disasters in the United States.²⁰ Some notable dam failures and incidents since 2000 include the following:

• In May 2020, following several days of heavy rain, two dams failed in Michigan, resulting in widespread flooding and the evacuation of approximately 10,000 downstream residents.²¹
• In March 2019, the latest dam failure fatality occurred when a hydropower dam in Nebraska failed because of an icy flood. There was no formal emergency action plan, because the dam was not classified as a high hazard potential dam.²². High hazard potential means the loss of at least one life is probable from a dam failure.
• In 2017, the near failure of Oroville Dam's spillway in California resulted in a precautionary evacuation of approximately 200,000 people and more than $1.1 billion in emergency response and repair.²³
• From 2015 to 2018, over 100 dams breached in North Carolina and South Carolina due to record flooding.²⁴
• Floods resulting from hurricanes in 2017 filled reservoirs of dams to record levels in some regions—for example, USACE's Addicks and Barker Dams in the Houston, TX, area; the Puerto Rico Electric Power Authority's Guajataca Dam in Puerto Rico; and USACE's Herbert Hoover Dike in Florida.²⁵
• The March 2006 failure of the private Ka Loko Dam in Hawaii killed seven people.²⁶
• The 2003 failure of the Upper Peninsula Power Company's Silver Lake Dam in Michigan caused more than $100 million in damage.²⁷

Hazard Potential

Federal guidelines set out a hazard potential rating to quantify the potential harm associated with a dam's failure or misoperation.²⁸ As described in Table 1, the three hazard ratings (low, significant, and high) do not indicate the likelihood of failure; instead, the ratings reflect the amount and type of damage that a failure would cause. Figure 4 depicts the number of dams listed in the NID that are classified as high hazard in each state; 60% of dams in the NID are classified as low hazard. From 2000 to 2023, thousands of dams were reclassified, increasing the number of high hazard dams from 9,921 to 14,934.²⁹ According to FEMA, the primary factor increasing dams' hazard potential is hazard creep—development upstream and downstream of a dam, especially in the dam failure inundation zone (i.e., downstream areas that would be inundated by water from a possible dam failure), that increases the potential consequences of a dam failure.³⁰ Reclassification from low hazard potential to high or significant hazard potential may trigger more stringent requirements by regulatory agencies, such as increased spillway capacity, structural improvements, more frequent inspections, and creating or updating an emergency action plan (EAP).³¹ Some of these requirements may be process and procedure based, and others may require structural changes for existing facilities.

Figure 4. High Hazard Dams in States and Territories

Source: CRS using National Inventory of Dams (NID) data accessed at https://nid.sec.usace.army.mil on January 24, 2023, with data last updated on January 18, 2023. Data for Texas are from 2019 NID data. Notes: Guam has one high hazard dam. The NID does not list dams from territories other than Guam and Puerto Rico.

Risk Management

Preventing dam failure involves proper location, design, and construction of structures and regular technical inspections, O&M, and rehabilitation and repair of existing structures.³² Preparing and responding to dam safety concerns may involve community development planning, emergency preparation, and stakeholder awareness.³³ Dam safety policies may address the risk that dams pose by focusing on preventing dam failure while preparing for the consequences if failure occurs.

Federal agencies and state dam safety agencies traditionally applied a deterministic, standards-based approach to dam safety by mainly considering a dam's structural integrity to determine how it would withstand maximum probable floods and maximum credible earthquakes. This approach resulted in these agencies providing condition assessments—assessments of relative dam deficiencies determined from inspections. The NID still includes condition assessments as reported by state agencies (see Table 2) and some federal agencies.³⁴ Of the 13,669 high hazard potential nonfederal dams in the NID as of January 2023, 61% had satisfactory or fair condition assessment, 15% had a poor or unsatisfactory condition assessment, and 24% were not rated.³⁵ For dams rated as poor and unsatisfactory, state regulatory agencies may take actions to reduce risk, such as reservoir drawdowns, and may convey updated risk and response procedures to stakeholders.³⁶

Some federal agencies (e.g., Reclamation, USACE, FERC) have since transitioned from this solely standards-based approach for their dam safety programs to a portfolio-wide risk-informed decisionmaking (RIDM) management approach to dam safety. These and other federal agencies working toward adopting a RIDM management approach no longer report condition assessment to the NID. Instead, some of these agencies use rating systems, such as the ones in Table 3. According to FEMA, "a risk-management approach seeks to improve the resilience of dam infrastructure and mitigate failure of dams and related structures through inspection programs, risk reduction measures, and rehabilitation and repair."³⁷ In the context of dam safety, risk comprises three parts:³⁸

• the likelihood of a triggering event (e.g., flood or earthquake),
• the likelihood of a dam safety deficiency resulting in adverse structural response (e.g., dam failure or spillway damage), and
• the magnitude of potential consequences resulting from the adverse event (e.g., loss of life or economic damages).

Evaluating and reducing risk requires a framework that explicitly evaluates the level of risk if no action is taken, including for all modes of failure (e.g., seepage of water and sediment through a dam), and recognizes the monetary and nonmonetary costs and benefits of reducing risks when making decisions. The RIDM framework comprises risk assessment, risk management, and risk communication. The RIDM assessment process aims to inform better decisionmaking and to enable more effective use of limited resources. Some state dam safety agencies (e.g., Colorado) also are working to incorporating a risk management approach.³⁹

Rehabilitation and Repair

Rehabilitation typically consists of bringing a dam up to current safety standards (e.g., increasing spillway capacity, installing modern gates, addressing major structural deficiencies), and repair addresses damage to a structure. Rehabilitation and repair are different from day-to-day O&M. In 2022, the Association of State Dam Safety Officials estimated that $75.7 billion was needed to rehabilitate nonfederal dams; of that amount, $24.0 billion was needed for high hazard potential nonfederal dams.⁴⁰ Federal agencies report various funding estimates needed for rehabilitation and repair of dam that they manage. Some stakeholders project that funding requirements for dam safety rehabilitation and repair will continue to grow as infrastructure ages, risk awareness progresses, and design standards evolve.⁴¹

Preparedness

Dam safety processes and products—such as EAPs and inundation maps—may support informed decisionmaking to reduce the risk and consequences of dam failures and incidents.⁴² An EAP is a formal document that identifies potential emergency conditions at a dam and specifies preplanned actions to minimize property damage and loss of life.⁴³ EAPs identify the actions and responsibilities of different parties in the event of an emergency, such as the procedures for issuing early warning and notification messages to emergency management authorities. EAPs also contain inundation maps to show emergency management authorities the critical areas for action in case of an emergency (see Figure 5 for a map illustration of potential inundation areas due to a hypothetical dam breach).⁴⁴ Many agencies that are responsible for dam oversight require or encourage dam owners to develop EAPs and often oversee emergency response simulations (i.e., tabletop exercises) and field exercises.⁴⁵ Requirements for EAPs often focus on high hazard dams. In 1999, 35% of state regulated high hazard potential dams had EAPs.⁴⁶ In January 2023, the percentage of high hazard potential dams in the United States with EAPs was 82% for state-regulated dams and 97% for federally owned dams.⁴⁷

Figure 5. USACE Potential Flood Inundation Map for Isabella Dam

Source: CRS with data from National Inventory of Dams (NID) data accessed at https://nid.sec.usace.army.mil. Notes: Flood inundation maps illustrate how far flood water may extend beyond the river channel by overlaying a shaded zone on a map of the river and its surrounding topography. These maps also show how deep the flood waters are anticipated to be for various flood scenarios. These projected flood depths are displayed as ranges (in feet) for specific sections of the potentially flooded areas. In particular, the U.S. Army Corps of Engineers (USACE) develops a set of flood inundation maps for each of its dams by modeling a limited set of standard flooding scenarios. The map above is for a hypothetical breach occurring at USACE's Isabella Dam when water levels are at the top of the active storage pool. USACE completed dam safety modification construction in 2022; this scenario is based on modeling from before this construction project. Flood inundation maps are designed to show the upper limit of potential impacts. Not all the standard flooding scenarios are equally likely to occur, and the maps are not intended to be predictive of what situations will occur. Flood inundation maps are available in the NID for most USACE dams. Currently, most other federal agencies do not publicly release inundation maps for federally owned dams. Some states, such as California, provide flood inundation map information on their own websites.

Federal agencies have developed tools to assist dam owners and regulators, along with emergency managers and communities, to prepare for, monitor, and respond to dam failures and incidents.

• FEMA's RiskMAP program provides flood maps, tools to assess the risk from flooding, and planning and outreach support to communities for flood risk mitigation.⁴⁸ A RiskMAP project may incorporate the potential risk of dam failure or incidents.
• FEMA's Decision Support System for Water Infrastructure Security (DSS-WISE) Lite allows states to conduct dam failure simulations and human consequence assessments.⁴⁹ Using DSS-WISE Lite, FEMA conducted emergency dam-break flood simulation and inundation mapping of 36 dams in Puerto Rico during the response to Hurricane Maria in 2017.
• DamWatch is a web-based monitoring and informational tool for 11,800 nonfederal flood control dams built with assistance from the U.S. Department of Agriculture.⁵⁰ When these dams experience a critical event (e.g., threatening storm systems), essential personnel are alerted via an electronic medium and can implement EAPs if necessary.
• The U.S. Geological Survey's ShakeCast is a post-earthquake awareness application that notifies responsible parties of dams about the occurrence of a potentially damaging earthquake and its potential impact at dam locations.⁵¹ The responsible parties may use the information to prioritize response, inspection, rehabilitation, and repair of potentially affected dams.

Federal Role and Resources for Dam Safety

In addition to owning dams, the federal government is involved in multiple areas of dam safety through legislative and executive actions. Following USACE's publication of the NID in 1975 as authorized by P.L. 92-367, the Interagency Committee on Dam Safety—established by President Jimmy Carter through Executive Order 12148—released safety guidelines for dams regulated by federal agencies in 1979.⁵² In 1996, the National Dam Safety Program Act (Section 215 of the Water Resources Development Act of 1996, as amended; P.L. 104-303; 33 U.S.C. §§ 467 et seq.) established the National Dam Safety Program (NDSP), the nation's principal dam safety program, under the direction of FEMA. Congress has reauthorized the NDSP and enacted other dam safety programs and activities related to federal and nonfederal dams.⁵³ A chronology of selected federal dam safety actions is provided in the box below.

National Dam Safety Program

The NDSP is a federal program established to facilitate collaboration among the various federal agencies, states, and owners with responsibility for dam safety.⁵⁴ The NDSP also provides dam safety information resources and training, conducts research and outreach, and supports state dam safety programs with grant assistance. The NDSP does not mandate uniform standards across dam safety programs.

Advisory Bodies of the National Dam Safety Program

The National Dam Safety Review Board (NDSRB) advises FEMA's director on dam safety issues, including the allocation of grants to state dam safety programs. The board is to consist of five representatives appointed from federal agencies, five state dam safety officials, and one representative from the private sector.⁵⁵ The Interagency Committee on Dam Safety (ICODS) serves as a forum for coordination of federal efforts to promote dam safety. ICODS is chaired by FEMA and is to include representatives from FERC, the International Boundary and Water Commission, the Nuclear Regulatory Commission (NRC), the Tennessee Valley Authority, and the Departments of Agriculture, Defense, Energy, the Interior (DOI), and Labor (DOL).⁵⁶

Assistance to State Dam Safety Programs

Every state (except Alabama) has established a regulatory program for dam safety, as has Puerto Rico.⁵⁷ Collectively, these programs have regulatory authority for 71% of the NID dams.⁵⁸ State dam safety programs typically include safety evaluations of existing dams, review of plans and specifications for dam construction and major repair work, periodic inspections of dams and construction work on new and existing dams, reviews and approval of EAPs required for certain dams,⁵⁹ and engagement with local officials and dam owners on emergency preparedness activities.⁶⁰ Funding levels and narrow state statutory authorities may limit the activities of some state dam safety programs.⁶¹ In 2021, 15 states had more than seven full-time employees in their dam safety program.⁶² In addition, some states—Alabama, Florida, Indiana, Kentucky, Vermont, and Wyoming—have not provided regulatory bodies with the authority to require dam owners of high hazard potential dams to develop EAPs.⁶³ However, state budgets, and accordingly staffing levels, have increased over the past couple decades (e.g., 317 full-time employees in 1999 compared with nearly 455 full-time employees in 2022).⁶⁴

The National Dam Safety Program Act authorizes state assistance programs under the NDSP. This assistance includes (1) grant assistance to state dam safety programs that are working toward or meeting minimal requirements as established by the National Dam Safety Program Act,⁶⁵ (2) grants for rehabilitation of high hazard potential dams, and (3) trainings for state inspectors, among other assistance. For more information on NDSP assistance for states, see CRS Report R47383, Federal Assistance for Nonfederal Dam Safety.

National Dam Safety Program Reporting

At the end of each odd-numbered fiscal year, FEMA is to submit to Congress a report describing the NDSP's status, federal agencies' progress at implementing the Federal Guidelines for Dam Safety, progress achieved in dam safety by states participating in the program, and any recommendations for legislation or other actions (33 U.S.C. § 467h).⁶⁶ Federal agencies and states provide FEMA with annual program performance assessments on key metrics such as inspections, rehabilitation and repair activities, EAPs, staffing, and budgets. USACE provides summaries and analysis of NID data (e.g., inspections and EAPs) to FEMA. FEMA published The National Dam Safety Program Biennial Report to the United States Congress, Fiscal Years 2018–2019 on November 17, 2022.⁶⁷ As of March 2023, FEMA had not published a biennial report covering subsequent years.

Federally Owned Dams

Federally owned dams are dams owned by the federal government that are managed by one or more federal agencies. The federal government is responsible for maintaining dam safety of federally owned dams by performing maintenance, inspections, rehabilitation, and repair work. No single agency regulates all federally owned dams; rather, each federal dam is regulated according to the policies and guidance of the individual federal agency that owns the dam.⁶⁸ The Federal Guidelines for Dam Safety provides basic guidance for federal agencies' dam safety programs.⁶⁹

According to the NID, in January 2023, federal agencies reported managing 2,825 federal dams, with some dams managed by multiple federal agencies (Figure 6).⁷⁰ Federally owned dams may be under the jurisdiction of three broad categories of federal agencies:

• Agencies that primarily manage water resources—USACE and Reclamation—manage 42% of federal dams in the NID, including many large dams. Dams managed by these agencies may be located on lands managed by other agencies.
• Agencies that manage most federal lands, collectively known as the federal land management agencies (i.e., the Bureau of Land Management, U.S. Fish and Wildlife Service, Forest Service [FS], and National Park Service), manage 39% of federal dams in the NID, which are typically smaller dams.
• Agencies that manage the remainder of federal dams, such as the Department of Defense and the Tennessee Valley Authority.

Figure 6. Location of Federal Dams and Number of Dams Owned per Agency

Source: CRS using National Inventory of Dams (NID) data accessed at https://nid.sec.usace.army.mil on January 24, 2023, with data last updated on January 18, 2023. Notes: No federal dams are in Puerto Rico, and one is in Guam. In addition to the agencies shown in the figure, the U.S. Department of Agriculture's Agricultural Research Service owns one high hazard dam. Multiple federal agencies may own a dam. USACE = U.S. Army Corps of Engineers, FS = Forest Service, BOR = Bureau of Reclamation, FWS = U.S. Fish and Wildlife Service, BLM = Bureau of Land Management, DOD = Department of Defense, BIA = Bureau of Indian Affairs, TVA = Tennessee Valley Authority, NPS = National Park Service, DOE = Department of Energy, IBWC = International Boundary and Water Commission.

The Federal Guidelines for Dam Safety recommend that agencies formally inspect each dam that they own at least once every five years; however, some agencies require more frequent inspections and base the frequency of inspections on the dam's hazard potential or their risk-management approach.⁷¹ Inspections may result in an update of the dam's hazard potential, among other categorical amendments. After identifying dam safety deficiencies, federal agencies may undertake risk reduction measures (e.g., nonstructural operation changes) or rehabilitation and repair activities. Agencies may not have funding available to immediately undertake all nonurgent rehabilitation and repair; rather, they generally prioritize their rehabilitation and repair investments based on various forms of assessment and schedule these activities in conjunction with the budget process.⁷² At some agencies, dam rehabilitation and repair needs must compete for funding with other construction projects (e.g., buildings and levees).⁷³ The following sections briefly discuss dam safety activities at the three agencies managing the most federal dams.

U.S. Army Corps of Engineers

USACE implements a dam safety program consisting of inspections and risk analyses for USACE-operated dams, and performs risk reduction measures or project modifications to address dam safety risks.⁷⁴ USACE uses a risk-informed approach for all dam safety program decisions and applies the Dam Safety Action Classification System (DSAC), which is based on the likelihood of failure in combination with loss of life, economic, or environmental consequences (see Table 3).⁷⁵

Congress provides funding for USACE's various dam safety activities through the Investigations, O&M, and Construction accounts.⁷⁶ The Inventory of Dams line item in the Investigations account provides funding for the maintenance and publication of the NID. The O&M account provides funding for routine O&M of USACE dams and for NDSP activities, including assessments of USACE dams.

The Construction account provides funding for nonroutine dam safety activities (e.g., dam safety rehabilitation and repair modifications).⁷⁷ The Dam Safety and Seepage/Stability Correction Program conducts nonroutine dam safety evaluations and studies of extremely high-risk or very high-risk dams (DSAC 1 and DSAC 2).⁷⁸ Under the program, an issue evaluation study may evaluate high-risk dams, dam safety incidents, and unsatisfactory performance, and then provide determinations for modification or reclassification. If recommended, a dam safety modification study would further investigate dam deficiencies and propose alternatives to reduce risks to tolerable levels; a dam safety modification report is issued if USACE recommends a modification.⁷⁹ USACE funds construction of dam safety modifications through project-specific line items in the Construction account. Modification of USACE-constructed dams for safety purposes may be cost shared with nonfederal project sponsors using two cost-sharing authorities: major rehabilitation and dam safety assurance (see below).⁸⁰ USACE schedules modifications under all of these programs based on funding availability.

Major rehabilitation is for significant, costly, one-time structural rehabilitation or major replacement work. Major rehabilitation applies to dam safety repairs associated with typical degradation of dams over time. Nonfederal sponsors are to pay the standard cost share based on authorized purposes. USACE does not provide support under major rehabilitation for facilities that were turned over to local project sponsors for O&M after they were constructed by USACE.

Dam safety assurance cost sharing may apply to all dams built by USACE, regardless of the entity performing O&M. Modifications are based on new hydrologic or seismic data or changes in state-of-the-art design or construction criteria that are deemed necessary for safety purposes. Application of the authority provided by Section 1203 of the Water Resources Development Act of 1986 (P.L. 99-662; 33 U.S.C. §467n) reduces a sponsor's responsibility to 15% of its agreed nonfederal cost share.⁸¹

Bureau of Reclamation

Reclamation's dam safety program, authorized by Reclamation Safety of Dams Act of 1978, as amended (P.L. 95-578; 43 U.S.C. §§506 et seq.), provides for inspection of and repairs to qualifying projects at Reclamation dams. Reclamation conducts dam safety inspections through the Safety Evaluation of Existing Dams (SEED) program using Dam Safety Priority Ratings (DSPR; see Table 3).⁸² Corrective actions, if necessary, are carried out through the Initiate Safety of Dams Corrective Action (ISCA) program. With ISCA appropriations, Reclamation funds modifications on priority structures based on an evolving identification of risks and needs.

The Reclamation Safety of Dams Act Amendments of 1984, as amended (P.L. 98-404; 42 U.S.C. §§506 et seq.) requires a 15% cost share from sponsors for dam safety modifications when modifications are based on new hydrologic or seismic data or changes in state-of-the-art design or construction criteria that are deemed necessary for safety purposes. Costs resulting from age and normal deterioration or lack of maintenance of structures are considered project costs and are allocated and deemed reimbursable based on the authorized project purposes and existing law. In 2015, P.L. 114-113 amended the Reclamation Safety of Dams Act to increase Reclamation's authority, before needing congressional authorization to approve a modification project, from $1.25 million to $20 million.⁸³ The act also authorized the Secretary of the Interior to develop additional project benefits, through the construction of new or supplementary works on a project in conjunction with dam safety modifications, if such additional benefits are deemed necessary and in the interests of the United States and the project. Nonfederal and federal funding participants must agree to a cost share related to the additional project benefits. ⁸⁴

The Commissioner of Reclamation also serves as the DOI's chair for the DOI Working Group on Dam Safety and Security and advises the Secretary of the Interior on program development and operation of the dam safety programs within DOI.⁸⁵ In this role, Reclamation provides training to other DOI agencies with dam safety programs and responsibilities, and Reclamation's dam safety officer represents DOI on the ICODS.⁸⁶

U.S. Forest Service⁸⁷

The FS manages dams on its lands, within the National Forest System (NFS), and may authorize nonfederal entities to use NFS lands for dams through a special use authorization (SUA; see box on "Nonfederal Dams on Federal Lands").⁸⁸ In addition, dams managed by other federal agencies (e.g., USACE, Reclamation) are located on NFS lands; the federal agency managing the dam has responsibility for those dams.

FS policies provide for general requirements and procedures for FS dams, such as classification, O&M plans, EAPs, and construction and design criteria.⁸⁹ FS policy requires NFS units to have a systematic dam inspection program, through which dams' maintenance needs, hazardous situations, operations, and other attributes are monitored.⁹⁰ Any dam with "deficiencies that significantly affect the integrity of the facility" must be repaired as soon as possible, or removed from service until repairs can be made if needed to protect human life or surrounding lands and resources.⁹¹ The FS also requires routine hazard assessments, through which consequences of dam failure are evaluated.⁹²

The FS typically uses general funding for capital improvement, maintenance, and deferred maintenance,⁹³ which includes dams, roads, structures, and other FS-managed infrastructure. Therefore, funding for dams, particularly major maintenance or rehabilitation (i.e., activities that cost more than $250,000), competes for funding along with other infrastructure projects in the FS's capital improvement prioritization procedures.⁹⁴ To the extent that FS dams have deferred maintenance needs, they could be eligible for deferred maintenance funding provided in discretionary or mandatory appropriations, such as mandatory funding from the National Parks and Public Land Legacy Restoration Fund established by the Great American Outdoors Act.⁹⁵ According to the agency, the FS attempts to prioritize its high hazard dams or addressing urgent safety situations when determining how to use its limited resources.

Federal Oversight of Nonfederal Dams

Some federal agencies are involved in dam safety activities of nonfederal dams; these activities may be regulatory or consist of voluntary coordination (see box on "Nonfederal Dams on Federal Lands").

Congress has enacted legislation to regulate hydropower projects, certain mining activities, and nuclear facilities and materials.⁹⁶ These largely nonfederal facilities and activities may utilize dams for certain purposes. States also may have jurisdiction or ownership over these facilities, activities, and associated dams, and therefore may oversee dam safety in coordination with applicable federal regulations.⁹⁷

Regulation of Hydropower Dams

Under the Federal Power Act (16 U.S.C. §§791a-828c), FERC has the authority to issue licenses for the construction and operation of hydroelectric projects, among other things.⁹⁸ Many of these projects involve dams, some of which may be owned by a state or local government. According to FERC, the agency regulates over 2,500 dams.⁹⁹ Of these, 1,754 are nonfederal dams listed in the NID as of January 2023; 807 of these nonfederal dams are classified as high hazard, with 147 in California, 86 in New York, and 69 in Michigan.¹⁰⁰ Before FERC can issue a license, FERC reviews and approves the designs and specifications of dams and other structures for the hydropower project. Each license is for a stated number of years (generally 30-50 years), and must undergo a relicensing process at the end of the license.

Along with nonfederal hydropower licensing, FERC is responsible for dam inspection during and after construction.¹⁰¹ FERC staff are to inspect regulated dams at regular intervals.¹⁰² The owners of projects with dams higher than 32.8 feet or with a total storage capacity of more than 2,000 acre-feet are required to contract independent consulting engineers, approved by FERC, for more thorough inspections every five years.¹⁰³ Should any inspection identify a deficiency, FERC would require the project owner to submit a plan and schedule to remediate the deficiency.¹⁰⁴ FERC then is to review, approve, and monitor the corrective actions until licensees have addressed the deficiency.¹⁰⁵ If a finding is highly critical, FERC has the authority to require risk-reduction measures immediately; these measures often include reservoir drawdowns.¹⁰⁶

FERC Response to Selected Hydropower Incidents

Following the spillway incident in 2017 at Oroville Dam, CA, a federal after-action panel and a state forensic team released reports in 2018 that raised questions about the thoroughness of FERC's oversight of dam safety.¹⁰⁷ Among other findings, the panel's report concluded that the established FERC inspection process, if properly implemented, would address most issues that could result in a failure. However, the panel's report stated that several failures occurred in the last decade because certain technical details, such as spillway components and original design, were overlooked and not addressed in the inspection or by the owner.¹⁰⁸ A 2018 GAO review also found that FERC had been prioritizing individual dam inspections and responses to urgent dam safety incidents, but had not conducted portfolio-wide risk analyses.¹⁰⁹ In response, FERC reported in 2021 that it had completed a screening-level risk analysis of 754 high and significant hazard dams in its portfolio and initiated 24 projects to address the risks it identified.¹¹⁰ In addition, FERC produced draft guidelines in 2016 for RIDM, with a similar risk management approach as USACE and Reclamation.¹¹¹ FERC has allowed dam owners—generally those with a portfolio of dams—to pilot RIDM, using the draft guidelines, for their inspections and prioritizing rehabilitation and repairs instead of using the current deterministic, standards-based approach.¹¹²

Based on these evaluations and other reasons, FERC revised 18 C.F.R. §12, which went into effect April 11, 2022.¹¹³ FERC revised the independent-consultant safety-inspection program, described above, so that the required scope of these inspections alternates between a new, more in-depth comprehensive assessment and a periodic inspection.

• Periodic inspections are to focus on the performance of the project over the previous five years and include a field inspection, a review of project operations, an in-depth review of monitoring data trends and behavior, and an evaluation of whether any potential failure modes are occurring.¹¹⁴
• Comprehensive assessments are to include a deep dive into every aspect of a project, including detailed review of the project's design, engineering analyses, and construction history; evaluation of spillway adequacy; potential failure mode analysis; and risk analysis.¹¹⁵

The regulation update also changed the process by which FERC reviews and evaluates the qualifications of independent consultants that conduct the inspections and assessments. Inspections are now to be conducted by an independent consultant team, which may consist of one or more independent consultants as well as additional supporting team members. The regulation update also included revised safety incident reporting, revised definitions, and codified FERC's existing Owner's Dam Safety Program requirement.¹¹⁶ In addition, FERC published four new engineering guideline chapters that provide further guidance related to the regulatory changes.¹¹⁷

Regulation of Dams Related to Mining

At mining sites, dams may be constructed for water supply, water treatment, sediment control, or the disposal of mining byproducts and waste (i.e., tailings dams).

Under the Federal Mine Safety and Health Act of 1977, as amended (P.L. 91-173; 30 U.S.C. §§801 et seq.), the Department of Labor's Mine Safety and Health Administration (MSHA) regulates private dams used in or resulting from mining.¹¹⁸ According to MSHA, approximately 1,640 dams are in its inventory. Of these, 520 are listed in the NID as of January 2023, with 255 classified as high hazard.¹¹⁹ As a regulator, MSHA develops standards and conducts reviews, inspections, and investigations to ensure mine operators comply with those standards. According to agency policies, MSHA is to inspect each surface mine and associated dams at least two times a year and each underground mine and associated dams at least four times a year.¹²⁰

Under Title V of the Surface Mining Control and Reclamation Act of 1977, as amended (SMCRA; P.L. 95-87; 30 U.S.C. §§1251-1279), DOI's Office of Surface Mining Reclamation and Enforcement (OSMRE) administers the federal government's responsibility to regulate active coal mining operations to minimize environmental impacts during mining and to reclaim affected lands and waters after mining.¹²¹ OSMRE regulations require coal mining operators to demonstrate that dams are constructed, maintained, and removed in accordance with federal standards (30 C.F.R. §715.18).¹²² According to the 2021 DOI Annual Report on Dam Safety, OSMRE regulates 69 dams at coal mines under OSMRE's federal and Indian lands regulatory authority.¹²³ Twenty-four states have primary regulatory authority (i.e., primacy) for dams under SMCRA authority: for primacy, states must meet the requirements of SMCRA and be no less effective than the federal regulations.¹²⁴ If the dam is noncompliant with the approved design at any time during construction or the life of the dam's operation, OSMRE or the approved state regulatory authority is to instruct the coal mining operator to correct the deficiency immediately or cease operations.¹²⁵

Regulation of Dams Related to Nuclear Facilities and Materials

The Nuclear Regulatory Commission (NRC) was established by the Energy Reorganization Act of 1974 (P.L. 109-58; 42 U.S.C. §§5801 et seq.) as an independent federal agency to regulate and license nuclear facilities and the use of nuclear materials as authorized by the Atomic Energy Act of 1954, as amended (P.L. 83-703).¹²⁶ Among its regulatory licensing responsibilities pertaining to dams, NRC regulates uranium mill tailings dams, storage water pond dams at in situ leach (ISL) uranium recovery facilities, and dams integral to the operation of other licensed facilities that may pose a radiological safety-related hazard should they fail.¹²⁷ Currently, NRC directly regulates seven dams.¹²⁸ If NRC shares regulatory authority with another federal agency (e.g., FERC, USACE, Reclamation), NRC defers regulatory oversight of the dam to the other federal agency.¹²⁹ Under NRC's authority to delegate regulatory authority, states may regulate dams associated with nuclear activities based on agreements with NRC (i.e., agreement state programs).¹³⁰

Federal Support for Nonfederal Dams

Nonfederal dam owners generally are responsible for investing in the safety, rehabilitation, and repair of their dams.¹³¹ In 2022, the Association of State Dam Safety Officials estimated that $75.7 billion was needed to rehabilitate nonfederal dams; of that amount, $24.0 billion was needed for high hazard potential nonfederal dams.¹³² Currently, 22 states provide a limited amount of assistance for these activities (e.g., rehabilitation, repair) through grant or low-interest revolving loan programs.¹³³ Some federal programs may specifically provide limited assistance to nonfederal dams that meet various eligibility criteria (e.g., the Small Watershed Rehabilitation Program is only available to dams that were originally constructed with assistance from the Natural Resources Conservation Service); these programs are in Table 4 and described in CRS Report R47383, Federal Assistance for Nonfederal Dam Safety.¹³⁴

Issues for Congress

Congress may consider oversight and legislation relating to dam safety in the larger framework of infrastructure improvements and risk management or as an exclusive area of interest. The following sections discuss selected issues that may be of interest. Some of these issues relate to many of the nation's dams and the federal agencies involved in their dam safety activities (e.g., security issues). Other issues focus on specific types of dams (e.g., dams eligible for funding from the Infrastructure Investment and Jobs Act [IIJA; P.L. 117-58]) or specific federal agencies (e.g., the National Oceanic and Atmospheric Administration [NOAA] updating methodologies for probable maximum precipitation studies). In some cases, certain federal agencies have pioneered new policies or approaches to dam safety activities (e.g., USACE disclosing inundation map data for most of its facilities; FERC changing regulations to address risk considerations) that Congress may be interested in evaluating and potentially facilitating adoption by other federal agencies. If Congress chooses to address a certain dam safety issue, Congress may first consider which dams and federal agencies are the focus of that issue, then strategize legislation and oversight efforts targeting those dams and/or agencies.

Federal Role and Funding for Dam Safety Activities

Since the 1970s, the federal government has developed and overseen national dam safety standards, and it has increasingly provided technical and grant assistance for nonfederal dam safety. These activities, as well as the enhancement of federal agencies' dam safety programs, have improved certain dam safety metrics; nonetheless, deficiencies in federal and state programs may have contributed to recent incidents. Congress may consider oversight activities related to federal implementation of dam safety practices. For example, in 2017, the Senate Committee on Appropriations directed USACE, Reclamation, and FERC to brief the Senate Committee on Appropriations on efforts to incorporate lessons learned from the failure of Oroville Dam's spillway into dam inspection protocols across all three agencies and their state partners.¹³⁵ Although incidents and reviews may result in recommending improvements to federal dam safety programs, some agencies have reported financial and other limitations to revising or expanding their dam safety programs.¹³⁶ Congress may consider these obstacles in determining whether new authorities or appropriations are needed. For example, in the 117^th Congress, the Twenty-First Century Dams Act (H.R. 4375/S. 2356) would have authorized a national dam inspection program and a national dam assessment, in addition to increasing authorization of appropriations for various federal agency dam activities and programs.

Individual dam O&M, rehabilitation, and repair costs can range from thousands to hundreds of millions of dollars.¹³⁷ The responsibility for these expenses lies with dam owners; however, many nonfederal dam owners are not willing or able to fund these costs.¹³⁸ Although some states have created a state-funded grant or low-interest revolving loan program to assist dam owners with repairs, ASDSO notes that existing programs seem to vary significantly in the scope and reach of available financial assistance.¹³⁹ Some stakeholders suggest another financial mechanism for supporting dam safety would be public-private partnerships, particularly supported by beneficiaries of dam services.¹⁴⁰ Congress provides regular appropriations for federal agency dam safety activities and programs, and in the 117^th Congress, the IIJA provided an influx of funding for some of these and other programs that may support dam safety.

Infrastructure Investment and Jobs Act

The IIJA provided supplemental appropriations to Reclamation's dam safety program, to the NDSP for its activities and grants, and for programs that may support nonfederal dam safety projects (see Table 5).

Congress may conduct oversight of these agencies' use of the appropriated funds, which may be in different stages of implementation. For example, Reclamation has released spend plans for FY2022 through FY2023,¹⁴¹ whereas other agencies are first developing policy and procedures for new programs (e.g., USACE's proposed rule for the Corps Water Infrastructure Financing Program and request for information for DOE's Maintaining and Enhancing Hydroelectricity Incentives).¹⁴² FEMA's NDSP is conducting listening sessions in FY2023 to determine how best to administer its funds based on the needs and capacity of state dam safety agencies and dam owners.¹⁴³ Some attendees of the initial sessions petitioned for flexibility to implement potential increased grant funding (e.g., ability to use funding over multiple fiscal years), among other concerns.

Another potential oversight issue includes agencies' capacity to administer this level of awards, contracts, and procurements and to perform project management and oversight. For example, in December 2022, DOI described challenges in increasing staffing at Reclamation to implement IIJA activities (e.g., hiring staff with necessary engineering and hydrology expertise).¹⁴⁴ Congress also may consider how to measure the effectiveness of these investments in improving national dam safety and what future level of appropriations to provide to these activities and programs while they implement IIJA funding. For example, Congress provided less funding to the Small Watershed Rehabilitation Program in FY2022 and noted that the reduction was based on IIJA additions.¹⁴⁵

Adoption of Risk-Informed Decisionmaking

The dam safety community has increasingly espoused the benefits of shifting dam safety programs from a standards-based approach to an RIDM approach; however, many programs face hurdles to implementing RIDM policies.¹⁴⁶ Reclamation and USACE were the first agencies to implement RIDM management; these agencies also have more resources and expertise to manage their large dam portfolios than most other federal and state agencies. Following the 2017 incident at Oroville Dam, some federal and state agencies have increased efforts to incorporate RIDM into management of their dam safety portfolios. For example, FERC has allowed owners to pilot RIDM using draft guidelines it published in 2016, and the agency updated its regulations in 2022 to include comprehensive inspections in its inspection program, among other updates. Colorado's Dam Safety Program has developed comprehensive dam safety evaluation tools to enable potential failure mode analysis and has created semi-quantitative risk assessment analyses to enable repeatable assessments across its regulatory dam portfolio.¹⁴⁷ While dam safety experts say RIDM and its components (e.g., comprehensive assessments) are needed to prevent incidents such as those experienced recently,¹⁴⁸ incorporating these practices may require development of new guidelines, certain personnel expertise, and more financial resources.¹⁴⁹ For example, comprehensive assessments are more costly than visual inspections and can require certain inspection expertise.

Congress may consider whether, and if so how, to support the adoption and implementation of RIDM approaches for dam safety. For example, Congress may conduct oversight of the NDSP's efforts to support dam safety agencies' and communities' adoption of RIDM policies. In September 2022, FEMA stated that the NDSRB's working group on risk was developing a risk matrix and respective tools and training for dam agencies to implement the matrix.¹⁵⁰ FEMA could update the Federal Guidelines for Dam Safety to further incorporate aspects of RIDM. IIJA appropriations of $67 million for the NDSP supports authorized activities of the program, which may include training and other activities to advance RIDM adoption and implementation. For example, this IIJA funding could potentially support activities such as FEMA's collaborative technical assistance series, which is to help communities at risk of dam-related flooding to better understand their risk landscape and the potential consequences of dam-related emergencies.¹⁵¹ Congress could also require certain aspects of RIDM policies in authorities for dam safety programs. For example, the authority for the FEMA's Rehabilitation of High Hazard Potential Dam Grant Program requires that tribal or local governments with jurisdiction over the area in which a dam receiving the grant is located has in place a hazard mitigation plan that includes all dam risks and complies with the Disaster Mitigation Act of 2000 (P.L. 106-390).¹⁵² While these requirements may ultimately improve RIDM practices, these requirements can result in application burdens for communities that are unfamiliar with these policies or do not have the resources to implement them.

Incorporating Future Conditions for Risk Management

Understanding how risk may change over time is also an aspect of RIDM. National probable maximum precipitation (PMP) studies have long been used for regulation and design of infrastructure, including dams, but the federal government has not updated PMP studies or methodologies to capture precipitation patterns and events of recent decades and the potential impacts of climate change.¹⁵³ According to the World Meteorological Organization,

The objective of a probable maximum precipitation (PMP) estimate is to calculate the probable maximum flood (PMF) used in the design of a given project at a particular geographical location in a given watershed, and to further provide information that could assist in designing the size (dam height and reservoir storage capacity) of the given project and dimension of the flood-carrying structures (spillway and flood carrying tunnel) of the project.¹⁵⁴

NOAA first developed methodologies for estimating PMP in the 1940s and applied them across the nation through studies in the late 20^th century.¹⁵⁵ State dam safety programs developed statutes, rules, and guidance documents for the design of facilities partly based on these studies.¹⁵⁶ Given that increased atmospheric moisture is an anticipated climate change effect, dam safety officials and engineers have petitioned for updated extreme precipitation estimation tools that can inform design and risk understanding of dams and associated structures under these future conditions.¹⁵⁷ NOAA has not officially updated these studies or methodologies to include new methods, technologies, or decades of more recent storm data libraries.¹⁵⁸ Some state dam safety programs have started to employ new studies conducted by entities outside the federal government,¹⁵⁹ or have created methodologies to consider the range of impacts due to a changing climate specific to their state.¹⁶⁰ Others find these alternatives too difficult to attempt.¹⁶¹ Some federal agencies have conducted site-specific PMP studies for certain facilities or are piloting their own methodologies.¹⁶² For example, USACE has evaluated numerical weather model-based precipitation maximization methods for areas dominated by atmospheric rivers.¹⁶³ This varied practice has led to inconsistencies between minimum dam-related design criteria, including for repair and rehabilitation of dams and associated spillways, and understanding of risk among federal and state agencies.¹⁶⁴

IIJA provided appropriations for NOAA to develop "next-generation water modeling activities, including modernized precipitation frequency and probable maximum studies."¹⁶⁵ This process is starting with a National Academy of Sciences, Engineering, and Medicine (NASEM) study to recommend an updated approach for estimating PMP in a changing climate, appropriate for decisionmaker needs.¹⁶⁶ The Providing Research and Estimates of Changes in Precipitation Act (PRECIP Act; Division D of P.L. 117-229) authorized this study, including certain study requirements. The act also directed NOAA to

• develop and publish a national guidance document two years after the study, to be updated at least every 10 years, that provides best practices that can be followed by regulatory agencies and other users;
• update and publish PMP estimates for the nation 6 years after the study and updated at least every 10 years; and
• conduct research in the field of extreme precipitation estimation with partners.

Despite these efforts, concerns remain that NOAA will not update these methodologies in time to be included into FEMA's and others' efforts to update their policies and products or to be considered in infrastructure investments funded by the IIJA and other federal appropriations.¹⁶⁷ Congress could conduct oversight of NOAA's progress on updating PMP methodologies and studies. Further, Congress could direct NOAA to issue interim guidance to practitioners in the short-term,¹⁶⁸ or to use funding to support nonfederal entities' development of targeted PMP studies.¹⁶⁹ However, regulations for dams informed by PMP studies may impact long-term and costly decisions in dam design and rehabilitation;¹⁷⁰ therefore, employing interim methodologies prior to NOAA's anticipated methodologies may ultimately result in further inconstancies and debate regarding these decisions.

Dam Public Awareness and Security Issues

According to some advocacy groups, many Americans are unaware that they live upstream or downstream of a dam.¹⁷¹ Further, if they are aware, the public may not know if a dam is deficient, has an EAP, or could cause destruction if it failed.¹⁷² A lack of public awareness may stem from a lack of access to certain dam safety information, the public's confidence in dam integrity, or other reasons.¹⁷³ Dam safety processes and products (such as inspections, EAPs, and inundation maps) are intended to support decisionmaking and enhance community resilience. Some of the information related to dam safety and resulting products may not be readily available to all community members and stakeholders because access to dam safety information has generally restricted from public access due to security concerns.¹⁷⁴

The September 11, 2001, terrorist attacks drew attention to the security of many facilities, such as the nation's water supply and water quality infrastructure, including dams. Damage or destruction of a dam by a malicious attack (e.g., terrorist attack, cyberattack) could disrupt the delivery of water resource services, threaten public health and the environment, or result in catastrophic flooding and loss of life. As a consequence of the September 11, 2001, terrorist attacks, federal policy and practices restricted public access to most information related to the condition assessment of dams and consequences of dam or component failure. For example, according to USACE, it had limited data regarding condition assessments for dams in the NID stating that they met the definition of a vulnerability assessment of critical infrastructure as defined by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001 (P.L. 107-56).¹⁷⁵ Then the NDSRB recommended in FY2017 for USACE to consider modifying security restrictions in the NID.¹⁷⁶ In November 2021, USACE updated the NID to no longer restrict data, including condition assessments and other risk-related information.¹⁷⁷ Still, some states do not publicly report certain data (e.g., Alabama and Illinois do not publicly report condition assessment data, and Texas does not publicly report hazard potential), so this information is not included in the NID.¹⁷⁸

Congress may consider reevaluating the appropriate amount of information to share (e.g., inundation scenarios from dam failure) to address public safety concerns and what amount and type of information not to share to address concerns about malicious use of that information. There are tradeoffs involved in sharing certain types of data. For example, sharing inundation-mapping data with the public may raise awareness of the potential risk of living near or downstream of a dam, but misinterpretation of that information could cause unnecessary alarm in downstream communities and could provide information to malicious entities on which dams would have the most potential for harm if attacked.¹⁷⁹ Inundation-mapping data generally have typically been shared with emergency managers and responders rather than with the public at large.¹⁸⁰ Some argue that disclosure to these officials is sufficient, as it provides the information to the officials who bear responsibilities for emergency response.¹⁸¹ Others argue the need for this information to be public so that communities better understand risk and improve local land use planning. In 2020, USACE changed its policy that, when inundation mapping is available, it is shared with the public.¹⁸² Accordingly, in January 2022, USACE made inundation mapping for most of its dams available online through the NID.¹⁸³ USACE is also conducting a pilot project with California, Colorado, and New York for these states to host inundation maps of certain dams that they own and/or regulate on the NID.¹⁸⁴ 

Efforts to Address Cybersecurity Risks

In addition to managing information flow to the public to address risk, Congress might consider the risk of individuals or groups compromising dams and their operating infrastructure for malicious purposes. This may include a physical attack or cyber intrusions to access and manipulate dam industrial control systems for malicious purposes.¹⁸⁵ In 2016, the Department of Justice charged an Iranian national with obtaining unauthorized access into the supervisory control and data acquisition systems of the Bowman Dam, located in Rye, NY, in August and September of 2013. According to the indictment, the attackers gained access to information about the status and operation of the dam, and would have been able to remotely operate the sluice gate had it not already been manually disconnected for maintenance.¹⁸⁶ This incident and others have focused attention on the cybersecurity of dams and other critical infrastructure assets.¹⁸⁷

In 2016, for the first time, Department of Homeland Security's (DHS's) Industrial Control Systems Cyber Emergency Response Team included dams in its assessments along with other types of infrastructure.¹⁸⁸ A 2018 Department of the Interior Office of the Inspector General (OIG) report highlighted poor security practices at two unnamed critical infrastructure dams owned by Reclamation,¹⁸⁹ and a 2022 Tennessee Valley Authority OIG report noted various issues with the cybersecurity controls of the TVA's non-power dam control system.¹⁹⁰ In March 2023, following a series of executive actions related to cybersecurity of critical infrastructure, the White House released a new national cybersecurity strategy for the federal government to better support the defense of critical infrastructure against emerging cybersecurity threats.¹⁹¹

DHS coordinates public-private partnerships for critical infrastructure security and resilience at the federal level. The Dams Sector is one of 16 critical infrastructure sectors designated by Presidential Policy Directive 21 (PPD-21) as having national-level significance to issues of security, the economy, and public health.¹⁹² DHS is the Sector Risk Management Agency (SRMA) for the Dams Sector, acting through the Cybersecurity and Infrastructure Security Agency (CISA).¹⁹³ As the SRMA, CISA is responsible for leading, facilitating, and supporting the security and resilience of the Dams Sector. CISA provides technical assistance and training opportunities, and guides sector partners and stakeholders through the Dams Sector Government Coordinating Council (Dams Sector GCC)—a government interagency group—to help them improve the safety, security, and resiliency of their facilities. The Dams Sector GCC coordinates these activities via its private-sector counterpart, the Dams Sector Coordinating Council.¹⁹⁴

A 2021 OIG report found that CISA could not demonstrate how its oversight has improved security and resilience in the sector.¹⁹⁵ The report raised a number of issues and recommendations related to CISA's lack of coordination and tracking of activities and performance, outdated sector plans, gaps in information shared with FEMA, and not effectively using the Homeland Security Information Network Critical Infrastructure Dams Portal—a DHS-run secure online information-sharing and coordination site—to provide critical information to sector stakeholders.

Congress may consider various options for addressing the risk exposure of the nation's dams to cybersecurity threats. Congress may conduct oversight on CISA's actions as the SRMA for the Dams Sector and its response to recommendations from the 2021 OIG report. While CISA concurred with all of the report's recommendations, it is not clear if the agency has fulfilled its commitments. For instance, one recommendation and concurrence was for CISA to update its Dams Sector-Specific Plan by the end of FY2022; as of March 2023, the 2015 plan remains in place.¹⁹⁶ Congress could also consider enacting legislation to address certain specific recommendations. For example, the report and ASDSO have recommended that CISA and FEMA's NDSP increase coordination.¹⁹⁷ Congress could consider amending the National Dam Safety Program Act to add CISA as a member of its advisory bodies (see "Advisory Bodies of the National Dam Safety Program") or to direct coordination between the agencies regarding resilience and security.

The National Cybersecurity Strategy released by the Biden Administration in March 2023 outlines improving cybersecurity through new and updated regulations and through financial incentives, among other means.¹⁹⁸ Since the majority of the nation's dams are regulated by state agencies, federal involvement in improving cybersecurity through regulations may be limited. Congress may direct federal agencies that own dams to strengthen cybersecurity policies. It may also direct FERC to require changes to mandatory cybersecurity reliability standards for the bulk electricity system (including hydropower assets) developed and implemented by the North American Electric Reliability Corporation (NERC), a nonprofit industry-led organization for electric reliability. FERC exercises oversight of and provides guidance for the development and implementation of NERC standards.¹⁹⁹ Regarding nonfederal dams, FEMA could use appropriations, including those provided by the IIJA, to support state agencies and nonfederal dam owners in their efforts to improve dam cybersecurity. Congress could also amend existing program authorizations or create new programs that authorize technical and/or financial assistance for cybersecurity improvements at nonfederal dams. However, Congress may consider trade-offs in using limited funds for security improvements if such a use detracts from investments in dam safety actions such as inspections, rehabilitation, and repair.