Scenario: Contaminate the Water Supply
Scenario
Using chemical or biological means, contaminate the water supply.
Description
Prior to September 11, 2001, the "convention wisdom" said that airplanes were secure and hijacking them was impossible. No one had hijacked a plane in the U.S. in years, so this seemed like a reasonable assumption. Only when terrorists managed to hijack not one but four airplanes on the same day was the conventional wisdom proven wrong. The conventional wisdom gave us false security and made us complacent toward hijacking. We paid a tremendous price for that error in judgment.
Today the conventional wisdom seems to think that an attack on our water supplies is impossible. This belief leads us to do nothing to protect our water supplies. That will eventually be a fatal mistake because the water system of any major city is an irresistible target to terrorists. As discussed in the water infrastructure scenario, water is essential to human life. We need it to drink, obviously, but we also need it to flush toilets, wash clothes, and water crops. Even if poison in the water never kills anyone, it will cause the water system to shut down. Once it shuts down, a city will become uninhabitable within days. See the water infrastructure scenario for details.
A chemical attack is the most likely route a terrorist would take. As described in the article entitled A Chemical and Biological Warfare Threat: USAF Water Systems At Risk, there are many possible chemicals that the terrorists might use. For example:
- Botulism toxin -- Less than half a pound of Botulism toxin is enough to make 200,000 gallons of water toxic. If a person drinks one cup of water poisoned at this concentration, he will die.
- Ricin - it is nearly as toxic as Botulism toxin. A pound would do it.
- Sodium cyanide is much less toxic, but is extremely easy to obtain. It would take about 400 pounds to make 200,000 gallons toxic.
These chemical agents are stable in chlorine and impervious to filtering. When you realize that 10 pounds of Botulism toxin is enough to make 5 million gallons of water lethal, you begin to see the magnitude of the problem. And there are many substances that terrorists could use just as easily to poison the water.
The conventional wisdom holds that poisoning a water supply is impossible because the volume of water in a lake is so great. That is an invalid argument for three reasons:
- As seen above, the concentration of certain toxins needed to make the water lethal is so low that a lake can be contaminated.
- You don't need to contaminate the entire lake, because you can release the chemical near the intake pipe for the water purification plant. All you have to contaminate is the relatively small amount of water running into the system, not the entire lake.
- Let's imagine a lake that is contaminated with a low level of cyanide. It is not fatal, but the water definitely contains a measurable amount of the toxin once the terrorists get done. Who, exactly, is going to use this water? Is the water system going to suck this poisoned-but-non-lethal water in and distribute it, telling everyone that it's OK? Of course not. Tainted water is unusable water, and the whole lake will require draining, decontamination and refilling -- a process that will take a year. In the meantime, the city has no water and becomes uninhabitable.
A biological attack on a water system is less likely than a chemical attack because the water purification system is designed to filter and kill bacteria. However, there is an easy way to thwart this system as well -- inject the toxin (either chemical or biological) into the system after purification. That is, inject the toxin into a water tower or water distribution main. Sound farfetched? As described in this article, one way to accomplish this goal is to pump the toxin from a home's faucet back up into the home's connection to the distribution main so that it threatens everyone else using that main. By selecting the home's address carefully, it might be possible to kill quite a few people. Any unsecured point in the distribution network is a potential point of attack.
Damage Potential
Potential damage ranges from the deaths of a few dozen people all the way up to thousands of deaths, depending on the type of attack and the amount of time it takes for people to discover the attack and shut down the water system.
In the worst-case scenario, the toxin would pollute the city's reservoirs so completely that they become totally unfit for human consumption. The reservoirs have to be drained, decontaminated and refilled. In that case, in certain cities, the city would become uninhabitable due to lack of water. People would have to evacuate the city.
Potential Solutions
This is a tough scenario. There are two reasons why it is so tough:
- We designed our water systems at a time when terrorism was not a threat. Now that terrorism is a big threat, it is difficult to defend these systems.
- Part of the design of our water systems is incredible centralization of resources. For example, the water system for New York City draws all of its water from a handful of lakes. The water flows through an even smaller number tunnels to get to the city.
There are innumerable points of attack, so any modern water system is difficult to defend. The following scenarios offer a sampling of the possibilities:
- Terrorists, dressed as bass fishermen, dump several 55-gallon barrels of toxin from their boat into the lake near the water purification plant's intake pipe.
- Terrorists, wearing scuba gear, swim underwater to a point near the water intake and disperse toxins.
- Terrorists, driving a pickup truck late on a stormy night, drive across a bridge that spans the reservoir. They pour the toxin onto the road from the bed of the truck as they drive. Because it is late and dark, no one sees them. Because it is raining, the rainwater washes the toxin off the bridge into the lake.
- On a rainy night, terrorists driving a tanker truck full of toxin pull up beside a creek in a remote area and dump in tons of toxin. The rain carries the toxin from the creek to a stream, from the stream to a river, from the river to the reservoir.
Short-term, given scenarios like these, there are six things we can do to start protecting our water systems:
- We can install equipment at the water treatment plant, its intakes, its reservoirs and at many points in its water distribution system to sniff for toxins and sound an alarm when they are detected.
- We can create and guard large buffer zones around water intakes
- We can secure and guard important access points in the water treatment plant and the distribution grid (water towers, pumping stations, etc.)
- We can stop the anonymous sale of toxins that could be used in an attack like this.
- We can use intelligence resources to try to detect an attack before it happens. This sort of work captured 4 terrorists in Italy in late February 2002 who were contemplating a water system attack.
- Citizens can store a one-week to two-week supply of drinking water in their homes in case of an emergency.
These steps avoid the "total solution", which is to intensely guard our lakes and the watersheds that feed them. We would need to close reservoirs to all recreational use, close and block all nearby roads, relocate residents in the watershed, and then fence, monitor and guard thousands of acres of land to actually secure a reservoir. And then there would still be holes. This solution is possible, but it seems unlikely in most cities in the current climate.
Longer term, we need to rethink the design of our water systems. New York City's water system, for example, is so centralized that just a few attacks (either toxic or explosive) can disable the entire system. That sort of centralization creates an inviting target.
The key is to start designing water systems that have redundancy and a distinct lack of centrality. Water should come from multiple sources (river, lake, well, runoff). It should flow through many disconnected systems to get where it is going. Right now, terrorists look at New York and see a very simple target list. A few attacks cause immense damage and shut down the system. If, instead, any attack had negligible effects on the system as a whole, there would be no little or value in attacking it. The terrorist threat disappears.
We must rethink our whole approach to water management and water system design to eliminate the terrorist threat.
Related Links
|