S. 67 — Introduced in Senate

II 113th CONGRESS 1st Session S. 67 IN THE SENATE OF THE UNITED STATES January 23 (legislative day, January 3), 2013 Mr. Lautenberg introduced the following bill; which was read twice and referred to the Committee on Environment and Public Works A BILL To amend the Safe Drinking Water Act and the Federal Water Pollution Control Act to authorize the Administrator of the Environmental Protection Agency to reduce or eliminate the risk of releases of hazardous chemicals from public water systems and wastewater treatment works, and for other purposes. 1. Short title; table of contents (a) Short title This Act may be cited as the Secure Water Facilities Act. (b) Table of contents The table of contents for this Act is as follows: Sec. 1. Short title; table of contents. TITLE I—Drinking water system security Sec. 101. Short title. Sec. 102. Intentional acts affecting security of covered water systems. Sec. 103. Study to assess threat of contamination of drinking water distribution systems. TITLE II—Wastewater treatment works security Sec. 201. Short title. Sec. 202. Wastewater treatment works security. Sec. 203. Study to assess threat of contamination of wastewater treatment works. I Drinking water system security 101. Short title This title may be cited as the Secure Drinking Water Facilities Act. 102. Intentional acts affecting security of covered water systems (a) Amendment (1) In general Section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) is amended to read as follows: 1433. Intentional acts affecting security of covered water systems (a) Definitions In this section: (1) Covered water system The term covered water system means a public water system that— (A) is a community water system serving a population of more than 3,300 individuals; or (B) as determined by the Administrator, presents a security risk that requires regulation under this section. (2) Secretary The term Secretary means the Secretary of Homeland Security. (b) Regulations (1) In general Not later than 2 years after the date of enactment of the Secure Water Facilities Act, the Administrator shall promulgate final regulations to establish— (A) risk-based performance standards for the security of covered water systems in accordance with subsection (c); and (B) requirements and deadlines for each covered water system— (i) (I) to conduct a vulnerability assessment in accordance with subsection (d) and submit the vulnerability assessment to the Administrator; or (II) if a vulnerability assessment has already been conducted relating to the covered water system— (aa) to revise the assessment in accordance with subsection (d); and (bb) to submit the revised assessment to the Administrator; (ii) to update and resubmit a vulnerability assessment relating to the covered water system— (I) not less frequently than once every 5 years; and (II) promptly after any change at the covered water system that could cause the reassignment of the covered water system to a different risk-based tier under subsection (h); (iii) to develop, implement, revise (as appropriate), and submit to the Administrator a site security plan in accordance with subsection (e)— (I) not less frequently than once every 5 years; and (II) promptly after any revision to the vulnerability assessment of the covered water system under clause (ii); (iv) (I) (aa) to develop an emergency response plan in accordance with subsection (f); or (bb) if an emergency response plan has already been developed for the covered water system, to revise the plan in accordance with subsection (f); and (II) to revise the plan not less frequently than once every 5 years; and (v) to provide annual training to employees and contractors of covered water systems regarding the implementation of site security plans and emergency response plans in accordance with subsection (g). (2) Consultation In promulgating regulations pursuant to paragraph (1), the Administrator shall consult with— (A) States that exercise primary enforcement responsibility for public water systems; and (B) the Secretary and other appropriate individuals and entities regarding— (i) a process for the development and evaluation of vulnerability assessments, site security plans, and emergency response plans; (ii) the development of risk-based performance standards under subsection (c); (iii) the establishment of risk-based tiers and a process for the assignment of covered water systems to the risk-based tiers under subsection (h); (iv) the designation of substances of concern under subsection (i); (v) the provision of threat-related and other baseline information to covered water systems under subsection (j); (vi) the treatment of protected information in accordance with subsection (o); and (vii) such other matters as the Administrator determines to be necessary. (c) Risk-Based performance standards (1) In general The risk-based performance standards for site security plans under this subsection shall be— (A) delineated by risk-based tier under subsection (h); and (B) increasingly stringent, based on the level of risk associated with each risk-based tier. (2) Factor for consideration In developing standards under this subsection, the Administrator shall take into consideration section 27.230 of title 6, Code of Federal Regulations (or successor regulations). (d) Vulnerability assessments (1) In general A vulnerability assessment under this subsection shall include an evaluation by each covered water system of the vulnerability of the covered water system to a range of intentional acts, including any intentional act that results in a release of a substance of concern that is known, or may be reasonably anticipated, to cause death, injury, or serious adverse effects to human health or the environment. (2) Minimum requirements At a minimum, a vulnerability assessment under this subsection shall include a review of, with respect to the relevant covered water system— (A) pipes and constructed conveyances; (B) physical barriers; (C) water collection, pretreatment, treatment, storage, and distribution facilities, including fire hydrants; (D) electronic, computer, and other automated systems that are used by the covered water system; (E) the use, storage, or handling of various chemicals, including substances of concern; (F) the operation and maintenance of the covered water system; and (G) the resiliency and ability of the covered water system to ensure continuity of operations in the event of a disruption caused by an intentional act. (e) Site security plans In developing and implementing a site security plan under this section, a covered water system may select layered security and preparedness measures that, in combination, appropriately— (1) address the security risks identified in the vulnerability assessment of the covered water system; and (2) comply with the applicable risk-based performance standards required under this section. (f) Emergency response plans (1) In general Each covered water system shall prepare or revise, as appropriate, an emergency response plan that incorporates the results of the most recent vulnerability assessment and site security plan of the covered water system. (2) Contents An emergency response plan under this subsection shall include— (A) a description of the plans and procedures, and an identification of the equipment, that can be implemented or used in the event of an intentional act at the covered water system; and (B) a description of the actions and procedures, and an identification of the equipment, that can obviate or significantly lessen the impact on public health and the safety and supply of drinking water provided to communities and individuals of an intentional act at the covered water system. (3) Coordination (A) In general As part of the emergency response plan of a covered water system, each covered water system shall provide to the individuals and entities described in subparagraph (B) appropriate information to ensure an effective collective response to an intentional act at the covered water system. (B) Description of individuals and entities An individual or entity referred to in subparagraph (A) is— (i) a local emergency planning committee; (ii) a State emergency response commission; (iii) a local law enforcement official; or (iv) a local emergency response provider. (4) Certification (A) In general Not later than 180 days after the date on which a vulnerability assessment is completed or revised, as appropriate, for a covered water system under subsection (d), the covered water system shall submit to the Administrator a certification that the covered water system has completed an emergency response plan in accordance with this subsection. (B) Updates As soon as practicable after any update of an emergency response plan of a covered water system under this section, a covered water system shall submit to the Administrator an updated certification under subparagraph (A). (g) Role of employees (1) Description of role Each site security plan and emergency response plan required under this section shall describe the appropriate roles and responsibilities that employees and contractors of the covered water system are expected to perform to deter or respond to an intentional act described in subsection (h)(2)(C). (2) Training for employees Not less frequently than once each year, each covered water system shall provide to employees and contractors of the covered water system with roles or responsibilities described in paragraph (1) not less than 8 hours of training regarding the conduct of those roles and responsibilities. (3) Employee participation In developing, revising, or updating a vulnerability assessment, site security plan, or emergency response plan required under this section, a covered water system shall include— (A) at least 1 supervisory and at least 1 nonsupervisory employee of the covered water system; and (B) at least 1 representative of each certified or recognized bargaining agent representing employees or contractors of the covered water system with roles or responsibilities described in paragraph (1), if any, in a collective bargaining relationship with the private or public owner or operator of the covered water system or a contractor to the covered water system.  (h) Risk-Based tiers (1) Establishment The Administrator shall establish, by regulation, 4 risk-based tiers for the categorization of covered water systems under this section, with tier 1 representing the highest degree of security risk. (2) Assignment (A) In general The Administrator shall assign (and reassign, as appropriate) each covered water system to 1 of the risk-based tiers established under paragraph (1). (B) Submission of information The Administrator may require a covered water system to submit to the Administrator such information as the Administrator determines to be necessary to determine the appropriate risk-based tier for the covered water system. (C) Factors for consideration In assigning a covered water system to a risk-based tier under this paragraph, the Administrator shall take into consideration— (i) the potential consequences (such as death, injury, or serious adverse effects to human health, the environment, critical infrastructure, national security, and the national economy) of an intentional act at the covered water system— (I) to cause a release, including a worst-case release, of a substance of concern; (II) (aa) to introduce a contaminant into the drinking water supply; or (bb) to disrupt the safe and reliable supply of drinking water; and (III) to steal, misappropriate, or misuse a substance of concern; (ii) the size of the population served; and (iii) the proximity of the water system to large population centers. (3) Explanation for risk-based tier assignment The Administrator shall provide to each covered water system assigned to a risk-based tier under this subsection a written explanation of— (A) the reasons for the assignment to that risk-based tier; and (B) the determination by the Administrator regarding whether the covered water system is required to submit an assessment under subsection (k)(2). (i) Substances of concern For purposes of this section, the Administrator, in consultation with the Secretary— (1) may designate any chemical substance as a substance of concern, taking into consideration appendix A of part 27 of title 6, Code of Federal Regulations (or successor regulations); and (2) on the designation of a chemical substance as a substance of concern under paragraph (1), shall establish, by regulation, a threshold quantity for the release or theft of the chemical substance, taking into consideration— (A) the toxicity, reactivity, volatility, dispersability, combustibility, and flammability of the chemical substance; and (B) the quantity of the chemical substance that, as a result of a release, is known, or may be reasonably anticipated, to cause death, injury, or serious adverse effects to human health or the environment. (j) Baseline information To facilitate compliance with the requirements of this section, as soon as practicable after the effective date of the regulations promulgated pursuant to subsection (b), and thereafter as appropriate, the Administrator, after consultation with appropriate Federal departments and agencies and State, local, and tribal governments, shall provide baseline information to covered water systems regarding the types of intentional acts that constitute probable threats with respect to— (1) the substantial disruption of the ability of the covered water system to provide a safe and reliable supply of drinking water; (2) the release of a substance of concern at the covered water system; or (3) the theft, misuse, or misappropriation of a substance of concern at the covered water system. (k) Methods To reduce consequences of chemical releases from intentional acts (1) Definition of method to reduce the consequences of a chemical release from an intentional act (A) In general In this subsection, the term method to reduce the consequences of a chemical release from an intentional act means a measure at a covered water system that reduces or eliminates the potential consequences of a release of a substance of concern from an intentional act. (B) Inclusions The term method to reduce the consequences of a chemical release from an intentional act includes— (i) the elimination or reduction in quantity of a substance of concern possessed or planned to be possessed by a covered water system through the use of alternate substances, formulations, or processes; (ii) the modification of the pressure, temperature, or concentration of a substance of concern; and (iii) the reduction or elimination of onsite handling of a substance of concern through improvement of inventory control or chemical use efficiency. (2) Assessment (A) In general Each covered water system that possesses or plans to possess a substance of concern in excess of the release threshold quantity established by the Administrator under subsection (i)(2)(B) shall— (i) include in the site security plan of the covered water system an assessment of methods to reduce the consequences of a chemical release from an intentional act at the covered water system; and (ii) submit the assessment under clause (i) to— (I) the Administrator; and (II) the State exercising primary enforcement responsibility for the covered water system, if any. (B) Factors for consideration In preparing an assessment under this paragraph, a covered water system shall take into consideration factors appropriate to ensuring public health and the security and environmental mission of the covered water system. (C) Inclusions Each assessment under this paragraph shall include a description of— (i) the methods to reduce the consequences of a chemical release from an intentional act at the covered water system; (ii) the means by which each method to reduce the consequences of a chemical release from an intentional act at the covered water system could, if applied— (I) reduce the potential extent of death, injury, or serious adverse effects to human health resulting from the chemical release; and (II) affect the presence of contaminants in treated water, human health, or the environment; (iii) whether each described method to reduce the consequences of a chemical release from an intentional act at the covered water system is feasible (as defined in section 1412(b)(4)(D)), not including consideration of the costs calculated under clause (iv); (iv) the costs (including capital and operational costs) and avoided costs (including savings and liabilities) associated with applying each method to reduce the consequences of a chemical release from an intentional act at the covered water system; (v) any other relevant information relied on by the covered water system in conducting the assessment; (vi) whether the covered water system has implemented or plans to implement 1 or more methods to reduce the consequences of a chemical release from an intentional act and a description of any such method; and (vii) in the case of a covered water system described in paragraph (3)(A), an explanation of the reasons for any decision not to implement a method to reduce the consequences of a chemical release from an intentional act at the covered water system. (3) Required methods (A) Applicability This paragraph applies to a covered water system that— (i) is assigned to 1 of the 2 highest risk-based tiers under subsection (h); and (ii) possesses or plans to possess a substance of concern in excess of the release threshold quantity established by the Administrator under subsection (i)(2)(B). (B) Highest-risk systems If, on the basis of an assessment under paragraph (2), a covered water system described in subparagraph (A) decides not to implement a method to reduce the consequences of a chemical release from an intentional act at the covered water system— (i) the State exercising primary enforcement responsibility for the covered water system (if the covered water system is located in such a State) shall, in accordance with a timeline established by the Administrator— (I) determine whether to require the covered water system to implement the method to reduce the consequences of a chemical release from an intentional act; and (II) notify the Administrator of the determination; or (ii) the Administrator (if the covered water system is not located in a State that exercises primary enforcement responsibility for the covered water system) shall determine whether to require the covered water system to implement the method to reduce the consequences of a chemical release from an intentional act. (C) Factors for consideration Before making a determination to require implementation of a method to reduce consequences of a chemical release from an intentional act under clause (i)(I) or (ii) of subparagraph (B), the State or the Administrator, as applicable, shall take into consideration factors appropriate to the security, public health, and environmental missions of covered water systems, including an examination of whether the applicable method to reduce the consequences of a chemical release from an intentional act— (i) would significantly reduce the risk of death, injury, or serious adverse effects to human health resulting directly from a chemical release from an intentional act at the covered water system; (ii) would not increase the interim storage of a substance of concern by the covered water system; (iii) would not render the covered water system unable to comply with— (I) other requirements of this Act; or (II) drinking water standards established by the State or political subdivision in which the covered water system is located; and (iv) is feasible (as defined in section 1412(b)(4)(D)) to be incorporated into the operation of the covered water system. (D) Appeals If a determination is made to require a covered water system to implement a method to reduce the consequences of a chemical release from an intentional act under clause (i)(I) or (ii) of subparagraph (B), the State or the Administrator, as applicable, shall provide to the affected covered water system an opportunity to appeal the determination, including the opportunity for a determination of consequences of an intentional act occurring outside the covered water system pursuant to subparagraph (E). (E) Consequences of an intentional act occurring outside a covered water system (i) In general A covered water system may request, as part of an appeal under subparagraph (D), a determination of whether the implementation of a method to reduce the consequences of a chemical release from an intentional act would result in a significant increase in the existing potential consequences of an intentional act occurring outside the covered water system that is directly related to the method to reduce consequences of an intentional act at the covered water system that is the subject of the appeal. (ii) Duties upon receipt of request Upon receiving a request under clause (i)— (I) the State exercising primary enforcement responsibility for the covered water system (if the covered water system is located in such a State) shall notify the Administrator, and the Administrator shall consult with the Secretary, as necessary, to quantify whether there will be a significant increase in the existing potential consequences of an intentional act occurring outside the covered water system (that is directly related to the method to reduce consequences of an intentional act at the covered water system that is the subject of the appeal) as compared to the consequences of a chemical release at the covered water system that would be reduced by the implementation of the method; or (II) the Administrator (if the covered water system is not located in a State exercising primary enforcement responsibility for the covered water system) shall consult with the Secretary, as necessary, to quantify whether there will be a significant increase in the existing potential consequences of an intentional act occurring outside the covered water system (that is directly related to the method to reduce consequences of an intentional act at the covered water system that is the subject of the appeal) as compared to the consequences of a chemical release at the covered water system that would be reduced by the implementation of the method. (iii) Significantly increased consequences outside covered water system If a determination is made pursuant to subclause (I) or (II) of clause (ii) that implementation of a method to reduce consequences of a chemical release from an intentional act pursuant to clause (i)(I) or (ii) of subparagraph (B) would result in a significant increase in the existing potential consequences of an intentional act occurring outside the covered water system as compared to the reduced consequences of a chemical release at the covered water system, the State exercising primary enforcement responsibility for the covered water system (if the covered water system is located in such a State), or the Administrator (if the covered water system is not located in a State exercising primary enforcement responsibility for the covered water system), shall take into consideration the determination made under this subparagraph when making a final determination under clause (i)(I) or (ii) of subparagraph (B). (4) Incomplete and late assessments (A) Incomplete assessments (i) In general If the Administrator determines that a covered water system failed to meet the requirements of this subsection in conducting an assessment, the Administrator, after notifying the covered water system and the State exercising primary enforcement responsibility for the covered water system, if any, shall require the covered water system to submit a revised assessment in accordance with this subsection by not later than 60 days after the date of receipt of notification. (ii) Review The State exercising primary enforcement responsibility for a covered water system subject to clause (i) (if the covered water system is located in such a State) or the Administrator (if the covered water system is not located in such a State) shall review a revised assessment submitted under clause (i) to determine whether to require the covered water system to implement any method to reduce the consequences of an intentional act pursuant to paragraph (3). (B) Late assessments If the Administrator determines that a covered water system failed to complete an assessment under this subsection in accordance with the deadline established for completion by the Administrator, the Administrator, after notifying the covered water system and the State exercising primary enforcement responsibility for the covered water system, if any, may take appropriate enforcement action under subsection (q). (5) Failures by State to act (A) Determinations (i) In general If the Administrator determines that a State exercising primary enforcement responsibility for a covered water system has failed to determine whether to require the covered water system to implement a method to reduce the consequences of a chemical release from an intentional act, as required by paragraph (3)(B)(i)(I), the Administrator shall notify the State and the applicable covered water system of the determination. (ii) Action by Administrator If a State has failed to make a determination required by paragraph (3)(B)(i)(I) by the date that is 30 days after the date of receipt of the notice of the Administrator under clause (i), the Administrator shall— (I) notify the State and the applicable covered water system of the failure by the State to make the determination; and (II) determine whether to require the covered water system to implement the applicable method to reduce the consequences of a chemical release from an intentional act, based on the factors described in paragraph (3)(C). (B) Enforcement actions (i) In general If the Administrator determines that a covered water system, with respect to a period in which a State has primary enforcement responsibility for the system, has failed to implement a method to reduce the consequences of a chemical release from an intentional act that is required by the State or the Administrator under paragraph (3)(B), or by the Administrator under subparagraph (A), the Administrator shall notify the State and the covered water system of the determination. (ii) Enforcement actions If the Administrator determines that a State has failed to commence an appropriate enforcement action by the date that is 30 days after the date of notification by the Administrator under clause (i), the Administrator shall— (I) notify the State and the applicable covered water system of the determination; and (II) determine whether to commence an appropriate enforcement action against the covered water system in accordance with subsection (q) to require the implementation of the relevant method to reduce the consequences of a chemical release from an intentional act at the covered water system. (C) Consideration of continued primary enforcement responsibility The Administrator may take into consideration the failure of a State with primary enforcement responsibility for a covered water system to make a determination as described in subparagraph (A), or to bring an enforcement action as described in subparagraph (B), in determining whether the State may retain primary enforcement responsibility for the covered water system under this Act. (6) Guidance for covered water systems (A) Guidance Not later than 180 days after the date of enactment of the Secure Water Facilities Act, the Administrator shall develop, and update thereafter as appropriate, nonbinding guidance, including guidance regarding Federal procurement, to assist covered water systems in assessing and implementing methods to reduce consequences of a chemical release from an intentional act by reducing or eliminating reliance on the use of threshold quantities of substances of concern at the covered water systems, as established under subsection (i)(2)(B). (B) Recommendations The Administrator shall, as appropriate, provide or recommend tools, methodologies, or computer software to assist covered water systems assigned to tier 3 or tier 4 under subsection (h) and required to conduct an assessment under paragraph (2) to achieve compliance with the requirements of this section. (l) Review by Administrator (1) In general Each covered water system shall submit to the Administrator the vulnerability assessment and site security plan of the covered water system, in accordance with such deadline as the Administrator may establish. (2) Review The Administrator shall— (A) review each vulnerability assessment and site security plan submitted under this subsection; and (B) (i) if the assessment or plan has any significant deficiency described in paragraph (3), require the covered water system to correct the deficiency; or (ii) approve the assessment or plan. (3) Significant deficiencies (A) In general Subject to subparagraph (B), a vulnerability assessment or site security plan of a covered water system has a significant deficiency under this paragraph if the Administrator, in consultation with the State exercising primary enforcement responsibility for the covered water system, if any, determines that— (i) the vulnerability assessment does not comply with the regulations promulgated pursuant to subsection (b); or (ii) the site security plan fails— (I) to meet applicable risk-based performance standards under subsection (c); or (II) to address a vulnerability identified in the vulnerability assessment under subsection (d). (B) Exclusion A deficiency in the content or implementation of the portion of the site security plan of a covered water system relating to methods to reduce the consequences of a chemical release from an intentional act shall not be considered to be a significant deficiency under this paragraph. (4) Identification of deficiencies If the Administrator identifies a significant deficiency in the vulnerability assessment or site security plan of a covered water system under paragraph (3), the Administrator shall provide to the covered water system a written notification of the deficiency that— (A) includes a clear explanation of the deficiency; (B) provides guidance to assist the covered water system in addressing the deficiency; and (C) requires the covered water system— (i) to correct the deficiency; and (ii) by such date as the Administrator determines to be appropriate, to submit to the Administrator a revised vulnerability assessment or site security plan. (5) State, regional, and local governmental entities No covered water system shall be required under State, local, or tribal law to provide a vulnerability assessment or site security plan under this section to any State, regional, local, or tribal governmental entity solely due to the requirement of paragraph (1) to submit such an assessment or plan to the Administrator. (m) Maintenance of records Each covered water system shall maintain an updated copy of the vulnerability assessment, site security plan, and emergency response plan of the covered water system. (n) Audits; inspections (1) In general Notwithstanding section 1445(b)(2), the Administrator (or a designee) shall audit and inspect covered water systems as necessary to determine compliance with this section. (2) Access In conducting an audit or inspection of a covered water system under this subsection, the Administrator shall have access to the owners, operators, employees, contractors, and employee representatives, if any, of the covered water system. (3) Confidential communication of information; aiding inspections (A) Confidential communication of information The Administrator shall offer nonsupervisory employees of a covered water system the opportunity to confidentially communicate to the Administrator information relevant to the compliance or noncompliance by the covered water system with the requirements of this section (including regulations promulgated pursuant to this section). (B) Aiding inspections A representative of each certified or recognized bargaining agent described in subsection (g)(3)(B), or a nonsupervisory employee if no such representative exists, shall be given an opportunity to accompany the Administrator during any physical inspection of a covered water system under this subsection to assist in the inspection, if a representative of the covered water system will also be accompanying the Administrator during the inspection. (o) Protection of information (1) Definition of protected information (A) In general In this section, the term protected information means— (i) a vulnerability assessment or site security plan under this section (including any assessment developed under subsection (k)(2)); (ii) any document directly relating to a review by the Administrator of an assessment or plan described in clause (i), and, where applicable, review by a State of an assessment developed under subsection (k)(2); (iii) any document directly relating to an inspection or audit under subsection (n); (iv) any order, notice, or letter regarding the compliance of a covered water system with the requirements of this section; (v) any information, document, or record required to be provided to, or created by, the Administrator under subsection (h); (vi) any document directly related to— (I) a security drill or training exercise; (II) a security threat or breach; or (III) maintenance, calibration, or testing of security equipment; and (vii) any other information, document, or record developed exclusively for purposes of this section, the disclosure of which, as determined by the Administrator, by regulation, would be detrimental to the security of 1 or more covered water systems. (B) Detriment requirement For purposes of clauses (ii) through (vi) of subparagraph (A), the only portion of any document, record, order, notice, or letter that shall be considered to be protected information is any portion— (i) the disclosure of which, as determined by the Administrator, by regulation, would be detrimental to the security of 1 or more covered water systems; and (ii) that is developed by the Administrator, a State, or a covered water system for purposes of this section. (C) Exclusions The term protected information does not include— (i) any information, other than a vulnerability assessment or site security plan, that the Administrator has determined, by regulation— (I) to be appropriate to demonstrate compliance by a covered water system with the requirements of this section; and (II) would not be detrimental to the security of any covered water system if disclosed; or (ii) any information that is obtained from another source with respect to which the Administrator has not made a determination under subparagraph (A)(vii) or (B), regardless of whether the information is included in an assessment or plan under this section, including— (I) information that is required to be made publicly available under any other provision of law; and (II) information that a covered water system has lawfully disclosed other than through a submission to the Administrator under this section. (2) Prohibition Protected information— (A) shall be exempt from disclosure under section 552 of title 5, United States Code; and (B) shall not be made available pursuant to any State, local, or tribal law requiring disclosure of information or records. (3) Information sharing (A) In general The Administrator shall promulgate such regulations, and may issue such orders, as the Administrator determines to be necessary to prohibit the unauthorized disclosure of protected information. (B) Sharing of protected information (i) In general The regulations under subparagraph (A) shall establish standards for, and facilitate, the appropriate sharing of protected information among— (I) Federal, State, local, and tribal authorities; (II) first responders; (III) law enforcement officials; (IV) designated supervisory and nonsupervisory covered water system personnel with security, operational, or fiduciary responsibility for the covered water system; and (V) designated employee representatives of covered water systems, if any. (ii) Inclusions The standards established under clause (i) shall include procedures for the sharing of all portions of a vulnerability assessment or site security plan of a covered water system relating to the roles and responsibilities of employees or contractors of the covered water system under subsection (g) with— (I) a representative of each certified or recognized bargaining agent representing those employees and contractors, if any; or (II) if a representative described in subclause (I) does not exist, at least 1 supervisory and at least 1 nonsupervisory employee with roles and responsibilities described in subsection (g). (C) Penalties (i) In general Protected information shall not be shared, except in accordance with the standards established and orders issued pursuant to subparagraph (A). (ii) Knowing violation Whoever discloses protected information in knowing violation of the regulations promulgated under paragraph (1) shall— (I) be fined under title 18, United States Code, imprisoned for not more than 1 year, or both; and (II) in the case of a Federal officeholder or employee, removed from Federal office or employment. (4) Treatment of information in adjudicative proceedings In any judicial or administrative proceeding, protected information shall be treated in a manner consistent with the treatment of sensitive security information under section 525 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295; 120 Stat. 1381). (5) Other obligations unaffected Except as provided in subsection (l)(5), nothing in this section modifies or otherwise affects an obligation of a covered water system— (A) to submit or make available information to employees of the covered water system, employee organizations, health professionals, emergency response organizations, or a Federal, State, tribal, or local government agency under any other provision of law; or (B) to comply with any other provision of law. (6) Congressional oversight Nothing in this section authorizes the withholding of information from Congress. (7) Disclosure of independently furnished information Nothing in this section modifies or otherwise affects any authority or obligation of a Federal, State, local, or tribal agency to protect or disclose any record or information that the Federal, State, local, or tribal government agency obtains from a covered water system or the Administrator under any other provision of law. (p) Preemption Nothing in this section precludes or denies the right of any State or political subdivision of a State to adopt or enforce any regulation, requirement, or standard of performance with respect to a covered water system that is more stringent than a regulation, requirement, or standard of performance established under this section. (q) Violations (1) In general A covered water system that violates any requirement of this section (including by failing to implement all or part of an applicable site security plan by such date as the Administrator may require) shall be liable for a civil penalty in an amount equal to not more than $25,000 for each day of the violation. (2) Procedure On a determination by the Administrator that a covered water system is subject to a civil penalty under paragraph (1), the Administrator, after consultation with the State for a covered water system located in a State exercising primary responsibility for the covered water system, and after taking into consideration the severity of the violation or deficiency and the record of the covered water system in carrying out the requirements of this section, may— (A) after providing notice and an opportunity for the covered water system to be heard, issue an order— (i) assessing a penalty under paragraph (1) for any past or current violation; and (ii) requiring compliance immediately or within a specified time period; or (B) commence a civil action in the United States district court in the district in which the violation occurred for appropriate relief, including temporary or permanent injunction. (3) Methods to reduce consequences of chemical releases from intentional acts Except as provided in paragraphs (4) and (5) of subsection (k), if a covered water system is located in a State exercising primary enforcement responsibility for the covered water system, the Administrator may not issue an order or commence a civil action under this section for any deficiency in the content or implementation of the portion of the site security plan of the covered water system relating to methods to reduce the consequences of a chemical release from an intentional act (as defined in subsection (k)(1)). (r) Reports to Congress (1) Annual report Not later than 3 years after the effective date of the regulations promulgated pursuant to subsection (b), and annually thereafter for each of the following 8 calendar years, the Administrator shall submit to the Committee on Environment and Public Works of the Senate and the Committee on Energy and Commerce of the House of Representatives a report describing the progress made during the reporting period in achieving compliance with this section, including, at a minimum— (A) a generalized summary of measures implemented by covered water systems to meet each risk-based performance standard established under subsection (c); and (B) a summary of the means by which— (i) covered water systems, as categorized by risk-based tier assignment under subsection (h), are achieving compliance with the requirements of this section; and (ii) the Administrator is implementing and enforcing those requirements, including a description of— (I) the number of public water systems that provided information to the Administrator pursuant to subsection (h)(2)(B); (II) the number of covered water systems assigned to each risk-based tier under subsection (h); (III) the number of vulnerability assessments and site security plans— (aa) submitted by covered water systems; and (bb) approved and disapproved by the Administrator; (IV) the number of covered water systems without approved vulnerability assessments or site security plans in place; (V) (aa) the number of covered water systems that have been assigned to a different risk-based tier or are no longer regulated by the Administrator under this section due to implementation of a method to reduce the consequences of a chemical release from an intentional act; and (bb) a description of the types of each such method to reduce the consequences of a chemical release from an intentional act; (VI) the number of audits and inspections conducted by the Administrator (or a designee) under subsection (n); (VII) the number of orders for compliance issued by the Administrator under subsection (q); (VIII) the administrative penalties assessed by the Administrator for noncompliance with the requirements of this section; (IX) the civil penalties assessed by courts for noncompliance with the requirements of this section; and (X) any other regulatory data the Administrator determines to be appropriate to describe— (aa) compliance by covered water systems with the requirements of this section; and (bb) the implementation by the Administrator of those requirements. (2) Public availability Each report submitted under this section shall be made publicly available. (s) Grant programs (1) Implementation grants to States The Administrator may provide grants to, or enter into cooperative agreements with, States, based on an allocation formula established by the Administrator, to assist the States in implementing this section. (2) Research, training, and technical assistance grants The Administrator may provide grants to, or enter into cooperative agreements with, nonprofit organizations to provide research, training, and technical assistance to covered water systems to assist the covered water systems in achieving compliance with this section. (3) Preparation grants (A) Grants The Administrator may provide grants to, or enter into cooperative agreements with, covered water systems to assist the covered water systems in— (i) preparing and updating vulnerability assessments, site security plans, and emergency response plans; (ii) assessing and implementing methods to reduce the consequences of a release of a substance of concern from an intentional act; and (iii) implementing any other security reviews or enhancements that are necessary to achieve compliance with this section. (B) Priority (i) Need In providing grants and entering into cooperative agreements under subparagraph (A)(i), the Administrator shall give priority to covered water systems that, as determined by the Administrator, have the greatest need. (ii) Security risk In providing grants and entering into cooperative agreements under subparagraph (A)(ii), the Administrator shall give priority to covered water systems that, as determined by the Administrator, present the greatest security risk. (4) Worker training grants (A) Definition of eligible entity In this paragraph, the term eligible entity means a nonprofit organization with demonstrated experience in implementing and operating successful worker or first responder health and safety or security training programs. (B) Grants The Administrator shall establish a program under which the Administrator shall provide grants to eligible entities to provide for training and education of— (i) employees and contractors of covered water systems with roles or responsibilities described in subsection (g); and (ii) first responders and emergency response providers who would respond to an intentional act at a covered water system. (C) Administration The Administrator shall offer to enter into an agreement with the National Institute of Environmental Health Sciences to administer the program under this paragraph. (D) Use of funds An eligible entity shall use a grant received under this paragraph for— (i) training and education of employees and contractors with roles or responsibilities described in subsection (g), including the annual mandatory training specified in subsection (g)(2), with priority given to covered water systems assigned to tier 1 or tier 2 under subsection (h); (ii) training of first responders in protecting nearby residents and property or the environment from the effects of a release of a substance of concern at a covered water system, with priority given to covered water systems assigned to tier 1 or tier 2 under subsection (h); and (iii) appropriate training for first responders and emergency response providers who would respond to an intentional act at a covered water system. (t) Timely provision of threat-Related information The Secretary shall, upon receipt of information concerning a specific threat that is relevant to a certain covered water system, provide the information in a timely manner, to the maximum extent practicable under applicable authority and in the interests of national security, to— (1) the covered water system; (2) the Administrator; and (3) appropriate Federal, State, and local law enforcement officials. (u) Authorization of appropriations (1) In general There is authorized to be appropriated to carry out this section $340,000,000 for each of fiscal years 2013 through 2017, of which— (A) not more than $30,000,000 may be used during each fiscal year for administrative costs incurred by the Administrator or States, as applicable, in carrying out this section; and (B) not more than $225,000,000 may be used during each fiscal year to implement methods to reduce the consequences of chemical releases from intentional acts at covered water systems, with priority given to covered water systems assigned to tier 1 or tier 2 under subsection (h). (2) Security enhancements Amounts provided under this subsection for basic security enhancements shall not be used for— (A) personnel costs; or (B) monitoring, operation, or maintenance of facilities, equipment, or systems. (v) Relation to chemical facility security requirements No provision of any appropriations Act relating to chemical facility security, and no law or regulation establishing a chemical facility antiterrorism standard, shall apply to a covered water system under this section. . (2) Effective date The amendment made by paragraph (1) takes effect on the date of promulgation by the Administrator of the Environmental Protection Agency of final regulations pursuant to subsection (b)(1) of section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) (as amended by paragraph (1)). (b) Effect of section (1) In general Nothing in this section or the amendment made by this section affects the applicability of section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) (as in effect before the effective date of the amendment made by subsection (a)(1)) to any violation of that section that occurs before that effective date. (2) Violations The requirements of section 1433 of the Safe Drinking Water Act (42 U.S.C. 300i–2) (as in effect before the effective date of the amendment made by subsection (a)(1)) shall remain in effect with respect to violations described in paragraph (1) until the later of— (A) the date on which the violation is corrected; and (B) the date on which enforcement proceedings relating to the violation are completed. 103. Study to assess threat of contamination of drinking water distribution systems Not later than 180 days after the date of enactment of this Act, the Administrator of the Environmental Protection Agency, in consultation with the Secretary of Homeland Security, shall— (1) conduct a study to assess— (A) the threat to drinking water posed by intentional acts of contamination; and (B) the vulnerability of public water systems, including fire hydrants, to such a threat; and (2) submit to the Committee on Environment and Public Works of the Senate and the Committee on Energy and Commerce of the House of Representatives a report describing the results of the study. II Wastewater treatment works security 201. Short title This title may be cited as Secure Wastewater Treatment Facilities Act. 202. Wastewater treatment works security (a) Amendment (1) In general Title III of the Federal Water Pollution Control Act (33 U.S.C. 1311 et seq.) is amended by adding at the end the following: 321. Wastewater treatment works security (a) Definitions In this section: (1) Covered treatment works The term covered treatment works means a treatment works that— (A) has a treatment capacity of not less than 2,500,000 gallons per day; or (B) as determined by the Administrator, presents a security risk that requires regulation under this section. (2) Secretary The term Secretary means the Secretary of Homeland Security. (b) Regulations (1) In general Not later than 2 years after the date of enactment of the Secure Water Facilities Act, the Administrator shall promulgate final regulations to establish— (A) risk-based performance standards for the security of covered treatment works in accordance with subsection (c); and (B) requirements and deadlines for each covered treatment works— (i) (I) to conduct a vulnerability assessment in accordance with subsection (d) and submit the vulnerability assessment to the Administrator; or (II) if a vulnerability assessment has already been conducted relating to the covered treatment works— (aa) to revise the assessment in accordance with subsection (d); and (bb) to submit the revised assessment to the Administrator; (ii) to update and resubmit a vulnerability assessment relating to the covered treatment works— (I) not less frequently than once every 5 years; and (II) promptly after any change at the covered treatment works that could cause the reassignment of the covered treatment works to a different risk-based tier under subsection (h); (iii) to develop, implement, revise (as appropriate), and submit to the Administrator a site security plan in accordance with subsection (e)— (I) not less frequently than once every 5 years; and (II) promptly after any revision to the vulnerability assessment of the covered treatment works under clause (ii); (iv) (I) (aa) to develop an emergency response plan in accordance with subsection (f); or (bb) if an emergency response plan has already been developed for the covered treatment works, to revise the plan in accordance with subsection (f); and (II) to revise the plan not less frequently than once every 5 years; and (v) to provide annual training to employees and contractors of covered treatment works regarding the implementation of site security plans and emergency response plans in accordance with subsection (g). (2) Consultation In promulgating regulations pursuant to paragraph (1), the Administrator shall consult with— (A) States with approved programs under section 402; and (B) the Secretary and other appropriate individuals and entities regarding— (i) a process for the development and evaluation of vulnerability assessments, site security plans, and emergency response plans; (ii) the development of risk-based performance standards under subsection (c); (iii) the establishment of risk-based tiers and a process for the assignment of covered treatment works to the risk-based tiers under subsection (h); (iv) the designation of substances of concern under subsection (i); (v) the provision of threat-related and other baseline information to covered treatment works under subsection (j); (vi) the treatment of protected information in accordance with subsection (o); and (vii) such other matters as the Administrator determines to be necessary. (c) Risk-Based performance standards (1) In general The risk-based performance standards for site security plans under this subsection shall be— (A) delineated by risk-based tier under subsection (h); and (B) increasingly stringent, based on the level of risk associated with each risk-based tier. (2) Factor for consideration In developing standards under this subsection, the Administrator shall take into consideration section 27.230 of title 6, Code of Federal Regulations (or successor regulations). (d) Vulnerability assessments (1) In general A vulnerability assessment under this subsection shall include an evaluation by each covered treatment works of the vulnerability of the covered treatment works to a range of intentional acts, including any intentional act that results in a release of a substance of concern that is known, or may be reasonably anticipated, to cause death, injury, or serious adverse effects to human health or the environment. (2) Minimum requirements At a minimum, a vulnerability assessment under this subsection shall include a review of, with respect to the relevant covered treatment works— (A) intercepting sewers, outfall sewers, sewage collection systems, and other constructed conveyances under the control of the treatment works; (B) physical barriers; (C) facilities, systems, and devices used in the storage, treatment, recycling, or reclamation of municipal sewage or industrial wastes; (D) electronic, computer, and other automated systems that are used by the covered treatment works; (E) the use, storage, or handling of various chemicals, including substances of concern; (F) the operation and maintenance of the covered treatment works; and (G) the resiliency and ability of the covered treatment works to ensure continuity of operations in the event of a disruption caused by an intentional act. (e) Site security plans In developing and implementing a site security plan under this section, a covered treatment works may select layered security and preparedness measures that, in combination, appropriately— (1) address the security risks identified in the vulnerability assessment of the covered treatment works; and (2) comply with the applicable risk-based performance standards required under this section. (f) Emergency response plans (1) In general Each covered treatment works shall prepare or revise, as appropriate, an emergency response plan that incorporates the results of the most recent vulnerability assessment and site security plan of the covered treatment works. (2) Contents An emergency response plan under this subsection shall include— (A) a description of the plans and procedures, and an identification of the equipment, that can be implemented or used in the event of an intentional act at the covered treatment works; and (B) a description of the actions and procedures, and an identification of the equipment, that can obviate or significantly lessen the impact on public health, and the ability of the treatment works to safely and reliably operate on the occurrence, of an intentional act at the covered treatment works. (3) Coordination (A) In general As part of the emergency response plan of a covered treatment works, each covered treatment works shall provide to the individuals and entities described in subparagraph (B) appropriate information to ensure an effective collective response to an intentional act at the covered treatment works. (B) Description of individuals and entities An individual or entity referred to in subparagraph (A) is— (i) a local emergency planning committee; (ii) a State emergency response commission; (iii) a local law enforcement official; or (iv) a local emergency response provider. (4) Certification (A) In general Not later than 180 days after the date on which a vulnerability assessment is completed or revised, as appropriate, for a covered treatment works under subsection (d), the covered treatment works shall submit to the Administrator a certification that the covered treatment works has completed an emergency response plan in accordance with this subsection. (B) Updates As soon as practicable after any update of an emergency response plan of a covered treatment works under this section, a covered treatment works shall submit to the Administrator an updated certification under subparagraph (A). (g) Role of employees (1) Description of role Each site security plan and emergency response plan required under this section shall describe the appropriate roles and responsibilities that employees and contractors of the covered treatment works are expected to perform to deter or respond to an intentional act described in subsection (h)(2)(C). (2) Training for employees Not less frequently than once each year, each covered treatment works shall provide to employees and contractors of the covered treatment works with roles or responsibilities described in paragraph (1) not less than 8 hours of training regarding the conduct of those roles and responsibilities. (3) Employee participation In developing, revising, or updating a vulnerability assessment, site security plan, or emergency response plan required under this section, a covered treatment works shall include— (A) at least 1 supervisory and at least 1 nonsupervisory employee of the covered treatment works; and (B) at least 1 representative of each certified or recognized bargaining agent representing employees or contractors of the covered treatment works with roles or responsibilities described in paragraph (1), if any, in a collective bargaining relationship with the owner or operator of the covered treatment works or a contractor to the covered treatment works.  (h) Risk-Based tiers (1) Establishment The Administrator shall establish, by regulation, 4 risk-based tiers for the categorization of covered treatment works under this section, with tier 1 representing the highest degree of security risk. (2) Assignment (A) In general The Administrator shall assign (and reassign, as appropriate) each covered treatment works to 1 of the risk-based tiers established under paragraph (1). (B) Submission of information The Administrator may require a covered treatment works to submit to the Administrator such information as the Administrator determines to be necessary to determine the appropriate risk-based tier for the covered treatment works. (C) Factors for consideration In assigning a covered treatment works to a risk-based tier under this paragraph, the Administrator shall take into consideration— (i) the potential consequences (such as death, injury, or serious adverse effects to human health, the environment, critical infrastructure, national security, and the national economy) of an intentional act at the covered treatment works— (I) to cause a release, including a worst-case release, of a substance of concern; (II) to disrupt the safe and reliable operation of the covered treatment works; and (III) to steal, misappropriate, or misuse a substance of concern at the covered treatment works; (ii) the design flow of the treatment works; and (iii) the proximity of the treatment works to large population centers. (3) Explanation for risk-based tier assignment The Administrator shall provide to each covered treatment works assigned to a risk-based tier under this subsection a written explanation of— (A) the reasons for the assignment to that risk-based tier; and (B) the determination by the Administrator regarding whether the covered treatment works is required to submit an assessment under subsection (k)(2). (i) Substances of concern For purposes of this section, the Administrator, in consultation with the Secretary— (1) may designate any chemical substance as a substance of concern, taking into consideration appendix A of part 27 of title 6, Code of Federal Regulations (or successor regulations); and (2) on the designation of a chemical substance as a substance of concern under paragraph (1), shall establish, by regulation, a threshold quantity for the release or theft of the chemical substance, taking into consideration— (A) the toxicity, reactivity, volatility, dispersability, combustibility, and flammability of the chemical substance; and (B) the quantity of the chemical substance that, as a result of a release, is known, or may be reasonably anticipated, to cause death, injury, or serious adverse effects to human health or the environment. (j) Baseline information To facilitate compliance with the requirements of this section, as soon as practicable after the effective date of the regulations promulgated pursuant to subsection (b), and thereafter as appropriate, the Administrator, after consultation with appropriate Federal departments and agencies and State, local, and tribal governments, shall provide baseline information to covered treatment works regarding the types of intentional acts that constitute probable threats with respect to— (1) the substantial disruption of the ability of the covered treatment works to operate safely and reliably; (2) the release of a substance of concern at the covered treatment works; or (3) the theft, misuse, or misappropriation of a substance of concern at the covered treatment works. (k) Methods To reduce consequences of chemical releases from intentional acts (1) Definition of method to reduce the consequences of a chemical release from an intentional act (A) In general In this subsection, the term method to reduce the consequences of a chemical release from an intentional act means a measure at a covered treatment works that reduces or eliminates the potential consequences of a release of a substance of concern from an intentional act. (B) Inclusions The term method to reduce the consequences of a chemical release from an intentional act includes— (i) the elimination or reduction in quantity of a substance of concern possessed or planned to be possessed by a covered treatment works through the use of alternate substances, formulations, or processes; (ii) the modification of the pressure, temperature, or concentration of a substance of concern; and (iii) the reduction or elimination of onsite handling of a substance of concern through improvement of inventory control or chemical use efficiency. (2) Assessment (A) In general Each covered treatment works that possesses or plans to possess a substance of concern in excess of the release threshold quantity established by the Administrator under subsection (i)(2)(B) shall— (i) include in the site security plan of the covered treatment works an assessment of methods to reduce the consequences of a chemical release from an intentional act at the covered treatment works; and (ii) submit the assessment under clause (i) to— (I) the Administrator; and (II) the State in which the covered treatment works is located, if the State has an approved program under section 402. (B) Factors for consideration In preparing an assessment under this paragraph, a covered treatment works shall take into consideration factors appropriate to ensuring public health and the security and environmental mission of the covered treatment works. (C) Inclusions Each assessment under this paragraph shall include a description of— (i) the methods to reduce the consequences of a chemical release from an intentional act at the covered treatment works; (ii) the means by which each method to reduce the consequences of a chemical release from an intentional act at the covered treatment works could, if applied— (I) reduce the potential extent of death, injury, or serious adverse effects to human health resulting from the chemical release; and (II) affect the presence of contaminants in treated water, human health, or the environment; (iii) whether each described method to reduce the consequences of a chemical release from an intentional act at the covered treatment works is feasible (as determined by the Administrator); (iv) the costs (including capital and operational costs) and avoided costs (including savings and liabilities) associated with applying each method to reduce the consequences of a chemical release from an intentional act at the covered treatment works; (v) any other relevant information relied on by the covered treatment works in conducting the assessment; (vi) a statement of whether the covered treatment works has implemented or plans to implement 1 or more methods to reduce the consequences of a chemical release from an intentional act and a description of any such method; and (vii) in the case of a covered treatment works described in paragraph (3)(A), an explanation of the reasons for any decision not to implement a method to reduce the consequences of a chemical release from an intentional act at the covered treatment works. (3) Required methods (A) Applicability This paragraph applies to a covered treatment works that— (i) is assigned to 1 of the 2 highest risk-based tiers under subsection (h); and (ii) possesses or plans to possess a substance of concern in excess of the release threshold quantity established by the Administrator under subsection (i)(2)(B). (B) Highest-risk systems If, on the basis of an assessment under paragraph (2), a covered treatment works described in subparagraph (A) decides not to implement a method to reduce the consequences of a chemical release from an intentional act at the covered treatment works— (i) the State with an approved program under section 402 (if the covered treatment works is located in such a State) shall, in accordance with a timeline established by the Administrator— (I) determine whether to require the covered treatment works to implement the method to reduce the consequences of a chemical release from an intentional act; and (II) notify the Administrator of the determination; or (ii) the Administrator (if the covered treatment works is not located in a State with an approved program under section 402) shall determine whether to require the covered treatment works to implement the method to reduce the consequences of a chemical release from an intentional act. (C) Factors for consideration In making a determination under clause (i)(I) or (ii) of subparagraph (B), the State or the Administrator, as applicable, shall take into consideration factors appropriate to the security, public health, and environmental missions of covered treatment works, including an examination of whether the applicable method to reduce the consequences of a chemical release from an intentional act— (i) would significantly reduce the risk of death, injury, or serious adverse effects to human health resulting directly from a chemical release from an intentional act at the covered treatment works; (ii) would not increase the interim storage of a substance of concern by the covered treatment works; (iii) would not render the covered treatment works unable to comply with— (I) other requirements of this Act; or (II) applicable standards established by the State or political subdivision in which the covered treatment works is located; and (iv) is feasible (as determined by the Administrator), to be incorporated into the operation of the covered treatment works. (D) Appeals If a determination is made to require a covered treatment works to implement a method to reduce the consequences of a chemical release from an intentional act under clause (i)(I) or (ii) of subparagraph (B), the State or the Administrator, as applicable, shall provide to the affected covered treatment works an opportunity to appeal the determination, including the opportunity for a determination of consequences of an intentional act occurring outside the covered treatment works pursuant to subparagraph (E). (E) Consequences of intentional act occurring outside covered treatment works (i) In general A covered treatment works may request, as part of an appeal under subparagraph (D), a determination of whether the implementation of a method to reduce the consequences of a chemical release from an intentional act would result in a significant increase in the existing potential consequences of an intentional act occurring outside the covered treatment works that is directly related to the method to reduce consequences of an intentional act at the covered treatment works that is the subject of the appeal. (ii) Duties upon receipt of request Upon receiving a request under clause (i)— (I) the State with an approved program under section 402 (if the covered treatment works is located in such a State), shall notify the Administrator, and the Administrator shall consult with the Secretary, as necessary, to quantify whether there would be a significant increase in the existing potential consequences of an intentional act occurring outside the covered treatment works (that is directly related to the method to reduce consequences of an intentional act at the covered treatment works that is the subject of the appeal) as compared to the consequences of a chemical release at the covered treatment works that would be reduced by the implementation of the method; or (II) the Administrator (if the covered treatment works is not located in a State with an approved program under section 402), shall consult with the Secretary, as necessary, to quantify whether there would be a significant increase in the existing potential consequences of an intentional act occurring outside the covered treatment works (that is directly related to the method to reduce consequences of an intentional act at the covered treatment works that is the subject of the appeal) as compared to the consequences of a chemical release at the covered treatment works that would be reduced by the implementation of the method. (iii) Significantly increased consequences outside covered treatment works If a determination is made pursuant to subclause (I) or (II) of clause (ii) that implementation of a method to reduce consequences of a chemical release from an intentional act pursuant to clause (i)(I) or (ii) of subparagraph (B) would result in a significant increase in the existing potential consequences of an intentional act occurring outside the covered treatment works as compared to the reduced consequences of a chemical release at the covered treatment works, the State with an approved program under section 402 (if the covered treatment works is located in such a State), or the Administrator (if the covered treatment works is not located in a State), shall take that determination into consideration in making a final determination under clause (i)(I) or (ii) of subparagraph (B). (4) Incomplete and late assessments (A) Incomplete assessments (i) In general If the Administrator determines that a covered treatment works failed to meet the requirements of this subsection in conducting an assessment, the Administrator, after notifying the covered treatment works and the State with an approved program under section 402, if applicable, shall require the covered treatment works to submit a revised assessment in accordance with this subsection by not later than 60 days after the date of receipt of notification. (ii) Review The State in which a covered treatment works subject to clause (i) is located (if the covered treatment works is located in a State with an approved program under section 402) or the Administrator (if the covered treatment works is not located in such a State) shall review a revised assessment submitted under clause (i) to determine whether to require the covered treatment works to implement any method to reduce the consequences of an intentional act pursuant to paragraph (3). (B) Late assessments If the Administrator determines that a covered treatment works failed to complete an assessment under this subsection in accordance with the deadline established for completion by the Administrator, the Administrator, after notifying the covered treatment works and the State with an approved program under section 402, if applicable, may take appropriate enforcement action under subsection (q). (5) Failure by State to act (A) Determinations (i) In general If the Administrator determines that a State with an approved program under section 402 has failed to determine whether to require a covered treatment works to implement a method to reduce the consequences of a chemical release from an intentional act, as required by paragraph (3)(B)(i)(I), the Administrator shall notify the State and the applicable covered treatment works of the determination. (ii) Action by Administrator If a State has failed to make a determination required by paragraph (3)(B)(i)(I), not later than 30 days after the date of receipt of the notice of the Administrator under clause (i) the Administrator shall— (I) notify the State and the applicable covered treatment works of the failure by the State to make the determination; and (II) determine whether to require the covered treatment works to implement the applicable method to reduce the consequences of a chemical release from an intentional act, based on the factors described in paragraph (3)(C). (B) Enforcement actions (i) In general If the Administrator determines that a covered treatment works has failed while located in a State with an approved program under section 402 to implement a method to reduce the consequences of a chemical release from an intentional act that is required by the State or the Administrator under paragraph (3)(B), or by the Administrator under subparagraph (A), the Administrator shall notify the State and the covered treatment works of the determination. (ii) Enforcement action If the Administrator determines that a State has failed to commence an appropriate enforcement action by the date that is 30 days after the date of notification by the Administrator under clause (i), the Administrator shall— (I) notify the State and the applicable covered treatment works of the determination; and (II) determine whether to commence an appropriate enforcement action against the covered treatment works in accordance with subsection (q) to require the implementation of the relevant method to reduce the consequences of a chemical release from an intentional act at the covered treatment works. (C) Consideration of continued program approval The Administrator may take into consideration the failure of a State with an approved program under section 402 to make a determination as described in subparagraph (A), or to bring an enforcement action as described in subparagraph (B), in determining whether the State may retain the approved program under section 402. (6) Guidance for covered treatment works (A) Guidance Not later than 180 days after the date of enactment of the Secure Water Facilities Act, the Administrator shall develop, and update thereafter as appropriate, nonbinding guidance, including guidance regarding Federal procurement, to assist covered treatment works in assessing and implementing methods to reduce consequences of a chemical release from an intentional act by reducing or eliminating reliance on the use of threshold quantities of substances of concern at the covered treatment works, as established under subsection (i)(2)(B). (B) Recommendations The Administrator shall, as appropriate, provide or recommend tools, methodologies, or computer software to assist covered treatment works assigned to tier 3 or tier 4 under subsection (h) and required to conduct an assessment under paragraph (2) to achieve compliance with the requirements of this section. (l) Review by Administrator (1) In general Each covered treatment works shall submit to the Administrator the vulnerability assessment and site security plan of the covered treatment works, in accordance with such deadline as the Administrator may establish. (2) Review The Administrator shall— (A) review each vulnerability assessment and site security plan submitted under this subsection; and (B) (i) if the assessment or plan has any significant deficiency described in paragraph (3), require the covered treatment works to correct the deficiency; or (ii) approve the assessment or plan. (3) Significant deficiencies (A) In general Subject to subparagraph (B), a vulnerability assessment or site security plan of a covered treatment works has a significant deficiency under this paragraph if the Administrator, in consultation with the State with an approved program under section 402 (if the covered treatment works is located in such a State), determines that— (i) the vulnerability assessment does not comply with the regulations promulgated pursuant to subsection (b); or (ii) the site security plan fails— (I) to meet applicable risk-based performance standards under subsection (c); or (II) to address a vulnerability identified in the vulnerability assessment under subsection (d). (B) Exclusion A deficiency in the content or implementation of the portion of the site security plan of a covered treatment works relating to methods to reduce the consequences of a chemical release from an intentional act shall not be considered to be a significant deficiency under this paragraph. (4) Identification of deficiencies If the Administrator identifies a significant deficiency in the vulnerability assessment or site security plan of a covered treatment works under paragraph (3), the Administrator shall provide to the covered treatment works a written notification of the deficiency that— (A) includes a clear explanation of the deficiency; (B) provides guidance to assist the covered treatment works in addressing the deficiency; and (C) requires the covered treatment works— (i) to correct the deficiency; and (ii) by such date as the Administrator determines to be appropriate, to submit to the Administrator a revised vulnerability assessment or site security plan. (5) State, regional, and local governmental entities No covered treatment works shall be required under State, local, or tribal law to provide a vulnerability assessment or site security plan under this section to any State, regional, local, or tribal governmental entity solely due to the requirement of paragraph (1) to submit such an assessment or plan to the Administrator. (m) Maintenance of records Each covered treatment works shall maintain an updated copy of the vulnerability assessment, site security plan, and emergency response plan of the covered treatment works. (n) Audits; inspections (1) In general The Administrator (or a designee) shall audit and inspect covered treatment works as necessary to determine compliance with this section. (2) Access In conducting an audit or inspection of a covered treatment works under this subsection, the Administrator shall have access to the owners, operators, employees, contractors, and employee representatives, if any, of the covered treatment works. (3) Confidential communication of information; aiding inspections (A) Confidential communication of information The Administrator shall offer nonsupervisory employees of a covered treatment works the opportunity to confidentially communicate to the Administrator information relevant to the compliance or noncompliance by the covered treatment works with the requirements of this section (including regulations promulgated pursuant to this section). (B) Aiding inspections A representative of each certified or recognized bargaining agent described in subsection (g)(3)(B), or a nonsupervisory employee if no such representative exists, shall be given an opportunity to accompany the Administrator during any physical inspection of a covered treatment works under this subsection to assist in the inspection, if a representative of the covered treatment works will also be accompanying the Administrator during the inspection. (o) Protection of information (1) Definition of protected information (A) In general In this section, the term protected information means— (i) a vulnerability assessment or site security plan under this section (including any assessment developed under subsection (k)(2)); (ii) any document directly related to a review by the Administrator of an assessment or plan described in clause (i) and, where applicable, a review by a State of an assessment developed under subsection (k)(2); (iii) any document directly related to an inspection or audit under subsection (n); (iv) any order, notice, or letter regarding the compliance of a covered treatment works with the requirements of this section; (v) any information, document, or record required to be provided to, or created by, the Administrator under subsection (h); (vi) any document directly related to— (I) a security drill or training exercise; (II) a security threat or breach; or (III) maintenance, calibration, or testing of security equipment; and (vii) any other information, document, or record developed exclusively for purposes of this section, the disclosure of which, as determined by the Administrator, by regulation, would be detrimental to the security of 1 or more covered treatment works. (B) Detriment requirement For purposes of clauses (ii) through (vi) of subparagraph (A), the only portion of any document, record, order, notice, or letter that shall be considered to be protected information is any portion— (i) the disclosure of which, as determined by the Administrator, by regulation, would be detrimental to the security of 1 or more covered treatment works; and (ii) that is developed by the Administrator, a State, or a covered treatment works for purposes of this section. (C) Exclusions The term protected information does not include— (i) any information, other than a vulnerability assessment or site security plan, that the Administrator has determined, by regulation— (I) to be appropriate to demonstrate compliance by a covered treatment works with the requirements of this section; and (II) would not be detrimental to the security of any covered treatment works if disclosed; or (ii) any information that is obtained from another source with respect to which the Administrator has not made a determination under subparagraph (A)(vii) or (B), regardless of whether the information is included in an assessment or plan under this section, including— (I) information that is required to be made publicly available under any other provision of law; and (II) information that a covered treatment works has lawfully disclosed other than through a submission to the Administrator under this section. (2) Prohibition Protected information— (A) shall be exempt from disclosure under section 552 of title 5, United States Code; and (B) shall not be made available pursuant to any State, local, or tribal law requiring disclosure of information or records. (3) Information sharing (A) In general The Administrator shall promulgate such regulations, and may issue such orders, as the Administrator determines to be necessary to prohibit the unauthorized disclosure of protected information. (B) Sharing of protected information (i) In general The regulations under subparagraph (A) shall establish standards for, and facilitate, the appropriate sharing of protected information among— (I) Federal, State, local, and tribal authorities; (II) first responders; (III) law enforcement officials; (IV) designated supervisory and nonsupervisory covered treatment works personnel with security, operational, or fiduciary responsibility for the covered treatment works; and (V) designated employee representatives of covered treatment works, if any. (ii) Inclusions The standards established under clause (i) shall include procedures for the sharing of all portions of a vulnerability assessment or site security plan of a covered treatment works relating to the roles and responsibilities of employees or contractors of the covered treatment works under subsection (g) with— (I) a representative of each certified or recognized bargaining agent representing those employees and contractors, if any; or (II) if a representative described in subclause (I) does not exist, at least 1 supervisory and at least 1 nonsupervisory employee with roles and responsibilities described in subsection (g). (C) Penalties (i) In general Protected information shall not be shared, except in accordance with the standards established and orders issued pursuant to subparagraph (A). (ii) Knowing violation Whoever discloses protected information in knowing violation of the regulations promulgated under paragraph (1) shall— (I) be fined under title 18, United States Code, imprisoned for not more than 1 year, or both; and (II) in the case of a Federal officeholder or employee, removed from Federal office or employment. (4) Treatment of information in adjudicative proceedings In any judicial or administrative proceeding, protected information shall be treated in a manner consistent with the treatment of sensitive security information under section 525 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295; 120 Stat. 1381). (5) Other obligations unaffected Except as provided in subsection (l)(5), nothing in this section modifies or otherwise affects an obligation of a covered treatment works— (A) to submit or make available information to employees of the covered treatment works, employee organizations, health professionals, emergency response organizations, or a Federal, State, tribal, or local government agency under any other provision of law; or (B) to comply with any other provision of law. (6) Congressional oversight Nothing in this section authorizes the withholding of information from Congress. (7) Disclosure of independently furnished information Nothing in this section modifies or otherwise affects any authority or obligation of a Federal, State, local, or tribal agency to protect or disclose any record or information that the Federal, State, local, or tribal agency obtains from a covered treatment works or the Administrator under any other provision of law. (p) Preemption Nothing in this section precludes or denies the right of any State or political subdivision of a State to adopt or enforce any regulation, requirement, or standard of performance with respect to a covered treatment works that is more stringent than a regulation, requirement, or standard of performance established under this section. (q) Violations (1) In general For purposes of section 309, any violation of a requirement under this section (including a regulation promulgated pursuant to this section) by a covered treatment works shall be treated in the same manner as a violation of a condition of a permit under section 402. (2) Methods to reduce the consequences of a chemical release from an intentional act Except as provided in paragraphs (4) and (5) of subsection (k), if a covered treatment works is located in a State with an approved program under section 402, the Administrator may not issue an order or commence a civil action under this section for any deficiency in the content or implementation of the portion of the site security plan of the covered treatment works relating to methods to reduce the consequences of a chemical release from an intentional act (as defined in subsection (k)(1)). (r) Report to Congress (1) Annual report Not later than 3 years after the effective date of the regulations promulgated pursuant to subsection (b), and annually thereafter for each of the following 8 calendar years, the Administrator shall submit to the Committee on Environment and Public Works of the Senate and the Committee on Transportation and Infrastructure of the House of Representatives a report describing the progress made during the reporting period in achieving compliance with this section, including, at a minimum— (A) a generalized summary of measures implemented by covered treatment works to meet each risk-based performance standard established under subsection (c); and (B) a summary of the means by which— (i) covered treatment works, as categorized by risk-based tier assignment under subsection (h), are achieving compliance with the requirements of this section; and (ii) the Administrator is implementing and enforcing those requirements, including a description of— (I) the number of treatment works that provided information to the Administrator pursuant to subsection (h)(2)(B); (II) the number of covered treatment works assigned to each risk-based tier under subsection (h); (III) the number of vulnerability assessments and site security plans— (aa) submitted by covered treatment works; and (bb) approved and disapproved by the Administrator; (IV) the number of covered treatment works without approved vulnerability assessments or site security plans in place; (V) (aa) the number of covered treatment works that have been assigned to a different risk-based tier or are no longer regulated by the Administrator under this section due to implementation of a method to reduce the consequences of a chemical release from an intentional act; and (bb) a description of the types of each such method to reduce the consequences of a chemical release from an intentional act; (VI) the number of audits and inspections conducted by the Administrator (or a designee) under subsection (n); (VII) the number of orders for compliance issued by the Administrator under subsection (q); (VIII) the administrative penalties assessed by the Administrator for noncompliance with the requirements of this section; (IX) the civil penalties assessed by courts for noncompliance with the requirements of this section; and (X) any other regulatory data the Administrator determines to be appropriate to describe— (aa) compliance by covered treatment works with the requirements of this section; and (bb) the implementation by the Administrator of those requirements. (2) Public availability Each report submitted under this section shall be made publicly available. (s) Grant programs (1) Implementation grants to States The Administrator may provide grants to, or enter into cooperative agreements with, States, based on an allocation formula established by the Administrator, to assist the States in implementing this section. (2) Research, training, and technical assistance grants The Administrator may provide grants to, or enter into cooperative agreements with, nonprofit organizations to provide research, training, and technical assistance to covered treatment works to assist the covered treatment works in achieving compliance with this section. (3) Preparation grants (A) Grants The Administrator may provide grants to, or enter into cooperative agreements with, covered treatment works to assist the covered treatment works in— (i) preparing and updating vulnerability assessments, site security plans, and emergency response plans; (ii) assessing and implementing methods to reduce the consequences of a release of a substance of concern from an intentional act; and (iii) implementing any other security reviews or enhancements that are necessary to achieve compliance with this section. (B) Priority (i) Need In providing grants and entering into cooperative agreements under subparagraph (A)(i), the Administrator shall give priority to covered treatment works that, as determined by the Administrator, have the greatest need. (ii) Security risk In providing grants and entering into cooperative agreements under subparagraph (A)(ii), the Administrator shall give priority to covered treatment works that, as determined by the Administrator, present the greatest security risk. (4) Worker training grants (A) Definition of eligible entity In this paragraph, the term eligible entity means a nonprofit organization with demonstrated experience in implementing and operating successful worker or first responder health and safety or security training programs. (B) Grants The Administrator shall establish a program under which the Administrator shall provide grants to eligible entities to provide for training and education of— (i) employees and contractors of covered treatment works with roles or responsibilities described in subsection (g); and (ii) first responders and emergency response providers who would respond to an intentional act at a covered treatment works. (C) Administration The Administrator shall offer to enter into an agreement with the National Institute of Environmental Health Sciences to administer the program under this paragraph. (D) Use of funds An eligible entity shall use a grant received under this paragraph for— (i) training and education of employees and contractors with roles or responsibilities described in subsection (g), including the annual mandatory training specified in subsection (g)(2), with priority given to covered treatment works assigned to tier 1 or tier 2 under subsection (h); (ii) training of first responders in protecting nearby residents and property or the environment from the effects of a release of a substance of concern at a covered treatment works, with priority given to covered treatment works assigned to tier 1 or tier 2 under subsection (h); and (iii) appropriate training for first responders and emergency response providers who would respond to an intentional act at a covered treatment works. (t) Timely provision of threat-Related information The Secretary shall, upon receipt of information concerning a specific threat that is relevant to a certain covered water treatment works, provide the information in a timely manner, to the maximum extent practicable under applicable authority and in the interests of national security, to— (1) covered treatment works; (2) the Administrator; and (3) the appropriate Federal, State, and local law enforcement officials. (u) Authorization of appropriations (1) In general There are authorized to be appropriated to carry out this section $200,000,000 for each of fiscal years 2013 through 2017, of which— (A) not more than $30,000,000 may be used during each fiscal year for administrative costs incurred by the Administrator or States, as applicable, in carrying out this section; and (B) not more than $150,000,000 may be used during each fiscal year to implement methods to reduce the consequences of chemical releases from intentional acts at covered treatment works, with priority given to covered treatment works assigned to tier 1 or tier 2 under subsection (h). (2) Security enhancements Amounts provided under this subsection for basic security enhancements shall not be used for— (A) personnel costs; or (B) monitoring, operation, or maintenance of facilities, equipment, or systems. (v) Relation to chemical facility security requirements No provision of any appropriations Act relating to chemical facility security, and no law or regulation establishing a chemical facility antiterrorism standard, shall apply to a covered treatment works under this section. . (2) Effective date The amendment made by paragraph (1) takes effect on the date of promulgation by the Administrator of the Environmental Protection Agency of final regulations pursuant to subsection (b)(1) of section 321 of the Federal Water Pollution Control Act (as amended by paragraph (1)). (b) Effect of section (1) In general Nothing in this section or the amendment made by this section affects the applicability of any provision of title III of the Federal Water Pollution Control Act (33 U.S.C. 1311 et seq.) (as in effect before the effective date of the amendment made by subsection (a)(1)). (2) Violations (A) In general Nothing in this section or the amendment made by this section affects the applicability of any provision of title III of the Federal Water Pollution Control Act (33 U.S.C. 1311 et seq.) (as in effect before the effective date of the amendment made by subsection (a)(1)) to any violation of that Act that occurs before that effective date. (B) Requirements The requirements of title III of the Federal Water Pollution Control Act (33 U.S.C. 1311 et seq.) (as in effect before the effective date of the amendment made by subsection (a)(1)) shall remain in effect with respect to violations described in subparagraph (A) until the later of— (i) the date on which the violation is corrected; and (ii) the date on which enforcement proceedings relating to the violation are completed. 203. Study to assess threat of contamination of wastewater treatment works Not later than 180 days after the date of enactment of this Act, the Administrator of the Environmental Protection Agency, in consultation with the Secretary of Homeland Security, shall— (1) conduct a study to assess— (A) the threat to wastewater treatment works posed by intentional acts of contamination; and (B) the vulnerability of wastewater treatment works to such a threat; and (2) submit to the Committee on Environment and Public Works of the Senate and the Committee on Energy and Commerce of the House of Representatives a report describing the results of the study.