Reporting Requirements: tampering and security breaches in your water system

In early 2022 the Water Quality Control Division published a Drinking Water Security Response Toolbox website designed to help water utilities plan for, prevent, and guide responses to security threats including threats of tampering, suspected tampering, general malevolent acts, cyberattacks, confirmed tampering, and violent acts. Physical security breaches and tampering events continue to pose a significant risk to Colorado’s public water systems and their ability to provide safe drinking water to their communities. The division would like to emphasize that it is critical for systems to: 

1. Take measures to prevent security incidents.
2. Plan their response to an attack.
3. Know what constitutes a tampering event or a suspected tampering event.
4. Understand the regulatory requirements for reporting tampering to the division. 

In response to recent tampering incidents and in an effort to clarify when it is required to report security events to the division, we have updated the Guidance: Report and Respond to Tampering Events or Security Threats. The guidance provides the following information for public water systems: 

• Regulatory details and requirements for reporting tampering or suspected tampering events. 
• Explanation of what constitutes an attempted, suspected, or confirmed tampering event.
• Simple actions to help prevent tampering events.

For the purposes of this article, we will focus on the requirements for reporting tampering or suspected tampering and examples of what constitutes an attempted, suspected, or confirmed tampering event. 

Reg 11 requires PWS to report tampering (suspected or confirmed) to the division

Per Regulation 11.2(1), tampering events, suspected tampering, or receipt of a tampering threat must be reported to the Colorado Department of Public Health and Environment (department). The supplier must notify the department as soon as possible but no later than 10 a.m. of the next calendar day and notify the Department in writing no later than 5 days after any attempted, confirmed, or suspected tampering, or receipt of a tampering threat. Failure to report attempted, suspected, or confirmed tampering in a timely manner may result in a violation of Regulation 11. The guidance offers information on what information to submit. For ease of reporting, the department has created the Tampering Threat and Incident Report Form. If you have issues accessing the form please fill out the pdf version of the form and submit it to cdphe.wqacutes@state.co.us.

It is really important to emphasize that attempted or suspected tampering is reportable even if the event is not successful or confirmed. When in doubt, please contact the department. The role of the department during actual or suspected tampering events is to: 

1. Help water system asses any possible impacts to water quality,
2. Support the system experiencing the event(s) by connecting them with state and federal agencies that specialize in tampering and security issues in the water sector. 
3. Support the industry and gather information to identify trends across the water sector. 

What constitutes an attempted, suspected, or confirmed tampering event?

What are some examples of tampering events?

• Introducing a contaminant into a public water system or drinking water.
• Interfering with drinking water or the operation of a public water system with the intent to harm people or the public water system infrastructure. 
• Vandalism that physically damages storage tanks, fire hydrants, locks on well buildings, wellheads, intake structures, pump stations, treatment plants, backflow devices, or any other part of the physical infrastructure of the drinking water system. 
• Any action that damages the integrity of a drinking water system or causes harm to the system including expending resources (staff’s time, funding to replace or repair damaged infrastructure, water loss, etc.).  
• Unapproved removal of critical records, equipment, or chemicals. 

What are some previous tampering events that required reporting to the department?

• Verbal threat of damaging the water system infrastructure. 
• Malicious damage to fire hydrants in the distribution system. This can create a cross connection or cause pressure loss. 
• Cybersecurity attack - ransomware attack that withheld SCADA system and billing system. 
• Tank hatch alarm sounding to indicate the tank hatch is opening frequently with no system staff in the area.
• Vandalism of security fencing and a well-house.
• Purposefully attempting to drain the distribution system or storage tank, opening and closing valves without permission, intentional damage. 

What does not constitute a tampering event?

• Any vandalism that poses no potential risk to public health, like non-destructive tagging which does not result in excessive costs to the system for removal/repair.
• Accidental damage to the system such as a car accident that results in damage to a hydrant. 
• Water theft is not considered tampering unless there is intent to damage or interfere with the system. Regardless of whether theft is tampering or not, please contact your local law enforcement. 

➽ Kyra Gregory Drinking Water Training Specialist  

Asset Management - the Key to a System's Capacity

The Water Quality Control Division’s Local Assistance Unit is charged with assisting Colorado’s public water systems with building their capacity to provide safe drinking water to their communities now and into the future. Capacity can be defined  as the amount that something can hold or produce, whether it is applied to people, things or systems. In a public water system (PWS), capacity is an indicator of the overall health of a system. A PWS’s capacity is assessed using 3 criteria: Technical, Managerial, and Financial or T-M-F. Just 3 little letters, sounds simple, right?  

Don’t let the  simplicity of those letters fool you, they are powerful. The key to a successful and healthy water system is T-M-F capacity. Every part of a water system can be classified under one (or more) of these criteria areas. So, it makes sense that understanding your system's capacity is essential to running a successful water system. In fact, when applying for funding an in depth capacity assessment may be required, depending on the funding source.  Beyond funding however, it is a tool that helps you manage and assess your system’s needs both short and long term.  

How can you determine your system's capacity?  

CDPHE’s TMF capacity worksheet tool can assist you. This worksheet offers a condensed, quick-tool version of the more robust TMF assessment done when applying for funding. By completing each question you will generate an estimate of your capacity percentage for each criteria area TM & F.  Using this percentage you can determine which areas are in good shape and which areas require more focus. Good TMF capacity is often tied to good asset management.  Understanding your system as a whole is critical to short- and long-term planning. Assets are everything your system is composed of from the physical infrastructure, pipes, meters, tubing, valves, etc. to the people that work in your system. Asset management is a cumulative inventory of your system as a whole that allows you to critically assess each piece, its lifetime, cost, and to generate a prioritized needs assessment. There are a variety of tools available for developing your asset management plan:

• Asset inventory is a big part of asset management and the EPA’s Taking Stock of Your Water System: A Simple Asset Inventory for Very Small Drinking Water Systems is an easy to follow tool that will help you begin developing your asset inventory. 
• Asset Management: A Handbook for Small Water Systems offers a step by step guide to building a full asset management plan. A robust asset management plan facilitates high capacity and high capacity is directly tied to a systems success.  

Need assistance with asset management or capacity development?

The Colorado Department of Public Health (CDPHE) Water Quality Control Division (WQCD) has capacity coaching available for free through the Local Assistance Unit (LAU). A PWS can request assistance by filling out the Coaching Assistance Form. Please welcome the newest member of our capacity development team Angela Green Garcia. Angela will be focusing on asset management and financial readiness.  

➽ Angela Green Garcia - Drinking Water Training Specialist

Lead and Copper Rule Revisions and Service Line Inventories

On August 14, 2023, the Water Quality Control Commission adopted the Lead and Copper Rule Revisions into Regulation 11. The changes to Regulation 11 are effective as of October 15, 2023, but the Lead and Copper Rule Revisions have a delayed start date and won’t take effect until October 16, 2024. The Lead and Copper Rule Revisions are a comprehensive update to the EPA’s 1991 Lead and Copper Rule.

Prior to adoption the division conducted an extensive stakeholder process with 26 meetings that provided opportunities for public feedback about the proposed changes. Overall, the division gained stakeholder consensus on adopting the Lead and Copper Rule Revisions into Regulation 11 within two years after promulgation of the revisions, and many of the stakeholder comments related to clarity of the rule requirements. The division reorganized the structure of the Lead and Copper Rule Revisions and incorporated stakeholder comments into the draft rule, where possible, to increase readability and clarity.

The Lead and Copper Rule Revisions affect more than 1,050 community and non-transient, non-community public water systems in Colorado, serving nearly 6.5 million people. A key requirement due by October 16, 2024 is that all systems subject to the rule must complete an initial lead service line inventory to classify the material of each service line entering a building, regardless of ownership.

To aid systems, the division has made many resources available to systems. First, we have posted EPA and state guidance for systems on how to complete a lead service inventory and reporting forms to submit to the division once completed. Second, the division contracted with Corona Engineering and worked with stakeholders to develop an initial lead service line inventory development policy that details the expectations for completion of an inventory and clarifies many lingering issues that remained unanswered in EPA guidance. Some examples include: 

• When can galvanized pipe be considered non-lead versus galvanized requiring replacement?
• How does a system use predictive modeling to complete their inventory?
• When can a system indicate all service lines installed after 1959 are non-lead?

Third, we are contracting with WSP USA Inc to provide no-cost technical assistance to systems serving less than or equal to 15,000 people and allowing systems serving 7,500 or more people to apply for grants to assist with completing their service line inventory and service line replacement planning. This money cannot be used for physical replacement of lead service lines. Grants will be awarded on a first-come, first-serve basis to eligible applicants over several application periods. 

It’s important to note that with less than one year left to complete an initial lead service line inventory and recognizing the resources necessary to diligently complete an inventory, water systems may categorize service lines as “lead status unknown” when they cannot determine the material through an evidence-based approach. However, additional requirements, including customer outreach and planning, are triggered under the new rule if any service lines are listed as “lead status unknown.”

• Other key changes under the LCRR include, but are not limited to:
• Compliance with a new lead “trigger level” set at 10 parts per billion (ppb).
• Tap sampling requirements that target lead service lines.
• Testing water for lead in schools and childcare facilities.
• Strengthened corrosion control treatment, lead service line replacement, and public education requirements.

Please note that these key requirements (e.g., lead trigger level and sampling changes) may be revised under another new rule, the Lead and Copper Rule Improvements (LCRI). The EPA plans to finalize the LCRI by October 2024. The department is awaiting more information about the LCRI in late 2023 or early 2024. Therefore, the department will provide communication and resources related to these requirements once more is known about the LCRI.

Resources:

• LCRR guidance, FAQs, and forms are available on the department’s Lead and Copper Rule & Revisions webpage.
• Review the department’s initial service line inventory development policy.
• To request no-cost technical assistance (Systems ≤ 15,000), complete the online form.
• To apply for grant funding (Systems ≥ 7,500, visit the Water Quality Grants webpage.
• Visit the department's drinking water training and assistance website to register for upcoming Lead and Copper Rule courses (online and in-person options available) and other free training opportunities.

➽ Bryan Pilson Technical & Regulatory Implementation & Coordination Unit Manager