Updated: Makeshift Chemical Attack in Iraq

In Iraq today, a chlorine tanker truck exploded in a makeshift chemical attack. Reuters reported:

A bomb destroyed a truck carrying chlorine north of Baghdad on Tuesday, killing at least five people and spewing out toxic fumes that left nearly 140 others sick, Iraqi police said.

It was not immediately clear if the chlorine truck blast was caused by a roadside bomb that hit the truck or if the vehicle itself was rigged with explosives as a makeshift chemical gas bomb.

One source at police headquarters said the truck was rigged with explosives ... A second police source also said the bomb was on the truck.

The bomb exploded near a restaurant at a rest stop on the main highway in Taji, 20 km (12 miles) north of Baghdad.

Insurgents and jihadists in Iraq have blown up gas trucks and gas stations before, but this is the first I've heard of anybody in Iraq using an IED to release deadly chemicals. If the bombs were in fact on the truck, then there's no question that their intent was to release the chlorine. Iraq is a real-world testing ground for terrorism, so it's worth noting whether this becomes a trend. It's not a good thing for terrorists to develop this capability.

Chlorine is nasty stuff, but it's used in water treatment, so it's loaded into railcars and tanker trucks that crisscross the U.S. every day. It's a vulnerability for sure. An oft-quoted study by the Naval Research Laboratory said that a worst-case chlorine leak from a railcar could kill up to 100,000 people in Washington D.C. (It's worth noting that TSA has proposed new rules for securing railcars, however.)

Update 2007-02-21: One day later, they did it again, with some success. Not good news:

Insurgents exploded a truck carrying chlorine gas canisters Wednesday — the second such "dirty" chemical attack in two days ... a pickup truck carrying chlorine gas cylinders was blown apart, killing at least five people and sending more than 55 to hospitals gasping for breath and rubbing stinging eyes, police said.

Some authorities believe militants could be trying to maximize the panic from their attacks by adding chlorine or other noxious substances.

"It is an indication of maliciousness, a desire to injure and kill innocent people in the vicinity," said [Lt. Col. Christopher] Garver, who also predicted militants may begin to launch similar attacks because of the widespread mayhem caused by this week's chlorine clouds.

Update 2007-03-02: Terrorism Focus looks closely at the trend of insurgent chemical attacks, suggesting that it's unclear if this trend is likely to continue, and that measures may be taken in Iraq to secure large supplies of chlorine:

Fortunately, the potential supply of chlorine suitable for such attacks will not allow groups to employ the agent in significant quantities indefinitely. Although there are numerous potential sources of chlorine in Iraq, future large-scale attacks can be kept at a minimum if bulk access points are kept under proper controls and distributions monitored.

The same precautions need to be ensured here, at all times, by local authorities. The threat of accidental or intentional chemical release is an issue for every community. A chlorine leak is a real possibility for any community that has a water treatment plant, and/or a highway or railroad running through it.

Managing Risk on the Rails

It seems that there has been a lot of press lately about rail security. Adding to the pile, the GAO recently released a review of DHS' work so far on the rail sector. It was an update of GAO's September 2005 report on the same subject.

Typical for a GAO report, there's some good news, there's some bad news. The salient point, which is hammered home again and again, is that DHS and the Transportation Security Administration (TSA) need to complete their risk assessment of the rail sector. TSA has worked on a lot of interventions, such as their new proposed rules for the passenger and freight sectors. But without finishing the risk assessment and developing a comprehensive strategy based on risk, who's to say if the rail sector will be as secure as it can be?

Here are a few highlights from the GAO report:

In our September 2005 report on passenger rail security, we recommended, among other things, that TSA establish a plan with timelines for completing its methodology for conducting risk assessments and develop security standards that reflect industry best practices and can be measured and enforced. These actions should help ensure that the federal government has the information it needs to prioritize passenger rail assets based on risk, and evaluate, select, and implement measures to help the passenger rail operators protect their systems against terrorism. … However, as of February 2007, DHS has not provided a formal response indicating if or how it has implemented these recommendations.

In fact, the National Infrastructure Protection Plan (NIPP), released in 2006, specifically requires agencies to develop priorities based on risk assessments:

In fulfilling its responsibilities under the NIPP, TSA must conduct and facilitate risk assessments in order to identify, prioritize, and coordinate the protection of critical transportation systems infrastructure, as well as develop risk based priorities for the transportation sector.

To be fair, TSA has been working on it:

DHS has made progress in assessing the risks facing the U.S. passenger rail system, but has not issued a plan based on those risk assessments for securing the entire transportation sector and supporting plans for each mode of transportation, including passenger rail.

As of February 2007, the [DHS] Office for Grants and Training (OGT) had completed or planned to conduct risk assessments of most passenger rail operators.

But the key is to have a comprehensive, strategic approach to intervention that's based on risk-management. Until you have the whole picture of risk, your interventions (though they may have individual tactical effectiveness) will not form an integrated system and will not reach their optimal level of effectiveness. For example:

In May 2004, TSA issued security directives to the passenger rail industry to establish standard security measures for all passenger rail operators, including Amtrak. However, as we previously reported, it was unclear how TSA developed the requirements in the directives, how TSA planned to monitor and ensure compliance, how rail operators were to implement the measures, and which entities were responsible for their implementation.

The GAO concludes:

Since our September 2005 report, DHS components have taken steps to assess the risks to the passenger rail system, such as working with rail operators to update prior risk assessments and facilitating rail operator security self assessments. According to TSA, the agency plans to use these assessment results to set priorities for securing rail assets deemed most at risk, such as underground and underwater rail infrastructure and high density passenger rail stations. A comprehensive assessment of the risks facing the transportation sector and each mode, including passenger rail, will be a key component of the TSSP and supporting plans for each mode of transportation. Until TSA issues these plans, however, the agency lacks a clearly communicated strategy with goals and objectives for securing the overall transportation sector and each mode of transportation, including passenger rail.

Bird Flu - Limited Human Immunity?

Interesting if true: ABC News reports on a study by flu researchers that indicates that humans may have some limited natural immunity to the H5N1 bird flu virus:

In the H5N1 bird flu, it's the H5 part that is most foreign to humans. The N1 part is more common in typical human flu viruses.

[Dr. Richard Webby of St. Jude's Children's Research Hospital] and his colleagues investigated this theory in a new study published this week in PLOS Medicine.

In mice, exposure to an N1-containing virus reduced the death rate from H5N1 bird flu by half.

Preliminary blood work on humans also suggests that yearly flu shots with N1 may offer some weak protection against H5N1 bird flu.

The exact amount of protection a person would have is unknown. "It's not going to prevent infection," Webby said. "But it might reduce the more severe parts of the disease."

Even if these findings are verified by further studies, this is not a magic bullet. Still, generally speaking, multiple layers of various interventions - i.e., concentric circles of protection - tend to provide a more workable, cost-effective solution than a single magic bullet, for all types of threats.

Let's hope that the good-old annual flu shot turns out to be an effective initial layer of intervention - even if it's only very limited. It's hard to imagine a simpler or more easily understood intervention than the annual flu shot.

And one more question, just thinking aloud: I wonder if anyone could do - or is doing - an epidemiological study of flu vaccination in the populations of humans (mostly in Asia) who have already been affected by bird flu. Are seasonal flu vaccinations administered in Indonesia, Thailand, Vietnam, etc.? If so, have they had any effect on the mortality rate among the affected populations so far?

FDNY's New Strategic Plan

The Fire Department of New York has released its new Strategic Plan for 2007-2008, which extends on its earlier edition of 2004-2005.

The new plan identifies five key goal areas:

1. Improve Emergency Response Operations
2. Enhance the Health and Safety of FDNY Members
3. Strengthen Management and Organizational Development
4. Increase Diversity
5. Improve Fire Prevention and Safety Education

There's a lot to like about the plan, but I'll focus only on some elements of it; specifically, the planning for major incidents and terrorism (especially the preventive efforts).

As indicated by the plan's Goal #1 - "Improve Emergency Response Operations" - the department's plans are mostly focused on response rather than prevention. Many activities have been - and will continue to be - focused on improving the response to a potential future event, rather than preventing it:

To increase overall response capacity, [as a result of the 2004-2005 Strategic Plan] the Department successfully negotiated and finalized mutual-aid agreements with New York State and Nassau County to provide fire service mutual aid. FDNY also finalized agreements with New York City Regional Emergency Medical Services Council (REMSCO) for mutual aid within the City and a State-wide EMS Mobilization Plan with the State Department of Health, as well as with New Jersey. Lastly, the Department finalized all-hazards emergency response plans that address biological, chemical, radiological, nuclear and improvised explosive response, developed a risk assessment internal web site of designated priority locations and established an FDNY Center for Terrorism and Disaster Preparedness.

It's good to see so many collaborative partnerships being developed, especially with other fire departments and EMS. But when I was reading the doc, I kept looking for collaboration with other first responders, such as the police. It's well-known that better communications between NYPD and FDNY on 9/11 probably would have saved lives. There are some indications of interagency information sharing, mostly focused on interoperable communications:

To facilitate the management and exchange of information, the Department continues to develop a Network Centric Command system. Network Centric Command, the integration of voice, data and video information through state-of-the-art technology, will assist the Incident Commander in decision-making during an incident. ... During an incident, Network Centric Command supports information-sharing among City, State and Federal agencies to provide a common operational picture. This integration will result in enhanced collaboration and synchronization of information to maximize an effective command.

Among the FDNY’s highest priority technology initiatives is the successful transformation of the Fire Department Operations Center (FDOC) that possesses new state-of-the-art capabilities to function as an off-site command post. Among the FDOC’s capabilities is video teleconferencing and on-scene video footage from media and police helicopters. The FDOC also has additional mapping capabilities and the ability to generate site-specific historical and hazard data from Department databases.

Interoperable communications are critical, of course - and first responders everywhere need them yesterday. But still, in the FDNY Strategic Plan, sharing information with other first responders seems to be primarily something that happens only in response to an event. Yet preventive efforts require critical information-sharing before an event. Is that part of the FDNY's plans? It's hard to say.

The FDNY does seem to have some forward-thinking, strategic plans for prevention. For instance, The Center for Terrorism and Disaster Preparedness, established at Fort Totten in Queens, is an interesting project. The department has sponsored strategic anti-terrorism training for leaders at the site, which involves role-playing the part of a terrorist. What's less clear to me is, what's the follow-up to this training? How do the lessons of the training event become operationalized within the department? What preventive efforts are the FDNY leaders, at all levels, engaging in on a regular basis?

It's not clear in the Strategic Plan. For instance, where prevention does take focus, in Goal #5 - "Improve Fire Prevention and Safety Education" - the FDNY's strategy mostly involves "typical" fire-prevention efforts such as community education, public presentations of fire prevention and safety information, producing fire safety documents in multiple languages, etc. When terrorism prevention is specifically mentioned, it's only an abstract future public-education project, focused on "awareness":

Explore the feasibility of developing an educational component with a focus on training the public on the topic of terrorism awareness.

Overall, it seems that prevention in the FDNY Strategic Plan has less focus than preparedness and response activities.

BioWatch - Oversight Problems Solved?

The DHS Inspector General recently released a report on the BioWatch program, the heart of which is a system of air-quality detectors, mostly in cities, that watch out for biological agents.

For biological agents, detection is extremely important. Unlike chemical agents, which tend to have quick impacts on health, biological agents tend to have delayed effects on health. Unless detection of biological agents is quick and reliable, the first indication of a biological incident may be a large number of people falling ill, with symptoms that may not be quickly diagnosed. The result may be an unnecessarily large number of casualties.

In 2004 and 2005, audits of the BioWatch program found that DHS was not adequately overseeing the program. There were inconsistencies in reporting, in performance of the testing systems, and in review of financial expenditures.

DHS says it has dealt with all these shortcomings, and the Inspector General seems happy with the changes:

The [DHS] Under Secretary [for Science and Technology] has taken action to resolve the issues. Based on management's description of actions taken, we consider the recommendations resolved and closed.

Yet I thought this was an interesting excerpt:

BioWatch program management said that DHS has recently begun issuing grants directly to state and local air monitoring agencies. To date, BioWatch program management reported that it has awarded grants to approximately 33 percent of the state and local agencies . . .

It's not clear to me what process DHS is using to evaluate the spending of this grant money, or how the state and local funds are fitting into the system. Unfortunately, the report doesn't go into details, though I'm curious.

Bio-Bugz

From the "Hey, Whatever Works" department comes this story, courtesy of NTI:

A Virginia Commonwealth University scientist has received $1 million from the U.S. Defense Department to study whether cockroaches and houseflies could be used as living sensors for biological weapons agents, Popular Science reported in its March edition.

"Cockroaches can detect all kinds of things, from anthrax spores to DNA," said entomologist Karen Kester.

Bugs could have greater range and sensitivity than mechanical detectors placed in subway stations and buildings.

Our society has an almost instinctive preference for technological solutions. But there are many dimensions to the threat, and many possible means of intervening against it.

CRS Report on Maritime Security

In January, the Congressional Research Service released a report on the threat of maritime terrorism.

While noting that "fewer than 1% of all global terrorist attacks since 1997 have involved maritime targets," the report discusses a few of the particular threats. It's an exercise in threat recognition.

The CRS notes that there are particular challenges to launching a maritime attack:

One U.S. naval analyst has identified a number of specific challenges for terrorists in the maritime environment:

• Maritime targets are relatively more scarce than land targets;
• Surveillance at sea offers less cover and concealment than surveillance on land;
• Tides, currents, wind, sea state, visibility, and proximity to land must all be factored into a maritime terror operation;
• Maritime terror operations may require skills that are not quickly or easily acquired such as special training in navigation, coastal piloting, and ship handling;
• Testing weapons and practicing attack techniques, hallmarks of Al Qaeda’s typically meticulous preparation, are harder and more difficult to conceal at sea than on land;
• The generally singular nature of maritime targets, the low probability of damage and casualties secondary to the intended target, and the problems associated with filming attacks at sea for terrorist publicity may also reduce the desirability of maritime targets.

Despite these difficulties, al Qaeda and other terrorists have chosen maritime targets in the past, including the USS Cole bombing in 2000, the attack on the French oil tanker Limburg in 2002, and the 2004 attack on the Philippine Superferry 14.

A maritime attack does not need to cause many human casualties to have an effect:

If economic loss is the primary objective, terrorists may seek to carry out different types of attacks, with potentially few human casualties but significant impacts to critical infrastructure or commerce. The Limburg bombing may have been an attack of this type, threatening to disrupt the global oil trade and causing considerable consternation among tanker operators. Although the bombing killed only one member of the Limburg’s crew, it caused insurance rates among Yemeni shippers to rise 300% and reduced Yemeni port shipping volumes by 50% in the month after the attack.

The report comments on the relative risks of different types of maritime attacks, starting with the nuclear "bomb in a box" (i.e., shipping container) scenario:

Expert estimates of the probability of terrorists obtaining a nuclear device have ranged from 50% to less than 1%. Among other challenges to obtaining such a device, experts believe it unlikely that countries with nuclear weapons or materials would knowingly supply them to a terrorist group. It also may be technically difficult to successfully detonate such a nuclear device. North Korea experienced technical failures in conducting its 2006 nuclear weapons test, and this test took place under highly controlled conditions. Attempting to detonate a nuclear device in a maritime terror attack could pose even greater operational challenges.

The risk of a "dirty bomb" attack may be higher, especially if the primary objective is economic damage, though there are skeptics:

Terrorist attacks on U.S. ports with radiological dispersion devices (“dirty” bombs) is also considered among the gravest maritime terrorism scenarios. A 2003 simulation of a series of such attacks concluded that they “could cripple global trade and have a devastating impact on the nation’s economy.” Many terrorism analysts view such a dirty bomb attack as relatively likely.

Scientists have long questioned whether terrorists could actually build a dirty bomb with catastrophic potential since handling the necessary radioactive materials could cause severe burns and would likely expose the builders to lethal doses of radiation. Building and transporting such a bomb safely and to avoid detection would likely require so much shielding that it would be “nearly impossible” to move. Weaker dirty bombs made from less radioactive (and more common) materials would be easier to build and deploy, but would have a much smaller physical impact and would likely cause few human casualties.

Attacking a tanker or port facility that handles liquified natural gas (LNG) could create a major explosion, though it's not easy:

To date, no LNG tanker or land-based LNG facility in the world has been attacked by terrorists. However, similar natural gas and oil assets have been favored terror targets internationally. The attack on the Limburg, although an oil tanker, is often cited as an indication of LNG tanker vulnerability.

Former Director of Central Intelligence, James Woolsey, has stated his belief that a terrorist attack on an LNG tanker in U.S. waters would be unlikely because its potential impacts would not be great enough compared to other potential targets. LNG terminal operators which have conducted proprietary assessments of potential terrorist attacks against LNG tankers, have expressed similar views.

If terrorists are looking for human casualties, a ferry is a possible target:

A RAND study in 2006 argued that attacks on passenger ferries in the United States might be highly attractive to terrorists because such attacks are easy to execute, may kill many people, would likely draw significant media attention and could demonstrate a terrorist group’s salience and vibrancy. One U.S. Coast Guard risk analyst reportedly has stated that “in terms of the probability of something happening, the likelihood of it succeeding and the consequences of it occurring, ferries come out at the very high end.” Such attacks have occurred overseas. As noted earlier in this report, terrorists linked to Al Qaeda attacked and sank the Philippine vessel Superferry 14 in 2004.

After examining the details, the report comes to this rather bland conclusion:

It appears, therefore, that while maritime terrorist attacks against the United States may be more difficult to execute and, consequently, less likely to occur than other types of attacks, they remain a significant possibility and warrant continued policy attention.

Boston's Aqua Teen Misadventure

Wednesday's news out of Boston, where the city came to a virtual standstill after city officials were notified of some suspicious objects - which later turned out to be "guerilla marketing" signs promoting a cartoon called Aqua Teen Hunger Force - is intriguing for a number of reasons.

First, a few basics of the case. Cartoon Network hired a marketing firm to come up with a "guerilla marketing" promotion for the trendy cartoon. The marketing firm created some light-up signs depicting characters from the cartoon (which looked a lot like Lite-Brite displays), then hired some people in various cities to plant them where they would be seen, such as "train stations, overpasses, 'hip and trendy areas, high traffic areas of high visibility'" (which only makes sense if you're trying to draw attention to your cartoon). The AP reported:

The first device was found at a subway and bus station underneath Interstate 93, forcing the shutdown of the station and the highway.

Later, police said four calls, all around 1 p.m., reported devices at the Boston University Bridge and the Longfellow Bridge, both of which span the Charles River, at a Boston street corner and at the Tufts-New England Medical Center.

The package near the Boston University bridge was found attached to a structure beneath the span, authorities said.

Subway service across the Longfellow Bridge between Boston and Cambridge was briefly suspended, and Storrow Drive was closed as well. A similar device was found Wednesday evening just north of Fenway Park, police spokesman Eddy Chrispin said.

So ... people notice the signs, think they look suspicious, call the police - and all hell breaks loose for the rest of the day.

Meanwhile, the marketing agency - in a truly dumb and irresponsible move - told its people in Boston to remain quiet, even as the city was locking down.

According to an e-mail one friend provided to the Globe, the executive at Interference Inc. told the artist, whom the agency had hired to install the small, battery-powered light screens in Boston, to remain silent, even as dozens of police officers collected the devices and shut down highways, subway lines, and part of the Charles River.

The executive asked Peter Berdovsky to "pretty please keep everything on the dl," slang for down low, or hush-hush, according to the message Berdovsky sent to his friends.

The city virtually shuts down, countless people are inconvenienced, the police and everyone else goes on high alert - and later in the day, the marketing company finally comes clean that it's just a promotion. There's no danger.

But, what's more, the company paid other people in other cities to plant the signs there. And in some cities, the signs had been there for 2-3 weeks - with not a single complaint. No one in New York reported any problems with the 41 signs there:

Not one New York City resident made a 911 emergency call in response to the promotion here Wednesday -- and, unlike Beantown, Manhattan has really been the target of terrorist attacks.

Portland responded "with a yawn," though maybe that had to do with the placement of the signs:

Portlanders have reported finding at least three of the devices that caused a minor panic in Boston, but reacted with a yawn, if that.

They were found in some of the trendier neighborhoods and were not near bridges or other infrastructure.

It's sensible that, if the people in Portland didn't place the signs near any key infrastructure elements, there would be less perception of a threat (unlike Boston). But ... if the placement of the signs were the determining factor, wouldn't you expect that Seattle would have had the same problem as Boston? At least one sign was posted on a bridge there:

Some of the same blinking electronic devices that threw a scare into the city of Boston today (Wednesday) have been found and removed from Seattle and several suburbs.

Police say the removal was low-key in Seattle.

One was found yesterday (Tuesday) by a Woodinville Public Works Department crew working on a rail trestle over State Highway 202.

Hmm ... and there was nothing to report in Atlanta:

Joe Cobb, Atlanta Police Department public information officer, said his department was unaware of the devices and had received no complaints.

In San Francisco it was also a non-event:

San Francisco police say 20 blinking signs advertising a cartoon show were scattered in various city neighborhoods without causing a stir.

Apparently no one had yet gotten around to placing any of the signs in Los Angeles:

None of the devices, which were planned to be placed around the Westside of Los Angeles, including Hollywood, West Hollywood and Santa Monica, had been reported found.

And although all of these cities seemed to shrug it off, the signs raised the ire of public officials in two cities: Philadelphia ...

When city officials learned little devices equipped with circuit boards and batteries were spread across Philadelphia, managing director Pedro Ramos and officials with the Mayor's office began combing the streets.

Ramos said the signs are illegal and those responsible will be punished.

... and Chicago:

They were recovered from elevated stations and storefronts…

And the city may seek monetary reimbursement from the marketing company responsible for planting them, said Supt. Philip Cline.

So ... the signs were considered a huge problem in Boston, a nuisance in Philadelphia and Chicago, and no big deal anywhere else. Philadelphia and Chicago want to be reimbursed for the trouble of finding and removing the signs.

And the prosecutor in Boston has prosecution on his mind - presumably, on charges of launching a full-blown terrorist hoax:

Assistant Attorney General John Grossman said bomb squad members who examined the lighted signs immediately detected three components that suggested the contraptions could be bombs. He said the black signs, about the size of a laptop computer, had what appeared to be a duct-tape wrapped package with a wire running into it and a power source, which would be needed to detonate a bomb.

"The devices looked like bombs" and had an "ominous nature," Grossman said.

While recognizing the fact that public authorities have to respond to any possible threat that's called in, a few questions come to mind:

1. Even without hearing from the marketing company, why didn't officials in Boston more quickly recognize that these things weren't bombs? It took hours for bomb-squad experts to see these things for what they were? Yes, there were batteries and wires, but these devices really weren't planted like an IED typically would be. Generally speaking, when you're planting an IED, you want it to blend in with its surroundings. You hide it in a backpack, or in a garbage can, or under a pile of garbage. You don't put blinking lights on it and place it in plain sight.
2. What effect will this have on "See Something, Say Something" efforts? Will people in Boston be as likely to report suspicious items if the result is a shutdown of the city, over something that turned out to be nothing at all?
3. If the guys in Boston (and here I'm talking about the guys who placed the signs, not the marketing agency who directed them) committed a crime, then what about the people who were hired to plant the signs in other cities? Did they commit the same crime? Or is the crime determined primarily by the degree to which public officials react to it? Did the guys in Boston commit a really serious crime, the guys in Chicago and Philadelphia commit a less serious crime, and the guys in Portland, New York, San Francisco, Seattle, etc., no crime at all?
4. Are we going to say that putting up signs like this is equivalent to, for instance, filling envelopes with white powder? Is it equivalent to calling in a bomb threat? Where do we draw the line?
5. How do authorities maintain vigilance without giving the appearance of crying wolf, when something like this happens? Every time that something like this happens, and there turns out to be no threat, people are going to be less and less inclined to respond to future warnings. It really is the "cry wolf" syndrome.
   

It's an interesting case, and one that indicates that there's a lot of Homeland Insecurity out there.

National First Responder Appreciation Day

The First Response Coalition is sponsoring an effort to establish a National First Responder Apprecition Day. They point out that catfish and ice cream have national days of appreciation; but firefighters, police officers, and emergency medical personnel don't.

There's a video in support of the effort, as well as a petition that you can sign.