Reader Comment 05-24-10 Video Surveillance Training

John Honovich (www.IPVideoMarket.info) left a very nice reply to yesterday’s blog about his video surveillance training program. He announced a change in his site’s pricing policy, writing that:

“In July, we are going to introduce a new plan just for basic video surveillance - $99 for the year. We want to make it as affordable as possible for end users to learn more about video surveillance.”

I always applaud suppliers rolling back their prices. I know that John isn’t just targeting this price at the chemical security community, but I know that it will be appreciated by the facility security managers that that are trying to get up to speed on a wide variety of security subjects. This will make that task just a little easier.

Development Along Rail Lines

This weekend there was an interesting article in my home town newspaper about the renovation of an old textile mill into offices, retail, and apartments. It is a deserted, historic old-building on the outskirts of the downtown area and it certainly deserves renovation; except that it has a major rail yard as a next door neighbor. The article makes a big thing about how lots of old mills across the South have been renovated along rail lines; rail lines were typically run near mills, or vice versa to provide shipping and receiving for those mills. The builder notes that the thick walls and insulated windows helps knock down the noise associated with rail lines so residents of the high-end loft type apartments typically put into these renovations don’t complain about the noise. That’s all good, as far as it goes. I just wonder if they are putting in airtight seals on the doors and window and auto shutdown mechanisms on the central heat and air. Oh, and more importantly chemical detectors for anhydrous ammonia and chlorine. You see this is not just a rail line alongside of the mill property, but it is a rail yard. This is where trains are taken apart, stored and formed up again. And some of the train cars coming through this particular yard contain chlorine gas and anhydrous ammonia. I know, I’ve watched them come in and go out. And the risk for an accidental release of chemicals from rail cars is higher at rail yards than just along rail tracks. More handling means that there are more chances for accidents. To make matters worse, there is next to no security at this particular rail yard. There are surface streets that cross the tracks and vast stretches of the perimeter with no fencing. In fact the only fencing that I know exists was part of the old mill perimeter fence. This means that if terrorists were interested in gaining access to these high-risk rail cars, this would be a good place to do so. Add a bunch of high-rent apartments on the perimeter and it becomes a potential terrorist target. Do the real estate disclosure laws cover this situation? Does the developer understand the potential hazard? Did the Planning Advisory Commission take these factors into account when they recommended that the zoning be changed from light industrial to an Uptown (mixed residential and commercial) zoning? You make your guesses; I know what I think. The only saving grace is that it will not be poor folks living next to the tracks; it will be well to do folks. People with access to well paid lawyers. People with access to important politicians. People who will ask "Why wasn’t I told, warned or protected?" when the accident or attack exposes them to toxic inhalation chemicals. Maybe that is what it will take to get these rail yards moved out of city centers.

HR 5346 Introduction

On Wednesday Rep. Thompson (D, MS), chairman of the House Homeland Security Committee, introduced HR 5346, billed as a bill to enhance the homeland security in the ports and waterways of the US. This bill is essentially Title XI, Port Security, of HR 3619 as it was passed in the House last October. HR 3619 and Politics As I noted earlier this month, the version of HR 3619 that was passed by the Senate was substantially different than the House version; one difference was that the Senate version did not include Title XI. The Conference Committee for this bill has yet to be appointed so it is a little surprising that Chairman Thompson is apparently assuming that Title XI will not be added back to the bill in Conference. It also begs the question that, if Title XI would not be acceptable to the Senate Conferees, how much of a chance will this bill have of being considered in the Senate in the limited amount of time left in the election shortened session. There is another interesting political oddity about HR 5346. HR 3619 was not acted upon by the Homeland Security Committee. It was introduced by Chairman Oberstar of the Transportation and Infrastructure Committee and the House Report on that bill only included actions by his Committee. One would have thought that it would have been Chairman Oberstar that would have introduced this bill, or at least co-sponsored it. Now I understand that Title XI of HR 3619 does specifically address port security issues and one would think that this would come under the purview of the Homeland Security Committee. This is one of the continuing problems that homeland security issues have in Congress, there are too many committees with their fingers in the homeland security pie. Politically speaking there is another possible explanation for the introduction of this bill. Chairman Thompson might be planning on getting this passed in the House (which could happen fairly quickly since it has essentially already been considered). Instead of trying to get it through the Senate he could be intending on getting it included in the DHS Budget bill (that has yet to be introduced). This is a technique that he has used for a number of pieces of legislation since he became Chairman in 2007. Chemical Security Provisions In my initial blog about HR 3619 I noted that there were a limited number of provisions in that bill that would directly affect the chemical security community. Interestingly all of those provisions were included in Title XI and made it into this bill. There was one significant change to Title XI provisions since I wrote that initial blog that will be of interest. The provisions related to the definition of ‘Especially Hazardous Materials’ were removed. Actually that term was changed to ‘certain dangerous cargo’ and a specific reference to any chemicals was not included in the definition of that term. It now leaves that definition up to regulations to be written by the Commandant. There was one other provision in HR 3619 as passed by the House that I noted in a later blog as being of potential concern to our community. That provision (§ 1332) dealt with Coast Guard actions against semi-submersible vessels used by drug traffickers. That provision was not included in this legislation. Moving Forward This bill should be able to make it through the two committees, Homeland Security and Transportation, that it has been referred to in the House. There should be no major opposition to the bill if/when it makes it to the House floor. The major question is how likely it is to get considered in the Senate. There is very little that looks the least bit controversial to me, but there is some reason that Chairman Thompson thinks that this will not be acceptable to the Senate conferees; so I don’t know.

SCADA Vendor Support

I just finished reading an interesting article on ControlGlobal.com. It describes ABB’s (a SCADA equipment vendor) ability to provide “advanced diagnostics and data collection tools to provide levels of access and maintainability for ABB equipment or monitoring of PCs in any environment” via remote access. Reading the article it struck me that ABB, and many other SCADA vendors offering similar services, may provide security managers at high-risk facilities with an overlooked security problem. Unescorted Access The CFATS regulations require that facilities conduct a variety of background checks on “for unescorted visitors with access to restricted areas or critical assets [emphasis added]” {6 CFR 27.230(a)(12)}. It would seem to me that even the most restrictive definition of ‘critical assets’ would include SCADA and industrial control systems at CFATS covered facilities. A vendor technician working on such systems on site would certainly fall under the ‘unescorted visitors’ definition unless accompanied by some one qualified to understand what the tech was doing with the cyber system. What would make that same technician exempt from the background check requirement if they were accessing the system from off-site? Any such off-site access must be considered ‘unescorted’ access to a critical asset. Two Options Now as I see it, there are at least two options. First CFATS covered facilities could shut down the off-sit access capabilities of these vendors. There is certainly a security argument to be made for that option. Unfortunately, most facilities do not have anyone on the payroll that can conduct the appropriate diagnosis, much less make the repair and adjustments that these vendor offer. Without these on-line services, facilities would have to be shut down until a technician could physically arrive on site; very costly. The second, and more useful, option would be to have these vendors conduct the appropriate background checks for each of their employees that have the access to these systems and to certify that they have met some minimum background check requirements. Of course, this would have to include the check of the terrorist screening database (TSDB) that DHS is requiring all others with access to the CFATS facilities to undergo. The current way that DHS is considering how to implement the TSDB check would require that each facility being served by these vendors would be required to submit data on each of the vendor employees with potential access. Not only would that be time consuming for the facility, but it would raise some privacy issues as well. Additionally that would drastically inflate the number of records that would have to be processed by the DHS folks. Alternatively, DHS could set up their TSDB tool to allow the SCADA vendors to have their own accounts where they would submit the information on their employees. CFATS covered facilities would then identify the vendors that their facility uses that would be authorized off-site access to their control systems. This would allow DHS to identify who had access to the facility equipment and yet protect the privacy of the vendor’s employees. A similar technique could be employed for other companies that have employees with routine access to multiple high-risk facilities. A Not So Minor Problem One small problem with this idea; the CFATS regulations only apply to high-risk chemical companies. DHS does not have the authority to regulate the vendors and contractors that support the covered facilities. Just one more thing that needs to be added to the re-authorization of CFATS.

Basic Video Surveillance

Long time readers of this blog will be familiar with the name John Honovich. John has web site, IPVideoMarket.info, that deals with the details of video surveillance. He has started a new service that looks very promising for security managers wanting to learn more about the basics of video surveillance technology, a video surveillance training program. The only drawback to the service is that it is not a free service, but the corporate membership rate is only $299 per year, so it isn’t much of a drawback drawback especially since it provides full access to the information on John’s site. John uses a combination of podcasts and printed material in the training program. I just finished listening to the first of three podcasts in the “Basics for Using Video Surveillance” program. It was an interesting 52-minute conversation about “Basic Uses of Video Surveillance” and it covered:

Different approaches to live surveillance monitoring Types of alarm monitoring Examples of conducting investigations Common number of cameras being used Common locations and types of cameras being used Privacy issues in using video surveillance Unrealistic or science fiction approaches to video surveillance

It included a very good discussion about when and why facilities may or may not decide to have someone constantly monitoring the feeds from their security cameras. I especially appreciated the discussion of video quality and why it isn’t practical to have 100% perfect videos throughout the day. There are two additional podcasts in this introductory program; Video Surveillance Products Basics and Basics on Cost and Value of Video Surveillance. John includes links to written reports on both subjects for further detailed information. Once again I have to recommend another of John’s products. The podcasts are interesting conversations instead of lectures. Combined with the links to reports on information covered in the podcast the training value for this material is high. Once again, John is not trying to make anyone a video surveillance technician or integrator with this program, but he is providing valuable information to someone who will be dealing with these professionals.

Counter Surveillance

Long time readers of this blog will be well familiar with my consistent calls for high-risk chemical facilities to establish counter surveillance programs as part of their security planning. Two internet articles, one from London and one from here in the US, from last week take a brief look at formal counter surveillance programs established by government agencies look at some of the issues that face such programs. Security Guard Interactions The program in London provides training to local security guards in how to deal with individuals taking pictures or making sketches of public buildings. The article points out the concerns of civil rights activists that the program has security personnel and police unlawfully stopping people for doing nothing more than taking pictures, hardly an illegal activity. Anyone setting up a counter surveillance program needs to take care to ensure that their legitimate security efforts don’t trample on the civil rights of the public. While taking pictures of chemical plants is less likely to be an action taken by simple tourists, there are still a number of legitimate reasons for people to be taking such pictures. Chemical safety and environmental activists all have a politically protected right to take such pictures as long as they don’t trespass on facility property. There is nothing wrong with security personnel talking with such off-site observers as long as care is taken to ensure that nothing in the actions and demeanor of those personnel that would indicate an effort to ‘detain’ the off-site personnel. Politely asking who the people are and why they are taking the pictures is unlikely to raise civil rights concerns. Crossing the line by demanding to see identification or blocking the movement of individuals or their vehicles until the police arrive should be avoided unless there is some other clear indication of obviously illegal behavior. Extensive training, vetted by company legal staff, needs to be provided to security personnel interacting with non-company personnel. Having said that, taking pictures of a high-risk chemical facility is an action that might be an indicator of a pre-attack terrorist planning process. Terrorist would need that type of detailed facility information to conduct target selection and planning activities. Identifying people conducting this type surveillance activity is a key part in preventing terrorist attacks. This makes identifying personnel taking pictures of a chemical facility a key intelligence activity. General Public Observations The second article looks at providing training to non-security personnel to report suspicious activity. The program sponsored by DHS relies on the fact that people working in the community have a better chance of observing suspicious activity than intermittent police patrols. They may spend more time in a single area making them more attuned to what is normal and what is abnormal. High-risk chemical facilities can utilize local neighborhood organizations to perform a similar function. The facility neighbors have a strong self-interest in helping to detect potential terrorist attacks that would directly affect the local population. Since management needs to be talking with these same people on emergency response planning matters, they might as well be asking these same people to help identify unusual individuals that show an interest in the operations of the chemical facility. To be effective any such observation program needs to include a reporting procedure that is simple and encourages participation. A phone number needs to be made readily available to the local population. More importantly there needs to be a positive person on the receiving end of that phone call that knows how to ask questions to draw out additional details. A voice message system is unlikely to inspire continued participation. Facility employees can be trained to accept these calls, but it would probably be more effective if trained security or law enforcement personnel handled this.

Greenpeace Security Inspections

No matter which side you take on the politics of the Greenpeace efforts, no one can ever accuse them of lack of chutzpah. Thanks to a Twitter® post from greenpeaceusa I found their latest effort in the campaign against industrial chlorine use. They have a series of pictures, with appropriate captions, on their “Real Chemical Security Now” page on FLICKR®. Most of the pictures show their green airship over the DuPont facility in Edge Moore, DE. Now the pictures do not show anymore detail than Google Maps® provides for similar facilities, so they haven’t really compromised the security of the facility. The pictures from another aircraft, probably a helicopter, do show how easy it would be to do an aerial reconnaissance of these sites. Or conduct an aerial attack if you knew what to aim your small plane at. I haven’t heard anything in the news about FAA complaints about over flights, so I would assume that: a – no one at DuPont noticed, or b – there are no special flight restrictions in these areas. It is almost certainly a combination of the two. In any case, Greenpeace once again gets style points while keeping their message fresh. I’m only surprised that they didn’t have a ground-based photo op to compliment the aerial photography. Keep your eyes open in the DE-NJ-MD area for the green airship over other chemical plants. BTW: Greenpeace – Hydrogen or Helium? Hydrogen would be greener if slightly more dangerous.