Pollution Prevention and Homeland Security Michael J. Ellenbecker Kwangseog Ahn

Homeland Security & Preventing Pollution from Attack on Critical Waterside Infrastructure Presented by Ed Badolato, Executive VP, Homeland Security The Shaw Group New Hampshire Pollution Prevention Conference University of New Hampshire September 21, 2004

Vulnerability: How to Audit Your Facility Presented by Ed Badolato Executive Vice President for Homeland Security The Shaw Group University of New Hampshire September 21, 2004

The New Environmental Paradigm Certain parts of the infrastructure are attractive targets for terrorists Certain parts of the infrastructure are attractive targets for terrorists Mass casualties Mass casualties Property damage Property damage Economic losses Economic losses Environmental impact Environmental impact We must reduce risk from indirect releases into the environment We must reduce risk from indirect releases into the environment

Osama bin Laden’s Targeting Philosophy “Inflict maximum damage to human, economic and physical infrastructures” “Attack symbolic, high prestige, economic, and strategic targets”

Pollution as a Terrorist Weapon--Kuwait, 1991

Staten Island Fuel Storage Fire

Four Bad Things That Can Happen from a Terrorist Attack on Your Facility 1. Loss of containment 2. Theft or misuse with intent to cause harm 3. Worker internal or public harm offsite 4. Degradation of assets, business functions, or company value

CRITICAL INFRASTRUCTURES Chemicals and Hazardous Materials Chemicals and Hazardous Materials Energy Energy Transportation Transportation Water Water Telecommunications Telecommunications Agriculture & Food Agriculture & Food Banking and Finance Banking and Finance Public Health Public Health Emergency Services Emergency Services Defense Industrial Base Defense Industrial Base Postal and Express Shipping Postal and Express Shipping

Vulnerability of Petro-Chem Facilities This book was co-authored by Ed Badolato This book was co-authored by Ed Badolato It covers: It covers: Industrial disasters Industrial disasters Process related incidents Process related incidents The terrorist threat to populated areas The terrorist threat to populated areas Sabotage of chem facilities and RR tank cars Sabotage of chem facilities and RR tank cars The cost factor The cost factor

Terrorism and the Chemical Transportation Industry 1. Plug the security gaps noted in industry “Lessons Learned” & “Best Practices” 2. Work across the full spectrum of Homeland Security incidents— preparation, response, recovery 3. Adopt and adapt technology fixes 4. Organize a layered, integrated security system

What We Can Expect in the Future More mass casualty attacks-- More mass casualty attacks-- “few attacks in the US, but they will be closer to the Madrid rail scenario than the WTC 9/11” Terrorist conventional bombings along with WMD attempts-- Terrorist conventional bombings along with WMD attempts-- “bombs will be the most predominant form of attack” More terrorist cells and operatives will be uncovered in the US More terrorist cells and operatives will be uncovered in the US

Laws & Regulations that Impact Facility Preparedness Clean Air Act Clean Air Act Bioterrorism Preparedness and Response Act of 2002 Bioterrorism Preparedness and Response Act of 2002 Maritime Transportation Security Act of 2002 Maritime Transportation Security Act of 2002 Resource Conservation and Recovery Act of 1976 Resource Conservation and Recovery Act of 1976 Occupational Safety and Health Act Occupational Safety and Health Act Emergency Planning and Community Right-to-Know Act Emergency Planning and Community Right-to-Know Act

Chemical/Environmental Security Players Key Agencies & Organizations Key Agencies & Organizations Department of Homeland Security (DHS) Department of Homeland Security (DHS) Environmental Protection Agency (EPA) Environmental Protection Agency (EPA) Department of Justice Department of Justice Department of Defense Department of Defense State & Local Emergency Response State & Local Emergency Response Industry Associations—ACC, SOCMA, and state industry organizations Industry Associations—ACC, SOCMA, and state industry organizations American Institute of Chemical Engineers American Institute of Chemical Engineers Secondary Agencies & Organizations Secondary Agencies & Organizations DOT DOT OSHA OSHA DOE DOE

DHS and the National HS Strategy The three objectives of the national strategy: 1. Prevent terrorist attacks within the US 2. Reduce Americas vulnerability to terrorists 3. Minimize the damage and recover from attacks that do occur

DHS Infrastructure Protective Measures Plan Technical Applications Technical Applications WMD Prevention WMD Prevention Protection Measures Protection Measures Buffer Zone Protection Plan (BZPP) Buffer Zone Protection Plan (BZPP) 1700 sites this year 1700 sites this year Target selection Target selection Surveillance Ops Surveillance Ops Planning Ops Planning Ops Rehearsals Rehearsals Training Training

Industry Safety Management Capabilities Process Safety Management Systems Process Safety Management Systems Hazard Evaluation Procedures Hazard Evaluation Procedures Chemical Process Quantitative Risk Analysis Chemical Process Quantitative Risk Analysis Release Mitigation Release Mitigation Safe Storage & Handling of High Toxic Hazard Materials Safe Storage & Handling of High Toxic Hazard Materials Layer of Protection Analysis Layer of Protection Analysis

We Must Work Across the Full Spectrum of Homeland Security Situations PreparationThreatVulnerabilityRiskCountermeasuresTrainingAlert/WarningResponsePoliceEMSFire Emergency Coordination EvacuationRecovery Emergency Response Incident Mgt Public Safety Clean up Resumption of Operations

Suggestions for Industry Suggestions for Industry The new industry security strategy should: The new industry security strategy should: Identify and prioritize critical infrastructure facilities. Identify and prioritize critical infrastructure facilities. Specify security roles and responsibilities. Specify security roles and responsibilities. Describe appropriate threat/alert information flows. Describe appropriate threat/alert information flows. Set the standards for actionable security plans Set the standards for actionable security plans

Suggestions for Your Facility Assume you are a target Assume you are a target Extend your perimeter—”mutual support” Extend your perimeter—”mutual support” Barriers Barriers Surveillance Surveillance Planning Planning Inform & engage employees Inform & engage employees

The Security Vulnerability Assessment Process 1. Project Planning Meeting--Setting the right course with the company/client 2. Facility Characterization and Critical Asset Identification--A thorough characterization of site asset characteristics and hazards 3. Identify and Prioritize the Threat--Complete evaluation of threats; internal, external, internally-assisted 4. Vulnerability Analysis--Prioritized evaluation of threats against assets 5. Risk Assessment —defining the potential for damage to or loss of an asset 6. Countermeasures Identification and Effectiveness Measurement-- Prioritized validation and justification of costs for improved security, highlighting process/operations benefits 7. Preparing the Report 8. Implementation

Step 3. Identify and Prioritize the Threat-

Threat Methodology Understand how terrorists target facilities Understand how terrorists target facilities Build a detailed, focused assessment Build a detailed, focused assessment Initial screening of sources of threat info Initial screening of sources of threat info Contact with local, state, & federal law enforcement and intelligence agencies Contact with local, state, & federal law enforcement and intelligence agencies Interviews with facility security managers Interviews with facility security managers

Step 4. Vulnerability Assessment

Vulnerability Assessment “Identification of the extent of susceptibility to exploitation, relative to the existence of any countermeasures.”

Two Approaches to Vulnerability Analysis 1. Asset-based analysis: assess potential targets (any attack scenarios) 2. Scenario-based analysis: assess attack scenarios (any asset)

VA Asset-Based Approach Where used: Where used: − “Basic” sites, i.e. no complex security challenges Key Elements Key Elements − Assess and categorize consequences − Assess target attractiveness − Identify and assess key assets Based on consequence and attractiveness Based on consequence and attractiveness Identify areas needing further protection Identify areas needing further protection

VA Scenario-Based Approach Where Used: Where Used: − Complex security challenges − High inherent threat Key Elements Key Elements − Identify key assets/targets − Identify applicable threats − Identify potential scenarios − Drives countermeasures for selected scenarios

Step 5. Risk Assessment

RISK Risk assessment—”a qualitative and/or quantitative determination of the probability of occurrence of an adverse event and the impact of its consequences.” Risk assessment—”a qualitative and/or quantitative determination of the probability of occurrence of an adverse event and the impact of its consequences.”

Step 6. Countermeasures Identification and Effectiveness Measurement-

Physical Security Systems Perimeter Protection Perimeter Protection Fences Fences Lights Lights Gates & Access Controls Gates & Access Controls Entrance/equipment locks Entrance/equipment locks Protection Force Protection Force Electronic security systems--motion detectors Electronic security systems--motion detectors Video surveillance systems, Video surveillance systems, Building alarm systems Building alarm systems

Other Countermeasures Loss prevention & material control Loss prevention & material control Control room security Control room security Distributed Control Systems Distributed Control Systems Crisis management and emergency response Crisis management and emergency response Policies & procedures Policies & procedures IT/Cyber security IT/Cyber security Intelligence Intelligence

SUMMARY SVAs Perform Important Functions SVAs Perform Important Functions Defines roles & relationships Defines roles & relationships Identifies necessary resources Identifies necessary resources Ensures comprehensive security effort Ensures comprehensive security effort Sets plan for implementation Sets plan for implementation

MODULE 2: Introduction to the Toxics Use Reduction Act Toxics Use Reduction Institute

Process Characterization Process Characterization Pre-Plan Identify TUR Options Identify TUR Options Develop or Update Plan Develop or Update Plan Certify Plan Screen & Evaluate TUR Options Screen & Evaluate TUR Options Implement Plan The TUR Planning Cycle Responsibilities of a TUR Planner Measure Success

Similarities in the Security and TUR Assessment Processes The Security Vulnerability Assessment Process 1. Project Planning Meeting 2. Facility Characterization and Critical Asset Identification 3. Identify and Prioritize the Threat 4. Vulnerability Analysis 5. Risk Assessment 6. Countermeasures Identification and Effectiveness Measurement 7. Preparing the Report 8. Implementation Process Characterization Process Characterization Pre-Plan Identify TUR Options Identify TUR Options Develop or Update Plan Develop or Update Plan Certify Plan Screen & Evaluate TUR Options Screen & Evaluate TUR Options Implement Plan The TUR Planning Cycle Measure Success

Importance of TUR in HS CRITICAL INFRASTRUCTURES Chemicals and Hazardous Materials Energy Transportation…

Pollution Prevention and Homeland Security Can use similar assessment methods PP personnel may be qualified to perform HS assessment, particularly in industry using hazardous chemicals PP itself reduces risks in HS – Lower toxicity – Lower volatility/explosion potential – Lower volumes store on site

Opportunities for TURI Appears there is lack of interaction between TUR/PP and HS TURI already has the expertise and resources for TUR/PP that can be applied directly to HS

What TURI Can Do? Advocate TUR to reduce HS risks Extend TURP program to TUR-HSP program Identify and prioritize the HS risks from hazardous chemicals – Use TURA data and TRI data including use amounts, locations of plants, etc. – Use chemical info including explosiveness, flammability, toxicity, etc. – Use other information about presence of symbolic, high prestige, economic, and strategic targets – Combine all the information to prioritize the HS risks Use the planning process to reduce HS risks

Funding Sources? DHS EPA OSHA NSF MA?