More Thoughts on Security Forces

Earlier this week I looked at comments submitted on the Draft Risk Based Performance Standards Guidance document in two separate blogs. One comment that was found in a wide variety of submissions was the concern about the apparent requirement for facilities to have armed guards. Today I thought that I ought to take another look at what RBPS #4 says about security forces and Metric 4.5 in particular. Protective Forces Discussion in RBPS #4 RBPS #4 deals with the requirement to deter, detect, and delay a terrorist attack. The discussion of security measures in RBPS #4 actually has very little to say about security forces. There is just a single short paragraph (pages 52-3) that I’ll quote in its entirety here:

“Protective forces are often used to enhance perimeter security and provide a means of deterrence, detection, delay, and response. Such forces can be proprietary or contracted, and can be armed or unarmed. They may be qualified to interdict adversaries themselves, or simply to deter and detect suspicious activities and to then call local law enforcement to provide an interdiction.”

Appendix C adds very little to the discussion of security forces. In fact, the paragraph on page 144 describing the use of security forces is the same as that found in RBPS #4 with the addition of a single sentence. That sentence adds very little to the discussion as you can see here:

“Protective forces can be used in a variety of ways, including standing post at critical assets, monitoring critical assets using remote surveillance, or conducting roving patrols on a documented schedule that specifically includes identified targets, processes, or assets.”

The discussion in Appendix C does provide a brief discussion of the security considerations for security forces. Again, the entry is short enough to be quoted in its entirety here:

“No matter how they are deployed, protective forces alone generally do not provide sufficient perimeter security. Accordingly, if a facility employs protective forces, they likely will need to be used in combination with one or more of the other measures listed above to provide an appropriate level of security to meet the Restrict Area Perimeter performance standard.”

There is certainly nothing in any of this discussion that would lead anyone to believe that DHS is requiring anyone to use armed guards. So, where does the concern come from? To answer that we need to look at Metric 4.5. RBPS Metric 4.5 Metric 4.5, Interdiction by Security Forces or Other Means, provides separate standards for Tier 1, Tier 2 facilities and a combined standard for both Tier 3 and 4 facilities. The difference between the standards can be found in the first sentence. That difference between them is highlighted below:

Tier 1 – “The facility is extremely likely to be able to detect and initiate a response to armed intruders resulting in the intruders being interdicted before they reach a COI target asset or other potentially critical target.” Tier 2 – “The facility is likely to be able to detect and initiate a response to armed intruders resulting in the intruders being interdicted before they reach a COI target asset or other potentially critical target.” Tiers 3/4 – “The facility has some ability to detect and initiate a response to armed intruders resulting in the intruders being interdicted before they reach a COI target asset or other potentially critical target.”

The remainder of each metric is the same for all four tiers.

“This capability may be achieved by a facility security force, sufficient delay tactics to allow local law enforcement to respond before the adversary achieves mission success, standoff distances (for VBIEDs), process controls or systems that rapidly render the designated COI target asset(s) or other potentially critical target non-hazardous even if a breach of containment were to occur (e.g., a rapid chemical neutralization system), or other equivalent measures. If security forces are used, they may be contract or proprietary, mobile or posted, armed or unarmed, or a combination thereof.”

The phrase that is of concern to commenters is “interdicted before they reach a COI target asset” combined with the mention of potentially armed security forces in the last sentence. Purpose of Site Security Plan Before we proceed with this discussion we need to take a reality check and examine the whole purpose of completing the site security plans that the RBPS Guidance document is designed to support. The purpose is not to fulfill the requirements of the CFATS regulations. The purpose is to prevent a successful terrorist attack on high-risk chemical facilities. What constitutes a successful terrorist attack depends on the chemicals involved at that facility. For facilities with release toxic COI a successful attack would be a toxic cloud leaving the confines of the facility and causing serious injures or deaths in the surrounding community. For facilities with a release flammable or explosive COI, a successful attack would be a release and resulting explosion that would spread damage, injuries and death beyond the facility perimeter. For these facilities the purpose of the SSP is easy to see; prevent death and injury in the surrounding community. For facilities with theft/diversion COI it is less obvious what constitutes a successful attack. Does the facility have to prevent the COI from leaving the facility? Or, should the standard be related to the prevention of death and injuries in the larger community. I think that the prevention of death and injury in the greater community is the true purpose. With that in mind, a successful attack is prevented if the terrorists are intercepted by police forces after leaving the facility, but before they can combine these chemicals into an effective improvised explosive device. The Meaning of Interdiction With this clearer definition of the purpose of the Site Security Plan, we can take a more informed look at what ‘interdiction’ means. In the simplest of terms, ‘interdiction’ means stopping a terrorist attack before it becomes successful. Again, depending on the facility and the COI involved this could mean radically different things. This could include mitigation measures that prevent the effects of a release from spreading beyond the facility boundaries or providing protection to the potentially affected population. For most facilities with release COI ‘interdiction’ is going to mean stopping the terrorist attack from reaching the storage areas where the COI is found. Unfortunately, there is no known combination of barriers and sensors that is capable of stopping a determined group of terrorists. The best that can be hoped for is that the visible barriers and security procedures make the facility an unattractive target (Deter). Lacking that, those security measures need to be able to identify an impending attack as early as possible (Detect) and slow the progress of the attack so that some sort of effective response can be executed (Delay). Security Forces Will Be Required For the great majority of high-risk chemical facilities with release COI, the lack of adequate mitigation options is going to require that the attacking terrorists are physically intercepted and prevented from continuing their attack. A security response force is going to be the only tool that will be flexible and adaptable enough stop a ground attack on the facility. The higher the risk to the surrounding population associated with the COI stored at the facility, the more likely it will be that terrorists attacking the facility will be armed. Sending an unarmed security force to intercept and stop an armed intruder would only be considered by the criminally insane or some Hollywood film maker. This is becoming an overly long discussion for a single blog posting. I’ll continue this discussion in later posts, but for now lets summarize. For high-risk chemical facilities that have release COI that could affect significant off-site populations, the site security plan is going to have to identify a combination of actions that the facility is going to take to prevent a successful terrorist attack. If there are not viable means to mitigate the effects of a catastrophic release of the COI, the facility will have to rely on an armed security response to stop the attackers from initiating that catastrophic release.