Counter Terrorism Committee
Water Infrastructure as Terrorist Targets
In 2002, the FBI sent a bulletin to computer security experts around the country indicating that Al-Qaida terrorists may have been studying American dams and water-supply systems, attempting to thoroughly plan new attacks. They specifically hunted for information on water supply and wastewater management practices in the U.S. The memo was sent after the information was taken from the computer of an individual with indirect ties to Osama bin Laden that contained architectural and engineering software related to the water reserves. In this memo, the FBI indicates that members of Al-Qaida have searched the internet for methods for gaining control of water supply facilities and wastewater treatment plants through the computer networks used by U.S. utility companies.
U.S. law enforcement and intelligence agencies have received indications that Al-Qaida members have sought information on Supervisory Control and Data Acquisition (SCADA) systems available on multiple SCADA-related Web sites. The systems are generally not on the public Internet, but are connected through communications channels that link a control center to hundreds of remote units. These in turn control water pumps and other equipment within U.S. and other developed nation’s water storage facilities. Remote control of water or sewage plants is not just a hypothetical concern. The world's water system is a delicate balance of components that includes: the water supply system (dams, reservoirs, wells, etc.); water treatment system; and the water distribution system (pipes, pumps storage tanks, etc.). These systems are mostly aging and in urgent need of upgrading as is and these possible attacks could hold grave consequences if carried out.
Risks:
"Raw" Water Systems: these include reservoirs, lakes or rivers. Likelihood of contamination is low given that several freighter cars of toxin would have to be dumped into the supply for any effect. Even then the massive dilution effect of the raw water supply is the best defense. However, such systems are nearly impossible to completely physically secure, leaving them vulnerable to such attacks.
Low Water Intakes: The potential for contamination increases as water dilution decreases, and such is the case for water intakes. There are 6,800 public supply drinking water intakes on rivers alone in the U.S. Likewise, intakes at mouths of reservoirs or lakes are also vulnerable. Contaminates introduced at intakes have a better chance of reaching the population than if introduced elsewhere. Real-time monitoring equipment can help stall this threat.
Medium Water Treatment: Here the physical assets of the facility are at risk. SCADA systems also are a concern, experts say. SCADA allows remote operations and monitors system status. Pull a SCADA offline and the facility is "blind" to any possible contaminate in the water.
High Water Distribution: This component is very vulnerable. Pipelines wander for thousands of unprotected miles; aqueducts snake through large areas. A person with crude knowledge of hydraulics and a bicycle tire pump and access to a kitchen faucet could introduce toxins into any local water distribution system. There are few security measures in place.
High Interlocking Dependencies: The water system is dependent on other critical infrastructures, such as the electrical grid. If the electrical grid fails, it could domino into the water system causing disaster. Some authorities have installed back-up generators; though many systems have not. Any disruption to the chemical industry also puts the water supply system at risk. Water authorities need chemicals to treat the water and make it usable.