9-11-2009

Today is the 8th anniversary of the 9/11 attacks on the United States. While there have been no successful terrorist attacks on the US since that fateful day, we continue to work at preventing the next attack. Today is a good day to take a look at those efforts and determine if they are necessary, or whether we should be expending that time and those resources on other endeavors. Questions Raised in QHSR This is one of the questions that was raised in response to a number of different Ideas discussed in the recent Quadrennial Homeland Security Review Dialogue. A number of different commentors noted that it is impossible to protect everything. Besides as we prevent one threat, our opponents develop another. Even as we stopped passengers from taking any potential edged/pointed weapons onto airline, the terrorists developed explosive shoes. We required passengers to take off their shoes for inspection and the terrorists turned to liquid explosives. As TSA continues to enforce the 3-1-1 Rule we hear reports of terrorists using explosives hidden in ‘anal cavities’ in a non-airline attack. Every new security measure results in a new technique. What the security measure critics fail to recognize is that none of the newly developed attack techniques has been successfully used in an attack on airlines in this country. A combination of robust intelligence work and ineptly executed attacks has resulted in the detection of these new techniques before they were successfully executed. Responses have been put into place to prevent future efforts. So why are we expending the time and effort to defend against the last attack technique? Actually the answer is quite simple; we prevent the terrorist organizations from perfecting those techniques. The 9/11 attacks succeeded in large measure because we stopped looking for hijackers because it was a discredited, no longer successful, terrorist attack technique. The terrorists realized that we had stopped looking, so they dusted off an old technique and successfully used it in a new way. We continue to defend against the simpler attack techniques because to do so raises the bar for participation in attacks. The simpler attack modes could be used by just about any wannabe; preventing those modes reduces the number of potential adversaries that can attack us. As new attack modes are developed and implemented, we will develop and implement defenses. Hopefully we will continue to detect the new attack modes before they are successfully used. No Attacks, Why Defend? The question is even more acute when it comes to defending chemical facilities against terrorist attacks. There have been no credible reports of attempted or planned attacks on high-risk chemical facilities in this country, so why are we requiring almost 7,000 facilities to expend a great deal of time, effort and money on defending these facilities against potential attacks? Actually we are using a standard process safety tool known as the “What if Technique”. In safety reviews we look at a variety of potential scenarios to see if something ‘bad’ can happen. If it is determined that there is a potential issue we then ask how likely it is that the scenario can occur. The worse the potential consequence the less likely the occurrence has to be required to take preventive action. The potential consequences of successful attacks on the high-risk chemical facilities covered under the CFATS program are so high that there only needs to be a relatively low probability of such an attack to make it worth while to take the required safety/security measures. Additionally, the tier ranking system used to evaluate the risk requires more security measures for the higher risk facilities. What Cost Security? Security measures cost money; who then pays for that security? This is one of the fundamental questions that needs to asked whenever the federal government requires actions by State and local governments or private individuals and companies. It is clear that under current rules the management of high-risk chemical facilities will pay for the planning, implementation and upkeep of security measures at their facility. They will, of course, pass those costs on to their customers so that the cost eventually gets spread through out the economy. If competitors can produce equivalent products without using the chemicals that trigger the regulatory requirement, or produce the products in locations where the risks are less, or can in some other way reduce their risk below the CFATS threshold, they will not have the security cost to recover in their pricing. Whether this will be enough to give them a significant competitive advantage in the market place will determine if the high-risk facility is able to remain in business using the chemicals of interest that make them high-risk facilities. While CFATS does not specifically require action by State and local governments, it is an inescapable fact that local law enforcement, emergency management and other governmental response agencies will be required to support security plans at these high-risk chemical facilities. Who pays for that support? While there may be grants that help in some limited situations, it is clear that the local population will pay for these security-support measures. In some ways that is appropriate since the neighbors will be receiving the direct benefits of that support in the event of an attack on the facility. The final cost that has not been addressed in the discussion of protection against potential terrorist attacks is who will pay for the damage that results from a successful terrorist attack. Will the facility and their insurance company bear the bulk of the financial responsibility for making whole the neighbors of the facility? Or will the facility be responsible for a ‘reasonable’ amount of the damage with the government picking up the rest? In either case, what is an adequate level of insurance coverage or bonding required for a high-risk chemical facility? Continued Evaluation Today, the anniversary of the fateful date reminds us that there are many enemies of this country in the world, some of whom will attack us where we live. We need to periodically look at the consequences of that fact and reaffirm that we will take the necessary actions to protect our way of life. We need to periodically re-evaluate the threat and the potential consequences to determine what measures are appropriate. Requiring high-risk chemical facilities to implement security measures is just one of those types of actions we need to take to protect ourselves and our society.