By BROOKS TIGNER
BRUSSELS – Policymakers and researchers in Europe are struggling with the issue of whether and how to yoke together municipal water safety and water security measures. Doing so raises many questions, however, from issues of efficiency and technical complementarity (or lack thereof) between the two sub-sectors to matters of cost.
“There are a lot so safety and security issues that should be working together such as the use of networks of sensors upstream for monitoring safety, but also those that would detect security threats,” Philippe Quevauviller, security research project officer at DG-HOME, the European Commission’s home affairs policy department, told a gathering of water security researchers here on 8 March. “These two don’t naturally work together due to different responsibilities, different ministries, and so on, but we need to ensure that what is being done for safety can be done for security.”
Another Commission source added: “It would be too easy to inject poison into a reservoir.”
But would it? Water system operators avow that their sector is more against attack than most researchers or academics realise and that, arguably, the risks of infiltration are not as high as commonly assumed.
As one water management official from a Belgian water supplier told SECURITY EUROPE on 8 March: “There is more done than researchers and Commission officials realise. We just don’t talk about it for fear of revealing our vulnerabilities or giving ideas to the terrorists. Cyber-security for our systems? Of course we and other municipalities have put that in place. Securing access to our pump stations, reservoirs and other infrastructure? Of course we’ve done that.”
Asked about how vulnerable a city’s water supplies might to attack beyond its immediate perimeter such as a pipeline, the official also threw cold water on that notion, so to speak.
“Most cities have a huge pipe or a network of huge pipes that carry high volumes of water under very high pressure – at least 7-10 bars. Not only are these usually buried deep underground but you’d have to know what you’re doing not to have the pressure explode in your face if you tried to punch a hole in one of these pipes,” said the official. “Of course, with some basic knowledge a terrorist might find other ways to infiltrate the system, but that also assumes he could get access to certain sites, but these are highly secured by today’s municipal authorities.”
Perhaps, but it could be that the idea of attacking a city’s water supply has simply not yet appeared on the radar screen of terrorist groups or lone wolf operators – or that that they are taking a long-term approach to planning.
As Sergio Olivero, a team member of the EU-funded security research project known as Water Crimes, observed: “We think the major threat to water systems is the insider threat or that created by the access that outside suppliers have to a water system.”
Or maybe it’s just a matter of time. “We have been lucky in Europe; we’ve have never had a serious event,” Tobias Biermann of the Commission’s DG-Environment said.
Though Biermann’s policy unit is focused on the safety and quality of drinking water and related data gathering, he said “it would useful to have data sets on incidents. If something happened, we would like to know as would disaster control agencies. For example the ECDC [European Centre for Disease Prevention and Control] is notified of five to six cases of water incidents a year but they don’t get enough details about them.”
Though the Commission aims to revise the EU’s long-standing drinking water directive, there is no link between it and security or, for that matter, between the EU’s water access directive and security.
“Security clearly lies within the remit of the member states, but the issue is how to combine proper technical monitoring and the confidentiality of classified information that falls to the member states,” said Quevauviller. “Currently, we cannot harmonise classified information [concerning water security]. If we want that, then we would need an EU regulation. It is very complex topic but also a gray area that needs tackling.”
One must also ask how high the issue is on the political agenda of cities. For example, during an 8 March meeting of mayors from across Europe at the EU’s Economic and Social Committee to discuss urban defences against terrorism, all the talk was about securing soft targets – i.e., open public spaces – against attack.
And yet street level entry points to underground conduits for utility lines and infrastructure are sometimes secured with only the lightest of locks and no evident cameras or alarm systems to discourage tampering.
There may be some light at the end of the tunnel for herding the water sector toward more uniform approaches to security, however.
One of the sub-groups within the European Reference Network for Critical Infrastructure Protection – a research project managed by the EU’s Joint Research Centre – is focused on water security.
The group aims to produce a set of recommendations for water system operators to follow the same procedures regarding decision support tools, a hydraulic model and geo-information system, optimisation of sensor placement, measurement standards for sensor devices and so on. The group will complete its draft report on these issues in May 2018, followed by final delivery of the document in November 2018.