Enhancement of security measures by water and wastewater
utilities is a given in today's environment. Moreover, such measures have
become more than a matter of sound management. The requirement for preparing
and filing vulnerability assessments and response plans under the new federal
Bioterrorism Act make such steps essentially mandatory.
One issue that can be overlooked inadvertently is how to
maintain security over the security measures taken. In other words, what steps
can a utility take to protect its security plans from disclosure?
Who Needs To Know?
Within a utility organization, it is doubtful that security
plans need to be, or should be, widely disseminated.Such plans should be
limited to as small a universe as possible--basically the personnel administering
the security, and to the extent of their involvement.
Of course, some measures always will be publicly obvious:
for example, a chain link fence, with razor wire and a padlock. However, other
measures are not obvious: for example, remote sensors and how they are
monitored. There is no need to disclose such measures to persons who have no
need to know them.
In the case of personnel given security knowledge,
background and credentials should be verified and non-disclosure agreements
should be executed. In the case of outside consultants such as engineers,
attorneys, accountants and vendor representatives, additional steps may be
justified.
Disclosure at Meetings
Control over disclosure of security details may be easier
within the confines of investor-owned utilities. However, municipal-owned
utilities may have to deal with open-meeting laws as may be applicable to
municipal city councils and village or district boards.
Most public meeting laws have provisions that permit closed
or executive sessions under stated circumstances and may provide that the
minutes of such sessions are protected from disclosure. Obviously, if the
specifics of security measures must be discussed, every effort should be made
to do so properly within a closed session. In those jurisdictions where this is
not possible, it may be necessary to request the legislature to modify the
laws.
Freedom of Information Requests
Municipalities are subject to the Freedom of Information Act
(FOIA) laws of their respective states. If sensitive security information were
required to be disclosed under a FOIA request, the security measures
implemented likely would be compromised. Simply stated, it makes no sense to
have to disclose security plans under a FOIA request.
The federal Bioterrorism Act exempts vulnerability
assessments filed with U.S. EPA from FOIA disclosure. Some state laws also
would exclude security disclosure under a FOIA request. Some states, including
Iowa and Virginia, recently have enacted such exceptions to their FOIA laws.
If the FOIA laws in a particular state do not have an
exception that would encompass sensitive security information, then efforts
should be made promptly to change such laws.
Regulatory Disclosures
Regulated water and wastewater systems generally are subject
to administrative agency disclosure requirements. For example, in a proceeding
for approval of a rate increase, a regulatory agency may wish to audit the
amount or reasonableness of costs incurred or projected for security measures.
Even at this level, sensitive security information should be
protected from unnecessary disclosure. One way to accomplish this is to make
such information available to agency staff only at the utility's premises and
under its supervision; to require that the agency certify a particular staff
person; to require a non-disclosure protective agreement by that person; to bar
reproduction of any documents; and to code documents so that they can be
accounted for before the staff person leaves the premises. It also may be
advisable to have the agency issue a protective order, particularly if
intervening parties are involved. In the case of court litigation, comparable
steps should be taken. See the Resolution on Commission Procedures Related to
the Increased Security Measures Undertaken by Water Utilities, adopted by the
National Association of Regulatory Utility Commissioners, November 13, 2001.
Other Security Measures
Obviously, there are some administrative measures that
utilities can take to minimize disclosure of sensitive material. Websites can
be filtered to delete security information. Computer access to data can be
restricted. Plans, specifications, manuals and contracts should be secured.
Shredders can be used when documents no longer are needed. Public reports,
including utility annual reports, statements under GASB 34 and consumer
confidence reports should exclude specifics about security measures.
For a review of state FOIA laws and models for protection of
security information, see State FOIA Laws: A Guide To Protecting Sensitive
Water Security Information, published by the Association of Metropolitan Water
Agencies.
RSS: WWD Articles
