Railway Safety Act (1989) Consultation

Transcription

1 2007 Railway Safety Act (1989) Consultation Len Babin, CPP Primoris Associates Inc., Calgary, AB 1/16/2007

2 Railway Safety Act Review Secretariat 180 Elgin Street, Suite 901 Ottawa, Ontario K2P 2K3 April 16, 2007 Comments Submitted on the Occasion of the Railway Safety Act (1989) Consultation at Calgary, Alberta on April 23, 2007 By Primoris Associates Inc. Contact: Mr. Len Babin Telephone: (403) P a g e

3 Abstract: The Canadian Railway System is a vast apparatus which is by its nature difficult to protect. Though it has largely been unscathed by the escalation in terrorist acts beginning in the middle of the 20 th century, in is not acceptable to deny the threat in Canada. This paper abets a more global perspective of the security of Canadian rail transportation systems while proposing a paradigm shift towards holistic security. The challenge for railways is to move beyond the notion that safety issues are the greatest concern. Today s reality would suggest otherwise. The safety paradigm may be obscuring the true threat. Protective measures that reflect the global threat and are based on classical security basics and cooperation will win the day. While no physical system is immune to attack and none are invincible, the old security adage that criminals will move on to softer targets is highly applicable here. Canadian rail systems must be made harder targets for criminals, vandals, and terrorists. One of the most effective ways of doing this is the creation of a comprehensive security framework and cooperation among all participants, regardless of affiliation. Primoris Associates Inc. Primoris Associates Incorporated is a foremost corporate security company in Alberta, Canada with a national/international international focus. Specializing in corporate security frameworks, awareness and training, and international security and justice support, we serve the corporate and government community locally and internationally. We are currently delivering the Alberta Counterterrorism Crisis Management Plan ACTCMP and NERC CIP International Cyber Security Standard in the electricity industry. Our principal consultant, Mr. Len Babin, CPP, is a highly qualified security professional who participated in the creation of the Government of Canada s Office of Critical Infrastructure and Emergency Preparedness (OCIPEP), now PSEPC P a g e

4 Introduction July 29: Basque ETA members bomb two railway stations in Madrid, killing seven August 2: Strage di Bologna: A terrorist bombing at the railway station in Bologna, Italy kills 85 people and wounds more than October 9: An Amtrak Sunset Limited train is derailed by antigovernment saboteurs near Palo Verde, Arizona. One person is killed and 78 are injured March 20: Sarin gas attack on the Tokyo subway by AUM Shinrikyo cultists kills twelve people and injures March 4: The Real IRA exploded a car bomb outside the BBC's main news centre in London. One London Underground worker suffered deep cuts to his eye from flying glass and some damage was caused to the front of the building May 13: Twelve people are killed in the Jaunpur train crash in India, caused when Islamic extremists cut the rails September 10: A train derailment in India kills 130 people in the Rafiganj rail disaster. Naxalite terrorism is suspected December 21: Kurnool train crash, Islamic extremists derail a train and kill 20 people in India March 11: Coordinated bombing of commuter trains in Madrid, Spain, kills 191 people and injures more than 1,500. Suspected Al-Qaeda authorship August 28: Shahawar Matin Siraj and James Elshafay are arrested for planning to bomb the 34th Street Herald Square subway station in New York City during the 2004 Republican National Convention August 31: A blast near a subway station entrance in northern Moscow, caused by a suicide bomber, kills ten people and injures July 7: London bombings Bombs explode on one double-decker bus and three London Underground trains, killing 56 people and injuring over 700, occurring on the first day of the 31st G8 Conference. The attacks are the first suicide bombings in Western Europe July 21: Attempted London bombings - Small explosions in three London Underground stations and one double-decker bus. This was pronounced as a "major incident" rather than an attack, and only minor injuries were reported. These four bombs were designed to cause as much damage as the 7 July 2005 London bombings, but the explosives had deteriorated and failed to detonate July 28: Jaunpur train bombing: 13 are killed when militants detonate a bomb on a commuter train in India P a g e

5 July 11: A series of explosions rock commuter trains in Mumbai, India, killing 209 and wounding another 714 civilians July 31: Two suitcase bombs are discovered in trains near the German towns of Dortmund and Koblenz, undetonated due to an assembly error February 19: Two bombs explode aboard the Samjhauta Express, a train headed toward Lahore, Pakistan, hour after it left New Delhi. 68 people died in the incident. 1 Security: New Reality = New Paradigm It is clear from the record of attacks throughout the world events which have disrupted rail systems and lives in various countries will come to Canada. What is equally clear is that rail systems are very difficult to protect due to their very nature. This new reality would seem to make accomplishing effective security insurmountable. The evolution of industrial safety and security in this country has played out in the same way in most industries. At the beginning of the industrialization of our country, the most pressing concern in industrial operations became safety. Though it took a while for this to be dealt with and formalized, safety systems have evolved to advanced levels in the civilized world. The same cannot be said for security. Failing to follow safety rules generally has an immediate and direct impact on daily operations. Employees who do not perform properly or who do not adequately protect themselves die on the job daily. Rules that are not followed cause spectacular accidents when heavy machinery is involved. Security, on the other hand is not as easy to define, not as easy to see, and not as easy to put into effect. In addition to these challenges of implementing security, the security situation has continued to change, not merely involving, but changing in a radical way. While all industry is globalizing through advanced communications and transportation, terrorism is also globalizing. It is folly to think of the threat as being over there. There are as many definitions of terrorism as the agencies which have been created to combat it. I offer you this one, from the U.S. Department of Defense: "the unlawful use of or threatened use of force or violence against individuals or property to coerce or intimidate governments or societies, often to achieve political, religious, or ideological objectives." 1 Entire section with sources from Wikipedia P a g e

6 In the mid-twentieth century when terrorism began to appear on our society s radar, a typical terrorist event might be a hijacked airliner or carefully placed bomb. However, globalization has changed all this. The mindset of terrorists has become global. Evidence of this is all around us and I will not try to make that case here. If one accepts that terrorists have a global reach, one must ask a question how terrorists determine which target to attack. Since terrorism is a crime, the theories emanating from a study of crime apply equally well. One of the classic theories in criminology is the theory of how crimes are committed. This is often represented in a crime triangle. Though there are many variations on the idea, a basic crime triangle is depicted as follows. 2 In this model, all three elements must be present for a crime to be committed. Like the components required for fire, the removal of air, ignition or fuel means there will be no fire. A major analysis is not required at this juncture of whether terrorists have the desire, the ability, and the opportunity to commit terrorism on Canadian soil. The record of terrorist activity clearly demonstrates they have these three elements to attack key structures in our country. Only one of these three elements is completely within our control: opportunity. With broad, coordinated, all-encompassing security systems, we can significantly diminish the opportunity of a terrorist to attack our rail systems. 2 Brockton Police Department P a g e

7 Then, to come back to the question of how terrorists select targets, the answer is simple. Like all criminals, they select the easiest target. A car thief who sees a complex car alarm will generally not try his skill on that vehicle for he knows there are hundreds in the nearby vicinity which will be easier marks. The same is true of the terrorist. The Canadian Rail Structure A Threat Assessment Canadian rail systems are unique in the world. Covering vast expanses of uninhabited territory, crossing the largest undefended border in the world, and carrying important commodities to a neighbor who is a world power and who has been at the center of global strife for the past number of years, Canadian rail systems have enjoyed a remarkably trouble free operation. One of the foundation principles of security is that all security is applied based on the threat and risk which is present in the operating environment. For example, some might say that it is a good idea to build a dike around a house to prevent floodwater from entering. However, whether that house is on a hill on the Canadian prairie or in the Red River Valley of Manitoba makes the difference in the appropriateness of such an investment. One determines that appropriateness by doing a threat and risk assessment. This assessment would very quickly indicate that the homeowner on the prairie is wasting his or her money by such an investment. The same threat and risk assessments must drive all security measures for them to be economical and effective. If I may offer the committee a rudimentary threat/risk assessment of Canadian rail system, I would say the following: 1. Terrorists are motivated to make a bold statement by making an extensive impact on very visible targets. A major attack on our vast Canadian rail system, a key component of our just-in-time economy, would make such an impact. It would also be a warning to the U.S. 2. When the nature of an infrastructure is such that it is impossible to completely protect, typically the protection approach is to be capable of rebuilding it in short order. The bulk electricity system in our country faces the same challenge and uses this approach (among others). The difference with the rail system is that attacks or accidents often cannot simply be remedied by rebuilding an infrastructure, even though this must be part of the plan. 3. The U.S. is a major world target of terrorism. If the target is not directly accessible, often indirectly accessing it by attacking its dependencies can P a g e

8 have a similar effect. An attack on the Canadian rail system could greatly affect our trading partner to the south thereby accomplishing terrorist goals. 4. One other approach for creating security in large infrastructures is a concept called devaluation. In devaluation, industry does not depend only on one major structure but it may build several structures that are capable of performing the same function. In the case of the Canadian railway system, the presence of some 45 operators works, on one hand, to advantage by creating devaluation but on the other hand security cannot be assured at the same level across the 45 companies. 5. Security whether about physical or information technology, concerns itself with protective perimeters. Typically perimeters are three-dimensional: internal, external, and service access. Who has recorded the protective perimeters of the Canadian Railway System? How, then, are they defended? CSO model One of the most effective ways to assure corporate security is to manage security for all corporate functions centrally. Typically, this is called the Chief Security Officer Model. In this model, all things that are pure security (personnel, physical, and information technology) as well as things that are security-like but don t fall into the pure disciplines (critical infrastructure protection, business continuity planning, workplace health and safety, training and awareness programs, and auditing) are centralized under one position in the company. This ensures a number of things: 1. All security expenditures will be based on a global plan that fits with the company s business plan. 2. A global threat and risk assessment is performed on all functions of the organization and used as the basis for applying security. 3. Like a corporate mission statement, security mission, policies, and guidelines can be developed and applied across the organization. 4. Security plays an important role in breaking down silos by having everyone participate in their own security. 5. Most importantly, all security activities can now a based on a security plan. Whether it involves applying security mechanisms, incident response, or recovery, action governed centrally is more effective P a g e

9 An Approach for the Canadian System The vastness and the variety of companies which exist in the Canadian system would make a central approach challenging. However, while the status quo continues to exist, the Canadian rail system is vulnerable and cannot be defended effectively. Additionally, it should not only be left to the companies operating the railroads to defend themselves based on government policies. In the policing world, police work with other partners and with citizens to make communities safer. This same paradigm can be extended to railroad operations in Canada by building partnerships with various levels of government and with citizens. Watch programs for key infrastructure would make a meaningful contribution to railway security and Canada. Training and awareness programs for employees, citizens, and governments, would also provide a level of assurance. While anyone could propose similar ideas, little success in protecting the national system will be achieved without doing a national threat and risk assessment and considering the rail system as a whole. This would involve a team of experts that understands the railway system and international threat. The most important feature of what is proposed here is that all partners need to be involved. The benefit of involving everyone is that not only will you encounter experts from the smaller lines that the needs of the smaller players will also be identified. Each participant should be made to feel equal in this endeavor and the protective mechanisms indicated should be applied equally across all the partners as indicated by the threat and risk assessment. Recommendations 1. The Railway Safety Act should be amended to include provisions for a national threat and risk assessment to all of its significant parts. 2. Security work on Canada s rail systems must be all-inclusive to bring together existing expertise and to share knowledge. 3. While operational safety will always maintain its place, the emphasis must now shift toward security holistic enterprise security. The only effective way to accomplish this is through a comprehensive security framework. 4. Training and awareness, not related to operational safety but related to the new security paradigm, must be delivered to all participants. This is the only way to engage in everyone in making security measures effective. 5. Everyone must continue to be vigilant against the human inclination to respond to security events without planning. An It has never happened P a g e

10 Summary here. or We re not the target. attitude must be eliminated as it will not lead to true security. It may seem like an obvious statement to say that the Canadian rail system is vulnerable due to its sheer vastness and the daily access which members of the public must have. However, as in many complex problems, solutions are often found in systematic approaches which involve broad cooperation. In a nutshell, this paper proposes that the basic concepts of security should be applied to the Canadian rail system. In essence, a global approach that defines perimeters based on a threat/risk assessment and which breaks down stovepipes and internal boundaries will be effective. No single approach can be effective. Governments and legislators must make a contribution which permits and encourages cooperation among all entities. Our future depends on it P a g e