Chemical Sector Intelligence

I ran across an interesting document at PublicIntelligence.net, a sort of Wikileaks-lite that publishes a wide variety of unclassified but restricted distribution documents; documents marked with FOUO (for official use only) for example. This one purportedly came from the Colorado Information Analysis Center. The “Signs of Terrorism: Chemical Sector” is, basically a standard two-page flyer describing the types of suspicious activity that might suggest the possible preparation for an attack on a chemical facility or an attempt to gain access to weapon precursor chemicals. I would like to think that the CIAC has distributed this flyer to chemical manufacturing and distribution facilities through out the state.

The interesting thing about this document is that it includes abstracts from what were apparently suspicious activity reports submitted to law enforcement agencies in Colorado. The abstracts have been sanitized to avoid giving facility identifiable information (though one example should be readily recognizable by anyone who follows the national news). The illustrative SARS summaries are pretty well selected and are relatively recent.

I only have two minor negative comments about the incidents used to illustrate the indicators. First the incident used to explicate the ‘Elicitation’ indicator could be fleshed out some to show why it was a suspicious inquiry rather than a rather typical first call from a potential new customer. Next the second incident used for ‘Supplies’ could have been better used for ‘Impersonation’ which has no example provided.

Intelligence Reports

These five SAR summaries are great examples of the kind of intelligence information that could be provided to chemical facilities across the country; high-risk chemical facilities in the CFATS program in particular. I would expect that a little additional information would be used to flesh out the information. Even if subsequent investigations showed that the incidents were totally innocent (and most will turn out that way, such is the life of an intel analyst) the information could serve as an exemplar of the type information that facilities should be routinely reporting.

Even innocent incidents have good intelligence value. If for example the first facility ‘investigated’ by the Greenpeace ‘security inspection team’ had turned in a SAR about the visit, followed up by an explanation of what the folks were actually doing, it would have made the next facility security manager’s job that much easier when they showed up there. The investigation of ‘suspicious people taking pictures’ would quickly change into a ‘no problem just those Greenpeace folks’; a situation of no concern to security guards, just plant management. It would help decrease tension by presenting the security staff with a known and understood situation.

Chemical Sector Fusion Center

I doubt that the people at ISCD have the excess manpower or specialists available to produce such intelligence reports. I’m not even sure that they have set up a mechanism for security managers at CFATS facilities to submit such reports to a central agency or whether they would just go to the local Joint Terrorism Task Force or the local police intelligence unit (or just the cop on the beat?). While the JTTF would love to receive these reports, they may not have some one with the chemical expertise to recognize the significance of some of the reports. The disappearance of a gallon of thiobisenthanol (a precursor for a form of mustard agent) might not raise terrorism alarm bells, for example, at the local fusion center.

What is really necessary is the formation of a fusion center with the expertise to collect and evaluate SAR’s related to chemicals and chemical facilities. They could produce the kinds of intelligence reports that would be of special interest to the chemical security community. These would include the types of SARS summaries discussed above, but also intelligence products that would identify specific threats to specific areas of the chemical community. Their work could help to inform the efforts of chemical security inspectors and to provide technical information and support to police and JTTF investigations.

Signs of Terrorism are FOUO?

The Seven Signs of Terrorism (Colorado forgot to mention ‘Dry Run’ and ‘Deploying Assets’) are a well known and publicly available program to get people to get people to report suspicious activity. I suspect that the folks in CIAC marked this document ‘FOUO’ because of the SARS report summary information that was included. This is typical of the over-classification problem that afflicts most intelligence related information.

But let’s get serious here. There is nothing in this flyer that should cause any intelligence collection manager to think twice about the potential disclosure of intelligence assets or collection methods/technology. Putting the ‘FOUO’ markings on this will ensure that some of the people who need to see this (everyone that works at or around a chemical facility) will not get to because of someone took the vague classification overly seriously. Additionally, it will make some paranoid activist (not all activists are paranoid, nor are all paranoids activists) sure that they were included in a SAR because they were taking pictures of chlorine railcars and are thus marked for life.

People need to take a hard look at their markings of documents such as this. Additionally, every organization (like CIAC) should have someone whose job it is to remove excessive markings from documents. It will make information sharing easier and make documents that actually require restricted distribution more likely to receive that protection.

Napolitano Wants Private Sector Involved in Fusion Centers

Last week Secretary Napolitano addressed the Fusion Center Conference in Kansas City, MO. She re-affirmed the importance of the Fusion Centers as information collection, analysis, and sharing organizations. She also told the conferees that these centers should develop the capability for lateral sharing of information amongst the Fusion Centers as well as sharing with elements of the Federal Government. Finally she noted that Fusion Centers needed to have increased private sector involvement. Private Sector Information Flow While Secretary Napolitano mentioned that Fusion Centers should be processing more than just terrorist information, the primary focus of these centers is counter-terrorism. Since many of the potential terrorist targets are privately owned, it seems obvious that the private sector needs to be included in the information sharing aspects of Fusion Centers. Information needs to flow from these centers to facility security managers about changes in the local terrorist threat status. Increased chatter indicating terrorist interest in a state, region or city should result in increased vigilance and counter-surveillance activities at high-risk facilities. That can only happen when the information gets down to the facility level. Likewise, information needs to flow from facility level to the fusion centers. High-risk facilities need to have a direction information submission channel to the local Fusion center. Reports of suspicious activity, apparent surveillance activities, or testing of security measures are all indications of potential future activities. Fusion centers have the capability to draw these reports together and put them together with information from other sources. Private Sector Analysis One of the main objectives of intelligence analysis is to ‘connect the dots’ between disparate pieces of information. For example, the theft of a single drum of a non-hazardous chemical means little. Combine that with the chemical process knowledge that this chemical is a potent polymerization initiator and you have a possible indicator of a sabotage attack on a chemical facility. Further combine that with the disappearance of an empty tank truck from a company known to ship monomers and you have the potential means to execute an attack and the information necessary to identify potential targets. This type technical information is not normally available to law enforcement personnel. The background to evaluate this type information is not included in the development of most intelligence analysts. This is where the private sector can help in the data analysis function. Unfortunately, there is currently no mechanism for getting the information to technically qualified analysts. And this is true for other sectors than just the chemical sector. Each of the 18 critical infrastructure/key resource (CIKR) sectors in the National Infrastructure Protection Plan has a different set of specialized knowledge that would have to be tapped to adequately protect high-risk facilities in that sector. To make matters worse, each of those sectors has a wide variety of specialties with its own knowledge set. It would be nearly impossible to staff each of the fifty odd Fusion Centers with a sufficiently large set of sector analysts to make a significant difference. Sector Fusion Centers Each of the CIKR has its own Sector Coordinating Council (SCC). For example the Chemical Sector Coordinating Council is made up of representatives of eighteen chemical trade associations. The Chemical SCC works with DHS and other Federal Agencies to ensure that the industry security efforts are coordinated with Federal NIPP efforts. Each SCC could form its own Fusion Center. Each center would provide data analysis unique to its sector, supporting State and regional Fusion Centers. It would also provide a unique base for industry specific data analysis supporting conventional intelligence organizations. It would also allow for communication of intelligence information to high-risk facilities within the Sector. The ‘analysts’ would be drawn from companies within the sector. Mid-level managers that have been identified as future security managers would be seconded to the Sector Fusion Center for a period of 12 to 18 months. This would provide them with the training and experience necessary for managing security and intelligence positions within their parent organization. It would also provide them with personal contacts in the intelligence side of the Federal government as well as personal security contacts across the Sector. Congress has a unique chance to establish a sector specific Fusion Center during the re-authorization of CFATS. The Chemical Sector Fusion Center could be authorized in that legislation. It would serve as a test bed for establishing similar fusion centers in each of the 18 CIKR sectors.