Pollution Prevention and Homeland Security

Michael J. EllenbeckerKwangseog Ahn

Homeland Security & Homeland Security & Preventing Pollution from Preventing Pollution from

Attack on Critical Waterside Attack on Critical Waterside InfrastructureInfrastructure

Presented byPresented by

Ed Badolato, Executive VP, Homeland SecurityEd Badolato, Executive VP, Homeland Security The Shaw Group The Shaw Group

New Hampshire Pollution Prevention New Hampshire Pollution Prevention ConferenceConference

University of New HampshireUniversity of New Hampshire

September 21, 2004September 21, 2004

Vulnerability: How to Vulnerability: How to Audit Your FacilityAudit Your Facility

Presented byPresented by

Ed BadolatoEd BadolatoExecutive Vice President for Homeland SecurityExecutive Vice President for Homeland Security

The Shaw GroupThe Shaw Group

University of New HampshireUniversity of New Hampshire

September 21, 2004September 21, 2004

The New Environmental The New Environmental ParadigmParadigm

Certain parts of the infrastructure Certain parts of the infrastructure are attractive targets for terroristsare attractive targets for terrorists Mass casualtiesMass casualties Property damageProperty damage Economic lossesEconomic losses Environmental impactEnvironmental impact

We must reduce risk from indirect We must reduce risk from indirect releases into the environmentreleases into the environment

Osama bin Laden’s Osama bin Laden’s Targeting PhilosophyTargeting Philosophy

““Inflict maximum damage Inflict maximum damage to to

human, economic andhuman, economic andphysical infrastructures” physical infrastructures”

““Attack symbolic, high Attack symbolic, high prestige,prestige,

economic, and strategic economic, and strategic targetstargets””

Pollution as a Terrorist Weapon--Pollution as a Terrorist Weapon--Kuwait, 1991Kuwait, 1991

Staten Island Fuel Staten Island Fuel Storage FireStorage Fire

Four Bad Things That Can Happen Four Bad Things That Can Happen from a Terrorist Attack on Your from a Terrorist Attack on Your

FacilityFacility1.1. Loss of containmentLoss of containment

2.2. Theft or misuse with intent to Theft or misuse with intent to cause harmcause harm

3.3. Worker internal or public harm Worker internal or public harm offsiteoffsite

4.4. Degradation of assets, business Degradation of assets, business functions, or company valuefunctions, or company value

CRITICAL CRITICAL INFRASTRUCTURESINFRASTRUCTURES

Chemicals and Hazardous Chemicals and Hazardous Materials Materials

EnergyEnergy TransportationTransportation WaterWater Telecommunications Telecommunications Agriculture & FoodAgriculture & Food Banking and FinanceBanking and Finance Public HealthPublic Health Emergency ServicesEmergency Services Defense Industrial BaseDefense Industrial Base Postal and Express ShippingPostal and Express Shipping

Vulnerability of Petro-Chem FacilitiesVulnerability of Petro-Chem Facilities

This book was co-authored This book was co-authored by Ed Badolatoby Ed Badolato

It covers:It covers: Industrial disastersIndustrial disasters Process related Process related

incidentsincidents The terrorist threat to The terrorist threat to

populated areaspopulated areas Sabotage of chem Sabotage of chem

facilities and RR tank facilities and RR tank carscars

The cost factorThe cost factor

Terrorism and the Chemical Terrorism and the Chemical Transportation IndustryTransportation Industry

1.1. Plug the security gaps Plug the security gaps noted in industry noted in industry “Lessons Learned” & “Lessons Learned” & “Best Practices”“Best Practices”

2.2. Work across the full Work across the full spectrum of Homeland spectrum of Homeland Security incidents—Security incidents—preparation, response, preparation, response, recoveryrecovery

3.3. Adopt and adapt Adopt and adapt technology fixestechnology fixes

4.4. Organize a layered, Organize a layered, integrated security integrated security systemsystem

What We Can Expect in the What We Can Expect in the Future Future

More mass casualty attacks--More mass casualty attacks--

““few attacks in the US, but they will be few attacks in the US, but they will be closer to the Madrid rail scenario than the closer to the Madrid rail scenario than the WTC 9/11”WTC 9/11”

Terrorist conventional bombings along Terrorist conventional bombings along with WMD attempts--with WMD attempts--

““bombs will be the most predominant form bombs will be the most predominant form of attack”of attack”

More terrorist cells and operatives will More terrorist cells and operatives will be uncovered in the US be uncovered in the US

Laws & Regulations that Laws & Regulations that Impact Facility Impact Facility PreparednessPreparedness

Clean Air Act Clean Air Act Bioterrorism Preparedness and Response Bioterrorism Preparedness and Response

Act of 2002Act of 2002 Maritime Transportation Security Act of Maritime Transportation Security Act of

20022002 Resource Conservation and Recovery Act of Resource Conservation and Recovery Act of

19761976 Occupational Safety and Health ActOccupational Safety and Health Act Emergency Planning and Community Right-Emergency Planning and Community Right-

to-Know Actto-Know Act

Chemical/Environmental Security Chemical/Environmental Security PlayersPlayers

Key Agencies & OrganizationsKey Agencies & Organizations Department of Homeland Security (DHS)Department of Homeland Security (DHS) Environmental Protection Agency (EPA)Environmental Protection Agency (EPA) Department of JusticeDepartment of Justice Department of DefenseDepartment of Defense State & Local Emergency ResponseState & Local Emergency Response Industry Associations—ACC, SOCMA, and state Industry Associations—ACC, SOCMA, and state

industry organizationsindustry organizations American Institute of Chemical EngineersAmerican Institute of Chemical Engineers

Secondary Agencies & OrganizationsSecondary Agencies & Organizations DOTDOT OSHAOSHA DOEDOE

DHS and the National HS DHS and the National HS StrategyStrategy

The three objectives of the national The three objectives of the national strategy:strategy:

1. Prevent terrorist attacks within 1. Prevent terrorist attacks within the USthe US

2. Reduce Americas vulnerability to 2. Reduce Americas vulnerability to terroriststerrorists

3. Minimize the damage and recover 3. Minimize the damage and recover from attacks that do occurfrom attacks that do occur

DHS Infrastructure Protective DHS Infrastructure Protective Measures PlanMeasures Plan

Technical ApplicationsTechnical Applications WMD PreventionWMD Prevention Protection MeasuresProtection Measures

Buffer Zone Protection Plan (BZPP)Buffer Zone Protection Plan (BZPP) 1700 sites this year1700 sites this year Target selectionTarget selection Surveillance OpsSurveillance Ops Planning OpsPlanning Ops RehearsalsRehearsals

TrainingTraining

Industry Safety Management Industry Safety Management CapabilitiesCapabilities

Process Safety Management SystemsProcess Safety Management Systems Hazard Evaluation ProceduresHazard Evaluation Procedures Chemical Process Quantitative Risk Chemical Process Quantitative Risk

AnalysisAnalysis Release MitigationRelease Mitigation Safe Storage & Handling of High Safe Storage & Handling of High

Toxic Hazard MaterialsToxic Hazard Materials Layer of Protection Analysis Layer of Protection Analysis

We Must Work Across the Full We Must Work Across the Full Spectrum Spectrum

of Homeland Security of Homeland Security SituationsSituations

PreparationPreparationThreatThreat

VulnerabilityVulnerability

RiskRisk

CountermeasuresCountermeasures

TrainingTraining

Alert/WarningAlert/Warning

ResponseResponse

PolicePolice

EMSEMS

FireFire

Emergency Emergency CoordinationCoordination

EvacuationEvacuation

RecoveryRecovery

Emergency Emergency ResponseResponse

Incident Incident Mgt Public Mgt Public SafetySafety

Clean upClean up

Resumption Resumption of of OperationsOperations

Suggestions for IndustrySuggestions for Industry

The new industry security strategy The new industry security strategy should:should: Identify and prioritize critical infrastructure Identify and prioritize critical infrastructure

facilities.facilities. Specify security roles and responsibilities.Specify security roles and responsibilities. Describe appropriate threat/alert information Describe appropriate threat/alert information

flows.flows. Set the standards for actionable security plansSet the standards for actionable security plans

Suggestions for Your Suggestions for Your FacilityFacility

Assume you are a targetAssume you are a target Extend your perimeter—”mutual Extend your perimeter—”mutual

support”support” BarriersBarriers SurveillanceSurveillance PlanningPlanning Inform & engage employeesInform & engage employees

The Security Vulnerability The Security Vulnerability Assessment ProcessAssessment Process

1.1. Project Planning Meeting--Project Planning Meeting--Setting the right course with the company/clientSetting the right course with the company/client

2.2. Facility Characterization and Critical Asset Identification--Facility Characterization and Critical Asset Identification--A thorough A thorough characterization of site asset characteristics and hazardscharacterization of site asset characteristics and hazards

3.3. Identify and Prioritize the Threat-Identify and Prioritize the Threat---Complete evaluation of threats; internal, Complete evaluation of threats; internal, external, internally-assistedexternal, internally-assisted

4.4. Vulnerability Analysis--Vulnerability Analysis--Prioritized evaluation of threats against assetsPrioritized evaluation of threats against assets

5.5. Risk Assessment —Risk Assessment —defining the potential for damage to or loss of an asset defining the potential for damage to or loss of an asset

6.6. Countermeasures Identification and Effectiveness Measurement--Countermeasures Identification and Effectiveness Measurement--Prioritized validation and justification of costs for improved security, Prioritized validation and justification of costs for improved security, highlighting process/operations benefitshighlighting process/operations benefits

7.7. Preparing the ReportPreparing the Report

8.8. ImplementationImplementation

Step 3. Identify and Prioritize the Step 3. Identify and Prioritize the Threat-Threat-

Threat MethodologyThreat Methodology

Understand how terrorists target Understand how terrorists target facilitiesfacilities

Build a detailed, focused assessmentBuild a detailed, focused assessment Initial screening of sources of threat Initial screening of sources of threat

info info Contact with local, state, & federal law Contact with local, state, & federal law

enforcement and intelligence agenciesenforcement and intelligence agencies Interviews with facility security Interviews with facility security

managersmanagers

Step 4. Vulnerability AssessmentStep 4. Vulnerability Assessment

Vulnerability AssessmentVulnerability Assessment

““Identification of the extent of Identification of the extent of susceptibility to exploitation, relative susceptibility to exploitation, relative to the existence of any to the existence of any countermeasures.”countermeasures.”

Two Approaches to Vulnerability Two Approaches to Vulnerability AnalysisAnalysis

1.1. Asset-based analysis: Asset-based analysis: assess assess potential targets (any attack potential targets (any attack scenariosscenarios) )

2.2. Scenario-based analysis: Scenario-based analysis: assess assess attack scenarios (any asset)attack scenarios (any asset)

VAVA Asset-Based Approach Asset-Based ApproachWhere used:Where used:

− ““Basic” sites, i.e. no complex security Basic” sites, i.e. no complex security challengeschallenges

Key ElementsKey Elements− Assess and categorize consequencesAssess and categorize consequences

− Assess target attractivenessAssess target attractiveness

− Identify and assess key assetsIdentify and assess key assets• Based on consequence and Based on consequence and

attractivenessattractiveness

• Identify areas needing further Identify areas needing further protectionprotection

VA Scenario-Based ApproachVA Scenario-Based ApproachWhere Used:Where Used:

− Complex security challengesComplex security challenges

− High inherent threatHigh inherent threat

Key ElementsKey Elements− Identify key assets/targetsIdentify key assets/targets

− Identify applicable threatsIdentify applicable threats

− Identify potential scenariosIdentify potential scenarios

− Drives countermeasures for selected Drives countermeasures for selected scenariosscenarios

Step 5. Risk AssessmentStep 5. Risk Assessment

RISKRISK

Risk assessmentRisk assessment—”a —”a qualitative and/or quantitative qualitative and/or quantitative determination of the probability determination of the probability of occurrence of an adverse of occurrence of an adverse event and the impact of its event and the impact of its consequences.” consequences.”

Step 6. Countermeasures Identification and Step 6. Countermeasures Identification and Effectiveness Measurement-Effectiveness Measurement-

Physical Security Physical Security Systems Systems

Perimeter ProtectionPerimeter Protection FencesFences LightsLights Gates & Access ControlsGates & Access Controls Entrance/equipment locksEntrance/equipment locks Protection Force Protection Force Electronic security systems--motion Electronic security systems--motion

detectorsdetectors Video surveillance systems, Video surveillance systems, Building alarm systemsBuilding alarm systems

Other CountermeasuresOther Countermeasures

Loss prevention & material controlLoss prevention & material control Control room securityControl room security Distributed Control SystemsDistributed Control Systems Crisis management and emergency Crisis management and emergency

responseresponse Policies & proceduresPolicies & procedures IT/Cyber securityIT/Cyber security IntelligenceIntelligence

SUMMARYSUMMARY

SVAs Perform Important Functions SVAs Perform Important Functions Defines roles & relationshipsDefines roles & relationships Identifies necessary resourcesIdentifies necessary resources Ensures comprehensive security effortEnsures comprehensive security effort Sets plan for implementationSets plan for implementation

MODULE 2: Introduction to theToxics Use Reduction Act

Todd_MacFadden@uml.edu

Toxics Use Reduction Institute

978.934.3391

ProcessCharacterization

ProcessCharacterization

Pre-PlanPre-Plan

Identify TUROptions

Identify TUROptions

Develop orUpdate PlanDevelop orUpdate Plan

Certify PlanCertify Plan

Screen & Evaluate TUR

Options

Screen & Evaluate TUR

Options

ImplementPlan

The TUR Planning Cycle

Responsibilities of a TUR Planner

MeasureSuccess

Similarities in the Security and TUR Assessment Processes

The Security Vulnerability Assessment Process

1. Project Planning Meeting

2. Facility Characterization and Critical Asset Identification

3. Identify and Prioritize the Threat

4. Vulnerability Analysis

5. Risk Assessment

6. Countermeasures Identification and Effectiveness Measurement

7. Preparing the Report

8. Implementation

ProcessCharacterization

ProcessCharacterization

Pre-PlanPre-Plan

Identify TUROptions

Identify TUROptions

Develop orUpdate PlanDevelop orUpdate Plan

Certify PlanCertify Plan

Screen & Evaluate TUR

Options

Screen & Evaluate TUR

Options

ImplementPlan

The TUR Planning Cycle

MeasureSuccess

Importance of TUR in HS

CRITICAL INFRASTRUCTURES Chemicals and Hazardous Materials Energy Transportation…

Pollution Prevention and Homeland Security

Can use similar assessment methods PP personnel may be qualified to perform HS

assessment, particularly in industry using hazardous chemicals

PP itself reduces risks in HS– Lower toxicity– Lower volatility/explosion potential– Lower volumes store on site

Opportunities for TURI

Appears there is lack of interaction between TUR/PP and HS

TURI already has the expertise and resources for TUR/PP that can be applied directly to HS

What TURI Can Do?

Advocate TUR to reduce HS risks Extend TURP program to TUR-HSP program Identify and prioritize the HS risks from hazardous

chemicals– Use TURA data and TRI data including use amounts, locations of

plants, etc. – Use chemical info including explosiveness, flammability, toxicity,

etc.– Use other information about presence of symbolic, high prestige,

economic, and strategic targets– Combine all the information to prioritize the HS risks

Use the planning process to reduce HS risks

Funding Sources?

DHS EPA OSHA NSF MA?