5
Managing Risk

As seen from the discussion in the previous chapters, and as demonstrated in the scenarios presented in Chapter 4, social factors can be as important as technical factors in determining the preparedness for and consequences of a deliberate disruption of the chemical infrastructure. This chapter presents a model of disaster impacts and discusses risk perception, interdependent security, and consequent decision making from the individual chemical plant to broader societal impacts. These concepts are useful to develop strategies for managing the vulnerabilities presented by the chemical infrastructure in a cost-effective manner. They point to management of emergency planning and response, and communication and social response, as important factors in reducing the likelihood that the consequences of an event will reach catastrophic proportions.

SOCIETAL IMPACTS OF HAZARDOUS INCIDENTS

Research conducted over the past 50 years has yielded a broad understanding of the process by which hazardous incidents affect local communities and the larger social units of which they are a part.1 Hazardous inci-

1  

(a) Cutter, S.L. 1996. Vulnerability to environmental hazards. Progress in Human Geography 20:529-539; (b) Lindell, M.K., and C.S. Prater. 2003. Assessing community impacts of natural disasters. Natural Hazards Review 4:176-185; (c) Mileti, D.S. 1999. Disasters by Design. Washington, DC: Joseph Henry Press; (d) Lindell, M.K., C.S. Prater, and R.W.



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities 5 Managing Risk As seen from the discussion in the previous chapters, and as demonstrated in the scenarios presented in Chapter 4, social factors can be as important as technical factors in determining the preparedness for and consequences of a deliberate disruption of the chemical infrastructure. This chapter presents a model of disaster impacts and discusses risk perception, interdependent security, and consequent decision making from the individual chemical plant to broader societal impacts. These concepts are useful to develop strategies for managing the vulnerabilities presented by the chemical infrastructure in a cost-effective manner. They point to management of emergency planning and response, and communication and social response, as important factors in reducing the likelihood that the consequences of an event will reach catastrophic proportions. SOCIETAL IMPACTS OF HAZARDOUS INCIDENTS Research conducted over the past 50 years has yielded a broad understanding of the process by which hazardous incidents affect local communities and the larger social units of which they are a part.1 Hazardous inci- 1   (a) Cutter, S.L. 1996. Vulnerability to environmental hazards. Progress in Human Geography 20:529-539; (b) Lindell, M.K., and C.S. Prater. 2003. Assessing community impacts of natural disasters. Natural Hazards Review 4:176-185; (c) Mileti, D.S. 1999. Disasters by Design. Washington, DC: Joseph Henry Press; (d) Lindell, M.K., C.S. Prater, and R.W.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities dents are events that are perceived by some segments of society as producing unacceptable impacts or as indicating the danger that such impacts might occur in the future. These incidents do not necessarily produce large numbers of casualties or damage, but they can result in a societal response disproportionate to the risks involved, relative to that posed by natural disasters, such as earthquakes and hurricanes. A Model of Disaster Impacts There are many apparent contradictions in the societal management of risk that can be explained (although far from perfectly) by recent models of disaster impacts2 and the social amplification or attenuation of risk.3 One model, the Disasters Impact Model (DIM) shown in Figure 5.1, describes the determinants of disaster consequences. The effects of hazardous incidents are determined in part by three pre-impact conditions: (a) hazard exposure, (b) physical vulnerability, and (c) social vulnerability. When a hazardous incident occurs, it is subject to event-specific (d) hazardous incident characteristics that combine with the pre-impact conditions to produce (e) physical impacts. In turn, these physical impacts cause (f) social impacts. However, the physical impacts can be reduced by (g) improvised emergency response, and the social impacts can be reduced by (h) improvised disaster recovery activities. In addition, the impacts of the incident can be further reduced by means of pre-impact hazard planning and management actions such as (i) hazard mitigation practices and (j) emergency preparedness practices that reduce the physical impacts and (k) recovery preparedness practices that reduce the social impacts. Some shortcomings must be kept in mind when applying the DIM to the chemical sector:     Perry. In press. Emergency Management Principles and Practices. Hoboken, NJ: John Wiley and Sons. 2   Lindell, M.K., and C.S. Prater. 2003. Assessing community impacts of natural disasters. Natural Hazards Review 4:176-185. 3   (a) Kasperson, J.X., R.E. Kasperson, N. Pidgeon, and P. Slovic. 2003. The social amplification of risk: Assessing fifteen years of research and theory. in N. Pidgeon, R.E Kasperson, and P. Slovic (eds.), The Social Amplification of Risk. New York: Cambridge University Press, pp.13-46; (b) Kasperson, R.E., O. Renn, P. Slovic, H.S. Brown, J. Emel, R. Goble, J.X. Kasperson, and S.J. Ratick. 1988. The social amplification of risk: A conceptual framework. Risk Analysis 8:178-187.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities FIGURE 5.1 The Disasters Impact Model: a model of hazardous incident impacts. SOURCE: Federal Emergency Management Agency. Introduction to Emergency Management Textbook. Available at http://training.fema.gov/EMIWeb/edu/introtoEM.asp. The effects and relationships displayed in the DIM are not linear or unidirectional as shown. There are interdependencies and interactions among and between these components. There are many complexities within the model and interaction may occur within components not depicted in the figure. The DIM, which was developed from findings of research on natural hazards, can best be applied to chemical incidents that have a well-defined geographic impact area, such as the release of hazardous materials from a fixed site or in transport. To date there has been no research to confirm that the DIM can be applied to incidents lacking a well-defined geographic impact area, such as chemical contamination of food or pharmaceuticals. The DIM lacks analytic methods for assessing remote downstream supply chain impacts of the destruction of a single facility or small group of facilities. Nonetheless, some useful general conclusions can be drawn from the DIM. The following sections describe the components of the DIM in greater detail.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities Pre-impact Conditions Pre-impact conditions play a large role in determining the consequences of a hazardous event. Hazard exposure refers to the geographical areas that could be affected by the impact of a hazardous incident. For example, the areas around chemical facilities and their transportation routes can be mapped to identify the locations, known as vulnerable zones, where dangerous levels of chemical exposures could occur if some or all of the contents of a chemical container were released.4 There are 9 categories of hazardous materials listed by the Department of Transportation,5 which include explosives, gases, flammable liquids, flammable solids, oxidizers and organic peroxides, toxic (poisonous) materials and infectious substances, radioactive materials, corrosive materials, and miscellaneous dangerous goods. Only a few of these are sufficiently dangerous, stored or shipped in large enough quantities, or located close enough to populated areas to produce direct damage or large numbers of casualties. Many of these chemicals have been identified as extremely hazardous substances (EHSs) in accordance with the requirements of Section 312 of the Emergency Planning and Community Right to Know Act of 1986 or Section 112(r) of the Clean Air Act Amendments of 1992. In most communities, vulnerable zones have been estimated using the U.S. Environmental Protection Agency’s (EPA’s) Risk Management Plan (RMP) estimates required by the Clean Air Act Amendments. Vulnerable zones are areas around a facility in which people could, but would not necessarily, be exposed to harm by a worst-case event. The portion of the vulnerable zone impacted in an actual event is dependent upon factors such as meteorological conditions, wind speed, wind direction, et cetera, and is expected to be some fraction of the total vulnerable zone. Therefore the number of people exposed in an actual event would be lower than the total number of people living in the vulnerable zone. Physical vulnerability refers to the susceptibility of persons and structures to the impacts of a hazardous incident. In the case of hazards to per- 4   U.S. Environmental Protection Agency, Federal Emergency Management Agency, and U.S. Department of Transportation. 1987. Technical Guidance for Hazards Analysis. Washington, DC. 5   Department of Transportation, Transport Canada, and Secretariat of Transport and Communications. 2000. Emergency Response Guidebook. Washington, DC.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities sons, this means deaths, injuries, or illnesses from extreme temperatures, blast pressures, and toxic chemicals. In the case of structures, physical vulnerability usually means susceptibility to damage from fire and blast, but structures can also be vulnerable to toxic chemicals if the materials from which they are constructed are reactive with the chemicals involved or are difficult to decontaminate. Social vulnerability can be characterized as people’s inability to anticipate, avoid, respond to, or recover from hazard impacts.6 Thus, social vulnerability addresses the degree to which people lack information about hazards; are located close to hazard sources; live or work in buildings having low hazard resistance; have little or no access to warnings, training on how to respond, evacuation transportation, and shelter locations; and have limited assets to support recovery from disaster impacts. Social vulnerability is determined in part by the state of a community’s emergency preparedness.7 In many cases, households’ social vulnerability is systematically related to demographic characteristics such as gender, age, education, income, and ethnicity. Event-Specific Conditions In addition to existing pre-impact conditions, the consequences of an actual event will depend upon event-specific conditions—those unique conditions that obtain at the time of the event. Hazardous Incident Characteristics. These include the availability of environmental cues, speed of hazard onset, scope of hazard impact, and duration of hazard impact.8 When hazardous incidents occur infrequently, with rapid onset, no environmental cues, large scope of impact, and long duration, it is difficult for households and local governments to improvise a 6   Blaikie, P., T. Cannon, I. Davis, and B. Wisner. 2004. At Risk: Natural Hazards, People’s Vulnerability and Disasters, 2nd edition. New York: Rutledge. 7   To address some of the issues of a vulnerable population such as community preparedness, risk perception, and the community’s overall response to terrorism, the Department of Homeland Security has sponsored the National Consortium for the Study of Terrorism and Responses to Terrorism (START) at the University of Maryland. See the following web site for more information: http://www.start.umd.edu/. 8   (a) Dynes, R.R. 1974. Organized Behavior in Disaster. Columbus, OH: Ohio State University Disaster Research Center; (b) Lindell, M.K. 1994. Perceived characteristics of environmental hazards. International Journal of Mass Emergencies and Disasters 12:303-326.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities successful emergency response. Although these conditions apply most directly to the storage and transportation scenarios, they also seem quite relevant to the chemical shortage and chemical misuse scenarios, as well. Improvised Emergency Response. When an incident occurs, the emergency response organization must perform four basic functions: emergency assessment, expedient hazard mitigation, population protection, and incident management.9 Emergency assessment consists of those diagnoses of past and present conditions and prognoses of future conditions that guide the emergency response. Expedient hazard mitigation refers to actions that emergency personnel take to limit the magnitude of the disaster’s impact (e.g., sandbagging a flooding river, patching a leaking railroad tank car). Population protection refers to actions—such as sheltering-in-place, evacuation, and mass immunization—that protect people from hazardous agents. Incident management consists of the activities by which the human and physical resources used to respond to the emergency are mobilized and directed to accomplish the goals of the emergency response organization. As discussed further below, emergency response personnel increasingly use emergency preparedness practices such as planning, training, equipping, and exercising to guide their emergency response. However, emergency response personnel may have to improvise emergency response actions for one of two reasons. First, they might implement maladaptive actions because they have inadequate plans, training, facilities, equipment, or materials. Second, they might implement adaptive actions because they recognize that specific characteristics of an incident require actions that differ from those prescribed by emergency operations plans and procedures. Improvised Disaster Recovery. During disaster recovery, the recovery organization must perform five basic functions: disaster assessment, debris clearance, resource management, physical reconstruction, and business resumption. Disaster assessment involves evaluating damage and casualties, and debris clearance involves removing damaged infrastructure, structures, contents, and vehicles. Resource management involves controlling the flow of personnel, equipment, and materials into the impact area, and physical reconstruction involves rebuilding or replacing damaged infrastructure, structures, contents, and vehicles. Finally, business resumption involves re- 9   (a) Lindell, M.K., and R.W. Perry. 1992. Behavioral Foundations of Community Emergency Planning. Washington, DC: Hemisphere; (b) Lindell, M.K., C.S. Prater, and R.W. Perry. in press. Emergency Management Principles and Practices. Hoboken, NJ: Wiley.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities establishing links to employees, suppliers, distributors, and customers. In scenarios lacking a specific incident scene—the chemical shortage and misuse scenarios—there is no physical damage, so debris clearance and physical reconstruction will not take place. However, disaster assessment, resource management, and business resumption will still be needed. As is the case with improvised emergency response, improvised disaster recovery can be necessary because of inadequate recovery preparedness or because recovery personnel recognize distinctive characteristics of an incident that indicate a need to deviate from the pre-impact recovery plan. Pre-impact Hazard Management Actions Communities are best able to protect themselves from low-probability, high-consequence incidents by engaging in three pre-impact hazard management interventions—hazard mitigation, emergency preparedness, and recovery preparedness—to reduce the physical and social impacts of hazardous incidents. Hazard mitigation practices provide passive protection to persons and property at the time an incident occurs, whereas emergency preparedness practices develop the resources needed to support an active emergency response. Recovery preparedness practices provide the financial and material resources needed to reestablish normal patterns of social and economic functioning after an incident has been stabilized. More specifically, hazard mitigation practices include hazard source control activities to prevent chemical releases, land use practices to limit the number and types of structures and persons that are exposed to a hazard, and building construction practices to prevent damage and casualties. For chemicals, hazard source control includes process design, facility construction materials, and operation and maintenance practices that reduce the probability of an incident. Hazard source control also includes flare towers, water curtains, or other devices that would reduce the magnitude of the impacts if an incident occurred.10 Land use practices include siting hazardous chemical facilities away from densely populated areas or locations of special facilities such as schools, nursing homes, or hospitals.11 Appropriate land use practices also include limiting residential and commercial con- 10   Prugh, R.W., and R.W. Johnson. 1998. Guidelines for Vapor Release Mitigation. New York: American Institute of Chemical Engineers Center for Chemical Process Safety. 11   Lindell, M.K. 2006. Hazardous materials. In American Planning Association, Planning and Urban Design Standards. New York: John Wiley & Sons. pp. 168-170.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities struction and the siting of special facilities within the vulnerable zones of hazardous chemical facilities. Finally, building construction practices ensure that residential and commercial structures located close to hazardous chemical facilities can withstand the forces of fires and explosions and can resist the infiltration of contaminated air from releases of toxic or flammable gases. Emergency preparedness practices develop the resources needed to support an active emergency response. These involve the development of emergency response plans, procedures, and training programs, the acquisition of facilities, equipment, and materials likely to be needed to support an emergency response; and the performance of drills and exercises to test the emergency response organization.12 To support the emergency assessment function, facilities, carriers, and local jurisdictions must develop the capability to promptly and accurately detect a chemical threat and to project its potential impact area to identify areas that require population protection actions. Consumer product and pharmaceutical producers and public health departments must have a prompt detection capability and an ability to carry out a response such as product recall in the event of contamination. To support the expedient hazard mitigation function, there must be an ability to control leaks, spills, and fires, to stabilize containers;13 and to quickly repair damaged production systems. To support the population protection function, it is necessary to have a capability for protective action decision making, population warning, protective action implementation (e.g., evacuation traffic management and evacuation transportation support, sheltering-in-place, use of alternative products, recall and collection of possible contaminated product), search and rescue, and transportation and treatment of the injured.14 To support the incident management function, there must be a capability to activate emergency response organiza- 12   Lindell, M.K., and R.W. Perry. in press. Onsite and offsite emergency preparedness for chemical facilities and chemical transportation. In S. Lee. (ed.) Encyclopedia of Chemical Processes. New York: Marcel Dekker. 13   Lesak, D.M. 1999. Hazardous Materials: Strategies and Tactics. Upper Saddle River NJ: Prentice-Hall. 14   (a) Lindell, M.K., and R.W. Perry. 1992. Behavioral Foundations of Community Emergency Planning. Washington, DC: Hemisphere Press; (b) Lindell, M.K., and R.W. Perry. in press. Planning and preparedness. In K.J. Tierney and W.F. Waugh, Jr. (eds.) Emergency Management: Principles and Practice for Local Government, 2nd Edition.. Washington, DC: International City/County Management Association.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities tions, coordinate and document their activities, acquire additional resources, and communicate with the public. Recovery preparedness practices provide the financial and material resources necessary to reestablish normal patterns of social and economic functioning after an event has been stabilized. These involve establishing pre-impact recovery organizations comprising representatives of all organizations that would participate in an actual disaster recovery, as well as developing a recovery plan that establishes the structure of the disaster recovery organization. In addition, recovery preparedness also involves the development of procedures to guide damage assessment; debris clearance (contamination cleanup in the case of persistent chemicals); resource management; physical reconstruction of infrastructure and residential, commercial, and industrial buildings; and business resumption. Finally, recovery preparedness also includes procedures for integrating hazard mitigation into the recovery process. This latter step ensures that the affected community is less vulnerable to future incidents.15 Hazardous Incident Impacts The principal physical impacts of a hazardous incident are casualties and damage, each of which can be caused by a primary hazard (e.g., an explosion or toxic release) or a secondary hazard (e.g., a toxic chemical release caused by an explosion as described in the high-volume scenario in Chapter 4). In addition to the direct casualties and damage caused by the primary and secondary hazards, there can be indirect physical impacts. For example, the destruction of a chemical plant that is the sole producer of a nonsubstitutable commodity could have the indirect effect of suspending production of all downstream products. The social impacts of a hazardous incident can be classified as psychological, demographic, economic, and political.16 Psychological impacts can be categorized as emotional, cognitive, and behavioral. Emotional impacts include such negative manifestations as depression and post traumatic stress 15   Schwab, J., K.C. Topping, C.C. Eadie, R.E. Deyle, and R.A. Smith. 1998. Planning for Post-disaster Recovery and Reconstruction. PAS Report 483/484. Chicago IL: American Planning Association. 16   Lindell, M.K., and C.S. Prater. 2003. Assessing community impacts of natural disasters. Natural Hazards Review 4:176-185.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities disorder but can also include positive manifestations such as a sense of community identification from helping to save the lives and property of others.17 Cognitive impacts are most likely to be changes in people’s perceptions of hazard exposure, hazard impact characteristics, personal consequences of hazard exposure, and characteristics of alternative protective actions.18 Behavioral impacts include changes in people’s daily activities such as work, education, recreation, social interaction, and basic functions such as eating and sleeping.19 A principal focus of the DIM is on the ways in which physical impacts such as casualties and damage cause social impacts through the direct experience of the impact area population. However, some of those in the impact area do not experience damage or casualties, and this is also true for the entire population outside the impact area. Unlike direct experience, which occurs when people are themselves casualties or experience damage to their own property, vicarious experience occurs when people learn about casualties or damage experienced by others. Direct experience has a very powerful effect on people’s beliefs and behavior, but it generally happens to a relatively small proportion of the population. By contrast, vicarious experience has a weaker effect on people’s beliefs and behavior than direct experience, but can affect a much larger proportion of the population. Demographic impacts are defined by changes in the population of the impact area including births, deaths, and migration (e.g., in- and out-migration).20 Economic impacts are defined by the changes in employment for households or profitability for businesses.21 In many cases, “losers” are counterbalanced by “winners” at the local level. For example, one 17   Kaniasty, K., and F. Norris. 1999. The experience of disaster: Individuals and communities sharing trauma. Pp. 25-61 in R. Gist and B. Lubin (eds.) Response to Disaster: Psychosocial, Community and Ecological Approaches. Philadelphia, PA: Brunner/Mazel. 18   Lindell, M.K., and R.W. Perry. 2004. Communicating Environmental Risk in Multiethnic Communities. Thousand Oaks, CA: Sage. 19   Houts, P.S., P.D. Cleary, and T.W. Hu. 1988. The Three Mile Island Crisis: Psychological, Social and Economic Impacts on the Surrounding Population. University Park, PA: Pennsylvania State University Press. 20   Smith, S.K., J. Tayman, and D.A. Swanson. 2001. State and Local Population Projections: Methodology and Analysis, New York: Kluwer. 21   Zhang, Y., M.K. Lindell, and C.S. Prater. 2004. Modeling and managing the vulnerability of community businesses to environmental disasters. Paper presented at the Association of Collegiate Schools of Planning.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities business’s inability to supply its products to customers can mean additional revenues for its competitors; money that victims spend on rebuilding their damaged homes generates revenues for construction companies. Thus, some of what appear to be economic losses are in fact only economic shifts. Political impacts include the enactment of regulations and legislation.22 Opportunities to Improve Hazard Management The above discussion of the Disaster Impacts Model suggests a number of areas in which research investments can significantly improve the nation’s ability to manage the vulnerabilities to and consequences of terrorist attack or other catastrophic disruption of the chemical infrastructure. Investments in hazard or vulnerability analysis for the storage and transportation scenarios can provide the information on pre-impact conditions that is needed to identify locations with the greatest hazard exposure, structures with the greatest physical vulnerability and population segments with the greatest social vulnerability. Investments in pre-impact hazard management actions can provide better ways to reduce vulnerability before an incident occurs (hazard mitigation), respond effectively when an incident does occur (emergency response preparedness), and recover rapidly after an incident has been terminated (recovery preparedness). The development and implementation of effective pre-impact hazard management actions can significantly reduce reliance on improvised emergency response and improvised disaster recovery actions. Hazard or Vulnerability Analysis for the Storage and Transportation Scenarios The Federal Emergency Management Agency23 recommends that community emergency operations plans (EOPs) be based on an explicit statement of situation and assumptions derived from hazard and vulnerability analyses and should also have hazard-specific appendixes that address any distinctive disaster demands imposed by specific hazard agents. However, no one has examined whether EOPs do contain appendixes for the 22   Prater, C.S., and M.K. Lindell. 2000. The politics of hazard mitigation. Natural Hazards Review 1:73-82. 23   Federal Emergency Management Agency. 1996. Guide for All Hazard Emergency Operations Planning. SLG-101. Washington, DC.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities training has addressed the coordination of individual efforts, distribution of workload, and selection of task performance strategies.49 None of this research has addressed the Incident Command System as defined by the National Wildfire Coordinating Group (1994)50 or the Incident Management System. Federal development and dissemination of the National Incident Management System51 makes it essential to examine the ways in which training research can be adapted to the needs of chemical emergency response. Drills, Exercises, and Incident Critiques. Federal agencies have provided guidance on drills, exercises, and incident critiques52 that appears to be derived from practitioner experience. However, there appears to be no scientific research on emergency response organizations’ performance of these tasks. This is unfortunate because there is relevant research on individual and team training that is relevant to this problem. For example, Hackman and Wageman (2005)53 proposed a model of team coaching that contains 49   (a) Arthur, W., Jr., B.D. Edwards, S.T. Bell, A.J. Villado, and W. Bennett, Jr. In press. Team task analysis: Identifying tasks and jobs that are team based. Human Factors; (b) Campbell, J.P., and N.R. Kuncel. 2002. Individual and team training. In N. Anderson, D.S. Ones, H.K. Sinangil, and C. Viswesvaran (eds.) Handbook of Industrial, Work and Organizational Psychology. Thousand Oaks, CA:Sage. pp.278-312; (c) Guzzo, R.A., and M.W. Dickson. 1996. Teams in organizations: Recent research on performance and effectiveness. Annual Review of Psychology 47:307-338; (d) Hollenbeck, J.R., D.R. Ilgen, D.J. LePine, J.A. Colquitt, and J. Hedlund. 1998. Extending the multilevel theory of team decision making: Effects of feedback and experience in hierarchical teams. Academy of Management Journal 41:269-282; (e) Kraiger, K. 2003. Perspectives on training and development. In W.C. Borman, D.R. Ilgen, R.J. Klimoski, and I.B. Weiner (eds.) Handbook of Psychology. Hoboken, NJ: John Wiley. Pp.171-192; (f) Salas, E., and C.A. Cannon-Bowers. 2001. The science of training: A decade of progress. Annual Review of Psychology 52:471-499. 50   National Wildfire Coordinating Group. 1994. Incident Command System National Training Curriculum. Available at www.nwcg.gov/pms/forms/ics_cours/ics_courses.htm. 51   (a) Department of Homeland Security. 2004. National Incident Management System. Washington, DC; (b) Federal Emergency Management Agency. 2004. National Incident Management System (NIMS): An introduction. Washington, DC. Available at http://www.fema.gov. 52   (a) Federal Emergency Management Agency. 2003. Exercise Design Course, IS 139. Emmitsburg MD: Emergency Management Institute; (b) National Response Team. 1990. Developing a hazardous materials exercise program: A handbook for state and local officials, NRT-2. Washington, DC: Author. 53   Hackman, J.R., and R. Wageman. 2005. A theory of team coaching. The Academy of Management Review 30:269-287.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities relevant concepts. An assessment of the applicability of this model to emergency response organizations is needed. Misuse Scenario. Emergency preparedness for the misuse scenario can be achieved by prompt epidemiological surveillance that detects and recognizes a common source for seemingly disparate illnesses or deaths. Hazard detection can be followed by prompt action to remove contaminated products from the marketplace and warn consumers to return items from potentially contaminated lots to official collection points. Recovery Preparedness for the Storage and Transportation Scenarios Pre-impact recovery planning has been advocated by a number of scholars,54 but research evaluating its effectiveness is quite limited.55 Available research indicates that pre-impact recovery planning was associated with faster housing recovery and better integration of hazard mitigation into the recovery process, but much more research is needed to test the generalizability of these results. Need to Refine the DIM for Chemical Incident Management There is a need to resolve the apparent conflict between the results of previous disaster research, which support an all-hazards approach, and the increased focus on specific hazards that has emerged in recent approaches to homeland security. Expedient hazard mitigation is arguably specific to a single hazard or group of hazards with similar effects, and emergency assessment arguably also has hazard-specific aspects. However, most aspects of population protection and incident management appear to apply to a wide variety of hazards. Research is needed to determine if this assumption is correct. How human responses to intentional terrorist events differ from those in response to natural or technological events remains to be determined. There has been much speculation that we cannot use past history to under- 54   Schwab, J., K.C. Topping, C.C. Eadie, R.E. Deyle, and R.A. Smith. 1998. Planning for Post-Disaster Recovery and Reconstruction. PAS Report 483/484. Chicago, IL: American Planning Association. 55   Wu, J.Y., and M.K. Lindell. 2004. Housing reconstruction after two major earthquakes: The 1994 Northridge earthquake in the United States and the 1999 Chi-Chi earthquake in Taiwan. Disasters 28:63-81.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities stand and predict how people would respond to events not previously experienced in this country. However, the likely responses to events such as suicide bombings, releases of biological agents, attacks with radiological dispersion devices, or releases of chemical warfare agents can be studied using careful empirical research before such disasters occur. Preliminary findings from the large number of post-9/11 investigations and studies of the 1993 World Trade Center and Oklahoma City bombings suggest that some types of behavior are similar to those observed in other large-scale disasters. Thus, the absence of panic and the large amount of altruistic behavior in these incidents come as no surprise. Other types of behavior, such as changes in travel behavior and product purchases, have not been studied in connection with disasters but have been observed in connection with stigmatized products such as cyanide-contaminated bottles of Tylenol and Alar-tainted apples. It is critical that comparative research efforts be made to document and understand the variations in human response to a wide range of hazards and social conditions if inappropriate negative responses and their consequences are to be mitigated. Research should be conducted to develop a realistic model of the effectiveness of pre-impact hazard management actions in reducing the physical and social impacts of a chemical incident. Conventional risk analyses typically calculate the area exposed to a specified chemical concentration, the number of people that would be exposed, and occasionally, the number of casualties that might be expected from a given release magnitude. Such analyses are useful for site-specific analyses, but rational priorities for S&T investments in pre-impact hazard management actions should be guided by a comprehensive model that can assess the expected reduction in physical (casualties and damage) and social (psychological, demographic, economic, and political) impacts of chemical incidents given one or more specific hazard mitigation, emergency response, or disaster recovery actions. For example, analysts should be able to specify the characteristics of a storage and transportation scenario (e.g., quantity of toxic chemical, meteorological conditions, population distribution) and estimate the physical and social impacts under existing conditions of hazard mitigation (i.e., building air infiltration rates), emergency response (e.g., warning, evacuation, medical transport and care), and recovery (debris removal or contamination cleanup, resource management, business resumption). Analysts could then test the effects of alternative levels (e.g., moderate investment, substantial investment) of the model parameters to identify the pre-impact hazard management actions that provide the greatest reduction in physical and

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities social impacts. A well-developed model should be able to identify which policies provide the greatest reduction in disaster impacts. In addition, it should be able to determine how much improvement in hazard mitigation, emergency preparedness, and disaster recovery actions can be expected from a given level of S&T investment. RISK PERCEPTION Traditional risk assessment focuses on losses that are often measured in monetary units. Risk perception is concerned with the psychological and emotional factors that have been shown to have an enormous impact on behavior. In a set of path-breaking studies begun in the 1970s, Paul Slovic, Baruch Fischhoff, and other psychologists began measuring laypersons’ concerns about different types of risks. These studies showed that those hazards of which the person had little knowledge, and were also highly dreaded, were perceived as being the most risky. The general finding that laypersons see the world differently from the scientific community also raised a set of questions as to the nature of the decision-making process for dealing with risks. The problems associated with risk perception are compounded because of the difficulty individuals have in interpreting probabilities in making their decisions.56 In fact, there is evidence that people may not even want data on the likelihood of an event occurring.57 If people do not think probabilistically, how do they make their choices? There is now a large body of evidence that individuals’ risk perceptions are affected by judgmental biases. The availability heuristic is one of the most relevant ones for dealing with extreme events. Here people estimate the likelihood of an event by the ease with which they can imagine or recall past instances.58 In cases where the information on an event is salient so that individuals fail to take into account the base rate, there will be a tendency by many to overestimate the probability of the event occurring. Following the terrorist activities of September 11th, many people refused to fly because they perceived 56   Kunreuther, H., N. Novemsky, and D. Kahneman. 2001. Making low probabilities useful. Journal of Risk and Uncertainty 23:103-120. 57   Huber, O., R. Wider, and O. Huber. 1997. Active information search and complete information presentation in naturalistic risky decision tasks. Acta Psychologica 95:15-29. 58   Tversky, A., and D. Kahneman. 1973. Availability: A heuristic for judging frequency and probability. Cognitive Psychology 5:207-232.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities the chances of being on a hijacked plane to be extraordinarily high even though it could be argued that the likelihood of such events occurring in the future was much lower given increased vigilance and added protection by the federal government. Other factors besides probability and consequences influence choices under risk and uncertainty. There is a growing body of evidence that affect and emotions play an important role in people’s decision processes.59 These factors play a particularly important role when individuals face a decision that involves a difficult trade-off between attributes or where there is ambiguity concerning what constitutes a “right” answer. In these cases, people often appear to resolve tasks by focusing on those cues that send the strongest affective signals. In other words, rather than basing one’s choices simply on the likelihood and consequences of different events, individuals are also influenced in their choices by emotional factors such as fear, worry, and love. It is also important to note that risk perception varies by previous experiences (e.g., prior exposure to an event), gender, race or ethnicity, income, and education, among other variables. IMPACT OF INTERDEPENDENCIES OF THE CHEMICAL SUPPLY CHAIN ON RISK-REDUCING MEASURES Weak links in the safety and security of the chemical infrastructure and supply chain networks can compromise the entire system. Given the decentralized nature of many parts of the supply chain due to distributed ownership and control, it may be difficult to coordinate risk-reducing measures across the system. Appropriate cost-effective measures must be identified to reduce risks from terrorism when there are interdependencies in the system. Strategies involving private-public partnerships can be developed to encourage firms to adopt these measures. These strategies include a combination of such measures as economic incentives, third-party inspections, insurance, and well-enforced regulations and standards. 59   (a) Slovic, P., M. Finucane, E. Peters, and D. MacGregor. 2002. The affect heuristic. In T. Gilovich, D. Griffin, and D. Kahneman (eds.), Intuitive Judgment: Heuristics and Biases. Cambridge, UK: Cambridge University Press; (b) Loewenstein, G., E. Weber, C. Hsee, and E. Welch. 2001. Risk as feelings. Psychological Bulletin 127:267-86; (c) Hsee, C., and H. Kunreuther. 2000. The affection effect in insurance decisions. Journal of Risk and Uncertainty 20:141-159.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities One reason that units in the supply chain are reluctant to incur the costs of investing in risk-reducing measures on their own is that even after doing so they may be adversely impacted by other firms in the system that fail to adopt similar measures. An effective investment by any firm or unit in the supply chain to reduce the likelihood and consequences of a disruption is often a costly investment. When there are interdependencies between units in the system there is less incentive for one unit to invest in protective measures if the other units have not taken similar action. Even if modifications of a single unit can reduce the chances of a disruption to the supply chain caused by its own operations, it can still be adversely affected by a second unit that did not undertake similar protective measures. In other words, in an interdependent system, investing in security buys a single unit less protection when there is the possibility of disruption from another unit. In fact, in an interdependent system, reducing vulnerabilities in one area might inadvertently increase vulnerability in another since the terrorists will conceivably turn to attacking weak links when choosing where to utilize their resources. There is a need to utilize existing institutional structures such as trade associations to promote coordination among units in the system. One could also utilize economic incentives such as subsidies to encourage certain activities and taxation to discourage others that will lead to win-win situations for everyone in the system. The more units in the network that do not invest in security, the less incentive will any specific unit in the system have to invest in protection. In other words, if one wants to protect the entire supply chain it requires coordination between all units in the system through either the private sector or some type of public sector intervention. That is, weak links may lead to suboptimal behavior by everyone. By coordinating the actions of all units in the supply chain, each firm will be better off because its expected profits will increase and society will be better off because the risks of disruption will be lower.60 Tipping and Cascading Behavior There may be ways of inducing tipping and cascading so that the welfare of every component in the supply chain is improved. Cascading refers 60   Kunreuther, H., and H. Geoffrey. 2003. Interdependent security. Journal of Risk and Uncertainty, Special Issue on Terrorist Risks 26:231-249.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities to a domino effect. If one unit invests in protection, then there is an incentive for a second unit to do the same, which leads a third unit to incur these costs and so on. The concept of tipping (from the tipping of a scale) refers to many others in the supply chain simultaneously investing in security measures because one or more units in the supply chain have done so. In taking these actions, those units reduce the possibility that the supply chain will be disrupted and hence provide an economic incentive for others to follow suit. Units or firms in any supply chain are heterogeneous; having different risks and costs associated with their activities. In the case of the chemical supply chain some units may have a much higher risk than others of causing a failure in the entire system through an accident or other disruption of its activities. These units are referred to as weak links in the supply chain. It has been shown that one unit in the supply chain may occupy such a strategic position that if it changes from not investing to investing in protection, all other units will find it in their interests to follow suit. In this case, this single unit will tip the entire system.61 Even if no single unit can exert such leverage, a critical mass may have the ability to do so. To best effect protection of the entire supply chain, units that could have the greatest negative impact on others in the system should be encouraged to invest in protective behavior, not only to reduce the possibility of losses to themselves and others, but also to induce other units to follow suit. Tipping suggests that it is particularly important to identify and then persuade these key players to manage risks more carefully through economic incentives (e.g., subsidies or fines). Working with them may be a viable substitute for working with everyone in the supply chain. Tipping and cascading behavior has been documented in many contexts where there is a sudden change from one equilibrium to another due to the movement of a few agents (e.g., the sudden change in the demographics of a neighborhood).62 61   Heal, G., and H. Kunreuther. In press. You Can Only Die Once: Interdependent Security in an Uncertain World. In H.W. Richardson, P. Gordon and J.E. Moore II (eds.), The Economic Impacts of Terrorist Attacks. Cheltenham, UK: Edward Elgar. 62   Schelling, T. 1978. Micromotives and Macrobehavior. New York:Norton.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities Strategies for Reducing Interdependent Risks The economic incentive for any individual unit in the supply chain to invest in risk-reducing measures is dependent on others taking similar actions. This situation resembles the familiar dilemma of the commons where there is no economic incentive for any individual or firm to take steps to reduce a risk, but if everyone adopted these measures, all would be better off. In these situations some type of intervention is required to address this problem of interdependent security (IDS). This intervention could be by a coordinating unit in the private sector, such as a trade association, or through well-enforced regulations or standards coupled with insurance and third-party inspection. Role of Trade Associations A trade association can play a coordinating role by stipulating that any member has to follow certain rules and regulations, including the adoption of security measures. For example, the National Association of Chemical Distributors (NACD) has developed a code of responsible distribution, has mandated third-party auditing of code compliance, and has actually terminated membership for noncompliance. Other chemical industry associations such as the American Chemistry Council (ACC), Synthetic Organic Chemical Manufacturers Association (SOCMA), American Petroleum Institute (API), and National Petrochemical and Refiners Association (NPRA) have member codes of conduct and can also play key roles in this regard. Role of Third-Party Inspections, Insurance, and Well-Enforced Regulations and Standards Well-enforced regulations and standards that require all units in the supply chain to undertake risk-reducing measures can play a role similar to that of trade associations. One example of such a regulation is Section 112(r) of the Clean Air Act Amendments. The passage of Section 112(r) of the Clean Air Act Amendments (CAAA) of 1990 created two new federal regulatory programs aimed at preventing releases of hazardous chemicals—the Occupational Safety and Health Administration (OSHA) Process Safety Management Standard and the EPA Risk Management Program. The OSHA program, enacted in 1992, required facilities containing large quantities of highly hazardous chemicals to implement accident prevention and

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities emergency response measures to protect workers. The EPA Risk Management Program regulation published in 1996 went beyond the OSHA program by requiring facilities to perform a hazard assessment and to submit a summary report to EPA by June 1999 called the Risk Management Plan.63 The EPA and other regulatory agencies have been searching for other alternatives to their centralized procedures to implement regulatory obligations due to their limited personnel and funds. Third-party inspections coupled with insurance protection can encourage decentralized units in the supply chain to reduce their risks from accidents and disasters and lead to a high compliance level. Such a management-based regulatory strategy shifts the focus of decision making from the regulator to individual units who are now required to do their own planning to meet a set of standards or regulations.64 The rationale behind using third parties and insurance to support regulations can be stated in the following way. As pointed out above, one of the biggest concerns of a regulatory agency is that it doesn’t have enough resources to audit all firms in the industry. By coordinating with the private sector, the number of audits the agency must perform can be reduced. Third-party inspection in conjunction with private insurance is a powerful combination of two market mechanisms that can convince many firms of the advantages of implementing security measures to make their operations safer. If insurance companies provide lower premiums to companies that have passed audit by a recognized third party, firms will have incentives to voluntarily adopt security measures. Federal regulatory agencies can then focus their audits on firms that have not applied or qualified for the discount. Those units taking action can encourage the remaining ones to comply with regulations to avoid being caught and fined. This is another form of tipping behavior. Without some type of inspection, low-risk units who have adopted risk-reducing measures cannot credibly distinguish themselves from high- 63   Belke, J. 2001. Chemical accident risks in U.S. industry—A preliminary analysis of accident risk data from US hazardous chemical facilities. Proceedings of the 10th International Symposium on Loss Prevention and Safety Promotion in the Process Industries. Stockholm, Sweden: Elsevier Sciences. 64   Coglianese, C., and D. Lazer. 2003. Management-based regulation: Prescribing private management to achieve public goals. Law and Society Review 37(4):691-730.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities risk units for regulators. However, if regulators coordinated with the private sector to delegate part of the inspection process through insurance companies and certified third-party inspectors, a channel would exist through which the low-risk units can distinguish themselves and avoid government audit. If a unit chooses not to be inspected by certified third parties, it is more likely to be perceived as high-risk rather than low-risk and is more likely to be audited by regulators. In this way, the number of audits needed is reduced because units that have received seals of approval from private third-party inspectors are known.65 As demonstrated in the work of the National Transportation Safety Board (NTSB), the U.S. Chemical Safety and Hazard Investigation Board (CSB), and the 9/11 Commission, an effective system will also independently and publicly investigate when catastrophic failures occur. Investigations examine the root and contributing causes, including the sufficiency of policies, practices, and oversight in the private and public domains. Future investigations should include efforts to gather data about interdependent security. Opportunities to Better Address Interdependent Security The model of interdependent security66 can be better tailored to the needs of the chemical infrastructure. The following open issues need to be addressed for a better understanding of the challenges associated with IDS issues and the management of risk in the chemical sector. Deciding whether to invest in security normally involves considerations over a period of time since there is an investment cost that needs to be compared with the benefits over the life of the protective measure. This is not currently accounted for in the IDS model. There is a growing literature in behavioral economics suggesting that individuals make choices in ways that differ from the rational model of 65   (a) Collins, Larry, James C. Belke, Marc Halpern, Ruth A. Katz, Howard C. Kunreuther, and Patrick J. McNulty. 2002. The insurance industry as a qualified third party auditor. Professional Safety 47(4):31-38; (b) Kunreuther, H., P. McNulty, and Y. Kang. 2002. Improving environmental safety through third party inspection. Risk Analysis 22(2):309-318. 66   Kunreuther, H., and H. Geoffrey. 2003. Interdependent security. Journal of Risk and Uncertainty, Special Issue on Terrorist Risks 26:231-249.

OCR for page 67
Terrorism and the Chemical Infrastructure: Protecting People and Reducing Vulnerabilities choice.67 Many individuals are not willing to invest in security for a number of reasons that include myopia, high discount rates, and budget constraints. Others take action because of anxiety and worry. These issues need to be considered when developing more realistic models of choice. The possibility of an attack on any unit in the system is likely to be influenced by what protective measures it has taken. Hence, these probabilities should be treated as endogenous. In the case of the chemical supply chain, terrorists are more likely to focus on targets that are less protected.68 Future research should examine how changes in endogenous probabilities impact IDS solutions and the appropriate strategies for improving the performance of individual units as well as the operation of the entire chemical supply chain. Economic studies to explore the interdependencies of the supply chain, determine how these impact decision making on security measures, and determine the least secure links in the chain is appropriate. DHS’s National Assets Database and its ongoing Risk Analysis for Critical Assets Protection (RAMCAP) analysis should be useful in identifying units that represent weak links in the security of the chemical supply chain.69 67   Kahneman, D., and A. Tversky. 2000. Choices, Values and Frames. New York, NY: Cambridge University Press. 68   Kunreuther, H., and H. Geoffrey. 2003. Interdependent security. Journal of Risk and Uncertainty, Special Issue on Terrorist Risks 26:231-249. 69   The committee did not have access to the National Assets Database or to the results of the RAMCAP exercise.