Rail Transportation Security – RSC Requirement

This is the first in a series of blogs that will look at the requirements of the recently released final rule on Rail Transportation Security. While the main focus of this regulation is directed at railroads, there are significant provisions (49 CFR part 1580, Subpart B) that will apply to a wide variety of chemical facilities that use railroad to ship or receive ‘specified quantities and types of hazardous materials’. 

Specified Hazardous Materials 

While the regulation includes certain explosives and radioactive materials among the specified ‘hazardous materials’, the materials that will affect chemical facilities (pages 8-9) generally are materials that are poisonous by inhalation (PIH) (49 CFR §171.8), including:

Anhydrous Ammonia Division 2.3 gasses Division 6.1 liquids in hazard zone A or B

Facilities that ship rail car quantities of these materials fall under these rules. Facilities located in a High Threat Urban Area (HTUA) (Appendix A, 49 CFR part 1580) that receive rail car quantities of these materials are also covered facilities. There are no exceptions for facilities that fall under CFATS, MTSA, nor are water treatment or waste water treatment facilities exempted. Rail cars containing ‘residual amounts’ of the specified materials are not covered under this regulation. So facilities shipping ‘empty’ railcars back to suppliers are not covered by this regulation unless they are located in an HTUA. 

Rail Security Coordinators Chemical facilities that are affected by this regulation will be required (49 CFR § 1580.101) to have a designated Rail Security Coordinator (RSC) and at least one alternate. This person will be the ‘corporate level’ point of contact for TSA. According to the final rule preamble (page 35) the RSC will “serve as the primary contact for intelligence information and security-related activities and communications with TSA, and coordinate security practices and procedures with law enforcement and emergency response agencies”. 

Contact information for the RSC and designated alternates will be provided to the TSA within seven days of their appointment or change in appointment or contact data. The contact data will include {§1580.101(d)} names, title, phone number(s) and email address(es). 

RSC Availability 

The RSC or alternate will be available to TSA on a 24-hours a day, 7 days a week basis. The use of a security center or industry call center (like CHEMTREC) will not be adequate to fulfill the contract requirements for the RSC unless the call center is “staffed 24-hours a day, 7 days a week, and must be able to immediately locate and communicate with the RSC” (page 38). Corporations that have multiple covered facilities may have a single RSC. The discussion in the preamble states that “A single RSC or alternate may have responsibility for multiple covered rail facilities that are owned and operated by one corporation, provided that the individual has the information necessary to perform the RSC’s duties” (page 41). 

RSC Training 

TSA has not provided any training requirements for the designated RSC. They have established a ‘performance standard’ (see below) for the RSC and would expect that any necessary training to perform to those standards would be provided by their employer. RSC Performance Standards (page 43)

“(A)vailable to TSA on a 24-hours a day basis, “(C)apable of serving as the primary point of contact with TSA on security matters, and “(A)ble to coordinate security practices and procedures with appropriate law enforcement and emergency response agencies.”

Draft 2009 National Infrastructure Protection Plan

DHS published a request for public comment on the draft revision to the National Infrastructure Protection Plan (NIPP). This draft document is based on a DHS triennial review of the NIPP and the public comments that it had requested earlier this year (see: “Triennial Review of National Infrastructure Protection Plan”). Comments need to be submitted (Docket # DHS-2008-0112) by December 1st, 2008.

What is the NIPP? The preface to the draft describes the NIPP and its 18 supporting Sector-Specific Plans (SSPs) as: “an integrated network of Federal departments, State and local government agencies, private sector entities, and a growing number of regional consortia—all operating together with a largely voluntary CIKR (critical infrastructure and key resources) protection framework”. The preface goes on to describe the updated draft NIPP this way:

“The current document was developed collaboratively with CIKR partners at all evels of government and the private sector. Participation in the implementation of the NIPP provides the government and the private sector the opportunity to use collective expertise and experience to more clearly define CIKR protection issues and practical solutions and to ensure that existing CIKR protection planning efforts, including business continuity and resiliency planning, are recognized.”

Public Comments I’ll be taking some time to read the 200+ page document. Then I’ll take a couple of blogs to discuss the parts that have a potential to have an impact on the high-risk chemical facility community.

DHS Announces Final Rule on Railroad Security Standards

DHS announced today on its web site the publication of the TSA’s final rule on Rail Transportation Security (49 CFR parts 1520 and 1580). Official publication in the Federal Register is expected shortly. The regulations will take effect 30 days after their publication in the Federal Register. Summary of Final Rule According to the DHS Fact Sheet posted today,

“The Rail Security final rule will require freight and passenger rail carriers to designate rail security coordinators and report significant security concerns to the Transportation Security Administration (TSA). The rule also will codify TSA’s broad inspection authority. For freight rail, the rule will ensure the positive handoff of security-sensitive materials as well as establish security protocols for custody transfers of security-sensitive material rail cars between receivers of these materials that are located in high threat urban areas, shippers of these materials, and rail carriers.”

Freight Rail and PIH/TIH Chemicals According to the summary section of the final rule:

“This rule further requires that freight rail carriers and certain facilities handling specified hazardous materials be able to (1) report location and shipping information to TSA upon request and (2) implement chain of custody requirements to ensure a positive and secure exchange of specified hazardous materials. TSA also clarifies and amends the sensitive security information (SSI) protections to cover certain information associated with rail transportation.”

More Detailed Review I will be conducting a more detailed review of this final regulation in upcoming blogs.

Video Surveillance Design

John Honovich and Doktor Jon continue to provide more information about video surveillance technology. Building on his commitment to provide more basic information on video surveillance system design (see: “Reader Comment – 10-31-08”) John has posted a new page on his web site, How to Design a Video Surveillance Solution, that will almost certainly become the basis for a new chapter in his eBook. And Doktor Jon (see: “More Reader Responses from 10-31-08 Blog”), in a new email, pointed me at a page on his site dealing with 'profiling' a CCTV system. Everyone Has a Video System Other than security fencing, video surveillance systems are probably the most common security tool. Every convenience store and fast food restaurant has at least a couple of the ever present cameras. And every TV news story about a theft or robbery at one of these establishments includes video of the crime. With all of these cameras out and about, it would seem that there is a great deal of expertise available for chemical facilities to employ in designing their video surveillance systems. The problem is that there is a fundamental difference between a couple of camera pointed at a front door and cash register and an industrial scale video surveillance system. When a high-risk chemical facility looks for a consultant or company to design and implement a video surveillance system it is important to remember that experience in designing those common commercial facility systems is not necessarily a good recommendation. Even industrial experience does not necessarily indicate knowledge of how to set up systems in and around chemical systems. Layered Approach Doktor Jon, in a November 5th email, reminds us that:

“In terms of securing industrial plants, CCTV should not really be considered as the primary intrusion detection system, or indeed deployed as the sole method of verifying an intrusion, but rather working as part of a layered approach with many other technologies and techniques being applied to best effect.”

This is point that is repeatedly made in the recently released Draft Risk Based Performance Standard Guidance document. There are a couple of different reasons for this important design consideration. First, every system has its unique strong points and weak points. Multiple systems allows for overlap of coverage and reducing the overall weak points of the monitoring system. Secondly, it is possible to defeat any security system. Multiple systems increase the difficulty faced by an adversary in developing techniques and methods for surreptitiously bypassing the security detection system. More Doktor Jon Advice One more piece of advice from Doktor Jon, via his latest email, is that CCTV systems should not be looked at as just security systems. He maintains that they may also be considered as part of the facility safety system. He says:

“In addition, of equal performance is the use of these systems as a vital safety tool, not only in terms of assisting with the day to day operations (process monitoring), but also providing a vital support role for first responders, in the event of a serious incident.”

In the one video installation project on which I was a member of the plant team, we actively considered the emergency response use of the system when we picked camera locations. We took a hard look at camera positions that would allow us to monitor unloading operations of our two most hazardous chemicals along with the storage tanks for those chemicals. We wanted to make sure that we could get the most use out of our expensive system.

RBPS Guidance – RBPS Metrics

This is the another in a series of blog posts that looks at the recently released draft DHS guidance document for implementing the Risk-Based Performance Standards (RBPS) in site security plans (SSP) for high-risk chemical facilities. The RBPS are a key component of the Chemical Facility Anti-Terrorism Standards (CFATS). This post deals with the RBPS Metrics provided for each RBPS. Earlier blogs in this series include:

RBPS Guidance – Introduction RBPS Guidance Shortcomings RBPS Guidance – 18 Risk Based Performance Standards

Each discussion of the eighteen Risk Based Performance Standards listed in the Guidance document ends with a table listing the ‘metrics’ that might be used to evaluate how a facility’s site security plan (SSP) addresses. The table is laid out so that there is a column for each of the four tiers of high-risk facilities. There is a summary level listing for each RBPS and a separate listing for each of the security measures discussed for that RBPS. Metrics are Only Guidelines The use of the term “metrics” is misleading in this draft Guidance document. They do not actually provide a measure of the security. DHS describes the information in these tables this way at the start of every RBPS Metrics table in the Guidance:

“The following table provides a narrative summary of the security posture of a hypothetical facility at each tier in relation to this RBPS and some example measures, activities, and/or targets a facility may seek to achieve that could be considered compliant with the RBPS. However, a facility may choose to demonstrate compliance through other measures, activities, and/or targets, provided DHS is satisfied that the measures demonstrated meet the level of performance specified in the RBPS.”

The fact that the ‘metrics’ provided in the tables are defined in qualitative terms not quantitative provides another level of difficulty for facilities trying to decide if their site security plan provisions adequately address the RBPS. What is clear from reading these guidelines is that facilities are going to have to work closely with the DHS inspectors during the SSP approval process. Levels of Protection In their SVA approval letter DHS will tell each facility their final assigned Tier level and the security issues that must be addressed in the SSP. Both of these pieces of information are important for determining the level of protection each facility must strive to achieve in addressing each of the RBPS in their SSP. Level of Protection Based on Tier Ranking To understand how this might work, lets look at the metrics for RBPS #1, Restrict Area Perimeter. First lets look at an extract from the summary metric (page 27) for each of the for Tiers (#1 is the highest risk tier):

Tier #1: “The facility has an extremely vigorous perimeter security and monitoring system that enables the facility to thwart most adversary penetrations and channel personnel and vehicles to access control points…” Tier #2: “The facility has a vigorous perimeter security and monitoring system that enables the facility to thwart or delay most adversary penetrations and channel personnel and vehicles to access control points…” Tier #3: “The facility has a perimeter security and monitoring system that enables the facility to delay a significant portion of attempted adversary penetrations and channel personnel and vehicles to access control points…” Tier #4: “The facility has a perimeter security and monitoring system that enables the facility to delay a portion of attempted adversary penetrations and channel personnel and vehicles to access control points…”

We can see the change from an ‘extremely vigorous perimeter” to a “vigorous perimeter” to just a “perimeter” from Tier 1 through 3, but there is no further decrease at Tier 4 reflecting that there must be some sort of ‘perimeter security and monitoring’ system at all high-risk chemical facilities. We can see a similar change in the required proficiency of that system. Level of Protection Based on Security Issue Again, we can look at RBPS #1 to see how the level of security required for different facilities also depends on the security issues identified for that facility. For this we can look at Metric 1.3, Standoff Distance:

Tiers #1and #2: “Sufficient vehicle standoff distance or alternative protective means are provided to ensure that vehicle-borne improvised explosive devices will not cause a breach of containment resulting in an uncontrolled release of a release chemical of interest from the nearest point of attack.” Tiers #3 and #4: “N/A”

From the wording we can see that this metric would only apply to facilities that have a security issue related to release COI. Facilities with theft/diversion or sabotage COI would not have to use this security measure to address the Restrict Area Perimeter RBPS. Additionally, we can deduce that facilities with a release COI security issue are not assigned to a Tier 3 or Tier 4 ranking since there are no metrics associated with those levels. RBPS that Transcend Security Issue or Tier Ranking Similarly we can see that some RBPS will have metrics that will not vary because of either security issue or tier ranking. We can think of these as transcendent RPBS. A good example of this can be found in RBPS #10, Cyber. The summary metric (page 81) is the same for all four tiers and carries no reference to any security issue:

Tiers #1, #2, #3, and #4: “The facility should have in place cyber security policies, procedures, and measures that result in a low risk of a successful attack on the facility’s critical cyber systems or using a facility’s critical cyber systems to carry out or facilitate an attack.”

There are some security measure metrics that vary somewhat by tier level for this RBPS. The following security measures have two levels of metrics, those for Tiers #1 and #2 and those for Tiers #3 and #4:

Metric 8.3.2 Separation of Duties Metric 8.3.3 – Access Control Lists Metric 8.4.1 – Cyber Security Training Metric 8.5.2 – Network Monitoring Metric 8.5.3 – Incident Response Metric 8.8.3 – Network/System Architecture Metric 8.9 – Audits

Metrics as an Evaluation Tool While DHS currently believes that the Section 550 language prohibiting the requiring of any specific security measure also requires the disclaimer discussed above, the metrics provided in this Guidance document will, for most facilities, provide a useful tool in evaluating their SSP. They won’t provide an absolute measure of compliance, but a facility that can provide an adequate justification to the DHS inspector of how their SSP addresses the listed metric, has a very good chance of having their SSP approved.

Ammonium Nitrate ANPRM Comments – 11-07-08

Back on October 30th I provided a brief analysis (see: “Ammonium Nitrate ANPRM – Comments Requested”) of the DHS Advance Notice of Proposed Rule Making (ANPRM) for regulations of the sale and transfer of ammonium nitrate. A number of commenters have already submitted their views on that issue, so it is time to start looking at those comments. As of November 7th six comments had been received and posted on the Regulations.gov web site. Those comments were from:

Westmoreland County Dept of Public Safety Norman Arendt Noah Clifton Patterson Anonymous Dept of Soil Science, ND State Hilltop Energy, Inc

Westmoreland County Dept of Public Safety Comments Christopher Tantlinger of the Westmoreland County DPS submitted two photographs (Photo #1, Photo #2)of an ammonium nitrate delivery truck overturned on the side of the road with a large portion of the solid contents spilled on the ground. He noted that the proposed regulations might want to address the security associated with these types of delivery vehicles without specifying any requirements. Norman Arendt Comments Norman Arendt addresses the ANPRM’s request for information about access to computers and computer skills of potential registrants under the new rule. He notes that many of his clients in Minnesota and Wisconsin are family farms and feed mills. He reports that computer skills are lacking and there is no access to the internet in many of these areas. He also notes that these farms and mills operate on a very slim margin and any increase in costs due to these regulations may result in many going out of business. He also reports that delivery of ammonium nitrate to this area is by barge on the Mississippi River and states that barge operators routinely accept a 15% loss of ammonium nitrate in route. Noah Clifton Patterson Comments Noah Patterson recommends that applications and certificates be filed and delivered by electronic means for the sake of efficiency while noting that provisions need to be made for hard copy operations in both instances for facilities and individuals that do not have access to the internet. He expresses concern with the potential vagueness of the standards for denial of registration. He would like to see ‘specific guidelines’ in the regulation outlining the appropriate basis for denial. He would also like to see the creation of an appeal system that includes non-DHS personnel in the process. Anonymous Comments This anonymous commenter notes that many ammonium nitrate users and sellers do not have routine access to the internet so that there need to be provisions for both electronic and hard copy submissions. He notes that agricultural extension offices may be a good source of providing information on the proposed ammonium nitrate program, but does not think that, because of budget limitations, they would be a good place to process applications. He notes that most users would be willing to switch to other types of fertilizers as long as:

It provides comparable crop growth and yield, It is applied in the same manner, It is widely available through existing fertilizer dealers, and It is of comparable cost.

Dept of Soil Science, ND State Comments R. Jay Goos notes that there are a number of acceptable substitutes for ammonium nitrate as a fertilizer. Hilltop Energy, Inc Comments Roger Hambleton notes the difficulty in meeting the theft/loss reporting requirements. He reports that because of bulk handling techniques and measurement technology, it would be difficult to detect relatively small losses during transportation and handling. My Comments on Comments Living in an area with limited internet access (only dial-up) I can sympathize with the commenters’ remarks about not relying on just internet submissions. DHS will certainly want to use electronic filing to ease the administrative burden of processing and filing the required information. Some sort of partnership with state agencies may be a solution to this problem. It is interesting to see the variety of comments about detecting losses/theft of anhydrous ammonia. I don’t have a lot of experience in handling bulk solids. Most of my experience in bulk handling was dealing with liquids. Even so, I can sympathize with commenters that cautioned that requirements for reporting losses and theft of anhydrous ammonia must take into account the practical limits of measurement technology.

Major Change to Change.gov Web Site

Last Friday I wrote a blog (see: “Office of the President-Elect”) about the website that the Obama transition team had at Change.Gov. Well, this morning when I went back to make my daily check of the site there was a major change. All of the links to issue statements like the one I quoted in Friday’s blog are gone. There is no notice about why the change was made. When I click on the link from my blog to the Homeland Security page it takes me to a page that says: “The page you requested is not available right now.” What is probably happening is that the transition team is updating what was probably a campaign page. I’ll keep an eye on the page and see if anything changes. Polarization While I am writing about this to keep my readers up-to-date about links in my blog, at least one other blogger, WarOfIllusions.WordPress.com, has found the same issue, but is pointing with alarm. This just goes to show that the polarization from the election is still present in the body politic. I was hoping that we could do without that until at least the inauguration.