Hazmat Fire Points to Possible Security Issues

An interesting article from NBCChicago.com points out a limitation of the current list of chemicals used to trigger CFATS compliance; even relatively low risk chemicals can cause security issues.

The Article

The brief article describes a recent fire in a storage tank at a Rhodia plant Dixmoor, IL. The storage tank contained sulfur (not a COI under CFATS) and the fire produced sulfur dioxide (among other things of course). Sulfur dioxide is toxic and evacuations around the plant were ordered. There were no injuries reported in the article and the cause of the fire “remains under investigation” but no one is apparently mentioning the ‘T’ word even in dismissing the possibility.

CFATS Implications?

Now sulfur dioxide (anhydrous) is a CFATS COI, both as a release – toxic (5,000 lbs) and a theft/diversion – WME (500 lbs). The fire may have produced amounts in excess of both quantities, but no one in their right mind would expect Rhodia of having to report this on a Top Screen for this facility. At the very least they would reasonably argue that they did not have an ‘inventory’ of this material or that the material was never really on-site; it was in a dissipating smoke cloud with concentrations below the minimum reporting requirements (1% and 84% respectively).

The potential issue is that there are a number of processes like fire that can happen at a chemical facility that would produce COI. Many of these processes could be manipulated by a terrorist attack (or more likely a disgruntled employee attack) and result in the same type damage that would be expected from an attack on a facility with similar amounts of the COI in storage.

Does this mean that all of these potential processes require action under CFATS? Absolutely not. While DHS has included a class of ‘Sabotage’ COI; that class is very restricted in the chemicals it applies to; generally only chemicals that produce toxic gasses upon the addition of water.

Should these processes be regulated under CFATS? Almost certainly not; though please note that there is a significant semantic difference between ‘absolutely not’ and ‘almost certainly not’. First off trying to write a rule that would reasonably limit the inclusion to the most dangerous chemicals or define the ‘processes’ in a reasonable manner would be extremely difficult and subject to lots of legitimate complaints about over reaching regulations.

Besides which, managing the list of COI for chemicals that would be potentially affected by this rule would be ridiculous. Just listing the chemicals that could produce sulfur dioxide in the event of a fire would be exhausting.

Look at Potential Consequences

Having said that, this incident in Illinois points out that there are potential consequences that could create a security issue. At the very least there ought to be some mechanism that identifies the facilities that would produce the worst effects when one of these processes is triggered, either accidentally or deliberately.

I’m not sure how you would reasonably do it, but because of this news report about this incident, the topic becomes something that facilities that store sulfur at the very least must consider. There is no telling what wackos read the news.

Australian Chemical Security Guidance Document

On Wednesday the Australian Government and the Plastics and Chemicals Industry Association (PACIA) announced the release an updated version of their Site and Supply Chain Security Guidance (SSCSG). This voluntary framework document is some what similar to the Risk Based Performance Standards guidance document produced by DHS in that it provides general guidance on how to develop a chemical security program. It is part of the Australian chemical industry’s Responsible Care program.

The DHS RBPS guidance document provides a much more comprehensive discussion of features that a security program should address, but chemical security professionals will find many things of interest in this document. It reflects a slightly different appreciation of the potential terrorist threat and how industry and government should respond to that threat.

Investigation of Security Incidents

It goes without saying that any security program will provide for investigation of security incidents and section 2.3 of this SSCSG briefly addresses this issue. It includes a list of examples of incidents that “would warrant investigation”. It includes examples of things readily recognizable by security professionals in any industry:

• “Doors not secured, holes in fence lines, indication of illegal entry
• “Unauthorised (sic) entry by personnel into restricted areas of the facility
• “Signs of vehicles in restricted areas along pipelines, fence lines, electrical substations, or remote plant security gates”

It also includes examples that are very specific to the chemical process industry that might be overlooked as possible security issues:

• “Major unexplained process upsets
• “Unexplained loss of containment of hazardous material
• “Unexplained loss of raw material or product”

The underlying incidents are typically investigated as process upsets that need to be resolved to ensure safe and profitable operation of the manufacturing process. What may be overlooked by chemical process professionals is that these may also be indications, especially if a routine processing issue cannot be identified as the root cause of the incident, of an attack on the site.

High-risk chemical facilities should include a chemical security professional in their routine incident investigation team. Even if the incidents provide no indication of a security breach, participation in the investigation will provide that security professional with additional insights into how the facility might be attacked.

Physical Security Measures

The discussion of physical security measures is generally much less detailed than that found in a number of different sections of the RBPS. There are some points in the discussion of access control that bear repeating. In listing the circumstances that must be considered in determining the appropriate level of access control (in section 4.1) they include the “degree to which facility operations are controversial”. This is something that is overlooked in the discussions in the RBPS.

For rather obvious reasons, there is a tendency in this country to equate a terrorist threat with a threat of an attack by Muslim Extremists. This is certainly not the limit of the terror threat. There are a number of other different (and evolving) types of organizations that might be expected to attempt attacks on chemical facilities. Target selection for each of these groups will be affected by their political goals and facility security assessments need to take this into account.

There is an access control measure included in the discussion in this section that I must admit that I had never considered, or heard mentioned in connection with chemical facility security. That measure is:

“Keep publicly accessible restroom doors locked and set up a key control system. If there is a combination lock, only office personnel should open the lock for visitors.”

I have seen this security measure employed at some convenience stores to reduce the incidence of vandalism or street level drug sales, but I have never heard of it being applied to an industrial security situation.

Cyber Security

Most of the cyber security discussion in section 4.3, as in the RBPS, focuses on Information Technology (IT) systems rather than control systems. Most of the information covered here is covered in much more detail in the RBPS, but there is an interesting addition here that I have not seen elsewhere. In their discussion of the potential reasons that a hacker might attack a cyber system at a chemical facility they include to “prevent emergency response systems” from working.

As I have mentioned on a number of occasions, a prompt and effective emergency response to an attack (or accident) will go along way to mitigating the consequences, particularly the off-site consequences, of a chemical release incident. The speed and efficacy of the response will depend, in large measure, on the speed with which the responders are notified and the detailed information they receive about the incident. Thus, a very effective way of ensuring the effectiveness of an attack would be to hamper that exchange of information.

I have long advocated the use of automated systems to detect leaks of toxic chemicals, track the progress of the plume dispersion and provide that information to emergency response personnel. Timely sharing of that information is crucial to maximize the effectiveness of the emergency response process. Protecting these automated systems should certainly be included in the cyber security program for the facility, particularly if they are connected to outside communications systems.

Chemicals of Interest

One key element of any chemical security program is the determination of which chemicals will be covered. The RBPS does not specify the DHS chemicals of interest (COI), but it is certainly based upon that list. Similarly the SSCSG depends on the Australian list of ‘chemicals assessed as of immediate potential security concern’ (I won’t even try to list that acronym, I’ll just use our ‘COI’) which is reproduced in Appendix A (how appropriate) of the SSCSG.

The Australian COI list only contains 96 chemicals (vs. over 300 on the DHS COI list) and there are substantial differences. The rationale for the Australian list is not included in this document, but it certainly focuses more on toxic chemicals and less on flammable chemicals. The Australian list includes a large number of pesticides where the DHS toxics list is mainly limited to Toxic Inhalation Hazard (TIH) chemicals as they are more easily ‘weaponized’.

While the pesticides included in the Australian list are not regulated under CFATS, chemical security professionals will want to take a look at the security of these chemicals where a facility may have been identified as a potential target for some eco-terrorist groups. Some of those groups would be at least as concerned about the production, storage or use of these pesticides as they would industrial TIH chemicals.

Risk Management Model

Though DHS does not specifically call it a ‘risk management model’ the CFATS program is clearly (and specifically) based on the Deter, Detect and Delay model, a very comprehensive model as far as it goes. The model used in this document (outlined in limited detail in Appendix B) expands that model to include Response and Recover. Response is defined as the “level of reaction required to counter an intrusion”. And Recover is defined as the “ability to ensure that operations can continue”.

As DHS, as an organization, is trying to advance their homeland security efforts to include ‘resiliency’ as part of their management mantra, the CFATS program should certainly consider expanding their model to what the Australians call the D3R2 (D Cubed, R Squared) model to address these resiliency issues. That should certainly include the provisions for a more comprehensive emergency response program for high-risk chemical facilities.

Reviewing Other Security Programs

The Australian Site and Supply Chain Security Guidance, like the CFATS RBPS, exists within a security framework that includes a variety of laws, regulations and industry standards. Viewing this document provides only a limited view of the Australian chemical security landscape.

Having said that, security professionals involved in chemical facility security activities would do well to review this relatively short (30 pages of relatively large type and white spaces) document. It provides a slightly different focus on chemical security issues from that found in the RBPS. As such it helps provide a more complete look at the chemical facility security picture.