Reader Comment 06-01-10 Counter Intelligence

Red Team, a frequent commentor, provided some valuable insights to a recent posting on counter surveillance, reminding us that a valuable way for someone to gain knowledge about our facilities is to simply ask questions of employees. Those of us with a military background will remember the required annual classes on counter intelligence and realize that the same things apply to employees at high-risk chemical facilities. We are probably not going to see active human intelligence collection efforts being made by al Qaeda; this requires a level of understanding of American language and culture that requires extensive study and training. Home grown terrorists, on the other hand will have the necessary knowledge base from every day life and would only require some rudimentary intelligence collection training. Essential Elements of Friendly Information Red Team makes an important counter intelligence point, writing that employees need to “know what can be talked about, and what can't”. In the military we were trained to look at essential elements of friendly information (EEFI). As part of the CI planning for any operation the staff would determine what information about the planned operation would provide the adversary with the knowledge to prevent the operation reaching a successful conclusion. The security staff for a high-risk chemical facility need to look at the facility, and its security measures to determine what information would allow a determined adversary to conduct a successful terrorist attack on the facility. Some elements will be the same for any facility; details of perimeter detection capabilities, vehicle and personnel inspection techniques, and COI storage locations for example. Other EEFI will be specific to the individual facility. Counter Intelligence Training As part of every class dealing with security awareness, employees must be made aware of the EEFI for that facility. They need to be made aware of the fact that they should not be talking about EEFI with anyone that is not an employee of the facility. They need to be provided with a means of reporting contacts with anyone that expresses an interest or asks questions about the identified EEFI. The training needs to emphasize that simply asking questions about EEFI does not necessarily make the questioner a terrorist. Any number of people might ask such questions in ordinary conversations and business people might be seeking the same information for legitimate reasons. It is important that all such contacts be reported to security personnel for evaluation. This points out another reason that high-risk chemical facilities need to employ experienced security professionals in the development and oversight of their security program. The proper evaluation of these CI reports requires a certain level of training and experience, training and experience that are unlikely to be part of a chemical professional’s background. Red Team points out that it is not just facility employees that need to be actively involved in this counter intelligence effort, noting that employees, contractors and even vendors might be approached for such information. As I have mentioned on a number of occasions, even off-site neighbors can be expected to have sufficient information about security information to be targets of such intelligence gathering efforts. Vendors and neighbors cannot be given the same counter intelligence training nor can they be given same level of details about EEFI. Having said that, there must be an attempt to communicate the potential risk to these interested parties and provide a ready mechanism for them to report potential questions about the facility. High-risk chemical facilities are going to have to take a serious look at all aspects of their facility operations to prevent potential terrorist attacks. One important aspect that cannot be overlooked is the development of an effective counter intelligence capability. An EEFI training program is an important part of that capability.

‘Chemical Security’ Campaign

Last week I mentioned the new Greenpeace advertising campaign, Chemical Security, in their continuing efforts to encourage Congress to pass legislation (HR 2868) allowing DHS to require implementation of inherently safer technology. Last Friday, the American Chemistry Council (ACC) issued a press release addressing the campaign as a “misguided attempt to ban essential chemicals”. Rather than see HR 2868 passed, the ACC would prefer to see legislation like S 2996 that would provide for a five year extension of the current CFATS program. Jobs and Conservation In their direct response to the Greenpeace campaign the ACC focused on the fact that the current CFATS program was an effective security program with the teeth to require compliance. They also noted that the program had already influenced a large number of facilities to make changes to their manufacturing processes to decrease the inherent risk of terrorist attacks. They also point out that “an effective security plan addresses potential security vulnerabilities while at the same time taking into account other important considerations like protecting jobs, managing environmental concerns and ensuring worker safety”. These ‘important considerations’ are directly focused on the concerns of many of the Greenpeace target audience. They continue that focus by noting that many of the ‘Greenpeace solutions’ are “more energy intensive and produce more waste”. If the chemical industry is going to have any chance of blunting the effectiveness of the political campaign being waged by Greenpeace and other activist organizations, they are going to have to focus on their new conservation message. And they are going to have to find more effective communications techniques than just press releases. Next Stage Greenpeace is certainly not allowing their campaign to stand still. On Monday they released a YouTube video continuing their Chemical Security campaign. Where the initial portion of that campaign was a series of still pictures of their ‘green’ airship over the Dupont facilities, this next step is a well produced video with high production values looking at the same facilities. They continue their focus on the potential risk of deaths and injuries from a large scale chlorine release, accidental or terrorist related. As of Tuesday morning the video has received over 500 hits, and Greenpeace had done nothing to advertise it. I have only seen one Tweet referencing the video and it was apparently a viral tweet, not associated with any of the typical Greenpeace voices. I expect that that will change as the week progresses. As the summer progresses I expect that Greenpeace will fulfill their promise made in the video of having their airship appear at other high-profile, high-risk facilities across the country. If I were running their campaign I would focus on areas with close Congressional races where I could publically call on candidates to take a stand on the issue of inherently safer technology. It will be interesting to see if the deeper pockets of the chemical industry will respond with an effective public campaign of their own, or whether they will continue to rely on a more traditional approach directed just at the politicians. In this year’s political climate I think a more public campaign will be required.

Chemical Storage Dikes

The Center for Chemical Process Safety has released their June 2010 Beacon. It deals with the issue of containment dikes and pads. The Beacon notes that while these dikes and pads have important environmental functions they also have a variety of safety functions as well. They provide three examples of safety functions:

“[L]imiting the spread of a fire and preventing exposure of other equipment if a flammable material spills and is ignited “[P]reventing contact of incompatible reactive materials in case of leak or spill “[L]imiting the spread of spilled corrosive material and preventing contact with equipment which could be damaged by contact with the corrosive material”

As with most safety devices, these safety features of dikes are frequently an overlooked yet important part of the facility security plan since they serve to mitigate the potential effects of a terrorist related release from the storage tanks within the diked area. As such the security plans for CFATS covered facilities need to address the protection of the integrity of these dikes. 

Containment dikes around critical COI storage tanks need to be able to withstand the force of the expected attacks on those COI. For example the dike wall between the storage tank and the expected location of a VBIED, must be able to withstand the force of the VBIED blast to remain a mitigating device in the facility protection scheme. Dikes around flammable chemical storage tanks need to be able to withstand the heat of a pool fire of those chemicals. 

Beyond protecting them against gross physical breaches, there needs to be provisions for verification of the status of drain valves, sump pumps and other controlled openings in the containment areas. While this is important for dikes around any COI storage areas, it is especially important for dikes separating incompatible materials that could violently react or produce toxic chemical vapors upon reaction. These dikes are a common feature at chemical facilities and are usually taken for granted. 

Security professionals need to take a second look at these structures when they are preparing site security plans that include bulk storage of COI. They could perform a vital security function in the mitigation of potential releases in the event of a successful terrorist attack.

Disappointing Reader Comment

An anonymous reader posted a comment disparaging DHS to a recent post about a change in the DHS web site. I have, and will continue, to publish comments with opposing view points, but I almost did not allow this posting. Not because it was complaining of DHS inaction, but because it contributed nothing to the discussion.

I know that I have a wide variety of readers on this blog. I would like to think that we are all interested in achieving the same end, protecting high-risk chemical facilities from physical attacks that could have serious repercussions on the surrounding communities. We will certainly have disagreements on how to achieve that end, but it is important that we are able to discuss those in a reasonable environment.

I have been very proud of the commentors to date who have expressed their view points in a clear, polite manner. The lack of name calling and demeaning of those with different view points has been commendable. I have had more than one reader compliment me on the open discussion on this blog and I have told each one that it is due, in large part to the political maturity of my readers.

The big problem, as I see it, with comments like those posted by Anonymous yesterday is that there is no way for DHS, their supporters or detractors to respond. There are no issues to discuss or for which solutions can be proposed. In fact, to claim that DHS has done ‘nothing’ is ludicrous on its face. We can certainly discuss the merits, or lack thereof, of what DHS has done or has specifically failed to do, but no one can honestly claim that they have done ‘nothing’.

I will continue to allow such posts as long at they are not completely self-serving (advertising) and they avoid personal attacks. This will be the last time, however, that I call attention to a comment that does not contribute to the discussion.

DHS Laws and Regulations Page Update 05-26-10

Because of other duties last week I did not get a chance to report on the recent change to the DHS Counterterrorism Laws and Regulations web page. Two new sections were added to this page and some minor changes were made to some of the chemical security related entries. Politically Correct Additions The two new sections reflect two increasingly important political concerns of people in Congress and the Administration; Human Trafficking and Bioterrorism. The links provided in these sections are all old news, most of them dating back more than two years. The counterterrorism link to bioterrorism is obvious, but the link associated with Human Trafficking is more tenuous. One would assume that there are terrorist organizations that are profiting from the trade in sex slaves and child laborers. Of course, the same could be said for the drug trade, cigarette smuggling, counterfeiting and any number of other illegal activities. Are we going to see all of these moved to the DHS Counterterrorism web pages? I hope not. There is no doubt that despicable people are involved in this activity and that serious government resources need to be marshaled to prevent these activities. But, making this part of the counterterrorism effort is a reach and will inevitably detract from legitimate counterterrorism efforts. Please, move the Human Trafficking information to the DOJ site where it belongs. Minor Changes The minor changes that I mentioned in the opening paragraph are small ‘e’ editorial changes that few people would notice or care about. I wouldn’t normally bother to mention them if the previously discussed changes had not already made doing a blog posting necessary. In a number of instances in the Paperwork Reduction Act section of the page, there are references to “Notice of Action issued by OMB”. At the end of the explanation in those sections there is a link provided to that notice. Now why the link is listed that way, I don’t understand, it should (in my opinion) be linked to the words “Notice of Action”, but I’m not the editor. The change was that in the previous version of this page, the entire link was printed; now the link is attached to the words (www.Regulation.gov). That makes the editorial decision even more confusing and internally inconsistent. Yes, I understand that I’m being anal retentive, but it is not often that a writer gets a chance to point out inconsistent actions by an editor; usually it goes the other way.

Reader Comment 05-28-10 Counter Surveillance

Last week we had a very informative reader comment posted to my earlier blog on Counter Surveillance. Jim Lupacchino, from Day & Zimmermann Security Services, provided some additional examples of why a comprehensive counter surveillance plan must be an integral part of a facility security plan; well worth reading. TAPI Jim introduces a term that is new to me, Terrorist Attack Preincident Indicators (TAPI), but jargon in any active industry is always changing. Jim describes this as the “patterns of behavior that are matched with known terrorists methods of operation”. Obviously these patterns are subject to change over time so it is important for the intelligence community to keep us up to date on how these patterns are changing. One thing is certain though, terrorists will continue to need to perform pre-attack surveillance if they want to have a decent chance of conducting a successful attack. This means that a facility with an active and effective counter surveillance program has a good chance of detecting and allowing law enforcement to prevent the attack before those terrorists have a chance to put the facility, its employees or neighbors at actual risk. Training Jim makes another very important point, training is key to an effective counter surveillance program. He also makes a point that I haven’t seen made elsewhere, that training needs to be targeted. He wrote:

“This training is most effective when customized to the roles and responsibilities of various departments. From Sales to Shipping, threat based awareness will take different forms reflective of the unique function's environment.”

While everyone needs to be aware of suspicious behavior near the facility boundary, there are other types of pre-operational intelligence gathering that may only be detectable by specific departments within the company. Sales personnel need to be aware of orders for Theft/Diversion COI from unusual or unexpected customers or unusual delivery locations. Human resources personnel need to screen job applicants to prevent workforce infiltration. Receiving personnel need to be aware of unusual questions about inbound shipments and receiving procedures. Every department is going to have specific counter surveillance requirements. I want to take an additional opportunity to re-emphasize a point I made in the original blog posting. Every high-risk facility needs to expand the perimeter of their counter surveillance program as far beyond the physical facility perimeter as possible. This means that they need to solicit active participation of the surrounding community. Of course the facility should already be talking to the community as part of their community right-to-know program, but facility management needs to actively ask for counter surveillance assistance from their neighbors; it is in the best interest of the locals to prevent a successful attack on the facility. Law Enforcement All of the best pre-attack counter intelligence information in the world is totally useless unless it is communicated to law enforcement. Waiting for the suspected attack to happen, even with increased on-site security ready to ‘repel boarders’ is still asking for a successful attack. One thing that the military has long understood is that there is never enough intelligence to provide 100% assurance of being able to defeat an attack. No, the only real way to prevent the possibility of an attack that actually results in the release of hazardous chemicals is to interdict the attack well beyond the perimeter fence. Since facility security forces have no authority to act off-site, facilities need to rely on law enforcement for these interdiction operations. This requires the sharing of counter intelligence information with local law enforcement personnel as early as possible. High-risk chemical facilities need to establish an active counter intelligence relationship with local law enforcement. Law enforcement needs to be made aware of the counter surveillance activities at the facility and in the local community. Actively involving the police intelligence collection effort in the facility counter surveillance plan will significantly extend the facility intelligence perimeter.

HR 553 Reported in Senate

Last week the Senate Homeland Security and Governmental Affairs Committee finally got around to publishing their report on HR 553, the Reducing Over-Classification Act. The Committee held their hearing on this bill back in November of last year and ordered the bill reported favorably; on Wednesday that report was officially filed and the GPO posted the official copy of that report on Friday. This is just one of a number of delinquent reports that we should be seeing in the coming weeks. This report is important because the Committee made some important changes to the legislation, changes that had not been available for public scrutiny until this report was published. Actually the reported version of the bill is a substantial re-write of the original bill that passed in the House back in February of 2009. The original bill was the work of Rep. Harmon (D, CA) and was intended to reduce the over classification of information in the Department of Homeland Security so that more information could be more easily shared with State and local governments and private entities responsible for protecting critical infrastructure and key resources (CIKR). The Senate bill extends the reach of this bill well beyond just DHS and makes it specifically targeted at intelligence information. Classified Information Advisory Officer In DHS it would require the designation of a Classified Information Advisory Officer to “assist State, local, tribal, and private sector entities that have responsibility for the security of critical infrastructure, in matters related to classified materials” (S. Rept 111-200, pg 5). The ‘private sector entities’ would certainly include high-risk chemical facilities under CFATS. The report makes it clear that the Committee intends for this Officer to “serve as both a valuable resource for information and an advocate for these non-federal entities”. Intelligence Dissemination Probably the most important part of this revised bill is the establishment of procedures to try to make counter-terrorism intelligence information more available for those that are actually charged with protecting CIKR. It would specifically task the Director of National Intelligence with ensuring the maximum sharing of intelligence sharing with “appropriately-cleared individuals in federal, State, local and tribal governments” (pg 6). I am disappointed that this section (Section 4) does not include ‘private sector entities that have responsibility for the security of critical infrastructure’, but that is probably because DHS would be the agency responsible for that specific communication. I would still have preferred to see that specifically mentioned in this section. The revised bill would require the standardization of format for intelligence products and require portion marking of those products to ensure that it is clear what portions of the intelligence reports is actually classified (which is already included in the general rules for marking classified documents). Then it would require each intelligence agency to determine which reports “could benefit a state, local, or tribal government, law enforcement agency, or private sector entity” (pg 7) and forward those reports to the Interagency Threat Assessment and Coordination Group (ITACG). The ITACG would then recommend to the DHS Undersecretary for Intelligence and Analysis (DHS I&A) to “produce a product at the lowest possible classification level that can be provided to appropriate entities” (pg 7). While first responders are specifically mentioned as a potential target audience (a great idea) of such reports, I am again concerned that ‘private entities’ are not mentioned. There does appear to be enough ‘buts’ and ‘ifs’ in the language to allow for adequate protection of ‘methods and sources’. This has always been the (semi) legitimate justification for keeping intelligence reports closely held. The parenthetical ‘semi’ is there because this justification has been used on occasion to provide cover for things completely separate from methods and sources. The one short coming in this legislation is that it still solely relies on intelligence agencies to voluntarily share their information with ITACG. While the agency IG’s are tasked with reporting on accurate classification efforts, there is no requirement for independent verification of the sharing of appropriate information with ITACG. I think that it would be beneficial for the provision of a officer in the Office of the DNI to review compliance with this sharing requirement. Preventing Over-Classification Only two sections in the bill address the original intent of HR 553, the prevention of over classification of information. It doesn’t appear that these provisions are nearly as robust at those proposed by Rep. Harmon, but they will have some affect the on the level of classification of intelligence information. The Way Forward This bill is now on the Senate Legislative Calendar and has a reasonable chance of being brought to the floor and being approved by the Senate in June. There doesn’t appear to be anything of significant political interest to delay its consideration. The bill will then have to go to Conference because of the Senate changes to the bill. The House has generally been slow to appoint conferees to bills during this session, so it isn’t clear that the bill could come to a final vote in both Houses before the summer recess. Even so, this bill could probably pass after the summer recess, even in this contentious election year.