Photographer Rights

Long-time readers of this blog will certainly have seen me comment on the importance of detecting the surveillance phase of a potential terrorist attack. Alerting the police and FBI of a potential attack is one of the best security measures that a facility has to prevent a successful terrorist attack. I have also mentioned that one of the indicators of possible pre-operational surveillance is someone taking pictures of the facility. I have tried to make it clear that ‘an indicator’ is not proof of terrorist surveillance and that someone taking pictures from public areas is not doing anything illegal.

There is an interesting blog posting over at NetworkWorld.com that addresses this issue from the point of view of a photographer. It should be required reading for all security managers and front-line security personnel. Now the blog is not a legal opinion, and some will consider the author to be an anti-government zealot (a appellation which the link associated with the picture accompanying the blog post would encourage), but it is a clear statement of the point of view of legitimate photographers.

I have been pleasantly surprised that there have been no reports of confrontations between facility security staff and Greenpeace activists conducting their photographic ‘security inspections’ of high-profile chemical facilities. These Greenpeace activities have clearly been part of their politically protected free speech rights. While I expect that their activities have discomforted the applicable security personnel, the lack of complaints about harassment by security personnel indicate that the security managers at these facilities have well understood the situation and had appropriately trained their security personnel.

Potential Surveillance Must be Investigated

Unfortunately, these types of photographic activities could also be used by terrorist planning an attack on a high-risk facility. As such they need to be investigated and reported. Investigational procedures must be developed that take into account to potential dual nature of such incidents.

Anyone talking with a photographer on public property must be well trained in their responsibility for positively representing the facility owners and workers. They need to be polite and respectful in the limited questioning that they conduct. Physical contact must be strictly prohibited and intimidation should be avoided at all costs. Politely requesting that the individual stop photographing the facility is acceptable, but anything that leaves the impression that the person is required to stop taking photographs leaves the facility vulnerable.

Role playing exercises are probably the most effective component of training for security personnel to deal with public encounters of all types, and would be particularly appropriate for situations of this sort. Clear identification of inappropriate responses in such training will go along way in avoiding inappropriate confrontations along the facility perimeter.

Site Security Plan

Now this is not something that I have seen covered in the Risk Based Performance Standard guidance document, and is probably not something that the DHS Chemical Security Inspectors will check when they visit a facility (though I might argue that they should). Having said that, this is certainly an example of the type of situations that Security Managers will to have to deal with in developing their security programs.

Another Look at Counter Surveillance

There is a good article on StratFor.com about the recent preventive arrests of an alleged terrorist in Manchester, UK. Anyone seeking to understand the dilemma of deciding when to break up a terrorist plot should read this article. In the middle of the article, however, is a short section of greater importance to members of the chemical security community. It deals with detecting a terrorist attack in the planning stages. Flawed Tradecraft Under the ‘flawed tradecraft’ heading the article states that “the suspects did not appear to possess any surveillance detection capability — or even much situational awareness — as they went out into Manchester to conduct pre-operational surveillance of potential targets while under government surveillance themselves”. The authors, Burton and Stewart, note that this is not unusual, claiming that “most militant groups do not provide very good surveillance training and as a result, poor surveillance tradecraft has long proven to be an Achilles’ heel for militants”. In this instance they note that “the suspects’ surveillance techniques appear to have been very rudimentary in that they lacked both cover for action and cover for status while conducting their surveillance operations”. Counter-Surveillance Plan As I have pointed out on a number of occasions, this means that the detection of potential attacks can be accomplished by standard counter-surveillance techniques. Burton and Stewart make the same point, saying that “because of this weakness, countersurveillance [sic] operations can be very effective at catching militant operatives when they are most vulnerable — during the surveillance phase of the terrorist attack cycle”. Counter-surveillance planning must be an integral part of any security plan directed at protecting a facility against potential terrorist attack. It must be remembered that counter-surveillance consists of two components; detection and investigation. The facility personnel will be actively involved in the detection phase, but the investigation phase, for a variety of practical and legal reasons, must be conducted by law enforcement. This means that the facility must establish an active relationship with local law enforcement organizations and develop procedures for reporting the detection of potential surveillance operations. While facility security staff will be an essential component of any counter-surveillance operation, every employee of the facility must be trained in the basic requirements of counter-surveillance operations; the more eyes that are watching for potential surveillance activities the better. High-risk chemical facilities must establish internal reporting procedures and actively encourage reporting of suspicious activity. The most obvious surveillance technique is someone taking detailed pictures or making drawings of the facility. More sophisticated surveillance operations will also include a personal approach to facility personnel asking questions about procedures, schedules and security. For terrorist operations this type of approach will typically be fairly clumsy and obvious; it takes a great deal of training to bring-off this type surveillance without raising suspicion. Surveillance Does Not Always Mean Terrorists One final note must be made in any discussion of counter-surveillance operations. Not everyone that is looking at a chemical facility is a terrorist. There are a number of constitutionally protected reasons that someone may be watching a chemical facility, even a high-risk chemical facility. Surveillance from public property, like roadways and sidewalks on public rights-of-way, is not illegal; suspicious perhaps, but not illegal. Harassment or interference with such protected behavior can certainly lead to expensive lawsuits and even criminal prosecution. This is one of the most important reasons to leave investigation to law enforcement personnel. Law enforcement is supposed to receive appropriate training to identify such protected behavior.

Another Attack on Canadian Gas Wells

Earlier this week the Associate Press reported another explosive attack on a natural gas metering shed in British Columbia. As in earlier attacks, the site was in a remote location with no personnel present so no one was hurt. Apparently the RCMP has no suspects, but the first attack in the series was accompanied by a written demand for oil and gas companies to halt operations in the area. News reports have labeled these eco-terrorist attacks though that is not proven by any legal standard. It may just be someone with a personal grudge against Encana, the owner of the facilities that have born the brunt of the attacks. In any case, some one is willing and able to use violence against these facilities to affect a political-economic objective. As such it certainly fits the general definition of terrorism. Potential for Escalation? As in many eco-terrorist attacks the attacker is apparently taking pains not to hurt anyone during these attacks. In the minds of most people this lessens the seriousness of the attacks, in the opinion of many people it even might make the attacker something of a hero figure. The problem is that there is no guarantee that the attacker will not make a mistake or miscalculation that would result in serious injuries or the death of innocent bystanders or company employees. There is little reason for the oil and gas companies to acquiesce to the demands and every financial reason not to. As long as the damage inflicted is limited in scope and remains in remote locations, the companies will repair the relatively minor damage and little more. There will be periodic pressure put on the police to capture the criminal, but there will be no significant increase in security measures at these remote locations. Sooner or later the bomber will realize that continuing the current attack profile is not working. Either the attacks will stop, with the bomber accepting defeat, or the bomber escalates to achieve the objective. Once escalation starts there are only three possible outcomes: Success, the oil and gas companies close down operations and leave, or Failure, the bomber realizes the futility of the attacks and quits, or Capture, the bomber is captured or killed by security personnel. The first two outcomes are unrealistic and extremely unlikely due to the nature of the adversaries. That leaves the third with the realization that the escalation will likely continue to advance until that outcome occurs. The question then becomes, how long can the current attack pattern continue until frustration overcomes the apparent reluctance to hurt people. Unfortunately that question can only be effectively answered in hind sight. Lessons for High-Risk Chemical Facilities While oil and gas facilities may be considered chemical facilities in the broadest sense of the term, the remote production facilities being attacked by this bomber are fundamentally different from most chemical high-risk chemical facilities covered by CFATS. These are remote, stand-alone facilities with no routine personnel attendance. With that in mind we have to be careful when we try to extrapolate lessons to more conventional chemical facilities. Counter-surveillance Probably the most important lesson is that the lone-wolf bomber does exist as a potential adversary. This type terrorist is the one of the most difficult for law enforcement to detect before the first attack. There is little possibility of this terrorist contacting a police informant for assistance; the most common way that terrorist plots are brought to the attention of police or security personnel. This makes it all the more important for facilities to have an effective counter-surveillance plan in place to detect the lone-wolf bomber during the surveillance process. The individual working alone has to conduct personal reconnaissance to be able to effect a successful attack. National vs Facility Threat Level The other important lesson that needs to be addressed is that there may be a threat of terrorist attack against a facility that has nothing to do with the terrorist threat against the nation. These attacks in Canada appear to have nothing to do with Al Qaeda or other jihadist organizations. High-risk chemical facilities need to pay attention to all public and private grievances against the facility, company or industry as potential sources for growing lone-wolf attackers. All overt threats communicated to the facility need to be reported to authorities. Any facility should report such threats to local police. High-risk chemical facilities need to include the FBI and DHS in their reporting structure. Most of the threats received will lead to nothing. Failure to share all threats with government investigators may lead to an unexpected attack that could have been prevented. This means that facilities must have a procedure for receiving reports of threats and forwarding them immediately to facility security and management. There should also be a procedure in place for reporting these incidents to authorities. This includes identifying, in advance, points of contact with local police and FBI intelligence organizations. Establishing a relationship ahead of time will ensure that reports receive the appropriate attention. Lone-wolf terrorists are the most difficult to detect in advance of their initial attack. They can also be the most difficult to stop from conducting follow-on attacks. Fortunately, they are rare, but not so rare that high-risk chemical facilities can afford to ignore their potential existence.