Protecting Our Water Supply
Disruptions could shut down businesses, harm economy
- By Bruce Czerwinski
- Jan 01, 2017
Maintaining the security of our
nation’s water supplies is serious
business. Attacks from a
lone vandal to a team of foreign
terrorists could, within hours,
result in widespread illness or economic disruption.
According to the EPA, there are about 155,000
public water systems providing water for human consumption
in the United States. These range in size
from privately owned systems, serving dozens of people
on a seasonal basis, to huge metropolitan utilities
supplying water to millions every day.
As an example, the nation’s largest municipal utility,
the Los Angeles Department of Water and Power,
serves its customers by annually pumping more than
2 billion gallons of water through a pipeline network
of more than 7,000 miles.
WHAT THE EXPERTS SAY
Most government and other experts say with the
so-called “dilution solution” it would take massive
amounts of a chemical or biological contaminant to
threaten consumers of large water systems. Needed
quantities of contaminants would be difficult to
obtain and even more difficult to introduce into a
system without being detected. Yet a few studies by
some private and public organizations show readily
available pumps and other devices could inject deadly
quantities of toxic compounds into our drinking
The physical destruction of water system components—
disrupting an area’s water supply—is a more
likely event than an attempt at contamination. Disruptions
could shut down businesses, leave residents
without water and hinder firefighting efforts.
So what can the security industry do to help protect
water system customers? Phil Lake, president of Austin,
Texas-based Knight Security, has worked on major
metropolitan water utilities and shared some ideas.
“Most utilities suffer from the same problem facing
other organizations – a limited budget for security,”
Lake said. “That means we have to carefully plan
in order to get the most from the electronic security
solutions being deployed.”
Lake said a water utility security plan usually begins
the same as one for other facilities—protect the
perimeter and work in using layers of security.
“The goal is to stop potential intruders before they
get on the property,” he said. “And in the case of a
mid-to-large water utility there may be 50 or more
separate facilities to protect—water treatment, chemical
storage, testing labs, service yards, reservoirs, pump
stations, parking lots/garages and office buildings.”
COMMUNICATION IS KEY
Lake said Knight Security typically starts with video
intercoms at each vehicular or pedestrian gate. Each
unit is connected to the utility’s security command
center. Without putting himself at risk, a guard can
have a two-way conversation and clearly see the visitor
before remotely opening a gate to allow access.
Video intercoms are used at remote buildings which
are often unmanned. Intercoms remove the need to
have guards onsite or travel to the facility to accommodate
visitors. A mobile app helps make guards more
efficient while on patrol, allowing them to control the
intercom units using smartphones or tablets to communicate
with visitors and unlock doors.
Intercoms are also very useful as part of emergency
towers placed in parking garages and other remote areas.
The stations’ bright blue lights attract distressed
visitors and employees who can directly contact security
guards with the push of a button.
A water utility will likely have hundreds—maybe
thousands—of employees requiring access to one
or multiple facilities. That’s where an access control
system becomes important. The system can be programmed
to allow employees access to only those entries
required to complete their jobs. Also, temporary
access can be granted when an employee is filling in
for a colleague on vacation or sick leave.
With both card readers and video intercoms, the
utility has an audit trail to see who entered which facilities
as well as the date and time. Lake said a number
of utility facilities are still protected by key locks.
Keys can be easily lost, stolen or copied, and keys provide
no audit trails.
“It’s still not unusual for remote sites to be left
unlocked throughout the day for the convenience of
employees,” he said. “This can be very dangerous if
the building stores dangerous chemicals or other potentially
harmful or valuable items.”
Lake strongly urged utilities to keep doors locked
at all times, with the exception of public entries which
must remain open during regular business hours. Employees
should use their access cards to enter appropriate
gates and/or doors.
Safety and liability are two other issues facing water
utilities. Reservoirs, pumping stations and other remote areas can attract children looking for places to
play. Fencing and gates (with electronic locks) are a
good way to deter access. Again, gate-mounted video
intercoms or card readers provide access for those
requiring it. Some utilities are still using padlocks to
secure gates. Lake said these can often be defeated.
Sensors strategically placed on fences will alarm
the command center if anyone tries to climb the
fence. Motion detectors can create virtual barriers
around open areas. Intrusion systems are ideal for
High-resolution video surveillance cameras provide
live and recorded video of remote entry points,
building perimeters and internal offices. For outdoor
use, such as outbuildings, reservoirs and perimeters,
Lake recommends the use of thermal cameras to capture
the movement of people at night. Also, wireless
IP-based cameras can eliminate the need for expensive
cable runs to remote areas.
Cameras are useful to monitor gauges and instruments
as part of a utility’s Supervisory Control and
Data Acquisition (SCADA) management system.
SCADA systems are installed at critical operational
sites allowing utility personnel to monitor water pressure,
equipment temperatures and other factors to
detect potential problems before they become dangerous.
Mobile apps allow guards to monitor live and
recorded video—including views of SCADA instruments—
as they move about the grounds.
Monitoring alarms and controlling many disparate
security systems can become overwhelming for any
security team. Lake said he always recommends the
installation of a security management system capable
of providing an integrated single-platform view of data
from cameras, intercoms, access control and intrusion
panels. Some systems are also capable of controlling
building systems such as lighting and HVAC.
Also, a wall of monitors displaying video from all
cameras can be overwhelming for a single or group of
guards. Video analytics can alert guards to any number
of user-defined events.
based security plan developed by Knight Security
is a system health monitoring program. Technology
allows the integrator to identify system issues—often
before a system fails—and prevent major problems
• Hard dive and CPU failures
• UPS and battery failures
• IP switch malfunctions
• Power supply loss
• Network communications loss
• Camera outages
• Access control downtime
“We don’t want to wait for a utility to experience
a problem before we’re called,” he said. “We initiate
about half of the service activity on the systems we
monitor. That’s why we continue to invest heavily in
technology to improve our system health monitoring
capabilities. The systems we install need to work as
intended. In securing our water supplies, there are no
In addition to security, a fully functioning system
can increase employee productivity and safety compliance,
Cyber security is also a concern for any utility.
Lake said his team leaves the cyber protection of
internal systems to the utility’s own IT department.
However, it is his group’s responsibility to safeguard
cameras, intercoms, access systems and other security
equipment from hackers.
That, Lake said, involves making sure factory-default
passwords have been changed and any system
firewalls are working and active. Knight Security also
advocates changing passwords on a regular, and frequent,
A 2016 report from Verizon Enterprise Solutions reported
a close call highlighting the need for utilities to
maintain their computer operating systems. A foreign
group breached a U.K.-based water utility’s outdated
system, taking control of the SCADA platform and
altering the amount of chemicals used to treat drinking
water. Fortunately, utility officials were able to
quickly identify and reverse the chemical flow, minimizing
any serious impact on customers.
Another valuable suggestion is training not only
the security staff, but all employees to be on the lookout
for suspicious people and activities. The public
can also be asked through their utility bills to provide
information about any unusual activity around neighborhood
Some utilities also choose to have their alarms register
with the local law enforcement and fire departments
in order to reduce response times to potentially dangerous
situations. Also, many water utilities regularly
invite first responders to visit the facilities to be aware
of vulnerable points and where they are located.
Operators of public and private water utilities have
no choice but to do their best to protect the public
from attacks on a critically vital service. In order to
stretch limited budgets, it’s wise to conduct regular
security assessments. These identify security strengths
and weaknesses and help decision makers spend their
money on those systems providing the highest degree
of protection and the best return on investment. Security
assessments are best conducted by an experienced
As long as we have state-sponsored terrorists and
even local vandals, our water supplies will offer a
tempting target. Just because attacks
on water utilities have been rare, we
must continue to protect our water
supplies to the best of our abilities.
This article originally appeared in the January 2017 issue of Security Today.