Reader Comment 06-03-10 Need to Know

We had an interesting post from an Anonymous reader yesterday continuing the discussion on the importance of thinking about denying the enemy, terrorists, information that would make it easier for them to successfully attack a high-risk chemical facility. We have looked at counter surveillance and developing EEFI, but Anonymous points out the need to remember a counter intelligence staple, the concept of Need-to-Know. Now that concept is covered well in the training that DHS provides before making one a qualified person for access to chemical vulnerability information (CVI), but Anonymous is correct, we have failed to extend that technique beyond the basic information marked as CVI. If combine the idea of Need-to-Know with the concept of Essential Elements of Friendly Information, we have another important part of the counter intelligence environment that we need to have in place to deny terrorists effective pre-attack intelligence. Anonymous reminds us that we need to train every employee to ask “does the other guy really need to know what you're talking about?” Now I certainly understand that most chemical facilities are relatively small and everyone on site is a vital part of the local team that makes the facility successful. This certainly requires a broad concept of sharing information. This is why the concept of EEFI must be combined with effective training. Anonymous does make one comment that I certainly disagree with. Anonymous writes “I prefer to stress the need to watch the conversation as opposed to watching for signs of intelligence gathering.” Since it takes a fairly sophisticated operation to mount a successful human intelligence collection effort, the vast majority of potential terrorist attacks will not be affected by an effective need-to-know effort. But, even the crudest terrorist attack will require some physical reconnaissance. Detecting and reporting that reconnaissance can allow law enforcement to pre-empt such attacks. Having said that, it is still certainly important to continually remind facility employees and contractors that they should not talk about facility security measures any where off site. Even an unsophisticated adversary would benefit from casually overheard information about security procedures. Training employees about what they should not be talking about to, or around, people without a need to know is an essential part of any effective counter intelligence campaign.