Security Planning and Assessment - Assignment Example

This paper will discuss the transportation of risky materials in highways. Security Planning and Assessment of Introduction Risky materials in transportation are vulnerable to sabotage or misuse and in the wrong hands pose a significant security threat. The security of risky materials in transportation poses unique challenges as compared to security at fixed facilities because of the changing environment surrounding a moving vehicle. Since risky materials are frequently transported in large quantities, once mobile they are particularly vulnerable to theft, interception, detonation, or release. When transported in proximity to large population centers, accidental or intentional acts could have serious consequences. Security Assessment One of the most critical components of rulemaking for the department of transportation1 is the assessment of possible transportation security risks for covered shipments of risky materials. Many companies have implemented numerous security measures without examining the threats against their operations and their vulnerabilities to those threats. Threats are sources of danger and can include both criminals and terrorists and the attacks that they might initiate to achieve their objectives. Vulnerabilities are weaknesses that make us more susceptible to attack or injury. When conducting a proper assessment of the threats to and vulnerabilities of the operation to a terrorist attack or terrorist activity, the types of information to consider include: (a) the type of risky material to transport, (b) the frequency and quantity of shipments, (c) the packaging type, and (d) the amount stored on-site. It is needed to identify and address the business practices (including relationships with external partners), such as the emergency response information that is available on site, and physical assets that are a part of the hazmat transportation activities. It is needed to analyze the company's business practices that affect the transportation of the risky materials included in HM-232 to identify potential security vulnerabilities. Such business practices may include: 'Taking and processing orders, including dispatching; Hiring and human resources-related activities (which relate to ensuring the trustworthiness of employees); Job descriptions, organization charts, and reporting structures for responsible management and decision making, security policies, and reporting (which all relate to who has access to information and who makes key decisions); Facility and building access policies and procedures; Qualification and selection of outside service providers (contractors) with access to hazmat handling areas; and Policies and procedures on distributing information related to hazmat shipments, including to business partners.' It is better to analyze each physical asset (facility, terminal, etc.) used in the transportation of hazmat to identify potential security vulnerabilities. This analysis should consider, at a minimum, the following: 'Exterior surveillance and line-of-sight attack potential; Areas of concealment; Normal and potential vehicle and pedestrian paths; How congestion, choke points (where vehicles or pedestrians may get delayed during an evacuation), and other circumstances might reduce the effectiveness of the security measures; Immediate surroundings - assess the potential for layered protection or and the nature of potential nearby threats; Storage facilities, transfer, loading, and unloading areas; Business offices, storage of empty hazmat packaging; and Visitor, vendor, and employee parking.' In addition, it is better to examine each configuration of transport vehicles for vulnerabilities based on use and the likely routes. Unlike many facilities, where the areas that are most in need of protection (such as critical operation centers) are separated from an outer fence by a considerable distance, there is no protective buffer surrounding vehicles on the road. Vehicles, therefore, can be more vulnerable. It is also better to identify and assess facilities that are owned and/or operated by others, such as truck stops, and rest/parking areas. It is important to remember that in the case of risky materials, the assumed agenda of terrorists is to convert the material, package, or vehicle into a weapon; in other words, controlling the material is an operational act in support of a larger attack plan. This can occur in several ways. The three principal methods are: The material can be purchased and delivered to the target location or an intermediate site to be transported later; the material can be acquired by theft either in transit or at a storage site. This part of the operation can take the forms of fraud, stealth, or violence; the material can be converted to weapons use directly while under legitimate control. This could be a violent event that takes the form of a catastrophic release, typically by explosive or mechanical attack. Taking the case of the legitimate purchase, there is nothing in the HM-232 security requirements that calls for validation of the consignee. However, it would be prudent business practice (but not required) to verify that an order of unusual character, such as a large shipment of toxic-by-inhalation gas to a stadium, is in fact expected and required. When it comes to determining which security measures are appropriate for the company, such as checking with consignees, only one can be the judge. Material acquired by theft is not unlike criminal activity associated with high value shipments. Unlike typical criminal profiles, however, the terrorist's readiness to employ extreme violence is much greater. Where the criminal may be reluctant to employ deadly force because of the repercussions if captured, the terrorist may not expect to survive the operation and so eventual capture is meaningless as a deterrent. Without considering the tactics used, a terrorist's objective is to take control of the material and transport it to a target location for use as a weapon. Maintaining control of the cargo, not the vehicle, is the primary concern here. In the third case, the material is converted to a weapon on the spot. This means that the material must be located at or near the final target. Storage areas and transport routing that are near desirable targets should be areas of concern. The 'Trojan Horse' scenario, where a device is attached to a shipment and detonated at the desired moment and location, and the 'Intercept' where a device is located in anticipation of the material's passage, are the two most likely options. What can be derived from all of the preceding discussion is that each method requires specific knowledge in order to be successful. There are basically three ways in which a terrorist can obtain this information: '1- Conduct research of public records and reference materials, including company websites, annual reports, and marketing information; 2- Observe operations; 3- and Acquire knowledge from participants in the company's operations or by actually taking part themselves (as an "insider").' Public information may be of limited value beyond learning the characteristics of the material being pursued. Observation is an operational act that involves exposure and risk of discovery. Direct knowledge through participation or trust of those in a position to know provides both detail and a high level of confidence in the information. This is the reason why business processes are of a security concern to HM-232. Although a major portion of the security plan may be uniform across a company's entire operation, planning must recognize that different classes of material may require different strategies. This is due to the nature of the material and the character of the transportation processes involved. The following is a discussion of several materials: Radioactive materials (RAM) are not likely to be used in creating a fission or fusion bomb, but as a persistent contaminant, that represents both a real health hazard and an emotional trigger for widespread panic. The most publicly discussed tactic is the 'Dirty Bomb', more appropriately referred to as a 'Radiological Dispersion Device' or RDD. This device uses conventional explosives to disperse the contamination, potentially creating an acute situation for large numbers of people. Because certain types of RAM are effectively invisible and easily spread through contact, less spectacular methods of dispersal must also be considered. Explosives require proximity to the target and sufficient quantity to be effective. By controlling either of these two parameters, the potential consequences can be reduced. Poisons are similar to RAM in that they represent a dispersal attack in order to be effective. Unlike RAM, dispersal of poisons must maintain an effective level of concentration to be successful. This tends to limit use of these materials to situations where the dispersal can occur within a defined volume. Flammables represent the most common category of risky material shipped and transported. The sheer number of opportunities and the diversity of locations and circumstances involved make flammable materials cause for concern. Biological materials represent means for dispersal attack, similar to RAM. CDC-regulated materials represent a potential for the introduction of infectious disease into the population. Another category of risky materials of interest to HM-232 includes all other placarded materials. Although these may not present the level of weapons potential as those discussed above, some of them are capable of significant economic and social disruption when intentionally released with malicious intent, while others do not require any additional security measures to be implemented. Companies have different and distinct types of operations. For example, some companies act as both shipper and carrier. In addition, some carriers maintain their over-the-road operations entirely separate (and differently) from their local pickup and delivery operations. It is appropriate to consider the distinct character of each of your operations in your security assessment. Both shipper and carrier operations involve the processing of orders. The 'business side of the house' is important because of the storage and shipping information. There are two groups of people of concern: those that must process or act on the order information and those who may have access to the information but do not typically process or act on it. Although each person who processes an order should be considered a potential threat, they also represent an opportunity for threat recognition. Carrier operations present several difficult security issues. Effective status and tracking of the cargo may be impractical, forcing strategies that involve the personnel and transportation equipment as surrogate indicators to potential problems. The variety of situations typically encountered while en route present many vulnerabilities that a terrorist can exploit. Companies have limited security dollars, making it necessary to prioritize the vulnerabilities to be addressed and the primary security objectives (PSOs). There are many ways to do a prioritization, but most rely on some form of subjective ranking system. For example, we may prioritize the threats us face as highly likely, somewhat likely, possible, unlikely, or improbable (of course, we could use a greater or fewer number of categories). We may then rate our vulnerabilities (perhaps on a scale from very low to high), considering how easy we believe it would be to exploit that vulnerability given our current operations. Combining these categories can help us focus our energies and limited resources on those vulnerabilities most easily exploited that correspond to the highest threats. We can treat this combination of threats and vulnerabilities as the relative likelihood of a terrorist act. However, this is not likelihood in the traditional sense of the word, since there are not sufficient historical data to know the probabilities of any future terrorist acts; it is simply a good substitute. This analysis will help to see what terrorists find attractive. Security Plan Security Plan should be a complete document and should include: (a) information on security assessment; (b) how to address any vulnerabilities identified in the assessment; (c) what security measures are adopted; (d) how, when, and by whom they will be implemented; (e) organizational structure; and (f) the responsibilities of the various employee positions. In essence, the security plan is the detailed map of how to address the security assessment. A security plan can be formatted using any structure that makes sense for any company. An example of a good model would be to structure or organize it into the following components or sections: Personnel Security, Unauthorized Access, and En Route Security. These areas are specifically required to be addressed by RSPA's HM-232 rule and must be included in the plan in some form. For each component, it is strongly recommended to provide a complete description of the relevant specific security measures used to reduce vulnerabilities. It is also better to discuss personnel roles and responsibilities for implementing each measure. The most effective security measures do not necessarily involve high-tech or high-cost implementations. Sometimes very simple changes in procedures can achieve the same result as a much more costly equipment-based solution. After the primary security objectives (PSOs) for each component of security plan are identified, it is needed to identify the specific security measures (or steps) that will be implemented to achieve each objective. A security measure is a policy, procedure, device, or system that is put in place to reduce one or more vulnerabilities. If one of the PSOs is to prevent access to hazmat vehicles by non-employees, an appropriate specific security measure might be to require employee identification cards and have a security officer check cards in the area where the hazmat vehicles are parked. Another option might be to park all hazmat vehicles in a secured area and only allow access by employees with identification cards and a signed dispatch order listing a specific vehicle. It is important to remember that specific security measures can be hardware-based (fences), technology-based (motion detection), policies and procedures oriented (always ask to see the visitor badge of anyone you do not recognize), or training-based (to reinforce policies that may not be followed properly). The Department of Homeland Security determines the national threat level based on information it receives from the various security organizations. The five levels of the Homeland Security Advisory System (HSAS) are color-coded based on the assessed threat condition. A low condition (green) indicates a low risk of terrorist attack; a guarded condition (blue) indicates a general risk; an elevated condition (yellow) indicates a significant risk of terrorist attack; a high condition (orange) elevates the level to a high risk; and a severe condition (red) is the highest level, indicating a severe risk of attack and requires the highest level of security. The national threat level may be increased by one or more levels depending on the nature of any pending threats. For example, if an attack occurred under a guarded threat level (blue), the level would be immediately raised to severe (red). While it is not required that the plan address varying threat levels, it is highly recommended. Some organizations adopt a system with less than five threat levels (for example, often green, blue, and yellow are lumped into a single category, resulting in three threat levels). Security plan should address the specific measures or actions to be implemented for each of the threat levels. Again, some of these measures may require only a policy change, while others may require a company to incur up-front costs at the lowest threat level to prepare for the highest threat level. We must already have the measures identified and ready to be implemented if a "red" threat condition is declared. When considering how to respond to varying threat levels, we should remember that the threat to our operation may be elevated for various reasons, including type of hazmat hauled or location of your facility, even if the national threat level is not raised. For example, there was a recent alert to possible terrorist threats in a state located in the Midwest, but HSAS remained at yellow. Motor carriers operating in that state, however, might have implemented their plans for the orange level. Future threats and alerts could be specific to your location, as in this example, or to your industry. As discussed above, there are three major components that must be included in a security plan in some form: personnel security, unauthorized access, and en route security. The number and extent of the measures selected to implement for each component is solely dependent on analysis of threats and vulnerabilities and your determination of the cost-effectiveness of each measure for your organization. A brief description of each component and security general objectives is provided below. Personnel security includes confirmation of identity and credentials. Identification of personnel is the foundation for access control, based on trust. This means a degree of confidence that an individual is who he represents himself to be and has the skills and experience claimed. Higher levels of trust relate to whether the individual can meet various operational safety and security requirements and even whether they are allowed access to secured areas or information systems. For example, to confirm the identity and credentials of job applicants, one security measure that can be used is to check the applicant's motor-vehicle record-a regulatory requirement for commercial drivers. Personal security and safety of personnel is an essential element of this component. This begins with the ability of the individual to recognize threatening situations, but must also be supported by systems and infrastructure that provide the capability for a proper response. For example, identifying critical personnel and establishing procedures to protect them are two security measures that you should consider adopting. How we control access to our site and to important information needs to be addressed in our plan. A vehicle in transit represents not just a moving target, but a critical space under constant exposure to an uncontrolled environment harboring a diversity of threats. A critical space is an area that is essential to our operations, such as a dispatch center, hazmat storage area, or an individual vehicle. When defining primary objectives, it is important to remember that the cargo is the prime source of consequential damage. Security measures that do not link directly to the regulated materials in some way, but just the vehicle, may be of limited value. A security plan is not a "one-size-fits-all" plan. Each plan for a site or terminal will vary based on the facility layout, design, location, highway access, and operations. In the event the company has more than one terminal, each terminal would need to have a site-specific security assessment, considering its unique characteristics. Each terminal would also need a site-specific security plan developed for and maintained at that facility. Policies or procedures may be set at the corporate level in some cases, but when implemented, may need some modification at the terminal level. Some companies, such as chemical manufacturers, group their facilities according to the nature of their operations and the types and quantities of materials that they handle. Security planning may be done at different levels of detail for each type of facility, with the more critical facilities getting a very in-depth treatment. Some companies may wish to implement a corporate-wide security plan for each type of facility since those grouped together are very similar. This may not be appropriate! Facilities of similar size and material handling may not have similar threats and vulnerabilities. One may be in a very rural location and another may be very close to a major urban population, critical bridge, or other potential terrorist target. Local law enforcement in one area may be very proactive and effective in deterring terrorist activity and may be understaffed in another area. Also, it is better to consider the routes that hazmat vehicles take when leaving terminals. The facility may not be in a target-rich environment, but the routes used may be. Site- and operation-specific analysis and treatment are always required; however, the implemented plan may still be the same. References Transportation Security Administration, Docket No. TSA-2003-14610, Amendment No. 1572-1, available at http://www.tsa.gov/interweb/assetlibrary/68_FR_23852.pdf as of 7/3/2003. Department of Homeland Security, available from http://www.dhs.gov/dhspublic/displaytheme=29. Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Title X, Section 1012, enacted by Congress October 25, 2001. Security Plan Guide, developed by Battelle and TotalSecurity.US for Federal Motor Carrier Safety Administration , U.S. Department of Transportation, Washington, DC 20590, available from http://www.fmcsa.dot.gov/safety-security U.S. Department of Justice, Federal Bureau of Investigation, "Terrorism in the United States 1999," 30 Years of Terrorism A Special Retrospective Edition, 1999. Clayton, Bruce D., Life After Terrorism, (Boulder, CO: Paladin Press), 2002. U.S. Department of Homeland Security, Information Bulletin 03-004, March 20, 2003. Read More