Water Technology talks with Ahren S. Tryon on water/wastewater challenges

s-cphoto/iStock

With respect to cybersecurity, one need only open the newspapers on any given day to see reports of new and disturbing trends in cyber-espionage and the ability of hackers to exploit industrial control systems. The water and wastewater industries are not immune from these concerns. In fact, water systems have increasingly become a target for these exploitations, representing a significant part of the upswing in reported attacks in the last year. Part of the problem stems from the evolution of technology used to remotely monitor and operate water and wastewater facilities. Networked "supervisory control and data acquisition" (SCADA) systems and other Internet-facing devices have become ubiquitous in the industry but are increasingly vulnerable both to remote access by third parties and internal access by unauthorized individuals and employees. With officials as high-ranking as the National Intelligence Director testifying to Congress that potential cyber attacks on the country’s infrastructure pose an even greater threat than physical attacks by global terrorist groups, the water and wastewater industries are effectively on notice that measures to increase physical security in the wake of 9/11 are no longer enough. There is a growing expectation that the industry’s information systems should be hardened against cyber threats.

WT: What steps are being taken to eliminate or reduce those threats?

AT: The problem of aging infrastructure is quickly coming to a head, and some states have taken action to aggressively promote accelerated investment in system upgrades. Pennsylvania’s Public Utility Commission, for example, recently approved the use of a distribution system improvement charge that allows utilities to charge customers a special surcharge to be invested in Commission-approved upgrades. Several other states in the east and Midwest, as well as California, have put in place similar programs. Pennsylvania also recently adopted measures that allow utilities to spread the cost of capital upgrades in certain situations across both water and sewer rate bases, reducing the impact on individual ratepayers. Pennsylvania is relatively progressive on this form of cost allocation.

At the federal level, the US Senate Committee on Environment and Public Works recently approved legislation that would create a Water Infrastructure and Finance Innovation Authority to help reduce the costs associated with upgrading critical water infrastructure. The legislation is expected to be considered by the full Senate as part of the larger Water Resources Development Act as early as May 2013.

To date, there is no uniform standard for addressing cybersecurity issues in the water and wastewater industries. Some states have begun to address these issues by requiring regulated entities to adopt cybersecurity plans and to report when cyber attacks have been detected. However, the majority of state public utility commissions have not adopted such measures, leaving individual utilities and municipal operators without much direction on how to protect both sensitive customer information and SCADA networks used to monitor and control system assets. Although legislation at the federal level has been proposed in recent years, privacy concerns have dominated the deliberative process and bipartisan agreement has been hard to come by. In February, however, President Obama issued an executive order requiring federal agencies to better communicate potential cyber threats to the private sector through increased information sharing and to develop a flexible framework for identifying and reducing the risk of cyber attacks on critical U.S. infrastructure. The water and wastewater sector is being rallied to engage in the efforts to develop the "Cybersecurity Framework," which will include voluntary standards and best practices that owners and operators of critical infrastructure will be urged to adopt. While the Cybersecurity Framework will be voluntary, the Executive Order directs federal agencies to review their authority to impose cybersecurity requirements. Moreover, the adoption of the standards ultimately established under the Cybersecurity Framework is likely to impact the insurability of operators against attacks, may become an issue in financings, and may shape courts’ consideration of the "commercially reasonable efforts" that companies should be taking to protect their customers and assets in the event of a cyber attack.

WT: How has communication failure been a problem amongst utilities? What are ways to fix those issues?

AT: The water and wastewater industry is fortunate to have national industry organizations such as the American Water Works Association and the National Association of Water Companies facilitating information sharing among their membership, particularly with respect to infrastructure issues and utility security. Where cutting-edge issues like cybersecurity are implicated, it is paramount that water and wastewater system operators engage in the process for developing standards and legislation. The industry organizations can provide a strong collective platform, provided their members communicate their desire and willingness to be informed and involved. There remains much work to be done at the federal, state and industry levels regarding efficient communication of real-time information about threats and emergency response. This will require concerted efforts to bring together regulators, water and wastewater system operators, other utility operators and state and local emergency responders.

WT: What type of energy issues should utilities most be concerned with? What types of equipment are being developed to help solve energy issues?

AT: While maximizing energy efficiency (particularly through minimizing system losses) should always be a concern, reducing the cost of energy and increasing reliability should be a priority consideration. One way in which utilities are increasingly addressing these concerns is through the development of on-site energy generation and/or storage solutions that can offset the need for power from the electric utility or serve as a backup in the event of an outage. As noted, one of the primary drivers of increasing electricity costs in recent years has been the charges associated with delivery.

Efficiency measures can help reduce the impact of these charges in the short term, although aging electric transmission and distribution (T&D) systems, along with "congestion" of the power system in some highly developed areas of the country, continues to put upward pressure on delivered electricity costs. Self-generation avoids the electricity T&D components to a large degree, with the exception of interconnection costs where utility service is still required or where net-metering may be a desired option. The biggest advantage to self-generation, however, may be increased reliability. Utilities on the east coast of the U.S. can attest to the impact that Hurricane Sandy and other weather events in recent years have had on their operations. Water and wastewater facilities in the mid-Atlantic went for days without power, forcing customers to boil their water (to the extent they were able) and causing the release of untreated sewage into local waterways. With the increased focus on cybersecurity and the growing concern that targeted attacks on critical infrastructure (i.e., water, wastewater and/or electric generation and T&D facilities) may also lead to shutdowns of water and wastewater facilities, reliability is a core energy issue that will continue to impact the water and wastewater industry.

WT: What role do the water/wastewater and energy divisions have on protecting the environment? How is the government working to make sure our environment remains the same or improves?

AT: The water industry has an inherent interest in protecting the environment. The business model depends on maintaining clean sources of drinking water that require minimal treatment. The very purpose of wastewater companies is to protect the environment. By virtue of the water-energy nexus — energy being essential to the production and treatment of water and clean water likewise being a central component to most energy systems — energy companies likewise have a vested interest in reducing and preventing the pollution of surface and groundwater.

State and federal government increasingly have targeted wastewater companies and the energy sector for increased pollution reductions through stringent performance and emissions standards. Because non-point sources of pollution such as storm water runoff and agricultural pollution are so difficult to regulate, regulators have focused on wastewater treatment plants, over which they have clear regulatory authority. As a result, treatment plant operators have been required to make substantial investments in pollution control equipment, making marginal improvements in pollution reduction that are becoming increasingly expensive. One of the more innovative approaches to reducing water pollution has been to create market-based nutrient trading programs that are designed to promote pollution abatement beyond regulatory requirements. While these programs have many issues yet to resolve, they offer a promising solution to finding the lowest cost path to increased environmental protection.

Ahren S. Tryon is the Energy and Utilities practice designee for Cozen O’Connor’s Cybersecurity team. He is also a member of the firm’s Energy, Environmental and Public Utility Practice. Tryon’s practice combines complementary skills in energy, environmental and transportation law to provide a range of services to energy and water/wastewater companies and government clients. Tryon has counseled clients through transactions, federal and state regulatory proceedings, and judicial and administrative litigation. He has represented clients before federal and state courts, state public utility commissions and environmental agencies, the Federal Energy Regulatory Commission (FERC), the Nuclear Regulatory Commission (NRC), the Surface Transportation Board (STB) and the Pipeline and Hazardous Materials Safety Administration (PHMSA). Beginning his legal career as a law clerk for FERC, Tryon gained firsthand knowledge of energy issues facing both government entities and private industries. He then served as a presiding official and as the counsel to the Western Region for the U.S. Department of Transportation’s Pipeline and Hazardous Materials Safety Administration. He also served as a member of the White House Task Force for Energy Project Streamlining.

Tryon utilizes his experience in environmental law in permit and licensing proceedings, including pipeline facility routing and permitting actions and transactions involving water and other energy projects. He advises clients on legislative and regulatory developments and has drafted legislation and policy concerning energy and water regulation and incentives. Tryon has counseled companies on pipeline integrity issues that may affect acquisition pricing, as well as on regulatory compliance and pipeline safety enforcement matters. He also has advised clients on other federal and state transportation-related regulatory issues for various modes, including trucking and rail. Tryon also has counseled clients on project funding opportunities under federal and state grant, loan/loan guarantee, and tax credit programs.