Societal Security: Case Studies in Cash Depot and LNG Facility Risk

1. Societal Security – Two case studies:A cash depot and an LNG facility Professor Jørn Vatn, NTNU

2. Topic for reflection • Does a true objective risk exist? • Under which conditions does it make sense to introduce the concept of a true objective risk? • Is the main objective of risk communication to contribute to making perceived risk equal to the true objective risk? • How could decisions be made in a societal security context with a basis in • An objective risk picture • A perceived risk picture that are not consistent?

3. 4 domains as a basis for risk definition • Real world domain • Observables such as number of gas leakages next year • Scientific cause and effect domain • What is the relation between the observables, which theories exists? • We do not claim to possess true knowledge in this domain • Uncertainty domain (we do not know with certainty) • Lack of sure (certain) knowledge regarding future values of observables, current values of observables, and cause & effects • Value and preferences domain • How desirable the various outcomes in the real world are

4. More on uncertainty • Aven & Renn use the term «uncertainty» to classify risk problems in ch 1.5 • Uncertainty refers to the difficulty of predicting the occurrence of events and/or their consequences based on incomplete or invalid data bases, possible changes of the causal chains and their context conditions, extrapolation methods when making inferences from experimental results, modelling inaccuracies or variations in expert judgments • The way the term uncertainty is used here is very problematic • I do not understand why Aven & Renn use «uncertainty» both in relation to (i)«about and severity of events», and to describe (ii) difficulty of prediction • Prediction is not defined, and a word that is not easy

5. More on values and preferences • Values and preferences deals with normative issues of a decision problem • What risk level can be tolerated? • How much is it worth to pay in order to reduce risk? • Wikipedia: Ambiguity of words or phrases is the ability to admit more than one interpretation • Aven & Renn use the word ambiguity in two ways • Interpretative ambiguity • Normative ambiguity  Various views on e.g., what is acceptable risk

6. What is risk? • Conceptual definition: • risk is to be understood as the uncertainty regarding the occurrence and the severity of events (close to Aven definition) • Operational definition (expressing uncertainty) • R = {<ei,pi,Si>} • ei = undesired events • pi, = an expression of the uncertainty regarding occurrence of events, i.e., probability statements are the quantitative language to express uncertainty (not an inherent property of the system) • Si = Severity of the event, also uncertain, i.e., we need probability statements to express Si

7. The issue of conditional risk • A risk statement is never unconditional, it should reflect many aspects • U = the relevant information, the theories, the understanding, the assumptions etc. which are the basis for the risk assessor when risk is assessed • D = the result of dialog processes and risk communication processes conducted in order to agree upon which elements of severity to focus on (e.g., fatality rate vs gross accidents) “Ambiguity” • V = the result of the verification processes to verify the correctness of the assessment given U and D • R = {<ei,pi,Si>}| D, U, V • Be as explicit as possible regarding D, U, V

8. Probabilities and uncertainties • Aven & Renn claim in Ch 12 that they put a stronger emphasis on the uncertainty dimension compared to Vatn (2007) • ?? • Seeing beyond probabilities and expected values, what does it mean? • Risk: R = {<ei,pi,Si>}| D, U, V • pi =pi| D,U, V, where • U = understanding and assumption. Several of these assumptions are uncertain regarding current value of observables, cause and effects, trends etc • This is to see beyond the probabilities, i.e., pi =pi | D,U, V •  We need to be explicit and present U, and not only usepias basis for the decision process, i.e., seeing beyond the probabilities

9. Complexity and risk • Complexity has been defined as interaction between subsystems that cannot be foreseen (Perrow, 1984) • If complexity is something we cannot really touch, does it then make sense to assess it’s “risk” • Many authors claim that it does not make sense, or that there is so huge uncertainty that risk assessment is valueless • Many of these authors see risk as a system property which is hidden behind huge uncertainty • We focus on risk as an expression of uncertainty • If a system is believed to have many interactions we are not able to foresee or express, most of us will say that system performance is uncertain, and hence operation is “risky” •  Risk and complexity make sense • In order to express how risky this will be, we need risk analysis

10. Background – Case study 1 • NOKAS (Norsk Kontantservice AS) was established 1st of July 2001 • The business concept of NOKAS is to deliver reliable, effective and profitable solutions to banks for treatment, control and distribution of Norwegian and foreign cash • In Stavanger NOKAS operates from three different locations up to May 2004 • In order to improve security, NOKAS decides to move to new premises at Frøystad outside the centre of Stavanger • The building application was approved in February 2003 • Frøystad Barnehage (Kindergarten) achieve a neighbour notice, and the NOKAS- building emerges • People are concern about vehicle traffic related to the premises, and the lack of parking places

12. Police officer shot to dead in brutal robbery • It was the 53 year old police officer Arne Sigve Klungland that was shot and killed under an armed robbery of Norsk Kontantservice in the centre of Stavanger Monday morning 5th of april 2004

13. NOKAS relocation to Frøystad • The focus at Frøystad is not traffic issues, or parking places any more: • In one month a cash depot will start operating in the neighbourhood • With the brutality demonstrated in the NOKAS robbery in the centre of Stavanger, there is a fair that something could happed to the children • And especially in the Kindergarten located only eight meter from the NOKAS building

15. Neighbours Kinder-garten NOKAS

18. Next events … • The Kindergarten and some of the neighbours organize themselves into a group which attempts to stop NOKAS from moving into their new premises • The municipal demands NOKAS to consider Societal Security • NOKAS moves into their new premises May 2004 • A consultant company performs the risk consideration on behalf of NOKAS • The cooperation with the neighbours fails, and thus there is no trust in the risk analysis report • The report is also heavily criticised by Terje Aven

19. Why was the consultant report so bad? • Terje Aven: • The Scandpower report claims that there exist an objective risk which is hard to assess. • From Avens point of view, risk does not exist objectively • Also, the Scandpower report claims that the risk is acceptable, which is not a statement to be claimed by the consultant • It is the decision maker, e.g., NOKAS, or the politician in this situation that should make the value statement regarding which risk to accept

20. The municipal of Stavanger takes lead • The situation has become an issue for the local press in Stavanger • Dailey reportages: • ”We are fearing a bloodshed” • ”We are not fearing NOKAS as a neighbour” • The municipal of Stavanger asks SINTEF to contribute • The work is divided in two parts • A set of dialogue meetings to enhance risk communication • A quantitative assessment of the risk picture based on the qualitative findings from the dialogue meetings • The SINTEF work will from the basis for a case to be presented for a political decision

21. Dialogue meetings – Risk communication • Elements • An initial mass meeting was arranged to inform about the process to come • Group meetings to discuss the threats and risk reducing measures • Neighbours with children in the Kindergarten • Neighbours without children in the Kindergarten • Employees in the Kindergarten • Employees at NOKAS • Representatives for the Stavanger police force • The results from the group meeting was discussed in a new group, now with one representative from each group • The result was continuously documented in a protocol available to all (after quality checks)

22. Some results from dialogue meeting • The two step procedure worked according to it’s intention • The discussion between the group representatives acted as an informal information channel where issues could be discussed in a relaxed environment. In fact this meeting was seen as a first promising step in a future dialogue. • The perceived risk was an important issue for the neighbors and the employees in the kindergarten. These representatives argued in terms of that something will happen, the question is when it will happen • The representatives from NOKAS and the police had sympathy to the neighbors whish to have more information related to the security issues • A central dilemma is that some information cannot be communicated opened, e.g., information about security systems, and the arrangements made by the police force • From the neighbors point of view lack of information, and lack of control leads to increased perceived risk. Increased trust is therefore an important factor in the future dialogue and problem solving process • A relatively large number of risk reducing measures were proposed. These measures covered both the short- and the long time horizon.

23. Risk quantification • Risk was calculated based on six identified scenarios • The scenarios were primarily a result of the group discussions • The scenarios were structured in order to facilitate quantification • Background data and assumptions comprised historical events, input from NOKAS, the police force in Stavanger and Oslo, available reports, and SINTEF judgements

24. Scenarios • Robbery of a money conveyance without intention to enter the cash depot • Hijacking of a money conveyance with the purpose to enter the cash depot • Use of explosives with the purpose to enter the cash depot • Taking hostages in order to enter the cash depot • Use of “insiders” to get access to the cash depot • Robbery of a larger money conveyance

25. Scenario modell

26. Scenario modelling • The most important risk scenario was: • Robbery of a money conveyance without intention to enter the cash depot • Main parameters to assess • What is the likelihood of the scenario • Will the police force interfere if an attack occurs?  • Number of bullets fired off • Probability of hitting 3rd person • Probability of escape route passes playing children • In the analysis statements regarding these aspects are discussed and presented

27. Assessment of parameter values • Different aspects applies when assessing parameters • What type of statistical material exists? • E.g., how many robberies take place every year, and how many NOKAS like facilities exist, and are they comparable? • How relevant is the data? • How to use the “similarity principle”, i.e. is Stavanger equal to Oslo? • Will the police force keep away according to their statement: “Why interfere when we at the end of the day will capture the robbers, as we did last time”

28. Risk picture summary

29. Risk evaluation

30. The interpretation by the media Stvng Aftenbl. Frøystad Kindergarten is safe NRK: High risk of robbery

31. The political process • The scope of SINTEFs work was not to interfere with the political processes that were running in Stavanger at the time of the study. However, the two SINTEF reports (Risk + Dialouge) should make a basis for the political discussions in Stavanger • The statement of the case from the city manager to the politicians in the City of Stavanger contained two parts • Part one was a general discussion about the risk involved, both the assessed risk by SINTEF, and the result from the risk communication that had taken part in the spring of 2005 • Part two was an explicit proposal to vote about. This proposal reads

32. The politician voted for the following: • The societal security related to third persons in the neighbourhood of the new NOKAS facilities is not worsened in such a way that moving the kindergarten nor the NOKAS facilities is necessary • The city of Stavanger will actively contribute to reduce the perceived risk in the neighbourhood by allocating necessary resources for dialog and communication • The city of Stavanger assumes that those measures NOKAS had suggested based on the SINTEF report will be implemented

34. Background case study 2 • The local energy provider Lyse was developing an LNG (liquefied natural gas) facility at Risavika outside Stavanger in Norway • Natural gas from the North Sea is transported through pipelines to shore, and then being liquefied at a process plant before it is stored in a huge tank • The LNG is distributed from the facility to local consumers by LNG tankers and LNG lorries • The localisation of the plant has been a hot issue in the region

35. Localization of the LNG factory

36. Project history • The LNG plant is under construction on a dismantled yard of a refinery • The yard was deregulated for new industry and several other enterprises are also under development, including a foreign ferry terminal approx 300 meters from the LNG plant • The LNG facility was approved according to the development plan by the local authorities in June 2006 • The authorization to store and treat inflammable goods was given by the national directorate (DSB) in December 2007 based on a preliminary risk analysis • In order to obtain the final authorization from DSB updated risk analyses have to be provided showing that the risk of the facility as built is in accordance to the acceptance criteria • A first quantitative update of the risk analysis is available • There is significant resistance against the factory, and it has been claimed that more or less all central actors have committed serious mistakes in the approval process (Vinnem, 2008) • Test production started in 2010 • The plant was official opened in October 2011

37. Topic 1 – Risk acceptance criteria • In Norway it is common that the enterprises themselves establish risk acceptance criteria (RAC) • Criteria are set both for individual risk for various groups, and for societal risk • This is the case even for third person • Safety authorities gives final approval, but do not give recommendations on RAC • For the particular case in Risavika, societal risk was one of the most demanding issues

38. Societal risk acceptance criteria used

39. How reasonable are the RAC? • The RAC are in accordance with values recommended by the HSE in the UK • Similar RAC in the Netherlands are much stricter • How does the RAC relate to “historical” gross accident risk level in Norway?

40. Historical “risk”

41. Criteria used in the Netherlands

42. Conclusions, RAC • In relation to “historical” events, the applied RAC do not impose significant additional risk • Provided not too many enterprises are balancing on the edge between red and yellow • It is not obvious that “natural events” should be used as a basis • However, it is hard to argue that the criteria are unreasonable • The Dutch criteria are much stricter • Note the history of the Dutch criteria: A calibration was done to give a reasonable risk level for 2000 LPG stations in the Netherlands

43. Should one use RAC? • The way RAC were used, the decision problem is seen as a decision problem where one accept any severity level if the assigned probability is sufficient low • Some of the stakeholders claimed that this is not the correct focus, there are some consequences that are unacceptable independent of their probabilities • This calls for a deterministic approach (Perrow?) • Regulations in Norway does not support such ideas • The topic was indeed discussed during the dialogue meetings, and the mass meetings • This may relate to what Aven & Renn denotes ambiguity

44. The results from the QRA shows that the risk is in the ALARP region The main contributor to the risk is the ferry terminal An ALARP process has been run to obtain efficient risk reducing measures The decided risk reduction measures will not bring risk to the Dutch level Topic 2 - Results from quantitative risk analysis

45. Topic 3 - Additional risk reducing measure • A drifting gas cloud is the main contributor to gross accident risk • A remote operated fire water pump that can establish a “curtain” of water that may stop the drifting of LNG gas • Forced ignition of drifting LNG gas

46. The plant layout

47. ALARP process • In the ALARP region we should implement all possible risk reducing measure unless they are impractical, or the cost of the measure is disproportional to the risk reducing effect • For the fire pump to produce the protective “curtain” of water, the benefit/cost ratio is found to be approximate 1:30, hence it may be argued that this is a rather costly measure

48. Forced ignition of the gas cloud • If there is a huge gas leakage at the plant, it is a possibility that the gas will not ignite immediately • Thus, a gas cloud may drift away from the plant towards the ferry terminal 300 metres away • If the gas cloud ignite when passing the ferry terminal this could cause up to 1000 fatalities • In order to reduce the consequence of this scenario it is proposed to ignite the gas cloud intentionally before it reaches the terminal building • This measure was rejected by Lyse

49. Effect of the measure • The measure may reduce the probability of an accident with 1000 fatalities with one or two decades depending on the reliability of the ignition unit • Hence, the measure will bring the risk in the direction of the Dutch criteria • Negative aspects: • Personnel fighting against the leakage will be exposed to an additional risk  demanding ethical issue • Increased expected material damages because ignition will for sure make huge material damages, whereas a non ignited gas cloud may drift away without any damage

50. Risk analysis  Mass meeting  Dialogue groups • Purpose of the dialogue groups • Express concern • Bring forward factors affecting risk • Advocate decision criteria and what to focus on, D • Issues that came up • Maintenance can not be guaranteed since DSB (safety authority) is consider much weaker than PTIL (authority in the oil&gas) • Be explicit on worst case • RAC should be replaced by worst case consideration • Risk analysis • The concerns and risk factors were included in the considerations •  The risk picture presented aimed to reflect these concerns D/U • Presenting worst case scenarios was appreciated by some of the strongest opponents