Chemical Plant Security

1. Chemical Plant Security Bill Hendon Eastman Chemical Company Securing Global Operations

2. Topics • Role of Chemical Industry • How we hardened up • Getting some help • Questions Securing Global Operations

3. Agriculture and Food Banking and Finance Chemical Defense Industrial Base Drinking Water and Wastewater Treatment Systems Emergency Services Energy Information Technology National Monuments and Icons Postal and Shipping Public Health and Healthcare Telecommunications Transportation Systems Critical Manufacturing Commercial Facilities Commercial Nuclear Reactors, Materials, and Waste Dams Government Facilities Department of Homeland SecurityCritical Infrastructure & Key Resource Sectors (CIKR) Critical Infrastructure Sectors Key Resources Securing Global Operations

4. Dependency on our Critical Infrastructure & Key Resources… • National Security • Economic Vitality • Our Way of Life Attacks Could… • Disrupt government and private industry operations and impact our economy and society • Result in large-scale human casualties, property destruction, and damage to national prestige and public confidence

5. So far.. • According to DHS, our country has critical infrastructure (CI) and key resources (KR). • Chemical Industry is one of these critical infrastructures. • Chemical industry provides mission support for the key resources. • Also, 85% of all CIKR assets are privately-owned. • ..so what do we do? Securing Global Operations

6. We protect our business and assets. • Chemical Plant Security • Long history of protecting employees, communities, and our business. • Historical security program both in physical and cyber security. • Utilized our trade association, American Chemistry Council (ACC), to function as the conduit and organizer of a chemical industry security program. Securing Global Operations

7. ACC Responsible Care (RC) program • ACC created the RC program in response to safety and environmental issues for our industry • The RC consists of 7 codes of manufacturing practices • Employee Health and Safety • Community Awareness and Emergency Response • Process Safety • Distribution • Product Stewardship • Pollution Prevention • Security • We’ll focus on the Security Code Securing Global Operations

8. ACC Security Code • ACC created the Security Code in June 2002. The SC consists of these elements: Securing Global Operations

9. Physical Security MeasuresOur industry installed physical security measures including: • Gates, • fences, • closed circuit TV, • identification badges and readers • vehicle barriers • railroad gates, • motion detectors, • turnstiles • and lots of lights. Securing Global Operations

10. Security Vulnerability Analysis (SVA) – our “hazard” assessment tool • A SVA is the process of determining the likelihood of an adversary successfully exploiting vulnerability, and the resulting degree of damage or impact on an asset. • SVAs are not quantitative risk analyses, but instead are performed qualitatively using the best judgment of security, safety, and other appropriate professionals. This is similar to the qualitative risk analysis process that is routinely applied in assessing accidental risk at the same facilities.” Securing Global Operations

11. Key concepts of the Security Vulnerability Analysis (SVA) • Evaluate facilities with highly hazardous chemical processes for attack scenarios. • Relative difficulty of an attack • Relative severity of an attack • Attractiveness of a target Securing Global Operations

12. Center for Chemical Process Safety (CCPS) SVA Methodology Focus on Four Key Security Events • Loss of Containment: release of hazardous chemicals • Theft or Misuse: theft of chemicals in order to cause harm or divert to criminal uses • Contamination: contaminate product to cause harm • Degradation of Assets: harm to assets, facility, infrastructure, business function Securing Global Operations

13. Securing Global Operations

14. Risk Ranking Matrix for Assets L I K E L I H O O D L I K E L I HOOD Securing Global Operations

15. Differences between SVAs and PHAs Securing Global Operations SVA • Intentional harm assumed • Likelihood of success of attack, not likelihood ofbeingattacked • Start with perimeter & general security measures and inward toward specific asset security • Assume general measures are already in place when examining specific targets/assets PHA • NO intentional harm assumed • Likelihood of process event both being initiated and propagating to failure of interest • Start with specific equipment items, work outward • No assumption of upgrade completion as a part of the analysis

16. New Federal Security RegulationDHS Chemical Facility Anti-Terrorism Standards (CFATS) • Establishes risk-based performance standards for the security of chemical facilities • Covered facilities must: • Prepare Security Vulnerability Assessments (SVAs), which identify vulnerabilities • Develop and implement Site Security Plans (SSPs) • Security Plans must identify specific security measures (standards) • Comply with recordkeeping and information protection guidelines • Establishes DHS authority for inspections, audits and compliance orders Securing Global Operations

17. CFATS Process Requirements Facility receives Notice to compete "Top Screen" Chemicals of interest and Quantities provided Feedback and Initial tier Assignment From DHS Facility Completes Top Screen (60 Days) Facility completes Site Security Plan Using CSAT Specify Performance Measures (120 Days) Facility competes SVA using Chemical Security Assessment Tool (CSAT) (90 Days) Facility receives final tier assignment from DHS DHS Audit And SSP Approval Securing Global Operations

18. Not the end but the beginning… • Until early 2000s, security was based on theft prevention and protecting the public. • Historical companion to safety programs. • Post 9/11/01, governmental demands and activist interest have created several federal regulations for security of transportation, ports and chemical facilities. • Chemical industry is much farther ahead than other industries. • Corporate security programs are much more involved and sophisticated. Securing Global Operations