I started a reply to a comment by frenv posted to my 8-5-07 blog entry, but it got too long and the question posed by frenv deserves a widespread discussion by everyone involved in the security of chemical facilities. Here is the original comment:
So here is the question I have about all this and other postings on this site/blog. How do we achieve a reasonable balance between real security (not "Mission Impossible"), and boogyman paranoia? Untold dollars could be spent and reduce our overall economic viability as a nation. No?
This is the basic problem that anyone has to deal with when looking at providing security for anything. The first thing that we must accept is that there is no such thing as absolute security; any security system that man can design can be defeated. Once that is understood, it becomes a cost benefit analysis problem; what is the potential cost of a successful attack, what is the probability of a successful attack, and what is the cost of the security precautions?
Realistically speaking, at this point in time there is a very low probability that any specific plant is going to hit by a terrorist attack; no one has attacked a chemical plant to date. This is one of the reasons that there has been so little work on providing much in the way of security at most chemical plants in this country; the cost of security precautions far outweighs the expected cost of a successful attack.
Of course the same thing could have been said about the probability of any specific airliner being hijacked and run into the twin towers prior to 9-11-2001. The cost of the necessary security procedures far out weighed the perceived costs of a successful hijack. In hind sight we can see that the analysis used the wrong cost basis for the cost of a successful attack.
The purpose of the new DHS regulations is to try to get all owners of all high-risk chemical facilities to make a structured, standardized calculation of the costs of security and the potential costs of a successful attack. Since chemical facility owners cannot be expected to have enough data to evaluate the potential of attack, the Congress gave DHS the responsibility since they have the access to the requisite intelligence information.
This is the purpose of the TOP SCREEN process, each facility that has a potentially dangerous quantity of a potentially dangerous chemical reports the quantities they have on hand and where the facility is located. DHS then calculates the likelihood of attack and the potential consequences of a successful attack. Facilities that are determined to be at high-risk based on those calculations will be placed in a four level tier system based upon their relative risk in that high-risk category. Those facilities placed in the higher tiers (tiers 1 & 2) will have to have more extensive security procedures in place to protect their facilities.
If a facility then determines that the cost of security is too high a cost to pay, a business decision certainly, they have a couple of options:
Fight the DHS designation – almost certainly a losing cause sinceDHS has the sole authority to make or change this designation, or
Reduce the amount of the dangerous chemical on-site at any given time – this should reduce the risk and thus lower the cost of security, or
Eliminate the dangerous chemical from their process – this is the solution that a lot of people outside of the industry would like to see, but is likely in very few instances, or
Get out of the business.
The good side of these new regulations is that all chemical facilities are going to have to play by the same rules. DHS will be the impartial arbiter of the game. Thus everyone’s cost basis for security will be based on the same set of calculations for the cost of a successful attack.
One final point, these regulations are not just directed at Al Qaeda, they are directed at all potential terrorist attacks. As a side light they will also be directed against a number of non-terrorist attacks as well. If there had been better security at the Whitley Fuel Depot in Spokane, WA, perhaps the person that apparently maliciously started that fire would have been prevented from doing so. How much security would have been enough? We won’t know until the investigation is complete, but there certainly would have been some level of security that would probably have prevented this incident (again there is no perfect security) ask the insurance companies how much security cost would have been too much? Or maybe we should ask the surrounding business owners, or the people that lived nearby, or the firemen that had to fight the fire. Security is truly like car or fire insurance, you complain about how much it costs until you have to use it.