Securing Wastewater Collection Systems from Accidental and Intentional Harm: a Cost-Benefit Analysis

It has been widely reported that industrial control systems underpinning critical infrastructures ranging from power plants to oil refineries are vulnerable to cyberattack. A slew of countermeasures have been proposed to secure these systems, yet their adoption has been disappointingly slow according to many experts. Operators have been reluctant to spend large sums protecting against threats that have only rarely materialized as attacks. But many security countermeasures are dual-use, in that they help protect against service failures caused both by hackers and by accident. In many critical infrastructure sectors accidents caused by equipment failures and nature do happen regularly, and investment to detect and possibly prevent accidents and attacks could be more easily justified than investments detecting and preventing attacks alone. In this paper, we conduct a cost-benefit analysis of adopting security countermeasures to reduce the incidence of sewer overflows in wastewater collection systems. We estimate the expected annual losses of wastewater systems due to large overflows exceeding 10,000 gallons using publicly-available data on overflows, cleanup costs, property damage and regulatory fines. We also estimate the cost of adopting security countermeasures for wastewater facilities in eight large US cities, finding that for many even a modest 20% reduction in large overflows can make adopting countermeasures cost-effective.