Water Over the Dam

By Fred Burton and Scott Stewart The response to last week’s Terrorism Intelligence Report on the Denver Water Board's decision to close the road running over the Dillon Dam took us a bit by surprise. We were not necessarily caught off guard by the volume of responses, but rather by a common theme that emerged in the responses we received. A substantial percentage of the readers who wrote in did so to ask if we believed the decision to close the road could have been made due to a threat to contaminate the drinking water in the reservoir, rather than a threat to destroy the dam itself. In fact, a few readers even accused us of having tunnel vision for not addressing the contamination threat in our analysis. We consider the readers who write to us to be a representative cross-section of our total audience. If this is indeed true, it indicates that there are a lot of people out there who are curious to know whether the Dillon Dam was indeed closed due to the threat of contamination. It also reveals that there is perhaps an even greater number of people who are concerned about the broader threat of the intentional contamination of drinking water. Because of this, we’ve decided to do something a little unusual this week and return to the topic of last week’s Terrorism Intelligence Report in order to address these two issues. We will briefly discuss the Dillon Dam situation to assess whether contamination could have been the threat that resulted in the road closure, and then use that discussion as a springboard to the larger issue of drinking water contamination.

Dillon Dam Contamination Threat

In order to understand the contamination threat to the water contained by the Dillon Dam (the Dillon Reservoir), we must first understand the layout of the dam, the road that runs over the dam, the reservoir itself, and the area surrounding it. First, the road that runs over the dam is separated from the water by several yards. A recreational trail that is several feet lower than the road runs between the road and the reservoir. Second, the road over the dam is patrolled 24/7 by armed guards and monitored by closed-circuit television (CCTV) cameras. (click map to enlarge) The Dillon Reservoir itself is very large. It has a surface area of 3,233 acres, is surrounded by 26.8 miles of shoreline and contains nearly 83 billion gallons of water. It is not only used as a source of drinking water for the city of Denver, but also serves as a major recreational area for camping, boating and fishing. The towns of Dillon and Frisco are both located on the edge of the reservoir, and both have marinas. There are also a number of campgrounds and picnic areas surrounding the lake, and there are many places where the roads surrounding the reservoir run in close proximity to the water. Because of these factors, we did not see the threat of contamination to the reservoir to be a realistic one. Contaminating 83 billion gallons of water to a meaningful level of toxicity would take a very large amount of agent. To take the contamination level of the water in the reservoir to just 10 parts per million would require 830,000 gallons of contaminant. That would require a fleet of over 55 tanker trucks carrying 15,000 gallons each. Manufacturing, transporting and distributing that quantity of agent would require a tremendous amount of effort. Secondly, even if one were able to manufacture a substantial quantity of toxic agent and transport it to the reservoir, from an operational standpoint, the road over the dam is simply not an ideal location from which to dump it into the reservoir. Draining a large amount of liquid from a tanker truck takes time, and any large vehicle that stopped on the road over the dam would be quickly noticed by the dam security force. Furthermore, the placement of the bike path between the road and the water would make it very difficult to ensure that whatever was dumped from the road would make it into the reservoir unless a long hose were used. Tactically, such an attempt would have a much higher chance of success if it were conducted in a more discreet place with less security and better access to the water’s edge. Backing a tanker truck down a boat ramp and dumping the contents of the truck directly into the water would likely be more effective. All in all, because the dam is not an optimal place to release a contaminant, and because the more suitable areas for doing were not closed to public access, it was fairly easy for us to deduce that the dam was closed due to the perceived threat of a bombing attack and not contamination. The statements published by the Denver Water Board also clearly indicate that the board made the decision to close the road over the dam due to the threat to the structure of the dam, and not a threat to the water behind it. Even though the Denver Water Board did not make its decision based on the contamination threat, let’s now take this opportunity to explore the topic of drinking water contamination.

Water Contamination

In general, there are several different types of substances that can be used to contaminate drinking water: pathogens, toxic metals, toxic organic compounds and radioactive material. Many of these elements are already present in water. Some occur naturally, like the pathogens E. coli, giardia and cryptosporidium, while others, like dioxin and Polychlorinated biphenyls (PCBs), result from human activity. Still others, like mercury and arsenic, find their way into water from both natural and human sources. Indeed, there are many places in the world where drinking water has been heavily contaminated by these toxins. Even in wilderness areas where the water appears to be crystal clear and pristine, people can still become sick from naturally occurring microorganisms like giardia. Because of the natural and man-made contamination in water, treatment plants have evolved over time, developing methods to either filter or kill potential hazardous elements. Most water treatment plants use a series of different processes to remove contaminants. Some of the processes are designed to remove the solids, while others utilize substances such as sand and activated carbon to filter it. Still other processes employ ozone, chlorine and chloramine to disinfect water. In some locations, treatment plants will even use technologies such as ultrafiltration and reverse osmosis to remove impurities. For the most part, water treatment plants do a good job of removing contaminants. Occasionally, however, a water treatment plant will experience a failure or be overtaken by a flood, which can result in contaminated water being delivered to homes. In 1993, for example, a water plant failure in Milwaukee led to the cryptosporidium infection of more than 400,000 people. More than 100 of those infected died as a result. Frequently, after a flood has compromised a water treatment plant, the community will be advised to boil drinking water until tests ensure that it is free of pathogens and other contaminants. Such water testing is not done only in emergency situations. Under Environmental Protection Agency guidelines (which are not just guidelines, but legally enforceable standards), drinking water must be regularly tested for the presence of various contaminants, including microorganisms, organic and inorganic toxins and radionuclides. Now, let’s look at intentional water contamination. Even if there were no water treatment plants that could detect or remove contamination, most water supply systems are enormous, and contaminating them with enough material to make the water toxic after the agent is diluted by all the water in the system would be very difficult. For example, there are 83 billion gallons of water in Dillon Reservoir. Denver Water, the company that operates the Dillon Reservoir, provides water to more than 1.1 million people and can process up to 715 million gallons of water a day at its three water treatment plants. This large quantity of water means that even if one could manufacture or otherwise obtain a large quantity of some sort of a pathogen or toxic compound, say, 3,000 gallons (the amount contained in a small tanker truck), the millions of gallons of water that flow daily through the major water mains in an urban area would still likely result in significant dilution, unless the contaminant could be injected into the system at a point close to the end of the line. Water systems handle about 168 gallons for each person served, which accounts for the hundreds of millions of gallons treated and transported daily. For example, a small concentration of something like sodium cyanide would have a harmful effect on people exposed to it over the long term. But in order to achieve an acute poisoning effect on a victim — the lethal dose for cyanide ingested by mouth to humans is between 50 milligrams and 200 milligrams — the concentrations would have to be much higher, and high concentrations are difficult to achieve in a system that involves hundreds of millions of gallons of water. In fact, it would take hundreds of thousands of tons of cyanide to contaminate the hundreds of millions of gallons of water that flow daily through the Denver Water system to the point where one glass of drinking water would contain enough cyanide to kill a person. This is not to mention that even the most incompetent of management at the worst water treatment center in the world would find it impossible to miss toxicity levels of such magnitude. Because of this dilution effect, toxins such as cyanide and ricin, which could conceivably be used to contaminate water, are generally more effective when used for targeted assassinations than they are in mass terror attacks. Even though a small amount of such substances is in theory enough to kill a large number of people, its distribution and dilution within a water system is difficult to predict, and efficiently dispersing such a substance in uniform, lethal doses would prove a daunting task. Furthermore, any person attempting to obtain a huge quantity of something like a cyanide compound from a commercial source would be carefully scrutinized in the post-9/11 environment. Existent waterborne pathogens could be injected into the system post-processing (and some pathogens are resistant to neutralizers like chlorine or chloramine in treated water), but the pressure in water lines makes such an attack difficult. Once water leaves the treatment facility, it is pressurized by pumping stations so that it will run through the thousands of miles of distribution pipelines and up into high-rise buildings. Injecting a contaminant into these pressurized water lines could prove difficult without the proper equipment to overcome that pressure. There are also pressure gauges and alarms on the pipelines, and any attempt to access them to inject a contaminant could trigger an alert. Using an existent pathogen, however, once again raises the issue of obtaining enough of the organisms to effectively contaminate the water system. The quantity problem could be overcome if some sort of super-pathogen were developed that could reproduce rapidly in water, bypass filtration, withstand disinfection and somehow pass water quality tests undetected. If such a bug were developed, a small quantity of the organism could conceivably be sufficient to contaminate an entire reservoir or water system. However, the development of such a vector would be very difficult and occupy a considerable amount of time and resources. This is because no such bug exists at present. Realistically, it would require the resources of a state, and not a lone wolf actor or a militant group, to design. Even then, the person engineering the organism would still have the additional challenge of assuring that it was sufficiently virulent to acutely infect its victims. Virulence is a huge issue in bioterrorism. It is something that groups who have carried out biological attacks in the past, like Aum Shinrikyo and the Bhagwan Shri Rajneesh cult, have struggled with. Granted, terrorist planners like Khalid Sheikh Mohammed have contemplated such attacks, among other chemical and biological weapons plots, but we have not seen concrete steps taken to implement such plans. This is likely due to the difficulty of conducting such an attack. Such schemes sound good when you are throwing ideas around, but they are very difficult to implement.

Realistic Vulnerabilities

In general, we do not believe that drinking water systems are the type of targets a militant organization such as al Qaeda or Hezbollah would choose to strike, as they do not have the inherent symbolism these groups generally look for when selecting targets. Such an attack would also not generate the same type of “shock and awe” effect that a suicide bombing or other more traditional attack would. However, a strike against the drinking water system of a highly recognizable city such as New York, Washington or Los Angeles might be seen as meeting this criterion. Other entities or actors, such as a delusional lone wolf or apocalyptic cult, might see the drinking water system in a particular city, like Denver, as a more attractive target. That said, there are still some vulnerabilities in the water supply system that would not require a super pathogen and are within the reach of many militant actors, should they choose to attack. Perhaps the largest vulnerability in any system is the water treatment plant itself. As we saw previously in the Milwaukee example, a failure at a treatment plant can result in a very large contamination incident. Such a failure could be induced by sabotage at the plant, though such sabotage might be quickly noticed if it were not conducted in a subtle manner, and warnings would be sounded. Because of this, perhaps the greatest threat to a treatment plant is that posed by insiders, such as engineers who understand the system and know how to disable or bypass the safeguards in that system. Another threat to the plant could come in the form of a clever and knowledgeable hacker who could assume control of the plant’s functions and subtly shut down critical systems. Such attacks would require far less resources than a program to genetically engineer a superbug. Another factor to consider is the psychological impact of even an unsuccessful attack if it were conducted in an obvious manner. The perpetrators could even conduct such an obvious attack knowing that they were not going to induce mass casualties, and that the water treatment system was going to thwart their plans, but proceed anyway in an effort to sow panic and create a huge disruption. This is where psychology comes in. If people hear that there is an incident at a water treatment plant due to a malfunction or flood and are asked to boil their water until further notice, they will do so without too much hysteria. However, if five apparent militants are seen dumping buckets into a reservoir — even if the contents of those buckets is green Kool-Aid — and people are asked to take the same course of action, the response is likely to be quite different. Even if tests failed to turn up evidence of a toxic substance, or enough of a toxic substance to make a measurable difference, the hysteria created by the specter of terrorism could very well have a tremendous psychological impact. Mass panic is likely to erupt. Like many other potential targets, the drinking water system is vulnerable to attack. In fact, it could be easily attacked — though such an undertaking would most likely be unsuccessful at creating mass casualties. Like the 2001 anthrax attacks, however, such an event could trigger mass panic that would cause far more disruption and economic impact than the immediate effects of the plot itself.