When Theodore Roosevelt designated the Grand Canyon a national monument in 1908, he called the colorful, mile-deep gorge "the one great sight which every American should see."
Americans have followed his advice. The Grand Canyon — now a national park — had nearly 4.8 million visitors last year alone, making it the second most-visited park, behind the Great Smoky Mountains.
But Grand Canyon utilities that provide drinking water and treat sewage are failing and need urgent repairs, according to an internal report and former employees.
Grand Canyon water systems were built by park concessionaires during the Great Depression. The last major upgrade to the drinking water utility was completed 55 years ago, when visitation levels were four times lower than today.
A move to automate the water systems around the turn of the 21st century increased their efficiency. But federal investigators have found those electronic controls are now outdated and at risk of attack.
Water problems at the Grand Canyon raise questions about the ability of the 99-year-old National Park Service to innovate and maintain its infrastructure under tight budget constraints, former employees say.
At the same time, Grand Canyon management’s ongoing failure to fix the water systems and alleged mistreatment of workers involved in revamping its networks — including a whistleblower who was wrongfully fired from the park — suggest to some that the issues there go beyond rickety pipes and funding shortfalls.
‘Decayed’ electronic controls
Grand Canyon National Park’s drinking water is mainly supplied by a spring below its north rim.
The spring-fed system dates to 1929 and pumps water some 3,200 feet up the canyon wall from mid-May to mid-October to the Grand Canyon Lodge resort complex, campgrounds and Park Service buildings.
Across the gorge, the year-round community at Grand Canyon Village gets its spring water pumped about 3,000 feet up the south rim from a system completed in 1932 by the Santa Fe Railway company.
The thirsty village original relied on a smaller spring on its side of the canyon and periodic train deliveries of water, according to "Polishing the Jewel," a Grand Canyon-affiliated group’s history of the park.
Then in 1970, the 16-mile, aluminum trans-canyon pipeline connected the two systems. The breakdown-prone pipe provides the south rim with an average daily flow of 1.1 million gallons, or about 800 gallons per minute.
Some of that spring water also goes to supplement the groundwater supplies of Tusayan, Ariz., a growing town of around 500 people located just outside of the park’s border (Greenwire, April 9).
Since 1999, all of the Grand Canyon water infrastructure has been operated by a supervisory control and data acquisition (SCADA) system.
The series of wireless devices run and monitor drinking water systems that are ancient — even for the cash-strapped National Park Service — as well as four wastewater treatment facilities, the oldest of which was built in 1932. The average year in which most NPS drinking water systems were built is 1975; wastewater systems date back to 1980 on average.
The electronic controls at the Grand Canyon were needed to improve the leaky infrastructure and blackout-prone grid it relied upon, according to Michael Martin, who designed the SCADA system.
"When I first got there, potable water spilled everywhere, reclaimed water spilled everywhere and wastewater spilled everywhere. I just felt like we could run a utility better than that," the former Grand Canyon controls engineer said.
"The big 900-horsepower pumps that lift water to the rim, when we’d start them, they literally would knock the power out on the south rim two out of three attempts," he said. "It was very problematic. We had to start the pumps every day."
Martin explained that his custom-built SCADA system used electronic water gauges and variable frequency pump drives to fix those problems and improved the efficiency of the park’s drinking water operations.
But since he left NPS in February 2010 to work for the Federal Emergency Management Agency’s Mobile Emergency Response Support team, Martin said the complex network of motors, monitors and wireless communications devices built up over the years to remotely operate the water infrastructure has "slowly decayed."
"It’s distressing," he added.
‘Health and safety hazard’
Interior’s Office of Inspector General came to a similar conclusion when it reviewed the SCADA system last year with the aid of the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team, the top cybersecurity experts in the federal government.
The August 2014 OIG report found the Grand Canyon water systems’ electronic controls were vulnerable to physical attacks, relied on an obsolete operating system and used unsecured wireless connections. The park also had no backup plan in case something were to happen to the lone employee responsible for managing its SCADA system.
"The failure of this system could cause the fresh water supply to become contaminated and could present a health and safety hazard," the OIG warned NPS Director Jonathan Jarvis.
Dan Morin, the only park staffer who had the codes and passwords needed to run its electronic controls, turned away a contracting company representative who visited the site in early 2012 to assess the SCADA system, the report notes.
The OIG’s findings — labeled for "official use only" — were obtained by Greenwire via a Freedom of Information Act request. The FOIA response did not include the security experts’ recommendations to address the water systems issues that were highlighted by the OIG.
But more than a year since the Park Service received the report, Grand Canyon leadership conceded that they still haven’t fixed the water utilities’ electronic controls. Park spokeswoman Kirby-Lynn Shedlowski blamed their slow response largely on the struggle to find and retain people with the right skills.
"The park has been unable to make much progress on updating the SCADA system due to the recent turnover of staff that worked on the system," Shedlowski said.
Three months ago, the Grand Canyon hired an electronic engineer and industrial electrician who, she said, are starting "to work towards maintaining and upgrading the SCADA system. Additionally, the park has requested project funding for this fiscal year to begin the much-needed component renewal of the SCADA equipment as well as to begin planning upgrades."
But Shedlowski downplayed the potential for the new hires to secure the utilities’ control system anytime soon.
"The effort to upgrade SCADA will most likely take multiple years and cost upward of $1 million," she said.
‘Microcosm’ of U.S. infrastructure
Martin, the SCADA system designer, acknowledged that it would be technically possible for highly skilled hackers to manipulate the electronic controls for the water networks.
But why bother? He suggested that the crumbling physical infrastructure of the drinking water and wastewater systems are a much bigger risk to people in and around the Grand Canyon.
The pipes, pumps and other major components in the desert outpost’s water network "are long past end-of-life, but they have no other alternative but to keep operating them even as they’re failing around them," Martin said of park management.
The trans-canyon pipeline, for instance, has sprung a leak between five and 30 times per year since 1978. Each rupture costs an average of $25,000 to fix and requires shutting down the south rim’s water system for the three to four days it takes per repair, according to park employees.
NPS data show that needed upgrades to Grand Canyon drinking water and wastewater infrastructure make up a substantial fraction of the agency’s overall $11.5 billion deferred maintenance backlog.
The two drinking water systems need more than $157.4 million worth of new equipment, including a costly replacement for the trans-canyon pipeline, which is now an unreliable patchwork of steel and aluminum. An additional $24.5 million is required to fix up the park’s wastewater treatment plants.
Each of those costs are more than the Grand Canyon’s annual operating budget. For the last eight years, management has had to run the entire park on around $21 million, Superintendent Dave Uberuaga emphasized in an interview.
"I don’t want to make that an excuse, because I live with that year after year. And we’re prioritizing projects and funding and critical infrastructure — not monthly, but multiple times a year," Uberuaga said.
Still, he added, "I wouldn’t refute that there’s been an under-investment in the infrastructure in the utility area."
Although the Grand Canyon has asked Congress for money to fix its electronic controls, Martin doubts that Congress will be willing or able to pony up the cash necessary to address that or the park’s costlier drinking water and wastewater problems.
"The whole thing sickens me, but I have to look at the Grand Canyon as a microcosm of the infrastructure of the United States itself," he said.
"How do you defend to the American people $150 million to replace a pipeline in the Grand Canyon when we have bridges that are falling apart and haven’t been inspected in years and years and years and — even if they were inspected — nobody would like what they found and nobody would have the money to fix them anyway?"
Concerns about park management
To Martin and other former employees, the ongoing water problems at the Grand Canyon are indicative of deeper leadership challenges at the park.
Martin, for one, said he ran afoul of management when some of his innovations eliminated the need for pump house workers and other manual jobs.
"The Park Service is not about building new things and making things better. It’s mostly about keeping things the same," he explained.
Leadership eventually made it clear to him that he had overstayed his welcome in the Grand Canyon.
"In the end — to give you an idea of how contentious it was — if you wanted to call me at my office, my telephone number was 7666. And that wasn’t accidental, because nobody was 7665 or 7667," he said.
The OIG uncovered similar stories.
In a section of its report focused on environmental violations unrelated to the SCADA system, the OIG notes that the park had been cited "on multiple occasions" by the Arizona Department of Environmental Quality for improperly chlorinating drinking water, failing to have an emergency operation plan, mismanaging the sludge left over from wastewater treatment and sloppy record keeping.
A former health technician at the park, whose name was redacted, told the OIG that she quit "because the problems that were identified during ADEQ’s inspections were not being fixed and were being pushed aside or ignored by park management."
The investigation, the OIG noted, was also prompted by a whistleblower whose name — like those of all the rank-and-file workers mentioned in the report — was redacted.
Problems exposed by fired vet
The OIG only touched on the whistleblower’s complaints, but Stephen Kruhmin, a former Navy reservist and father of eight, provided Greenwire with dozens of documents detailing how he was fired from the park after raising concerns about the SCADA system and clashing with Morin, who federal investigators found was the last employee left with access to the water systems’ electronic controls.
Kruhmin was hired in November 2011 to replace Martin at the Grand Canyon. Based on experience he had working on Yosemite National Park’s SCADA system, Kruhmin was concerned that the software the Grand Canyon utility used was no longer supported by its manufacturer and that the operating system it ran on was Windows XP, which Microsoft had stopped selling the year before.
Morin was not swayed by those arguments and sent emails to management alleging that his new co-worker was putting the largely closed electronic controls system at risk of a cyberattack.
Shortly before Thanksgiving 2012, Kruhmin — an electrical engineer with decades of experience — was fired from the park in part because he was allegedly unable to operate the water utilities’ electronic controls. That decision was later overturned by the federal Merit Systems Protection Board.
Kruhmin returned to the park the following January but found that his job duties had been significantly changed and that his co-workers had been instructed not to talk to him. As a result, he decided to again challenge the Department of the Interior, which oversees the Park Service, in front of the MSPB.
Ultimately, Kruhmin agreed to drop all complaints against Interior in an August 2013 settlement that required the agency to pay some of his attorney’s fees, clear his federal employment record and provide management training for Grand Canyon leadership. In return, he agreed to resign from the park at the end of January 2014 and perform "custodial duties" until then.
Morin quit the Park Service for a job with the Army Corps of Engineers shortly after Kruhmin’s resignation. He did not respond to emailed interview requests.
Kruhmin, who earned a merit award for his time on the toilet-cleaning crew, was unemployed for more than four months after leaving the Grand Canyon. To save money during that period, the Afghanistan war veteran said that he, his wife and three youngest children moved to Oklahoma to live in the attic of his eldest daughter’s house.
"Boy, did they nail me for being a whistleblower," said Kruhmin, who now works on utility control systems for the Air Force at Naval Air Weapons Station China Lake in Southern California.
Call for ‘regime change’
When presented with the specific concerns about management made by Kruhmin, Martin and the former health technician who was mentioned by the OIG, Grand Canyon Superintendent Uberuaga said he was unfamiliar with their situations and could not comment on them anyway.
"I regret that there’s anyone left feeling that way, but it does happen in organizations," he added.
Uberuaga, who leads around 500 Park Service workers and oversees another 1,300 concessionaire employees, also couldn’t confirm that the management classes promised in the settlement with Kruhmin ever occurred.
But he noted that "in the last three years, I’ve invested several hundreds of thousands of dollars in training employees in supervision." His focus on improving oversight came in response to feedback he got from meetings with and surveys of Grand Canyon employees, he said.
The fact that the water utilities in particular seem to have suffered from poor management didn’t seem to surprise Uberuaga.
"These are technicians that are now supervisors," he said. "They are a really good wastewater treatment plant operator, but they weren’t necessarily a good supervisor."
Kruhmin, though, is skeptical that any number of training classes for park managers will do much to improve conditions for workers, whistleblowers or visitors.
"I don’t have any animosity toward the Park Service, but the Grand Canyon in particular is really bad for some reason," he said. "The only way they’re going to fix that is to do a regime change there."
