ChemLock Exercises – An Overview

Developing a chemical facility security plan is just a time-consuming, compliance exercise until it has been tested. Instead of waiting for a real-world security incident to be the first test of a facility security plan, a smart security team will conduct a variety of exercises to evaluate the efficacy of the plan and the assumptions which drove its development. CISA’s new ChemLock program, a voluntary off-shoot of the successful Chemical Facility Anti-Terrorism Standards (CFATS) program, provides a number of exercise tools that facility security managers can use to plan, execute and evaluate a series of exercises to see how well their facility security plan stands up to a variety of security scenarios.

A War Story

In 1978, I was working in G3 Operations in US Army Berlin/Berlin Brigade. The world was a much different place then and Berlin was an interesting place to be. One of the wide-spread security problems that the world faced at that time was airline hijackings. A variety of terrorist groups around the world were well schooled in hijacking planes and many of the incidents ended in tragedies. USAB had been tasked in developing an Operations Plan for dealing with a hijack at the US controlled Tempelhof Airport in West Berlin.

Early in August of 1978 there was an exercise conducted to evaluate that OpPlan. PanAm supplied an actual airliner. A number of US Army civilian staffers and dependents were recruited to act as passengers and a couple of scruffy looking Special Operations soldiers from Detachment A were selected to perform the role of Palestinian terrorists. The exercise ended with an assault on the aircraft with lots of simulated casualties. A great time was had by all, and a series of meetings were held to evaluate what had happened and what changes needed to be made in the OpPlan.

Unfortunately, while that evaluation was under way, the situation became real. On August 30th, the Emergency Operations Center received a call from the Berlin Air Safety Center informing the EOC that a Polish airliner had been hijacked and was enroute to Tempelhof. The OpPlan was activated and a team from the EOC (myself included) was dispatched to Tempelhof to control the operation. The operation was a fiasco for all sorts of geopolitical reasons, but the soldiers and airmen on the ground performed their duties that day well, in large part because of the exercise that had been conducted earlier that month.

ChemLock Exercise Web Page

This page is the starting point for exercise planning and development. Most of (okay maybe all, but I am not sure about that) the information here was not specifically developed by the CISA Office of Chemical Security (the folks that manage the CFATS program), but rather by the wider range of offices within CISA and DHS.

There are two general options provided on this page. The first (and easiest) is a series of canned CISA Tabletop Exercises Package (CTEP). The CTEPs are no-cost to download and include the scenario-specific situation manual, planner handbook, facilitator/evaluator handbook, and assorted forms and templates. The second option is to contact the ChemLock folks to ask for assistance in planning and executing an exercise. That option is initiated by the use of the same  ChemLock Services Request Form that I have mentioned in a number of earlier posts.

CTEPS

The CTEP exercise support comes in two parts. First, the documentation and templates necessary for running these exercises. Those are found on the CTEP page. These administrative aids can be used to support multiple exercises. The detailed scenario information for the various chemical-facility-specific exercises are found on the ChemLock Exercise page. They currently include:

• Chemical Security Active Shooter,

• Chemical Security Active Threat,

• Chemical Security Civil Unrest,

• Chemical Security Complex Coordinated Attack,

• Chemical Security Domestic Threat,

• Chemical Security Drone (Unmanned Aerial System [UAS]),

• Chemical Security Edged Weapon,

• Chemical Security Fire as a Weapon,

• Chemical Security Improvised Explosive Device (IED),

• Chemical Security Vehicle-Borne IED (VBIED), and

• Chemical Security Vehicle Ramming

Additional scenarios are listed on CISA’s Physical Security Scenario’s web page.

Who Should Participate?

Tabletop exercises are generally used to look at coordination and response activities. Ultimately, this means that facility management down to first line supervisors should be included in these exercises. The first time that an exercise is run, it is usually a good idea to limit participation to four or five key personnel. Once the major bugs are worked out at that level, then the same scenario should be run with the full management/supervision team.

At some point facility management is going to need to try to include outsiders in these exercises. If there is potential for off-site consequences, or the facility is going to need off-site support to respond, then outside agencies are going to have to be represented in exercises. But, before you bring in the police and fire department, try to have the internal problems worked out first.

Which Exercise?

In a perfect world, every facility would run every exercise as routine part of operations. Obviously, that is not going to happen in the real world. If a facility has never run an exercise of this sort, it is probably best to concentrate on one exercise and run it through a couple of iterations before trying to determine what sort of ‘exercise schedule’ will be appropriate for the facility.

I will be looking at individual exercise packages in future posts, but each facility is going to have to determine which exercise would be the most appropriate to start with. Facilities are going to want to start with something simple, but something that is a real potential threat at that facility. For example, a vehicle borne explosive device is probably not a serious threat at a facility that does not have significant inventories of toxic inhalation hazard chemicals on site unless an attacker has a particular issue with the facility.

Remember, though, the whole purpose of the ChemLock program is to help chemical facilities solve their security issues. The folks at OCS have offered to provide that assistance. So, facilities should contact the ChemLock folks with their questions about these exercise programs. Questions should be addressed via email to ChemLock@cisa.dhs.gov.