Reader Comments 12-16-08

In a comment posted yesterday, ThomKay took exception to the use of the term ‘eco-terrorist’ in my blog about the power plant incursion (see: “Major Security Breach”). When I was writing that piece I thought that there might be some objection to that comment, but I was in a hurry to get back to another project I was working on, so I did not explain the use of the term. First off, to date there has been a significant difference between the operations of ‘eco-terrorists’ and terrorists such as al-Qaeda (to site an extreme example). Eco-terrorists have generally been pretty careful to restrict their actions to property and not people. The few times that people have been hurt seem almost accidental or negligent rather than acts of malice or intent. While I vehemently disagree with their attacks on property, I do agree that I would much rather see them attack property than people. That is why I am careful to use the term ‘eco-terrorist’ rather than the more general term ‘terrorist’. A Continuum of Political Activity Now, looking at ThomKay’s specific complaint, he writes “Activists are not terrorists. Loosely using this term is unfair to non-violent activists who participate in civil disobedience in order to effect change.” He is correct; an activist is not necessarily an eco-terrorist and is certainly different from a terrorist. Unfortunately these are all part of the continuum of political activity and the lines between them are not easily defined. And reasonable people will disagree where those lines are drawn. Protestors that picket power plants are certainly not ‘eco-terrorists’. Protestors that lie down in the roads to those power plants to stop workers or supplies from entering the plants are activists practicing civil disobedience. They will be arrested for various misdemeanors and I have a certain amount of admiration for their convictions and perseverance. Protestors that slash tires of workers or delivery people to stop them from entering a those power plants have, in my opinion, stepped over the line to ‘eco-terrorist’ activities. Drawing the Line on the Turbine Incident The first thing that comes to mind when examining the shut down of the turbine at Kingsnorth is that there is nothing in the reports that indicates that there was any property damage involved. This would tend to move the line towards activism. Unfortunately, the unscheduled shut down of a high-speed turbine is a complex operation. The slightest error in that operation will result in locally catastrophic consequences. The slightest mistake could have resulted in the effective destruction of that turbine with the potential for damage to surrounding equipment and personnel. Even if the perpetrator of this shutdown was an experienced power plant operator (and that seems very likely to me) the stress of situation would greatly increase the possibility of making errors in the shut down operation. Furthermore, the sudden removal of 500 MW from the electrical grid certainly has the potential for knocking out significant portions of the grid. That loss of power has the potential for a number of potentially serious consequences. Because of the high potential for on-site damage and off-site consequences, I believe that this incident stepped over the line to eco-terrorism. If he had simply entered the facility and tagged the equipment or room with appropriate green slogans, and exited with photographic evidence of his exploits I would certainly have called him an activist while I castigated the facility for its inexcusably inept security. But no, the potential for property damage moved it too far out the line of political action for my taste. No Such Thing as Absolute Security ThomKay does make one final point in his comment posted to yesterday’s blog that is very important. He writes that this “further demonstrates that guards, gates, and gadgets do not result in enough security to prevent real terrorists from releasing chemicals into communities”. While there was a seriously poorly executed security program at place in this instance, Tom’s general point is absolutely correct. There is no security plan that will provide absolute protection against a determined attacker. Any security planner that fails to take that into account needs to look for another job. Security plans cannot stop at fences, guards and gadgets. It has to include an active counter-surveillance operation and personal surety plans because a well planned attack requires extensive knowledge of the facility. Mitigation plans have to be made to deal with the potential successful attack. Plans have to be made to deal with off-site consequences. And yes, facilities must take a serious look at Tom’s unstated, but not forgotten desire, alternative chemicals and processes that would make a successful attack much less dangerous.

Training for Recognition of IED’s for Railcar Inspections

On December 26th the new Rail Transportation Security Rule will take effect. One of the requirements of that rule is that all covered hazmat shippers are required to inspect railcars for signs of tampering or the presence of improvised explosive devices {§ 1580.107(a)(1)}. Obviously the covered hazmat shippers will be required to train their personnel to complete this requirement. In an earlier blog (see: “Rail Transportation Security – Rail Car Chain of Custody”) I noted that “According to the preamble to this final rule (page 84) TSA is in the process of completing a DVD that may be used to train people in ‘identifying IEDs and signs of rail car tampering’.” Well, yesterday I did a search of the TSA site, and sure enough they do have such a training DVD available. All you have to do is copy the request form (TSA Form 1913) from the TSA site and mail it off to the address on the form or send it by email to freightrailsecurity@dhs.gov. According to the form there is also a Freight Rail Security Awareness Brochure that can be requested at the same time. I have not had a chance to review either yet. As you might expect, as soon as I get a chance to review these training tools, I’ll certainly report on them in a future blog.

Revised Submission Date for ASP for Tier 4 Facilities

Breaking News! DHS posted on their web site today that they are extending the submission deadline for submission of Alternate Security Plans for Tier 4 facilities. The new deadline is now December 31st. This was not posted in today’s Federal Register and there is no indication on the web page that it will be posted. SPREAD THE WORD. There is no explanation on that site for the reason for the change, but I suspect that it has something to do with the problems some facilities have been having with their submissions of ASP’s (see: “More on the SOCMA SVA Problems”).

Major Security Breach

If the security gods were ‘shuddering in dismay’ Saturday they are absolutely outraged today. Nancy Bartels in her blog at ControlGlobal.com points us at a story out of Great Britain where an eco-terrorist climbed over the security perimeter at a major British power plant, walked through an unlocked door, shut down a 500 MW power generation turbine, and then walked out of the plant. Oh, yes, he also left a hand made banner that read “No New Coal”. When did this happen? According to the Guardian Newspaper article it happened on November 28th. Police are still investigating, but they have no clue who the individual was. Inadequate Security Security must have been poor, right? Well, the Guardian describes this as the “most heavily guarded power station in Britain”. And rightfully so, it has been the target of a number of ecological protests (see: Evolving Eco-Terrorist Groups) centered on the facility’s massive use of coal. The British have spent £12M on security. The perimeter consists of two 10 foot electrified fences topped with razor wire. The area is covered by video cameras that caught the whole incident on tape. Sounds like impressive security, what went wrong? Well, there were some serious gaps in the security plan. Let’s work backwards from the point where he shut down the turbine:

He was able to physically access a computer control system in the facility; a computer that was apparently neither password-protected nor physically secured. He gained access to the operations floor of the facility through an unlocked door. He walked across the open ground around the facility even though he was captured on the video system (both coming and going) without catching the attention of security. He scaled two electrified security fences without setting off an alarm. He was able to reconnoiter the site without detection.

It sounds like the facility felt secure behind its high-tech fences. It also appears to be a very expensive lack of security. Nancy Bartels has some extremely interesting question in her blog:

“Who was watching those screens? If the answer is "nobody," then why bother to install them in the first place? If the answer is "somebody," shouldn't he or she have done something besides just watch?”

And, of course, she ends her blog with the best question of all, “As for all you folks in charge of your process operation's security, how well are you sleeping tonight?”

National Infrastructure Advisory Council Meeting 01-06-09

DHS announced in today’s Federal Register that the National Infrastructure Advisory Council (NIAC) will conduct a meeting on January 6th, 2009. The meeting will be held in Washington, D.C. and will be open to the public. Oral comments from the public will not be allowed, but written comments may be submitted before December 30th (Docket No. DHS-2008-0192). The meeting will include a status report on the Frameworks for Dealing With Disasters and Related Interdependencies Working Group and discussion on establishing a working group for the upcoming study on Infrastructure Resiliency.

HAZMAT Enhanced Enforcement Rule Comments – 12-05-08

A week has passed since the comment period ended on the Pipeline and Hazardous Materials Safety Agency and the comments are still coming into the Regulations.Gov web site, though at a much slower pace. Since the last blog reviewing comment submissions (see: “HAZMAT Enhanced Enforcement Rule Comments – 12-05-08”) there have been three corporate comments and 1 comment supporting the comments made by National Association of Retail Ship Centers. This will probably be the last blog in the series. The three corporate comments were received from: Reusable Industrial Packaging Association Arkema Inc Dangerous Goods Advisory Council The single comment supporting the NARSC was another form letter submission, bringing the total to 36. It was received from: Don VonderBurg Reusable Industrial Packaging Association Comments The RIPA did not believe that the definition of ‘freight container’ does not need to contain a volumetric capacity and proposed an alternative definition for this term. RIPA suggests that DOT should circumvent the requirements for inspectors to reclose a packaging using the ‘manufacturer’s closure instructions’ (since they would probably not be available to the inspector) by just requiring the inspector to use an ‘approved PHMSA closure method’. RIPA believe that packaging manufacturers, reconditioners or distributors should be held liable for failure of a packaging after it has been opened and reclosed by a DOT inspector. Arkema Inc Comments Arkema would like clarification of what would cause an inspector to be ‘suspicious of packages’. They would also like clarification of how an inspector will know what the manufacturer’s instructions are for closing packages. Dangerous Goods Advisory Council The DGAC is concerned about carriers, shippers or receivers being held responsible for ‘unacceptable safety performance’ of inspectors while opening packagings. DGAC believes that DOT should ‘unambiguously’ identify who is responsible at each stage of the inspection, packaging opening/reclosure, storage and return to shipping process. DGAC recommends that package opening inspections should only be made at the shipper’s or consignee’s location, not at roadside stops. DGAC questions how the DOT inspectors will identify or select ‘appropriate facilities’ for conducting evaluations of packagings and identifications of shipped materials. DGAC has numerous concerns about the ‘Out of Service’ provisions in the rule and specifically notes that any time an inspector stops or removes a package in transit, it is in effect ‘Out of Service’ DGAC believes that the ‘cost to industry’ estimates are ‘grossly understated’ and provide an example of one of their member companies that could incur costs of $100,000 for a single opened package. DGAC suggests that a supplementary NPRM be issued once the comments made to this NPRM are addressed and the rule is revised. My Comments on Comments The comments from both RIPA and DGAC identify some serious shortcoming with the proposed regulations; most of which have been identified previously. As always, I think that anyone that identifies a problem and then proposes a specific response, as has been done by RIPA, makes it more likely that they will be taken seriously by regulators. It certainly is no guarantee that the proposed wording will be accepted, but it will increase the chances. DGAC’s recommendation that a new NPRM be issued after the rule is re-written would normally be a non-starter; that require too long an increase in the time necessary to get a regulation into effect. In this case where there is a new administration that will be doing the issuing of the regulation, I think it is much more likely that a new NPRM may be issued. Still it will depend on how much the new administrators pay attention to the comments of the industry.

High-Risk Chemical Facility Identified in Local Press

Somewhere the security gods are shuddering in dismay; there has been a high-profile violation of the rules protecting Chemical-Terrorism Vulnerability Information (CVI). The Orlando Sentinel broke the story about a local high-risk chemical facility that is in the process of preparing their Security Vulnerability Assessment. What is the identity of the well known chemical facility? It is Sea World. Actually, three Orlando area theme parks had to submit Top Screens, according to the story. Both Disney World and Universal were told by DHS that they were not designated as high risk facilities. Busch Entertainment Corp, the owners of Sea World, would not tell the Orlando Sentinel if their other two Sea World Facilities (in San Diego and San Antonio) were also undergoing SVA evaluations (well, someone understands security). So, someone at Sea World leaked the information to the reporter, Jason Garcia, at the Orlando Sentinel. Also, according to the story, the CFATS status appears to have been confirmed by a facility spokeswoman. So what? What can DHS do about it now that the cat is out of the bag? According to Section 27.400(j), the unauthorized disclosure of CVI is “is grounds for a civil penalty and other enforcement”. Section 27.300(b)(3) sets the maximum penalty at $25,000. The newspaper and the reporter are in the clear, the CVI rules only apply to personnel who were provided proper access to the CVI. The Rest of the Story… Just a quick side note; Paul Harvey really did come up with a good line, and it is especially appropriate here. Forget for the remainder of this blog posting the CVI issue. What I want to do with the remainder of this posting is ask each reader, “How would you like to be responsible for the CFATS implementation at Sea World?” Let’s take a look at the situation. The perimeter security is probably pretty good; they only want people coming through the paying entrances or the employee entrances. The physical screening for weapons and explosives is probably better than that done at most chemical facilities. They employees are almost certainly checked out pretty good, though they probably don’t check the DHS Terrorist Database. What is lacking is any sort of vetting process for the paying customers; the only identification that is checked is their credit card or cash. Separating the Chemical Facility and the Public Facility Okay, so they have to keep the paying customers away from the chemical facility portions of the park. This is nothing new for these theme parks. They do an excellent job of keeping the public separated form the support sections of the facility. The biggest part of that is nothing more than keeping the supporting structure well camouflaged and hidden. Once you have those isolation techniques down to a science, the rest of the security plan is fairly straight forward. Establish a security perimeter around the chemical assets. Control access with RFID identification cards or biometric identification. Establish multiple layers of security to allow for a reasonable response time for the facility security team. All of the rest of it falls into place fairly easily. Once you get passed the idea of the tourist trap as a high-risk chemical facility and realize that you have to properly define what the chemical facility is and what is the theme park, then developing your security plan is fairly easy. It is just that first step that is conceptually so difficult.