Reader Comments – 05-11-09 – Video Escort Continued

As promised, this is a continuation of yesterday’s blog about the use of video systems to monitor non-TWIC personnel in the secure area of an MTSA covered facility. This is functionally equivalent to tracking personnel that lack unaccompanied access in a high-risk chemical facility. Just a reminder that, under MTSA regulations, a person without a TWIC may be escorted by monitoring when in the facility secure area, but must have a side-by-side escort in designated restricted areas in the facility. In yesterday’s blog we talked about some definitions from 33 CFR §101.105 as well as my definitions of some terms that I am using in the discussion. I failed to specifically define the term ‘target’, but it should have been obvious that the term was used to describe a person being monitored or video escorted. I talked about some ways that the target could be identified to the surveillance system. We finished yesterday’s blog with a discussion of accidental and deliberate security breaches and the need to investigate to determine into which category a security breach fell. Accidental Security Breach An accidental security breach includes any instance where the security system looses track of a person that is not authorized unaccompanied access to the facility. There are a number of legitimate reasons why a person may temporarily disappear from observation. Dead spaces in the video coverage can be caused by poor camera placement, changes in weather or lighting conditions, vehicles or other objects moving through or into the field of view of security cameras. Known dead spaces should be carefully mapped and security personnel should be well aware of those areas and what is normally found in them. These locations should be checked by roving security personnel at random intervals at least once per shift. Dead zones near or within view of restricted areas should be checked more often. Every system, cyber or human based, will have a period of time for which the subject being out of view will not be a matter of concern. A well designed system will specify the allowable time period that a target can remain out of view without requiring an alarm. The length of time will be a judgment call based on a combination of size of known dead spaces, delay time for restricted area security measures, response times of security forces, and facility risk factors. The objective is to minimize the number of false alarms while detecting all significant deliberate security breaches. Any time that the maximum allowable disappearance time is exceeded, either system should provide an alarm for a potential security breach. If the target re-appears on the system and appears to be behaving innocuously before the security response arrives on scene, the security personnel should first investigate the area where the target was out of view. They should be looking for signs of tampering with facility equipment, emplacement of observation devices or employment of IEDs or other offensive weapons. The higher the facility threat status, the more thorough that investigation should be. Once that area is cleared a member of the security team should approach the target only if the target is behaving suspiciously or the target appears to be lost. In either case, the target should be provided side-by-side escort for the remainder of the time at the facility. Monitoring or video escort should still be maintained on the target. Deliberate Security Breaches When either the automated or human monitoring system completely looses track of a target individual the reason for concern is obvious; in a high-risk environment the assumption of nefarious activity is usually the first suspicion. Operationally, any time the target individual is not locatable on the video system by the time the security response arrives on the scene, there must be an assumption that this is a deliberate security breach. Facility security procedures will dictate what must be done when a deliberate security breach is detected. The response will depend on a number of factors; including facility threat status, types of chemicals on hand, and the proximity of off-site populations. Still the response procedures would typically include provisions for:

Notifying additional security response forces including police; Notifying emergency response personnel; Increasing security level at the facility; Shutting down safety critical processes; and Moving facility personnel to a secure location.

Most importantly the facility security procedures must include procedures for detention of suspects involved in potentially deliberate security breaches. Unless a facility is using sworn law enforcement personnel for security, security personnel are unlikely to be authorized to actually arrest suspects. Procedures for detaining personnel, securing potential crime scenes and turning both over to law enforcement personnel, must be documented, reviewed by legal personnel, and coordinated with law enforcement agencies. Needless to say, frequent training and evaluation of security personnel is also required. Multiple Accidental Breaches A well executed terrorist attack is always preceded by a reconnaissance of the intended target. The higher priority the target is for the organization planning the attack, the more likely it is that there will be attempts made to evaluate on-site security procedures. One effective method to do this would be for personnel with legitimate reasons to be on site (vendors, contractors, or delivery personnel for instance) to make seemingly innocent security breaches to track security response procedures. This is one of the reasons that it is important to keep track of apparent accidental security breaches. Multiple breaches by the same person should be regarded as suspicious activity. Off-site investigation of suspicious must be accomplished by law enforcement personnel, not facility security personnel. This means that suspicious activity needs to be reported to law enforcement as soon as it is identified. The facility should be prepared to share all available information when the report is made. Facility Security Plan The facility security plan needs to address all of these issues. The use of monitoring or video escort technology in place of side-by-side escorting of personnel not authorized unaccompanied access to the facility must be fully documented. Response procedures, including time limits for acceptable loss of target from observation, must be clearly delineated, trained and periodically evaluated in drills and exercises.

Reader Comments – 05-11-09 – Video Escort

As I had hoped, John Honovich has responded to yesterday’s blog on using video systems to monitor non-TWIC personnel. John writes (in part, see the whole comment attached to yesterday’s blog):

1. It's very hard to set up video surveillance cameras to cover all areas of a facility. Lots of logistical barriers exist - some permanent, like trees, walls and storage areas and some temporary like trucks, containers, etc. The risk is high that significant gaps will exist in coverage. Designers may try to use PTZ (controllable cameras) but then someone needs to control them and they may still have issues with barriers preventing them from seeing areas. 2. If video analytics are used (such as Siemen's SiteIQ), there will certainly be issues where the system losses sight of an unescorted person. This could be because of inclement weather or more frequently, bright sunlight or darkness obscuring a person. 3. One of the key benefits of a human escort is that the human escort can instantly respond and intercept an unregistered visitor from causing damage or violating regulations. With video surveillance, an operator will have to dispatch a responder which costs critical amounts of time.

John and I also traded a series of emails about this subject yesterday (most of the points John made there were included in his posting). Those conversations brought out some information that was lacking in the original blog posting.

Definitions 

To keep this discussion clear and understandable we need to look at three definitions in 33 CFR Part 101 – Maritime Security. These definitions are for the terms, ‘escort’, ‘secure area’ and ‘restricted area’ come from §101.105:

“Escorting means ensuring that the escorted individual is continuously accompanied while within a secure area [emphasis added] in a manner sufficient to observe whether the escorted individual is engaged in activities other than those for which escorted access was granted. This may be accomplished via having a side-by-side companion or monitoring [emphasis added], depending upon where the escorted individual will be granted access. Individuals without TWICs may not enter restricted areas [emphasis added] without having an individual who holds a TWIC as a side-by-side companion, ****” “Restricted areas mean the infrastructures or locations identified in an area, vessel, or facility security assessment or by the operator that require limited access and a higher degree of security protection.” “Secure area means the area on board a vessel or at a facility or outer continental shelf facility over which the owner/operator has implemented security measures for access control in accordance with a Coast Guard approved security plan.”

For purposes of this discussion we will assume that the same terms and restrictions apply to high-risk chemical facilities under CFATS. That isn’t strictly true, but it is close enough for our purposes. For example, TWICs are not required for most high-risk chemical facilities, but the underlying identification and vetting requirements do apply. There are two other terms that I will use that are not included in the regulations list of terms, so I will provide the definitions for their use in this discussion. Those terms are ‘monitoring’ and ‘video escorting’:

“Monitoring means the use of a video system by a trained operator to track the movements of personnel through the non-restricted areas of the facility.” “Video escorting means the use of video system and a software based security management system to automatically track personnel movements through non-restricted areas of the facility. The system will alarm when tracked individuals leave a designated area or enter areas other than those designated for that individual.”

While ‘video escorting’ is a form of ‘monitoring’ it turns more control to the software for moment to moment observations allowing the human monitor to track more people at one time. The human monitor remains in the loop to respond to alarms, direct security personnel and watch for non-standard conditions that might interfere with software observation.

Identification of Targets 

One of the problems that John pointed out in our email exchange is that for video escorting you need to have a way to initially identify the escorted ‘target’ to the system. This would typically take place at one of the entrances to the facility. A security guard would establish the identity of the person and verify that the person was authorized some level of access to the facility using whatever controls required by that facility security plan.

This would have to include a clear designation of what areas that person was authorized to go without side-by-side monitoring. All of that information would have to be entered into the security management system. This would effectively establish an electronic tag for that individual containing the essential security information about that individual. A more sophisticated system could include a copy of the individual’s ID and a photo of the individual.

SPECIAL NOTE: privacy rules would probably require that the individual be informed that the facility would maintain these records in their security files. Then there would have to be some way to link the information tag to the virtual location of the individual on the facility map. The details of this would vary by the system used, but it could be as simple as having the person stand in a designated position at the gate while the security system acquired with the video tracking system. As noted in the original article this could get more involved by including an RFID tag on the visitor’s badge with sensors/readers scattered around the facility to add location verification capabilities to the system. Even something as simple as using a different color head gear for these targets would be an aid for the system identification.

Response Requirements 

A key part of the escort definition in §101.105 is the requirement to be able to “to observe whether the escorted individual is engaged in activities other than those for which escorted access was granted”. Missing from that definition is the derived necessity of being able to take appropriate responses to the unapproved activity. The vast majority of these ‘security breaches’ are going to be unintentional errors by the person moving about the facility on authorized business.

The appropriate response would be to have someone intercept and talk to the individual to set them on the proper path. The small number of intentional breaches is going to require a different level of response, but would still begin with interception. To differentiate between the two types of breaches will most often require some level of investigation. Unless all escortees are going to be given communications devices, this will require a security person to find and intercept the person doing the unexpected. This may become manpower intensive as the number of escortees rises and erase the personnel gains realized by installing a video escort system.

To Be Continued – This entry is getting more than a little long, and there is much more to discuss, so we will take this as a natural stopping point and resume this tomorrow.