Last Friday DHS added three new questions to their FAQ page. The first question deals with a Top Screen issue and the other two deal with Site Security Plan issues. The three questions are:
- 1534: What is the Area of Highest Quantity (AHQ)?
- 1536: What does "risk-based" mean?
- 1537: Why is DHS using risk-based performance standards?
Area of Highest Quantity
The definition of AHQ is provided. It is a circle with a radius of 170 feet that contains the highest quantity of the COI in question. While this is a fairly straightforward definition, I have always wondered where the 170 ft radius came from. Well the SVA instructions provide the answer, it is the 9 psi overpressure line for a VBIED located at the center of the circle.
Definition of "Risk-Based"
The DHS answer never does actually define what ‘risk-based’ means though it does provide a description of their ‘risk-based tiering structure in its regulatory approach’. Let me take a swing at the definition.
Risk-Based – Adjective, describing a process where decisions are made based on relative levels of risk. Example: The CFATS process is risk-based; facilities are rated and regulated based on their relative risk for terrorist attack. The highest rated facilities are required to respond faster and adhere to higher standards of performance.
Risk-Based Performance Standards
I was happy to see that while the DHS answer started off with the ‘because Congress told us to’ explanation, a legally sufficient reason, they proceeded to give a justification for those standards. The first answer is the standard ‘each facility is unique’ and thus requires a unique response.
The second justification is one that has been appearing more frequently lately. This one points out that industry-wide security is increased because an adversary will not know what security procedures will be in place at any given facility.
- "Security measures that differ from facility to facility mean that each facility presents a new and unique problem for potential adversaries."
I am not sure that I agree with that reasoning. This assumes that there is a central training department for terrorists that is teaching them how to attack chemical plants.
What I think is the best reason for this approach is not given in this answer. The alternative approach is the command method of regulation. That method assumes that the government is omniscient, and has the definitive answers to the problem. Since there is little actual experience in protecting chemical facilities from terrorist attacks, it would be hard to believe that anyone has ‘the answers’.