Emerging pathogens and deliberate attacks on European water supplies: a scenario planning workshop

The prospect of microbiological contamination of drinking water supplies is an ever-present concern for managers of public water supplies. Most such threats are routine, well-recognised and described, and thus can usually be prevented using standard protection measures. Incidents involving emerging pathogens and attacks, however, are inherently less predictable. Either because by definition emerging pathogens are not well understood, or because of deliberate planning by attackers to hide their actions and maximise surprise. Vulnerability of municipal water supplies to such events is a topic of ongoing concern (Haimes et al. 1998; Clark & Deininger 2000; Qiao et al. 2007; Gleick & Heberger 2014; Mutchek & Williams 2014). Documented plots to deliberately contaminate drinking water supplies in the period 1946–2015 were described by Brainard & Hunter (2016). Literature about emerging diseases in drinking water is more expansive and diverse, and tends to be segregated by species, groups of similar microbes or parasites, outbreak context or types of control methods. For instance, a worldwide review of protozoa outbreaks is in Baldursson & Karanis (2011). Sinclair et al. (2009) undertook a structured literature review to search for and report on virus-disease outbreaks in recreational waters.

Emerging infectious diseases refer to poorly understood and often relatively recently discovered pathogens. Our understanding of the risks these pose to public health through environmental routes of transmission is not clear. Concerns about emerging diseases and potential mitigation measures overlap greatly with concerns about and possible strategies to resist deliberate contamination of water supplies (such as for terrorist reasons). This report documents the methods and outcomes of a meeting designed to help prepare for both possible threats.

Scenarios have been described as ‘Stories that can help us recognise and adapt to changing aspects of our present environment. They form a method for articulating the different pathways that might exist and identify plausible steps to move down each of those possible paths’ (Schwartz 1996). Scenario planning can have a positive impact on decision quality in response to uncertain and rapidly developing situations (Meissner & Wulf 2013). Scenario development is the first step towards identifying strategies that result in robust decision-making in multi-faceted situations with high uncertainty about possible risks (Kwakkel et al. 2016). As part of the exercise, our participants learned many concepts typically involved in structured approaches to scenario construction. Drawing on methods used in other published scenario building events, our approach was pragmatic and adapted so as to be completed in one day and potentially easily replicated in participants’ own organisations and workplaces, if desired.

European professionals with expertise in water safety, water provision, waterborne diseases and environmental protection were invited to attend a workshop that was designed to create an active participatory meeting. The workshop format was a short plenary session followed by smaller group collaborative work (in parallel), with a final plenary session at the end of the afternoon. All participants were allocated to either the emerging diseases (ED) or attack (AtK) groups by event organisers. A subject expert was purposefully placed in each group (acting as both participant and topic expert), in case of technical queries that the facilitators could not answer. Our sessions were normative-participatory in nature, consolidating multiple theories and concepts for participant engagement (Steinmüller 1997).

Scenarios are ‘hypothetical sequence[s] of events constructed for the purpose of focusing attention on causal processes and decision points’ (Kahn & Wiener 1967). Thus, scenarios are hypothetical but still outlined and concrete (Wilson 1978). Scenario planning is suited to developing multiple alternatives of possible futures taking into consideration unlikely futures with unknown probability of actually occurring. These are relatively extreme events, so-called very rarely expected Black Swans. Alternative scenarios can be used to explore possible tipping points and thus interventions that might disrupt multiple negative scenarios. Because the scenarios we sought to develop were anticipatory in nature, we used a participatory-normative approach to scenario planning. There is little to no formalisation in this type of scenario planning unlike in forecasting and trend exploration (Steinmüller 1997).

Given the short time-frame, our scenarios were brief outlines, rather than fully developed and written versions. They were semi-global, with regard to wider contextual issues but remaining close to the original topic. The scenarios were fully qualitative. We used an intentional interpretation of the scenario, which assumes that the scenario is not only the text developed by the participants but rather the blueprint of the future developed by them.

• Key factors and key factor analysis: Key factors are those factors that define the outcome of an event. They need to be highly important (i.e. must have a strong impact) and uncertain (i.e. not definite, such as the time of sunrise tomorrow).

• Silent sorting: applicable at the stage of nomination and grouping of possible key factors. The process is done in silence to encourage a multiplicity of perspectives.

• Key factor variants: A variant of a key factor is a variable status that the factor could take (i.e. if a key factor is climate, variants could be hot and dry, cold and wet, cold and dry, etc.).

• Backcasting: Backcasting is the process to link the (future) scenario with the present. Backcasting starts at the point of the scenario (in our case 2023) and describes events in reverse order, going backwards from future to the present. It is the opposite of forecasting and seeks to develop pivotal points that lead to a scenario becoming a reality or not.

Prior to the workshop, fixed conditions for each scenario were decided by the facilitators. These fixed conditions are parameters that cannot be changed during the scenario planning process and serve to orient the outputs towards pre-specified objectives. Fixed scenario conditions are listed in Table 1. Figure 1 summarises the steps that participants went through during the workshop.

For the workshop, we devised an approach that allowed scenarios to be devised quickly (work progressed from factor identification to simple scenario descriptions in one full working day).

Participants were randomly allocated to one of the two scenario groups (attack and emerging pathogen) with some adjustment made to ensure relatively equal distribution of skills and representatives from the same organisation(s). Within each group, participants were asked to identify all relevant key factors that are likely to influence the scenario they are working on. These were written on adhesive notes and stuck to a wall or whiteboard. Duplicate entries were removed and the participants were asked to check if they could think of any further key factors. Once all key factors were identified and agreed (no more suggestions for others or alterations), participants were asked to look for relationships and interactions between these factors, with the option of creating groups, over-arching category labels, and relationship indicators such as arrows (Figure 2). Participants were allowed to nominate, remove, cluster or remove from clusters both their own key factors and those contributed by other participants. Participants were also allowed to re-add factors removed by themselves or other participants. This was done in silence (silent sorting). Any arguments about the validity of a factor or its associations had to be resolved silently by moving or removing the respective factor. Silence deterred habitual deference to verbally or personality dominant colleagues and meant that minority voices and alternative perspectives were more likely to be heard.

The previous phase allowed the development of a complex network of interrelated key factors. The next stage was to identify (by voting for) the most important factors for each scenario. In the voting stage, each participant was asked to label what, in their opinion, were the four most important factors (four votes to allocate). A participant could even give all their votes to the same single factor if they felt very strongly about it. The factors with the most votes were selected for the next step, which was generating variant states for each factor. A repeat round of voting was an option in the event of tied votes.

For each key factor selected, participants were asked to identify four plausible variant states. This was done in small groups (3–4 people). Examples were given so as to clarify the process. For instance, if disease transmission is a key factor, examples of variant states could be very infectious, not very infectious, waterborne or transmitted by bodily fluids.

After variants were devised, scenario building was demonstrated to participants. This was done by going person to person, with each person choosing one variant for each factor, making sure that the variants selected could plausibly happen together. After each variant was chosen, that same variant was not available for the other scenarios. Once all factor variants were chosen, they were combined to form a ‘skeleton’ for each scenario. Subsequently, small groups (4–6 persons) worked on backcasting for their specific scenario, starting in the projected year (2023) and working backwards to fill in the story of how the scenario might have happened from our concurrent circumstances in late 2017.

A feedback questionnaire was distributed to the participants to assess their opinions about the scenario planning workshop (Appendix 1, available with the online version of this paper).

Thirty-one participants attended the workshop event in Barcelona, Spain, held on 7 November 2017. They had expertise in microbiology, medicine, civil infrastructure maintenance and protection, data analysis, environmental and/or public health and facility management. Most worked for water companies, universities or government agencies tasked with resource regulation and/or protection. Most were professionally based in Spain, but there were participants concurrently working in seven other countries: Austria, Denmark, France, Netherlands, Norway, Portugal and the UK. All had spent most of their professional lives in Europe, but many had experience working in low-income countries on projects related to the provision of safe drinking water. Fifteen experts were placed in the emerging pathogen group and 16 in the attack group.

The key factors and variants were chosen by the participants for the emerging pathogen (ED) and attack (AtK) scenarios are shown in Tables 2 and 3, respectively. The ED group identified eight key factors, while the AtK group identified five. For each key factor, four variants were successfully formulated. Three key factors were shared between the two scenarios, namely emergency response, communications and pathogen characteristics/source. Interestingly, the scope of these factors was described somewhat differently between the two groups, which are very much allowed within scenario planning methods. The ED group members were quite concerned with pathogen characteristics (infectious dose and inactivation methods) and modes of transmission, while the AtK group considered pathogen characteristics as a mix of pathogen types. One variant for the source of the pathogen (variant 4) included infectious dose, persistence and incubation period. Similarly, communication strategies identified by the ED group were multi-faceted and revolved around the efficacy of a potential crisis committee, interaction with media and political influences. Conversely, the AtK group described only the outcome of whatever communication efforts were in place. The key factor variants were poor, perfect, disastrous, etc. This was also the case for the key factor emergency response. The AtK group derived variants such as none, incomplete and complete. The ED group categorised the emergency response and defined three key areas: health systems, official communication and compliance. All three components were considered while deriving variants (Tables 2 and 3). The AtK group considered access to healthcare as a stand-alone key factor. Finally, the AtK group identified areas that were exposed to the contaminated water as a key factor. This is particularly relevant considering the uncertainties about the scale of the malicious attack.

When building the scenarios, one group found scenario construction too difficult; they were inclined to think that detection methods (genomic analysis, specifically) made their scenario too unlikely to happen. However, five of the scenarios (two emerging disease and three attack) were well enough developed to be reported here. It was commonly mentioned in all scenarios that lack of resources or policy changes that led to poor equipment maintenance or substandard monitoring of contamination or other reduced microbe control measures could considerably exacerbate the worst impacts of any threat scenario. All scenarios had to make plausible assumptions about decisions and policies adopted by health systems, governments and others. Policy changes could be to reduce the frequency of testing, remove types of testing and remove chlorine from water. Some of the suggested details in all of the scenarios are sensitive, especially the specific mechanics of how an attack could happen. For this reason, and for brevity, we publish here only the timelines for each scenario, which start 5 years in the future and work backwards to the present day. The variants used to build each scenario are listed in Boxes 1a–5a. Corresponding scenario timelines are listed in Boxes 1b–5b.

Of 31 individuals, 26 (84%) returned completed questionnaires to the organisers. Feedback was broadly very positive (see Table 4).

We describe a set of procedures for running a one-day workshop to facilitate experts to envision a range of plausible scenarios that could threaten water supplies they are tasked to protect. Most of our experts by necessity understood their area of expertise well, but this could lead to a blinkered focus on just some vulnerabilities. The chief benefit of the process was in helping participants to see many vulnerabilities simultaneously in the water supply systems. Hence, there was a synergistic perspective of relevant risks: a chance to improve understanding how seemingly small individual vulnerabilities could cascade together into huge problems. This type of exercise can be invaluable to inform the design of strategies that mitigate potential harm linked to many individuals or combined vulnerabilities.

Although the threats posed here were purely biological, the methods could easily be adapted to consider other hazards, such as chemical or radiological threats. The workshop steps described here are not definitively the best way to undertake such a workshop; we describe ways to improve the implementation below. Neither could our resulting scenarios possibly be definitive; a different set of experts probably would have identified somewhat different key factors and developed possibly quite different scenarios. The choices of key factors and how participants imagined scenarios were heavily influenced by their own backgrounds (and therefore could be very country-specific). Nevertheless, we hope that our account and comments about implementation may be useful to others pondering whether to run similar planning exercises within their own organisations, in order to inform local risk assessment. Some of our observations described below seem likely to be very generalisable to many settings, with regard to protecting water supplies. A valuable outcome of scenario planning exercises like ours is going beyond worst- and best-case scenarios; combinations of plausible and individually ordinary outcomes can also lead to crisis situations. There is an infinite number of scenarios for any one topic, and scenarios need to be adaptable to local conditions in order to be credible and not just very unlikely extremes. The intermediate steps in the methods we describe can also be a constructive exercise for those involved in water protection, such as identifying key factors (inherently important and uncertain) and the use of silent decision-making (the silent sorting methods which encourage the widest range of views to emerge).

Participants found it difficult to plausibly imagine these scenarios except in an environment where protection measures and communications strategies were significantly inadequate by European standards. This is encouraging as it suggests that an inverse situation is true in the group opinion: the scenarios were very unlikely as long as regulatory standards remain high, and monitoring and accountability mechanisms are well resourced. Some of the participants with microbiology backgrounds felt strongly that genomic analysis would ensure very rapid identification of pathogen characteristics, so much so that delay in identification or difficulties in planning a management strategy would be negligible. Developments in genomic methods may indeed facilitate quicker removal from water supplies. However, the converse is also true. In an environment with inadequate safety controls, insufficient laboratory methods, poor resources or monitoring, the participants easily imagined a high diversity of ways that an ED or attack could be highly disruptive to the provision of safe drinking water in Europe.

Among the many policy changes that could increase the likelihood of an emerging pathogen or successful attack were declines in capital investment, delays in repairing infrastructure, prioritising other public services or promoting public preferences (such as having less chlorine taste in drinking water), as well as reduced intra-agency cooperation. The participants thought that such policy changes were unlikely but not impossible, especially given the ever-present pressure on public services to be cost-effective. Policies that would reduce negative scenario impacts were to maintain effective communications with the public and between relevant agencies, as well as well-defined strategies to make water quality testing easier, quicker, more specific and yet still cost-effective.

The facilitators see many ways that the methods could have been concisely and clearly better explained. We were not prepared for how systematically and thoroughly the participants wanted to approach the task of choosing variants: we should have been firmer about insisting that they think of variants in concise terms. Many participants tried to devise elaborate scenarios as backstories for a possible variant before they could decide on each variant option. It is certainly possible to dedicate an entire day to decide on factor variants, but for the purposes of scenario building in a one-day workshop, the variants only needed to be possible, rather than especially plausible. The time spent developing and identifying possible backstory details for the variants was still productive, ultimately because these details were useful when fleshing out details during the scenario building stage.

The workshop results were dependent on the skillsets and experience of those available to attend. To maximise value out of a scenario planning exercise, targeted recruitment of individuals with pre-specified skills and expertise might be preferable. This could lead to greater credibility and more effective response strategies, especially if participants had past experience dealing with exactly these types of threat (deliberate attacks or emerging pathogens). We should have asked our participants about their prior experience (if any) addressing these or similar threats.

In the plenary discussion afterwards, attendees raised further observations about testing regimes. They commented that current methods for water quality testing are well suited for the required regulatory monitoring. However, deference to regulatory standards somewhat acts as a deterrent to trying new or more sensitive testing methods, since the new methods would not be required and may represent an unnecessary and unreimbursed cost. There are also problems with accepting results from new techniques because of their lack of correspondence with data accumulated from conventional monitoring. Some methods are associated with different error patterns (such as higher numbers of false positives) and thus require sensitive decision-making with regard to when an alert truly needed to be raised.

The regulatory sector should be receptive to new methods, but getting new methods into practice is often a slow process because of conservationism in the sector. Additional limitations are the usually high cost of newly developed methods. Therefore, the participants agreed that a distinction should be made between regulatory compliance and operational monitoring. It was suggested that the first step in operational implementation is event monitoring. This has been trialled since late 2017 in Spain (Brainard et al. 2018).

Relatively new technologies such as whole-genome sequencing for typing and source tracking are relevant. These techniques offer value in outbreak investigation for tracing sources of contamination but are unlikely to be unsuitable for routine application in environmental sampling, as the large amounts of data generated could not necessarily be linked to health risks in humans. Microbial source tracking and whole-genome sequencing techniques have been developed (Hjelmsø et al. 2017), which may be very valuable in bioterrorist attack investigations. Water quality testing strategies can be most protective when implemented in a tiered approach, such that test results are enhanced by complementary information from multiple sources (Rickert et al. 2014; Ryzinska-Paier et al. 2014).

As observed previously, the key factors and scenarios identified by our participants cannot be definitive and may not all be generalisable; instead, they are the products of the procedures as described. With regard to our procedures, we have tried to explain them clearly and be candid about what could be improved. We did not subject the workshop or the outputs to a rigorous evaluation scheme. Checklists for evaluating the quality of participatory scenario planning exercises are not well developed, but many resources exist from which such a checklist could be derived, some of which are contextualised with regard to water safety. Piirainen et al. (2012) produced a systemic evaluation framework to be used for enhancing the utility of scenario generation. Scott et al. (2012) described how scenario planning must identify important but uncertain factors, their impacts and ultimately key adaptations to reduce risks of harm. Both Mott Lacroix et al. (2015) and Van der Merwe (2008) advocated that scenario planning exercises should produce outputs that are challenging, relevant and plausible; we believe that our scenario planning had many if not all of these attributes.

The scenario building workshop fostered increased awareness of possible risks to water supplies. The methods comprise a process that has credibility for participants by creating a multiplicity of considered perspectives in the process of identifying what the key uncertain and important factors are, and their possible variant states, that could have a high impact on the proposed problem situation. This meeting encouraged health and industry experts to identify vulnerabilities and novel pathways for an emerging disease or attack to threaten water supplies. Very positive feedback about the experience was received, even among those participants who found their scenario were very unlikely. Scenario building could be used to inform water safety plans (Bridle et al. 2014; Ryzinska-Paier et al. 2014; Gunnarsdottir et al. 2016, 2017) for better risk assessment and to improve protection of public water supplies.

Funding and support were provided by the EU-FP7 Aquavalens project (grant agreement no. 311846). Mike van der Es, Claudia Serra Puigdomenech and Robert Pitchers gave helpful comments on this manuscript as it developed. JB, CCH and PRH are affiliated to the UK National Institute for Health Research (NIHR) Health Protection Research Unit in Emergency Preparedness and Response in partnership with Public Health England (PHE). The views expressed are those of the authors and not necessarily those of the European Union, UK National Health Services, the NIHR, PHE or workshop participants. The funders had no role in event design, workshop delivery, a collection of feedback, analysis, decision to publish or preparation of the manuscript. Thank you to all of our participants for their intellectual input and expertise, creative and collaborative contributions, as well as Aquavalens partners cetAqua and Aigües de Barcelona who co-hosted the meeting.