Accidentally Making Terrorist Explosive

I ran into two interesting articles over on ChemistryWorld.com relating to two separate (separated by the Atlantic Ocean) student lab experiment that resulted university evacuations, the closure of chemistry labs, and an examination lab procedures. In both incidents, students inadvertently, produced an explosive beloved by terrorists due to its instability and explosive power. Let’s look at the most recent article first.

The first paragraph of that article describes the lab manufacture of a “small amount of a shock-sensitive explosive chemical”, that had been accidentally produced in a University of Delaware chemistry lab. I immediately flashed back to high-school chemistry where we convinced the Chem Professor (yes, I had a PhD Chemist as an instructor in high school, a story for another day) that we could use a jar of iodine crystals to show friends and family the wonders of chemistry; nitrogen tri-iodide, a well known ‘contact explosive’. Unfortunately for the administration of the Delaware lab, the students in this case were not making NI3 (a relatively low power explosive), they made triacetone triperoxide (TATP), a higher powered explosive that is almost as easy to detonate.

There were no details in the article on how this ‘accident’ occurred, but TATP is relatively easy to make, even though it is potentially dangerous, and extremely dangerous to purify. That was the reason for the evacuations and lab closures. To determine how this could ‘accidentally’ occur, we need to look at the earlier article, dating back to 2017.

While the details are only of interest to an organic chemist, the short description is that a chemical reaction was being undertaken, using acetone as a solvent. To reduce a byproduct of the primary reaction hydrogen peroxide was added to the vessel. Instead of calculating how much hydrogen peroxide was needed they used a large excess. The excess reacted with the acetone to form TATP. Again, the labs were evacuated, the area closed, and bomb disposal folks called in. Both incidents ended without explosion.

The big problem here is that TATP is a simple explosive to make and the base materials (acetone and hydrogen peroxide) are readily available at big box stores and beauty supply stores. It is so easy to make, it is being made by accident college labs.

Review - ChemLock Exercises – Chemical Sector IED

NOTE: This is the first in a series of blog posts looking at various CISA Tabletop Exercises Packages (CTEP) offered to chemical facility managers by the new CISA ChemLock program, a voluntary chemical security program run by the Office of Chemical Security (the CFATS folks). It is a follow-up to my earlier Overview post. CTEP administrative documents can be found here. The scenario manuals can be found here.

This post looks at the Chemical Sector IED (docx download link) (BTW: someone needs to talk with CISA about the hazards of links that automatically download MS Office or .PDF documents) scenario. For those of you who have played wargames or D&D, this scenario is going to be a bit of a disappointment. There is no dungeon master script and there are no unit markers with strength points and movement allowances. More importantly, there are no winners. These scenarios provide a brief generic description of an attack and its aftermath with a series of discussion questions about what should have been done, what should be done, and who had responsibility for the various actions.

The Scenario Document

The basic scenario document downloaded from the Physical Security Scenario page consists of a Word® document that facilities can customize for their situation. It contains three modules:

• Incident and Response,

• Sustained Response, and

• Short-Term Recovery.

Each module contains a brief and rather generic description of the each phase of the incident and a series of questions to guide a discussion between the exercise participants about actions that could have been taken before during and after each phase of the incident to mitigate the effects. Some of the questions will not be appropriate for smaller scale exercises with limited (or no) outside participation. Those questions should just be ignored during the exercise. Management may want to raise those questions, though, with the Local Emergency Planning Committee (LEPC).

Alternate Use

While these questions were designed to be discussed after a facility has had a chance to develop a site security plan (SSP), an enterprising security manager would do well to look at these questions while developing that SSP. The questions, while not exhaustive, are comprehensive and provide a good look at what the site security plan should include for this particular scenario. They provide an informed look at some of the issues that the plan should be expected to address.

For more details, including the major discussion questions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/chemlock-exercises - subscription required.

CFATS and the ‘Insurrection’

While Wednesday’s incident at the Capital in Washington D.C. was a relatively low-level personal violence event with no ‘weapons of mass destruction’ employed (there have been reports of some pipe bombs and Molotov cocktails discovered, none were actually used), there have been increasing concerns expressed in the media (see here, here and here for example) about the potential for violence next week in the days surrounding the inauguration of President-Elect Biden.

I have seen nothing from CISA expressing any specific concerns, nor has there been any advisories published on the National Terrorism Advisory System. There have been, however, two rather innocuous tweets (here and here) from the @cisa.gov account about improvised explosive devices (IEDs). Facilities that store, use or manufacture IED precursor chemicals (many regulated under the Chemical Facility Anti-Terrorism Standards as Theft/Diversion IED chemicals) should probably take a quick look at their security and shipping procedures related to those chemicals and take action to insure that their facility is not linked to any news reports next week about the use of IEDs.

Chemical facilities regulated under the CFATS program for such IED precursors should already have approved security measures in place to protect those chemicals from theft or diversion. Such facilities should probably conduct a inventory review to insure that none of their regulated chemicals are missing as well as a review of recent shipping records to determine if any of those chemicals were shipped to unusual customers or delivery addresses. Any discrepancies should be reported to the FBI and CISA’s Infrastructure Security Compliance Division.

 While many extremists of various right-wing groups were identified in the January 6^th event, a very large number of the protestors involved were ordinary Americans, many in positions of trust (see here for example). Facility management must realize that they almost certainly have employees and contractors working at their facilities who have some level of sympathy for President Trump and some may actively support the ‘Stop the Steal’ movement. That is not to say that these employees would necessarily support the employment of IEDs or the theft/diversion of precursor chemicals, but prudence would suggest that companies keep a closer than normal look at security and inventory control measures that could be easily circumvented by insiders.

CFATS and the Nashville Bombing

I have been waiting patiently since the bombing in Nashville on Christmas day on information about the explosive used to talk about its potential impact on the Chemical Facility Anti-Terrorism Standards. The use of ammonium nitrate or some other ‘conventional’ improvised explosive would have called into question the effectiveness of the CFATS program in preventing the theft/diversion of IED precursor chemicals. Well, the unofficial word appears to be out that the CFATS program has no worries, but maybe the rest of us do.

The Article

I ran across an article on thedailybeast.com that posits that the bomb appears to have been a fuel-air bomb (or thermobaric weapon), an explosion created by the detonation of a large mass of flammable gas. The military likes this type of fuel-air explosive (FAE) for destroying things because they create a large area of over-pressure that has a propensity for collapsing structures and is useful in detonating mine fields. It is the former capacity that would have apparently been the intended use of the Nashville bomber.

According to the article, the bomber apparently released a flammable gas from a pressurized cylinder (propane would be a likely choice) inside the motor home used as the vehicle in the vehicle-borne improvised explosive device (VBIED) and then detonated it when it had reached an appropriate fuel-air mix within the vehicle. The problem posited by the article is that the bomber would probably already be unconscious or dead from asphyxiation by the time the proper concentration were reached.

Background

To understand the limitations of an FAE you have to understand two flammability concepts well known to chemical process safety professionals, LEL and UEL. LEL is the ‘lower explosive limit’ for a chemical, the minimum concentration of the chemical in air that can be ignited; below that limit there is too much distance between the molecules of that chemical in the air to sustain combustion. Similarly, the UEL is the ‘upper explosive limit’; above that limit there is not enough oxygen in the air to sustain combustion.

The LEL and UEL is well known for all industrial chemicals. There is a nice table over on the engineeringtoolbox.com that provides the UEL for common industrial gasses. The table shows the limits for propane (for instance) as 2.1 to 10.1% respectively.

Now the total energy released in a FAE is directly related to the total weight of the material that will be oxidized in the conflagration, typically carbon, nitrogen and hydrogen. So, generally, the higher the UEL the more material available for combustion and the more energy released. Simplistically, the more stuff, the bigger the boom.

Hmmm. Looking at the table acetylene would be a much better flammable gas than propane; hardly surprising to anyone that has seen fires at acetylene facilities.

One last technical issue, you can get bigger, faster explosions by adding more oxygen to the atmosphere.

Why No More IFAEs?

Okay, if these improvised fuel-air explosives (IFAEs) are so impressive why haven’t they been more prevalent? Why is this possibly the first one in a terror attack? There are a number of technical problems with IFAEs. The first is mixing. If the flammable gas is not adequately mixed in with the atmosphere you will have portions of the containment (the motor home in this case) where you are below the LEL or above the UEL. If your detonator (flame source) is in either of those areas, you will not get a detonation. If your concentration (even if well mixed) is too close to the LEL you will get a fire that burns out too quickly due to lack of fuel; same for being too near the UEL but for lack of oxygen.

You also have to be very careful to remove any unintended sources of ignition, including static discharges from releasing the gas into the containment area. Any premature ignition will lead to underperforming explosives due to the mixing issues described above.

The military solved these problems with their thermobaric weapons through lots of engineering, trial and error and lots of repetition. Terrorist bomb makers are going to have to go through the same type development process. It is much easier to just use the readily available conventional IEDs.

No CFATS Problem?

If it is confirmed that the Nashville bombing was an IFAE, there will be no finger pointing at the CISA CFATS program because the program does not attempt to regulate flammable gasses as theft/diversion security threats. While many of the chemicals listed in the table mentioned above are on the Appendix A, 6 CFR Part 27, list of DHS chemicals of interest, they are all regulated as release-flammable security threats. Security measures are put into place to ensure that industrial storage tanks of these materials are not ignited or turned into local FAEs.

Could they be regulated as theft/diversion chemicals of interest? Not likely. DHS has not been able to come up with a cost-effective way to regulate the sale of ammonium nitrate, a much less common but better understood IED precursor. How would they be able to regulate the sale of propane cylinders or even acetylene cylinders?

Tannerite and the ANSP

I had an interesting discussion last week with a reader who must remain anonymous (for professional reasons) about the technically still pending Ammonium Nitrate Security Program (ANSP) and explosive targets sold under the brand name Tannerite®. Anon was concerned that the sale of these binary explosives was not covered under the ‘proposed’ ANSP (all but dead) nor in the recently released Sandia Labs report on ammonium nitrate.

Anon is correct that the commercial sale of these targets would probably not be covered by the proposed ANSP. There is a 25-lb minimum on the amount of ammonium nitrate (AN) being sold to require buyer registration under that program. With the largest single packaging currently being sold on the Tannerite web site containing only eight ‘one-pound targets’ (containing presumably substantially less than 1-lb of AN), the company could very reasonably restrict sales enough to keep their customers from having to register).

Anon’s question is why would an ‘explosive target’ not be included in a security program designed to block the use of ammonium nitrate in improvised explosive devices (IED)? The answer to that question addresses the problem that DHS continues to have with their congressional requirement to regulate ammonium nitrate security to prevent its use in IED’s; money. And, unfortunately, we are not talking about the money lobbyists are spending to stop regulations; we are talking about the cost of regulations.

ANSP Costs

DHS estimated that the cost of their proposed Ammonium Nitrate Security Program would range somewhere between $300 million to $1.041 billion over 10 years with the actual expected cost closer to about $670.6 million. The largest variable in that overall cost estimate (and the largest part of the estimated cost) is the cost of the point-of-sale regulations.

Congress requires that potential regulators look at the cost benefit of their proposed regulations, and DHS did so with their ANSP notice of proposed rulemaking (NPRM). Using the Murrah Building attack (the only large scale AN based terrorist attack in the United States as their prevention standard, DHS calculated a payback period of 14.1 years for the ANSP. Or in plain-speak, if the ANSP prevented a Murrah scale attack every 14.1 years, the program would pay for itself. Since it has already been 24 years since that bombing, and a similar attack has not taken place, and the ANSP has not been in place, it seems like the price of the program is too large. That is, in fact, why DHS has not finalized the ANSP, it is not justified on a cost/benefit basis.

Smaller Scale Attacks

It would take a huge number of explosive targets (or medical cold-packs, another small-scale product that uses ammonium nitrate) to make up a Murrah Building scale bomb. The buyers of that type of quantity would stand out even without the ANSP and some law enforcement agency would be investigating. A huge number of small-scale purchases would not attract attention but would be logistically very difficult to accomplish.

No, binary targets and cold-packs would only be used in small-scale devices like the IEDs used in the September 2016 attacks in New York City. The one device that detonated did not kill anyone, but it did injure 29 people. The ANSP would not have prevented that attack. A federal program that would prevent that scale of IED attack by limiting the purchase of small amounts of ammonium nitrate would be significantly more expensive. It would have to prevent more than one such attack a year to be ‘cost effective’ based upon the $95 million cost per-year estimate for the ANSP program. The higher cost of the expanded program would probably require preventing an attack every couple of months to be effective.

Of course, it should be remembered that for small-scale IED’s ammonium nitrate-based weapons are fairly complicated and requires some small level of expertise to employ. There are a number of lesser skilled options available to the casual IED maker, black-powder or gunpowder pipe bombs being the most common examples in the US. And I will not even discuss the much less dangerous ‘mail-box bombs’.

This is one of the reasons that DHS has reached out to stakeholders about looking at the broader improvised explosive device issue. It is much too early to talk about this effort as being a rulemaking (especially since Congress has not specifically provided authority for an expanded rule making), but folks seem to be looking at establishing some sort of voluntary retail identification check program for some sort of list of chemicals that could be used to make IEDs (almost certainly not including mail-box bombs).

IED Precursor Chemical Study Published

Today the DHS Chemical Facility Anti-Terrorism Security (CFATS) web site was updated to include links to a pre-publication copy of the report of the National Academies report on possible modes of regulating improvised explosive device (IED) precursor chemicals. This study was commissioned by DHS in August 2016 as part of their efforts to craft effective regulations for the prevention of the use of ammonium nitrate in IEDs.

A quick review of the 191-page document would indicate that the study committee has taken a very nuanced look at the issue of controlling precursor chemicals to prevent their use in the construction and use of IEDs by terrorists. There is no quick fix proposed by the study. Instead they have produced six broad recommendations:

Federal, state, local, and private sector entities attempting to reduce the threat of IED attacks by restricting access to precursor chemicals should focus on both person-borne and vehicle-borne IEDs.

Federal, state, local, and private sector entities attempting to reduce the threats from person-borne and vehicle-borne IEDs should consider multi-chemical, rather than single-chemical, strategies.

Federal, state, local, and private-sector entities attempting to reduce the threats from person-borne and vehicle-borne IEDs should focus on retail-level transactions of precursor chemicals, especially e-commerce.

Federal, state, local, and private-sector entities should explore strategies for harmonizing oversight of the sale and use of commercially available kits that contain precursor chemicals that are specifically designed to be combined to produce homemade explosives.

US DHS should engage in a more comprehensive, detailed, and rigorous analysis of specific provisions for proposed mandatory and voluntary policy mechanisms to restrict access to precursor chemicals by malicious actors.

The federal government should provide additional support for voluntary measures, activities, and programs that can contribute to restricting access by malicious actorsto precursor chemicals used to manufacture IEDs.

I will be taking more detailed reviews of various portions of the study in future blog posts.

Gas Bombs

It appears that the folks at PublicIntelligence.net are back functioning again and have recently published another interesting intelligence document, this one from the Maryland Coordination and Analysis Center. The Maryland Fusion Center produced this ‘Officer Awareness Bulletin’ on Trash Bag (Balloon) Bombs last May; the document is marked ‘Unclassified/For Official Use Only’.

Security Warning: Government employees and contractors; under the Obama Administration’s WIKI Leaks doctrine, you may be subject to disciplinary action up to and including dismissal if you are caught reading the FOUO document without specific authorization.

The Bulletin describes the use of trash bags filled with a lighter-than-air flammable gas as an improvised explosive device. They note that acetylene is a commonly used gas for these IEDs. Its wide flammability range and ease of ignition make it more effective than the other commonly available flammable gas, propane. Acetylene gas bag bombs can self-ignite due to static electric accumulation and discharge while propane bombs would typically require some sort of flame producing detonator. Note: self-igniting bombs are very difficult to control.

They report two specific instances where these devices have detonated, producing personal injuries and relatively minor property damage. It notes that these were described on-line as early as 1985 (okay, ‘on-line’ is a stretch, my term not the Fusion Center’s) in the hacker e-zine Phrack. I actually played with a couple of these ‘devices’ in the early 70’s so this is not something really new.

Because of the small amount of explosives that can be ‘packed’ into these ‘devices’ (trash bags are not really pressure vessels), these are not very effective IED’s except in confined spaces where the overpressure effects can be maximized. It is difficult to attach anti-personnel projectiles to these balloons; it doesn’t take much to weigh them down and trash bags are very easy to tear. In short, these IED’s are not very effective weapons. I will give the Maryland Fusion Center credit; the Bulletin does not overhype the potential dangers of these devices.

Because there are a number of YouTube® videos showing these things making impressive looking explosions; lots of noise and flash; law enforcement types certainly need to know about the potential dangers associated with these devices. From a security perspective I suppose that these things could be used as distractive devices or even as initiators of secondary fires and explosions in flammable environments, but the difficulty in timing the detonation greatly reduces their potential effectiveness in these applications. If someone has access to appropriate detonators there are much more effective IED explosives readily available.

Commercial Peroxides

In a blog last month about academic lab alternative security programs I mentioned the IED precursor chemicals that had been bought by the suspected terrorist in Denver earlier this year. I said then that I would probably address the question of why such materials were not chemicals of interest under CFATS. Well this slow season during the holidays seem like a good time to address such issues. Pressure Events The first thing that people have to realize is that there are a wide variety of readily available commercial products that can be used to make an ‘explosion’. Most people consider it an explosion when a chemical reaction produces a gas in a sealed jar and the resulting gas pressure builds up to the point where the jar ‘explodes’ sending pieces of glass flying. While military and security people don’t really consider these ‘pressure events’ to be explosions, they are used to damage property and hurt people. DHS has not attempted to regulate the chemicals that go into these types of ‘explosives’ for two basic reasons. First the potential damage from these devices is so limited that they really are not useable as terrorist weapons. The second reason is that the number of potential chemicals used in such devices is so large that there is no practical way to regulate them. For a really ludicrous example look at the ‘explosion’ resulting from the combination of Mentos® candy and Coke®. Peroxide Explosives Now the alert reader will be quick to point out that the peroxide explosives that could be made with hair care products involved in the Denver case are explosives in the military sense. That is that the chemical reaction is in reality a really fast burning fire that produces a great deal of pressure in a very short period of time. Properly enclosed in a metallic casing these explosions can produce significant damage over a large area. Various peroxides are of particular significance when looking at a large number of improvised explosives. Chemically speaking they contain readily available oxygen that promote a wide variety of chemical reactions. From a security point of view they speed up the rate of combustion for many materials so that the other chemical now explosively burns. These peroxides are available in a wide variety of commercial products, including cleaning products, hair colorings, and hygiene products. The concentration in these products is so low that they would have no appreciable affect on the rate of burning. Unfortunately, a chemist or chemical technician can figure out ways to extract the peroxides from these products to produce a concentrated enough to peroxides to be used in improvised explosives. There is a problem with this however. You really have to know what you are doing when completing the extraction/concentration process. Nearly all of the techniques require the application of heat and that is always a dangerous thing to do to peroxides. They are unstable molecules that readily give up their excess oxygen (which is why they are used in explosives in the first place). If you don’t follow procedures exactly the premature of release of oxygen will result in small explosions in your equipment. Some will be true explosions while others will be pressure events. Dirty equipment or poor temperature control make this result even more likely. While the explosions will be small on a relative scale, they will certainly be large enough to destroy the processing equipment while killing or injuring the operators. Peroxide COI DHS took all of this into account when they set their minimum concentrations for peroxides when they established their list of DHS Chemicals of Interest (Appendix A to 6 CFR 27). Generally speaking the concentration listed in the appendix are those that are readily useable as improvised explosive components. This is why peroxide containing hair products are not covered materials under CFATS. This does not mean that DHS and the FBI are ignoring the potential use of lower concentrations of peroxide in commercial products. As I noted in an earlier blog DHS has established a voluntary program urging retailers and distributors of a variety of peroxide containing materials to watch out for odd purchases of these materials. The lower the concentration the larger the amount of material needed to extract sufficient quantities of peroxide to make terrorist weapons. This means that typical, legitimate users of these materials do not need to be hassled to prevent terrorist use of these chemicals.

Counter IED Symposium

Thanks to Stephen Melvin at OurSafeTowns.com for letting me know about a Counter IED Symposium being held on December 1st thru 3rd in Washington, D.C. The Interagency Council for Applied Homeland Security Technology (ICAHST) is sponsoring this event. The symposium will address key issues and critical mission needs in support of IED defeat and prevention in the United States and reflect on the differences between military and civilian response needs. According to the agenda on the NCSI web site the symposium will focus on the following critical areas:

“Threat Environments: Domestic and Military Response; “Threat Analysis: Research and Technology; “Incident Response and Training; and “Information Sharing.”

This symposium is really targeted at Federal, State and local government agencies that will be charged with responding to IED incidents in the United States. The NCSI web site does note that “industry, academia and laboratories sponsored by the Government” will be attending the event. While I don’t suspect that will include many high-risk chemical facilities, I would hope that some industry organizations like ACC or SOCMA will have representatives in attendance. Registration information is available on-line.

Improvised Explosive Awareness Training

Last week I came across a notice on the American Chemistry Council’s Responsible Care® website announcing an improvised explosive awareness training course being put on by the Chemical Branch of the DHS Sector Specific Agency. The notice announced a January class in Houston, TX with later classes in Los Angeles, Dover, Newark, Detroit, and Chicago (exact dates yet to be announced). It also provided a point of contact at DHS for further information, whom I have contacted. Nohemi Zerbi (Nohemi.zerbi@dhs.gov, (703) 235 – 2871) was kind enough to provide me with a flyer for the Houston class. To register for the free class (first come, first serve) you just need to contact Nohemi. Registration is limited by the number of seats available at the venue. In any case, registration closes on December 23, 2008. This is a day long course (8:00 am to 4:30 pm). It will address the basics of both improvised explosive devices (IED’s) and vehicle borne IED’s (VBIED’s) with a view to reducing vulnerabilities and providing “information sharing resources to improve preparedness”. It looks like the target audience is probably corporate security types or possibly Facility Security Managers. I am trying to get some further information on the background of the presenters and some more information about the level of detail that will be provided. If and when I get additional information, I will let you know.