Security and Safety

Anyone that worked with me while I was a process chemist in a specialty chemical manufacturing facility knows that I have always been passionate about process safety. And readers of this blog know of my passion for security. So, it should be no surprise that I am very concerned with the Chemical Safety Board (CSB) vs. Sensitive Security Information (SSI) controversy surrounding next week’s public meeting on the Bayer CropScience fatal process accident that happen last summer. Two opinion pieces yesterday, one at USAToday.com and the other at Pubs.ACS.org, paint this as a conflict between security and community-right-to-know (CRTK). I think that this is a major mistake. In the context of counter terrorism operations, security and CRTK are part and parcel of the same operation, just like security and safety. They all contribute to a piece of the puzzle to prevent a successful terrorist attack. Assume it was a Terrorist Attack Let me use the Bayer incident as an instructional aid. Let’s assume that the accident was not an accident, but actually a well planned and executed terrorist attack. Assume for a moment that the ‘process upset’ that caused the explosion had been deliberately engineered and had been just a little bit larger in size. The nearby MIC tank, instead of escaping damage, would have (in our assumed incident) been punctured by flying debris. A cloud of methyl isocyanate would have been released to the atmosphere and spread to the adjacent community. The resulting panic, injuries and deaths would have made this a very successful attack. However, if CRTK had been an integral part of the security plan for the installation, there would have been automated systems around the tank and process area to detect the slightest release of MIC. As the first sensor detected the leak, an automatic alarm would have been sent to facility and community first responders. As more sensors became ‘involved’ other automated sensors would have begun auto-dialing local residents and businesses warning them to begin to take appropriate measures. Weather sensors and an array of chemical sensors around the facility would have begun mapping the spread of the cloud and projecting concentrations beyond the fence line. Decisions would have been made about who would evacuate and who would shelter in place and the appropriate communications made. Local residents would have been told in advance how to shelter in place or where to evacuate and why one was better than the other in a particular situation. At the same time, other automated mitigation measures would go into action. Water and chemical sprays would start that would knock down the bulk of the cloud. Properly equipped emergency responders would arrive at the scene and make what ever temporary repairs were possible to stop further leakage. Off-site response personnel would arrive on the scene to provide assistance to the community near the facility, monitoring for exposure levels and getting people safely out of the area. In the CRTK scenario, the success of the terrorist attack would have been reduced because panic, deaths and injuries would have been greatly reduced. This is the reason that CRTK plans are an integral part of any successful counter-terrorism security plan, just as they are a critical part of any successful process safety plan. Working Together Unfortunately, the government’s safety, security, and CRTK people are not working together. They are in different agencies and working under separate mandates. In this case the security and safety people have worked out an accommodation, but the CRTK people are still wondering in the wilderness. Two agencies have worked together to the extent that one did not stop the other, but that is not actually cooperation. It is more like a temporary cease fire on the battlefield to collect the wounded. This is a high-risk chemical facility (both from a safety and security point of view). Until the CSB determines the actual cause of the incident (which may not happen for another six months, if ever) there is a remote possibility that this was a deliberate attack and not a process problem. Even if it were completely accidental or the result of an inadequate process design/operation there are security issues that will inevitably be identified in the thorough type investigation that the CSB conducts. In either case the Coast Guard, as the responsible security agency for the facility, should be working as part of the CSB team during the investigation. A Coast Guard investigator should be a working member of the team, reporting to the head CSB investigator. That forensics investigator would then be immediately available and up to speed on the investigation if evidence of sabotage or outside attack was discovered. Otherwise that investigator should be looking at how the existing security plans contributed to or mitigated the severity of the incident. Congressional Action Required When the Chemical Safety Board was formed ten years ago there was no Federal involvement with security at chemical facilities. As the C&EN article notes there are now about 10,000 facilities with federally regulated security measures. More will likely be added if/when the water facility exemption is removed this year. The mandate for the Chemical Safety Board needs to be updated to take this into account. On the other hand, Congress completely overlooked the issue of chemical safety and community-right-to-know when they mandated security measures at chemical facilities. That was a major political and technical mistake and one that needs to be corrected. It is fortunate that the Bayer issue comes up when it did. Congress is beginning to consider the reauthorization of the CFATS program next week. The hearing before the Government Oversight subcommittee of the Energy and Commerce Committee should be just the first such hearing to look at the safety/security issue. Both the Energy and Commerce and the Homeland Security Committees need to look at this issue as part of the CFATS reauthorization. In my not-so-humble opinion, the Chemical Safety Board needs to remain the lead agency in any major accident or incident at a chemical facility; they alone have the technical expertise to get to the root cause of the accident/incident. At facilities that fall under CFATS, DHS should provide an investigator to assist the CSB by looking into security issues. For facilities that fall under the MTSA, the Coast Guard should provide that assistance. Additionally, they could provide on-going guidance to the CSB investigators about what information they receive or uncover that would be considered to be protected information under SSI or CVI rules. In any case, there should be a classified appendix to any CSB report involving a covered chemical facility that addresses the security issues that contributed to, or mitigated, the severity of the incident. That report should be given the widest possible dissemination in the security community, including other covered facilities.

Reader Comment – 04-15-09 – CFATS Reauthorization

Yesterday reader Pan Kamal responded to a blog I wrote last month about Sen. Leiberman’s letter to the Senate Budget Committee. Pan wrote:

“CFATS needs to get reauthorized. The protection afforded by CFATS is well thought out. The remaining piece of technology that will give us a huge leg up in protecting our critical infrastructure and other homeland assets is software and systems to link physical access control with the IT systems that manage and monitor chemical processes and storage of hazardous materials. There are companies starting to offer these technologies today.”

I am sure that there are people that oppose CFATS, but I have not seen any public outcry against the reauthorization. There has been opposition to some of the implementation processes, notably by farm groups and petroleum product suppliers, but that opposition has been about details, not about the program. I am not so sure that I agree with Pan’s argument for linking “physical access control with the IT systems that manage and monitor chemical processes”. Part of the problem with the vulnerability of control systems is their helter-skelter linkage with business IT systems. Any linkage of access control systems with process control systems or business IT systems needs to be carefully thought out and precisely implemented. Having said that, control systems, safety systems and business IT systems all need better access controls. Limiting access to all critical systems is a key security requirement for all manufacturing systems, but it is especially important for potentially hazardous systems. Further linkage of business, security and safety systems may be one way to accomplish this task, but it does raise the specter of the failure of a single system adversely affecting an entire enterprise.

Draft SSP Review – Facility Security Measures

This is another in a continuing series of blogs describing the draft SSP Template that was provided by a reader of this blog, not DHS. Just a quick reminder, this means that there might be differences between this template and the one that DHS will shortly be opening on the CSAT web site. The previous blog in the series was: Draft SSP Review – General Facility Information Draft SSP Review – Facility Operations This posting will be a general overview of what will undoubted be the largest portion of the Site Security Plan, the Facility Security Measures section. This section looks at overall site security measures, not measures related solely to particular assets within the facility boundary. Those asset security measures will be addressed in a later portion of the draft SSP Template. Risk-Based Performance Measure List The first thing one sees when starting the Facility Security Measure section of the SSP is a list of the 18 Risk-Based Performance Standards (RBPS). The instructions on the template read: “For each of the following RBPS, you must click on the box and then answer Yes or No as to whether the facility has any security measures for that RBPS.” For each of the RBPS marked ‘Yes’ the SSP submitter will subsequently see an extensive series of questions concerning that RBPS in a sub-section related just to that RBPS. The subsections for those RBPS that are marked ‘No’ will not appear. I would expect that the vast majority of facilities that have approvable Site Security Plans will have security measures for each RBPS. The one RBPS that might checked ‘No’ by a limited number of facilities will be RBPS #8, Cyber Security. There are still a few facilities that have no computer systems to protect. Any facility that checks ‘No’ to any RBPS should expect that they will have to fully justify that selection to DHS before DHS even starts to consider approving the Site Security Plan. I would suggest that facilities would want to initially check ‘Yes’ to each RBPS and carefully review each section to see if there is even a single question that can be answered before deciding to come back and check ‘No’ to any RBPS. Existing, Planned, or Proposed Security Measures Each RBPS subsection will be headed by the same initial question; “Does the facility have any existing, planned, or proposed security measures for RBPS X? This is a good place to discuss the difference between these three categories of security measures. The distinctions are important to the SSP approval and inspection process. An ‘existing’ security measure is obviously currently in place and operating. If DHS were to show up today, the facility would be able to show measure to the inspector. A ‘planned’ security measure is one that is not yet installed or in place but has received formal management approval and is going to be installed by a scheduled date. A ‘proposed’ security measure is one that the facility is considering for installation, but the approval process has not yet been completed. Essay Question At the end of each RBPS sub-section there is one final question. This question does not have the common ‘Yes/No’ check-off that most questions get, or even the short, fill-in-the-blank for the inevitable ‘Other’ questions. The question is long, but so is the potential answer. That is why I call this the ‘Essay Question’. Here is the question:

“Does the facility have any proposed security measures for satisfying this RBPS that it wants to share with DHS? In the response to this question, the facility may share with DHS any existing or planned security measures the facility proposes to remove or eliminate to include a general timeline for such action. In the response to this question, the facility may also identify any existing or planned security measures which the facility has identified in this RBPS section, but which the facility does not wish DHS to include in evaluating its SSP for approval. Please see section 4.1.3 and 5.1.3 of the CSAT Site Security Plan Instructions for more detail.”

As I explained in an earlier blog, the purpose of this question is to give DHS an idea of what changes are currently planned for the Site Security Plan. If the current/planned security measures are determined to be inadequate, but there are proposed measures included here, it would allow DHS to tell the facility which of the proposed measures would enable DHS to approve the plan. Asking DHS not to include reported security measures in their evaluation will serve a similar purpose; if DHS approves the program without considering these measures, the company will be free to remove these measures without effect on their SSP status. If the facility has any existing security measures that it is considering taking out of service or removing, notifying DHS of this in this question would allow DHS to comment on how this removal would affect the continued approval of the Site Security Plan. Paired with proposed improvements, this would again give DHS a chance to ‘approve’ off-setting improvements. Once again, the approved Site Security Plan will become essentially a contract with DHS. It will provide the standard by which DHS inspectors will judge the adequacy of security arrangements at the facility.

TWIC Reader Meeting Update

Last week I noted that the Coast Guard would be holding a public meeting on their TWIC Reader ANPRM on May 6th, but that they had not yet identified the exact location in the Washington, DC area for that meeting. In today’s Federal Register the Coast Guard announced that the meeting would be held at the the Sheraton Crystal City Hotel, 1800 Jefferson Davis Highway, Arlington, Virginia 22202. The meeting is scheduled to run from 9:00am to 5:00pm EDT, though it may end sooner if all public comments are received before that time.

TWIC Reader ANPRM – Record Keeping Requirements

This is the final blog posting in a series of blogs about the advanced notice of proposed rule making (ANPRM) that the Coast Guard recently published about the potential regulation of transportation worker’s identification credential (TWIC) reading devices. These devices would be used to verify the identity of people working in ships and facilities covered under the Maritime Transportation Security Act (MTSA). The other blogs in this series include: TWIC Reader ANPRM – Identification Techniques TWIC Reader ANPRM – Risk Groups TWIC Reader ANPRM – Reader Use by Risk Groups TWIC Reader ANPRM – Recurring Unescorted Access TWIC Reader ANPRM – Security Plan Requirements The ANPRM expresses the Coast Guard’s current thinking about what types of requirements will be included in the regulations that will be formally proposed later this year. This post looks at potential requirements for record keeping. As with any government program, record keeping will be used to confirm compliance with the new rules. Unescorted Access Records The TWIC Readers will be able to record the date and time of every reading, along with appropriate personal identification information. This type of information may be of use in law enforcement investigations. The Coast Guard is considering requiring facility and vessel owners to keep records of the entry data for two years. Since Risk Group C facilities and vessels are not required to use a TWIC Reader to control access, they will not be required to maintain these records. Interestingly, the Coast Guard is specifically not expecting to require that exit data records be maintained. They explain that they believe that “that type of requirement would be burdensome compared to the security benefit that it would provide” (74 FR 13368). With no requirement to record exit data, there will be no requirement to read TWIC upon exiting the facility/vessel. Recurring Unaccompanied Access Records For facilities or vessels that use the recurring unaccompanied access procedure the Coast Guard is expecting to require that the owner/operator maintain records of people that have been granted unaccompanied access under the procedure. The Coast Guard expects that they would be able to look at such records during an inspection and determine the identity of the (fourteen or fewer) personnel currently being authorized unaccompanied access under the recurring unaccompanied access procedure. The other part of the recurring unaccompanied access procedure that will be inspectable is the requirement to periodically check the validity of the TWIC. To be inspectable the Coast Guard would have to require that records of the validity checks would have to be maintained.

Draft SSP Review – Facility Operations

This is another in a continuing series of blogs describing the draft SSP Template that was provided by a reader of this blog, not DHS. Just a quick reminder, this means that there might be differences between this template and the one that DHS will shortly be opening on the CSAT web site. The previous blog in the series was:

Draft SSP Review – General Facility Information

The next portion of the Draft SSP Template will be the general facility information portion of the tool. This section of the template will require the facility management to contact a variety of local government agencies to get data. If the facility has not established a working relationship with these agencies by this point in the facility security preparations, now is a good time to do so.

Facility Description 

There are some new questions about the facility that have not been previously required in the CFATS process. The first that the facility will see is the ‘facility type’ this provides a pull down menu with a description of various types of chemical facilities. The copy of the draft template that I have does not show the pull down options, but this should be a fairly straight forward selection process. If there is no appropriate selection there is a fill in the blank option available.

The next ‘question’ appears to be awkwardly worded; it reads: “Provide the Office of Emergency Management (OEM) authority under which the facility operates.” From the example provided in my copy of the template, “County”, it is apparent that the question refers to the lowest level of ‘Emergency Management Agency/Administration’ that services the facility area. The selection is made from another pull down menu with the standard fill-in the blank ‘other’ option.

The other two questions in this sub-section deal with the ‘locale’ of the facility and the ‘type construction’. The responses are chosen from the inevitable pull down menu with the standard ‘other’ option.

Facility Contact Information 

This sub-section requests the name and contact information for four separate ‘Security Officer’ listings; Facility Security Officer, Assistant Facility Security Officer, Corporate Security Officer, and Cyber Security Officer. I am certain that the written instructions will make abundantly clear that there must be at least two separate names provided, one for the Facility Security Officer and the Assistant. Larger facilities and multiple high-risk facility companies will almost certainly have separate names for the other two positions.

The last question in this subsection is something of a step-child, put here for the lack of a better heading. It asks: “Does the facility implement security plans required or recommended by the following agencies?” It then provides ‘Yes/No’ check-offs for TSA, DOT, Coast Guard, Customs and the ever present ‘Other’. If a facility is unsure about this question it probably does not apply.

On-Site Response Capabilities 

This next section asks a number of questions about the on-site emergency response capability for the facility. Most of the requested responses are ‘Yes/No’ check-offs with one fill-in the blank (name of facilities that share the response capability) and one fill-in the number (number of members of the on-site Emergency Management Team).

The only ‘odd’ question is the one about ‘Special Response Capabilities’. What constitutes an SRC is not clear until the next page where there is a list of ‘Capabilities’ that DHS is interested in. Some items on the list, field medical and toxic release response for example, are fairly common, but there are some exotic response capabilities listed. ‘Aviation’, ‘Hostage Rescue’ and ‘Snipers’ are three that are sure to raise some eye brows. Responses are simple ‘Yes/No’ check-offs.

Emergency Response Information 

This section starts off with two easy questions about facility shelter-in-place capability and the presence of a ‘community notification system’. Both questions require a ‘Yes/No’ check-off. The remaining questions are going to require extensive conversations with off-site emergency response agencies. While there is an added ‘Unknown’ check-off option for many of these questions, I don’t believe that DHS will (nor should) accept that answer for too many questions.

The emergency response agencies that the Draft SSP Template addresses are local police, fire department, emergency medical technicians (on-site and off-site), and mutual assistance groups. The questions deal with the name of the agency, number of full-time personnel, response times and ‘Special Response Capabilities’. The SRC section provides the same list of capabilities as found in the on-site response section.

Special Response Capabilities 

This sub-section of the Draft SSP Template should probably been called ‘Other Response Agencies’, that would have been less confusing. It looks for information on three other agencies that might be counted on to respond to an incident at the facility. These agencies are State Police, US EPA, and State EPA. Most of the questions are the same as for the previous response agency section. One new addition is the question that asks: “Is there a formal, written agreement with the responding agency?”

Facility Personnel 

The number and type of employees working at the facility are addressed in this sub-section. The questions ask for numbers of ‘Employees’ and ‘Security Officers’ in the categories of full-time, part-time, contractors, and others. There are also questions about the shift times and number of employees on each shift.

COI – Chemical Operations 

The types of operations involving the facilities listed COI are covered in this sub-section. Those operations are shipping, selling, receiving, and manufacturing. Each of the COI listed in the General Facility Information section of the template are pre-populated into this sub-section. There are ‘Yes/No’ check-offs for each of the COI to determine if the operations apply to that COI. There is also a question about what industries the facility supplies. Finally, for each COI that has been indicated as being shipped or received is listed in a separate section asking about the mode of transportation used for shipping and receiving.

Uploads 

The final two sub-sections in the Facility Operations section of the SSP deal with optional data uploads to the system. The first is the ASP upload. All high-risk facilities have the option of filing an Alternative Security Plan in lieu of completing the remainder of the SSP as long as it meets the requirements of 6 CFR § 27.225. Given the problems that facilities had with using ASP’s in lieu of filling out the DHS SVA, I doubt that many ASP’s will be approved on the first go round.

The second upload sub-section is for ‘Facility Schematics’. This allows facilities to upload aerial photographs, plot plans, drawings and system schematics to DHS. The simplest facilities probably will not need to do this, but any facility that handles multiple COI, or COI in multiple locations should probably plan on providing documents to make it easier for DHS to understand the locations of COI storage and other key locations.

 A personal recommendation; use a good security software program to scan your files for bugs, viruses, worms, etc before uploading them to the DHS system. I am very sure that DHS is going to scan these upload documents, but it looks pretty tacky if you try to upload an infected file to the DHS system.

TWIC Reader ANPRM – Security Plan Requirements

This is another in a series of blogs about the advanced notice of proposed rule making (ANPRM) that the Coast Guard recently published about the potential regulation of transportation worker’s identification credential (TWIC) reading devices. These devices would be used to verify the identity of people working in ships and facilities covered under the Maritime Transportation Security Act (MTSA). The other blogs in this series include: TWIC Reader ANPRM – Identification Techniques TWIC Reader ANPRM – Risk Groups TWIC Reader ANPRM – Reader Use by Risk Groups TWIC Reader ANPRM – Recurring Unescorted Access The ANPRM expresses the Coast Guard’s current thinking about what types of requirements will be included in the regulations that will be formally proposed later this year. This post looks at potential requirements for changes to security plans. Security Plan Amendments Current vessel and facility security plans were prepared, submitted and approved before these requirements were developed for the use of the TWIC Reader to identify, validate and verify the people authorized unescorted access to secure areas within the vessel or facility. Amendments to those security plans will have to be completed to take into account these new requirements. The Coast Guard is considering a six month (from the time of the publication of the final rule) time limit to submit the amended security plan, or perhaps setting up a staggered schedule to avoid having all security plans come due for renewal at the same time. Public comment on these time schedules and deadlines is requested. Security Plan Amendments could be required to address a wide variety of implementation requirements to include:

TWIC verification requirements; Unreadable fingerprint identification requirements; Separate physical access system requirements, including identity protection; Recurring unescorted access (RUA) requirements; Escort requirements at RUA facilities or on RUA vessels; Periodic card validity check requirements at RUA facilities or on RUA vessels;

Alternative Security Plan Amendments The Coast Guard does not currently believe that these TWIC Reader rules will require re-writing § 101.120. That is because there is already existing authority {§ 101.120(d)(i)(ii)} to allow the Coast Guard to order the amendments to existing ASPs. The Coast Guard expects to use the same time limits in such orders, but requests public comments on the suitability of those time limits. An organization ASP could cover more than one vessel and/or facility and could cover more than one risk group. With this in mind the Coast Guard notes that they would expect the amended ASP to address each relevant risk group.