He hits the ground, sprints toward the security-locked door and destroys the lock within seconds. Now he's inside the building, hunting down the computer system that purifies water for millions.
When someone finally notices the alarm, how many seconds will have ticked by? Was that barbed wire fence enough to slow the intruder down? Now that he's smashed through one door, will he confront a maze of locked doors and padlocks? Or will the computer be lying behind the first door?
Will a security guard or police officer be available to respond? Can either confront and subdue the terrorist in the time that's left?
The clock is ticking…
A real risk
Not too long ago, guarding our water supply against a malevolent intruder meant scouting for kids with spray cans, or perhaps the occasional thief (sometimes an employee with a grudge).
That kind of risk assessment has been seemingly transformed from a dry numbers-crunching exercise into a real-life video game where a loss can be deadly.
"Water is a very potent symbol for people. Clean water is almost seen as a birthright in this country," said Dr. Mary McDaniel, a risk communications expert with the Venice-based McDaniel Lambert consulting firm. When it comes to the water supply, "if the public doesn't perceive it's safe…then the effects are very real…"
In the broadest sense, most of life's activities involve some element of risk.
When is the right time to buy a house or stock? How much health insurance should one have?
Measuring that risk is an imprecise science, and when someone guesses wrong—risk becomes real. When the risk is something as uncertain and frightening as a terrorist attack—the uncertainties multiply.
Even when risk can be quantified, in the real world it can never be eliminated entirely—at least not at a cost most people would accept. One could foolproof a water system by having guards linked arm in arm along every aqueduct, pipeline and reservoir. The costs of total protection mean lost opportunities in other areas, such as averting drought. And the bills would be astronomical.
The real purpose of risk assessment is to consider some prudent increases in spending to achieve a reasonable reduction in risk.
Risk assessment has assumed an even more important role in the post Sept. 11th world. Public and private institutions across the nation are conducting the same vulnerability assessments as the water industry. The results will help determine how billions of dollars will be spent.
"We don't do anything any more without asking what are the security implications. We look at everything from a security point of view," said Carrie Lewis of Milwaukee Water Works, a retail and wholesale municipal utility that serves 825,000 customers.
Water is a risky business
Terrorism may seem to be unlike any risk we've encountered before. But risk isn't anything new for the water industry. Drought can siphon off rain and snow pack. Wildfire debris can destroy watersheds. Earthquakes can sever pipelines. And those are just the natural risks.
In addition to the longstanding political and legal risks of losing one's water rights or water supply, there are ongoing regulatory risks that a government agency will ban a contaminant, or declare that a water project endangers animals or plants.
Whether it's those issues, a U.S. president weighing a profound policy shift, or household financial planning, all risk assessment has some common elements. There is data to be collected and examined vigilantly. There is a weighing of possible consequences if the status quo continues. And then there are recommended solutions, which usually contain an extra margin of safety. An uncertainty factor is often plugged into the formula—a little-known number that can produce major differences in the recommendation.
Once presented with the solutions, the decision-makers determine whether they can live with the current risk, or if they want to invest the recommended amount to reduce the risk.
How that process works in practice depends on who is assessing the risk, and in what kind of environment.
Whether it's bull markets, fiscal policy or security issues, perceptions of risk seem to run in cycles.
McDaniel said there is merit in the argument that the pendulum swings from underestimation to overestimation of risk.
Most attention seems to be paid to risk assessment in the aftermath of a crisis. When the sense of crisis fades, the risk assessments sometimes are criticized as unnecessary.
Within the water industry (especially outside of agriculture), that's evidenced by the difficulty in generating public interest in water issues when there isn't a drought impacting scores/thousands of people.
"With less frequency people tend to forget. The focus is no longer there…and money is committed elsewhere," said Sonny Fong, Emergency Preparedness Manager and Chief of Security for the California State Department of Water Resources.
There can be periods where protective steps in response to a perceived or actual crisis can produce measures that aren't needed for years, if ever. In some cases, the measures taken in response to risk assessments do more harm than good (with one extreme example being the internment of Japanese-Americans during World War II).
The confidence level rises, along with a growing level of apathy, or possibly a feeling of exceptionalism ("It can't happen to us") or a feeling that historical cycles won't repeat themselves. There may be an underestimation of what the worst-case scenario might turn out to be.
This pattern persists until the next crisis occurs.
"People's natural state tends to be apathetic…(until a crisis affects them personally)…" Mary McDaniel said.
Assessing the risks
The public tends to underestimate the risks from everyday voluntary activities such as smoking, drinking, driving or overeating. Since they are a matter of choice, they seem to involve a measure of control. People who choose to live in flood zones, for example, routinely underestimate the likelihood of a flood. But a fire risk is 1-in-100, while a flood is one in four.
The public prefers to focus on low-probability, high-consequence risk —like child abductions, plane crashes and bio-weaponry attacks. In all such cases, they tend to overestimate the chances of that happening.
According to a list compiled by risk communications expert Peter Sandman, terrorist attacks tend to have a lot of factors that tend to send them off the charts in terms of public reaction—they're unnatural, exotic, memorable, dreaded events that exact a large toll within a short time period.
When the experts talk about risk, they may talk about "the probability of something going wrong as being very, very low. (In contrast), the public says 'I know things can still happen. What steps can I take to protect me and my family?''' McDaniel said.
The experts tend to focus on the high-probability, moderate consequence risk and then take steps to cover their bets or assume a calculated, low-probability risk in the event of the worst-case scenario.
But "the experts are many times wrong, no doubt about it…" McDaniel said.
When it comes to risk assessment, the public imagines a chalkboard full of equations and "perceives that there is more of an exactitude to it than there is," McDaniel said. "Risk assessments are only as good as the assumptions that go into them…"
The insurance industry makes its living at quantifying risk—and history is replete with examples where it guessed wrong.
After being stung by natural disasters like Hurricane Andrew and the Northridge earthquake, insurers were shocked by Sept. 11th. Prior to that, terrorism coverage had been offered at virtually no cost. Like most of the country, the insurance industry had failed to heed the warnings of an attack on American soil that had been sounded in official government reports for years.
Now the pendulum has swung the other way. Unsure of the risk, some insurers aren't issuing any terrorism coverage at all saying it's presumptuous to put a figure on the likelihood or magnitude of future attacks.
Drew Boronkay, risk manager for the Metropolitan Water District, says that in places where there seems to be a quantifiable risk (such as an office building or other public spot where lots of people concentrate in one place), workers' compensation premiums are soaring, including a big spike in the cost of coverage for Metropolitan's mid-rise Union Station headquarters building.
In the Denver water system, terrorism coverage for the property policy plunged from $250 million to $1 million, while the $88,000 premium went up 54 percent, risk manager Jim Crockett said.
Predicting risk in the 21st century
Within the water industry, one still can't predict if there will be a drought, earthquake or fire next year, or how serious they might be.
One way to reduce uncertainty is to rely on reams of historical data and research.
Records of drought and earthquake can stretch back a century or more. When the risk is a water contaminant, there can be hundreds of peer-reviewed scientific studies. Even the political and legal battles often follow a familiar pattern.
Even under the best conditions, "all types of 'prediction' are inexact,'' notes Mark Sovern, special agent of the Metropolitan Water District.
And terrorism isn't like what the industry has faced before. It's a man-made threat, a deliberate act, and virtually unprecedented.
Actual physical attacks on water facilities have been largely the stuff of history—like the "Arizona navy" flotilla that tried to block the construction of Parker Dam, or the farmers that took up guns and explosives in Owens Valley.
Deliberate contamination is also something new.
Before, when agencies did risk assessments for contaminants, they focused on naturally occurring substances, or on industrial pollution, or accidental releases or failures of a manmade system, McDaniel said.
"Typically, they didn't look for things caused by intentional acts. That's a much, much different issue. The water systems weren't designed for that," McDaniel said. "That makes protection an awful lot harder."
The closest precedent might have been the Cold War fear that nuclear war might destroy the water supply.
Milwaukee water superintendent Carrie Lewis recalls an early 1960s water facility in her area that seems to reflect the sentiment of the Cuban missile crisis.
"It is literally a bomb shelter, it has one-foot-thick walls and no windows, and the locks on the doors are all explosion-proof. The place is a fortress. So people were thinking about it," Lewis said. "But I guess we lost sight of it between then and now."
As World War III faded as an infrastructure threat, terrorism was slow to even register as an infrastructure threat. In the '70s, terrorism might have been "a couple of guys hijacking a plane to free their buddies from jail," Sovern said.
"But the latest generations of terrorism may have state sponsorship that would give them access to military-grade munitions or weapons of mass destruction," Sovern said.
Catherine Murphy, senior public affairs manager for the American Water Works Association, said several years prior to Sept. 11th, after hearing that water utilities were adopting a more strategic perspective about its facilities, "the FBI recommended to the industry that they conduct vulnerability assessments."
Even then, it seemed hard to take seriously.
In Milwaukee, there hadn't even been an incident of vandalism in recent years, which may explain why a post-Sept. 11th assessment showed that fencing, doors and locks were not being used to their full potential.
Water goes undercover
Jolted into assessing the risk of the unknown, the water industry has been forced into a new tactic—intelligence-based risk assessment. Rather than look to the past, it depends on tips about what might happen in the future.
"The new twist is now we have an interdependency with law enforcement," Lewis said. "I never expected that getting to know my local FBI agent was going to be part of my job."
AWWA says that the last FBI warning to water agencies came late last year—and despite the suggestion of recent news stories—there hasn't been one since.
"There have been threats (direct and indirect) worldwide," insists California water official Sonny Fong, "they're just not published. Keep in mind that water systems (are part of a much larger infrastructure network with) many interdependencies and a threat to any one of them is also a threat to the water system."
A long-range water supply forecast can rely on meteorological records, but terrorism, by its nature is unpredictable. How do you take a "meteorological" reading of a secretive terrorist organization that might be spreading disinformation, or resorting to exaggeration or diversionary schemes?
"Not all intelligence can be taken at face value," Sovern acknowledges. "In a lot of cases, we don't know whether to trust it." In the effort to strike a balance between alerting the public and averting panic, "by the time you get something to the public it's so watered down."
"Part of all intelligence is counter-intelligence," Sovern said. "Some information is purposely vague and some of it purposely incorrect, depending on the target audience."
Safe to say that Sovern's shop is working with a different set of facts.
"Metropolitan is a serious enough player to enjoy access to the highest levels of the federal law enforcement and intelligence communities through the District's special agents."
Based on what he's been told, Sovern sees no reason to relax his guard.
So how does one do a security risk assessment in a post-Sept. 11 world?
Metropolitan Water District, like many water agencies, is using a threat assessment formula derived by Sandia Labs in conjunction with the American Water Works Association Research Foundation.
The risk assessment is a combination of probability that something might happen, the security effectiveness against that threat, and the consequences if the act occurs.
On the probability front—the assumption is not that a terrorism attack might happen—it will happen.
As far as security effectiveness, it deals with the issues raised by the scenario of the fence-jumping terrorist.
"By appearing to be a 'hard target' by having guards, fences and closed circuit television cameras we may discourage an attack,'' Sovern said.
If the terrorist isn't deterred and attempts an attack—it's like two stopwatches ticking away—one for the terrorist and one for the agency.
The idea is to rack up as much time for the terrorist as possible. One way is to start the clock earlier with an early detection system, such as putting an alarm on the outer property line as opposed to the inside fence.
Another way is to put in obstacles that chew up the terrorist's time.
The water agency's job is to respond rapidly and spend as little time as possible tracking down the intruder.
If the water agency uses up more time than the terrorist does—then "security effectiveness is zero," Sovern said.
If the security fails, then what are the consequences?
The high cost of security
If it's a modest attack on a reservoir that results in a boil-water notice,
that's a much lower score than losing a raw water source like Oroville
reservoir or Diamond Valley Lake.
"The risk equation quantifies risk values," Sovern said. "Management
then has to decide if spending X million dollars to improve a 3-in-10
risk to a 2-in-10 risk is both safer and cost effective."
Following its risk assessment, Metropolitan opted for $5.5 million in
security upgrades. They included new alarm and video systems, automated
remote water sampling, augmented testing to detect intentional contamination
and equipment that could detect contaminants faster.
"Is $5 million prudent…10 million…15 million? It can be
an endless money pit, and have you really addressed the issue?" said
Fong of the State Department of Water Resources.
If customers' bills start going up, and nothing happens, then what might
the reaction be? Another risk is putting on such a show of security—such
as installing metal detectors at every entrance—that the public begins
to wonder if there is more of a threat than the agency is letting on.
Responding to risk assessment isn't cheap—it's costing more than
$100 million at the Los Angeles Department of Water and Power.
Risk assessment sometimes can point out low-cost fixes.
In Milwaukee, for example, all-hours remote access to the SCADA computer
system has been eliminated and replaced with a new system that requires
employee authentication and clearance through a dispatcher.
"Twenty four hours a day of vulnerability has been cut down to a
few minutes," Lewis said.
If there's any consolation, it's that the limited resources argument applies
to the other side as well.
"They don't have an unlimited amount of guys willing to die for the
cause," Sovern said. "The terrorists' goals and objectives are
to create headline-grabbing events that damage our economy and cause fear
in the public. Those goals and objectives, coupled with the need to get
the maximum bang-for-the-buck, result in a prioritizing of targets.
"In this scale, Metropolitan is a 'medium' level target. As another
example, knocking out the entire air traffic control system would be a
'high' level target because it better meets the criteria,'' Sovern said.
Preparing for one kind of risk can help prepare for other risks. Long
before Sept. 11th, in assessing the risks of natural disasters, water
agencies came up with emergency response techniques that can be used for
terrorism. In preparing for riots, agencies forged close ties with law
enforcement that have proven valuable now. In preparing for the Y2K computer
bug, agencies got practice for defending against cyber-terrorism.
The lessons work both ways in the steps being taken today. Even if water
facilities are spared from a terrorist attack, the lessons learned in
preparing for one can have beneficial effects.
"I don't think we will ever become complacent about it," Lewis
said. 
Not
too long ago, guarding our water supply against a malevolent intruder
meant scouting for kids with spray cans, or perhaps the occasional thief.
That kind of risk assessment has been seemingly transformed from a drynumbers-crunching
exercise into a real-life video game where a loss
can be deadly.
“We don’t do anything any
more without asking what are the security implications. We look at everything
from a security point of view,”
- Carrie Lewis, water superintendent, Milwaukee
Water Works.
When the experts talk about risk, they
may talk about “the probability of something going wrong as being
very, very low. (In contrast), the public says ‘I know things can
still happen. What steps I can take to protect me and my family?’’
- Dr. Mary McDaniel, risk communications
expert,
McDaniel Lambert consulting firm
“I never expected that getting
to know my local FBI agent was going to be part of my job.”
- Carrie Lewis, water superintendent,
Milwaukee Water Works.
