Tuesday, December 30, 2008

SOCMA Takes on IST

I have noted in a couple of recent blogs that the American Chemistry Council (ACC) seems to be reluctant to directly attack potential requirements for inherently safer technology (IST) in up coming legislation on securing high-risk chemical facilities. According to a recent Synthetic Organic Chemical Manufacturers Association (SOCMA) press release SOCMA does not share that reluctance. In discussing what SOCMA would like to see in the way of chemical legislation in the 111th Congress SOCMA’s apparent first priority will be the moving of the current CFATS program to permanent status “without product substitution requirements under the guise of inherently safer technology (IST)”. The press release goes on to say:
“‘The American chemical manufacturing industry practices the fundamental principles of IST every day,’ said Joe Acker, President of SOCMA. ‘It is inappropriate for Washington bureaucrats to be given authority over which chemicals to substitute for security purposes. It will also likely create dangerous unintended consequences.’”
This will put SOCMA on a collision course with the House Homeland Security Committee that included a moderate IST requirement in its Chemical Facility Anti-Terrorism Act (CFATA) of 2008 (HR 5577) last year. That legislation will probably be the forerunner of any legislation that will make it to the floor of the House early in 2009. It is unlikely that SOCMA has the political power to get Chairman Thompson to pull an IST requirement from any chemical facility security bill that will pass through his committee. Nor does it seem likely that Chairman Waxman of the House Energy and Commerce Committee will have the desire to bury chemical security legislation like his predecessor did this year. Even Rep Green from Houston, TX (a chemical facility rich district if there ever was one), chair of the important Environment and Hazardous Materials subcommittee seems to be on the CFATA band wagon after Chairman Dingell was removed as the committee chair (see: “Waxman v. Dingell Aftermath”). No, I think that the ACC tactic will allow them to successfully urge some minor modifications to the IST provisions of the current language in HR 5577. Directly attacking IST will not be successful in the current political climate in Congress. The IST proponents have done too good job in defining the discussion in the minds of the public. Some form of IST will almost certainly be included in any chemical facility security legislation that makes it to a vote.

Reader Comments 12-26-08

Blogs about video surveillance systems always attract the most responses. Today we look at a comment from Ryan Taylor, CEO, TRUSYS about last weeks blog; "Using Video for Detecting Perimeter Violations". His comments are longer than most, but seem to be well worth reading. You can find his complete comments at the bottom of the referenced blog by clicking on the comments link. He notes that the figures quoted in that blog for false positives (175 or more per week) are completely unacceptable from his point of view. He states that his company recently tested a system with a false positive rate of 1 false positive per 38 actual detections. That sounds pretty impressive to me. He also briefly discusses options for doing the ‘analytics’ in the individual cameras rather than in a central computer. He also mentions web based software rather than loading the analytics software on facility computers, noting that this allows for remote maintenance and adjustments. The more we talk about using video analytics for intrusion detection, the more it becomes obvious that this is not yet mature technology. Facilities that want to use this technological fix to replace a large guard force need to keep that in mind. This certainly appears to be an area a facility security manager should approach carefully.

Monday, December 29, 2008

Comments on Ammonium Nitrate ANPRM – 12-26-08

We continue to have an increasing, yet hardly overwhelming, number of comments on the advance notice of proposed rule making issued by DHS for the regulation of the sale and transfer of Ammonium Nitrate. This last week there were comments posted by six organizations. Those commentors were: 

The Fertilizer Institute Comments 

TFI believes that the AN program should be administered through the State fertilizer control offices with DHS limiting their function to conducting the terrorist database searches for the states. TFI recommends that the State FCO’s conduct the inspections and audits as they are already doing so for most of the distributors. This would leave DHS to audit the State offices. TFI suggests that registration take place at local Cooperative Extension Offices and through the US Mail, local distributors could keep blank registration forms on hand to submitted via mail. TFI volunteers to help distribute posters and brochures explaining the program to end users of AN. 

Northwest Mining Association Comments 

The NMA suggests that DHS use the authority provided in the legislation to exempt AN explosive sales and transfers to ATF licensed personnel from the registration provisions of the proposed regulations. The NMA comments that requiring purchasers to report thefts and unexplained losses exceeds the authority provided in the legislative background. They also suggest that the terms ‘unexplained losses’ need to be better defined and need to take into account the normal losses found during the handling of bulk AN. 

Agricultural Retailers Association Comments 

The ARA suggests that any registration program be a web based program, allowing registrants access through their personal internet connection or through their Local Cooperative Extension Service office. ARA suggests that DHS should use the accepted industry definition of solid ammonium nitrate fertilizer containing at least 33% nitrogen by weight for the material regulated under this rule. ARA argues against DHS favoring the use of a substitute for AN fertilizer. ARA is concerned that a proposed $50,000 fine for a simple record keeping error or late filing would drive distributors to stop carrying AN fertilizers. 

National Mining Association Comments 

The NMA suggests that DHS should use its statutory authority to exempt entities licensed by the ATF from the registration requirements of this rule. The NMA objects to DHS expanding their statutory authority by requiring purchasers to report theft and losses of AN. It notes that the ATF already requires their licensed users to report thefts within 24 hours. 

Cornell University Comments 

The comments provided by Cornell University address the small amounts of AN used in research settings and questions if DHS intends to include those small (typically 1-lb bottles) quantities in the proposed regulations. 

Wyoming Ag-Business Association Comments 

The WABA notes that two crops in Wyoming use ammonium nitrate fertilizer, sugar beets and hay grass. They note that the Wyoming legislature is attempting to set up a state regulatory program for ammonium nitrate fertilizer, but are waiting for appropriate guidance from DHS. The WABA urges rapid adoption of the final rule to allow for implantation in time for the upcoming fertilizer application season. 

My Comments on Comments 

The commentors are providing a great deal of good information to DHS to consider in their rule making process. The users of explosive AN all wish DHS to recognize the registration of users of explosive AN by the ATF in the proposed rules. They all note that the registration requirements of the ATF exceed those discussed for AN fertilizer registration. And they all note that the authorizing legislation specifically allows for such an exception. 

The suggestion of the Fertilizer Institute to use State Fertilizer Control Offices (FCOs) to do the grunt work of the regulatory process certainly seems to be a useful idea. Since they are presumably already working with the distributors and end users of fertilizer AN it would make sense to use the existing bureaucracy instead of setting up a new one. The major draw back to this is that DHS would have to negotiate with 50 FCOs to set up the funding for the program. Still it appears to be worth investigating. The WABA comments about getting something set-up quickly seems to be a recipe for finding a whole host of unintended consequences. 

What DHS should probably do instead is announce that it does not intend to have regulations in place before July 1st and not be effective before October 1st (dates are examples not necessarily actual dates to be used). This would allow the industry to get the 2009 manufacture, distribution and sale of AN under way without undue concerns about the application of these rules. 

Anyone that has watched the CFATS implementation would be very surprised if DHS could get rules written, a registration system in place, and everything running smoothly in time for spring application of fertilizer. DHS needs to make clear to the AN fertilizer community that they can expect a reasonable introduction schedule of useable rules. In turn, the same community should be aggressive in self-policing in the mean time to help protect the overall society from this potential threat.

DHS Five Year Terror Forecast

There have been a number of press reports in the last week or so about a ‘leaked’ DHS forecast on the five year outlook for terror attacks against the US homeland and its interests abroad. I have not had the reportorial privilege of receiving a leaked copy of the FOUO (For Official Use Only, a marking that has little effect on restricting distribution) report, so it is difficult for me to comment on any of the contents with any authority. Fortunately, this does allow me the blogger’s freedom to extrapolate from small bits of information. So be forewarned. The following discussion of future threats against high-risk chemical facilities is only loosely based on what I have read about someone else interpreting a leaked intelligence report. Maybe that will allow you to sleep better. Weapons of Mass Destruction As DHS and the intelligence agencies continue to get better at tracking terrorist organizations trying to buy, steal, or build weapons of mass destruction, sooner or later these miscreants are going to recognize what we have been discussing in this country for a number of years. We have a number of high-risk chemical facilities in this country that can be used as WMD. We have even made it easier since we have exempted a number of the most dangerous chemical facilities, water treatment and waste water treatment plants, from any meaningful security regulations. The political discussion about security or the lack thereof, at these facilities will become louder and even more detailed this year. Our political process has already required, to make a legitimate political point, a non-governmental organization to pinpoint the 101 most useful targets. Even more detailed discussions about some of these potential targets have been included in the local press, again as part of the legitimate political discussion that is an important part of our culture. Even more publicity will be pointed at these facilities as local politicians get involved in the discussions. PJC FORECAST: Within the next year, investigators will uncover a plot against one of the facilities listed in the CAP Chemical Security 101 Report. The investigation will reveal that a small group of local wannabes will have identified their ‘target’ by reading the local newspaper. They will be identified when they try to obtain explosives for their attack from a patriotic criminal. Frontal Assault on Chemical Facility Al Qaeda will actively recruit among technicians from major American chemical facilities shutdown in third world countries. These facilities will be shutdown for economic reasons related to the current global economic downturn. This recruiting will allow them to put together teams of fighters that understand the internal workings of such facilities. Such a force would be able to execute a Mumbai style assault on a major chemical facility and to hold it hostage. While the terrorists were conducting ‘negotiations’ with authorities, well-trained chemical technicians would be able to wire the facility for the most effective attack that would result in the largest number of off-site casualties. Controlled releases of highly flammable chemicals could be used to effect fuel air explosions to destroy multiple toxic chemical storage facilities. PJC FORECAST: Within the next five years there will be a large-scale paramilitary assault on a high-risk chemical facility. The holding of such a facility will allow for an optimized attack on all the chemicals stored at the facility. A disorganized evacuation attempt will actually increase the numbers of fatalities resulting from the well coordinated attack. Cyber Attacks Real terrorists will realize that the most effective way to attack high-risk chemical facilities may not be by a frontal assault, but by a back-door attack through the cyber control system. They will realize that release of toxic chemicals through remotely opening valves or short-circuiting safety devices will produce more terror than a frontal assault. It will also allow them to use the threat of such attacks on other facilities as an extortion weapon to allow them to finance more complex operations. Al Qaeda will not have to use jihadist cyber skills to perpetuate these attacks. They will be able to contract out the work to cyber gangs in Russia or China to do the actual penetration attacks. These gangs will either be aided and abetted by their national governments seeking a ‘competitive’ advantage against US companies, or at the very least ignored by those governments. Independent cyber attacks by disgruntled ex-employees trying to make their way in a severely damage economy will become indistinguishable from terror attacks. The large number of projected layoffs in the chemical industry will inevitably result in at least one tech-savvy ex-employee trying to execute a much publicized revenge cyber attack. The first such attack will result in a number of personnel who still have access to their former employer’s computer systems attempting to resort to cyber extortion to ‘feed their family’. PJC FORECAST: Within the next year there will be a rash of ‘minor’ chemical releases caused by ex-employees exacting revenge on their former employers for letting these people go during rough economic times. Publicity about these attacks will result in a number of threats of major releases as a method of extortion. Within the next two years there will be a major release executed by a remote cyber attack on a cyber control system that will be traced back to Al Qaeda. Unexpected Attack Sources PJC FORECAST: Sooner or later the Drug Enforcement Agency is going to make a major drug bust against a Mexican drug lord for actions on this side of the border. In retaliation, one or more terrorist attacks against El Paso or some other Southwestern rail terminal will be executed by Mexican drug cartels to get the American government to back off. This will take the form of explosive devices on a hazmat rail cars originating in Mexico and destined for locations within the United States. The railcars will not necessarily be marked as hazmat cars. PJC FORECAST: Hamas will become incensed when the Obama Administration demands that they stop rocket attacks on Israel. Hamas will hire a Venezuelan drug cartel to park an explosive packed semi-submersible in the Houston Ship Channel and detonate it when a large ocean-going shipment of hazmat chemicals passes by. The Venezuelan government will deny complicity, but will not fully cooperate in the investigation. PJC FORECAST: A lone environmental extremist will effectively shut down a coal fired power plant during peak hours with the use of a small explosive device. No one will be harmed at the power plant, but the resulting sudden grid shutdown will result in a malfunctioning safety system at a high-risk chemical plant. A significant toxic chemical release will result in injuries to thousands and a few hundred deaths. Well, that should be enough potential terror threats against high-risk chemical facilities to make for a more sober celebration of the New Year. More likely, it will provide some food for thought for professional security managers. This is the type of information that DHS should be providing to security managers at high-risk chemical facilities. A real threat assessment is a look at ‘enemy’ capabilities and interests that facilities can use to analyze the risk to their facilities and adapt their plans accordingly.

ACC Continues Political Push

As the year end quickly approaches and the new session of Congress gets ready for its first meeting on January 6th, the American Chemistry Council is continuing their preparation for the upcoming debate in Congress on chemical facility security legislation. Last Friday I commented on VP Marty Durbin’s contribution (see: “Chemical Facility Security Legislation”). Today we look at an article by Cal Dooley, the organization’s President and CEO. Chemical Facility Security The article does not just address the chemical facility security issue, but rather looks at a variety of challenges that face the chemical industry in general over the next year. One of those is the future of the chemical facility anti-terrorism standards (CFATS) that expires in October. As is usual with any chemical facility security discussion with the ACC, Dooley starts out with an affirmation of the industry’s concern about security and the $6 Billion spent so far. Actually, I am beginning to get a little concerned about that figure. It hasn’t changed over the last year. The ACC member companies have either stopped spending (not likely with CFATS implementation under way) or they have stopped counting. In either case it would be much more impressive if ACC were to update that figure periodically. The only other part of this article that addresses chemical facility security is Dooley’s pledge to work with Congress to make CFATS permanent, emphasizing the risk-based performance standards of the current program. No mention is made of the IST issue or of Federal pre-emption; both were areas of ACC concern last year. ACC vs Railroads Over the last couple of years there has been an increasing animosity between the railroads and the chemical industry. Last year the American Railroad Association joined in the call for mandatory IST to sharply reduce the amount of PIH chemicals shipped by rail. In this article Dooley calls for Congress to “pass reform legislation to promote competitive rail service, end rail monopolies and restore a healthy, reliable, competitively-priced freight-rail system.” Interestingly, this may put the ACC on the side of a variety of advocacy groups that are pushing for routing PIH chemicals around urban areas. One of the things that railroads have used to justify routing through urban areas is that they would have to shift such loads to other carriers to get around cities. This may make for some interesting debates in Congress. Interesting Political Year The coming year is shaping up to look like an interesting political year. The economy will, of course, be the main focus, but there are enough other issues facing chemical facilities and chemical transportation that companies and organizations are going to have to watch the 111th Congress a little more closely than they have in the past.

Friday, December 26, 2008

Reader Comment 12-24-08

I got a quick response from John Honovich to Wednesday’s blog (see: “Using Video for Detecting Perimeter Violations”). As always he was appreciative of the mention of his site in the blog (it is free advertising after all). He includes some advice for security mangers thinking about using video analytics: “My general recommendation for security managers is to be very careful when selecting video analytics. This technology suffers from incredible overselling. A lot of security managers have horror stories as a result. I hope Nick's article helped to dispel the notion that video analytics are magic. You need to be very careful about selecting video analytic systems, and for managers of chemical facilities you may need to use multiple analytic technologies in combination.” As he always does, John wanted me to let everyone know that he is willing to take questions (jhonovich@ipvidemarket.info) from people working in chemical facility security. It’s not just because he is a nice guy (and he’s always been helpful to me), he notes that there is some self-interest involved; “It helps me as well better understand the challenges of security managers.” I urge anyone that has questions about video surveillance to take John up on his kind offer.

Area Maritime Security Committee Vacancies

In Wednesday’s Federal Register the Coast Guard published a notice soliciting members for a number of Area Maritime Security Committees (AMSC). The notice provides a list of 40 Captain’s of the Port that have vacancies on their local AMSC and points of contacts for applications. The list includes well known ports like Savannah, GA and Boston, MA, but also areas of inland waterways such as the Upper Mississippi. The notice states that: “The AMSCs shall assist the Captain of the Port in the development, review, update, and exercising of the Area Maritime Security (AMS) Plan for their area of responsibility.” Applicants should have 5 years experience “related to maritime or port security operations” and must pass a background investigation. This blog might seem to be a strange place to address maritime security issues, but there are a large number of chemical facilities that exist in Maritime Security Areas. I think that it is probably appropriate that they are properly represented on these AMSCs. These chemical facilities have a unique perspective on port security that could provide the Captain’s of the Port valuable insights into those security issues.

Chemical Facility Security Legislation

We are little more than a week away from the convening of the 111th Congress. With the CFATS authorization expiring this year there is going to be a lot of legislative attention focused on chemical facility security. We have been hearing from a number of advocacy groups about their push for increased authority for DHS in this area (see: “The Buzz Continues about Chemical Security 101”). Now the American Chemistry Council weighs in on matter in an interview on EENews.Net. Marty Durbin Interview The interview transcript on this site comes from an interview that Marty Durbin, a VP for the American Chemistry Council did on the ‘On Point’ interview show distributed by Environment & Energy Publishing. The transcript on the web page contains a link to the video of the interview as well. The interviewer, Monica Trauzzi, tosses a couple of easy questions at Mr. Durbin to get the ACC point of view about the upcoming legislative calendar and what the ACC looks for from Congress on chemical facility security. This is certainly not a hard hitting investigative interview, but it does provide some insight into what ACC is looking at in the coming session. HR 5577 The comments made by Mr. Durbin make it sound like the ACC had been supportive of the efforts to get HR 5577 passed in the 110th Congress. Actually, the ACC has been supportive of extending the current CFATS program. In so far as HR 5577 did specifically do that, ACC can claim support for the legislation. They had previously expressed concerns about some of the other components of HR 5577, specifically the IST provisions and the wording of the Federal Pre-emption provisions. In this interview Mr. Durbin does not specifically address those concerns. Chemical Security 101 Ms. Trauzzi does set up a slow-pitch softball question about the recently released Center for American Progress report on inherently safer technology. The ACC response is surprisingly collegial, offering the observation that the “Center for American Progress has done some good work and clearly we share the objective they have in making sure that all the critical infrastructure is adequately protected against threats of terrorism”. The hardest slam after that is that “it may be an oversimplification” and even that is softened by the comment that there are “a lot of different pieces to the puzzle and you've got to use all the tools in the toolbox”. It appears that IST is no longer the political bogey man, but rather a political reality that will have to be dealt with. The Writing on the Wall From this interview it seems clear that the ACC is clear that the upcoming Congress is not going to take the easy way out and pass a simple extension of the current CFATS program like HR 5533. With that option apparently closed, the ACC is looking for the next best thing; making CFATS permanent with some relatively minor changes. While they will probably fight to get some wording changes to the IST provisions and perhaps some modifications to the worker representation clauses, it does not appear that the ACC will make a serious move to stop a bill similar to HR 5577 from passing early in the 111th Congress. I think what they are much more concerned with is that there will be a major re-write of the whole chemical facility security plan. If CFATS expires a new proposal would probably not include the risk-based performance-standards that are the key part of CFATS enforcement. If Congress starts getting involved in writing specific requirements for security programs, it could start to get really expensive for the chemical industry.

Wednesday, December 24, 2008

Potential for Chemical Attack on Inaugural Train

Fred Millar, a long time reader of this blog and a vocal proponent for re-routing PIH chemical shipments around major urban areas, has sent me a copy of a letter that Friends of the Earth have sent to the US Secret Service outlining some of their concerns about the potential for a chemical attack on President-Elect Obama and Vice-President Elect Biden in their proposed rail trip from Chicago to Washington DC for their inauguration.

The letter acknowledges that the SS can probably protect their principals, Obama and Biden and their families, from the release of PIH chemicals enroute, they question whether or not the same can be said for the crowds that will attend the various functions along the route of that rail odyssey. They point to the potential threat from rail cars containing PIH chemicals on nearby freight rail lines as well as the many high-risk chemical facilities that would be expected to be along the rail lines in question.

While it has been many years since I had the pleasure of working with the SS on Vice-President Rockefeller’s trip to Berlin, GER (I had a very minor role as a guard Commander of the Relief at the facility which he spoke) I would expect that the SS is taking the FOE concern as seriously as it was intended. This is one of those ‘special events’ that the route selection rule would encourage the railroads to take into account in their route planning for hazmat shipments. While that rule has fewer teeth in it than many (certainly including Fred and myself) would like to have seen, I am sure that the persuasive powers of the Secret Service will be able to get the railroads to comply with shipping delays, re-routings, and the like necessary to keep railcars of chlorine, hydrogen fluoride, and anhydrous ammonia away from the general vicinity of the Obama train and stations where it will be stopping.

Likewise, I am sure that any high-risk chemical facilities along the route will have their normal security plans augmented by federal, state and local authorities. Inventories are likely to be adjusted and processes temporarily shutdown where possible to reduce the associated risks. Actually, because of the current state of the economy and chemical production rates, this should not be the same burden that it could be in more prosperous times.

Anyone that is interested in seeing a copy of the FOE letter can contact me. Fred has graciously allowed me to forward it to whomever I thought appropriate. If the FOE were to post this on their web site, I would certainly be happy to provide a link on this blog. One final thought. Anyone that gets involved in this issue that is willing to share details, after the fact please, I would certainly like to publicly examine the types of extraordinary security precautions that this type of event required.

Mexican Border Rail Issues

There was an interesting article on NewsPaperTree.com, an El Paso, Tx news site, about a wide variety of chemical safety issues that are related to the legal traffic in hazardous chemicals across the border in that area of the country. The article lists hydrofluoric acid, sulfuric acid and a variety of hazardous waste that crosses from Mexico to the United States in railcars through downtown Juarez and El Paso. The article quotes a 2007 report from the Good Neighbor Environmental Board (GNEB) that concludes that it is probably not possible to conduct “a thorough physical inspection of each truck, rail car and container entering the United States”. Railroad Transportation Security Rule This is especially troubling when one considers that the soon to be implemented (April 1st, 2009) chain of custody requirements for covered hazmat rail shipments (specifically including hydrofluoric acid) will not cover these railcars until they are well into the United States. The TSA, in the preamble to the rule (page 72162) states that: “The chain of custody requirements do not apply at any shipper facilities located outside the United States. Rather, for international shipments to the United States, the requirements begin at the first railroad carrier interchange point and apply to all subsequent carrier interchanges that are otherwise subject to this final rule.” This means that railcars containing poisonous by inhalation chemicals originating in the most lawless sections of Mexico, areas under control of various drug lords and other violent criminals, will transit cities like El Paso without any provisions for inspections of these cars for tampering, presence of IEDs or other threats to the integrity of their structure. Rerouting There are many that will point to this as an additional reason for requiring re-routing hazmat rail shipments around major urban areas. The article does note that last September a joint Mexican-New Mexico plan was announced to “to re-route trains from downtown Ciudad Juarez to the up-and-coming border development of Santa Teresa, New Mexico, by 2012”. The article goes on to question how much money either the Mexican Government or the government of New Mexico can afford to contribute to the public-private partnership project that could cost ‘hundreds of millions of dollars’.

Using Video for Detecting Perimeter Violations

I have mentioned John Honovich’s web site about video surveillance on a couple of occasions. One of the interesting things about John’s site is that he has a wide variety of industry experts contributing to the site. Yesterday, after receiving my weekly update email from John I went to a recommended discussion by Nick Grange of C3 Shared Services about setting up video analytics for perimeter intrusion detection. False Positives One of the problems with and intrusion detection system is the issue of false positive alerts. You certainly want a system sensitive enough to detect anyone crossing the detection perimeter. Setting the system to be too sensitive, however, results in alarms when there is no penetration, a false positive. Every time there is an alarm there has to be some sort of response. Depending on the distance between the perimeter and the actual security zone this could be a full tactical security team response, sending a roving patrol/guard to check out the situation, or reviewing the video record of the area. Nick noted that his firm tested a variety of video analytic systems at a site and found a wide range of false positives, from a low of 175 to as many 16,000 in the week long tests. Depending on what your alarm response is, 175, or about one per hour, may seem like a lot, but 16,000 is way to many for any security program. I would suspect that the equipment supplier never warned their customers about the potential for high false-positive rates on the 16,000 false-positive system. System Optimization The other good thing about Nick’s short article is the discussion about system optimization. I particularly like his explanation of how his firm selects the distance between cameras in a perimeter surveillance system. The one point that he does not emphasize is that those distances are for optimum situations, flat and clear terrain. If there are ditches or other obstacles those distances may be greatly reduced. Even so the 60m per camera and 3 to 4 hours per camera fine tuning and system adjustments gives you an idea of how long it should take a contractor to set up a system for your facility. Too much longer or shorter in the contract bid ought to be questioned. Nick’s comment about monthly maintenance of the system should also be considered when bidding out such a system. Intrusion Detection Systems There are a wide number of different types of systems that can be used for perimeter intrusion detection. Each of these systems has its strong points and weak points. John’s site concentrates on video systems, so it should not be used as the only source of information about choosing such a system. Unfortunately, I have yet to find a comparable single-point information source for other intrusion detection systems. One point in favor of a video surveillance system is that it provides a video record of the alarm situation. This frequently allows for a rapid determination of most false positives. This reduces the need for sending someone to the site of the alarm for investigation purposes. This is one of the reasons that video systems, without the analytics software, are used as a backstop for other IDS systems. Recommendation This short article by Nick Grange is certainly worth the time to read it. It will not make anyone a video analytics integrator by any means. It will, however, provide some additional information that will allow a facility security officer to be a more intelligent consumer of security services. While you’re there on the site, you might as well browse through the other offerings on John’s web site.

Tuesday, December 23, 2008

Reader Comments 12-23-08

Fred Millar has a series of questions in response to a blog that was written on December 13th, (see: “High-Risk Chemical Facility Identified in Local Press”). In that blog I noted that an article in an Orlando, FL newspaper pointed out that Sea World was completing an SVA under the CFATS regulations. I also noted who ever released that information at Sea World had violated the CVI provisions of those regulations. Fred asks:
“What public info is already available on this facility --e.g., the Risk Management Plan? “Never a word on the public's right to know? “What alternative chemicals are available/already used by other safer facilities? “Is a major Disney or Sea World facility (the crowd) a terrorist target (e.g., from nearby rail lines carrying poison gas cargoes) as a major tourism venue?”
The information that Fred requests is not available from the news article, but with a little bit of assumption and knowledge of the CFATS process, I can make a stab at answering what may be rhetorical questions. No Risk Management Plan I doubt that there is much information available to the public on the chemicals involved. With the late date in the SVA process the facility was probably preliminarily tiered as a Tier 4 facility. Because of the high public risk attendant at Sea World, it was probably not a release chemical hazard that put it on the high-risk chemical facility list. In al likelihood it was a theft/diversion chemical of interest that placed the facility on the list. That being said there would probably be no risk management plan required under EPA rules. Inherently Safer Technology Without knowing what the chemical is it is hard to answer the IST question. I would bet that both Fred and I came to the same guess/conclusion about the chemical used when we saw which facility was doing an SVA and what similar facilities were not. My bet is chlorine in small tanks for water treatment. There would already be alternative water treatment facilities being used for the animal tanks because fresh water animals do not do well in chlorine and chlorine is probably not so effective in salt water systems. No the chlorine would be used in water attractions where there was high people contact with the water. High residual chlorine levels are the best way of protecting the public from transmission of bacterial disease in such systems. Using bleach would probably be as effective (it leaves chlorine residuals), but it has some handling problems. I suspect that if the facility were to remain on the high-risk list after the SVA is reviewed by DHS, those minor handling problems would become less important than the security costs involved in protecting the facility from the theft/diversion of those chlorine tanks. Oh yes, neither the EPA nor DHS consider the risk of release from those small (<2,000 lbs) tanks to be much of a public risk. Their rules do not consider the high day-time population in the immediate vicinity of those tanks. I bet that Fred and I both have the same level of opinion about the size of that loophole. Other Sources of Chemical Attack All of the big tourist facilities in the Orlando area are certainly potential terrorist attack targets. The use of rail car quantities of TIH chemicals as a method of attack against these facilities is not likely; the nearest rail line is six to eight miles away. At that range a more likely target was indentified in the CAP report, Chemical Security 101. One of the 202 ‘almost as dangerous’ chemical facilities (Brentag Mid-South) is located on the rail line at the closest point of approach to Sea World. An attack on that facility with an easterly wind would provide a decent scare at Sea World, but likely no mass casualties. A more likely target would be a truck carrying TIH chemicals on I4 or FL 528, but even those would probably be iffy, chemicals are such notoriously hard weapons to aim. Much more effective would be an armed assault on the facility. The Public Right to Know The problem of RTK is a problem that security planners are really loath to discuss. The security wonks would rather that no one knew about the locations of high-risk chemical facilities; it makes it harder for foreign terrorists to identify those locations, don’t you know. On the other hand, people have a right to know what risks are associated with where they live or work. To me, the most telling point in this discussion is the fact that most security wonks conveniently forget, a good security plan also covers the ultimate what if; what if the attack succeeds. Some sort of plan must be included to deal with mitigating the effects of the successful attack and those plans require the informed cooperation of the affected parties. That informed cooperation must be informed in advance, not when the gas cloud approaches their house, their school, their place of work. The whole point of that particular blog posting was to get this discussion started. There needs to be an informed discussion about the balance between security and the public’s right to know. No, I do not believe that they public needs to know much in the way of details about the security plan, but they certainly need to be involved in the emergency response portion of that plan. And they need to be confident that some one is taking a hard, outside look at the provisions of the security plan to make-sure that the facility is not pinching pennies. The million dollar question is how do we make both security and the public’s right to know both work?

Ammonium Nitrate Rule Legislative Background

In my blog yesterday (see: “Comments on Ammonium Nitrate ANPRM – 12-19-08”) I noted that the Institute of Makers of Explosives (IME) commented in their submission that there was no legislative history for the § 563 authorization for this rule; that that section had been added to the Consolidated Budget Bill outside of the normal legislative process. I agreed with that assessment and pointed to some of the problems that that had caused for DHS in their rule development process. After writing and posting that blog, I did a little bit of digging on Thomas.LOC.gov, the Library of Congress web site dedicated to maintaining a history of the progress of legislation. In that digging I found that there was more of a legislative history to § 563 than I gave credit for in yesterday’s blog. Secure Handling of Ammonium Nitrate Act of 2007 Section 563 started out as HR 1680, the Secure Handling of Ammonium Nitrate Act of 2007. It was introduced by Chairman Thompson of the House Homeland Security Committee on March 26th, 2007. It was assigned to the Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology. No hearings were held on this bill, relying on a single subcommittee hearing held in the 109th Congress on HR 3197, a similar bill, in December 2005. The Homeland Security subcommittee considered HR 1680 in a meeting on March 28th, 2007. It was reported favorably to the full committee without amendment after that meeting. The full committee considered the bill in meetings on April 17th and 26th, amending the bill and ordered it reported to the House, as amended, by a voice vote. House Report 110-357 House Report 110-357 was produced on October 2nd, 2007. The report points to a number of terrorist attacks and thwarted attacks where ammonium nitrate was used to make the bomb used in the attack. It then notes (page 7):
“This legislation is needed to create a nationwide, minimum standard for regulating the sale of ammonium nitrate based fertilizers nationwide that could be used in terrorist acts, without unduly burdening the agricultural sector’s access to ammonium nitrate fertilizer for farming and other legitimate agricultural purposes.”
The House Report incorporates the Congressional Budget Office estimates of costs and revenues for the implementation of this proposed legislation. The CBO estimates the cost of implementing this bill by DHS to be $45M through 2012. Principally this would be the cost of hiring 60 inspectors and 20 administrative personnel. The CBO estimated that the costs to owners of ammonium nitrate facilities and users to “be small relative to the annual threshold” (page 12) of $131M set by the Unfunded Mandates Reform Act. The report provides a lengthy discussion of the intent of the Homeland Security Committee in the ‘Section-by-Section Analysis of the Legislation’ section (pages 13 – 18). While that discussion does address the IME’s concern about requiring DHS registration of ATF registered users of the explosive form of AN (page 14), it does not address their concerns about the corporate ownership issue. The discussion does address the ‘point of sale’ versus ‘point of distribution’ issue. On page 15 the report states:
“Moreover, the Committee emphasizes that not only must an owner verify the identity of a purchaser in a manner determined appropriate by the Secretary, but that such identity verification shall include confirmation of the agency relationship where an agent takes possession of ammonium nitrate for the buyer.”
This would make it very difficult not to make transportation personnel agents in the transaction. It appears that they would either have to be agents of the buyer by taking ‘possession of ammonium nitrate’, or they need to act as agents of the seller by verifying the registration status of the receiver upon delivery. In either case this causes the complications indicated in the IME submission. Action in the House HR 1680 was brought to the floor of the House on October 23, 2007. It was discussed for less than 40 minutes; discussed, not debated (Congressional Record H11864-6). Four speakers rose to address the issues associated with this bill. All four speakers were from the Homeland Security Committee and all four, two Democrats and two Republicans, enthusiastically supported the bill. After the conclusion of the ‘debate’ the bill passed in the House on a voice vote. The next day the bill was received in the Senate and referred to the Committee on Homeland Security and Governmental Affairs. There is no record of any additional action taking place on this legislation until identical provisions showed up in the Omnibus Budget Bill in late December 2007 (see: “DHS and the Omnibus Spending Bill”). Adding homeland security legislation that passed in the House to spending bills is a tactic that Chairman Thompson has both advocated (see: “House Passes HR 4806 and HR 6193”) and used to good effect. It makes tracking the legislative history of a bill a tad bit more difficult. We can expect to see the same thing in the future.

Monday, December 22, 2008

Comments on Ammonium Nitrate ANPRM – 12-19-08

The comments continue to accelerate at an ‘exponential rate’ (well they did double each of the last two weeks). This last week we have had four commentors make submissions about the ammonium nitrate advanced notice of proposed rule making; twice as many as last week. Those comments were received from: Institute of Makers of Explosives Cardinal Health Hinton Mills International Explosives Detection Dog Association 

Small Users Exception 

The valuable thing about the public comment process for proposed rules is that it provides a mechanism for identifying unintended consequences before they cause too many problems. This week comments posted by Cardinal Health and the IEDDA point out at least two classes of small volume users of ammonium nitrate that a reasonable person would never require undergo the user registration process being developed at the behest of Congress. 

Cardinal Health is a manufacturer, of among other things, therapeutic cold packs used to treat pain and swelling associated with ‘sprains, strains and broken bones’. They note that their sealed cold packs contain small amounts of ammonium nitrate and water that produce an endothermic reaction when mixed. Each cold pack contains less that 5 ounces of high-density ammonium nitrate with less than 0.2% combustible substances. It would seem reasonable that the ammonium nitrate leaving the Cardinal Health manufacturing facility would not be covered by the registration requirements of this rule. 

The other small volume user was identified by the submission of the IEDDA. Dog trainers that train explosive detection dogs use extremely small amounts of explosive grade ammonium nitrate to train their dogs to detect the material. They propose that they be allowed to buy their ammonium nitrate under their current ATF permits that they use to purchase small quantities of Division 1.1D explosives. 

Institute of Makers of Explosives Comments 

The IME has submitted a two part response to the ANPRM. Their responses to the questions posed in the NPRM were not posted to the Regulations.gov web site when I downloaded submissions on Friday afternoon. I will review those responses in a subsequent blog. They submitted a separate document (reviewed here) to address some areas that they would like to see clarified about the interpretation of the authorizing legislation and four areas that they would like to see addressed in the regulations. 

Normally, such wholesale clarifications would not be necessary because there would be a legislative history to refer to divine the Congressional intent of the legislation. The authorizing legislation for this rule, however, was an add on to a last minute ‘comprehensive budget bill’ and it avoided the normal legislative process. So there is no Congressional testimony or record that would allow someone to determine the Congressional intent. 

There are four general areas of concern that IME addressed in their discussion, exemption for explosive purposes, reporting ammonium nitrate losses, transportation workers as agents and international harmonization. IME believes that the registration of those with an ATF permit for the manufacture, sale or use of an explosive form of ammonium nitrate should not be required to undergo the DHS registration procedures. They suggest that the ATF registration procedures are more thorough than those envisioned for the DHS registration program. 

IME believes that DHS must take extreme care when defining the ‘unexplained losses’ of AN that would have to be reported to DHS. They note that a large portion of AN transfers are bulk transfers. There are weighment issues other transfer issues that result in routine losses of AN in bulk transportation. 

IME does not want DHS to include transportation workers in the definition of ‘agents’ that must be registered under these regulations. They note that the ammonium nitrate industry has already had to deal with a near paralysis of AN deliveries when ATF tried to separately regulate transportation workers in 2003. IME suggests that current TSA security regulations should suffice for controlling AN in transit. IME would like to see the AN security regulations harmonized with the Canadian rules to ease the trade in this commodity between the two countries, even though they note that the Canadian program is ‘broader than that authorized’ for this rule. 

One of the things that IME would like to see ‘clarified’ is the definition of persons that would be required to be registered under the new regulations. They note that a standard legal definition (1 U.S.C. 1) of persons include “corporations, companies, associations, firms, partnerships, societies, and joint stock companies, as well as individuals”. This definition would provide some difficulties for the regulation because DHS is required to do a terrorist database search for all registrants. 

Furthermore, since most transfers would be between corporate entities not individuals, most transactions would be between ‘agents’ rather than ‘persons’. The statute requires disclosure of agent information at the point of sale, not the point of distribution. Since most corporate sales are not made face to face, an identification card to verify registration would not be very useful. 

Hinton Mills Comments 

Hinton Mills is a ‘small farm supply retail store’ that has sold ammonium nitrate for about 50 years. They typically sell 500 tons/year. They state that the “potential for monetary penalty for careless record keeping under the proposed regulations will cause us to no longer sell Ammonium nitrate”. 

My Comments on Comments 

 The problems identified by these four submissions would normally have been expected to have been identified in the legislative process through hearings and staff research. The fact that the requirements for this legislation did not go through such a process makes it much more difficult for an agency like DHS to develop comprehensive regulations that do not have huge unintended consequences. 

It seems self-evident that, in the current environment, the government should control the sale and transfer of an explosive precursor that is so widely available. The devil is, of course, in the details. If the program is too restrictive, many will stop handling AN. In the agricultural field this will mean a change to more expensive fertilizers, the cost of which must be passed on to the food consumer. 

Exceptions need to be crafted for the small scale users of AN like Cardinal Health that do not jeopardize societal security. Procedures need to be developed to handle registration that are effective but do not put an unnecessary burden on small users. Definitions need to be developed that are inclusive yet workable. In short, DHS has its work cut out for it. 

Unfortunately, DHS has not received any where near enough comments from users, distributors, sellers or transporters of ammonium nitrate. Only 13 commentors have provided their input so far. With the December 29th deadline for comment submission quickly approaching DHS needs a lot of responses in a hurry. Unfortunately, with the time of the year it is not likely to receive many before the end of the comment period.

More Details on TSA Rule Extension

Last Friday I provided a brief note in this blog (see: “Extension for a Section of Rail Security Rule ”) that TSA had extended the effective date on a portion of the Railroad Transportation Security Rule while leaving the December 26th effective date in effect for the remainder of the rule. The effective date for 49 CFR § 1580.107 has been extended to April 1st, 2009. Here is a little more detail on what that extension means. Section 1580.107 The only section of the rule (§ 1580.107) that is affected by this extension is section dealing with the chain of custody and control of covered rail cars (See: “Rail Transportation Security – Rail Car Chain of Custody”). This is the section of the rule that outlines how the exchange of covered rail cars between shippers and carriers, between carriers, and between carriers and receivers who are located in HTUAs will be executed and documented. This section also establishes the general requirements for hazmat shippers to keep a rail car in a ‘rail secure area’ {§ 1580.107(i)} from the time the security inspection is completed until the railroad takes custody of the rail car{§ 1580.107(a)(2)}. The same general requirement for a ‘rail secure area’ is provided in this section covering hazmat receivers that are located in an HTUA to keep a covered railcar in such an area from the time it is received from a rail carrier until the time unloading is complete {§ 1580.107(f)(2)}. This section does include the requirement for hazmat shippers to conduct a security inspection for signs of tampering, other signs of compromised security, or the presence of suspicious items (to include IEDS) before loading a rail car{§ 1580.107(a)(1)}. This requirement may not be substantially affected by this extension because a similar requirement already exists for all hazmat rail cars, not just the rail cars covered under this rule (§ 174.9). Reason for Extension According to the notice in the Federal Register
“On December 11, 2008, the Association of American Railroads and its member freight railroads requested that TSA delay the effective date of this provision. They presented information indicating that the initial 30-day period for compliance did not afford sufficient time for railroad carriers to implement procedures and train their workforce to meet the new regulatory requirement.”
TSA acknowledged that there might be difficulties in developing and implementing procedures to comply with this section of the rule. It is interesting that no hazmat shipper or receiver petitioned for delays of implementing this section because of the inherent difficulties in implementing the ‘rail secure area’ provisions of this section. I would bet that this is because most of these facilities are going to suggest that their entire facility is a ‘secure area’ so they do not need special provisions for a ‘rail secure area’. It will be interesting to see how TSA deals with such a claim. Areas Not Covered by the Extension The ARA did not request, nor did TSA approve an extension of the effective date of the remainder of the rule. This means that the following provisions still go into effect the day after Christmas:
Inspection Authority (see: “Rail Transportation Security – Inspection Authority”) Rail Security Coordinator (see: “Rail Transportation Security – RSC Requirement”) Location Reporting for Covered Rail Cars (see: “Rail Transportation Security – Reporting Railcar Locations”) Reporting Significant Security Concerns (see: “Rail Transportation Security – Reporting Security Concerns”)
All of these provisions are going to require development of internal procedures and training of personnel. There have been no indications on where the TSA enforcement effort will focus first. If I were in charge of the TSA inspection effort, I would start hot and heavy on January 5th showing up at the front gates of hazmat facilities, both shippers and receivers, checking for procedures allowing TSA inspectors to enter the facility. They would also check for RSC information, rail car location point of contact and procedures. They would also review facility procedures for reporting significant security concerns.

Friday, December 19, 2008

Military Support for Chemical Facility Incidents

The web site GovExec.com has an interesting article about the potential use of the new ‘combat’ brigade that has been assigned to Northern Command (NorthCom) for ‘action’ in the United States. Those two words in quotes are included because of the discussions in the fringe blogosphere about how these units would be used to put down American citizens. Since these 20,000 (ultimately, only 4,700 have currently been assigned) have always been stationed in the United States, I never did understand the concerns. Not to mention the fact that 160,000 US troops had some severe problems keeping Iraq in control, a much smaller country than the United States. A mere 20,000 soldiers would have a hard time ‘controlling’ a good size US city. But I digress.

The article notes that the brigade being formed at Ft. Stewart, GA would be the first of three brigades that would be used to respond to, among other things, WMD attacks in the United States. That would include, presumably, attacks on high-risk chemical facilities. The idea being that these units would have the transportation (including air lift), personnel and equipment to provide the evacuation and medical treatment that will be necessary for a mass casualty type situation involving a chemical, biological or radiological event.

Government – Military Coordination 

With the fairly radical change in mission for these soldiers there will come a lot of planning and training. Most of this the military will be well prepared for. They have lots of experience in starting up new units or changing unit roles. The one major difference here will be the coordination of that planning and training with a whole new host of civilian agencies, principally FEMA, but other agencies in DHS as well.

The other thing that will be interesting for these units is that they will also have to work hand and glove with state and local government agencies. These will include State Homeland Defense agencies, but also law enforcement, fire departments, and emergency medical services. To make this type of coordination effectively, the Army is going to beef up the Civil Affairs staff (S-5, if I remember right) in these units down to the battalion levels.

Military Planning 

One thing that the military is very good at is contingency planning. A commander that is given a contingency mission provides his staff with a brief outline of his concept of how to deal with the mission. The staff then starts the planning process for that contingency, identifying tasks to be accomplished and allocating the men and materials necessary for accomplishing those tasks. Then subordinate units repeat the same process with their assigned piece of the contingency.

Not only does this provide the unit with a plan for the initial stages of the contingency should it arise, but it also gives the staff invaluable practice in the planning process. As plans are developed they are refined by conducting a variety of exercises, typically starting with a variety of staff war games. Eventually, if the contingency is high enough priority it will include exercises with troops. The exercises allow many of the bugs to be worked out of plans, but more importantly they allow the people involved the chance to think about their part in the plan in a way that simply reading the plan would never accomplish.

Potential Contingency Operations

I would like to suggest that a good way to select some contingency operations for these units would be to identify the Tier 1 high-risk chemical facilities in the unit’s area of operations and have these units begin planning for a response to a successful terrorist attack on those facilities. This would provide real-world missions and require the coordination with a wide variety of civilian agencies at a number of levels of government.

There would not be any necessity of interfacing with the management of the facilities. The mission statement would start with the assumption that a worst case terrorist attack was successful. This would avoid any of the potential problems of sharing Chemical-Terrorism Vulnerability Information (though the military would be well prepared for handling that type information due to their routine handling of classified material). While the fact that these facilities are Tier 1 is technically CVI, the identity of these plants should be well known to local authorities due to EPA reporting requirements. 

The general mission statement would include the definition of the situation; the location of the facility, identification of the worst-case chemical and an estimate of the amount of the chemical released. It could include requirements to:
Establish the limits of the contaminated zone, Isolate the contaminated zone to prevent looting and further casualties, Decontaminate all personnel leaving the zone, Search the contaminated zone to find and evacuate survivors, Provide triage and stabilization medical care for personnel leaving the contaminated zone and moving casualties to appropriate medical treatment, Begin decontamination of critical infrastructure within the contaminated zone, and Turn over the contaminated zone to civilian control.
The Advantages for the Military

 As with any contingency planning exercise the military will gain experience in planning for this new type operation. They will learn to identify a new type of ‘key terrain’, those critical points of the infrastructure that are important to the functioning of civil society. They will gain experience in identifying and opening lines of communication with local political leadership. They will learn how to interface their electronic communications with those of local law enforcement and emergency response personnel. Finally they will gain a better perspective on the equipment and training requirements for this new mission.

The Advantages for the Public 

The establishment of these new units may provide cities with the highest risk chemical facilities some hope for an appropriate response for a terrorist attack on those facilities. While appropriate security planning and execution is the key to prevention of such an attack, everyone should realize that there is no such thing as complete security. No city is large enough to handle the emergency response mission for such a large scale catastrophe on their own. The identification of a sizeable Federal response force, with the necessary manpower, equipment and training is a huge first step in reducing the potential size of that catastrophe.

But, it will only be effective if the appropriate planning is begun before the incident begins.

Extension for a Section of Rail Security Rule

TSA published in today’s Federal Register an extension of the effective date for 49 CFR 1580.107 from December 26th, 2008 until April 1st, 2009. The announcement said that this was done to allow “affected freight railroad carriers, rail hazardous materials shippers, and rail hazardous materials receivers additional time to conduct training and implement procedures to come into compliance with the chain of custody and control requirements of the rule”. The effective date for the remainder of the rule remains as December 26th, 2008. More details will follow in a later blog.

Thursday, December 18, 2008

Comments on Ammonium Nitrate ANPRM – 12-12-08

The comments are starting to come in at an accelerating rate. This last week we have had two commentors make submissions about the ammonium nitrate advanced notice of proposed rule making; twice as many as last week. The two comments were received from Michael B. Ag/Gro Fertilizer Inc Michael B. Comments Michael B. suggests that DHS include a small volume exception to these rules when they are written. He would also like to see licensed users under 27 CFR part 555 exempted from the registration requirements. Interestingly Michael B. actually read the ANPRM and attempted to provide answers to each of the questions that DHS posed to the regulated community. He suggests that DHS use both computer and manual processes for completing registration applications and suggests patterning the process on the similar process that ATF uses. His most interesting comment comes on the question of the potential usefulness of this process and it is worth quoting in its entirety. He writes: “It will make a lot of legislators feel better but unfortunately I don't think it will stop a determined terrorist from obtaining a large quantity of AN.” Ag/Gro Fertilizer Inc Comments For some reason DHS has assigned a different document number to each page of the Ag/Gro submission, page 1, page 2, and page 3. Ag/Gro has also submitted answers to each of the questions that DHS asked in the ANPRM. They suggest electronic submissions through the local agricultural extension office; noting that less than half of their customers have routine access to a computer. They suggest that the user certificates be a ‘tamper-proof card’ with a bar code and that each distributor receive a reader from DHS. Ag/Gro does not believe that an inspection program will be required for long, because the potential fines will drive most distributors out of the AN business. They suggest that the various State departments of Agriculture be given the responsibility for conducting the inspections. On the questions of fees, they note that Congress prohibited charging the farmers a fee and comment that placing a fee on distributors or manufacturers will cause most to exit the business. Ag/Gro estimates that there could be upwards of 50,000 AN fertilizer users that would have to register and be certified. This will be a time consuming process. They also note that DHS needs to give plenty of advance notice when the implement this rule to allow distributors to sell off their inventory before this rule take effect, otherwise they will likely be stuck with unsellable product. My Comments on Comments I am really concerned with the predictions of Ag/Gro about the effect of these proposed regulations on the future of anhydrous ammonia as a fertilizer. If their expectations are correct, this will have an effect entirely unexpected to the members of Congress that pushed the requirement for this rule through the legislative process. It might be an interesting graduate student project at a couple of land-grant colleges to interview farmers and distributors of ammonium nitrate to see if Ag/Gro’s opinion is any where near correct. I think that Ag/Gro’s comments about a bar code reader for verification are probably unnecessary. A photo ID card should suffice, especially since most of the buyers will be well known to the sellers.

Update on IED Training DVD

I reported yesterday (see: “Training for Recognition of IED’s for Railcar Inspections”) about the training DVD that TSA has developed for IED recognition training and that I would try to get a copy of the DVD to review. Well, I did receive a prompt email response from TSA to my request. They said:
“We have received your request for freight rail training materials. However, the materials are only meant for those entities which are regulated under 49 CFR 174.704 or 49 CFR 1580.”
I doubt that they are trying to hide anything. The rules probably say that they are for railroads and hazmat shippers, so that is the only people that TSA will send them to. And I am certainly not a railroad or a hazmat shipper, a point I made clear in my email to TSA. Oh well, I’ll try to get the video through some alternative sources. The good news is that I did a get a one day turnaround on my request. That bodes well for facilities trying to get the video.

PHMSA HAZMAT Security Rule Comments – 12-15-08

While the comment period has been closed for a month on this rule, a number of new comments were posted to the Regulations.gov web site this week. Of the seven comments received this week only two were from the special effects community, an industry association and a manufacturer. The commenters were: American Pyrotechnics Association Comments International Society of Explosives Engineers Department of Defense Explosives Safety Board Dangerous Goods Advisory Council Association of American Railroads National Propane Gas Association RES Specialty Pyrotechnics, Inc American Pyrotechnics Association Comments The APA considers pyrotechnics and fireworks to be low explosives and is of the opinion that they should not be considered ‘security sensitive hazardous materials’. They support the efforts of the special effects community in opposing the any quantity limit on Division 1.4, 4.1, and desensitized explosives. International Society of Explosives Engineers Comments The ISEE joins the Institute of Manufacturers of Explosives (IME) in opposing the change of the amounts of some explosive materials requiring security plans from a ‘placarded amount’ to ‘any amount’. They believe that the added security will have little effect since the small amounts would be of little use ‘for criminal purposes’ and would endanger the jobs of many people. Department of Defense Explosives Safety Board Comments The DOD ESB recommends that military explosives, Division 1.6, have an ‘any quantity’ limit for requiring a shipment security plan. Dangerous Goods Advisory Council Comments The DGAC recommends that the quantity of Division 1.4 explosives requiring a security plan not be reduced from the current ‘placarded amount’ to ‘any amount’. DGAC opposes the listing of all Division 2.2 with an oxidizing subrisk. They understand and accept the listing of oxygen but not compressed or liquefied air. DGAC opposes the listing of Division 4.2 and Class 3 desensitized explosives, Division 4.2 PG II, Division 4.3 PG II, Division 5.1 PG II, Organic Peroxide Type B, Division 6.1 PG I (except TIH), Division 6.2. DGAC opposes requiring security plans for small quantities of TIH liquids and gasses. DGAC believes that assessing the risks of specific routes is impracticable. DGAC questions the needs for all security assessments to be written and believes where they are written they should be in a separate document from the security plan. Association of American Railroads Comments The AAR requests clarification of the term ‘site-specific or location-specific security risks’. AAR would like to think that, at least for railroads, it would be the same as the ‘designated critical and high-risk assets and locations that present special or unique public security considerations’ that are currently included in the railroad security plans. The AAR requests that PHMSA includes provisions requiring shippers to notify carriers when a radionuclide threshold is met or exceeded. The AAR questions why anhydrous ammonia shipments are not included in the requirements of this rule. The AAR questions why employees that merely handle hazardous materials or their paperwork would require ‘in-depth training’. The AAR requests clarification of the requirement to re-do in-depth training when changes are made to the security plan, asking if it includes purely administrative changes that do not affect employee responsibilities. National Propane Gas Association Comments The NPGA does not believe that propane should be considered useable for making a weapon of mass destruction. They base that belief on studies done by DHS that point out the difficulties that someone would have in obtaining the proper mixed ratio of air and propane to make a fuel-air explosive. NPGA disagrees with the requirement for conducting a route specific risk assessment, noting that propane delivery drivers typically drive a different route every day, making such a risk assessment impractical. RES Specialty Pyrotechnics, Inc Comments RES Specialty Pyrotechnics is a manufacturer of the specialty pyrotechnic devices used by the special effects community. As with all of the other commentors from that community they object to the drastic lowering of the amount of Division 1.4 explosives that would require a shipment security plan. They note that the carriers that they use would refuse shipments rather than expend the time and money to meet the requirements of this rule. In effect, this rule would put this company out of business. My Comments on Comments Well, we have now heard from representatives from all parts of the special effects community, manufacturers, users, and an industry association. They all agree that shipments of Division 1.4 explosives shipped in quantities of less than 1,000 lbs (not requiring a placard on the shipping vehicle) should not require the preparation of a shipment security plan. They all agree that an ‘any amount’ limit would put almost the entire industry out-of-business. Hmmm, maybe PHMSA ought to take a second look at this. The comment from the DOD Explosives Safety Board is unusual for a couple of reasons. First it comes directly from the military board without all of the usual endorsements from higher headquarters. More importantly, it is not often that you hear a comment requesting stiffer requirements from some one other than a group of political activists. That this request for an increase in requirements comes from a technical organization with expertise in the particular subject matter under discussion should favorably catch the attention of the PHMSA. Long time readers of this blog will realize that I have had little use for the propane industry’s efforts to avoid security rules. Their discussion of the WMD effects of propane looks like another one of those situations, at least at first glance. I will have to agree with them that forming an optimum fuel-air explosive mixture in most building would be technically challenging. There are a number of high value targets where this would not be as much of a problem. What would make an optimum target would be a large building with large volumes of open areas; shopping malls, sports stadiums and the like come to mind. I can think of a couple of other uses that the military looked at in the 70s that would be equally effective. I could also design some smaller devices, but then again, I have always had a devious mind. Fuel-air explosives can be challenging, but the wide area of the overpressure effects will always make it a valuable tool for the more dedicated terrorist. Amateurs will likely just cause fires and an occasional impressive explosion, but the professional could make this into a very valuable weapon.

Wednesday, December 17, 2008

Reader Comments 12-16-08

In a comment posted yesterday, ThomKay took exception to the use of the term ‘eco-terrorist’ in my blog about the power plant incursion (see: “Major Security Breach”). When I was writing that piece I thought that there might be some objection to that comment, but I was in a hurry to get back to another project I was working on, so I did not explain the use of the term. First off, to date there has been a significant difference between the operations of ‘eco-terrorists’ and terrorists such as al-Qaeda (to site an extreme example). Eco-terrorists have generally been pretty careful to restrict their actions to property and not people. The few times that people have been hurt seem almost accidental or negligent rather than acts of malice or intent. While I vehemently disagree with their attacks on property, I do agree that I would much rather see them attack property than people. That is why I am careful to use the term ‘eco-terrorist’ rather than the more general term ‘terrorist’. A Continuum of Political Activity Now, looking at ThomKay’s specific complaint, he writes “Activists are not terrorists. Loosely using this term is unfair to non-violent activists who participate in civil disobedience in order to effect change.” He is correct; an activist is not necessarily an eco-terrorist and is certainly different from a terrorist. Unfortunately these are all part of the continuum of political activity and the lines between them are not easily defined. And reasonable people will disagree where those lines are drawn. Protestors that picket power plants are certainly not ‘eco-terrorists’. Protestors that lie down in the roads to those power plants to stop workers or supplies from entering the plants are activists practicing civil disobedience. They will be arrested for various misdemeanors and I have a certain amount of admiration for their convictions and perseverance. Protestors that slash tires of workers or delivery people to stop them from entering a those power plants have, in my opinion, stepped over the line to ‘eco-terrorist’ activities. Drawing the Line on the Turbine Incident The first thing that comes to mind when examining the shut down of the turbine at Kingsnorth is that there is nothing in the reports that indicates that there was any property damage involved. This would tend to move the line towards activism. Unfortunately, the unscheduled shut down of a high-speed turbine is a complex operation. The slightest error in that operation will result in locally catastrophic consequences. The slightest mistake could have resulted in the effective destruction of that turbine with the potential for damage to surrounding equipment and personnel. Even if the perpetrator of this shutdown was an experienced power plant operator (and that seems very likely to me) the stress of situation would greatly increase the possibility of making errors in the shut down operation. Furthermore, the sudden removal of 500 MW from the electrical grid certainly has the potential for knocking out significant portions of the grid. That loss of power has the potential for a number of potentially serious consequences. Because of the high potential for on-site damage and off-site consequences, I believe that this incident stepped over the line to eco-terrorism. If he had simply entered the facility and tagged the equipment or room with appropriate green slogans, and exited with photographic evidence of his exploits I would certainly have called him an activist while I castigated the facility for its inexcusably inept security. But no, the potential for property damage moved it too far out the line of political action for my taste. No Such Thing as Absolute Security ThomKay does make one final point in his comment posted to yesterday’s blog that is very important. He writes that this “further demonstrates that guards, gates, and gadgets do not result in enough security to prevent real terrorists from releasing chemicals into communities”. While there was a seriously poorly executed security program at place in this instance, Tom’s general point is absolutely correct. There is no security plan that will provide absolute protection against a determined attacker. Any security planner that fails to take that into account needs to look for another job. Security plans cannot stop at fences, guards and gadgets. It has to include an active counter-surveillance operation and personal surety plans because a well planned attack requires extensive knowledge of the facility. Mitigation plans have to be made to deal with the potential successful attack. Plans have to be made to deal with off-site consequences. And yes, facilities must take a serious look at Tom’s unstated, but not forgotten desire, alternative chemicals and processes that would make a successful attack much less dangerous.

Training for Recognition of IED’s for Railcar Inspections

On December 26th the new Rail Transportation Security Rule will take effect. One of the requirements of that rule is that all covered hazmat shippers are required to inspect railcars for signs of tampering or the presence of improvised explosive devices {§ 1580.107(a)(1)}. Obviously the covered hazmat shippers will be required to train their personnel to complete this requirement. In an earlier blog (see: “Rail Transportation Security – Rail Car Chain of Custody”) I noted that “According to the preamble to this final rule (page 84) TSA is in the process of completing a DVD that may be used to train people in ‘identifying IEDs and signs of rail car tampering’.” Well, yesterday I did a search of the TSA site, and sure enough they do have such a training DVD available. All you have to do is copy the request form (TSA Form 1913) from the TSA site and mail it off to the address on the form or send it by email to freightrailsecurity@dhs.gov. According to the form there is also a Freight Rail Security Awareness Brochure that can be requested at the same time. I have not had a chance to review either yet. As you might expect, as soon as I get a chance to review these training tools, I’ll certainly report on them in a future blog.

Revised Submission Date for ASP for Tier 4 Facilities

Breaking News! DHS posted on their web site today that they are extending the submission deadline for submission of Alternate Security Plans for Tier 4 facilities. The new deadline is now December 31st. This was not posted in today’s Federal Register and there is no indication on the web page that it will be posted. SPREAD THE WORD. There is no explanation on that site for the reason for the change, but I suspect that it has something to do with the problems some facilities have been having with their submissions of ASP’s (see: “More on the SOCMA SVA Problems”).

Tuesday, December 16, 2008

Major Security Breach

If the security gods were ‘shuddering in dismay’ Saturday they are absolutely outraged today. Nancy Bartels in her blog at ControlGlobal.com points us at a story out of Great Britain where an eco-terrorist climbed over the security perimeter at a major British power plant, walked through an unlocked door, shut down a 500 MW power generation turbine, and then walked out of the plant. Oh, yes, he also left a hand made banner that read “No New Coal”. When did this happen? According to the Guardian Newspaper article it happened on November 28th. Police are still investigating, but they have no clue who the individual was. Inadequate Security Security must have been poor, right? Well, the Guardian describes this as the “most heavily guarded power station in Britain”. And rightfully so, it has been the target of a number of ecological protests (see: Evolving Eco-Terrorist Groups) centered on the facility’s massive use of coal. The British have spent £12M on security. The perimeter consists of two 10 foot electrified fences topped with razor wire. The area is covered by video cameras that caught the whole incident on tape. Sounds like impressive security, what went wrong? Well, there were some serious gaps in the security plan. Let’s work backwards from the point where he shut down the turbine:
He was able to physically access a computer control system in the facility; a computer that was apparently neither password-protected nor physically secured. He gained access to the operations floor of the facility through an unlocked door. He walked across the open ground around the facility even though he was captured on the video system (both coming and going) without catching the attention of security. He scaled two electrified security fences without setting off an alarm. He was able to reconnoiter the site without detection.
It sounds like the facility felt secure behind its high-tech fences. It also appears to be a very expensive lack of security. Nancy Bartels has some extremely interesting question in her blog:
“Who was watching those screens? If the answer is "nobody," then why bother to install them in the first place? If the answer is "somebody," shouldn't he or she have done something besides just watch?”
And, of course, she ends her blog with the best question of all, “As for all you folks in charge of your process operation's security, how well are you sleeping tonight?”

Monday, December 15, 2008

National Infrastructure Advisory Council Meeting 01-06-09

DHS announced in today’s Federal Register that the National Infrastructure Advisory Council (NIAC) will conduct a meeting on January 6th, 2009. The meeting will be held in Washington, D.C. and will be open to the public. Oral comments from the public will not be allowed, but written comments may be submitted before December 30th (Docket No. DHS-2008-0192). The meeting will include a status report on the Frameworks for Dealing With Disasters and Related Interdependencies Working Group and discussion on establishing a working group for the upcoming study on Infrastructure Resiliency.

HAZMAT Enhanced Enforcement Rule Comments – 12-05-08

A week has passed since the comment period ended on the Pipeline and Hazardous Materials Safety Agency and the comments are still coming into the Regulations.Gov web site, though at a much slower pace. Since the last blog reviewing comment submissions (see: “HAZMAT Enhanced Enforcement Rule Comments – 12-05-08”) there have been three corporate comments and 1 comment supporting the comments made by National Association of Retail Ship Centers. This will probably be the last blog in the series. The three corporate comments were received from: Reusable Industrial Packaging Association Arkema Inc Dangerous Goods Advisory Council The single comment supporting the NARSC was another form letter submission, bringing the total to 36. It was received from: Don VonderBurg Reusable Industrial Packaging Association Comments The RIPA did not believe that the definition of ‘freight container’ does not need to contain a volumetric capacity and proposed an alternative definition for this term. RIPA suggests that DOT should circumvent the requirements for inspectors to reclose a packaging using the ‘manufacturer’s closure instructions’ (since they would probably not be available to the inspector) by just requiring the inspector to use an ‘approved PHMSA closure method’. RIPA believe that packaging manufacturers, reconditioners or distributors should be held liable for failure of a packaging after it has been opened and reclosed by a DOT inspector. Arkema Inc Comments Arkema would like clarification of what would cause an inspector to be ‘suspicious of packages’. They would also like clarification of how an inspector will know what the manufacturer’s instructions are for closing packages. Dangerous Goods Advisory Council The DGAC is concerned about carriers, shippers or receivers being held responsible for ‘unacceptable safety performance’ of inspectors while opening packagings. DGAC believes that DOT should ‘unambiguously’ identify who is responsible at each stage of the inspection, packaging opening/reclosure, storage and return to shipping process. DGAC recommends that package opening inspections should only be made at the shipper’s or consignee’s location, not at roadside stops. DGAC questions how the DOT inspectors will identify or select ‘appropriate facilities’ for conducting evaluations of packagings and identifications of shipped materials. DGAC has numerous concerns about the ‘Out of Service’ provisions in the rule and specifically notes that any time an inspector stops or removes a package in transit, it is in effect ‘Out of Service’ DGAC believes that the ‘cost to industry’ estimates are ‘grossly understated’ and provide an example of one of their member companies that could incur costs of $100,000 for a single opened package. DGAC suggests that a supplementary NPRM be issued once the comments made to this NPRM are addressed and the rule is revised. My Comments on Comments The comments from both RIPA and DGAC identify some serious shortcoming with the proposed regulations; most of which have been identified previously. As always, I think that anyone that identifies a problem and then proposes a specific response, as has been done by RIPA, makes it more likely that they will be taken seriously by regulators. It certainly is no guarantee that the proposed wording will be accepted, but it will increase the chances. DGAC’s recommendation that a new NPRM be issued after the rule is re-written would normally be a non-starter; that require too long an increase in the time necessary to get a regulation into effect. In this case where there is a new administration that will be doing the issuing of the regulation, I think it is much more likely that a new NPRM may be issued. Still it will depend on how much the new administrators pay attention to the comments of the industry.

Saturday, December 13, 2008

High-Risk Chemical Facility Identified in Local Press

Somewhere the security gods are shuddering in dismay; there has been a high-profile violation of the rules protecting Chemical-Terrorism Vulnerability Information (CVI). The Orlando Sentinel broke the story about a local high-risk chemical facility that is in the process of preparing their Security Vulnerability Assessment. What is the identity of the well known chemical facility? It is Sea World. Actually, three Orlando area theme parks had to submit Top Screens, according to the story. Both Disney World and Universal were told by DHS that they were not designated as high risk facilities. Busch Entertainment Corp, the owners of Sea World, would not tell the Orlando Sentinel if their other two Sea World Facilities (in San Diego and San Antonio) were also undergoing SVA evaluations (well, someone understands security). So, someone at Sea World leaked the information to the reporter, Jason Garcia, at the Orlando Sentinel. Also, according to the story, the CFATS status appears to have been confirmed by a facility spokeswoman. So what? What can DHS do about it now that the cat is out of the bag? According to Section 27.400(j), the unauthorized disclosure of CVI is “is grounds for a civil penalty and other enforcement”. Section 27.300(b)(3) sets the maximum penalty at $25,000. The newspaper and the reporter are in the clear, the CVI rules only apply to personnel who were provided proper access to the CVI. The Rest of the Story… Just a quick side note; Paul Harvey really did come up with a good line, and it is especially appropriate here. Forget for the remainder of this blog posting the CVI issue. What I want to do with the remainder of this posting is ask each reader, “How would you like to be responsible for the CFATS implementation at Sea World?” Let’s take a look at the situation. The perimeter security is probably pretty good; they only want people coming through the paying entrances or the employee entrances. The physical screening for weapons and explosives is probably better than that done at most chemical facilities. They employees are almost certainly checked out pretty good, though they probably don’t check the DHS Terrorist Database. What is lacking is any sort of vetting process for the paying customers; the only identification that is checked is their credit card or cash. Separating the Chemical Facility and the Public Facility Okay, so they have to keep the paying customers away from the chemical facility portions of the park. This is nothing new for these theme parks. They do an excellent job of keeping the public separated form the support sections of the facility. The biggest part of that is nothing more than keeping the supporting structure well camouflaged and hidden. Once you have those isolation techniques down to a science, the rest of the security plan is fairly straight forward. Establish a security perimeter around the chemical assets. Control access with RFID identification cards or biometric identification. Establish multiple layers of security to allow for a reasonable response time for the facility security team. All of the rest of it falls into place fairly easily. Once you get passed the idea of the tourist trap as a high-risk chemical facility and realize that you have to properly define what the chemical facility is and what is the theme park, then developing your security plan is fairly easy. It is just that first step that is conceptually so difficult.
/* Use this with templates/template-twocol.html */