Making Transportation Tunnels Safe and Secure (2006)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

4Tunnel systems, in their design, have a safe environmen- tal order and are capable of withstanding the assaults nor- mally presented by everyday use. For example, below-grade tunnels are watertight, with proper water evacuation capa- bility and safety systems to move air into and out of the tubes. The tunnel structure is designed and built to exist within the soil or seabed that it occupies. Mined tunnels similarly coexist within their surface environment to pro- vide safe, smooth operation. Despite these and other safety features, however, damage or disruption to a tunnel, its operations, and/or occupants can result from the impact of hazards or threats. The tables in this chapter consist of a list of major hazards and threats that may adversely impact the normal operation of a transportation tunnel and associated infrastructure. The transportation tunnel and associated infrastructure include all electrical and mechanical operations within the tunnel environment, such as ventilation and fire suppression. Haz- ards and threats to the tunnel environment also include actual or perceived physical hazards and threats affecting the users of the transportation system. The primary criterion used for the analysis of safety haz- ards and security threats was the level of impact that a major hazard or threat would have on the tunnel system. All hazards and threats considered in depth are capable of closing a tun- nel for an extended period of time (i.e., lasting more than 25 hours). These hazards and threats encompass potential inci- dents that have not been routinely encountered or planned for by a tunnel operator. Because the standard literature discusses hazard issues, threats make up the major portion of the events examined in this report, particularly threats related to the introduc- tion of a foreign item into the tunnel environment to dis- rupt the tunnel and its users. This analysis excludes completely the range of safety hazards that are routinely observed and handled by a tunnel operator—such as equipment breakdown, utility disruptions, minor criminal acts, and medical emergencies—because tunnel operators have years of experience in handling such issues. The expe- riences of tunnel operators in handling these minor inci- dents have been distilled into handbooks and readily available procedural reference materials. Where possible, notations for additional reference material concerning these minor hazards have been included in this report. The focus of this guidance is, therefore, a combination of major hazards that are not likely and threats—principally acts of terrorism—that might be realized in a tunnel environ- ment. Unlikely, extraordinary threats have been excluded. These include highly unlikely acts of terrorism that seem irra- tional or ineffective in a tunnel context (such as a nuclear detonation or airborne threats). The hazards and threats discussed in this report have been assembled individually. With this format, the reader can first absorb the details of each potential scenario and then read the recommended actions to mitigate the hazard or threat. The remainder of Chapter 2 discusses (a) the major hazards and threats that will adversely affect the normal operation of a transportation tunnel and its associated infrastructure, (b) the damage potential of these hazards and threats, and (c) possible hazard and threat scenarios. 2.1 Major Hazards and Threats Table 1 presents a range of major hazards and threats that may adversely affect a tunnel and its associated features. The hazards and threats are expressed in terms of generic scenar- ios with potential to damage the normal operation of a trans- portation system, including specific tunnel components. One of the concerns, “Fire,” appears under the “Threat” heading as arson and under the “Hazard” heading as unin- tentional. This distinction is made because, although the C H A P T E R 2 Hazards and Threats

effects of an intentional fire and an unintentional fire may be similar, the defenses to the two kinds of fire may differ. There are three major hazards and 10 major threats. The major hazards are the following: • Fire (unintentional), • Structural integrity loss by natural causes, and • Introduction of hazardous materials. The major threats are the following: • Introduction of small improvised explosive devices (IEDs): explosive materials delivered via one to five aggressors transporting the payload. • Introduction of medium-sized IEDs: explosive materials delivered either by vehicle (car) or by multiple persons act- ing in concert to transport the payload. • Introduction of large IEDs: explosive materials delivered either by vehicle (truck) or by multiple persons acting in concert to transport the payload. • Introduction of chemical agents. • Introduction of biological agents. • Introduction of radiological agents. • Cyber attack: a virtual aggression against the command and control systems of a tunnel system with the intent of disabling systems. • Maritime incident: a waterborne incident affecting a tun- nel shell from above and any exposed sides. Adverse 5 Vulnerable Tunnel Feature Tunnel Construction and Engineering Feature Tunnel System Feature Hazard or Threat Im m er se d Tu be Cu t-a nd -C ov er B or ed o r M in ed Ve nt S ha ft Po rt al St at io n D is tri bu tio n Ch an ne l Co nt ro l C en te r Su bs ta tio n Ut ili ty B ui ld in g Hazard Fire (Unintentional) √ √ √ √ √ √ √ √ √ √ Structural Integrity Loss by Natural Causes √ √ √ √ √ √ √ √ √ Introduction of Hazardous Materials √ √ √ √ √ √ Threat Introduction of Small IEDs √ √ √ √ √ √ √ √ √ Introduction of Medium-Sized IEDs √ √ √ √ √ √ √ √ √ √ Introduction of Large IEDs √ √ √ √ √ √ √ √ √ √ Introduction of Chemical Agents √ √ Introduction of Biological Agents √ √ Introduction of Radiological Agents √ √ √ √ √ Cyber Attack √ Maritime Incident √ √ Fire (Arson) √ √ √ √ √ √ √ √ √ √ Sabotage of MEC Systems √ √ √ √ √ √ √ √ √ IEDs = improvised explosive devices. MEC = mechanical, electrical, and communications. Table 1. Major hazards and threats to transportation tunnels and associated features.

impacts may be due to sunken ships, misguided anchors, or explosives. • Fire (arson): an intentionally set conflagration with the intent of causing physical harm or damage to property. • Sabotage of mechanical, electrical, and communications (MEC) systems: the intentional impairment or destruction of MEC systems necessary to the safe, efficient operation of a tunnel system. The right side of the table notes the affected vulnerable tunnel features, also referred to in this report as “assets.” The vulnerable tunnel features have been divided into two types: tunnel construction and engineering features and tunnel sys- tem features. Tunnel construction and engineering features include the type of tunnel facility constructed and the major engineered features, which are typically immovable. There are six categories of tunnel construction and engineering features: • Immersed tube: employed to traverse a body of water. Tun- nel sections, usually 300 to 450 feet (91 to 137 meters) long, are placed into a pre-excavated trench. • Cut-and-cover: tunnel construction method involves braced, trench-type excavation (“cut”) construction of structures and placement of fill materials over the finished structures (“cover”). • Bored or mined: bored tunnels are often excavated using mechanical equipment such as road headers or tunnel bor- ing machines (TBMs), while mined tunnels may be exca- vated using manual or mechanical methods. • Vent shaft: any at-surface or above-grade air intake or exhaust facility servicing a below-grade road, transit, or rail section. • Portal: any engineered entranceway or boat section to a below-grade road, transit, or rail section. • Station: any facility in regular use by nonemployees of a passenger rail or transit system. Unlike the other categories of construction and engineering features, this category is applicable to passenger rail and transit only. Tunnel system features include the major components designed and installed to support the efficient operation and safe environment of a tunnel. Mechanical, electrical, ventila- tion, and communication systems are the major sections designed to support the tunnel system. These systems are capable of update or replacement over time. The categories of tunnel system features are as follows: • Distribution channel: any conduit, sheath, piping, fiber optic, or metal line designed and installed to provide a source of power or method of communication between a tunnel system and a utility terminus. • Control center: any facility designed, constructed, and equipped with systems intended to monitor and control the tunnel environment and the movement of vehicle and rail traffic over and through a tunnel section. • Substation: any facility specifically designed to relay power, water, or sewer connections between the tunnel and the central utility building. The substation is con- nected to the utility building and the tunnel via distribu- tion channels. • Utility building: Any facility specifically designed to pro- vide power to the tunnel system. This facility is operated continuously to achieve its mission and is connected to both substations and the tunnel through a distribution channel. A utility building may also be designed to provide water or sewer removal from the tunnel. 2.2 Damage Potential The damage potential of hazard and threat scenarios— often a sequence of physical events (such as fire or flooding) and their secondary impacts (such as injuries, fatalities, or loss of function)—determines the key characteristics of countermeasures that can mitigate the impact of hazards and threats, if not prevent them. Table 2 presents the damage potential of the hazards and threats listed in Table 1. Except for radiation, the types of damage listed in Table 2 and considered throughout this report are visible to emer- gency responders and the tunnel operator. All types of dam- age, including radiation, may be mitigated. Possible damage includes the following: • Fire/smoke: any active conflagration or post conflagration condition of smoke and harmful vapors. • Flooding: the condition of excessive water inflow to a tun- nel area exceeding the pumping capacity of the tunnel systems and causing a hazard or threat to people and property. • Structural integrity loss: any decrease in the fitness of the tunnel to carry passengers or freight that requires inspec- tion by the tunnel owner and major repair prior to its reopening for beneficial use by the public. • Contamination: the condition of being unfit for nor- mal habitation due to the presence of radiation, biologi- cal agents, harmful chemicals, hazardous airborne particles, or sewage sufficient to require professional remediation. • Utility disruption: loss of power, air, steam, water, or com- munication service for more than 25 hours. 6

• Extended loss of asset use: loss of the ability to safely move passengers or allow vehicular traffic for more than 25 hours. • Extended public health issue: actual or potential ability to cause illness in a significant portion of the population sufficient to overwhelm the medical treatment capacity of the area. 2.3 Hazard and Threat Scenarios Hazard and threat scenarios are profiles that include the hazard or threat, the mode of delivery, the path to the tar- get, the tactical delivery device, and the location of the tar- get. Table 3 provides basic hazard and threat scenarios. The assumptions made during the development of this table are based on past terrorist acts and current available intelli- gence. The scenarios are intended to include categories applicable to highway, rail, and transit tunnel systems. However, the needs, vulnerabilities, and points of access differ from mode to mode, as well as from tunnel to tunnel within a mode. The reader is encouraged to review the text to ascertain the applicability of the table to his or her own situation. The following sections present hazard and threat scenarios, respectively, in relation to assets. Note that some scenarios, such as fire, may be the result of an intentional act (i.e., a threat) or an unintentional event or circumstance (i.e., a hazard). 2.3.1 Hazard Scenarios in Relation to Assets Fire (Unintentional) Unintentional fire is more probable than intentional fire and has occurred in several tunnel systems. Fire may destroy any structure or vehicle and kill people if not controlled. A tunnel structure may be completely ruined by a conflagra- tion. Fire sources may be disparate and triggered by any com- bination of flammable material and ignition. Fire occurs in nature and does not necessarily require human intervention to spread. Fire, or the danger of fire as a smoke condition, will immediately have a negative impact on all tunnel assets by inducing the evacuation of persons and equipment from 7 Damage Potential Hazard or Threat Fi re /S m ok e Fl oo di ng St ru ct ur al In te gr ity Lo ss Co nt am in at io n Ut ili ty D is ru pt io n s o f Ex te nd ed L os As se t U se Ex te nd ed P ub lic H ea lth Is su e Hazard Fire (Unintentional) √ Structural Integrity Loss by Natural Causes √ √ √ √ √ √ √ Introduction of Hazardous Materials Threat Introduction of Small, Medium-Sized, or Large IEDs √ √ √ √ √ √ √ Introduction of C/B/R Agents Cyber Attack Maritime Incident Fire (Arson) √ √ Sabotage of MEC Systems √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ √ C/B/R = chemical/biological/radiological. IEDs = improvised explosive devices. MEC = mechanical, electrical, and communications. √ √ Table 2. Damage potential of hazards and threats.

8Hazard or Threat Mode of Delivery Path to Target Tactical Delivery Device Location of Target Very Large IED Ship Waterway Explosive Container (Depth Charge) Top of Tunnel Large IED Vehicle Tunnel Roadway Truck Liner Large IED Vehicle Tunnel Roadway Truck Column or Wall Large IED Vehicle Surface Roadway over Tunnel Truck Roof Slab Large IED Vehicle Tunnel Roadway Truck Ventilation Building Large IED Vehicle Surface Access Road Truck Ventilation Building Large IED Vehicle Tunnel Roadway Truck C&C Center Above Tunnel Large IED Vehicle Surface Access Road Truck Stand-Alone C&C Center Large IED Vehicle Surface Access Road Truck Stand-Alone Substation Large IED Vehicle Surface Access Road Truck Ventilation Shaft Large IED Vehicle Surface Access Road Truck Station Large IED Vehicle Surface Access Road Truck Ventilation Structure Large IED Rail or Transit Vehicle Trackway Locomotive or Freight/ Passenger Car Liner Large IED Rail or Transit Vehicle Trackway Locomotive or Freight/ Passenger Car Column or Wall Medium IED Vehicle Tunnel Roadway Car or Van Liner Medium IED Vehicle Tunnel Roadway Car or Van Column or Wall Medium IED Vehicle Tunnel Roadway Car or Van Ventilation Building Medium IED Vehicle Surface Access Road Car or Van Ventilation Building Medium IED Vehicle Tunnel Roadway Car or Van C&C Center Above Tunnel Medium IED Vehicle Surface Access Road Car or Van Stand-Alone C&C Center Medium IED Vehicle Surface Access Road Car or Van Stand-Alone Substation Medium IED Vehicle Surface Access Road Car or Van Ventilation Shaft Medium IED Vehicle Surface Access Road Car or Van Ventilation Structure Medium IED Motor Vehicle or Foot Surface Roadway over Tunnel Truck or Multiple Backpacks Roof Slab Medium IED Transit Vehicle Trackway Car or Engine Liner Medium IED Transit Vehicle Trackway Car or Engine Column or Wall Medium IED Rail Car or Foot Trackway Freight/Passenger Car, Engine, or Multiple Backpacks Liner Medium IED Rail Car or Foot Trackway Freight/Passenger Car, Engine, or Multiple Backpacks Column or Wall Small IED Foot Tunnel Roadway Backpack Liner Small IED Foot Tunnel Roadway Backpack Column or Wall Small IED Foot Stations/Shops/ Tunnel Portals Backpack Column or Wall Small IED Foot Stations/Shops/ Tunnel Portals Backpack Liner Table 3. Hazard and threat scenarios.

9Hazard or Threat Mode of Delivery Path to Target Tactical Delivery Device Location of Target Small IED Foot Tunnel Roadway Backpack Exposed Ductbank Small IED Foot Surface Access Road Backpack Inside Ventilation Building Small IED Foot Surface Access Road Backpack Inside C&C Center Small IED Foot Surface Access Road Backpack Inside a Stand-Alone Substation Small IED Foot Tunnel Trainway Backpack Exposed Ductbank or MEC Equipment Small IED Foot Tunnel Trainway Transit Vehicle Station Small IED Foot Surface Access Road Backpack Station Small IED Foot Surface Access Road Backpack Inside Substation Small IED Foot Surface Access Road Backpack Inside Ventilation Structure Large Fire Vehicle Tunnel Roadway Tanker Liner Large Fire Vehicle Tunnel Roadway Tanker Column/Wall/Roof Slab Large Fire Vehicle Tunnel Roadway Tanker Portal Large Fire Vehicle Tunnel Roadway Tanker Any Tunnel Location Adjacent to Critical Facility Large Fire Rail/Transit Car Trackway IED on Train Liner Large Fire Rail/Transit Car Trackway IED on Train Column/Wall/Roof Slab Large Fire Rail/Transit Car Trackway IED on Train Portal Large Fire Rail/Transit Car Trackway IED on Train Any Tunnel Location Adjacent to Critical Facility C/B/R Foot Tunnel Air Supply System Vial/Aerosol/Small Package Tunnel Occupants and Surrounding Population C/B/R Foot Surface Access Road to Tunnel Vent Intakes Vial/Aerosol/Small Package Tunnel Occupants and Surrounding Population C/B/R Vehicle Tunnel Air Supply System Vial/Aerosol/Small Package Tunnel Occupants and Surrounding Population C/B/R Vehicle Tunnel Roadway Vial/Aerosol/Small Package Tunnel Occupants and Surrounding Population C/B/R Vehicle Surface Access Road to Tunnel Vent Intakes Vial/Aerosol/Large Package on Truck Tunnel Occupants and Surrounding Population C/B/R Vehicle Surface Access Road to Tunnel Vent Intakes Vial/Aerosol/Large Package Tunnel Occupants and Surrounding Population C/B/R On Foot in Transit Car Tunnel Roadway Vial/Aerosol/Large Package Tunnel Occupants and Surrounding Population C/B/R Transit Car Tunnel Trainway Vial/Aerosol/Large Package on Train Tunnel Occupants and Surrounding Population Hazardous Materials Vehicle Tunnel Roadway Truck Any Place in Tunnel Hazardous Materials Transit Car Tunnel Trainway Device on Train Any Place in Tunnel Cyber Attack Digital Virtual Virus Code C&C Maritime Incident (Anchor Drag) Ship Water Above Tunnel Passing Ship Tunnel Shell C&C = command & control. IEDs = improvised explosive devices. MEC = mechanical, electrical, and communications. Table 3. (Continued).

within the structure and surrounding areas. Fire and smoke will decrease visibility to unsafe levels, precipitate collision of vehicles and equipment, and cause personal injury. A fire con- trolled by firefighting may still result in smoke and water damage at a level sufficient to render a tunnel unfit for use or occupancy. The related assets are the following: • Tunnel structures. A fire may cause damage to the integrity of a structure and its engineered support bracing. The heat of a flame may distort all standard tunnel mate- rials sufficient to require closure for repair. The damaging effects of a fire are consistent across bored, cut-and-cover, and immersed tube tunnel construction. • Portals. Smoke and flame damage may threaten engineered works to weaken a portal.Damage or destruction may also be inflicted on monitoring equipment situated at the portal to a tunnel such as over height detection units, heat sensors, car- bon monoxide detectors, and closed-circuit camera units. • Vent shafts. Fire, heat, and water damage may affect air intake and exhaust towers, machinery, and required air fil- tering equipment. The damage would require replacement. • Stations (passenger tunnels only). A fire may damage or destroy wood, metal, and masonry structures that are nec- essary for normal human occupancy. Certificates of occu- pancy are routinely revoked when a fire causes damage to a structure. A small conflagration, with flame and smoke, may render a station unfit for occupancy and disallow its use by persons, vehicles, and equipment; it will be unfit until environmental abatement is complete and repairs are made to meet regulatory code. A station unfit for occu- pancy eliminates its primary function within the system, which is the transfer of passengers to railcar. • Distribution channels. The destructive path of flame and smoke may melt sheathing, iron piping, polyvinyl chloride (PVC), and metal conduit, thereby damaging the contents beyond repair. Pipes carrying water could serve as conduits for burning oil. Water used in firefighting efforts may have a destructive effect on power and communication lines. The loss of a utility in or near the tunnel structure will deny service to the surrounding areas, including any businesses, homes, or schools. Utilities may also facilitate the flow of water and other materials along their pathways and in entry and exit locations. • Control centers. Flame and smoke may destroy the physi- cal structure and all mechanical equipment of a control center and endanger the lives of personnel assigned to that facility. Water damage to equipment and structure may also occur in firefighting efforts. The loss of a control cen- ter would severely affect the ability of a transportation sys- tem to operate. The impact would be particularly severe on rail systems that rely on remote monitoring and sensors to control movement. • Substations. Fire may damage or destroy the physical structures containing utility equipment and connections. A fire may also sever the power feed and monitoring sys- tems of a substation, thereby rendering the station unfit for use. Equipment rendered unusable by the effects of a fire will need to be replaced prior to the operation of a tunnel to maintain the ability to evacuate water and provide power. Substations may also be adversely impacted by fire- fighting techniques that may send soiled water and debris into the plenums, thereby jamming lines and pump rotors. • Utility building. Fire may damage the utility terminus structures, rendering them unusable. Structural Integrity Loss by Natural Causes Despite the best efforts of engineering and maintenance, the potential danger of structural integrity loss to tunnels and supporting infrastructure from unforeseen circumstances will always exist. There is no known method to guarantee that a structure will never fail or deteriorate. Proper design, con- struction, and maintenance may drastically reduce the likeli- hood of a sudden failure. However, unseen geotechnical or aquatic forces may go undetected by asset owners. Inconsis- tencies and lapses in the design, construction, and mainte- nance of a tunnel may collude to create the conditions for a sudden structural integrity loss. Structural integrity loss may be sudden or slow acting. The scope of this damage may be minimal, such as a crack in the wall requiring remediation or a pavement ripple requiring the temporary relocation of traffic. Integrity loss may also be cat- astrophic, resulting in total collapse or flooding of a structure, wreaking widespread loss of assets, and loss of life. The related assets are the following: • Tunnel structures. Loss of structural integrity threatens to collapse the bore, tube, or constructed below-grade area wholly or partially. A whole or partial collapse will force the closure of the asset for an undetermined amount of time. Minor integrity losses also drastically increase the oppor- tunity for water inflow, thereby inducing a progressive loss of material strength. Loss of integrity directly affecting a rail bed or track may unsettle the transit area of the tube. Disturbances to only the transited area will slow road traffic until repair; these disturbances will likely halt rail traffic because of the deflection of the rail. • Portals. Portal construction is subject to the same stresses as the tube areas. Whole or partial collapse will force a clo- sure of the transit areas and nearby access paths. • Vent shafts. Loss of structural integrity may destroy air intake and exhaust plenums, shafts, and towers. A shift in the support of a vent shaft area can alter the load-bearing capability to support heavy machinery necessary for air 10

purification. The absence of fresh air delivery into the below-grade structure can detrimentally impact that facil- ity’s ability to support life and safety. • Stations (passenger tunnels only). A passenger station may be made partly or wholly unsafe by a structural integrity loss. Falling debris, unsettled steps and walkways, and uneven road or rail surface contribute to an unsafe environment. • Substation. A substation may be disturbed or made non- functional by a loss of structural integrity. Machinery or piping may be made uneven, thereby interrupting the designed flow of the station. Power brought in by hard wire may be interrupted by the movement or decay of the struc- tures on which they are tethered. • Control centers. Control centers lose functionality when a loss of structural integrity occurs in a tunnel system. Sensors, cameras, alarms, radio signals, and detectors are normally hard wired inside a tunnel system and tethered to a wall, shaft, plenum, or stairway system. The partial collapse of a support for one of these remote communica- tion systems would disable the unit and eliminate its use to a control center. • Distribution channels. Similar to the operation of a control and detection system, distribution channels would be inter- rupted or impaired by the whole or partial loss of the struc- tures that they monitor or are attached to. Buried utilities, located within the footprint of the tunnel structure or in nearby corridors, may be affected by the geotechnical alter- ation subsequent to a whole or partial collapse. Utilities con- nected by piping or hard wire may be severed or cracked. The collapse may allow water to intrude on soft wire net- works such as fiber optic to corrode connectors. Power util- ities may also experience water intrusion that may result in surges, overloads, and possibility of electrocution. Introduction of Hazardous Materials A tunnel system may be threatened by the accidental dis- charge of hazardous materials into the confined space of the tunnels or the stations. Hazardous materials can take a liquid, solid, or gaseous form. Even minimal quantities of some mate- rials can cause serious injury to tunnel system users. Hazardous materials can range from common industrial cleaners used by tunnel workers to a canister of pepper spray set off by a com- muter. In both circumstances, it is unlikely that the mainte- nance worker or the commuter entered the tunnel system with the intent of discharging hazardous material into the air. Mate- rials may also include hazardous liquid, debris, or waste prod- uct moved into the tunnel system by a vehicle, truck, or rail car. Public vehicular tunnel systems may forbid the transport of dangerous materials through below-grade areas, but these injunctions alone cannot stop private vehicles and trucks from attempting to transport them. Hazardous materials will enter the tunnel systems in varying quantities, and many will exit the system without incident or release. Through driver error or unfortunate circumstance, hazardous materials may leak or be released into the tunnel. Many hazardous materials require specialized remediation that will close a road or tran- sit tunnel to allow processing. The related assets are as follows: • Tunnel system and structure. The introduction of haz- ardous materials into a tunnel system constitutes a hazard to the safe use of the tunnel and requires immediate reme- diation. When a material is identified as potential or actual hazardous material, the area containing the hazard must be taken out of service for remediation. This closure adversely affects the use of the tunnel system and disrupts traffic flow. The tunnel as a system is adversely disrupted. The structural integrity of the tunnel may also be damaged by the introduction of certain hazardous materials, thereby requiring heavy repair under closed conditions. • Portals. Hazardous material introduction may have the same adverse impacts to a portal as to the tunnel structure. Certain hazardous materials require remediation, and remediation may require full or partial closure of the road or rail line. Closures will affect flow through the portals. • Stations (passenger tunnels only). The introduction of hazardous materials may constitute an immediate safety hazard and require the partial or full evacuation of the sta- tion to commence remediation efforts. Any evacuation would be an adverse impact. 2.3.2 Threat Scenarios in Relation to Assets Introduction of Small IEDs Explosives are materials capable of violent decomposition, which often takes the form of extremely rapid oxidation (i.e., burning).Explosions are the result of sudden and violent release of gas during the decomposition of explosive substances. Small IEDs are defined as explosive or incendiary produc- tion materials or devices small enough to be easily concealed. Compact or small devices are easily concealed among a per- son or personal belongings and may only be detected by deliberate use of equipment, processes, or close observation. The destructive pattern of any explosive device has the poten- tial to damage every object within its blast radius. A small conventional explosive has the capacity to kill or injure any- one within its blast radius. The related assets are as follows: • Tunnel structures. A hand-carried IED will damage the portion of the tunnel located within the blast radius. The portion of the structure damaged may be relatively small 11

or extensive. The hand-carried IED will cause the tempo- rary closure of the tunnel for evacuation and repair. • Portals. Similar to the tunnel structure, the portal may be damaged if it is within the blast radius of the hand-carried IED. The portal will be closed temporarily for repair. • Vent shafts. Similar to the tunnel structure, the vent shaft may be damaged if it is within the blast radius of the hand- carried IED. The shaft or intake structure will be closed temporarily for repair. • Stations (passenger tunnels only). A hand-carried IED set to detonate in a passenger station will likely cause more damage to persons than to property. A device set to explode in a passenger station will have been intended to harm or frighten people. The relative space difference between a sta- tion and a tunnel will allow a greater physical area to absorb the blast, thereby lessening the physical damage to the station. A mass casualty incident will likely lead to the closure of the station for an extended period, but not permanently. • Substation. Similar to the tunnel structure, the system’s substation may be damaged if it is within the blast radius of a hand-carried IED. The substation will be closed tem- porarily for repair. • Control centers. Depending on the placement of an explo- sive device, the blast may throw the facility off line or threaten the facility’s ability to safely hold persons and equipment. A control center located many miles from the scene of an explosion may be physically unaffected but still see a loss in monitoring capacity to the affected area. A con- trol center located at the site of an explosive blast may be directly affected, evacuated, and possibly destroyed. • Distribution channels. A small blast will damage or destroy wiring, piping, or vents located within the blast zone. Loss of these distribution channels may force the clo- sure of the tunnel system for repair. • Utility terminus building. A building may be partially closed for repair as the result of the successful delivery of a small IED. Loss of a utility may have a cascading effect on downstream systems, thereby debilitating service in the tunnel system. Introduction of Medium-Sized and Large IEDs Medium-sized and large explosives typically rely on a mobile delivery system, such as a car, truck, or rocket, or are stealthily placed in a chosen area prior to detonation. The power of a medium-sized or large explosive is wholly destructive to persons and property. In the confined atmo- sphere of a tunnel system, the force of a blast will be absorbed by the components of the tunnel system, causing casualties and destruction. Large quantities of explosives require efforts at interdiction prior to their placement or delivery. Vehicle-borne delivery systems are noticeable to defenders. The related assets are as follows: • Tunnel structures. A vehicle-borne explosive will damage a significant portion of the tunnel located within the blast radius. The vehicle-borne explosive will cause a long-term closure of the tunnel for evacuation and repair. A well- placed large explosive may cause the tunnel structure to collapse and require rebuilding. A large explosive may also cause a mass casualty incident. • Portals. Similar to the tunnel structure, the portal may be damaged or destroyed if it is within the blast radius of the vehicle-borne explosive. • Vent shafts. Similar to the tunnel structure, the vent shaft may be damaged or destroyed if it is within the blast radius of the vehicle-borne explosive. The shaft or intake struc- ture may require reconstruction. • Stations (passenger tunnels only). A vehicle-borne explo- sive set to detonate in a passenger station will cause signif- icant damage to persons and property. A mass casualty incident will likely lead to the closure of the station for an extended period, if not permanently. Reconstruction of the station will need to occur. • Substation. Similar to the tunnel structure, the substation may be damaged or destroyed if it is within the blast radius of a vehicle-borne explosive. A substation will require reconstruction if the damage is significant. • Control centers. Depending on the placement of a vehicle- borne explosive, the blast may throw the facility off line or threaten its ability to safely hold persons and equipment. A control center located many miles from the scene of an explosion may be physically unaffected but still see a loss in monitoring capacity to the affected area. A control center located at the site of an explosive blast may be directly affected, evacuated, or possibly destroyed. • Distribution channels. Any explosive blast will damage or destroy life safety and monitoring systems located within the blast zone. Interconnected distribution channels will be severed, thereby limiting or destroying their usefulness to another part of the tunnel system not directly affected by the blast. Systems will need to be reconstructed. • Utility building. Utility lines and connectors may be dam- aged or destroyed if they are within the blast zone. Loss of a utility will have a cascading effect on downstream sys- tems, debilitating service in the tunnel system and adjoin- ing areas. Introduction of Chemical Agents According to the Federal Emergency Management Agency (FEMA), as promulgated in Emergency Response to Terrorism Job Aid (which is available online at http://www.usfa.dhs. 12

gov/downloads/pdf/publications/ert-ja.pdf), there are five classes of chemical agents, all of which produce incapacitation, serious injury, or death: • Nerve agents damage the nervous system of a person and are extremely effective in small doses. Exposure is achieved through the respiratory tract and the skin. Nerve agents are deadly and fast acting, and symptoms include difficulty breathing, seizures, headaches, and salivation. All nerve agents require handling and treatment with extreme care. Well-known nerve agents include sarin (GB), soman (GD), tabun (GA), and V agent (VX). • Blister agents, also known as vesicants, include phosgene and mustard gas. Vesicants are absorbed through the eyes, skin, and lungs. They attack tissue and cause severe blister- ing. They may lead to seizures, blindness, and pulmonary edema. Blister agents are treatable and were first intro- duced during World War I. • Blood agents quickly diminish the ability of the body to absorb oxygen into the bloodstream, thereby depriving the organs of oxygen. Common types of blood agents include hydrogen cyanide and arsine, both of which are used in industrial applications. Blood agents enter the body through the skin or the respiratory tract and provoke cherry red lip color convulsions, nausea, and respiratory arrest. Affliction by a blood agent is treatable. • Choking agents interfere with the breathing process and, if left untreated, may induce asphyxiation. Choking agents include common compounds such as chlorine, ammonia, hydrogen chloride, and phosphorous. Common symptoms include coughing; shortness of breath; and a burning sen- sation in the eyes, nose, and throat. There are no known antidotes to choking agents, but successful medical treat- ment is available. • Irritant agents are agents designed to temporarily inca- pacitate a person. They generally do not have long-term effects or induce death. Common irritants include pepper spray, mace, and tear gas, all of which will induce tearing eyes, coughing, and throat irritation. These effects are tem- porary and treatable. The agents’ means of affliction and effects are outlined in Emergency Response to Terrorism Job Aid and in the succinct Department of Health and Human Services’s Terrorism and Other Public Health Emergencies: A Reference Guide for Media (which is available online at http://www.hhs.gov/emergency/ mediaguide/PDF/00.pdf). The related assets are as follows: • Vent shafts. Similar to a biological agent, air intake facili- ties may be the point of introduction for a chemical agent. By introducing a chemical agent into a vent shaft, an aggressor would be able to introduce the agent into the ventilation system. This method may also dilute the con- centration of the chemical agent. An affected vent shaft would need to be quarantined, decontaminated, and likely decommissioned due to damage, public fear, or use as evidence in a criminal investigation. • Stations (passenger tunnels only). Stations would be the likely scene of both introduction of the chemical agent and the mass casualty. The means to introduce a chemical agent into a station is relatively unsophisticated. An aggressor could enter the station with a vial, bag, or other carrier and open it on the platform, thereby exposing the tunnel users to the chemical agent. The station would be designated as out of service; it would become a mass casualty treatment area, crime scene, and site of an infected structure requiring decontamination. Upon decontamination and release as a crime scene, partial or full reconstruction may be necessary. Introduction of Biological Agents The introduction of a harmful biological agent into a tun- nel transportation system is a threat of high damage potential and low probability. There is little historical data on the use of biological agents in the United States as a threat against tun- nel transportation systems. Biological agents are weaponized versions of organisms that occur in the natural environment. Bacteria, viruses, and toxins can be manipulated to cause widespread contagion and infec- tion among a targeted population. Biological agents can be released into the air of a tunnel system and provoke either an immediate or delayed response from the affected individuals. Biological agents are very difficult to manufacture, handle, and deliver. Their effectiveness is impacted by wind, moisture, and air removal systems. Well-known biological agents include botulism, smallpox, and anthrax. Symptoms of a biological agent vary, but may include increasing fatigue or flu-like symptoms. Victims may suffer localized paralysis, swelling, rashes, or fever. Treatment is possible for many, but not all, biological agents. Introduction of a biological agent into a transportation tunnel would likely cause a delayed medical treatment situa- tion. Travelers would begin seeking medical treatment hours or days after the exposure. Damage to the tunnel infrastruc- ture would be contained to directly affected equipment and areas, all of which would require complete decontamination. During the period of decontamination, all equipment must be quarantined and replaced. The related assets are as follows: • Vent shafts. Air intake facilities may be the point of intro- duction for a biological agent. By introducing a biological agent into the air shaft, an aggressor would be able to 13

introduce the agent into the ventilation system. This method may also dilute the concentration of the biologi- cal agent. For a persistent agent, an affected vent shaft would need to be quarantined, decontaminated, and likely decommissioned due to damage, public fear, or use as evi- dence in a criminal investigation. • Stations (passenger tunnels only). Stations would be the likely scene of both the introduction of the biological agent and the mass casualty incident. The means to introduce an agent into a station is relatively unsophisticated. An aggres- sor could enter the station with a vial, bag, or other carrier and open it on the platform, thereby exposing the tunnel users to the biological agent. Once identified as contami- nated, the station would be designated out of service; depending on the speed of onset of symptoms, it could become a mass casualty treatment area, crime scene, and infected structure site requiring decontamination. Upon decontamination and release as a crime scene, partial or full reconstruction may be necessary. Introduction of Radiological Agents A radiological attack would have a destructive impact on a tunnel transportation system, nearby environments, and the user community. Radiological contamination disrupts the cell structure of a victim, causing sickness and death. A vic- tim may experience delayed symptoms and may mistake the cause of the symptoms for a flu-like illness. Radiological material is difficult to manufacture, handle, and deliver. It can be as deadly to the attacker as to the victims. Facilities and equipment would both be placed out of ser- vice and possibly abandoned. Extensive decontamination efforts would be required to restore them to use. The related assets are as follows: • Tunnel structure. A successful radiological attack would adversely affect the tunnel structure. Damage may be immediate (resulting from the explosive used in the deliv- ery) or long term (resulting from the contamination of the structure with radiological material). Immediate blast damage may affect the integrity of the structure, including supports, braces, and engineered works that withstand water intrusion. The long-term effects of radiological con- tamination might require lengthy remediation, including replacement of sections or construction of alternative routes. These scenarios would require a long-term closure of that area of the system or abandonment. • Portal. The portal would be similarly impacted as the tun- nel structure. Depending on the placement of the explosive delivery device, the portal may become unsteady and con- taminated. Damage may require reconstruction, long-term closure, or abandonment. The effect of a radiological threat successfully executed on an occupied passenger station would be a mass casualty event and would lead to closure of the station for an extended period for abatement and reconstruction. Severe contamination or severe damage from the explosive delivery could result in abandonment. The impact to the system could be drastic. The station might not be used as a transit way, entry point, or egress point for a considerable amount of time. A NOTE ABOUT BIOLOGICAL, CHEMICAL, AND RADIOLOGICAL ATTACKS: Biological, chemical, and radiological attacks may not be readily apparent at the site of introduction within the tunnel system. The introduction of these agents may be dis- cernable only later, when victims seek medical treatment and the origin of their problems are traced to the use of a com- mon tunnel. The effect of an attack would remain consistent with the descriptions provided, yet the discovery of the attack would be different than other primary hazards and threats described. An extended discussion of chemical, biological, and radiological agents and transportation system response options is presented in NCHRP Report 525, Vol. 10: A Guide to Transportation’s Role in Public Health Disasters. Cyber Attack Closed-circuit television (CCTV), air quality testing, and traffic algorithms are commonplace to ensure the smooth, safe use of a tunnel. The deployment of a concerted effort to deny the use of digital technology to the tunnel operator is a threat. The venue to attack the computer network of a tunnel operator is remote and virtual. The introduction of a virus into a remote network is commonplace in today’s environ- ment. Minimal technology is needed to launch a cyber attack. The related asset is as follows: • Control centers. Technology is crucial to the monitoring and safe operation of a tunnel. Control centers remotely view, test, and monitor a tunnel environment using digital transmission and other technology. Maritime Incident The occurrence of a maritime incident, specifically a ship sinking over a subaqueous tunnel or dropping a depth charge on the tunnel, is a threat to the safe operation of a water tun- nel. Subaqueous tunnels located under navigable waterways are potentially at risk. A maritime incident may result from a navigational error or mechanical defect aboard the ship. A maritime incident may also result from an intentional act by an aggressor. An intentional maritime incident may be part of a more elaborate attack designed to simultaneously inflict damage on 14

multiple assets. For example, the use of a sunken vessel to damage the tunnel shell will cause a great amount of first responder resources to be devoted to mitigating the water- borne disaster. An aggressor may take advantage of the con- centration of resources at that site and strike another area deemed to be the higher-value target. In this example, the sunken vessel only serves as a delivery mode for an explosive to reach the tunnel shell. A quantity of explosives detonating outside the shell would damage the shell. The extent of dam- age will be determined by the exact placement of the explo- sive and the quantity deployed. All explosions occurring from the outside on the tunnel shell will cause the closure of the tunnel to users for a period of time while the damage is inspected and mitigated. Efforts will also be expended to evacuate any tunnel users in harm’s way. The related asset is as follows: • Tunnel structures. Subaqueous tunnels may suffer dam- age or collapse if struck by a ship of sufficient size. The damage or collapse may allow sufficient water inflow to flood the tunnel, thereby endangering lives, property, and the use of the tunnel. Fire (Arson) Arson is the criminal act of enacting a conflagration on property. The act is intended to inflict injury to persons and damage to property. Arson that is intended to damage or destroy property may also recklessly endanger the safety of tunnel users and first responders. An occurrence of arson could inhibit the ability of the tunnel operator to open the tunnel for a period of time. A 341 million British thermal units (MBTU) per hour (100 MW) fire is the maximum design fire currently used globally for most road tunnels and is the maximum size fire that can be controlled by the majority of road tunnel ventilation systems. In typical tran- sit and rail tunnels, the maximum design fire size is much lower, in the neighborhood of 68.2 to 170.5 MBTU per hour (20 to 50 MW). Any fire larger than 341 MBTU per hour (100 MW) will not be controllable in any tunnel and, there- fore, could be a major catastrophic event. Therefore, this project considered only fires larger than 341 MBTU per hour (100 MW). Sabotage of MEC Systems A premeditated, intentional disruption of tunnel MEC systems presents a threat to all nearby below-grade tunnel structures. Loss of system function may alter the effective- ness of safety and operational systems, thereby presenting a tunnel condition unfit for general use. Systems designed for the evacuation of water, delivery of power, provision of fresh air, or monitoring of traffic may be made unusable for an extended period. Replacement of the sabotaged system may incur great costs and lengthy installation times. Significant loss of MEC systems may cause tunnel operations to be sus- pended. The related assets are as follows: • Tunnel structures. A disrupted utility may cause the sus- pension of tunnel system operations due to unsafe condi- tions. Power loss in a tunnel system will likely trigger a closure of the underground area and evacuation of stand- ing populations. Water or sewer inflow will trigger an immediate suspension of tunnel operations or severe restrictions on travel through the system. • Vent shafts. Exhaust and air intake machinery may suffer a loss of function due to a loss of power or a sudden water inflow. • Stations (passenger tunnels only). Sabotage of MEC systems may adversely impact a passenger station due to power loss, which cripples lighting, ventilation, and safety systems. Disrupted sewer, steam, and water lines allowing material to enter the station could create an unsanitary condition, thereby precipitating injury and evacuation. • Substation. Facilities containing connections for pumps and feeder machinery may suffer a loss of function due to a loss of power. • Control Centers. Monitoring capabilities of a control cen- ter are diminished or negated by a loss of power. Staffed control centers are also subject to evacuation because of unsafe or unsanitary conditions that may be found with a disrupted water, steam, or sewer pipe. • Distribution channels. Piping, wiring, conduit, and shafts to control fire control, ventilation, smoke detec- tion, carbon sensor, and video monitoring equipment may suffer a function loss due to a power loss or inten- tional damage. • Utility terminus building. This facility may be the direct target of an aggressor determined to damage or interrupt MEC systems within a tunnel system. Loss of the utility ter- minus building would require intensive repair efforts. 2.4 Conclusions To varying degrees, the hazards and threats presented in this chapter have occurred in the United States. They will likely present themselves again. Their capacity to close a tun- nel system, however briefly, is proven. Although their detri- mental effects on the tunnel system, equipment, and users may be mitigated, the more consequential security threats may have unprecedented consequences in terms of major tunnel damage and indeterminate service impacts. 15