Another Look at CFATS and Weapons

A topic that comes up from time to time in discussing security plans at high-risk chemical facilities covered under the CFATS program is the question of whether or not security personnel should be armed. Generally speaking chemical facility management is against fire arms and security personnel (myself included) tend to favor their use. The issue came up again in a rather odd context last week in the first of two FoxNews.com reports by Mike Levine.

Mike quoted from the as of yet unseen internal DHS report on problems in the implementation of the CFATS program:

“’Despite their lack of law enforcement authority, some still actively seek the right to carry a firearm,’ the internal report reads.”

The reason that I mention this here is that it is very important that everyone at DHS, especially the CFATS inspection force, understand why chemical facility managers are typically so adamant about no firearms being allowed on their property. It is not because they are anti-gun nuts (I personally know at least a couple that are card-carrying NRA members), but rather they are scared to death of what a gun can potentially do on site.

Flammable Atmospheres

Almost every chemical facility worthy of the name houses one or more flammable chemicals. A very safe chemical facility will take excruciating pains to ensure that those chemicals remain confined in the appropriate storage or processing systems. Even so, they know that small spills and releases are almost inevitable. Less safe facilities will, almost by definition, have more and larger such releases.

Even the smallest spills of flammable chemicals (ones so small that even the most rabid environmentalist would ignore it) result in a small cloud of flammable vapors. Under the right atmospheric conditions even those small clouds can be ignited by stray sparks and open flames. This is the reason that hot work permitting and flammable gas testing procedures are such an important part of chemical safety programs.

Before any work is done at a chemical facility that could produce sparks (drilling, grinding, etc) or introduce open flames (welding or cutting) a gas test meter is used to determine if there is the presence of a flammable atmosphere. A flammable atmosphere is defined as any concentration of a flammable vapor above the lower explosive limit (LEL) and below the upper explosive limit (UEL). Every flammable chemical has its own characteristic LEL/UEL combination.

These are called ‘explosion limits’ for a very good reason. The flammable vapor/oxygen ratio is so favorable for burning that the cloud ignites easily and burns very quickly, producing heat and a rapidly expanding cloud of combustion products that produce a pressure wave that can cause extreme damage at quite some distance for the site of ignition.

Generally speaking the larger the amount of the flammable chemical that is released into the environment the larger is the chance that at least some portion of the vapor cloud will be within the explosive limits for that chemical. And the larger that explosive portion of the cloud is the larger is the area that will be affected by the resulting explosion.

Firearms

Handguns, rifles and shotguns are often generically referred to as firearms. The reason for this is clear; it is the burning of a propellant charge in the chamber of the weapon that causes the expansion of gasses in the barrel that, in turn, cause the projectile to fly towards its intended target at high-speeds.

Anyone that has seen a firearm discharged at night will have had a clear vision of the muzzle flash that accompanies the firing of the bullet. That muzzle flash (and cylinder flashes from revolvers) is nothing more than gasses that are still burning as they leave the confines of the weapon.

Those burning gases are almost certainly hot enough to ignite a vapor cloud that is within the explosive limits for that particular chemical. Depending on the size of the vapor cloud (which is again dependent on the size of the chemical release) the discharge of a single round from even a small handgun could result in a catastrophic explosion.

Bullet Holes

As it that weren’t problem enough, the projectile that leaves the barrel just before the muzzle flash is going to travel some considerable distance from the weapon before air resistance and gravity combine to bring it to earth. That can be quite some distance, something that even the most ardent shooter frequently forgets. Unless, of course, something gets in the way first.

Most people have no concept of the penetrating power of modern bullets. Having seen their favorite cop or detective on television hiding behind car doors in a gun fight, they assume that thin pieces of sheet metal are impervious to bullets. Nothing could be further from the truth. Even the rounds from small pistols can easily penetrate the walls of most storage tanks and smaller chemical storage containers.

If the bullet penetrates the container or tank below the liquid level the chemicals inside are going to come out the bullet hole. The rate will be dependent on the caliber of the bullet and the viscosity and flow characteristics of the chemical. Most really dangerous flammable chemicals will flow out of even a 0.22 caliber hole at quite an astounding rate.

For flammable liquid storage tanks, the higher the liquid level inside the tank above the bullet hole the faster the chemical is coming out. Under the proper conditions of bullet hole size, and pressure the liquid will convert to a vapor upon exiting the tank, greatly increasing the chances for forming a flammable atmosphere.

Consequences

If an armed security guard or responding police officer encounters and armed terrorist who has penetrated the perimeter security measures of a high-risk chemical facility it is very likely that a gun battle will ensue. While every attempt will certainly be made to just hit the intruders with the bullets, the sad truth is that in any gun battle most bullets miss their intended targets.

The larger the chemical facility, the more likely it is that the ‘missing’ bullets will hit storage tanks, containers or process equipment resulting in the release of chemicals. If flammable chemicals are on site, the longer the gun battle runs the more likely it is for a flammable chemical storage tank or container to be hit by a stray bullet. And sooner or later it is likely that a firearm will be discharged within a flammable atmosphere. Then the probability of a successful terrorist attack will increase dramatically.

Guards Must be Armed

I am firmly convinced that if a security force is going to have any chance of preventing a successful armed assault on a high-risk chemical facility it is going to have to be armed. But, as I have explained here, arming them with firearms can be counterproductive to say the least. A security force manager is going to have to look for alternative weapons for facilities with significant amounts of flammable chemicals on site.

Interestingly, just yesterday the folks at PublicInteligence.net published a copy of a DOD Non-Lethal Weapons Reference Book. While many of the weapons discussed in this book are firearms based, most are not. I strongly recommend that any security force manager should look over this reference for ideas for alternative weapons for interdicting terrorist attacks.

Armed Guards

I had an interesting email conversation with a reader last week about the issue of armed guards at high-risk chemical facilities. The reader wanted to know my opinion about whether or not DHS would ‘require’ the use of armed guards for Tier 1 or 2 facilities. I did a series of postings on the subject over a year ago, but that was before the Risk Based Performance Standards Guidance document was published. Perhaps it is time to revisit the issue. 

Of course, DHS cannot ‘require’ any security measure in the approval of the facility’s Site Security Plan. This is specifically prohibited by the §550 authorization for the CFATS regulations. The real question is under what circumstances would DHS expect to see the use of armed guards to adequately address the Deter, Detect and Delay performance standard? 

Armed Guards and the Guidance Document 

The discussion portion of RBPS #4 in the Guidance document has very little to say about security guards. The single paragraph discussing armed guards (pg 53) states that:

“Protective forces are often used to enhance perimeter security and provide a means of deterrence, detection, delay, and response. Such forces can be proprietary or contracted and can be armed or unarmed. They may be qualified to interdict adversaries themselves or simply to deter and detect suspicious activities and to then call local law enforcement to provide an interdiction.”

Even in the metric portion of the Guidance document there is only a very limited discussion of security forces. Metric 4.1, Deterrence and Delay (General), briefly addresses ‘on-site security’ (pg 55) by stating, for Tier 1 facilities:

“Through a combination of on-site security, barriers and barricades, hardened targets, and well-coordinated security response planning, the facility has a very high likelihood of deterring an attack and/or delaying an attack for a sufficient period of time to allow appropriate security response.”

Other brief mentions of the use of security forces can be found in RBPS #1 and #2 where they describe such forces as ‘standing posts at critical assets’, ‘using remote surveillance’, or ‘conducting roving patrols’. No mention is made of the employment of armed personnel. Metric 3.1 mentions that access control points are manned by ‘security personnel’, but there is no discussion of whether or not they might be armed personnel. 

As one would expect, the SSP Questions Manual does not give much in the way of guidance. There are a number of questions listed about security forces (see pages 148 thru 152), including questions about what whether they are armed (for example: Q:10.33-15459, pg 149). None of these questions provides any hint of what DHS would like to see. There are a number of questions, however, in the facility information portion of the SSP about response capabilities, both on-site and off. On-site response questions include asking if the facility has snipers or ‘tactical response (combat)’ teams (pg 30). The off-site response questions are much more extensive and include questions about the local police force capabilities as well as their response time. The response time questions (pg 31) address both initial response (first officer on scene) and ‘tactical response’ times. 

Determining Need for Armed Guards 

Lacking specific guidance from DHS on when and where armed guards are ‘required’, how does a facility make the determination whether or not they need armed guards? To answer that we need to go back and look at the RBPS 4.1 Metric; for tier 1 facilities the need is for a security system that is capable of “delaying an attack for a sufficient period of time to allow appropriate security response”. 

First we need to understand what an ‘appropriate security response’ is. In large part this will depend on the COI at the facility. For Theft/Diversion COI an appropriate response may be the apprehension of the terrorists with the COI in their possession before they have a chance to employ them in a subsequent attack. For facilities with a large quantity of Release Toxic COI, an appropriate response would have to be one capable of stopping a successful release of that COI into the surrounding community. That response must be capable of stopping a determined and likely armed attack on the facility; this requires an armed response force. 

The next question the facility must answer is whether or not they are going to rely on on-site or off-site response forces for their ‘appropriate response’. If an off-site response force is going to be used for the final line of defense, the on-site security system (including security force) is going to have to be able to delay an attacker until that response force can arrive on scene, apprise themselves of the situation and assume a tactical position that maximizes the potential success of their mission. How much time that will be will vary according to the situation, but it can be determined with the gaming of a number of likely attack scenarios. 

Once the appropriate response time is determined, the facility simply needs to determine if their security devices, procedures and personnel are capable of delaying a determined attack for that length of time. The best way to determine this is to have tactically experienced personnel conduct a penetration exercise. Lacking that an evaluation by an independent security team not connected with the installation or maintenance of the security systems should be conducted. 

The bottom line is that if a toxic release COI is present in large enough volumes to present a threat to a relatively large off-site population, an armed response is going to be necessary to prevent a terrorist attack aimed at that COI. If the response force is on-site, it must be armed. If the response force is off-site, it may be necessary to have an on-site security force that is armed to delay the potential attack long enough for the response force to arrive and defeat the attackers.

Reader Comments 11-21-08

Last Friday the ever present Anonymous left a comment about my blog (see: "New IST Report from Center for American Progress") concerning the recently released report from the Center for American Progress. Among other things, he took exception to one of the ‘goals’ of the CAP report, the one about utilizing the ‘experience and knowledge of facility employees’ in conducting SVAs and formulating SSPs. Employee Involvement His comment was that: “Many of the employees of these facilities have limited knowledge and experience with regards to REAL security.” I’ll go one better and state that, in my experience, almost no employees, hourly or salaried, had any significant knowledge or experience with security. The rare exception came to the job with security experience from the military. Does that mean that they should be excluded from the assessment and planning process? Absolutely not! At the facilities where I worked, we always had one of the hourly workers sit in on all of the safety reviews. It wasn’t because of their superior knowledge of process safety; it was because of their superior knowledge of plant processes. The chemists and engineers certainly knew more about the safe limits of the process, but the workers knew more about how the operators actually did things and reacted to things. This knowledge was important to designing the process and writing the instructions that the operators would be required to execute. This is why safety reviews and process hazard analyses are always conducted by a team. The problem will be worse, of course, for security assessments and security planning. Since essentially no one from the facility will have an adequate security background, the facility will have to rely on security professionals, either consultants or hired to staff. Those security professionals will not have anywhere near an adequate understanding of the process safety concerns that will play into the security plan. Worse, they will not talk the same language as the facility operational personnel. As facility employees receive the necessary training and get hands on experience with security processes this problem will ease. Facilities that use consultants for their security professionals will continue to have a language translation problem unless they establish a long-term relationship with their consultant to provide for an adequate learning curve. Facilities that hire staff security professionals will have a shorter learning curve and a better working relationship. Robust Security Forces Anonymous made another comment, almost in passing, which I think is very important and practically ignored in the recently released Draft Risk Based Performance Standard guidance document. He said that: “While the various companies might hire Wackenhut or similar security guard companies for onsite ‘security,’ what is needed for some of these Tier 1 facilities are real response and security forces similar to Nuclear Power Plant facilities.” For Tier 1 facilities, those that pose the highest risk of terrorist attack, are going to require more than a gate guard and security system monitors. There will have to be someone on site that is capable of intercepting and detaining armed intruders. This is going to require an armed security force, with all of the problems attendant to that situation. See my discussion at “Security Forces at Chemical Facilities – Sourcing Security”. Someone is going to have to take a hard look at what types of weapons can safely be used in an environment packed with flammable, toxic and/or explosive chemical compounds Anonymous One personal note, I really like to hear from my readers. I want to see their comments and I enjoy hearing their points of view and ideas. Hopefully, so do my other readers. Having said that, I have to say that I really do not like names like ‘Anonymous’. I do understand that there are people that, for a variety of political or legal reasons, cannot make public comments about security matters. I would prefer that they contact me by email (PJCoyle@aol.com) rather than using a nom-de-guere (I hope my French spelling is correct), but I realize that even that may not provide adequate deniability. Be forewarned, though, that I will be much more likely to delete an anonymous comment that is even borderline discourteous or malicious.