budapest 2005 04 28

Combating Interference by Unauthorised Persons-German Approach-Dr. Hans-Joachim Uth, Federal Environmental Agency, Germany: 

Combating Interference by Unauthorised Persons -German Approach- Dr. Hans-Joachim Uth, Federal Environmental Agency, Germany Joint meeting of CCA responsible for SEVESO II Directive and the Committee for Action Programme in the field of Civil Protection 28-29 April, Budapest, Hungary

Overview: 

Overview New situation after September 11, 2001 New Strategy for identifying and protecting security-relevant installations Hazard analysis Risk analysis Protecting security-relevant installations Related problems, further research developments

New situation after September 11, 2001: 

New situation after September 11, 2001 Terroristic activities are not unusual in history Viewpoint of process safety: Limiting consequences rather than prevention Prevention of terroristic activities is a matter of politics However reality shows that politics is not very successful. We have to taken into account the threat of terroristic activities and their consequences for Chemical Industry.

Scope- What establishment may be concerned ?: 

Scope- What establishment may be concerned ? upper tier establishments due to European SEVESO II Directive (96/82/EC) lower tier establishments due to European SEVESO II Directive (96/82/EC) if vulnerable objects are in the vicinity In those establishments a danger due to deliberate action can not excluded

Definitions -1: 

Definitions -1 Facilities requiring special protection are establishments that are regularly intended for the presence of large numbers of people (schools, meeting places, hospitals, stations etc.). This group also includes densely populated residential areas and transport routes with high traffic densities. Security-relevant installations are installations in an establishment under SEVESO II Directive, which are, in the event of interference by unauthorised persons, capable of giving rise to a serious danger to facilities requiring special protection. An unauthorised person is any person who deliberately commits acts with the aim of directly or indirectly causing damage. For this purpose it is irrelevant whether the person is an employee of the operator, an agent of the operator, or a third party.

Definitions -2: 

Definitions -2 Security means all activities designed to prevent dangers which may arise from interference by unauthorised persons and to achieve preventive containment of the consequences of any major accidents nevertheless caused by unauthorised persons. A security analysis is the identification and assessment, by systematic means, of potential interference by unauthorised persons and of the dangers that may result from such interference.

Systematic identification weather a risk for deliberate acts with serious consequences is to be taken into account. : 

Systematic identification weather a risk for deliberate acts with serious consequences is to be taken into account.

Slide8: 

Concerned establishments General: Upper tier establishments Case by case: Lower tier establishments if Hazard Analysis is positive. Operator’s measures Protection of site perimeter Protection of installatations Raising employee awareness Supplementing safety reports and/or documentation of measures Notifying information necessary for preparing the external alarm and emergency plans Environmental Protection authorities Audit of operator’s measures Emergency authorities Immediate preparation of external alarm and emergency plans Hazard Analysis - Description of major accidents despite precautions - Identification of facilities requiring special protection Impacts of major accidents despite precautions cause serious danger to facilities needing special precautions positive Risk Analysis - Vulnerability Importance of availability - Symbolic character Feedback to authority responsible for public security Security Analysis

Hazard Analysis: 

Hazard Analysis Accident scenarios triggered by deliberate acts, including possible domino effects. Identification of special vulnerable objects in the vicinity of establishments. Assessments of consequences in respect to the special vulnerable objects.

Risk Analysis: 

Risk Analysis Assessment of the risk situation (general security situation, size and composition of work force, quality of security organisation, social position of members of company management, nature of sales connections and foreign activities, crime situation to date etc.) Local position of establishment and installations (vulnerability from outside and in­side, distance from factory fence, visibility from outside, roads on and off site, situation of industrial estate) The importance of availability of the installations for downstream production processes and services, The symbolic character of the company or the installation (ownership situation, type of production and storage of substances, product range, significance of the company from an economic strategy point of view etc.)

Protecting security-relevant installations -1: 

Protecting security-relevant installations -1 So identified security-relevant installations must take special measures to secure them against interference by unauthorised persons. To achieve such security objectives the following measures in particular may be considered: The perimeters of establishments – or if appropriate the common perimeter in the case of industrial estates – (site fence, gates etc.) must be secured by technical and organisational means to ensure that unauthorised persons cannot gain access with­out using force. Non-site personnel should be kept identifiable. Visitors and external companies must be monitored appropriately.

Protecting security-relevant installations -2: 

Protecting security-relevant installations -2 Installations are to be protected in such a way that unauthorised persons cannot cause a major accident without internal knowledge and/or technical aids. Employees must be made aware of the need to secure the establishment, and must be involved. Special situation to be considered for industry complexes.

The selection of appropriate measures requires a systematic SECURITY Analysis. : 

The selection of appropriate measures requires a systematic SECURITY Analysis.

Slide14: 

Assessment of risk situation Identification of points at risk Security strategy Selection of measures Hazard assessment Definition of security objectives Review Audit

Procedure for performing a security analysis : 

Procedure for performing a security analysis Determining and assessing the risk situation Identifying the specific points at risk in the establishment Assessment of hazards in relation to protection objectives Selecting security measures, preparing the integrated security strategy.

Hazard assessment: 

Hazard assessment II. Typs of motives , etc. (Risk categories 1-3) IV.Points at risk I. Factors assessing the risk situation III. Accessment of probability in 4 steps Selection (Table of points at risk) V. Typical acts of interference / instruments 1-10 Hazard assessment (Reduced table of points at risk)

Step I: Factors assessing the risk situation – General Information-: 

Step I: Factors assessing the risk situation – General Information- General safety situation (police crime statistics, publications by insurance companies, information of public authorities on anti-subversion activities). Membership of other companies (establishment belongs to a large (global) company or group. This applies primarily to politically motivated crimes). Importance of establishment for downstream production and services (Installations with a key role for downstream production or services). Sales connections (business connections with politically unstable countries). Local situation of establishment (Neighbouring establishments, Access, domino effect).

Step I: Factors assessing the risk situation – site specific information-: 

Step I: Factors assessing the risk situation – site specific information- Nature of production and storage. Amount and variation of employees (Internal and External personnel , Foreign employees, language barriers). Security management, policy of company (Quality of safety management system, company culture, commitment in security issues). Public involvement of Company management (position in political parties or associations). Crime to date (records of the last 5 years, organised crime, acts of sabotage, bomb threats, cases of arson.

Step II: Risk Category Typ -1: 

Step II: Risk Category Typ -1

Step II: Risk Category Typ -2: 

Step II: Risk Category Typ -2

Step II: Risk Category Typ -3: 

Step II: Risk Category Typ -3

Step IV: Typical Points at risk : 

Step IV: Typical Points at risk Tanks, containers, storage facilities, Filling stations Control centres, switch panels, computer systems Pipe channels, Cable routes, Pump buildings, Valve batteries Production buildings, sections Cooling units, Emergency systems of all kinds High-voltage lines and in-feed points, Electrical supply facilities Energy supply systems of all kinds etc.

Step V: 10 Typical acts of interference / instruments : 

Step V: 10 Typical acts of interference / instruments

Example of a table of points at risk : 

Example of a table of points at risk

Hazard assessment (Reduced table of points at risk): 

Hazard assessment (Reduced table of points at risk)

Deliberate male operation(01): 

Deliberate male operation(01) Switching equipment on/off, Opening/closing pipeline valves, Turning hand wheels, actuating levers in the course of the process etc. Criminal Profile: Such deliberate male operation might be caused by employees or external individuals.

Manipulation (02): 

Manipulation (02) Deliberate incorrect programming of control systems, Deliberate incorrect adjustment of measuring equipment, Suppression of process, fault or alarm reports, Preparatory prevention of starting of emergency units, Switching off protective systems etc. Criminal Profile: “insiders” with a detailed knowledge of the installation

Vehicle accident (03): 

Vehicle accident (03) Leakage from drum due to accident with fork lift truck. Derailment of tank cars, Destruction of installations due to truck impact etc. Criminal Profile: employees and external individuals.

Interference using simple aids (04) : 

Interference using simple aids (04) Cutting wires, Breaking glass parts of installation (e.g. level gauges), Jamming moving parts of an installation, Admixture of non-permitted substances to a process etc. Criminal Profile: most likely offenders are employees

Interference using major aids (04) : 

Interference using major aids (04) Breaking open doors and subsequently destroying equipment, Demolishing instrumentation and control equipment, Breaking open tanks and pipelines, resulting in major leakages etc. Criminal Profile: All , no preference

Arson using simple means (06) : 

Arson using simple means (06) Igniting flammable liquids from the process sequence, Setting fire to storage facilities, resulting in release of hazardous substances, Setting fire to peripheral rooms or equipment having an impact on important parts of installations. Criminal Profile: All , no preference

Arson using incendiary devices (07) : 

Arson using incendiary devices (07) Pouring out and lighting flammable liquids (e.g. petrol), Throwing “Molotov cocktails” (e.g. through windows), Attaching professional incendiary devices with timed or remote controlled ignition. Criminal Profile: Such attacks presuppose a high level of criminal energy.

Use of explosives (08) : 

Use of explosives (08) Placing a home-made “fire extinguisher bomb” inside sensitive installation parts or, more probably, at the edge of buildings, Blowing up tanks and pipelines, Blowing up load-bearing structures, resulting in the collapse of tanks, Destroying parts of installations etc. Criminal Profile: As a rule this kind of attack involves external interference with a radical political background.

Shooting (09) : 

Shooting (09) Causing leakages in free-standing tanks or pipelines, Eliminating instrumentation or control equipment from a distance, Causing failure of supply systems at a distance. Criminal Profile: external actor.

Incidents outside the plant itself (10) : 

Incidents outside the plant itself (10) Spreading of fire from neighbouring facilities, Flying debris following an explosion in neighbouring facilities, Failure of supply systems as a result of disasters outside the installation etc.

Security objectives : 

Security objectives Meaningful planning of security measures is only possible if clearly defined objectives exist as to what they are intended to achieve. Examples The control equipment including the software must only be accessed by specially authorised personnel. Security-relevant switching systems must be monitored by the hazard warning sys­tem. In the event of incorrect operation an alarm sounds in the control room. The danger area is to be separated from the rest of the building by constructional/ mechanical means. Ingress into the storage building after working hours is to be impeded by mechanical barriers and reported by electronic surveillance measures etc.

Description of security measures / security strategy : 

Description of security measures / security strategy Location and position External enclosure Site access controls (pedestrians and vehicles) Protecting areas at risk Organisational measures Security organisation Alarm, surveillance and communication systems

Documentation : 

Documentation The analysis and the measures based on it should be documented. This documentation, however, is especially confidential and should only be accessible to a limited group of employees within the company. It should however be clear from documents available to all employees and the public that the operator has taken the necessary measures to protect the establishment and installations from interference by unauthorised persons.

Recent Research Results (2004): 

Recent Research Results (2004) A-1 Securing industrial facilities against deliberate acts causing chemical releases A-2 Evaluation of approaches to prevent deliberate acts by ‚internal offenders‘ B Classification of information for reasons of public safety Full report UFOPLAN-202 48 376 (in German): www.umweltbundesamt.de/anlagen

A-1 Securing industrial facilities against deliberate acts causing chemical releases: 

A-1 Securing industrial facilities against deliberate acts causing chemical releases This part evaluates the possibility of security screening on trustworthiness of employees as a prevention measure against deliberate acts of politically or ideologically motivated internal offenders. A procedure to identify the staff requiring security screening at hazardous facilities is proposed.

A-2 Evaluation of approaches to prevent deliberate acts by ‚internal offenders‘ : 

A-2 Evaluation of approaches to prevent deliberate acts by ‚internal offenders‘ This part deals with intended harmful behavior of employees for reasons of dissatisfaction, anger or due to working conditions. Known motives and root causes for the development of motives were analysed. Several strategies to prevent the development of motives were analysed and evaluated to be a part of an overall prevention concept. A manual for good practice in the prevention of intended harmful behavior of employees in organizations is developed.

B Classification of information for reasons of public safety: 

B Classification of information for reasons of public safety This part evaluates the conditions to be fulfilled to allow restrictions of the free access to documents including information on hazardous installations (e.g. the safety report) for reasons of public safety according to German relevant legislation (Federal Impact Protection Law and Environmental Information Law) Development of decision criterias for the restriction of the rights on free access to information.

Information sources on SVA (Selection): 

Information sources on SVA (Selection) German Recommendation: www.umweltbundesamt.de/anlagen US overview: http://yosemite.epa.gov/oswer/ceppoweb.nsf/content/links.htm?openDocument#security Guideline of CCPS: http://www.aiche.org/industry/ccps/sva/index.htm US Ministry of justice: http://www.ncjrs.org/pdffiles1/nij/195171.pdf Responsible care program: http://www.responsiblecaretoolkit.com/security_guidance_siteSec.asp SOCMA: Chemical Site SVA Model & Manual: http://www.socma.com/products/VulnerabilityAnalysis.htm