Water systems are distributed networks of pipes, pumps and reservoirs. Like all distributed networks they can be very difficult to protect from vandalism and terrorist attack. There are two broad types of attacks that could hit a water system. The first type is an attack on the quantity of water available (physical supply) and the second is an attack on the quality of water. The end result of both types of attack is a lack of potable water entering your home.
The greatest defense for a water system is that most of it is underground. It is very difficult to access most parts of water distribution systems. Even for the operators of the system it is time consuming and disruptive to the wider community. If anyone unauthorized to dig in a road to access a watermain they will be reported to the authorities in the form of complaints about traffic or noise.
I think it goes without saying that depending on public complaints to defend against terrorism is nowhere near secure.
The exposed parts of water systems are water treatment facilities, reservoirs and fire hydrants. These are the points where the system is at the surface and easily accessible. These different points also offer different security concerns.
Treatment facilities are as secure as any factory or industrial facility will be. The treatment facility I work at is always locked and there are a limited number keys. Then there is an electronic alarm system which brings a human on site if there is an intrusion alarm. There is also a human dispatched if the communication link is broken. A large city water treatment facility will most likely be manned twenty-four hours a day. The biggest weakness here is that properly armed people can force their way in and destroy the building if they so desire. Or they can contaminate the reservoir on site (if they know how).
Reservoirs of treated water are next most likely place for a terrorist attack. The biggest weakness here is that reservoirs are almost never manned during the day. They will be visited most days, but rarely will people be there all day. The good news is that water in reservoirs is monitored constantly(usually) with automatic analyzers. Reservoirs can be destroyed, and the water within wasted. Or the quality of the water can be destroyed this is where chemicals could be added easily.
The remaining pieces of the system are fire hydrants. Fire hydrants pose a unique risk to water security. It is very easy to add chemicals to a fire hydrant. It is however not easy to get that chemical into the water supply. This is because of the construction of the hydrant itself and the pressure in the system. There is a valve at the bottom of the hydrant which isolates the water. In order to add chemicals to a fire hydrant you also have to lower the system pressure which is rarely easy to do undetected. At this point I want you to remember the scene in Batman Begins where Sandman is dumping his psychotropic drug into a cracked watermain. I don’t expect realistic depictions from the movie, I do however want you to know this is nowhere near realistic. Watermains are pressurized, when they crack water shoots out at anywhere from 50 to 100psi. This is enough to erode foundations of buildings and the all soil around the break creating massive sinkholes. It is not something you can pour chemicals into. This is what it looks like when watermains break.
Just adding chemicals to water, is not as effective as it appears on the surface. Most water supplies contain residual disinfectants, usually chlorine. Disinfectants are highly reactive chemicals, they aren’t limited to just killing bacteria. Highly reactive chemicals often react with other chemicals. I am obviously oversimplifying the chemistry involved, but it is true that a large portion of any chemical added to water will be consumed by the chlorine in the water.
Cyber attack is another way water systems are vulnerable. You may wonder why water treatment facilities are connected to the internet and the answer is for remote monitoring and control. It may seem like an unwarranted risk having these facilities connected to the web. It is not an unwarranted risk at all. The likelihood of the automated system needing an intervention that cannot wait for someone to be onsite is greater than a targeted cyber attack. Keep in mind that even normal breakdowns of the watersystem can cause illness and even death. These need to be responded to and are just as important as preventing cyber attack. I am not a technology expert so I will leave it to other people to suggest the best firewall setup. Another thing to note about cyber attack on a water treatment facility is that even if the attacker is successful and shuts down the control computer, the facility can still be controlled manually.
Terrorism is something that needs to be addressed when it comes to water systems. People inside and outside the system need to be aware of the risks and what can be done for protecting the security of out water.