Reader Comment 06-03-10 Need to Know

We had an interesting post from an Anonymous reader yesterday continuing the discussion on the importance of thinking about denying the enemy, terrorists, information that would make it easier for them to successfully attack a high-risk chemical facility. We have looked at counter surveillance and developing EEFI, but Anonymous points out the need to remember a counter intelligence staple, the concept of Need-to-Know. Now that concept is covered well in the training that DHS provides before making one a qualified person for access to chemical vulnerability information (CVI), but Anonymous is correct, we have failed to extend that technique beyond the basic information marked as CVI. If combine the idea of Need-to-Know with the concept of Essential Elements of Friendly Information, we have another important part of the counter intelligence environment that we need to have in place to deny terrorists effective pre-attack intelligence. Anonymous reminds us that we need to train every employee to ask “does the other guy really need to know what you're talking about?” Now I certainly understand that most chemical facilities are relatively small and everyone on site is a vital part of the local team that makes the facility successful. This certainly requires a broad concept of sharing information. This is why the concept of EEFI must be combined with effective training. Anonymous does make one comment that I certainly disagree with. Anonymous writes “I prefer to stress the need to watch the conversation as opposed to watching for signs of intelligence gathering.” Since it takes a fairly sophisticated operation to mount a successful human intelligence collection effort, the vast majority of potential terrorist attacks will not be affected by an effective need-to-know effort. But, even the crudest terrorist attack will require some physical reconnaissance. Detecting and reporting that reconnaissance can allow law enforcement to pre-empt such attacks. Having said that, it is still certainly important to continually remind facility employees and contractors that they should not talk about facility security measures any where off site. Even an unsophisticated adversary would benefit from casually overheard information about security procedures. Training employees about what they should not be talking about to, or around, people without a need to know is an essential part of any effective counter intelligence campaign.

Reader Comment 06-01-10 Counter Intelligence

Red Team, a frequent commentor, provided some valuable insights to a recent posting on counter surveillance, reminding us that a valuable way for someone to gain knowledge about our facilities is to simply ask questions of employees. Those of us with a military background will remember the required annual classes on counter intelligence and realize that the same things apply to employees at high-risk chemical facilities. We are probably not going to see active human intelligence collection efforts being made by al Qaeda; this requires a level of understanding of American language and culture that requires extensive study and training. Home grown terrorists, on the other hand will have the necessary knowledge base from every day life and would only require some rudimentary intelligence collection training. Essential Elements of Friendly Information Red Team makes an important counter intelligence point, writing that employees need to “know what can be talked about, and what can't”. In the military we were trained to look at essential elements of friendly information (EEFI). As part of the CI planning for any operation the staff would determine what information about the planned operation would provide the adversary with the knowledge to prevent the operation reaching a successful conclusion. The security staff for a high-risk chemical facility need to look at the facility, and its security measures to determine what information would allow a determined adversary to conduct a successful terrorist attack on the facility. Some elements will be the same for any facility; details of perimeter detection capabilities, vehicle and personnel inspection techniques, and COI storage locations for example. Other EEFI will be specific to the individual facility. Counter Intelligence Training As part of every class dealing with security awareness, employees must be made aware of the EEFI for that facility. They need to be made aware of the fact that they should not be talking about EEFI with anyone that is not an employee of the facility. They need to be provided with a means of reporting contacts with anyone that expresses an interest or asks questions about the identified EEFI. The training needs to emphasize that simply asking questions about EEFI does not necessarily make the questioner a terrorist. Any number of people might ask such questions in ordinary conversations and business people might be seeking the same information for legitimate reasons. It is important that all such contacts be reported to security personnel for evaluation. This points out another reason that high-risk chemical facilities need to employ experienced security professionals in the development and oversight of their security program. The proper evaluation of these CI reports requires a certain level of training and experience, training and experience that are unlikely to be part of a chemical professional’s background. Red Team points out that it is not just facility employees that need to be actively involved in this counter intelligence effort, noting that employees, contractors and even vendors might be approached for such information. As I have mentioned on a number of occasions, even off-site neighbors can be expected to have sufficient information about security information to be targets of such intelligence gathering efforts. Vendors and neighbors cannot be given the same counter intelligence training nor can they be given same level of details about EEFI. Having said that, there must be an attempt to communicate the potential risk to these interested parties and provide a ready mechanism for them to report potential questions about the facility. High-risk chemical facilities are going to have to take a serious look at all aspects of their facility operations to prevent potential terrorist attacks. One important aspect that cannot be overlooked is the development of an effective counter intelligence capability. An EEFI training program is an important part of that capability.