The European Commission’sscience and knowledge serviceJoint Research Centre

European Reference Network for critical infrastructure protection

Thematic Group on Chemical and Biological Risks to Drinking Water

Rui Teixeira, Municipality of Barreiro, Portugal

This work has received funding from the European Union’s Horizon 2020 research and innovation programmeunder grant agreement No 775989. The contents of this article do not reflect the official opinion of the European Union. Responsibility for the information and views expressed therein lies entirely with the speaker.

2

Trento

Tomas Bata Bristol

Kassel

IACIE

Thessa-loniki

Gdansk

Luzern

Patras

ACI

EDP

Finavia

ECAC

Raja

Operators

RATPEON

Alli-ander

PSE

IATA

Shell

GDF Suez

Industry

L3EOS

S:can

IconalABB

Mutix

Elster

EDP Smiths

Vituki

IBMCyber Security Center

AsterAPCO

VCE

Siemens

Rapiscan

Honeywell Morpho

ENER

MOVECNCT

EU Inst.

ENISAJRC

GROW

HOME

ENEA LNEC

BAM

Fraun-hofer

CEATNO

DSTLAEA

RobertKoch

EcoindCETAQUA

ICRA

STUK

VTTThales ENCS

CERN

INRIA

NPL

Research Facilities

Academia

Romania

CzechDenmark

Portugal

Netherlands

Cyprus

Spain

Germany

GreeceHungary

Sweden

UK

Belgium

France

Switzer-lands

Austria

Finland

PolandMemb. states

ETSICEN/CEN.

ISO

NIST

https://erncip-project.jrc.ec.europa.eu/

What is ERNCIP?

A JRC-facilitated network of security related expertsvolunteering to address issues of pre-standardisationat EU-level towards fostering the development of innovative and competitive security solutions

3

• Chemical/Biological(CB) Risks to Drinking Water• Detection of Indoor Airborne CB agents

Chemical & Biological Detection

• Detection of explosives and weapons at secure locations• Protection of structures

Weapons & Explosives Detection

• Radiological/Nuclear threats to critical infrastructure

Radiological & Nuclear Threat Detection

• Extended Virtual Fencing (video and biometric technologies)

Physical Security

• IACS components Cybersecurity Certification Framework

Cybersecurity

Thematic Groups 2017-2019

4

© P

hilip

p H

ohen

blum

TG CB Risks in Drinking Water – Who we are...active since April 2012

Environment Agency Austria (coordination)

University de Lorraine - Nancy (FR)Fraunhofer-IOSB (DE)

Robert Koch Institute (DE)Water Research Centre plc (UK)

Lyonnaise des Eaux (FR)Aguas do Algarve (PT)

Aigües de Barcelona (ES)Jerusalem Waters (IL)

Barreiro Water (PT) S::CAN (AT, ES)

ADASA Sistemas (ES)

voluntary participation - membership agreementseveral members on hold

5

Chemical and Biological Risks to Drinking WaterA response to deliberate chemical and/or biological contamination of drinking water.

Guidance: Water Security Plan in drinking water supply for water utility operators

Environment Water Utility Network Consumer Waste

SAFETY: Monitoring as requested by legislation, weak measure to identify quickly changing compositions or contamination with hazards not being monitoredSECURITY• Online monitoring (Event Detection, Early Warning, Limitation of non compliance with

legal frameworks, DWD etc.) • Rapid response analytical screening (targeted/non targeted laboratory analysis)• Physical and cyber protection: Out of scope of TG Water considerations

6

Water Security Plan 2017-2019

Guidance on requirements for production of a water security plan in drinking

water supply

Rapid detection & identification labmethodologies

Practical guidelines on the requirements of a continuous

online water-quality monitoring system in

drinking-water-supply systems

7

Water Security Plan

Water Security

Plan

Context Purpose Scope

Design

Implemen-tationRevision

Disclosure

8

Continuous online water-quality monitoring system

Hydraulic model and geographic information system application

Sensor-placement optimization software

The sensors

Event-detection system

Water quality contamination dissemination look-ahead simulation

Event-management system

Sensor-placement optimization software

Hydraulic model and geographic information system application

9

Continuous On Line Water Quality Monitoring System

Event Management System

Event Detection System

Contamination Dissemination Model

Physical Security

Customers complaints

Sensors

Hydraulic Model GIS mapping of the water network

10

Rapid detection & identification lab methodologies

Hydraulic model and geographic information system application

Sensor-placement optimization software

Rapid detection & identification Lab methodologies – Chemistry

Rapid detection & identification Lab methodologies – Microbiology

Quality control - Intercomparison tests for unknown contamination events

Rapid detection Lab methodologies - Toxicology

Contamination scenarios to be considered

Future work: Lab response to emergency (with connection to the other reports)

11

Water Security Plan - Lifecycle

12

Water Security Plan design

General characterization of a water supply system

Threat identification

Responsibilities allocation and team constitution (internal team and external entities)

Risk assessment

13

Water Security Plan Implementation

Phase I –Planning andPreparation

• Risk assessment• Security and system design vulnerabilities• Characterization and evaluation of the threats• Definition of scenarios• Indicators for detection of suspicious activity• Preparedness for rehabilitation• Alternative water supplies and redundancy• Emergency response plan• Identification of roles• Awareness-raising, training and exercices

14

Water Security Plan Implementation

Phase II –Protection – Event

detection and confirmation

• Event detection• Record of anomalous occurrences• Online water quality and operational

monitoring• Consumer complaints, public health and

surveillance by authorities• Sampling and laboratory analysis for

confirmation

15

Water Security Plan Implementation

Phase III -Response - Event

management

• Communication• Response measures

16

Water Security Plan Implementation

Phase IV -Remediation and recovery - Return

to normality

• Recovery plan• Remediation and recovery actions• Identification of roles• Return to normality

17

ObservationsIntentional threats to water systems are the main focus

A water security plan needs:• a risk assessment approach specific to water security• different approach to remediation and recovery• inclusion of technical issues: online monitoring, lab tests and

methods, etc. • involvement of all stakeholders: customers, public health

authorities, water managers, policy makers etc.• link to other plans (emergency, WSP, etc.)• link to daily operations

18

Challenges• Security is a sensitive topic to discuss within water utilities or

between them and national authorities• Security awareness is needed for water utilities and their staff• Information may not be available or sharable• Terminology is not agreed or understood in a uniform manner• Standards for water security are missing

• Planning is one step, implementing is key• Implementation cannot take place solely on the effort of the utility,

it needs involvement and an active role of the policy makers and authorities

19

Next steps…Finalise guidance reports

Exchange with stakeholders• Operators, authorities,

manufacturers, policy makers• EurEau• DG-Home, DG-ENV, DG-SANTE• NATO

ERNCIP Workshop is being planned for Autumn 2019

© Philipp Hohenblum

20

Stay in touch

This work has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 775989. The contents of this article do not reflect the official opinion of the European Union. Responsibility for the information and views expressed therein lies entirely with the speaker.

•EU Science Hub: ec.europa.eu/jrc

•Twitter: @EU_ScienceHub

•Facebook: EU Science Hub - Joint Research Centre

•LinkedIn: Joint Research Centre

•YouTube: EU Science Hub