West Fertilizer Facility and CFATS

I just had an interesting conversation with a television news person who contacted me about some research he was doing about the explosion the day before yesterday at the West Fertilizer Company facility in West, TX. He had apparently talked to someone at ISCD earlier who told him that (so this is now third hand information that I have not verified) that the facility had not filed a top screen reporting the anhydrous ammonia stored in two storage tanks on site. The facility has (according to rtknet.org) had filed Risk Management Plan (RMP) reports with the EPA documenting 54,000 lbs of anhydrous ammonia on site.

CFATS Coverage

I was asked if I thought that it would be unusual for a facility of this type not to have filed a Top Screen. My reply was essentially yes and no. I mentioned that ISCD had done considerable outreach to chemical facilities in the years since the introduction of the program in 2007. I know that agricultural supplier organizations were one of their target audiences in the early days; so one would like to think that the word had gotten down to facilities like West Fertilizer.

But the CFATS program is the Chemical Facility Anti-Terrorism Standards and I would bet that many owners of facilities like this ignored the information pushed their way because they knew that they weren’t ‘chemical companies’; they were agricultural supply retailers. That plus the fact that no terrorist worthy of the name would waste their time in an attack on a rural facility like the one in West, TX would tend to reinforce the view in the minds of many owners of this type of facility that the CFATS program couldn’t possibly apply to them.

Anhydrous Ammonia Explosion?

I was also asked if I though an anhydrous ammonia bleve (Boiling Liquid Expanding Vapor Explosion) could have been responsible for the catastrophic explosion at the facility. Now I am hardly an expert on bleves, but I do know that they are typically preceded by a hot fire outside of the tank (and videos and news reports certainly show a fire before the explosion) and can produce spectacular explosions. Now anhydrous ammonia is hardly a flammable chemical, but a fire hot enough to cause the combination of tank softening and increased pressure necessary for a bleve would certainly be hot enough to ignite an anhydrous ammonia cloud. So you certainly have a potential for a fuel-air explosion.

There are other possible explosion sources at a fertilizer company. An Ag retail facility like this could typically be expected to store/sell ammonium nitrate and urea fertilizers. Both of these types of fertilizers can also produce spectacular explosions. So why the immediate focus on the anhydrous ammonia? It is the only chemical that a news organization can readily confirm was located at the site by searching an on-line source like rtknet.org; neither ammonium nitrate nor urea are required to be reported to the EPA under the RMP program.

Google Map® Investigation

This conversation peaked my interest enough that I did a map investigation of the facility using Google Maps®. If you look at the facility from the satellite view you will see four good size tanks; three to the north of the two main buildings and one to the south. None of these tanks would be holding anhydrous ammonia; they are not pressure tanks.

I can’t tell what is actually in them, but the large diameter piping going to the smaller three of these tanks would be typical of a solids handling system similar to the type used to handle ammonium nitrate or urea.

Again, I can’t see any tank markings in these satellite images, but I think that we’ll find that the two anhydrous ammonia tanks are among the four horizontal tanks south of the larger building along the railroad siding. These horizontal tanks are commonly used for storing anhydrous ammonia.

Now there are a number of smaller vertical tanks between the building and the horizontal tanks. If these tanks contained some sort of flammable or combustible liquid and they released their contents to the ground you could get the type of fire that could cause a partially filled anhydrous ammonia tank to bleve. Of course this is also the type fire that we would expect a responding fire crew to be flooding with water and that would effectively prevent a bleve.

No, I think that we will find that one or more of the three intermediate size tanks held ammonium nitrate and that was what caused the devastatingly catastrophic explosion.

Chemical Safety Board Starting Investigation

The Chemical Safety Board investigators started arriving on site yesterday. They are deploying a large contingent because of the number of deaths and the amount of property damage that certainly places this chemical accident among the most deadly in recent memory. There is no telling how long it will take for them to complete their investigation, but we should start to hear some definitive information being provided by the CSB to the national media.

HR 624 Passes As Amended in House

Today the House passed HR 624, CISPA, by a largely bipartisan vote of 288 – 127 after passing a number of amendments to the bill. About half of the Democrats in the House voted in favor of the bill. It looks like all of the amendments considered yesterday and today were adopted by nearly unanimous votes. One amendment, #8 from Rep. Sanchez (D,CA), was modified in some manner, we won’t know specifically how until the Congressional Record is printed tomorrow.

HR 1468 Introduced - Cybersecurity

As I noted last week Rep. Blackburn (R,TN) introduced HR 1468, the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2013 (SECURE IT). This is very similar to HR 4263 and S 2151 that were introduced in the 112^th Congress.

Changes

This latest version of SECURE IT has been substantially revised from both of the earlier versions. The bill remains essentially a Federal IT security bill with a few odd provisions that will affect the private sector and control systems.

The gross changes from the previous House bill include the following additions:

§ 104. Construction.

§ 205. Clarification of authorities.

§ 307. No new funding.

TITLE V—Data Security and Breach Notification

Title V addition significantly broadens the effect of the bill in that it provides notification requirement for breaches of computer systems that result in the compromise of personally identifiable information from computers in both the government and private sectors.

The following sections were not included from the earlier House bill:

§ 404. Cloud computing services for research.

§ 405. Cybersecurity university-industry task force.

§ 410. Cybersecurity strategic research and development plan.

§ 414. Cybersecurity automation and checklists for Government systems.

§ 415. National Institute of Standards and Technology cybersecurity research and development.

Removing that last section had an impact on control system security in that §415(e)(4) had directed NIST to “carry out research associated with improving security of industrial control systems”.

Important ICS Provision Remains

The most important provision (from an ICS security view point) from HR 4263 still remains virtually unchanged;  § 305, Damage to Critical Infrastructure Computers. This would amend 18 USC Chapter 47 by adding ‘‘§ 1030A. Aggravated damage to a critical infrastructure computer. This section would make it a federal crime to knowingly cause or attempt to cause damage to a critical infrastructure computer if it results in substantial impairment of either the computer or “the critical infrastructure associated with the computer”. Violations would be punishable by fines and or imprisonment for 3 to 20 years.

Moving Forward

This bill went nowhere in either the House or Senate last session. If it had been introduced earlier it might possibly have been considered by the House yesterday, but it faces an uphill battle because of the number of different committees (six) that would have to consider it because of the number of different areas that it impacts.

Bills Introduced – 04-16-13

While the House was working on cybersecurity bills and the Senate on gun control legislation there were three bills introduced that might be of specific interest to the chemical security and cybersecurity communities. They are:

HR 1583 Latest Title: To amend the Homeland Security Act of 2002 to establish an appeal and redress process for individuals who are screened against the terrorist watchlist and wrongly delayed or prohibited from boarding a flight, or denied a right, benefit, or privilege, and for other purposes. Sponsor: Rep Clarke, Yvette D. (D,NY)

HR 1584 Latest Title: To amend the Homeland Security Act of 2002 to prevent terrorism, including terrorism associated with homegrown violent extremism and domestic violent extremism, and for other purposes. Sponsor: Rep Clarke, Yvette D. (D,NY) 

S 733 Latest Title: A bill to amend the Department of Energy High-End Computing Revitalization Act of 2004 to improve the high-end computing research and development program of the Department of Energy, and for other purposes. Sponsor: Sen Alexander, Lamar (R,TN)

HR 1583 might impact both the TWIC program and the new CFATS Personnel Surety Program. There is no telling exactly what efforts Ms. Clarke is proposing until we see the actual language of her bill. And Lamar’s bill might be a cybersecurity bill or it might just be a cyber bill, only a review of the actual legislation will tell.

PHMSA Increases Maximum Civil Penalties for HMR Violations

The Pipeline and Hazardous Material Safety Administration published a direct final rule in today’s Federal Register (78 FR 22798-22800) raising the maximum civil penalties “for a knowing violation of the Federal hazardous material transportation law or a regulation, order, special permit, or approval issued under that law”. Since PHMSA is simply incorporating Congressional requirements (from §33010 of of MAP-21 (Pub. L. 112-141) it has bypassed the normal publish-comment-and-review regulatory process.

Today’s rule will change 49 CFR §107.329 and §171.1 to:

• Revise the maximum civil penalty from $55,000 to $75,000 for a person who knowingly violates the Federal hazardous material transportation law or a regulation, order, special permit, or approval issued under that law;

• Revise the maximum civil penalty from $110,000 to $175,000 for a person who knowingly violates the Federal hazardous material transportation law or a regulation, order, special permit, or approval issued under that law that results in death, serious illness, or severe injury to any person or substantial destruction of the property;

• Remove the current $250 minimum civil penalty; and

• Revise the minimum penalty amount to $450 for a violation related to training.

The effective date for the rule is today and it will “apply to violations occurring on or after October 1, 2012”. 

Boston Marathon Explosives Speculation

It is still too early into the investigation of yesterday’s dual bombings along the route of the Boston Marathon to know for sure what actual explosives were used in the attack. Having said that a CNN report yesterday makes the following comment:

“Based on the bombs' effects, the devices could have been small enough to be concealed in small bags or boxes, a law enforcement official said. The smoke was consistent with a "low-velocity improvised explosive mixture, perhaps flash powder or sugar chlorate mixture," the official said.”

IF the ‘sugar chlorate’ mixture was the material of construction, it MIGHT indicate (note the big ‘IF’ and the big ‘MIGHT”, this is all speculation at this point) it might indicate that a theft/diversion of a DHS chemical of interest (COI) was involved in this attack. Either sodium chlorate or potassium chlorate would be effective in this role and both are DHS COI.

The theft/diversion would not necessarily have had to come from a CFATS covered facility. The small size of the device (probably less than 1.5 gallons according to the previously mentioned news story) would have required must less than the 400 lbs Screening Threshold Quantity (STQ) that would initiate the CFATS coverage process.

If it turns out that one of those two chlorates was actually used in the bombs (and the FBI labs will certainly be able to determine that), then we can be pretty sure that FBI agents will be visiting all CFATS facilities in the Northeast (and probably everywhere east of the Rockies) that reported inventories of either of the two components on their Top Screens. I would assume that ISCD would share that data with the FBI on all top screen submissions, not just currently covered facilities.

We’ll just have to follow the news and see where this takes us.

House Rules Committee Adopts Rules for Debate on HR 624

This evening the House Rules Committee adopted H. Res 164, a structured rule for the consideration of HR 624, Cyber Intelligence Sharing and Protection Act (CISPA). The rule provides for limited debate and the consideration of 12 amendments. The Majority Leader’s web site says that the debate on HR 624 will begin tomorrow afternoon and continue through Thursday with a vote no later than 3:00 pm EDT.

The Committee considered over forty amendments that were submitted by various House members and pared it down to 12. Nothing in the bill or its proposed amendments specifically addresses control system security issues.

I expect that most of the cleared amendments will pass and the amended bill will almost certainly pass of a somewhat bipartisan vote. Whether the offered amendments will change the bill sufficiently to avoid a threatened Presidential veto remains to be seen. The point is almost moot because I doubt that the bill will make it to the floor of the Senate, the next required stop on the road to the President’s desk.