Additional Homeland Security Committee Hearing This Week

Late Monday afternoon, the House Homeland Security Committee announced an additional hearing for this week, a hearing that may be of interest to the chemical security community. The Subcommittee on Transportation Security and Infrastructure Protection will hold a markup hearing on HR 2200, a bill introduced last week by Rep. Jackson-Lee (D, TX). The title of the bill is the “Transportation Security Administration Authorization Act”. The hearing will be held tomorrow at 10:00 and will be web cast. The bulk of the bill deals with aircraft security measures, but there are three provisions that will probably affect the chemical industry. First, the bill {§301(d)} would require TSA to hire an additional 300 Surface Transportation Security Inspectors to handle a variety of inspections of ground based transportations systems including freight rail. Second, the bill {§1118(e)}would require a new Transportation Security Advisory Committee be established with a Freight Rail Security Working Group. Third, the bill will require the Secretary to report back within 30 days of passage of the bill about the status of a variety of transportation security training program regulations required by the 9-11 Commission Act of 2007. This bill appears to be on the fast track for action in the House Homeland Security Committee. The bill was introduced on April 30th and the GPO print of the bill was not posted until yesterday. The first sub-committee markup will held tomorrow. I would not be surprised to see the full committee markup scheduled for next week.

Replies to Comments on UP STB Petition

Last Friday the Surface Transportation Board (STB) posted three formal replies to the comments received on the Union Pacific petition for ‘clarification’ of their common carrier obligation to provide rate quotes to US Magnesium for the transport of chlorine gas to facilities with ‘adequate supplies’ of chlorine from suppliers located significantly closer to the facility than the US Magnesium ship point in Utah. Those replies in support and opposition to the UP petition came from: Union Pacific Association of American Railroads American Chemistry Council Union Pacific Reply UP says that ‘attacks’ on the UP petition fall into two categories; the Board lacks jurisdiction, and UP is trying to manipulate markets. UP rejects both types of claims. UP maintains that the board has the jurisdiction to determine if the US Magnesium request for rates is ‘reasonable’. The problem with this interpretation is that there is no ‘reasonable’ requirement for requesting a rate. The reasonable standard is only applied to the request for ‘service’ that would possibly come after the rate was established. UP questions the legitimacy of the claims of ‘market manipulation’ when the current rules already manipulate the rail service markets. UP notes that it is not able to make legitimate business decisions about the use of their manpower and equipment because of their ‘common carrier’ obligation. They note that the liability issues associated with carriage of TIH chemicals like chlorine would normally call for a business decision to avoid carrying that chemical Finally, UP maintains that it is requesting a narrow ruling from the STB that the request for rates to these four (out of 35 requested) destinations was not reasonable based on the combination of distance, HTUA’s traversed, and availability of alternate supply. This contradicts it’s wider request to “clarify the extent of UP's common earner obligation with regard to transporting chlorine” in its petition for a declaratory order. Association of American Railroads The AAR reply looks at some of the legal issues raised in various replies to the UP petition. Generally they hold that the legal issues raised against the petition do not adequately reflect the case law which actually supports the UP petition. They quote a variety of precedents that indicate that STB has the sole authority to decide the reasonableness standard for requests for service. They note two potentially important points; the ‘reasonable’ standard may be raised in a request for rates case, and that the Board may hold a higher safety standard than that set forth in current safety regulations. The real meat of the AAR argument is found in its concluding statement:

“In determining the reasonableness of the request to transport TIH materials, the Board should apply the relevant legal principles and address the public policy concerns set forth above and as more fully discussed in Ex Parte No. 677 (Sub- No. 1). The AAR also respectfully requests that the Board act as expeditiously as possible to issue the policy statement urged by the AAR in Ex Parte No. 677 (Sub- No.l) which would allow a carrier to impose reasonable liability-sharing arrangements on shippers as a condition of moving TIH materials.”

This argument makes it look like the UP petition is an attempt to make the STB reach a ruling on last year’s hearings on the common carrier obligation to carry TIH chemicals. It makes it clear that what the railroads are actually looking for is a method to require that TIH shippers share in the liability burden of those shipments. American Chemistry Council Reply The ACC reply is actually a ‘joint’ reply of the ACC and six other organizations representing groups of shippers that rely on the railroads for shipment of hazardous chemicals including a variety of TIH chemicals. As in their earlier comments the ‘Joint Shippers’ oppose the UP petition. Here they note that both TSA and DOT in their comments affirm that there is no safety or security reason to support the petition. They object to many of the claims about liability issues raised by the AAR and other railroad commentors, noting that UP did not make that claim in their original petition so the issue cannot be legitimately raised in the reply to petition comments. My Comments on the Comments One of the main claims in UP’s petition was that there were adequate supplies of chlorine available to the potential recipients of the US Magnesium chlorine shipments that were from closer sources of supply so the risks associated with the longer shipments were not ‘reasonable’. A number of commentors noted that the assertion of adequate supplies was not, in fact, true. UP made no effort in their reply to comments to address this apparent conflict in factual claims. In effect this allows the counter claim to invalidate the basis for the UP claim. In my mind this is the fatal argument against the UP petition. If there are not adequate supplies available from closer sources and TSA-DOT assert that there are adequate regulations to protect the longer shipments, then the STB has little recourse but to find that the US Magnesium request was reasonable and UP must provide the requested rates. We will now wait for the STB decision on the petition. Hopefully it will come faster than the still open STB Ex Parte 677 and 677(sub no1) that attempted to address the issue of common carrier obligations for TIH shipments and the liability issues associated with those shipments. Of course, an early resolution to those two earlier issues would probably have prevented this petition from being filed.

API SVA Training

Today’s email brought me some interesting information from API Smart Brief ® (a news digest email). It included a very brief note about “SVA training for the petroleum, petrochemical and chemical industries” to be conducted in Washington, D.C. on May 7th and 8th. The American Petroleum Institute’s (API) Security Vulnerability Assessment (SVA) program is one of the programs recognized by the Center for Chemical Process Safety (CCPS) and should thus be a program that could be expected to be recognized by DHS as an acceptable alternative security program (ASP). While I have heard of some problems that some users of other ASP’s had with their SVA submission, I have not heard of any specific problems related to the API program. It is almost certainly too late to get into the May 7th course, but API has additional classes scheduled later in the year. According to the API web site the schedule includes the following dates/locations:

September 2nd and 3rd; Houston, TX October 15th and 16th, San Francisco, CA December 3rd and 4th, Washington, DC

You can get a copy of the registration form online. The cost is $800 for API member and $1050 for non-members.

This Week’s Congressional Hearings – 5-4-09

I have only been able to find one scheduled congressional hearing this week that might be of interest to the chemical security community. On Wednesday, May 7th, the Subcommittee on Railroads, Pipelines, and Hazardous Materials of the House Transportation and Infrastructure Committee will be conducting a hearing on the “Reauthorization of the Department of Transportation's Hazardous Materials Safety Program”. There are no witnesses listed yet on the Committee web site, so we can’t tell exactly which portion of this very wide subject area will be covered at the 10:00 am hearing. There are certainly a number of security related topics that could come up in this hearing. There are no current indications on the web site that this hearing will be webcast.

NACD Lobbying Effort

Last week 50 members of the National Association of Chemical Distributors ‘flew-in’ to Washington to have a chance to personally lobby members of Congress according to an article on ThomasNet.com. Issues brought up in the effort included CFATS reauthorization and reaffirming the railroad common carrier obligation to carry hazmat chemicals. According to the article, the NACD approach to CFATS authorization was to urge Congress to remove the current October expiration of the CFATS authority without making any other changes to the system. The idea would be to allow full implementation of CFATS before making any substantive changes to the process. This personal lobbying effort has been an effective technique for NACD and other chemical industry groups to bring a particular viewpoint to the attention of members of Congress on a number of issues. It may be most effective when the people making the presentation in today’s economic and political environment can point to the preservation of jobs as part of the outcome of their desired point of view. Whether this will be a more effective lobbying method than the public pressure technique being employed by groups like Green Peace will depend on the size of the letter writing, petition signing campaign organized by those groups and how well those campaigns are targeted. Strong supporters of the chemical industry are unlikely to be swayed by the Green Peace campaign, just as strong environmentalists or workers rights supporters are unlikely to be swayed by personal lobbying efforts by industry. We will have some relative measure of the success of these two campaigns in the coming weeks as CFATS reauthorization is debated in Congress. There was one other interesting item of note in this article. Sue Armstrong, the Director of the DHS Infrastructure Security Compliance Division, had to opportunity for an outreach meeting with NACD members. This is a standard tool that DHS uses to help industry understand their responsibilities under CFATS. She gave them a standard briefing on the CSAT program as well as an update on the SSP roll-out. Now that the OMB has approved the Risk-Based Performance Standards Guidance document, there was more information she could include in her update than was available when she briefed the ACC ChemSecure conference a couple of months ago.

Electrical Infrastructure Security Legislation

Anyone that has been reading the newspapers lately should certainly be aware of the fact that US intelligence agencies believe that they have found evidence of penetration of control systems used in the production and distribution of electrical energy in the United States. Many feel that there is inadequate legal authority to address this apparent vulnerability. The chairs of the House and Senate Homeland Security Committees made the first step to correct that legal shortcoming last Thursday when they introduced identical bills in the House (HR 2195) and the Senate (S 946). According to a joint press release, the bill would be known as the Critical Electric Infrastructure Protection Act (CEIPA). CEIPA Objectives These bills would provide the Federal Energy Regulation Commission (FERC) with specific legal authority to regulate security of critical electric infrastructure. It would bring any “any entity that owns, controls, or operates critical electric infrastructure” {§224a(e)} under the jurisdiction of FERC for purposes of these security provisions. Additionally, FERC is given the responsibility for determining what “systems and assets, whether physical or cyber used for the generation, transmission, distribution or metering of electric energy…. are so vital to the United States that the incapacity or destruction of such systems and assets, either alone or in combination with the failure of other assets, would cause significant harm to the security, national or regional economic security, or national or regional public health or safety” {§224a(a)(1)}. As an interim measure the bills would require FERC, within 120 days of passage, prepare regulations, to “protect against known cyber vulnerabilities or threats to the reliable operation of the critical electric infrastructure in the United States” {§224b(a)}. These regulations would be developed in ‘consultation’ with DHS and would “supplement, replace, or modify cybersecurity reliability standards” already in place. Additionally the bills would require to the Department of Homeland Security to conduct an ongoing assessment of the “cyber vulnerabilities or threats to critical infrastructure, including critical electric infrastructure and advanced metering infrastructure” {sec 224(b)(1)}. The results would be reported to FERC and Congress and would be used to formulate rules and regulations to deal with the vulnerabilities and or threats uncovered. Affect on High-Risk Chemical Facilities The most obvious effect on high-risk chemical facilities will come from the DHS review of cyber threats to ‘critical infrastructure’. High-risk chemical facilities will certainly be included in that review. While we have yet to see the final Risk-Based Performance Standards Guidance document, the draft version of that documents provided little guidance on control system security. A serious review of control system vulnerabilities should certainly result in increased emphasis on the security of these critical systems under CFATS. It is unlikely that DHS will complete such a review prior to site security plan (SSP) submissions by most currently identified high-risk chemical facilities. DHS could certainly require facilities to re-look at cyber security after the review is completed and revisions are made to the SSP tool and RBPS Guidance document. This legislation does not, however, currently propose to change the §550 prohibition of DHS requiring any prescriptive security measures as a pre-requisite of the approval of site security plans. Clear identification of cyber security risks will help many facilities increase their security, but without a modification of this prohibition most facilities will not undergo the detailed system reviews that will be required to truly secure these systems. As more chemical facilities turn to adding co-generation capabilities to their operations there is the possibility that their facilities may come under the FERC control of their electrical generation systems. Facilities that do not return power to the grid are unlikely to be affected, but as micro-generation becomes more important to the grid, co-generation facilities that send excess electricity to the grid are likely to be controlled to some extent by FERC regulations

Cyber Forensics

There is an interesting, if brief, blog by Joe Weiss over on ControlGlobal.com. It takes a look at an intriguing issue, how do we know that there have been ‘attacks’ on the control systems for the electric power industry? He references a CSPAN radio interview with Siobhan Gorman, the writer from the Wall Street Journal who broke the story. Joe notes that she said that “the intelligence agencies installed special detection mechanisms that picked up the evidence, not the power companies”. Why Cyber Forensics? Joe goes on to make the comment that the “control system cyber forensics [emphasis added] for power companies, and other industries, are marginal at best”. Just what does the term ‘cyber forensics’ mean? It is basically a combination of software and hardware system components that allows an investigator to go back and determine how and why the control system did what it did. Many control systems have some cyber forensics capability. In the chemical facility where I worked it was a fairly routine part of incident investigations for all sorts of process upsets. We would go back and look what commands operators entered into the control system for the process involved. This was a good way to find some of the operator errors that led to or complicated the incidents under investigation. What Joe is talking about in his blog is a bit more complicated than just looking at keyboard command logging. It potentially includes looking at records of all of the system communication; that is communications between the various components that make up the control system. This is the basic reason that the comprehensive forensics capability is lacking in most software; maintaining a record of all of the communications is memory intensive and does little to help process engineers and chemists do their jobs of process monitoring and process improvement. Requiring Cyber Forensics Capability Joe asks a good question at the end of his blog: “If the intelligence agencies do have this capability [to install special detection mechanisms], why isn’t [it] being used throughout critical infrastructure?” There are, of course, many easy answers to that question. The first is that there is no legal basis for requiring that such a capability be installed in any non-governmental cyber system. Additionally, many organizations would be reluctant to give the government that degree of insight into their processes. Finally there is the question of who will pay for this capability. Many of these questions could be answered by requiring cyber forensic capability in all critical control systems in what ever cyber security legislation comes out of Congress this year. For high-risk chemical facilities this issue could also be addressed in upcoming re-authorization legislation for CFATS, but that would require a fundamental restructuring of the risk-based performance standards basis for the current program. Cyber Forensics will not Prevent an Attack One important thing to remember though is that cyber forensics capability will not prevent an attack. It only allows one to go back and determine, after the fact, that an attack has taken place, how the attack was carried out, and potentially allowing investigators to determine (and hopefully prove) who conducted the attack. Even the hardware and software capability is not sufficient to allow these determinations to be made; it still requires a trained investigator to sift through the recorded information. Lacking a trained computer forensics investigator at every critical facility what is needed is a software expert system that can identify unexpected communications with the system and the ability to alert the facility computer security officer (CSO). This will still require that the CSO will at least have basic forensic training to evaluate the situation and determine if expert assistance is required. While this still does not stop an attack, it may allow for timely mitigation of the effects of the attack. CSO Action Required While Congress needs to look at the cyber forensics issue, the CSO at high-risk chemical facilities can take some actions to enhance facility cyber forensics capability. First, contact your control system vendor and see what forensic capability already exists in your system. Ask the vendor what cyber forensic support or training they offer. Finally, ask what system upgrades are available for your system to enhance the cyber forensics capability. The answers to all of these questions need to be fed back into your site security plan development.