Audit: Many NY water providers fail to submit disaster plans

Although local water systems across New York are required to submit emergency response plans, about one in 10 failed to meet the latest deadline, and the state has been slow to follow up, according to a new audit from the state comptroller's office.

In response, the state Department of Health says it now has a policy to speed enforcement if plans are submitted late.

Community water systems that serve more than 3,300 people must prepare the plans at least every five years and submit them to the Department of Health’s Bureau of Water Supply Protection. The plans have two components: a vulnerability assessment identifying possible risks such as heavy storms and cyberattacks, and a plan to mitigate the damage.

An emergency plan is essentially “a playbook,” said Stan Carey, superintendent of water & sewer for the Village of Garden City. They contain "all the details on what to do, who to notify, when to notify the public. So it’s a very important tool to have to guide us through an emergency.”

But in an audit released last week, state Comptroller Thomas DiNapoli said 33 of 317 water systems surveyed had neglected to submit updated vulnerability assessments, and 32 systems submitted emergency response plans late. Thirty had never submitted a cybersecurity vulnerability assessment, required since 2018.

The audit does not name the water agencies surveyed, and DiNapoli’s office declined to say which systems had outdated plans.

A state Department of Health spokeswoman said none of the 44 Nassau and Suffolk water systems surveyed in the audit were late with their plans as of April 3, the most recent date for which the department had data.

DiNapoli's audit of emergency plans comes as municipal water supply and waste systems are at increasing risk from intensifying storms, drought and wildfire.

When Superstorm Sandy landed in 2012, some systems were overwhelmed, and billions of gallons of sewage spilled into rivers and coastal waters.

Updating emergency plans is “the bare minimum” in disaster planning, said Andrew Whelton, an environmental engineer with Purdue University who has advised utilities on disaster planning. Utilities need to practice various scenarios, so they are ready to make sound decisions in an emergency.

Written plans are a start, he said, “but if that’s all that’s been done, they can be in for a world of hurt if disaster strikes, because they may be just winging it.”

Carey said some of the responses required in the plans don’t change much from year to year. Storms may be stronger and more frequent, for example, but the plan for mitigating them remains essentially the same.

“We need to know that we have the latest information on hand,” including small but critical details such as contact information, said Carey, a member of the state’s Drinking Water Quality Council.

Preparedness plans for hurricanes "would need the latest information on where to get fuel for backup generators,” said Phil Thompson, deputy director of operations at the Suffolk County Water Authority.

Cybersecurity also is an area of concern “that has been evolving over the past couple of years,” Carey said.

According to the U.S. Cybersecurity and Infrastructure Security Agency, five cybersecurity attacks on U.S. water systems occurred between 2019 and early 2021. In one, a hacker accessed the computer system controlling a Florida water treatment plant and added lye to the water.

Rich Bova, emergency manager for the Suffolk County Water Authority, which has 1.2 million customers, said the agency has had a “robust cyber response plan” for several years that outlines how to preserve evidence and recover data in the event of a breach.

The state’s oversight of emergency plans also needs improvement, DiNapoli’s audit said.

The Department of Health and the state Division of Homeland Security and Emergency Services, which makes recommendations on disaster preparedness, don’t always communicate well, which “represents a gap” in oversight, the audit said.

It said the Health Department lacked effective follow-up procedures when revised plans were not submitted on time.

The department issued a notice of violation to five of the delinquent systems, but it also approved one plan before the requested changes had been made, the audit said.

In a written response to the audit, the department said it has a policy to "take escalating enforcement actions” if plans are submitted late. Its January 2023 review resulted in 51 notices of violation.