Radiation Detection Update

An update on earlier posts regarding radiation detection:

HLS Watch points out that the Domestic Nuclear Detection Office (DNDO) is starting a project to evaluate radiation detection systems at ports - specifically, at the transfer point from ship to rail:

The U.S. Department of Homeland Security (DHS) will soon begin conducting multiple projects in the Port of Tacoma, Wash., to evaluate technology and concepts of operations for radiation detection that will scan cargo at various points in transfer from ship to rail. By establishing a Rail Test Center (RTC) at the port, DHS will identify and evaluate radiological and nuclear detection solutions for intermodal rail port facilities that can be used across the country.

As I've argued before, a detection system is necessary but not sufficient to address the threat. A system of detectors, no matter how robust, is essentially a series of nets intended to snare an adversary.

Nets can be avoided, however. A comprehensive preventive scheme should exploit all aspects of the threat: the adversary, his motivations, his capabilities, his financial and human resources, his access to weapons, and his access to the target.

Cross-posted in IPS Blogs at the Institute for Preventive Strategies.

What Chertoff Said

DHS Secretary Michael Chertoff said a few things worth noting in a recent speech to the Sacramento Chamber of Commerce. Mostly it's stuff he has said before, but it's good every once in a while to take note of what the guy in charge is saying. So...

On public/private collaboration:

[Emergency preparedness] has to be a public/private partnership because most of the assets and employees which are threatened in any situation, whether it's a potential terrorism attack or a natural disaster, most of those assets and employees are in private hands. ... And therefore, this is really an area where partnership is very important.

On risk management:

[I]n this world, you cannot eliminate risk. ... What we have to do is manage risk.

What do we mean by risk? Well, we look at three things. We look at threats, we look at vulnerabilities, and we look at consequences. We try to weigh where the threats are, where we are most vulnerable, and, perhaps most important, what would the consequences be if a particular threat came to pass.

On viewing security as an investment, rather than a cost:

[T]here is a very important business case to be made with respect to investments in homeland and national security. After all, a good part of what you need to do when you invest your resources in producing economic activity is to protect your investment. You've got to protect your assets, you've got to protect your employees, you've got to protect your business processes and your good will.

And therefore, investment in protection of infrastructure or people against all kinds of threats is very much at the core of your business mission, and that's why I think there is a real confluence of objectives here between government and its responsibility to protect the country, and you as business leaders in your obligation to protect your own investments.

On rail security:

[W]e have focused on the most significant risks to our rail transportation system. One of those is the risk of transportation of hazardous chemicals ...

At the end of last year, we issued a proposed regulation that will require major railroads to improve the monitoring of rail cars that carry toxic inhalation chemicals. Rail companies have to make sure these cars are not left unattended in rail yards, especially where they are near major cities or population centers. They have to be able to track the whereabouts of these cars at all times, and then they have to put these rail cars on the safest, economically practicable routes.

This regulation also illustrates another key element of the way we approach these problems, because it was developed working in partnership with the rail industry and the chemical industry at every step of the process, so that we did have a fair, intelligent and not hysterical risk-based strategy. We didn't simply propose these regulations unilaterally.

This is a pretty sunny summary. Actually, the rules on chemical plant security are quite contentious. (See these posts). And DHS still needs to complete a comprehensive risk assessment of the rail sector. (See these posts.)

The new rules are great for tracking the location of hazardous chemicals on the rails, but railroad companies have only five minutes to share this information with DHS. When local authorities get the information is a different question - and perhaps a more important question, given that local first responders are the ones who have to deal with any incident. And a lot of local communities need better information and preparation regarding their local rail risks. (See this post.)

On emergency preparedness:

[U]nder our National Infrastructure Protection Plan, which is how we work with the private sector to decrease the vulnerabilities in private sector infrastructure, we're developing specific plans to heighten protection for infrastructure in areas like agriculture, drinking water facilities, and dams.

Well, yes. But based on these comments, you'd think the process was smooth and remarkable only for its exemplary collaboration between the public and private sectors. But it hasn't really been that smooth, in part because DHS needs to do a better job of collaborating with the sectors. (See these posts for full details, but here's a notable quotable: "...a lack of trust in DHS and fear that sensitive information would be released are recurring barriers to the private sector’s sharing information with the federal government.") So the plans are getting put into place, but DHS does need to do a better job of listening to its public sector partners.

[P]reparation in advance for the unthinkable, gives you a leg-up in being able to respond when the unthinkable actually comes to pass.

No argument there. Nicely said.

Philosophically, I think Chertoff's emphasis on managing risks, working with private sector partners, and imagining the unimaginable is on target. The sticky parts come when you try to implement policies. Resistance and lack of trust can gum up the best laid plans. That, I think, is DHS' biggest challenge.

Chlorine, Iraq, and Chemical Security

Another chlorine attack in Iraq. It's number 9.

The bombing in Anbar province marked the ninth use of suicide chlorine bombs in the sprawling, mainly desert territory that has been a stronghold of the Sunni insurgency. Recently, however, many Anbar tribes have switched allegiance, with large numbers of military-age men joining the police force and Iraqi army in a bid to expel al-Qaida in Iraq fighters.

(Off-topic, that's good news about the Anbar tribes switching sides. It reminds me of the widely distributed PowerPoint presentation created by an Army Captain who served in Anbar before he was killed by an IED in December 2006.)

Back on topic now: Al-Qaeda is showing that they are interested in refining their ability to use chlorine in attacks. Anyone responsible for local homeland security ought to make sure they know as much as possible about the location and security of stocks of chlorine in their area, if they don't already. This includes chlorine that passes through in trucks and railcars, to the extent possible. Even though all the detailed information on rail shipments isn't available to local authorities, some is - but you have to ask for it:

Tom White, spokesman for the Association of American Railroads, an industry lobbying group, said that in 2005, railroad companies agreed to provide local officials with a listing of the top 25 chemicals by volume coming through their communities -- if they ask for it.

Rail security is an evolving situation which involves pending litigation and political maneuvering. Hopefully in the end, more information will be forthcoming:

The U.S. Conference of Mayors has asked the federal Department of Homeland Security to require railroads to tell cities when highly toxic shipments are coming their way, or to at least require better communication about the types of chemicals being shipped through communities.

For chemical plants, the situation is less clear, as documented in these recent posts. New DHS effectively block state and local authorities from having a say in the security of chemical plants. But regardless of how the political situation shakes out, it's helpful to develop trusting relationships between chemical plant security personnel and local authorities. An accident, attack, or natural disaster is no time for introductions.

Risk on the Rails: An Update

This is an update to this post from a couple of weeks ago:

The Government Accountability Office (GAO) released a new statement on rail security. They continue to prod DHS and the Transportation Security Administration (TSA) to complete the required risk assessment and strategic plans for rail security:

[A]s of March 2, 2007, TSA has not issued the required Transportation Sector Specific Plan and supporting plans for passenger rail and other surface transportation modes, based on risk assessments. Until TSA does so, it lacks a clearly communicated strategy with goals and objectives for securing the transportation sector, including passenger rail.

GAO reiterates its support of a risk-management approach to rail security. While acknowledging the complexity and difficulty of managing risk on the rails, due to the inherently open nature of the rail system itself, the number of stakeholders involved, etc., the GAO continues to point out that, despite making progress, DHS and TSA have not completed the required system-wide risk assessment and resulting strategy:

DHS has made progress in assessing the risks facing the U.S. passenger rail system, but has not issued a plan based on those risk assessments for securing the entire transportation sector and supporting plans for each mode of surface transportation, as required by and in accordance with the National Infrastructure Protection Plan.

TSA expects the 50 largest rail transit agencies to complete security self-assessments in early 2007. According to TSA, the agency is using the results of these assessments to set priorities, and has identified underground and underwater rail infrastructure and high-density passenger rail stations as assets at highest risk.

In short, there's progress but more is needed. TSA continues to assess risk on an ongoing basis (e.g., identifying underground and underwater rail and high-density passenger rail as high-risk assets) without an overall picture of the risk environment on the rails.

Managing Risk on the Rails

It seems that there has been a lot of press lately about rail security. Adding to the pile, the GAO recently released a review of DHS' work so far on the rail sector. It was an update of GAO's September 2005 report on the same subject.

Typical for a GAO report, there's some good news, there's some bad news. The salient point, which is hammered home again and again, is that DHS and the Transportation Security Administration (TSA) need to complete their risk assessment of the rail sector. TSA has worked on a lot of interventions, such as their new proposed rules for the passenger and freight sectors. But without finishing the risk assessment and developing a comprehensive strategy based on risk, who's to say if the rail sector will be as secure as it can be?

Here are a few highlights from the GAO report:

In our September 2005 report on passenger rail security, we recommended, among other things, that TSA establish a plan with timelines for completing its methodology for conducting risk assessments and develop security standards that reflect industry best practices and can be measured and enforced. These actions should help ensure that the federal government has the information it needs to prioritize passenger rail assets based on risk, and evaluate, select, and implement measures to help the passenger rail operators protect their systems against terrorism. … However, as of February 2007, DHS has not provided a formal response indicating if or how it has implemented these recommendations.

In fact, the National Infrastructure Protection Plan (NIPP), released in 2006, specifically requires agencies to develop priorities based on risk assessments:

In fulfilling its responsibilities under the NIPP, TSA must conduct and facilitate risk assessments in order to identify, prioritize, and coordinate the protection of critical transportation systems infrastructure, as well as develop risk based priorities for the transportation sector.

To be fair, TSA has been working on it:

DHS has made progress in assessing the risks facing the U.S. passenger rail system, but has not issued a plan based on those risk assessments for securing the entire transportation sector and supporting plans for each mode of transportation, including passenger rail.

As of February 2007, the [DHS] Office for Grants and Training (OGT) had completed or planned to conduct risk assessments of most passenger rail operators.

But the key is to have a comprehensive, strategic approach to intervention that's based on risk-management. Until you have the whole picture of risk, your interventions (though they may have individual tactical effectiveness) will not form an integrated system and will not reach their optimal level of effectiveness. For example:

In May 2004, TSA issued security directives to the passenger rail industry to establish standard security measures for all passenger rail operators, including Amtrak. However, as we previously reported, it was unclear how TSA developed the requirements in the directives, how TSA planned to monitor and ensure compliance, how rail operators were to implement the measures, and which entities were responsible for their implementation.

The GAO concludes:

Since our September 2005 report, DHS components have taken steps to assess the risks to the passenger rail system, such as working with rail operators to update prior risk assessments and facilitating rail operator security self assessments. According to TSA, the agency plans to use these assessment results to set priorities for securing rail assets deemed most at risk, such as underground and underwater rail infrastructure and high density passenger rail stations. A comprehensive assessment of the risks facing the transportation sector and each mode, including passenger rail, will be a key component of the TSSP and supporting plans for each mode of transportation. Until TSA issues these plans, however, the agency lacks a clearly communicated strategy with goals and objectives for securing the overall transportation sector and each mode of transportation, including passenger rail.

Boston's Aqua Teen Misadventure

Wednesday's news out of Boston, where the city came to a virtual standstill after city officials were notified of some suspicious objects - which later turned out to be "guerilla marketing" signs promoting a cartoon called Aqua Teen Hunger Force - is intriguing for a number of reasons.

First, a few basics of the case. Cartoon Network hired a marketing firm to come up with a "guerilla marketing" promotion for the trendy cartoon. The marketing firm created some light-up signs depicting characters from the cartoon (which looked a lot like Lite-Brite displays), then hired some people in various cities to plant them where they would be seen, such as "train stations, overpasses, 'hip and trendy areas, high traffic areas of high visibility'" (which only makes sense if you're trying to draw attention to your cartoon). The AP reported:

The first device was found at a subway and bus station underneath Interstate 93, forcing the shutdown of the station and the highway.

Later, police said four calls, all around 1 p.m., reported devices at the Boston University Bridge and the Longfellow Bridge, both of which span the Charles River, at a Boston street corner and at the Tufts-New England Medical Center.

The package near the Boston University bridge was found attached to a structure beneath the span, authorities said.

Subway service across the Longfellow Bridge between Boston and Cambridge was briefly suspended, and Storrow Drive was closed as well. A similar device was found Wednesday evening just north of Fenway Park, police spokesman Eddy Chrispin said.

So ... people notice the signs, think they look suspicious, call the police - and all hell breaks loose for the rest of the day.

Meanwhile, the marketing agency - in a truly dumb and irresponsible move - told its people in Boston to remain quiet, even as the city was locking down.

According to an e-mail one friend provided to the Globe, the executive at Interference Inc. told the artist, whom the agency had hired to install the small, battery-powered light screens in Boston, to remain silent, even as dozens of police officers collected the devices and shut down highways, subway lines, and part of the Charles River.

The executive asked Peter Berdovsky to "pretty please keep everything on the dl," slang for down low, or hush-hush, according to the message Berdovsky sent to his friends.

The city virtually shuts down, countless people are inconvenienced, the police and everyone else goes on high alert - and later in the day, the marketing company finally comes clean that it's just a promotion. There's no danger.

But, what's more, the company paid other people in other cities to plant the signs there. And in some cities, the signs had been there for 2-3 weeks - with not a single complaint. No one in New York reported any problems with the 41 signs there:

Not one New York City resident made a 911 emergency call in response to the promotion here Wednesday -- and, unlike Beantown, Manhattan has really been the target of terrorist attacks.

Portland responded "with a yawn," though maybe that had to do with the placement of the signs:

Portlanders have reported finding at least three of the devices that caused a minor panic in Boston, but reacted with a yawn, if that.

They were found in some of the trendier neighborhoods and were not near bridges or other infrastructure.

It's sensible that, if the people in Portland didn't place the signs near any key infrastructure elements, there would be less perception of a threat (unlike Boston). But ... if the placement of the signs were the determining factor, wouldn't you expect that Seattle would have had the same problem as Boston? At least one sign was posted on a bridge there:

Some of the same blinking electronic devices that threw a scare into the city of Boston today (Wednesday) have been found and removed from Seattle and several suburbs.

Police say the removal was low-key in Seattle.

One was found yesterday (Tuesday) by a Woodinville Public Works Department crew working on a rail trestle over State Highway 202.

Hmm ... and there was nothing to report in Atlanta:

Joe Cobb, Atlanta Police Department public information officer, said his department was unaware of the devices and had received no complaints.

In San Francisco it was also a non-event:

San Francisco police say 20 blinking signs advertising a cartoon show were scattered in various city neighborhoods without causing a stir.

Apparently no one had yet gotten around to placing any of the signs in Los Angeles:

None of the devices, which were planned to be placed around the Westside of Los Angeles, including Hollywood, West Hollywood and Santa Monica, had been reported found.

And although all of these cities seemed to shrug it off, the signs raised the ire of public officials in two cities: Philadelphia ...

When city officials learned little devices equipped with circuit boards and batteries were spread across Philadelphia, managing director Pedro Ramos and officials with the Mayor's office began combing the streets.

Ramos said the signs are illegal and those responsible will be punished.

... and Chicago:

They were recovered from elevated stations and storefronts…

And the city may seek monetary reimbursement from the marketing company responsible for planting them, said Supt. Philip Cline.

So ... the signs were considered a huge problem in Boston, a nuisance in Philadelphia and Chicago, and no big deal anywhere else. Philadelphia and Chicago want to be reimbursed for the trouble of finding and removing the signs.

And the prosecutor in Boston has prosecution on his mind - presumably, on charges of launching a full-blown terrorist hoax:

Assistant Attorney General John Grossman said bomb squad members who examined the lighted signs immediately detected three components that suggested the contraptions could be bombs. He said the black signs, about the size of a laptop computer, had what appeared to be a duct-tape wrapped package with a wire running into it and a power source, which would be needed to detonate a bomb.

"The devices looked like bombs" and had an "ominous nature," Grossman said.

While recognizing the fact that public authorities have to respond to any possible threat that's called in, a few questions come to mind:

1. Even without hearing from the marketing company, why didn't officials in Boston more quickly recognize that these things weren't bombs? It took hours for bomb-squad experts to see these things for what they were? Yes, there were batteries and wires, but these devices really weren't planted like an IED typically would be. Generally speaking, when you're planting an IED, you want it to blend in with its surroundings. You hide it in a backpack, or in a garbage can, or under a pile of garbage. You don't put blinking lights on it and place it in plain sight.
2. What effect will this have on "See Something, Say Something" efforts? Will people in Boston be as likely to report suspicious items if the result is a shutdown of the city, over something that turned out to be nothing at all?
3. If the guys in Boston (and here I'm talking about the guys who placed the signs, not the marketing agency who directed them) committed a crime, then what about the people who were hired to plant the signs in other cities? Did they commit the same crime? Or is the crime determined primarily by the degree to which public officials react to it? Did the guys in Boston commit a really serious crime, the guys in Chicago and Philadelphia commit a less serious crime, and the guys in Portland, New York, San Francisco, Seattle, etc., no crime at all?
4. Are we going to say that putting up signs like this is equivalent to, for instance, filling envelopes with white powder? Is it equivalent to calling in a bomb threat? Where do we draw the line?
5. How do authorities maintain vigilance without giving the appearance of crying wolf, when something like this happens? Every time that something like this happens, and there turns out to be no threat, people are going to be less and less inclined to respond to future warnings. It really is the "cry wolf" syndrome.
   

It's an interesting case, and one that indicates that there's a lot of Homeland Insecurity out there.

Rail Security: Will the Information Be Shared?

GovExec has a short article today about pending rules from TSA regarding rail shipments of hazardous materials:

The Transportation Security Administration is set to propose a new rule that would require rail carriers to respond more quickly to government queries on the whereabouts of hazardous chemicals they transport through urban centers.

Under the proposed rule, slated for publication next week in the Federal Register, transporters of potentially explosive chemicals or those that could be lethal if inhaled would have as little as five minutes to tell federal investigators the precise location of rail shipments, in the highest risk situations. In less severe circumstances, the companies would be allowed up to half an hour to respond.

The regulation also would require industry officials to designate a rail security coordinator to work with federal officials and track and reduce "standstill" time for railroad cars carrying hazardous materials.

Here's my question: Who notifies local authorities, who will be the first on the scene in any hazardous materials incident? In a HAZMAT incident, every second counts. If lives are to be saved in this type of incident, they will be saved by local personnel. Will the information be shared promptly with local authorities?

The Threat on the Rails

A relatively brief report by the Citizens for Rail Safety highlights the threat of a catastrophe on the nation's railroads. The whole thing is worth a read, but here are some highlights:

Just one 90-ton rail car of chlorine, whether involved in an accident or act of terrorism, could create a toxic cloud 40 miles long and 10 miles wide and could kill as many as 100,000 people in 30 minutes.

Railroads in the United States transport 1.8 million shipments of hazardous materials every year, using 100,000 tank cars, filled with such chemicals as chlorine, anhydrous ammonia, cyanide compounds, flammable liquids and pesticides. The result is one million tons of hazardous material being moving across the nation daily.

Between 1988 and 2003 there were 181 acts of terror, worldwide, involving railroads and related rail targets.

Though the vast majority, 99.98 percent according to the railroads, of Hazmat shipments arrive safely and without major incident, there are fatalities, hospitalizations, and/or evacuations every year from the escape of a large quantity of gases or liquids.

Making the problem more serious is the vulnerability of the railways. Rail cars pass through cities day and night, and it is not possible to physically secure all railways.

Rail cars, tracks, yards, and basic infrastructure are not sufficiently secure. They are not only poorly protected from possible terrorists, but often in poor maintenance, making them more vulnerable to accidents.

Rail Hazmat cars are extremely vulnerable when they sit for hours and even days and weeks, unattended and unsecured, along track sidings and in yards.

So, while perfect security for this sector is not possible, the report argues that improved training is not only essential but possible. The current state of training is "inadequate":

In-depth quality training for rail workers and community members is essential for saving lives and health. It is currently inadequate.

The typical emergency responders are poorly trained in responding to Hazmat incidents, especially involving rail, and usually have little knowledge of the rail infrastructure in their communities or the chemicals moving through by rail.

Citizens in “rail communities” generally know little about the Hazmats moving through their towns and do not know what to do should there be an emergency. Rail Hazmats often run through densely populated areas.

One solution is better collaboration between railways and first responders in local communities:

There are few forums that bring together rail workers, emergency responders, and citizens to learn about and plan for rail Hazmat incidents. There are very few joint training exercises.

Many communities are without emergency action plans for rail emergencies.

Hazmat safety and health training saves lives. ... In Graniteville, South Carolina in 2005 a conductor lived because his military training taught him not to run, but to walk out of a cloud of chemical gas. Chlorine killed his engineer partner, who without training, ran and because of his deep inhalation of chlorine gas, ran to his death.

This is an important threat to consider. Safe, secure rail traffic is essential to protect lives. It has significant economic implications as well.

Dems Likely to Increase Domestic HLS Spending

With Democrats in the majority in the House, and maybe in the Senate, they will push for their proposals on Homeland Security. This generally means an increase in domestic expenditures, which would affect homeland security professionals at local, state, and federal levels. Government Computer News reports:

With the Democrats taking control of the House of Representatives next January for the first time since 9/11, the nation is likely to see changes in anti-terrorism policy and increased domestic spending.

Specifically, they are likely to push for full implementation of the 9/11 Commission's proposals, both international and domestic.

Other anti-terrorism areas of emphasis for Democrats in Congress have included urban and mass transit security; chemical security, port security, first responders, disaster preparedness and privacy.

It is certain that the Democrats will be eager to push for an approach that differentiates them from the Bush Administration. But as always, it won't be the amount of money they spend. It will be how smart they spend the money.

DC Studies Rerouting Hazardous Cargo

Washington DC is launching a study that will examine the feasibility of rerouting hazardous rail shipments around the city, the Washington Times reported.

The rail line proposals are largely a response to concerns of the D.C. Council and the Homeland Security Department about the risk from terrorists' sabotaging tank cars with hazardous materials, unleashing deadly chemicals on Washington's population. Rail lines run less than a half-mile from the U.S. Capitol.

"A terrorist attack on a freight car with hazardous cargo, such as liquid chlorine, could kill thousands within a very short time and imperil the functioning of critical federal facilities," said Rick Rybeck, D.C. Department of Transportation deputy administrator.

This is a threat that any community should recognize and be prepared to deal with. The hazard comes not only from intentional release of hazardous materials, but from accidental spills as well.