IST Questions – Active Mitigation

This is another of a series looking at how DHS might construct an Inherently Safer Technology Assessment Tool (ISTAT) for the Chemical Security Assessment Tool if Congress were to include a requirement for conducting an IST assessment as part of their legislation to make the CFATS program permanent. The other postings in the series were:

An IST Tool for CSAT
Reader Email – 03-04-10 IST Rules
IST Questions – Inventory Management
IST Questions – Chemical Substitution

 As I explained in the initial posting in this series active mitigation systems include automated, active safety systems that chemically or physically modify an RTCOI so that a catastrophic release of the material does not have a significant effect outside the facility boundaries. The main controversy with these systems is their reliability in the destructive environments associated with terrorist attacks. Because of this controversy, the initial questions will establish the efficacy of the system.

Chemical Neutralization 

The initial questions will establish the existence of chemical reactions that will convert the RTCOI to a chemical that does not present the same vapor phase toxicity. Follow-up questions will look at how quickly the reaction proceeds and examine the byproducts, chemical and physical, of that reaction. Finally the questions will examine if it is possible to design an automated system to effect the chemical neutralization that does not require operator action and will proceed in the event of loss of power or computer control.

Once the effectiveness of the neutralization system is established, the cost of the system will be established. As in earlier process changes that require new equipment these questions will address engineering estimates for the costs of these installations. As with any preliminary estimates they will include known costs (e.g.: list cost of storage tanks) plus a standard engineering markup to cover installation costs. DHS would have to establish a standard method for determining that markup.

Physical Neutralization 

Typically physical neutralization systems convert the vapor phase of an RTCOI into a form that would not leave the confines of the facility; the most common is one that uses a solvent spray to dissolve the released toxic vapor. The initial questions will look at the efficacy of the spray system, establishing the amount of solvent necessary to knock down a catastrophic release of the material from the single largest container on site. Subsequent questions will establish how the system will be designed to remain effective if power systems are shut down by the terrorist attack. Again, once the efficacy of the proposed system was established the costs of the system would have to be examined.

100% Efficacy? 

One political question that would have to be addressed with this type of IST program is whether or not the neutralization system would have to achieve 100% neutralization to be considered an adequate IST system. The argument can be made that reducing the amount of the RTCOI that leaves the facility to an amount less than as the Tier Reduction Quantity (TRQ) or the Facility Elimination Quantity (FEQ) established for that facility would be a sufficient risk reduction to meet the requirements for the current language in HR 2868. Thus 100% efficacy would not be required for these systems.

Reader Comment – 12-10-09 – Water Sprays

Yesterday, our good friend Anonymous left a response to my blog on the use of water sprays as a mitigation measure for toxic release incidents. Anonymous wrote: “Water sprays and other consequence-reduction mitigation measures are sensible for many cases, but they wouldn't be a silver bullet for toxic release attacks: Attackers might sabotage a facility's spray system before releasing toxic chemicals stored there.” Anonymous is absolutely correct. There is no fail-safe system for preventing adverse consequences of a chemical release, just as there is no fail-safe security measure. Nothing is certain in life except death. Having said that, mitigation measures are less vulnerable to intentional disruption then are primary security defenses. The reason for this is that they are harder for an outsider to detect during off-site, or even surreptitious on-site surveillance. The most likely way for them to be identified would be through insider assistance. Since mitigation measures are primarily safety systems rather than security measures, they should be designed to be hard to turn off or disrupt. Only a very limited number of personnel should have access to their controls. Any modification to safety systems should result in multiple alarms going off to warn personnel that a safety critical system has been disabled. Such alarms typically require immediate shutdown of unprotected systems or the application of manual response measures. The same actions would reduce the risks associated with a terrorist attack. But, Anonymous still has a valid point; a mitigation measure should never be considered as a substitute for proper security. It should be part of the multi-layered security system, just as it is only a part of the facility safety system. Facilities should never rely on a single a single security system or a single safety system.