Senate Hearing on Mumbai Terrorist Attacks

Well, Congress is back in session and the hearing schedule starts off with a hearing in the Senate Homeland Security and Governmental Affairs Committee (Senate HS Committee) on the Lessons from the Mumbai Terrorist Attacks. The hearing will be held on January 8th at 2:00 pm EST. Now I did not see any reports about the Mumbai attacks involving attacks on any chemical facilities. I do think, however, that there are probably security lessons to be learned for high-risk chemical facilities. Anyone that read my blog on the DHS 5 year Terror Forecast knows that I think that a fast attack like this could very successfully executed against almost any high-risk chemical facility in the United States. The Senate HS Committee web page today shows a single panel that will address the committee. The panel members will be:

Charles E. Allen – DHS Arthur M. Cummings – FBI Raymond W. Kelly – NY PD

This should be an interesting discussion.

Railroad Accounting for Hazmat Shipment Costs ANPRM

The Surface Transportation Board published an advance notice of proposed rule making in Monday’s Federal Register concerning how railroads account for the unique costs of transporting hazmat. The STB is proposing to require railroads to report unique costs associated with hazmat shipments separately so that the STB could take them into account in their Uniform Railroad Costing System (URCS). According to the notice the “Board seeks public comment on whether and how it should improve its informational tools to better identify and attribute the costs of hazardous-material transportation movements” (74 FR 248). Comments are due on or before February 4, 2009 The STB does not handle its public comment submissions through the Regulation.Gov web site. Instead, it still uses an E-FILING link on the Board's Web site, at http://www.stb.dot.gov. Alternatively individuals can file written comments, but must include 10 copies of all documents, by mailing to:

Surface Transportation Board Attn: STB Ex Parte No. 681 395 E Street, SW. Washington, DC 20423-0001.

In addition to the general question of whether or not the Board should proceed with the rule making, the STB asks for certain specific items of information that will be necessary to effectively prepare an appropriate rule. These items include:

The definition of the operations and expenses to be reported, The definition of a ‘hazmat shipment’ (ie: should it be limited to TIH/PIH shipments), The identification and definition of operating costs associated with the hazmat shipments, The identification and definition of the assets devoted to hazmat operations, and The identification and definition of the appropriate operating statistic to be used in the URCS to allocate the identified cost (ie: car-miles, revenue ton-miles, etc).

More Discussion about Chemical Security Legislation

Over the last week or so there has been a steady stream of articles on ICIS.com written by chemical industry leaders about what they see coming in the upcoming 111th Congress. All of those articles have touched to some extent on the need to renew the current Chemical Facility Anti-Terrorism Standards (CFATS) that are slated to expire in October of this year. They have all opposed to some degree mandatory inherently safer technology (IST) requirements in that legislation. Today we’ll look at an article on that site that specifically addresses the IST debate from the side of some advocacy groups. Strong IST Proponents The article notes that the current CFATS legislation was pushed through a Republican controlled Congress with a Republican President. This year those roles will be reversed. Many of the groups pushing for more controls, and IST in particular, are allies of the Democratic Party. The article notes particularly that the Center for American Progress was founded by John Podesta, “who leads the Obama transition team and is likely to have a large role in the new administration”. Readers will remember that it is the CAP that is leading the current publicity campaign for IST with its publication of Chemical Security 101 earlier this year. HR 5577 Model The article frequently points to HR 5577 as the model for legislation in the upcoming Congress. The authors note that HR 5577 was held up by the Democrats last summer because it would be easier to pass in a Congress more dominated by the Democrats, and it would be less likely to be vetoed by a Democratic President. I’m not sure that Chairman Thompson would agree with that assessment. He was particularly incensed when Secretary Chertoff suggested that the passage of HR 5577 should be delayed. The article notes that the chemical industry opposed HR 5577 because of the IST provisions and the easing of the federal pre-emption rules. The pre-emption rules had already been changed as part of the provisions of the FY2008 Omnibus Budget Bill, so that actually was a non-issue by the time HR 5577 was reported to the Congress by the Homeland Security Committee. Though it was not noted in this article, there were other items in HR 5577 that the industry also objected to. These included provisions requiring union and employee participation in the security processes and whistleblower protections. Provisions that required redress procedures for employees that failed background investigations were also included in the HR 5577 requirements that the industry was not happy with. Extending the HR 5577 Model The article does note that there seems to be a push to extend the HR 5577 model to include some more aggressive provisions. The article notes that Greenpeace would like to see the IST provisions of HR 5577 extended to “to any chemical facility that puts 1,000 or more local residents at risk of attack consequences”. The article notes that this would jump the potential IST requirements from covering 200-300 facilities under HR 5577 to about 3,500 sites. This is slightly misleading since the bulk of the sites that Greenpeace includes in its figures are water treatment and waste water treatment plants that are exempted from the current CFATS processes. HR 5577 already extends coverage to those facilities. It isn’t clear if all of those treatment facilities would be covered by the HR 5577 IST requirements. HR 5577 would continue to allow the Secretary to set the standards for the selection and tiering of ‘high-risk chemical facilities’. It is not clear how Greenpeace would re-write the legislation to include all facilities that would put “1,000 or more local residents at risk of attack consequences”. Depending on how one defined ‘attack consequences’ the number of facilities that would be covered would be completely unmanageable. Political Discussion Being Dominated by IST Proponents This article was not written by IST proponents. It was apparently written by the staff at ICIS.com to balance the coverage provided by the earlier articles written by chemical industry representatives. This is certainly a legitimate and even proper way to report on issues; providing multiple view points on a complex discussion. This has not always been the way this issue has been covered in the popular press at the local level. With few exceptions it has not been because of an obvious bias on the part of newspapers or reporters. Generally the anti-IST views of the local industry have been missing from the coverage because of the refusal of the industry to talk about the issue. Usually this refusal has been reported as because the industry ‘does not discuss security or safety measures’. The chemical industry and its representative organizations are going to have to reverse this stand if they hope to get reasonable IST provisions included in a chemical facility security bill during the upcoming session of Congress. The political discussion is now being controlled by people that are actively pushing for very restrictive IST provisions that will be written by people with little knowledge of how industrial chemical processes are designed or controlled. The industry needs to engage in this political discussion at all levels. New Year’s Resolution Well, I do admit that I get a bit preachy at times. For example, how many posts now have included a blast at the chemical industry for botching the IST debate? Well, my New Year’s Resolution for this blog is to try to minimize my harping on single topics through multiple blog posts.

Control System Security is Not IT Security

Joe Weiss has an interesting blog posting over on the ControlGlobal.com web site that briefly discusses the difference between Control System Security and IT Security. It notes that corporate information technology systems are not the same thing as process control systems. Unfortunately, the people addressing cyber security tend to lump these two disparate systems under the ‘Cyber’ heading. This could be clearly seen in the Draft Guidance for the Risk-Based Performance Standards that DHS issued earlier this year. They assumed that what they had learned about security for IT systems was directly translatable to control systems. I recommend that anyone that is looking at security for automated control systems at high-risk chemical facilities should look at the ISA99 Committee on Industrial Systems Security comments submitted on the Draft Guidance Document. They provide a pretty decent discussion about some of the differences between IT and Control Systems security. I took a stab at looking at the requirements for control systems security last spring in a series of blogs that I did on the Federal Energy Regulatory Commission’s Final Rule on their “Mandatory Reliability Standards for Critical Infrastructure Protection”. I’m afraid that my coverage of the FERC standards was less than adequate when it came to the discussion of technical details. I would like to see some more people like Joe Weiss address this issue in more detail. I was a control system user, not a programmer or system engineer. I understood the DCS system that I used just enough to get the information out of it I needed for my process improvement work. The engineers who understand the internal workings of those systems are the ones that need to explain to the rest of the chemical security community what we need to do to secure those systems without seriously upsetting them.

CSX Implements Rail Security Rules

A reader has pointed me at a letter that CSX is sending to customers explaining how it plans to implement the new Rail Transportation Security Rule. Among other things, it notes that it will require all of its customers that ship Rail Security-Sensitive Materials (RSSM) or receive RSSM in High Threat Urban Areas (HTUA) to be fully in compliance with the new rules by February 15th. They note that this earlier compliance date is necessary to ensure CSX compliance with the TSA regulations by the federally mandated compliance date of April 1st, 2009. Continuous Attendance Rules In order to allow CSX the maximum flexibility in its scheduling of pick-ups and deliveries while still following the chain of custody rules in the new regulations (49 CFR § 1580.107) CSX is notifying its customers of its new requirements. Effective February 15th any customer that CSX directly serves that is:

An RSSM Receiver facility in an HTUA “must be attended 24 hours a day, every day” to effect the chain of custody requirements of the rule. An RSSM Shipper facility “must be attended 24 hours a day, every day from the time CSXT is informed that that railcar is ready for pickup until the pick-up has been appropriately documented by the consignor and CSXT”.

These CSX rules definitely go above and beyond the requirements of §1580.107. In the preamble to the final rule TSA notes that it only expects RSSM receivers in HTUAs to fulfill the ‘attendance rule’ by having someone present “only as long as necessary to transfer the car from the delivering railroad carrier, to document the transfer of custody, and to ensure that it is moved into a rail secure area” (73 FR 72150). The CSX requirement is clearly designed to allow it to continue its practice of making unannounced pick-ups and deliveries of rail shipments. Rail Secure Areas The CSX letter addresses the requirement in the regulations for RSSM Shipments to be picked up from and delivered (in HTUAs) to ‘Rail Secure Areas’. The letter notes that, as of February 15th “customers will be responsible for designating a "Rail Secure Area" at their shipping and/or receiving facilities”. While at some future point “CSXT may need to have written certifications of compliance from each consignor we serve directly and each consignee we serve directly”, they are currently accepting “informal oral notifications” of the designated areas. Chain of Custody Requirements The CSX letter describes the requirements outlined in the new regulations for documenting the chain of custody transfer of RSSM railcars at shipper and receiver locations. Surprisingly it does not describe how it plans to effect that hand-off documentation. I would have expected them to include a copy of a transfer form that they would expect a facility to have prepared (by RSSM shippers) and available at the transfer point. Effects on Routing of RSSM Shipments The CSX letter also brings up an entirely new issue that was not addressed in the rule making process, the effect of these rules on the hazmat rail routing issue. The letter states that:

“Finally, we note that there are a number of other requirements affecting railroads, including a prohibition on interchanging Rail Security-Sensitive Materials at most "unattended" interchanges. This requirement greatly complicates the routing of railcars containing Rail Security-Sensitive Materials. Many cars will have to be rerouted through attended interchanges, and our other operations may be impacted by these changes. It is very possible that the New Rules may result in significant increases in the transit times of some Rail Security-Sensitive Materials. We are still designing the required routing changes, and are not yet in a position to predict the new routes' effects on specific movements. If no attended interchange is available, CSXT may not be able to continue service in that lane, unless the consignor or consignee makes satisfactory contractual arrangements with the carriers to bring the interchange into compliance.”

This is going to have the largest impact on facilities that are only served by short line railroads. If a short line operator is not able to comply with the CSX requirement for 24 hour a day attendance at interchange points, it appears that CSX will refuse to deliver RSSM to that operator. This could effectively shut off access to RSSM shipments for any facility served by that operator. A more likely result is an increase in shipping costs as the short line operator adds staff to comply with the CSX attendance requirements. A more important impact is the use CSX will make to avoid having to use interchange agreements to avoid shipping around urban areas. Any routing that would go through an interchange that was not ‘manned 24 hour a day’ would not be useable under the new CSX rule. CSX is certainly not trying to specifically route through urban areas, but they will use this rule to avoid lowering their profits by re-routing around urban areas through use of some other carrier. Interestingly, nothing is said about CSX agreeing to provide 24 hour a day attendance at interchange points with other rail carriers. I expect that its interchange operations with other main line carriers will continue without interruption. I also expect that CSX will use its 800-lb gorilla status to require short line carriers to coordinate attended transfers of RSSM shipments at interchanges where CSX does not maintain 24 hour a day attendance. Customer Compliance The CSX rules outlined in this letter do not have the force of law and most of them are not specifically required by the new TSA regulations. They are simply rules made up by CSX to make it easier for them to comply with the new TSA regulations. For most RSSM shippers and receivers served by CSX this is a technical point; effectively they will have to comply with the CSX rules as CSX is the only game in town for shipping by rail for their facilities. I have not seen similar letters from other rail carriers. I would expect similar rules from most of the mainline railroads. They have made no secret of their dislike for carrying TIH/PIH chemicals. Anything that will discourage railroad shipments of these chemicals will make their day. Short Line carriers may be more willing to work with their customers to come up with ways to deal with the new TSA rules.

HSAC Meeting 01-12-09

Last Tuesday, DHS posted a notice in the Federal Register that the Homeland Security Advisory Committee would be holding a meeting on January 12th, 2009. The meeting will be closed to the public. According to the notice:

“The HSAC will meet for the purpose of receiving briefings and updates from Secretary Chertoff on the current status of the DHS administration transition, a threat assessment and intelligence briefing focused on the transition period, and the upcoming National Special Security Event, the inauguration of President Elect Obama. The Secretary will also brief the members on successes, challenges and vulnerabilities affecting the Department's mission. The briefings will include information on sensitive homeland procedures and the capabilities of the Department of Homeland Security Components.”

Given the nature and timing of the meeting it would not be unexpected for Secretary Designee Napolitano to be present at this meeting as an unofficial guest of Secretary Chertoff.

More Chemical Industry Comments on CFATS Modifications

Another chemical industry organization has joined the political discussion about the future of the Chemical Facility Anti-Terrorism Standards (CFATS). This last Monday there was an article on ICIS.Com about comments made by the President of the National Petrochemical & Refiners Association (NPRA), Charles T Drevna. NPRA Against Mandatory IST Again the comments were on the general upcoming chemical legislative agenda of the 111th Congress, but Mr. Drevna did specifically address CFATS. He noted that “legislative efforts will be undertaken in 2009 to amend the Chemical Facility Anti-Terrorism Standards (CFATS) programme to allow government officials to dictate to facilities which security measures they must employ”. He makes clear that ‘security measure’ that they are discussing is IST. He reminds the law makers that while “inherently safer technology (IST) will be one of the cornerstone security debates in the 111th Congress, lawmakers must recognise that IST is a chemical engineering philosophy - a concept, not a technique”. He warns lawmakers that changes “to the existing CFATS will likely slow down current government efforts to ensure the security of chemical facilities”. This point carried more weight last year while DHS was rolling out the SVA program, but it has lost most of its import because of the slow pace of getting the CFATS program into place. There is a distinct possibility that CFATS legislation may make it to the floor in the House before the first facility is required to submit its Site Security Plan. Industry Missing the Political Game It is interesting to see that the industry comments that I have been looking at for the last week or so have all been directed at the industry press rather than the public at large. Industry seems to be unconcerned that the advocacy groups calling for mandatory IST are taking their campaign to the public. Just Wednesday there was another article in the public press about the CAP Chemical Security 101 report. The timing was interesting because it was looking at the identification of the Exxon Joilett refinery as one of the ‘101 most dangerous facilities’ because of its use of hydrogen fluoride in the alkylation unit. Exxon, according to the news report, “refused to say whether they are considering an alternative approach to refining”. Industry needs to be proactive in addressing the IST issue at each facility where the issue is raised in the public press. If there are legitimate reasons why the facility cannot implement the alternative technology identified in the CAP report, those reasons need to be briefly explained to local reporters. It need not be a chemical engineering explanation; the CAP report only hit the generalities. But failing to address the IST issue straight on will ensure that the generalities in the CAP report will guide the formation of the IST rules in the next chemical facility security law.