Safe Drinking Water Act and Federal Facilities

Enforcement Alert: Cybersecurity Vulnerabilities at Public Water Systems

EPA has identified cybersecurity vulnerabilities at public water systems that are being exploited. These cyberattacks are increasing in frequency and severity. On May 20, 2024, EPA issued an Enforcement Alert highlighting that the Agency is increasing the number of community water system inspections focusing on cybersecurity. EPA Increases Enforcement Activities to Ensure Drinking Water Systems Address Cybersecurity Threats provides information on EPA’s work to combat cyberattacks and highlights resources for state and local agencies to remove vulnerabilities. EPA’s Cybersecurity Water Sector web page provides additional information on cybersecurity training, resources, assessments, and funding.

Summary

The Safe Drinking Water Act or SDWA was signed into law in 1974, and reauthorized in 1996, to ensure public health protection through compliance by public water systems with federal drinking water standards, including all monitoring and reporting requirements. The law also placed increased emphasis on providing the public information about the quality of their drinking water.

The 1996 amendments require systems to report their water quality annually to their customers (Consumer Confidence Reports) and EPA to produce the National Public Water Systems Compliance Report, which summarizes and evaluates the annual reports submitted by primacy agencies to EPA. It focuses on community water systems (serving year round populations at their primary residences) non-transient non-community systems and transient non-community water systems whether they are above ground or underground sources. Finally, the SWDA requires EPA to establish permitting requirements for State underground injection control programs.

Application of SDWA to Federal Agencies

The 1996 SDWA amendments clarified that Federal agencies engaged in certain activities, such as owning or operating a public water system, must comply with all federal, state, interstate, and local safe drinking water requirements.

EPA Enforcement

Administrative Enforcement

Federal agencies that own or operate facilities in wellhead protection areas or that may contaminate water supplies in a wellhead protection area, own or operate public water systems, or are engaged in any regulated underground injection activity are subject to and must comply with SDWA requirements to the same extent as other persons. They are also subject to EPA administrative and state, tribal, and local enforcement actions.

The 1996 SDWA amendments clearly express EPA ’s administrative penalty authority over federal agencies in section 1447, 42 U.S.C. § 300j-6. SDWA section 1447 provides the blanket authority for EPA to issue penalty orders to federal agencies for violations of any requirement of the SDWA or a requirement or schedule imposed by an administrative compliance order, an imminent and substantial endangerment order, or other administrative order issued under the SDWA.

SDWA penalties against federal agencies may be up to $48,586 per day per violation. (The Federal Civil Penalties Inflation Adjustment Act of 1990 requires EPA to revise every four years the penalty amounts available under federal environmental statutes, including the SDWA. For the current penalty amounts, see 40 C.F.R. Part 19, Table 1 of Section 19.4 .

The EPA Guidance on Federal Facility Penalty Order Authority Under the Safe Drinking Water Act, as amended in 1996 (May 29, 1998) explains the 1996 SDWA Amendments’ application to federal entities and advises EPA Regions on the enhanced SDWA authorities. Specifically addressed in the guidance are:

administrative procedures for section 1414(g), 42 U.S.C. § 300g-3(g), Compliance Orders
administrative procedures for section 1431 Imminent and Substantial Endangerment Orders
administrative procedures, including opportunity to confer with the Administrator, for section 1447(b), 42 U.S.C. § 300j-6(b), penalty orders
section 1447(b), 42 U.S.C. § 300j-6(b), penalty order settlements
administrative procedures for administrative orders under the underground injection control program
timing of issuance of SDWA administrative orders
press releases for SDWA enforcement actions at federal facilities

The SDWA does not require EPA to provide notice and an opportunity for a public hearing before a compliance order takes effect. However, in its Guidance on Federal Facility Penalty Order Authority Under the Safe Drinking Water Act, as amended in 1996, EPA states that it believes that providing a federal agency an opportunity to confer with an appropriate EPA regional official is warranted even in the absence of a statutory provision requiring one. That EPA regional official, under the guidance, must have authority to issue a section 1414(g) order (for violations of the public water system requirements), a section 1423 order (for violations of the underground injection control requirements), or a section 1431 imminent and substantial endangerment order. The guidance also states that due to the emergency nature of section 1431 orders, an opportunity to confer may be limited.

Section 1447(b) of the SDWA requires that before a penalty order becomes final, the EPA Administrator must provide the federal entity with notice and an opportunity for a formal hearing on the record in accordance with the Administrative Procedures Act. 40 CFR Part 22 sets forth EPA’s general rules of administrative practice governing the assessment of administrative penalties. EPA’s Part 22 regulations require public notice of an SDWA administrative penalty order issued to a federal agency, including information that any interested person may seek judicial review of the penalty order within 30 days after it becomes final.

If EPA issues an SDWA section 1447 administrative penalty order and no settlement is eventually reached, the head of the federal entity may request an opportunity to confer with the Administrator following exhaustion of the Part 22 process. As is explained in the Guidance on Federal Facility Penalty Order Authority Under the Safe Drinking Water Act, as amended in 1996, the EPA Administrator’s obligation to provide an opportunity to confer is only in connection with EPA-issued orders, not state orders. Therefore, EPA will not confer with federal entities regarding state-issued orders.

Risk and Resilience Assessments

Additionally, the America’s Water Infrastructure Act of 2018 amended SDWA Section 1433 to require community water systems (public water systems that supply water to the same population year-round) that serve more than 3,300 people to complete a risk and resilience assessment and develop an emergency response plan (ERP). Risk and resilience assessments include an evaluation of risk to community water systems from malevolent acts, including cyberattacks, and natural hazards. Each community water system must prepare or revise an ERP that incorporates the findings of the risk and resilience assessment. Given vulnerabilities and attacks on systems, EPA is increasing the number of community water system inspections that focus on cybersecurity and is prepared to issue system-specific administrative enforcement orders to address noncompliance with SDWA Section 1433. For more information on EPA’s work to combat cyberattacks, please see our latest Enforcement Alert.

Emergency Powers

SDWA section 1431, 42 U.S.C. § 300i gives the EPA Administrator broad authority to act to protect the health of persons in situations where there may be an imminent and substantial endangerment. Specifically, section 1431 provides that, upon receipt of information that a contaminant that is present in or likely to enter a public water system or an underground source of drinking water, or there is a threatened or potential terrorist attack or other intentional act, that may present an imminent and substantial endangerment to the health of persons, the EPA Administrator may take any action she deems necessary to protect human health.

The Administrator may take action under this section only if the state and local authorities have not acted to protect the health of persons. Then, to the extent the Administrator deems practicable in light of the imminent and substantial endangerment, she must consult with the state and local authorities to confirm the factual situation and any action the state or local authorities are or will be taking. Actions the Administrator may take under this section include, but are not limited to issuing administrative orders to persons subject to the SDWA, including federal agencies, such as orders to clean contaminated sources of drinking water or to provide alternative water supplies.

SDWA subsection 1431(b) subjects persons who violate an order issued under § 1431(a) to a penalty not to exceed $29,154 for each day the violation occurs or the failure to comply continues. Federal agencies may be subject to administrative penalties under section 1447 for violation of an order issued under section 1431. However, EPA has decided, as a matter of practice, that it will not assess higher penalties under section 1447 for federal agency violations of a section 1431 order than what EPA could assess against a private party, as provided in subsection 1431(b).

Criminal Enforcement

In addition to civil liability, sanctions may be sought against individual employees of federal agencies for criminal violations of the SDWA. Enforcement of criminal violations is authorized under different sections of SDWA, which establish fines and penalties for several types of criminal violations.

State Enforcement

According to SDWA section 1447, 42 U.S.C. § 300j-6 federal agencies are subject to state requirements for protection of wellhead areas, public water supply systems, and underground injection controls. In addition, states may exercise primary enforcement authority of the requirements for public water systems under SDWA section 1413, 42 U.S.C. § 300g-2 if certain criteria are met. If the state does not properly enforce the SDWA, EPA may withdraw primacy or take appropriate enforcement action.

Under SDWA section 1422, 42 U.S.C. § 300h-1 states have primary enforcement responsibility for underground injection controls if the state can meet the requirements for authorization to assume primary enforcement responsibility. Section 1422 also provides that EPA may implement an applicable UIC program in a state if the state fails to submit an application to assume primary enforcement responsibility or if the EPA Administrator determines that the state’s program does not meet the requirements.

Tribal Enforcement

SDWA subsection 1422(e), 42 U.S.C. § 300h-1(e) provides for an American Indian Tribe to assume primary enforcement responsibility for an underground injection control (UIC) program if the tribe complies with the applicable requirements. Until a tribe assumes primary enforcement responsibility, the currently applicable UIC program shall continue to apply.

Under SDWA section 1451, 42 U.S.C. § 300j-11 EPA is authorized to treat eligible Indian tribes in the same manner as states, including for enforcement of the public water system and underground injection control (UIC) requirements. EPA may approve a tribe to have primary enforcement responsibility for public water systems and UIC sources if certain criteria are met.

Citizen Enforcement

SDWA subsection 1449(a), 42 U.S.C. § 300j-8 allows U.S. citizens to file a civil action (civil suit) against any federal agency that is alleged to be in violation of any SDWA requirement. In addition, SDWA subsection 1449(a) allows citizens to file a civil action against the EPA Administrator for an alleged failure to perform any non-discretionary act or duty.

SDWA subsection 1449(b) precludes citizens from filing a civil action if EPA, the Attorney General, or a state has filed and is diligently prosecuting a civil action; however, citizens can intervene in the case. In addition, SDWA subsection 1449(b) precludes citizens from filing a suit until notification is given to EPA, the State in which the alleged violation occurred, and the facility alleged to be in violation of a SDWA requirement. Additional conditions and requirements pertaining to citizen suits are set forth in SDWA subsections 1449(a) through (e).