Fall 2010 Regulatory Agenda – Security Training

On Monday I looked at the Fall 2010 Regulatory Agenda and the pending regulations that might be of interest to the chemical security community. Yesterday I addressed the ammonium nitrate rule listed in the DHS portion of that Agenda. Today I would like to look at the TSA rule that would look at security training for freight rail employees listed in the RISC portion of the Agenda (75 FR 79563-4).

Background

Actually this is just one of the three rules listed in the Agenda where TSA will be developing security training standards but the other two deal with passenger transport modes, so they will not be of direct interest to the chemical security community. All three rules were required by different sections of the Implementing Recommendations of the 9/11 Commission Act of 2007 (PL 110-53). Section 1517 is the section that required TSA to develop these training regulations within 6 months of the enactment of that law. Since that law was passed on August 3, 2007, TSA is late, especially since they don’t currently plan to have even a notice of proposed rulemaking until March 2011.

According to the Agenda the “rulemaking will propose general requirements for a security training program to prepare freight railroad employees, including frontline employees, for potential security threats and conditions”. Any requirements will have to be justified by a cost-benefit analysis. TSA intends to look at the following potential costs:

• Creating or modifying a security training program and submitting it to TSA;
• Training (initial and recurrent) all security-sensitive employees;
• Maintaining records of employee training;
• Being available for inspections;
• Providing information on security coordinators and alternates; and
• Reporting security concerns.

DHS will then evaluate these costs against the potential benefit by using a ‘break-even analysis’ to determine the degree that the training requirements would reduce the overall risk of a terrorist attack. The risk assessment would be based upon scenarios included in the TSA Transportation Sector Security Risk Assessment.

I’m not sure how many of the scenarios might reach a break-even point for the costs of training, but I am sure that at least one scenario would clearly justify, by this type of analysis, an attack on a toxic inhalation hazard (TIH) chemical rail car in a major urban area. The number of people potentially at risk in such an attack is very large.

Delays in Rulemaking

I haven’t talked with anyone at TSA about the delays in this rulemaking, but I can make an educated guess as to at least some of the reason. First and most obvious is that surface transportation risks have always been a lower priority at TSA than air transportation. The specter of the 9/11 hijackings is the obvious reason for this as is the long history of plane hijackings. Add to that the relative ease of securing an aircraft vs a train or bus, and it is easy to see why TSA has concentrated on the low hanging fruit.

Even within the surface transportation area, freight rail is a lower priority than public transit. This too makes a certain amount of sense since it is much easier to successfully attack a passenger train than chlorine rail car. A terrorist armed with no more than a handgun or even just an acid filled squirt-gun could successfully attract world-wide attention. There would be a much higher level of technical expertise required to cause a catastrophic release of a TIH gas from a railcar.

To date TSA has limited their freight rail security regulation efforts to establishing actual standards for security of TIH rail shipments. Many will argue that the security measures are inadequate and TSA does have problems with providing acceptable measures of the actual risk reductions achieved.

Finally, TSA has included limited training requirements in their freight rail security rule. Those requirements are primarily limited to identifying improvised explosive devices. In fact TSA has produced a video that can be used in that training.

Security Training

As my readers will probably expect, I have definite ideas about what types of things should be included in any security training regulations for freight railroad employees. First and fore most, TSA has to be careful of how they define ‘security-sensitive employees’ that will be required to be trained. If they limit this training to just the ‘front-line’ employees that physically deal with trains and railcars, they will do a severe disservice to the American public. Any employee of a railroad that handles TIH chemical shipments should be considered a ‘security-sensitive’ employee for purposes of this regulation.

TSA should probably take a page from the safety training requirements used by PHMSA for hazmat shippers. The security training should follow the same two tier level of general awareness training and position specific training. Everyone should be trained on the general awareness of the terrorist threat, including:

• Explanation of current threat level,
• Discussion of potential attack consequences,
• Review of history of terror attacks on freight rail assets,
• Identification of pre-operational surveillance techniques, and
• Discussion of suspicious activity reporting procedures.

The position specific training needs to be tailored to the duties of each employee that may be required to accomplish security related task in support of the railroads efforts to prevent a successful terrorist attack on TIH railcars. The inclusion of the word ‘successful’ is very important because it needs to include emergency response measures and evacuation procedures that would be used in the event of both catastrophic and relatively ‘minor’ releases of a TIH chemical in the event of an attack (NOTE: these would mostly be the same for an accidental release).

Typically there would be a generic requirement in any rule of this sort for employees to be specifically trained on the requirement of the job outlined in the railroad security plan. Since TSA has yet to establish a requirement for railroads to have a security plan (there are only vague ‘requirements’ to conduct a vulnerability assessment), it would be difficult for TSA to include such language in a training regulation. To be fair, I suspect that most railroads do have security plans.

A key component of the job specific training would be communications measures to be used in the event of a suspected or actual attack. Not only does this need to include internal communications, but communications with local first responders. This is particularly important for train crews since they will typically transit many different jurisdictions during any train movement of any length. Being able to contact, and provide applicable information to, the local response agencies would be critical for any effective emergency-response to an attack on a TIH railcar.

Finally, any railroad employee that could reasonably be expected to be exposed to a TIH chemical release in the event of a terrorist attack (or accidental release), needs to be trained in the specific hazards associated with each TIH chemical transported by that railroad. This must include information on how the employee can identify that a release has occurred and determine how best to avoid critical exposure to the toxic cloud.

Training is a key component of any security plan. The best plan in the world will be absolutely worthless if the employees that must execute the plan are inadequately trained in its implementation. TSA has a responsibility to ensure that effective security plans are in place and that the employees are properly trained to execute those plans.