OMB Approves Rail Security ICR Revision

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an ‘Extension without change’ for the Transportation Security Administration’s information collection request (ICR) for “Rail Transportation Security” (this ICR does not include the new cybersecurity reporting requirements). While OIRA calls this an extension without change, they report that there is a minor decrease in the number of responses and hour burden estimates. TSA does not address this minor change in their supporting documentation.

TSA does report one minor process change in this ICR. On page 4 of the Supporting Document, TSA reports that they are now providing “an additional electronic option for reporting significant security concern information” to supplement the telephonic reporting of incidents. They do not provide any specific information on that process other than noting that: “TSA does not require that a specific form be used for submitting information electronically as long as the information provided is consistent with the requirements of the information collection.” TSA reports that: “. In general, electronic reports were found to be more detailed when compared to telephonic reporting; improved ease of use and accuracy of reported data; and reduced the need for subsequent calls to address transcription errors and collect additional information, leading to expedited analysis of security concerns.”

Review - Changes in TSA Rail Security Burden Estimation

On Tuesday, I reported that the TSA had published a 30-day ICR extension notice in the Federal Register. I noted that there was a minor discrepancy in the reported burden number. Since then, the OMB’s Office of Information and Regulatory Affairs (OIRA) has published the supporting document submitted by TSA in their extension request for this ICR. While this information explains the burden discrepancy, the total data submission to OIRA makes it clear that this is an ICR revision, not a simple extension.

The table below shows the data abstracted from Section 12 of both the submitted supporting data document and the supporting document for the currently approved ICR.

	Proposed Estimate		Current Estimate
	# Responses	Burden	# Responses	Burden
Security Coordinator	475	475	475	475
Location Reporting	327	164	655	328
Security Concerns	4,961	4,961	4,961	4,961
Chain of Custody	214,000	107,000	214,000	107,000
Total	219,763	112,600	220,091	112,764

While there is nothing nefarious about the discrepancies in the changes made in the supporting information for this information collection revision, the TSA continues to have substantial problems with their ICR documentations. While the recent Federal Register notice classified this as an extension of a currently approved collection, this is clearly a revision of the ICR. TSA has provided OIRA with an adequate explanation for the revision, but TSA continues to be sloppy and vague about their public reporting about their ICRs. Unfortunately, OIRA will undoubtedly approve the changes to this ICR, as they have so often in the past.

For more details about the change in burden estimate, as well as other changes in the information collection request, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/changes-in-tsa-rail-security-burden - subscription required.

Bills Introduced – 06-15-15

There were 32 bills introduced in the House and Senate yesterday. Only one of them may be of specific interest to readers of this blog:

HR 2786 To require the Commissioner of U.S. Customs and Border Protection to submit a report on cross-border rail security, and for other purposes. Rep. Vela, Filemon [D-TX-34]

I’m not typically a big fan of report generating bills, but it would be nice to have CBP take a look at this situation. It will be interesting to see if TSA is to be involved.

Byproducts and Unintended Consequences

There is an interesting discussion going on over on the Hazardous Materials Emergency Response (group membership required) group on LinkedIn about one of the byproducts of the current crude oil glut. As more expensive crude oil production sites are closed off due to the low market price of crude oil, there will be a reduction in the amount of crude oil transported in the US and Canada by railroad. One would like to think that this will lead to an increasing number of the most hazardous DOT 111 railcars being taken out of crude oil service.

Bill Barnholt, Cobra Hazmat/Safety Consulting & Training, writes in his discussion that:

“This means that there's going to be hundreds of (hopefully residue not loaded) tank cars being stored in areas that aren't used to having them around. This also increases the possibility of sabotage of the tank cars being stored. This will make the need for Emergency Responders even greater.”

Now this is not really an unusual occurrence. There are certain types of railcars that are periodically idled. The use of grain transport hopper cars, for instance, drops off dramatically after the harvest has been transported to market. The cars that are not actively in use are parked on some sort of non-active track until they are needed again.

The problem with these crude oil railcars, however, is that they may contain significant amounts of crude oil residue. While there certainly isn’t enough in a rail car to cause the sorts of fires that we have seen in the last year or so, there certainly is enough flammable vapors in these cars to cause a sizeable explosion if enough oxygen is present and there were some sort of ignition source.

I know that sounds dangers but there are two important ‘ifs’ in that statement. First enough oxygen must be present. We would expect these cars to be closed and, unless someone deliberately introduced oxygen into them, it is highly unlikely that there would be enough oxygen to support combustion inside the car. Second you would need a heat source (fire, electrical spark, etc) inside the car to provide an ignition source.

The very low probability problem could be eliminated by washing out the crude oil residues out of the railcars. Anyone that has ever cleaned a greasy auto part will have some inkling of the problems that are involved in this process. Needless to say this is not something that can be done safely or environmentally soundly just anywhere. Special facilities are required, the wash residue is typically a hazardous waste, and everything about this is quite expensive.

To the best of my knowledge there is no regulatory program that would require the owners of these cars to have them cleaned prior to parking them on a siding somewhere. Even more scary is the fact that there are no regulations that govern the security of these railcars that contain only residues. And there are certainly no rules governing where they can be parked.

Theoretically it would be fairly simple to turn these residue containing tank cars into rather impressive bombs. Some of the equipment would be a tad bit heavy for transporting by hand and it would take a little bit of knowledge about rail car fittings, but with the proper equipment and about 30 minutes access to the railcar a vapor phase explosion could be produced.

The effects of the explosion would be dependent on a number of factors, most of which would not be readily discernable before the attacker opened the railcar. I would expect, however, that if enough crude oil residues were present, it would be possible to produce a large enough explosion to damage nearby structures, kill people, and attract national news attention. In other words, it would be a successful terrorist attack if it took place near inhabited areas.

It is certainly too late to start any legislative or regulatory action to address the immediate issue. Local police departments should probably plan on actively patrolling these parking areas and all first responders should have a good idea where these railcars are parked in and near communities.

Other than that the best we can do is to continue to hope that the various wackos that wish to create death and destruction in support of whatever cause ignites their anger continue to lack the creativity and knowledge necessary to execute these types of attacks.

Short Takes 12-22-13

Just some more things that I did not get a chance to address during the week.

Another Parked Train Derailment

While the actual accident came on the 13^th early this week brought the announcement that BNSF railroad was offering a reward of $100 Thousand for information about the apparent vandals that released the breaks on a parked train car in Tulsa, OK. The released cars (not a whole train) rolled back onto a mainline track and into an on coming train.

No chemicals (other than 100-gal of diesel fuel) were spilled in this accident and there was no fire. If someone were, however, interested in making a nasty chemical mess, this looks like it might be a way to accomplish the task with the proper selection of either the parked cars or the passing train. The rail community needs to take a close look at this incident and come up with a better way of dealing with parked train security.

TSA Security Solicitations

TSA recently published two interesting solicitations for security proposals; one for ID authentication and one for monitoring high-risk rail car movements.

In the first the TSA is looking for the development of a “Credential Authentication Technology (CAT) system” that would allow them to verify a wide variety of identity cards. Once TSA vets such technology, it would only be smart to move it security checkpoints at other critical infrastructure locations that have a wide variety of visitors.

In the second TSA is looking for a more timely method of tracking rail security sensitive materials than the current reporting method directed by 49 CFR 1580.103. A technology solution is being looked for instead the current phone reporting method.

DHS Morale – A GAO Report

The GAO published a report this week on efforts to improve employee morale at DHS. It updates earlier reports from February and September 2012. They note that DHS has put some improvement programs into place, but as we’ve come to expect from these GAO reports, complains that DHS has not included methods to measure and track changes in morale brought about by these efforts.

Illegal Trade in Cyber Weapons

An interesting, but brief article over at NextGov.com about a provision in NDA passed this week that requires the government to “suppress the trade in cyber tools and infrastructure that are or can be used for criminal, terrorist, or military activities while preserving the ability of governments and the private sector to use such tools for legitimate purposes of self-defense”. An interesting point is made about who will determine if something is a cyber weapon or a legitimate cyber tool. Another point made is if we cannot control physical arms trade which is easier to physically detect and track, how are we going to be able to track software trade?

Cybersecurity Follows Safety Culture Model

An interesting article over at Automation.com compares the current ICS cybersecurity situation to the early efforts to legislate chemical safety. While the author tries to make the case that early legislation led to a much improved safety culture, the current chemical safety program problems being addressed by the President’s EO points to problems with trying to legislate safety/security without putting a strong enforcement effort in place to ensure compliance.

Wiper Malware

A brief article over at SecureList.com looks at the use of Wiper Malware, programs that wipe data off of systems. The author describes a number of variants currently in the wild. While their recent use has been focused at IT systems, the author closes with a scary statement:

“We estimate that Wiper attacks will continue and may become even more popular in the near future, as means of attacking critical infrastructure at precise times, to cause widespread damage.”

The use of such malware against control systems or even just segments of control systems could have devastating effects, particularly if employed against chemical process systems. Even if catastrophic releases were not bad enough, the re-startup of these complex systems would be very difficult.

Gasoline Tanker as a Weapon

An article over at NewsDay.com describes a recent Long Island accident where a gasoline tanker drove into a car resulting in a massive fuel leak and fire. A witness described the scene this way:

“There was quite a huge fireball and a river of burning gasoline running down the street."

As I have mentioned a number of times in this blog, a hijacked gasoline tanker placed in the proper place and equipped with an appropriate charge could be quite an effective weapon.

CSB Report on California Refinery Fire

The Chemical Safety Board released a draft ‘Regulatory Report’ [Download Link] as part of its ongoing investigation of the 2012 Cheveron refinery fire in Contra Costa, CA. The Board is recommending that California change the way it regulates chemical safety at refineries (and presumably other high-risk chemical facilities). They are suggesting a change to the European Safety Case Model instead of the current compliance model used by OSHA. The draft was released to solicit public comments on the suggestion. This report is particularly important because of the OSHA RFI concerning potential changes to the Process Safety Management (PSM) program.

Crude Oil Train Wreck

This weekend there was a serious train derailment in a small town in Canada that may have some serious implications for the expanding use of rail shipments of crude oil. One person is known to be dead and an indeterminate number are missing. Large portions of the town center have been destroyed.

The Incident

According to news reports (here and here) an unmanned train of the Montreal, Maine & Atlantic Railway rolled at high-speed into Lac-Megantic, Quebec and derailed in town. Four railcars carrying North Dakota crude oil were damaged, leaked, and caught fire. An explosion was mixed in there somewhere; witness accounts are a little confused since the incident took place about 1:00 am Saturday morning.

The train had been parked outside of town. The reason has not been publicly announced, but it could have been for a crew rest period, crew switchover, or other legitimate reason. In any case the engineer claims that the brakes were set on all five locomotives and a number of the rail cars. If that is true, then there was a failure of those breaking systems or someone; deliberately or accidentally, released the brakes.

Along with the to be expected (and apparently extensive) blast and fire damage at the scene of the derailment, it appears that large quantities of burning crude (or some other flammable liquid; it is not yet clear from news reports what else this particular train was hauling) made their way into the storm sewer system and spread flames (and possibly secondary explosions of sewer gas?) beyond the immediate area of the fire.

The Cause?

It is way too early in the investigative process to presume to know the cause of the train starting to roll towards town. The whole gamut of possibilities (crew incompetence, maintenance failure, accidental release and deliberate release) remains as the potential cause(s) of the initial roll away. Even the cause of the actual derailment in town could have a number of possible causes (including too fast for the curve, inadequately maintained tracks, obstruction on the tracks, or a deliberate derailment).

There were news reports earlier this year of an al Qaeda related plot to cause a passenger train on a similar trans-border rail line to derail, so it is possible that this derailment was the result of a planned attack by al Qaeda or its wannabes. It is also well known that a number of environmental groups have civil disobedience actions planned against the rail transportation of Canadian oil-sands crude to American refineries (no, this was not Canadian crude and there is a far stretch between civil disobedience and criminal attacks) so there is a remote possibility that an eco-nut (the moral/political equivalent of a Jihadist-waco) could have been behind this.

If it was an eco-nut, it would be unlikely that the derailment, fire and explosions in town would have been the desired consequence. The same would certainly not be true of an al Qaeda wannabe.

Explosions

The news reports include conflicting descriptions of when the explosions came in relation to the derailment and fires. Some claim that the explosions preceded the derailment (and thus may have contributed to the derailment). If that was the case, the only ‘naturally’ occurring explosion would have been caused by a static discharge within one of the flammable liquid railcars caused by the sloshing liquid. The companies that I have worked for placed a ‘nitrogen blanket’ in the head space of all bulk flammable-liquid containers to prevent this from happening, but this is not universally done or required. A blast after the derailment but before the fire would have probably required the same ignition source.

An explosive device could have caused explosions at either time, thus possibly contributing to the derailment or causing the initial release of crude that started the fires. That loose crude would have been ignited by the sparks of the railcar scraping across the pavement.

I have mentioned on a number of occasions that using an explosive device on a toxic inhalation hazard (TIH) railcar would be very difficult; those cars are effectively armored so that they can withstand an internal pressure of 300 psi. A flammable liquid railcar is not as effectively protected as they are expected to withstand much lower pressures. It would not take a really professional bomb-maker to prepare a device that would breach a flammable liquid car.

An explosion after the initial fire would be much easier to explain as being due to ‘natural causes’. If one of the crude cars was breached in the accident (and the liquid ignited by metal to pavement sparks) the pool fire could rest beneath an overturned car that was still intact. The direct impact of flames would both weaken the metal and cause an increase in vapor pressure due to boiling volatiles inside the sealed car. That could fairly quickly lead to a BLEVE (Boiling Liquid Expanding Vapor Explosion) that I have discussed here before.

Security Implications

If this was caused by something as simple as kids playing on an empty train (that is a bit of a stretch considering the number of separate break systems that were supposedly set), then railroads are going to have to reexamine their basic security procedures for trains that are allowed to sit on unguarded tracks. This would not be the first incident of this type, but probably the worst in the way of consequences.

If this was a terrorist attack, or whatever persuasion, then the railroads and TSA (and Congress) are certainly going to have to re-look at the requirements that they have put in place for counter-terrorism security. To date, the only chemicals that have been regulated for security are TIH chemicals, explosives and radioactives. Proving a realistic threat against flammable liquids will greatly increase the cost of rail shipping.

Political Implications

As I noted earlier, many environmental organizations have been politically attacking the increased shipping of crude oil by rail as an end-run around the use of pipelines to handle crude from environmentally sensitive oil reserves. They have effectively blocked (at least for a time; maybe longer, the political end of that action has yet to be written) the approval of the trans-border Keystone XL pipeline.

The expanding use of rail shipments of crude has provided the oil industry a way around that political blockage. If the environmentalists can successfully point at this incident as a prime example of the safety issues related to crude-by-rail shipments, it may make it harder to bypass the pipeline restrictions.

At the very least we can expect to see petitions to the Federal Railroad Administration and its Canadian counterpart to increase the safety rules for the transport of crude-by-rail. At worst we could expect this to be a galvanizing incident in expanding the political and civil disobedience actions against crude-by-rail.

This will also almost certainly re-ignite calls for railroads to provide advance notice to local first responders of the identity and quantity of hazardous materials being transported by rail through their areas of responsibility. It will also serve as an additional rallying cry for organizations calling for the government mandating the re-routing of hazardous chemicals around municipal and urban settings.

A lot is going to depend on the results of the accident investigation being undertaken by the Canadian Government. Everyone involved with the shipment of hazardous materials, particularly crude oil, by rail will need to watch this investigation and the political ramifications closely.

TSA Publishes Summary of Surface Transportation Enforcement Actions

Yesterday the Transportation Security Administration (TSA) published a notice in the Federal Register (78 FR11216) that they had posted a summary report of their surface transportation enforcement actions taken in 2012 on the Federal eRulemaking Portal (www.Regulations.gov;  Docket # TSA-2009-0024)[NOTE: There seems to be some sort of problem with www.Regulations.gov this evening][NOTE as of 0500 EST 2-19-13 www.Regulations.gov is operational]. This report is required by 49 USC 114(v)(7)(A).

The report for 2012 notes that there were 27 enforcement actions taken by TSA as a result of findings made by surface transportations security inspectors. The violations covered three general regulatory areas:

• Rail Car Chain of Custody – 49 CFR 1580.107 – 18 Instances;

• Reporting Significant Security Concern – 49 CFR 1580.105 or 1580.203 – 4 Instances;

• Rail Car Location and Shipping Information 49 CFR 1580.103 – 2 Instances;

• Rail Security Coordinator – 49 CFR 1580.101 – 1 Instance;

• TWIC – Fraudulent Use or Manufacture – 49 CFR 1570.7(b) – 1 Instance; and

• TWIC – Fraud and Intentional Falsification – 49 CFR 1570.5(a) – 1 Instance.

TSA may assess civil penalties of up to $10,000 per violation of surface transportation security requirements under 49 USC or TWIC violations under 46 USC. The maximum assessed in 2012 was $50,000 for a single individual for TWIC violations. Only two other civil penalties were assessed in 2012.

TSA Publishes 30-Day ICR Notice for Rail Security Program

The Transportation Security Administration published a 30-Day information collection request (ICR) notice in today’s Federal Register (77 FR 19680-19681) in support of its rail security program. This is a follow-up to the 60-day ICR notice published in January.

In my blog about that earlier notice I noted that TSA failed to explain why there was the large change in the number of respondents between this proposed submission and the currently approved ICR from 2008. That earlier ICR called for an expected 88,145 responses and a total burden of 288,945 hours at a cost of $9.4 million. The current ICR notice shows only 54,023 hours and does not list a cost nor does it list a total number of expected responses. Again there is no explanation for the change in this public document.

Rail Borne Chemical Threat to Super Bowl?

An Indianapolis TV station’s web site is reporting that CSX will halt rail traffic past the Lucas Oil Stadium on Super Bowl Sunday this year. The tracks run within a block of the stadium, and train traffic will not be allowed on those tracks starting about 3 hours before game time until after the Stadium is emptied after the game. The fear is, of course, that a hazardous material leak (accidental or deliberate) that close to the game site could put thousands of people at risk.

Okay, a pause to allow our friends from Green Peace and other environmental activist organizations to ask “What about the thousands of people who live and work along that same line every day?”

Accidental Releases

They are, of course, correct in that anyone living within a certain distance of a railroad track is placed at increased risk of exposure to any hazardous chemical that is being carried in any of the rail cars. The amount of increased risk is infinitesimal; railroads have a very enviable safety record either in the absolute number of fatal chemical incidents or the number of releases per ton-mile of hazardous material transported. Only pipelines have a better overall safety record.

If the risk is sooo small, why are they stopping the train traffic on game day? A small part of the reason is that even an infinitesimal risk is way too high when you are dealing with high-profile events like the Super Bowl. Even a relatively small and hardly dangerous leak of a moderately toxic chemical along the nearest point of approach to the Stadium (named after an oil company, how ironic) would result in the game being stopped and the stadium being evacuated. That would kill Indianapolis’ chance of ever getting another high profile event in their fair city.

Deliberate Attacks

The real reason has nothing to do with accidental releases. If that were the case, those trains would be stopped every time the Colts play at home. It hasn’t happened. It won’t happen. No one is concerned with accidental releases. It is a terrorist attack converting one or more of those railcars to chemical weapons, improvised explosive devices or flame weapon that keeps the CSX security people awake at night as Super Bowl Sunday approaches.

Now the risk of a successful terrorist attack (defined as resulting in a catastrophic failure of the railcar tank resulting in impressive off-site consequences; death and destruction) on a rail car is relatively low. The cars are made of very thick, welded metal, that was designed to resist damage in normal handling and low speed derailments. A portable explosive device designed to take out such hardened targets are not available via Terror-U-Online; it requires the services of an explosives engineer, lots of hands-on time with a stationary vehicle. Oh yes, they have to be large enough to be readily detectable.

Unless, of course, one were to place the device inside of the sealed and filled railcar. But that’s a topic of a completely different post.

Partially Successful Attack

Of course, a successful attack doesn’t really have to be successful to be successful, if you get my meaning (of course you don’t, I’m being entirely too cute, but I will explain). If a targeted release of a chemical (and it wouldn’t even have to be really hazardous) were visible to the news teams covering the game, the security advisors for the event would have to immediately begin evacuation procedures even before they knew the actual nature of the release. There would be wide spread panic resulting in potentially hundreds of deaths or serious injuries; all in front of the eyes of the world.

And that is the reason that CSX is stopping the flow of all rail cars by Lucas Oil Stadium on Super Bowl Sunday, but letting them flow the other 365 days of 2012.

House Passes HR 1892 – Intelligence Authorization

On Friday the House of Representatives passed HR 1892, the Intelligence Authorization Act for Fiscal Year 2012, by a substantially bipartisan vote of 384 to 14. Needless to say, most of this bill is classified and not subject to public or blogger review, but some of the provision are unclassified.

Normally I wouldn’t address an intelligence authorization bill in this blog, but there are two items in this bill that might indirectly affect the chemical security community. The first makes the DHS intelligence apparatus officially part of the ‘intelligence community’ and second addresses security of railroads.

Intelligence Community

Section 411 of the bill amends §3(4) of the National Security Act of 1947 {50 U.S.C. 401a(4)} by adding the Office of Intelligence and Analysis of the Department of Homeland Security to the list of agencies officially considered to be an ‘element of the Intelligence Community’. If this provision remains in the bill through final passage, it would mean that it took longer than 10 years from the date of the 9-11 attacks to make homeland security officially (if probably still not actually) a fully functioning part of the intelligence community.

Is it any wonder that we still don’t have the full sharing of intelligence information that would help to prevent attacks like those that formally introduced this country to the community of international terrorism?

Actually, this inclusion of OIA in the intelligence community was further enhanced (slightly to be sure) by the adoption of an amendment offered by Rep. Keating (D,MA) by voice vote. That amendment would add a section to Title V of the bill that would express the ‘sense of Congress’ that the intelligence community “should continue to integrate and leverage fusion centers to enlist all of the intelligence, law enforcement, and homeland security capabilities of the United States in a manner that is consistent with the Constitution to prevent acts of terrorism against the United States” (pg 16 of the Rules Committee Report on H. Res. 392).

A ‘sense of Congress’ declaration has no legal standing, but it does provide notice to the intelligence community that the check writers think that the fusion centers and OIA should be taken seriously.

Railroad Security

Another ‘sense of Congress’ amendment was offered by Rep. Carney (D,DE) regarding the ‘priority of railway transportation security’ was adopted by bipartisan vote of 303 to 92. That amendment to Title V of the bill concluded that “railway transportation security (including subway transit security) should continue to be prioritized in the critical infrastructure threat assessment developed by the Office of Intelligence and Analysis and included in threat assessment budgets of the intelligence community” (pg 15).

Given the history of terrorist attacks against transit systems the primary focus of this amendment was almost certainly intended to be on passenger rail systems not freight rail. But, given the extent and importance of freight rail and the inherent risks associated {particularly toxic inhalation hazard (TIH) chemical transport} with it, one would like to think that the intelligence community would certainly include freight rail threat assessments in its consideration of ‘railway transportation security’.

While identifying potential terrorist attacks in the planning stages is generally considered to be the best security against such attacks, it is particularly important in defending against attacks against the rail sector. The physical layout of rail systems makes it practically impossible to use physical security means to protect against attacks on this transportation mode. The only effective method of protection is advance detection and that is the job of the intelligence community.

OMB Approves FRA PTC Amendment Rule

The Office of Management and Budget announced on their RegInfo.gov web site yesterday that they had approved ‘consistent with change’ (OMB speak for make some minor changes please) a Federal Railroad Administration proposed rule amending the Positive Train Control regulations. Since this rule was not published in the Unified Agenda we have no way of knowing what this proposed rule will contain until it is published in the next week or two in the Federal Register.

OMB was kind enough to tell us that it is ‘economically significant’ and that it will effect small businesses.

Rail Security Hearing

Yesterday the Senate Homeland Security and Governmental Affairs Committee held a hearing looking at the “Next Steps for Securing Rail and Transit”. Like last week’s hearing before the Senate Commerce Science and Transportation Senators questioned the disparity between TSA funding for air and rail security operations. Once again, there was little mention of or consideration for freight rail security operations.

The written testimony from TSA Administrator Pistole for this hearing (not surprisingly, identical to last week’s written testimony) does not mention freight rail security or TSA’s much delayed regulations for railroad security training. Similarly the prepared testimony from Commissioner Boynton from Connecticut’s Department of Emergency Management and Homeland Security failed completely to discuss either of these two issues.

The testimony from Dr. Flynn, President of the Center for National Policy, also focused on passenger rail security to the exclusion of freight rail issues. He did, however, take TSA to task for their failure to complete the security training regulations mandated by Congress. He notes that “most local jurisdictions have been hesitant to pursue their own [training] effort until direction arrives from Washington” (page 6). No one wants to spend money on developing a training program only to find out that it doesn’t meet the requirements of later federal regulations.

Oh well, I suppose we need to accept that the limited number casualties resulting from an attack on passenger rail like those seen in Madrid and London far outweighs the potential threat of the result of an attack on a single chlorine or anhydrous ammonia rail car.

BTW: I did finally get around to listening to the web cast of last week’s rail security hearing. Beyond listening to Administrator Pistole whine about how hard it is to write regulations and getting them through the Administration’s internal review process, there was nothing of interest to the chemical security community in the hearing.

Oh yes, Administrator Pistole wants an abbreviated regulatory process for homeland security regulations. I’m not sure what he wants shortened since TSA hasn’t even published an advance notice of proposed rule making yet. Perhaps he needs to send his administrative people over to talk to NPPD who published the CFATS regulations (much more complicated than training regulations) well within the congressionally mandated time limit.

Congressional Hearings Week of 6-20-11

Two weeks in a row with both houses of Congress in Washington, what a concept. The hearing schedule is beginning to reflect the approach of the summer vacation period with lots of increased activity with seven hearings this week of potential interest to the chemical and cyber security communities. As I mentioned yesterday there will be a markup of HR 901; additionally there will be two cyber security hearings, a budget hearing, a rail security hearing, a suspicious activity reporting immunity hearing and the political favorite, a WMD hearing. There will also probably be a House Rules Committee hearing on the rule for HR 2219 that I mentioned last night.

Cyber Security

Two different committees will be looking at the Obama Administration’s cybersecurity proposal. On Tuesday the Subcommittee on Crime and Terrorism of the Senate Judiciary Committee will hold their hearing with witnesses scheduled from the Department of Justice, DHS-NPPD, and the National Institute of Standards and Technology.

On Friday the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the House Homeland Security Committee will hold their hearing on the subject. There is no witness list available yet for this hearing.

As I noted in an earlier blog, there are significant a control systems provisions in the President’s cybersecurity proposal, but that is no guarantee that they will even be mentioned in these hearings. The inclusion of NPPD and NIST witnesses does provide the possibility that this topic will be covered in the Senate hearing, but a lot will depend on the questioning from the Senators. Being a Judiciary Committee panel, I don’t hold out a lot of hope for the Senate hearing, but I do expect a better chance of substantive covereage of control systems security issues in Friday’s hearing.

Coast Guard Budget

The Oceans, Atmosphere, Fisheries, and Coast Guard Subcommittee of the Senate Commerce Committee will be holding an oversight and budget hearing on Thursday looking at the Coast Guard. This is kind of late in the season for a budget hearing, but the Senate is way behind the House in the budget process this year. I doubt that there will be much in the way of MTSA coverage in this hearing. No witness list is currently available, but we can certainly expect the Commandant to be on hand.

Rail Security

The Senate Homeland Security and Governmental Affairs Committee will be holding a hearing on Wednesday looking at rail security operations. The recovery of information from the Bin Laden compound indicating an interest in attacking rail targets on the 9/11 anniversary is bringing some attention to this neglected area. If last week’s hearing before the Senate Commerce Committee is any indication, there will be no substantive discussion of the existence of a freight rail threat; but we can always hope. Those hopes are partially dashed by the fact that there is no railroad witness on the current witness list.

See Something Say Something

The Subcommittee on the Constitution of the House Judiciary Committee will be holding a hearing on HR 963, the See Something, Say Something Act of 2011, on Friday. This is bill introduced by the Judiciary Committee Chair to provide immunity to people making good-faith suspicious activity reports. There are no witnesses currently listed for this hearing.

WMD

Late last session Rep. King (R, NY) introduced HR 5057 that dealt with defenses against terrorist uses of weapons of mass destruction. King’s bill focused almost exclusively on nuclear and biological weapons to the exclusion of chemical weapons. That bill is apparently pending re-introduction and will be the subject of a hearing before the Cybersecurity, Infrastructure Protection, and Security Technologies Subcommittee of King’s Homeland Security Committee on Thursday.

Congressional Hearings Week of 6-13-11

This week both the Senate and House will be in Washington at the same time. This actually results in a decrease in the number of hearings that might be of interest to the chemical security community; this week there will only be two such hearings; both addressing chemical transportation issues. I’ll be watching a third Congressional development this week, the Ag spending bill, for potential chemical security provisions.

Emerging Rail Threat

The Senate Committee on Commerce, Science, and Transportation will hold a hearing on Tuesday looking at the ‘emerging threats’ to rail security. I suspect that the bulk of the hearing will address people moving issues, but the topic of freight rail security (which is principally a discussion of toxic inhalation hazard (TIH) chemical transportation security issues) will certainly be addressed.

Pipeline Safety

The Energy and Power Subcommittee of the House Energy and Commerce Committee will hold a hearing on pipeline safety on Thursday. Scheduled witnesses include PHMSA Administrator Quarterman and representatives from the American Petroleum Institute, the Interstate Natural Gas Association of American and the Natural Resources Defense Council. Industrial safety and security are naturally intertwined, but there is only a very limited chance that pipeline security will be even briefly addressed in this hearing.

AG Budget

This week the House will take up HR 2112, the budget for the Department of Agriculture and related agencies with the House Rules Committee meeting on Monday to formulate the rule. This is not a hot bed of chemical security interest, but the agriculture budget bill has included chemical security provisions in the past, specifically a tax credit provision for reimbursing food producers for chemical security measures in the 2008 bill. With impending (maybe) regulation of ammonium nitrate sales, there may be a similar move for ammonium nitrate producers and distributors.

Development Along Rail Lines

This weekend there was an interesting article in my home town newspaper about the renovation of an old textile mill into offices, retail, and apartments. It is a deserted, historic old-building on the outskirts of the downtown area and it certainly deserves renovation; except that it has a major rail yard as a next door neighbor. The article makes a big thing about how lots of old mills across the South have been renovated along rail lines; rail lines were typically run near mills, or vice versa to provide shipping and receiving for those mills. The builder notes that the thick walls and insulated windows helps knock down the noise associated with rail lines so residents of the high-end loft type apartments typically put into these renovations don’t complain about the noise. That’s all good, as far as it goes. I just wonder if they are putting in airtight seals on the doors and window and auto shutdown mechanisms on the central heat and air. Oh, and more importantly chemical detectors for anhydrous ammonia and chlorine. You see this is not just a rail line alongside of the mill property, but it is a rail yard. This is where trains are taken apart, stored and formed up again. And some of the train cars coming through this particular yard contain chlorine gas and anhydrous ammonia. I know, I’ve watched them come in and go out. And the risk for an accidental release of chemicals from rail cars is higher at rail yards than just along rail tracks. More handling means that there are more chances for accidents. To make matters worse, there is next to no security at this particular rail yard. There are surface streets that cross the tracks and vast stretches of the perimeter with no fencing. In fact the only fencing that I know exists was part of the old mill perimeter fence. This means that if terrorists were interested in gaining access to these high-risk rail cars, this would be a good place to do so. Add a bunch of high-rent apartments on the perimeter and it becomes a potential terrorist target. Do the real estate disclosure laws cover this situation? Does the developer understand the potential hazard? Did the Planning Advisory Commission take these factors into account when they recommended that the zoning be changed from light industrial to an Uptown (mixed residential and commercial) zoning? You make your guesses; I know what I think. The only saving grace is that it will not be poor folks living next to the tracks; it will be well to do folks. People with access to well paid lawyers. People with access to important politicians. People who will ask "Why wasn’t I told, warned or protected?" when the accident or attack exposes them to toxic inhalation chemicals. Maybe that is what it will take to get these rail yards moved out of city centers.

CSX SecureNow

Yesterday I was invited to join a Blogger Conference Call with CSX. They wanted a chance to show-off their new SecureNow system; their comprehensive method of tracking freight and passenger rail cars on the CSX rail system. From what we were shown they have good reason to be proud of their system. RSSM Monitoring What started as an asset management system has been modified to produce a security monitoring system that allows them to track a large number of potential targets as they move across the CSX system. What will be of the most interest to readers of this blog is the extensive capability to track railcars carrying Rail Sensitive Security Material (RSSM). Not only can they track individual RSSM railcars, but the supporting data base can instantly provide detailed information on the shipment, the RSSM hazard, and details on the rail car construction and layout. They are even working with some RSSM shippers to evaluate the use of a variety of car status sensors as an additional data source. The system is technically impressive, but it does appear to be a logical outgrowth of an asset management system. If the system were limited to just CSX use, that is all that the system would ever be; an extensive, technically-advanced asset management system. What is more impressive to me is the political acumen that led CSX to share the use of the system with private, State and Federal emergency response and security officials. Sharing Information CSX has provided CHEMTREC® with a system terminal and access to the CSX system. CHEMTREC is a private organization established by the American Chemistry Council to provide a single centralized clearing house for chemical safety information for first responders. The CHEMTREC 1-800 number is the go-to source for first responders to go to get the up-to-date information necessary to safely respond to an accident involving hazardous chemicals. I would not be surprised to find that their phone number was the single most common phone number on an emergency responder’s speed dial list. With the SecureNow terminal in operation at CHEMTREC the first responders to a freight rail accident can contact a well known phone number and quickly determine if that CSX train is carrying hazmat, what hazmat material is in which car in the train, how much is in each car, as well as the safety information associated with those materials. It truly makes CHEMTREC a one stop shop for first responders looking for hazmat response information. CSX provides state homeland security personnel with direct access to the SecureNow information through the CSX Public Safety Coordination Center. Dedicated lines from designated State Fusion Centers ensure that security planners and emergency response coordinators have uninterrupted access to CSX information. CSX is also in the process of putting SecureNow terminals in Fusion Centers covering states where CSX provides service. Because of the legal negotiations and training requirements CSX currently only has terminals in Indiana, New York, New Jersey, Kentucky, Maryland and Ohio. Additionally, CSX has installed a terminal in the TSA Freedom Center. The information directly available to TSA from that terminal is certainly in excess of the requirements for reporting the location of RSSM railcars that were included in the latest freight rail car security regulations. Time for Questions At the end of the CSX presentation we were provided some time to ask some general security related questions. I took the opportunity to ask about the implementation of the Freight Rail Security Rules. Readers might recall that I have written two postings on the CSX plans for implementation back in January. In the first I addressed a letter CSX was sending to its customers about implementation plans. In the second I looked at a reply I received from CSX about the first blog. In those blogs I looked at CSX concerns expressed that the attended carrier-to-carrier handoff rules might cause them to change some RSSM routes to avoid using some short line and regional carriers that could not provide attended exchanges. In the second blog I noted that “CSX is certainly not trying to specifically route through urban areas, but they will use this rule to avoid lowering their profits by re-routing around urban areas through use of some other carrier.” I specifically asked Skip Elliott about how many routing changes had been made due to the attended hand-off rules. He told us that CSX had been able to coordinate hand-offs with all of the affected short line and regional carriers. He noted that some exchange locations had been changed, there had been no route changes because of these freight rail rules. It was too early in the implementation of the RSSM routing rules to ask effective questions about that implementations, especially since the only thing being done to date is data gathering. CSX did make a commitment to future blogger calls, so perhaps I’ll get a chance to ask questions on those issues in the future.

House Hearing Week of March 9th

The House Homeland Security Committee has three hearings scheduled next week that may be of interest to the chemical security community. The Homeland Security Subcommittee of the House Appropriations Committee has two hearings that might be of interest. Cyber Security The Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology Hearing will hold a hearing on cybersecurity issues on Tuesday, March 10, 2009 at 2pm EDT. It is entitled: “Reviewing the Federal Cybersecurity Mission” and it will provide an opportunity for the Committee to provide input into the 60-day NSC cybersecurity review. There is nothing in the currently available information indicating that the issue of control system security will be discussed, but it cannot be ruled out. Infrastructure Protection Subcommittee on Transportation Security and Infrastructure Protection will look at the Mumbai attacks and their implications for infrastructure protection in a hearing to be conducted on March 11th at 2pm EDT. The hearing will be entitled: “The Mumbai Attacks: A Wake-Up Call for America’s Private Sector”. This hearing should have the most direct impact on planning for the protection of high-risk chemical facilities. Mexican Border Violence On Thursday, March 12th at 10am EDT the Subcommittee on Border, Maritime, and Global Counterterrorism will look at the situation on the Mexican border in a hearing entitled: “Border Violence: An Examination of DHS Strategies and Resources”. Again, nothing indicates that chemical security issues will be specifically addressed, but, as I noted in a blog last December, there are substantial cross border shipments of hazardous materials that may be affected by this violence. The Homeland Security Subcommittee of the House Appropriations Committee will look at the same issue on Tuesday, March 10th at 11:30am EDT. Interestingly there is no overlap in the witness lists for these two hearings, so there should be a broad cross section of agency views expressed between these two hearings. Rail Security Issues The Homeland Security Subcommittee will be holding a hearing on March 12th at 10am EDT that will be looking at railroad security issues. The hearing is entitled: “Securing the Nation’s Rail & Transit Systems”. Two of the witnesses will be representing large metropolitan (New York and Los Angeles) transit authorities, so it is not clear that there will be much discussion of freight rail security issues.

Pending TSA Security Regulations

I recently found another web site that provides valuable information about the development of Federal government regulations. It is part of the Office of Management and Budget web site, RegInfo.gov. Looking through its data base I found reference to three TSA regulations in development that pertain to ground transportation security. Interestingly two of the three regulations are well past their legislatively mandated implementation dates and not a single NPRM has been published. The ‘pending’ regulations are:

Railroads--Security Training of Employees Railroads--Vulnerability Assessment and Security Plan Revision of Enforcement Procedures; Reporting of Security Issues

In this blog I will examine the OMB data on these three rules. In later blogs I will attempt look at the requirements in more detail. Security Training of Employees According to the abstract published on this web site:

“The Transportation Security Administration (TSA) will add new regulations to improve the security of railroads in accordance with the Implementing Recommendations of the 9/11 Commission Act of 2007. The rulemaking will propose general requirements for a security training program to prepare railroad frontline employees for potential security threats and conditions. The regulations will take into consideration any current security training requirements or best practices.”

The legal authority cited for the rule is: 49 USC 114; PL 110-53, sec 1517. There was a statutory deadline of February 3rd, 2008 for the publication of the NPRM. Vulnerability Assessment and Security Plan According to the abstract published on this web site:

“The Transportation Security Administration (TSA) will add new regulations to improve the security of rail transportation in accordance with the Implementing Recommendations of the 9/11 Commission Act of 2007. This rulemaking will propose general requirements for each railroad carrier assigned by the Secretary of the Department of Homeland Security (DHS) to a high-risk tier to conduct a vulnerability assessment; implement a security plan that addresses security performance requirements; and establish standards and guidelines for developing and implementing these vulnerability assessments and security plans.”

The legal authority cited for the rule is: 49 USC 114; PL 110-53, sec 1512. There was a statutory deadline of August 3rd, 2008 for the publication of the NPRM. Reporting of Security Issues According to the abstract published on this web site:

“The Transportation Security Administration (TSA) proposes to amend its investigative and enforcement procedures to conform their scope to the changes in TSA’s civil enforcement authority enacted in the Implementing Recommendations of the 9/11 Commission Act of 2007. Specifically, the proposed rule would establish procedures by which TSA could issue civil money penalties for violations of any statutory requirement administered by TSA, including surface transportation security requirements, as well as requirements governing the use of Transportation Worker Identification Credentials. This proposed rule also would add new procedures by which members of the public could report to TSA a problem, deficiency, or vulnerability regarding transportation security, including the security of aviation, maritime, railroad, motor carrier vehicle, or pipeline transportation, or any mode of public transportation, such as mass transit.”

The legal authority cited for the rule is: 49 USC 114; PL 110-53, secs 1302, 1304, 1413, 1415, 1521, 1536 , There was no statutory deadline for this rule, but the OMB site noted that the expected NPRM date for the rule was in November 2008. The New Administration It will be interesting to see how the Obama Administration deals with these rules. Implementing the 9-11 Commission recommendations was a big part of the Democrat’s legislative agenda when they came into power in the House in 2007. The current economic conditions may put a damper on their enthusiasm for pushing these rules, but I expect that they might just yet see the light of day.

Mexican Border Rail Issues

There was an interesting article on NewsPaperTree.com, an El Paso, Tx news site, about a wide variety of chemical safety issues that are related to the legal traffic in hazardous chemicals across the border in that area of the country. The article lists hydrofluoric acid, sulfuric acid and a variety of hazardous waste that crosses from Mexico to the United States in railcars through downtown Juarez and El Paso. The article quotes a 2007 report from the Good Neighbor Environmental Board (GNEB) that concludes that it is probably not possible to conduct “a thorough physical inspection of each truck, rail car and container entering the United States”. Railroad Transportation Security Rule This is especially troubling when one considers that the soon to be implemented (April 1st, 2009) chain of custody requirements for covered hazmat rail shipments (specifically including hydrofluoric acid) will not cover these railcars until they are well into the United States. The TSA, in the preamble to the rule (page 72162) states that: “The chain of custody requirements do not apply at any shipper facilities located outside the United States. Rather, for international shipments to the United States, the requirements begin at the first railroad carrier interchange point and apply to all subsequent carrier interchanges that are otherwise subject to this final rule.” This means that railcars containing poisonous by inhalation chemicals originating in the most lawless sections of Mexico, areas under control of various drug lords and other violent criminals, will transit cities like El Paso without any provisions for inspections of these cars for tampering, presence of IEDs or other threats to the integrity of their structure. Rerouting There are many that will point to this as an additional reason for requiring re-routing hazmat rail shipments around major urban areas. The article does note that last September a joint Mexican-New Mexico plan was announced to “to re-route trains from downtown Ciudad Juarez to the up-and-coming border development of Santa Teresa, New Mexico, by 2012”. The article goes on to question how much money either the Mexican Government or the government of New Mexico can afford to contribute to the public-private partnership project that could cost ‘hundreds of millions of dollars’.