Thursday, August 23, 2007

More changes to the DHS Web Site

There have been changes to two more of the DHS Chemical Security Web Site Pages. The first is more cosmetic than anything else. The 2007 Chemical Sector Security Summit page has been changed to an advertisement for the up coming June 2007 meeting to a report on that meeting. It reads more like a press release than an actual information page. Along with this they removed access to the Proposed Agenda page which makes a great deal of sense.

 

The second change was made on the Accessing the Chemical Security Assessment Tool (CSAT) page. They added access to a new .pdf document: the CSAT User Change Request User Guide (PDF, 26 pages – 686 KB). This document provides instruction on how to make changes to the previously registered Preparer, Submitter, and Authorizer for a site. It also provides instructions on how to convert a Submitter for multiple sites to a single user/password status. This will make it easier for corporations with multiple sites to use a single Submitter for multiple sites, and that Submitter will only have to remember a single User Name and Password.

 

I am still expecting to see a final version of the Appendix A out some time soon, along with the appropriate changes to the Top Screen. DHS is again getting some heat from Senators (Delaware this time) complaining about agricultural propane users being affected by this legislation. I expect to see some sort of clarification on this issue, among others, when the final version of the Appendix A comes out.

Friday, August 17, 2007

The National Infrastructure Advisory Council meeting

The Department of Homeland Security (DHS) published an meeting notice in today’s Federal Register announcing the upcoming meeting of the National Infrastructure Advisory Council on October 9, 2007 in Washington, DC. One of the items to be covered at this meeting be a presentation by the Insider Threat to Critical Infrastructure Operators Working Group. This working group made an initial presentation at the July meeting of the advisory council.

 

DHS considers the “Insider Threat” of particular importance in planning for security at high-risk chemical facilities. Section 27.215 of the new 6 CFR part 27, Chemical Facility Anti-Terrorism Standards (CFATS), specifically requires that the Threat Assessment includes a description of “possible internal threats, external threats, and internally-assisted threats”; two of the three possible threats include operations by insiders. In Section 27.230 the seventh Risk Based Performance Standard covers sabotage and specifically describes the requirement to: “Deter insider sabotage”. The same section also requires the establishment of a Personal Surety Program, performance standard 12, a tool to help prevent insider attacks.

 

Anyone that will be working on Security Vulnerability Assessments or Site Security Plans for high-risk chemical facilities should be interested in the presentations made by this working group

Monday, August 13, 2007

Other terrorist threats

While there has been a great deal of attention paid to the threat posed by Al Qaeda in potential terrorist attacks against chemical facilities, there is nothing in the new Chemical Facility Anti-Terrorism Standards (CFATs, 6 CFR part 27) that refers to Al Qaeda or infers that there is only a single type of terrorist threat. In fact, the recent National Intelligence Estimate, The Terrorist Threat to the US Homeland, mentions threats of terrorist attack by Hizballah, home grown Islamic radicals, and “single issue” non-Muslim terrorist groups, specifically saying:

 

 

“We assess that globalization trends and recent technological advances will continue to enable even small numbers of alienated people to find and connect with one another, justify and intensify their anger, and mobilize resources to attack—all without requiring a centralized terrorist organization, training camp, or leader.”

 

One such “single interest” group that has been showing increasing readiness to use violence in support of their cause is the radical side of the animal rights movement. Last month there was an attempted bombing of a UCLA researcher’s car, purportedly by the Animal Liberation Brigade.   Jerry Vlasak, co-founder of  the North American Animal Liberation Press Office, and self appointed spokesman for radical animal rights groups has been quoted in the LA Weekly as saying; ““I think the animal-rights movement has been way too slow in taking radical actions,” he says. “And they’ve been way too nice.””

 

This is not the only type of group that has its violent radical fringe. In fact, every legitimate protest group in the country attracts its own radical element that, while beyond the control of the main stream body, receives some measure of support and respect from the nonviolent side of the protest. This was seen in the Civil Rights movement in the 1960s, the Anti-War movement of the 1970s, and more recently in the Anti-Abortion movement. Similar fringe groups can be found associated with almost any significant protest movement.

 

While it is easy to dismiss these small fringe groups as being ineffective, we must remember that the second most deadly terrorist attack in the United States to date, the bombing of the Murrah Building in Oklahoma City, OK was carried out by a small group of people, with only two being actively involved in the actual plot. Facilities storing dangerous chemicals are potentially a valuable target for such groups because a relatively small, uncomplicated attack, if successful, can have a spectacular result.

 

Chemical facilities will have to take these fringe groups into account when they do their security planning. Part of the Security Vulnerability Assessment (SVA) that all high risk facilities are required to submit to DHS includes a threat assessment. In this part of their SVA the facility should include mention of any organizations with potential fringe elements that may pose a threat to the facility because of facility’s products, business associates, or political ties in this country or overseas. These fringe organizations may increase the threat to that particular facility beyond that seen in the industry as a whole.

 

Threat assessment is a key part of any security plan. Acknowledging that fringes of political and social protest movements may pose a threat to organizations or facilities protested against is a first step in developing a viable threat assessment.

Saturday, August 11, 2007

First Security Vulnerability Assessments to be done soon

On June 8th of this year the new Chemical Facility Anti-Terrorism Standards (CFATS) went into effect. Three days later, according to congressional hearing testimony by Col. Bob Stephan, Assistant Secretary Infrastructure Protection, the first notifications went out to fifty facilities to complete a Top Screen with additional facilities being notified on the 13th. The sixty-day deadline to complete those first Top Screens was over yesterday with the remaining to be completed by Sunday. This means that notifications to start completing Security Vulnerability Assessments (SVA) should start going out in the next week or so to the highest risk facilities, Tiers 1 and 2.

 

We should be seeing additional changes to the DHS web site with explanations about how the SVAs will be completed in the Chemical Security Assessment Tool (CSAT). There is also the possibility that the revised Appendix A, DHS Chemicals of Interest, will be released soon, along with changes to the Top Screen. Those changes would effect those facilities not already notified to complete a Top Screen that have (or plan to have) chemicals on site listed in the revised Appendix A at levels above the STQ.

 

Additional information provided by Col. Stephan indicated that there would be significant revisions to Appendix A with changes to some of the Screening Threshold Quantities (STQ) and the addition of blend rules for some chemicals. This would require some changes to the Top Screen including revisions of the two .pdf downloadable files supporting the Top Screen on the CSAT web page; CSAT Top-Screen Questions and CSAT Top-Screen User Manual. It would have been very inappropriate to change the Top Screen during the middle of the initial 60 day filing period.

 

It will be interesting to see if DHS publishes any data about these initial entries into the CSAT system. While no one expects them to provide any site specific data, a brief press release about the number of facilities that provided data, and were subsequently declared to be High-Risk Facilities would be interesting as would information about the Tier ratings. Because of the way these facilities were selected for providing Top Screen information we should expect that a very high ratio would be declared to be at high risk for terrorist attack.

Thursday, August 9, 2007

Biometric Security for Control Systems

We are a little bit early in the process yet to be worrying too much about Site Security Plans, but there is going to be a teleconference next week that will be looking at biometrics and security systems that Security Managers might want to pay attention to. The teleconference is being sponsored by IBG, a biometrics provider, and can be watched on the web live or archived after the event.

 

One of the problems that many chemical manufacturing sites will have with their security plans is that the best way to attack many of their critical assets will be through their automated control systems. While there are many things that can be done to help to prevent off-site access to these systems, hardening the on-site controls to prevent unauthorized access is more difficult. One of the options is to use biometrics to control access to the controls.

Wednesday, August 8, 2007

More DHS website updates

DHS is continuing to make changes on their web site with respect to the chemical facility security pages. Today the pages dealing with Chemical-terrorism Vulnerability Information (CVI) have been updated. The old page, Chemical-terrorism Vulnerability Information, has been modified by adding links to six new pages:

 

Defining Chemical-terrorism Vulnerability Information

Evaluating Need to Know for Chemical-terrorism Vulnerability Information

Accessing Chemical-terrorism Vulnerability Information

Handling Chemical-terrorism Vulnerability Information

Sharing Chemical-terrorism Vulnerability Information

Training for Chemical-terrorism Vulnerability Information Access

 

The information on these pages is mainly a re-write of the information provided in the CVI Procedural Manual. It is a bit more accessible on these web pages, but there is no new information here. It is odd that, while there are references, and links, to many pdf documents on these pages, none of them has the link to the Adobe Acrobat download page that was recently added to some other pages on this site, see my earlier blog entry. It would seem that DHS is not doing a good job on site continuity, with different people preparing different pages. This is a common problem with complex informational web sites.

Monday, August 6, 2007

Minor DHS Web Site changes

DHS is continuing to update their web site. Two pages were changed today to add a link to download the Adobe Acrobat (pdf) reader software necessary to read some of the DHS publications that can be downloaded from the site. The two pages that have changed are:

 

Chemical Security Assessment Tool

 

Accessing the Chemical Security Assessment Tool (CSAT)

 

This download link is common on web sites that provide pdf files for downloads. Practically speaking, just about everyone that will be accessing the site will already have the reader on their computer, but this is just good web site management.

 
/* Use this with templates/template-twocol.html */