Chemical Sector Security Awareness Guide

A couple of weeks back I wrote about a new training resources web page established by the DHS Chemical Sector Office. I also wrote a separate blog about that site’s Active Shooter Plan. When I contacted the Chemical Sector Office to get my copy of that plan I also got a copy of the Chemical Sector Security Awareness Guide. Today I would like to take a look at that Guide. This relatively short (only 32 pages) .PDF brochure provides a brief overview of security issues for chemical manufacturing, distribution and transportation facilities and organizations. According to the document it is designed to make chemical professionals “aware of the security risk to the sector and to provide a list of activities or actions that they can take to reduce that risk” (pg ii). It is targeted at all chemical operations not just those regulated by CFATS or MTSA. This is not a security primer (there are books written on the subject), just a quick review of security issues. There is no startling new information in this pamphlet, but the organization is well organized and easy to access. The strongest part of the presentation is the ready availability of a wide variety of tabular data, including:

Table 1: Indicators of a Possible Security Threat Table 2: Indicators of Suspicious Activities in the Chemical Supply Chain Table 3: Common Oxidizers, Acids, and Fuels Used in IEDs Table 4: Potential Indicators of a Suspicious Vehicle Table 5: Safe Evacuation Distances for Selected Improvised Explosive Devices (IEDs) Table 6: Cybersecurity – What You Can Do Table 7: Suspicious Cyber Incidents Table 8: Resources for Security Information and Updates

Counter-Surveillance Readers of this blog will be well familiar with my emphasis on counter-surveillance operations. This pamphlet also pays particular attention to such activities even though it doesn’t specifically use the term. Table 1 provides one of the best listings of surveillance indicators that I have seen; I would definitely place copies of this at all guard stations including video monitoring stations where perimeter cameras are monitored. I would also like to see posters of this table placed in employee areas like break rooms, classrooms, and locker rooms. I was disappointed that there wasn’t even a brief discussion of civil rights protections. Many of the listed ‘indicators’ can be associated with non-attack related activities, many of which are constitutionally protected. A perfect example is the recent actions of some Greenpeace activists as part of the ‘Chemical Security Inspection’ campaign. As long as such activists remain outside of company property and don’t interfere with facility operations, they should not be harassed or interfered with. A brief paragraph or two about that in the discussion in this pamphlet would have been more than appropriate. A very valuable addition to this discussion is the inclusion of Table 2 and the accompanying discussion of suspicious activity in the chemical supply chain operations. These indicators can apply to many chemical operations, but they are particularly important to the sale, transport and storage of theft/diversion chemicals of interest (COI); those chemicals that can be used to manufacture improvised explosives or toxic chemical weapons. Improvised Explosive Devices There is a very good awareness level discussion of the issue of improvised explosive devices (IED) and vehicle-borne IEDs (VBIED). I was really impressed by the inclusion of the comment about the importance of area housekeeping as a tool for making it easier to spot an emplaced IED. The two tables in this section provide some equally valuable information; Table 4 provides potential indicators for suspicious vehicles and Table 5 provides evacuation distance guidelines for the response for the discovery of suspected IEDs/VBIEDs. The guidance provided on page 9 of the pamphlet for how to deal with the discovery of a suspected explosive device is certainly appropriate. I do, however, think that there could have been emphasis on these safety responses. At the very least this information should be set off visually. There should also be a comment about every facility needing a bomb response plan including detailed reporting procedures. I would certainly have preferred to see the inclusion of form for collecting/reporting information about the discovery of a device or receipt of a bomb threat. This would help to ensure that all of the necessary information would be given to emergency personnel. Cyber Security Cyber security issues are very complex, especially if the facility has computer based industrial control systems. This pamphlet does not attempt to provide any more detailed guidance on this subject than it does on the previous topics. The two tables in this section along with the accompanying discussion do provide a very basic starting point for cyber security planning. The only real problem that I have with this section is that it never even mentions ICS or SCADA security issues that are certainly different than normal IT security issues. These issues are very briefly mentioned in Appendix A. Reporting Incidents First, let me start off with an editing issue about the section of the pamphlet dealing with reporting incidents. There are two tables in this section; one providing contact information for reporting chemical facility security incidents to Federal agencies and one providing an outline of the type information necessary for a good report. I just don’t understand why they aren’t individually called a ‘Table’ so that they could be listed on the Table of Contents. This would make them easier to find. The reporting contacts table does appropriately emphasize the necessity of reporting first to 911 in the event of an active event. Local police and fire personnel will be the first people to actually respond to such an incident so they need to be notified first. Once first responders are on the way, then the facility should be concerned about contacting other appropriate agencies. I was severely disappointed though with the list of POC provided in this document. While there is a number given for MTSA facilities, there is no listing for CFATS facilities or transportation related incidents. This is really surprising since both ISCD and TSA are DHS agencies. If those two agencies were added to the table, I think that it would be very valuable to have this table printed as a card so that it would be readily available. I would place this card at every phone in the facility, but most managers would disagree with me; they would prefer to limit the people that would be making such notifications to avoid inappropriate reports. Facilities do need to have a well established and exercised procedure for making the determination of when to notify Federal agents of security incidents. Training There is no section that specifically addresses training facility and/or security personnel in security awareness. The ‘Chemical Sector-Specific Agency Voluntary Security Programs’ chapter does briefly mention two programs; the Web-Based Chemical Security Awareness Training Program (which I reviewed some time ago), and the Chemical Sector Explosive Threat Awareness Training Program. There is no contact information provided for the later (though I suspect all that is required is contacting the Chemical Sector Office). I am disappointed that more training information is not listed. The TSA DVD based program for detecting IED’s on railcars certainly deserves mention here. Additionally there are a number of videos produced by various state homeland security agencies based upon the ‘Seven Signs of Terrorism’ that would be a valuable addition to any facility security training program. Additional Information Appendix B provides a decent sized list of additional information resources. Most of the listed resources have URL’s/links for obtaining the documents on line. There are four government documents and one private sector document listed that are not apparently available on-line. It would have been very nice if there was some information on how to get these documents. Recommendation

While I have some minor misgivings and disagreements with the information included (or not) in this document I think that it is a very valuable resource for anyone concerned about chemical security issues. It is certainly worth the effort to request and read the document. CFATS and MTSA covered facilities will find this a valuable addition to their security library. Lower risk facilities should have this document if they have no other chemical security information on site.