Security and Crisis Management Preparation and Response

1. Security andCrisis ManagementPreparation and Response April 28, 2004

2. Recognize the Critical Relationships Between Security and Crisis Management • Security • Prevent incidents • Limit potential effects / extent • Crisis Management • Respond appropriately to avoid or limit impacts • Develop remedial measures • Both Can and Should be Improved Together Through Iterative and Conjunctive Development

3. Common Objectives • Protect People And Environment • Comply With Law • Keep Operations On-Line or Bring Them Back On-Line • Avoid Or Limit Disruption of Lives And Business • Preserve Options and Defenses

4. Common Security Concerns • Site / Buildings • Equipment / Inventory / Supplies • Business Operations • Computer Systems / Proprietary Information

5. Think Outside of the Fence • Security Issues Don’t Just Involve Your Site • Suppliers • Customers • Community / Neighboring Sites • Transportation • Government

6. Where to Start? • Conduct Security Audit • Implement Additional Safeguards • Identify Remaining Security Gaps • Develop Crisis Management Program • Repeat

7. Security Audit and Improvements • Secure Access to Site and Facilities • Identify Threats Posed to Neighboring Properties and People • Determine Potential Threats Posed by: • Employees • Contractors • Vendors • Others (theft, vandalism, etc.) • Evaluate Potential Disruption Posed by Other Entities

8. Identify Remaining Security Gaps • Develop Countermeasures for Known Gaps • Consider Responses to Unanticipated Events • Prepare for Impacts Posed by Disruptions from Other Entities • Develop a Crisis Management Plan

9. Legal Requirements for Emergency Planning • Examples of Potentially Applicable Requirements: • EPCRA • Clean Air Act • Oil Pollution Act • But, These Requirements May Not be Fully Suitable or Adequate for Your Facility’s Needs

10. Developing a Crisis Management Plan – Some Common Tools • Backup Systems • Continuing operations • Suppliers • Computer systems • Personnel Management System • Listing of personnel with information • Role, dates, notes • Document Management System • Bates stamp / scan? • Title, description and dates

11. Developing a Crisis Management Plan – Communications • Establish “Control Group” and Attorney / Client Privilege • Legal, Technical, Business, Governmental Relations • Identify Possible Participants and Audience: • Employees / Unions • Federal, State, Local Agencies and Departments • Residents • Insurers • Contractors / Vendors

12. The Reality During a Crisis • People Want To Help • Unknowns Exist • Confusion Follows (Facts, Roles, Responsibilities) • Mistakes And Misstatements May Be Made • Exhaustion And Frustration Are Enemies • Relationships (Good & Bad) Are Forged

13. More Communication Tools • Practice, Practice, Practice ! • Crisis Room (On-Site / Remote) • Notification, Notification, Notification ! • Government (agencies / emergency responders / elected officials) • Employees • Public • Insurers • Potentially Responsible Parties

14. Communication Protocols • Spokesperson • Control • Message / Theme

15. The Delicate Balance:Control Without Interfering • Information • Access • Personnel • What Procedures? What Policies? • What Counseling? What Debriefing? • Counsel Present Or Remote • Access • Investigative • Vendors • Insurers

16. Hypothetical Scenario • ABC Corp. is a defense contractor • Site is leased from XYZ Realty Trust • Several ASTs located near river • ABC currently has 300 union employees and 100 contractors • Neighboring properties include: • Residences • Private school • Large mall

18. Security / Crisis Management Considerations • Communications • Employment • Business • Environmental • Real Estate • Insurance

19. Security / Crisis Management Considerations: Employment • Background Checks / I-9 Compliance • Employee Training • Electronic Monitoring • Workplace Discrimination • Evacuation Plan • Managing the High Risk Employees

20. Security / Crisis Management Considerations:Business • Business Continuity Plan • Technology • Other Preventive Measures • Technological security • Information security • Audit?

21. Security / Crisis Management Considerations:Environmental • Site Security • Perimeter • Sensitive activities / materials • Control Group / Communications • Coordination with / Training Emergency Responders • Contracts with Critical Service Vendors • Compliance and Practice Audits • SPCC • RMP

22. Security / Crisis Management Considerations:Real Estate • Leased Facilities - Lease Provisions • Owned Facilities • Owned and Leased Facilities • Physical Security • Audit?

23. Security / Crisis Management Considerations:Insurance • Evaluations of Coverages and Limits • Coverages for Contractors • Historic Insurance Information • Familiarity / Comfort with Policies

24. Incident – April 30, 2004

25. Incident – April 30, 2004

26. Incident – April 30, 2004 • photo

27. Post-Incident

28. When and As Possible: Reassurance To The Community • Media – Message / Theme • Initial • Ongoing • Employees • Agencies: DEP, EPA, Police, Fire, Department of Health • Community Leaders – Direct Communication

29. Post-Incident Actions and Investigations • Cause / Responsibility • Operational Needs • Responses from Employees • Responses from Third Parties • Threats of Litigation • Preservation of Evidence

30. Response Considerations • Real Estate • Employment • Environmental • Business • Insurance • Communications / Other

31. Post-Incident Real Estate Considerations • Efforts to Secure Site • Access (into and out of facility) • Site control • First Aid / Response Actions • Efforts to Regain Operations • On-Site / Remote Crisis Center

32. Post-Incident Employment Considerations • Psychological / Grief Counseling • Employee Claims and Internal Support Systems • Regulatory Investigations • Managing the High Risk Employers

33. Post-Incident Environmental Considerations • Perform Internal Investigations and Refine Self-Audit • Confirm Notifications Made • Federal • CERCLA, EPCRA, CAA, and CNA • State • Maintain Credibility and Control • Preserve Critical Evidence • Evaluate Civil and Criminal Exposure

34. Post-Incident Business Considerations • Control Investigations / Subpoenas • Manage Disputes • Monitor / Maintain Morale • Efforts to Regain Operations / Relocate

35. Post-Incident Insurance Considerations • Duties in the Event of Loss • Documenting the Loss • Documentation • Employee time • Business disruption • Hidden costs • Evaluation of Coverages / Damages • Subrogation and Indemnification

36. Closing the Loop • Consider Potential Security Risks Posed to Your Facility • Identify and Implement Security Upgrades • Develop a Crisis Management Plan for Other Risks • Continue to Develop and Implement Crisis Management Plan and Security Upgrades

37. Some More Friendly Persuasion • General Duty Clauses • CAA • OSHA • Pending Federal Legislation • Examples: S. 6, S. 994, S. 157, H.R. 1861, H.B. 2901 • Considerable Alignment / Popular Support • Would generally apply to “stationary sources” under CAA Section 112(r)(2), with substances present above threshold quantities

38. General Scope of Pending Federal Legislation • EPA Would Promulgate Regulations for Implementing Security Measures at “High Priority” Sites • DHS or EPA Would Promulgate Regulations to Require: • Vulnerability assessments • Prevention, preparedness and response plans (every 5 years) • All Bills Include Enforcement and Penalty Provisions • Certain Bills Include Additional Requirements for: • Use of “inherently safer technology” • Implementation of “safer design and maintenance”

39. Questions / Comments ?