(TNS) — In the 1990s, a Roanoke resident might have woken up one morning with the idea of touring a water treatment facility and simply driven over and taken a tour that same day.
Not anymore — at least, not so easily. After the attacks of Sept. 11, 2001, heightened concern over the security of the nation’s food and water led to more protective measures.
At the time, the Western Virginia Water Authority didn’t exist — it was created in 2004, when the city of Roanoke and Roanoke County consolidated their water and wastewater operations.
But it has continued the security work that began in the aftermath of the attacks and adapted as the tools it uses — and the type of threat it may be vulnerable to — has evolved.
“You can never say, ‘I can make something perfectly impossible,’ because it’s a large functioning system,” said S. Scott Shirley, the water authority’s chief operating officer for water quality. “But our goal is disrupt and catch it as early as possible so that it’s not harmful and, frankly, prevent it.”
WHAT THE LAW REQUIRES
The first effort to increase security came in the form of the Bioterrorism Act of 2002, which, among other things, mandated that water utilities complete vulnerability assessments.
Shirley helped select the consultants that would assess the city of Roanoke’s system. For years after the act was passed, utilities continued making assessments and improving, but there wasn’t much regulation, he said.
It wasn’t until 2018 that the American Water Infrastructure Act formalized a process for those assessments and what to do with them.
Utilities are now required to conduct the assessments every five years and, about six months later, certify that they have updated their emergency response plans in light of the assessment results.
HOW TO KEEP A WATER SUPPLY SECURE
Prior to the attacks, Roanoke had a dedicated officer for the utilities team, although that officer largely served as law enforcement for the Carvins Cove Recreational Area. Today, that law enforcement position coordinates with other agencies and provides police presence at any of the water authority’s facilities, Shirley said.
Those facilities now have security perimeters and aren’t as easy for people to access. But it’s not just the water authority’s physical spaces that need protection.
System control and data acquisition networks, or SCADA, allow utilities to see what’s happening in their system. They’ve become a critical tool, Shirley said, but they also require cybersecurity considerations.
“That has been an evolution in our industry where you’ve seen an increasing use of computer systems to manage utilities, and therefore the cybersecurity component is growing within our vulnerability assessments,” Shirley said.
Shirley was involved with the formation of the SCADA network and said that cybersecurity has been a risk concern from the start, in the 2000s. He added that the water authority is fortunate to have a dedicated team that builds and protects the SCADA network, something that smaller utilities don’t have the capacity for.
The water authority has also partnered with the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, or CISA, for several years. The agency runs exercises, offers scanning and assessments and can send members of its team to utilities to perform deep dives of a network’s cybersecurity.
“They want to see your recovery plans, every detail, and then they produce a set of recommendations: what you’re doing well and what we can improve,” he said.
Among their suggestions: Preventing visitors on tours of facilities from taking pictures that show the SCADA network screens, Shirley said. It’s little details like that that protect the system.
CHANGES FOR CUSTOMERS
Speaking of tours, those might be the most obvious change for water customers after the attacks. Whereas people could once visit facilities on a whim, Shirley said, access is now a bit more limited.
But the water authority’s public relations team has grown, he said, and it has made an effort to reach out to the community in the form of school tours.
“So you have maybe limited access in one way, but then you’re opening up access by going to schools and actually talking to the youngest age groups about the importance of water and utilities,” he said.
Plus, you can still tour a facility, as long as you call the water authority and set something up first. Shirley said the water authority values getting to show people how the system works.
“We don’t want to lose that with our customers, because for the authority to be effective, our community has to value water,” he said.
And customers have a part to play in keeping the region’s water safe too, he said. Recreation at Carvins Cove has grown since 2000, which means there are more people near the reservoir who can “see something, say something,” as the slogan that gained traction after 9/11 puts it.
“So when we have recreational users who are valuing that natural resource — they are very much part of our network,” Shirley said.
© 2026 The Roanoke Times, Va.. Visit www.roanoke.com. Distributed by Tribune Content Agency, LLC.
