Senate Appropriations Committee Reports HR 2017

Yesterday the Senate Appropriations Committee reported on their mark-up of HR 2017, Department of Homeland Security Appropriations Act, 2012.  The bill was ordered favorably reported on a very bipartisan vote of 28-2 (that also included two other spending bills). The substitute language for the bill is not yet available on the GPO web site, but the report (Senate Report 112-74) is available.

I haven’t had a chance to do a detailed review yet but Section 538 will extend CFATS authorization for another year.

Incident Highlights Chemical Sabotage Risk

An article on the Portland (ME) Daily Sun website describes a chemical incident at a wastewater treatment plant that highlights a form of chemical sabotage not addressed by the Chemical Facility Anti-Terrorism Standards (CFATS) regulations. Of course, since this took place at a wastewater treatment plant, even if the risk were addressed by the CFATS rules, they would not have applied.

Incident Description

According to the article, someone pumped about 500 gallons of industrial grade bleach into a sodium bisulfite storage tank. A well understood chemical reaction proceeded to take place that produced heat and chlorine gas. The tank was apparently adequately vented because an explosion did not take place.

The article did not say if it was a facility employee or a delivery truck driver that was responsible for putting the wrong material into the tank. While accidents like this are not really common, they happen often enough that the prevention of these accidents is an almost mandatory topic in process safety reviews.

Incompatible Chemicals

Any facility that handles chemicals has to worry about the inadvertent mixing of incompatible chemicals. Almost all chemicals have at least one other chemical that, if mixed, will result in the production of toxic gasses, heat, fires, or some other dangerous byproduct. There are even well known materials that are incompatible with water.

For hazardous chemicals that require process safety reviews or hazardous operations reviews, one of the topics that should be addressed is how the combination of incompatible materials will be avoided. Typically the preventive techniques will involve a combination of engineering controls and administrative procedures. Unfortunately, process safety rules are not required take into account deliberate attempts to mix incompatible materials.

Sabotage Risk

One method of attacking a high-risk chemical facility would be to deliberately mix two chemicals that would produce a reaction that would result in a catastrophic release of toxic, flammable or explosive chemicals. This could be effected by an insider, a delivery driver (at facilities that allow drivers to unload chemicals) or through an attack on an industrial control system.

Currently the CFATS regulations only address the sabotage risk for a single class of chemicals that react with water to produce the potential for catastrophic releases or explosions. Part of the reason for that is that there is such a wide range of chemicals that could produce hazardous consequences if mixed with an incompatible chemical that almost all chemical facilities would be covered. For instance pool supply facilities store acids and concentrated hypochlorite that produce a similar reaction to that described in this incident. Grocery stores sell multiple products that produce similar reactions.

Counter-terrorism Response

Any facility that houses large quantities of chemicals with well-known incompatibility reactions should internally address measure to prevent their use in a potential terrorist attack. Simple measures include unloading procedures, different types of hose fittings on tanks storing incompatible chemicals, and ensuring that there are no common piping that could allow movement between incompatible tanks. These are common safety measures and should not cause an undue burden on most businesses.

High-risk chemical facilities need to specifically look at this issue, even with chemicals that are not listed on the DHS Chemicals of Interest (COI) list. Attacks on non-covered chemical storage tank that could affect covered storage tank would provide a method of attacking those tanks without introducing a complicated explosive device.

CIPAC Annual Meeting October 6th

Today the DHS Critical Infrastructure Partnership Advisory Council (CIPAC) published a notice in the Federal Register (76 FR 55693) announcing that their Plenary Meeting will be held on October 6^th, 2011 in Washington, DC. No agenda is currently available, with the Notice explaining that the Council “will meet to discuss issues relevant to the protection and resilience of critical infrastructure”.

While the meeting is open to the public, participation in the discussions will be limited to Council members, DHS officials and invited personnel. There will be a limited period available at the end of the meeting for public comments of up to 3 minutes on first come basis. Personnel wishing to make on-topic comments during that period need to register that intention at the meeting location.

Written comments may be submitted at any time before or after the meeting. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket #  DHS-2011-0055).

As I have commented about any number of DHS public discussions, I think that DHS and CIPAC would be better served if public meetings like this were available as a webinar-type internet broadcast. Complaints by a number of public advocacy groups like Greenpeace that CIPAC gives industry ‘undue influence’ on the operations and policies of DHS would certainly be diminished if the public deliberations of this group were truly made public.

NOTE: A copy of this blog post will be submitted as a comment on this Docket.

Senate Subcommittee Marks Up DHS Spending Bill

Yesterday the Homeland Security Subcommittee of the Senate Appropriations Committee marked up their version of the FY 2012 DHS spending bill. There is no publicly available record of the markup or the bill but the Committee did publish a summary. The bill would provide less money than the FY 2011 authorization but much more than the bill the House passed in June.

According to the summary the Senate bill would increase Coast Guard funding, restore grant programs eliminated by the House bill, significantly increase cyber security spending and restore many of the S&T programs eliminated by the House.

There is no specific mention of chemical security matters, but I think we can safely assume that there is the now standard one year extension of the CFATS program.

ICS-CERT Publishes Advisories on Two Industrial Control Systems

Yesterday the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) published two control system advisories. One dealt with the Siemens WinCC system while the other dealt with the Scadatec Limited Procyon system.

Siemens WinCC

A new set of security researchers, Billy Rios and Terry McCorkle, have reported a memory corruption vulnerability in WinCC Runtime Advanced Loader, a component of both WinCC flexible and TIA Portal. This vulnerability was reported in limited distribution on the US-CERT secure portal on September 1^st.

The vulnerability would allow an attacker with basic skills to use a specially crafted packet to execute a denial of service attack and possibly execute arbitrary code remotely. There is no known exploit publicly available for this vulnerability.

Siemens has not developed, nor is it intending to develop a patch for this vulnerability. They advise customers to keep this feature disabled on their systems except when it is being used to update firmware.

Scadatec Limited Procyon

The nSense Vulnerability Coordination Team has reported a buffer overflow vulnerability in the Scadatec Limieted Procyon HMI/SCADA product. This vulnerability was originally reported on the US-CERT secure portal on August 4^th.

This vulnerability would allow a moderately skilled attacker to use a specially crafted packet to cause a buffer overflow via the Telnet daemon allowing for a denial of service attack and potentially allow the remote execution of arbitrary code.

Scadatec Limited has produced an updated version of Procyon HMI/SCADA product that is free of this vulnerability. Current customers can download the new version from http://scadatec.co.uk/existing_users.html.

General Comments

The increased visibility of SCADA system vulnerabilities has started to produce the additional attention of security researchers that has been predicted by a number of commentators in the ICS security arena. We must assume that the portion of the Black Hat community actively interested in attacking systems has also increased their attention on industrial control systems. We should start to see apparently random attacks on such systems. Hopefully system owners will report such attacks to ICS-CERT and/or RISI.

It is interesting to see Siemens specifically decline to produce a patch or update to deal with this new vulnerability. It is good to see that the vulnerable system is disabled by default, but it is unreasonable to assume that all users will remember to re-disable the loader when they are done using it to update firmware. They are setting their customers up for failure.

ISCD Updates CSAT Registration Manual

I was doing my daily click-around the DHS Chemical Security web site today and clicked on the link to the Register to Access CSAT page, a page that I don’t look at very often. To my surprise it was updated last week to reflect a link to a new version (June 2011) of the CSAT User Registration User Guide.

No Other References on ISCD Web Pages

There is no indication on the Chemical Security Assessment Tool page that there was a change to the registration manual; it still shows a July 208 date for the manual in the Key Documents section of the page (though the link does go to the new manual).

There is no indication on the CFATS Knowledge Center page that there has been a change in this manual. If you click on the ‘User Registration’ button on the page the link in that page’s ‘Related Documentation’ section to the User Guide takes you to the new manual, but none of the FAQ’s listed on the page have been updated to reflect the new manual. Alert readers might remember a brief note in my blog from August 20^th that discusses a minor change to FAQ #1544 that addressed registration issues, but it had nothing to do with the new manual.

As I noted in that blog, the registration manual is probably one of the least used manuals today as most facilities are already registered. A new facility would find this new manual in the normal course of things from any of the above sites and they would not need to know that it is a new manual. Already registered facilities will have little use for this manual. Experienced consultants who are working with new clients getting them ready to register should certainly review the new manual, however.

New Manual

There is no management of change documentation in this version of the manual, so it is difficult to determine what changes were made in Version 5. I don’t have a copy of the old manual with me to compare against and I don’t see anything obvious. Once I’ve had a chance to do a detailed comparison I’ll let my readers know here.

Implications of FRA PTC Revisions – Rerouting Decisions

Last month I briefly described the latest notice of proposed rulemaking (NPRM) published by Federal Railroad Administration (FRA) concerning changes to the way the FRA intends to administer the Congressionally mandated positive train control system (PTC). This post, the second in a series of posts, will look at the potential effects on TIH routing decisions that will be made by individual railroads. The other post in this series was:

Implications of FRA PTC Revisions – STB Rate Disputes

Rail Routing Rules

Before the PTC regulations went into force the FRA and the Pipeline and Hazardous Material Safety Administration (PHMSA) put safety and security rules into force that required railroads to make formal routing decisions for, among other highly hazardous materials, TIH chemicals. Those rules required that the analysis would take into account twenty-seven separate factors, one of which was cost. The rule does not specify the weighting to be given to each of those separate factors.

It has been clear from the start of the PTC rulemaking process, and even going back to the Congressional discussions that lead-up to the mandate for the rule, that the installation of PTC systems was going to increase the operating and capital costs of railroads. A number of commenters, myself included, questioned if those increased costs would be used to justify the movement of TIH routes back along urban area rail lines that would be required to have PTC systems even without the TIH chemicals or already carried TIH traffic.

One of the mitigating factors in the current PTC rules that makes this transfer of risk more difficult is found at §236.1020. That section outlines the so called ‘alternative route analysis test’ that requires justifying the routing change by showing that the new line presents no higher overall safety and security risk as the old line, assuming that both carried the TIH shipments. This reinforces the current TIH-routing safety and security rules.

Weakening Routing Rules

This NPRM would remove §236.1020; making the simple removal of TIH traffic from a line not otherwise required to have PTC systems installed the sole requirement for removing that line segment from the PTC requirement.

Since the current TIH routing rules do not require railroads to get their routing decisions approved by either FRA or PHMSA, there is no longer a requirement for any federal agency to review the routing changes that will be made to avoid installing PTC systems on line segments that would only be covered due to their TIH loadings.

The FRA estimates that this rule would affect about 10,000 miles of rail lines.

Favoring Urban Routings

This means that there will be an added incentive for railroads to switch TIH traffic to those lines that also carry passenger trains. Such co-routing would significantly decrease the number of miles that would need to be included in the PTC system, reducing the overall cost of the PTC rule.

Passenger rail lines, almost by definition, run through urban and suburban population centers. After all this is where the people live and work. This means that this proposed rule will almost certainly increase the number of urban and suburban lines that carry TIH chemicals.

The reduced speed limits for these lines will certainly limit the number accidents that will result in the release of TIH chemicals, especially catastrophic releases. Unfortunately, the same risk reduction cannot be applied to the potential for attacks on these railcars. These cars are difficult to attack because of their robust design, but they do become more likely targets as they traverse populated areas, particularly major urban areas. The increased target value will also ensure the increased likelihood that professional terrorists, with the skills and tools necessary to successfully attack these harden targets, will be involved in their attack.