Information Sharing

I noted last week on my blog that the National Infrastructure Advisory Council (NIAC) would be meeting on January 18^th to address the issue of information sharing. While I am not sure what the NIAC working group will be addressing in their information sharing report that is to be delivered at this meeting, I would like to take this opportunity to address a homeland security information sharing situation that I think ought to be addressed.

CFATS and Information Sharing

There are more than 6,000 chemical facilities in the United States that the Department of Homeland Security is regulating under the Chemical Facility Anti-Terrorism Standards (CFATS) regulations. These facilities are covered under this regulatory regime because the Infrastructure Security Compliance Division of DHS has determined that they present a high-risk of terrorist attack.

One of the eighteen Risk Based Performance Standards (RBPS) that each of these facilities is required to address in developing their site security plan (SSP) is that the SSP must address what needs to be done during periods of elevated threats (RBPS #13). This presupposes that there is some mechanism that will provide these facilities with notice of periods of elevated threats.

Another of the RBPS addresses the need for these facilities to provide provisions in their SSP to explain how they will report ‘significant security incidents’ (RPBS #15). While it is clear that an attack or an attempted attack would be a significant security incident, one would also like to think that most facilities would consider signs of potential pre-operational reconnaissance would also be considered a significant security incident.

Looking at these two RBPS requirements it is clear that we have a requirement for these facilities to be participating in an information sharing environment; providing raw intelligence information and responding to analyzed intelligence reports. What is not clear is that there is anyone on the other side of the information sharing process that is prepared to collect, collate and address the specific information provided by this community to produce the information product that they require.

Chemical Fusion Center

There are a number of State, regional and even some city fusion centers that have been set up to act as information sharing clearing houses. They provide mechanisms for the collection of security reports from a wide variety of organizations within their specific jurisdictions, collating and analyzing the information in those reports and sharing the intelligence information with law enforcement agencies and other fusion centers to allow for the appropriate response to that information.

While it could be possible for each of these CFATS covered facilities to establish independent relationships with their location based fusion center, probably through their local law enforcement agencies, there is no specific mechanism provided to aid these facilities in establishing those relationships. Inevitably this will mean that most of these facilities, particularly the smaller facilities, will not have an efficient information sharing environment.

What is needed is the establishment of a formal mechanism for this particular information sharing environment. A mechanism that provides a clear method for collecting security related information from these facilities. A mechanism that provides the intelligence analysis capability specifically suited to understanding the chemical security environment. And a mechanism that provides for reporting potential threats to chemical security to those facilities and the greater law enforcement community.

In short, what is needed is a fusion center that addresses the specific needs of this community, not a community based upon their physical location, but a community based upon the common threat they face. The threat of a terrorist attack on their facility because they produce, store, distribute or use high-risk chemicals. In short, what is needed is a Chemical Fusion Center.

DHS has set up a communication system for sharing regulatory information with this community in their web-based Chemical Security Assessment Tool. It would seem that this tool would be a valuable tool for collecting information from the more than 6,000 CFATS covered chemical facilities. DHS-ISCD has point of contact information for security related issues with each of these facilities. This could form the core of the flow of information to these facilities.

What is currently lacking is the chemical intelligence analysis capability to turn those collected reports into potentially actionable intelligence information that could be shared with other fusion centers and the chemical security community. The folks at the National Infrastructure Advisory Council are in a unique position to provide a recommendation to establish such a Chemical Fusion Center as part of their look at improving the information sharing environment. I would like to suggest that it would be appropriate for the information sharing working group to be tasked to look at this particular issue.

NOTE: A copy of this blog is being submitted to the NIAC for consideration at their meeting.