Marine Terrorism. A re-evaluation of the risks. Tim Allmark Engineering Manager ABS Consulting Europe & Middle East

Transcription

1 Marine Terrorism A re-evaluation of the risks by Tim Allmark Engineering Manager ABS Consulting Europe & Middle East

2 RUNNING ORDER Introduction ISPS Code Overview Understanding the Context Application of Traditional Risk Tools Consequence Management Summary

3 INTRODUCTION In December 2002 the IMO adopted a new set of guidelines for international shipping. These are intended to improve marine security by limiting the opportunities for terrorism and having systems in place to manage the consequences. By July 1 st 2004 all ships above 500t DWT will need to have the following procedures/documents in place:- Ship Security Plan Ship Security Assessment The following roles also need to be created:- Company Security Officer Ship Security Officer

4 ISPS CODE OVERVIEW By July 1 st 2004 all ports trading internationally will need to have the following procedures/documents in place:- Port Facility Security Plan The following role also needs to be created:- Port Facility Security Officer There are estimated to be c 6500 port facilities worldwide which fall under this regulation, however the top 40 ports handle c 80% by tonnage. Costs? Ships- $1.3Bn, + &730Mn/ year Ports $30Mn, & $8Mn/ year

5 SHIP SECURITY CERTIFICATION CHALLENGE ISPS Code Required Ships to be Certified per Day, World Fleet To meet 1 July 2004 deadline (at 6 days per week) Total Fleet = 43,794 Ships 500gt + Self Propelled MODUs Starting Point 1 July Regulations come into force 0 Feb- 03 Mar- 03 Apr- 03 May- 03 Jun- 03 Jul- 03 Aug- 03 Sep- 03 Oct- 03 Nov- 03 Dec- 03 Jan- 04 Feb- 04 Mar- 04 Apr- 04 May- 04 Jun /03/2003 PLENARIO 5

6 AN OVERVIEW OF MARINE TERRORIST SCENARIOS Source OECD

7 REGULATIONS Regulations- Mandatory SOLAS/ ISPS US Maritime Transportation Security Act 2002 USCG 96 Hour Rule Regulations- Voluntary US Container Security Initiative(USCSI) US Customs Trade Partnership Against Terrorism (C-TPAT) Mandatory for all vessels over 500t, and all international ports, regulated via IMO. Enacts ISPS into US Law and adds further controls Requires 96 hour notice of port arrival Develops bilateral agreements between the US and foreign states to scan for high risk containers. Currently 23 ports have agreed in principal, and 15 have implemented. Supply Chain security initiative to trace goods from origin shipper through to final delivery

8 ISPS CODE IN CONTEXT Source OECD

9 SHIPPING CASUALTIES 2002 Number of Vessels Lost Number of Lives Lost Losses in mgt Source Lloyds Fairplay

10 SHIPPING CASUALTIES 2002 Total Losses (number) by Incident Type Foundered Fire/ Explosion Collision/Contact Wrecked/ Stranded Others Total Losses (Tonnage) by Incident Type Foundered Fire/ Explosion Collision/Contact Wrecked/ Stranded Others Source Lloyds Fairplay

11 TERRORISM VS ACCIDENT Accidents are Cascades of Random and Ordered Events that Lack Deliberate Intent Terrorist attacks are no longer an accidental challenge but a deliberate and intelligent attack on the people/assets

12 TRADITIONAL RISK MANAGEMENT Traditionally Risk = Frequency (F) x Consequence (C) Frequency = Initiating Event Frequency x Prob of Safeguard Failures In some ways all the above can be quantified Security Risk = Threat(T) x Vulnerability (V) x Consequence (C) Threat is a measure of the likelihood of a specific attack will be initiated against a specific target. Quantitative estimation is difficult. Defining Threat is difficult, and therefore focus should be on Vulnerability and Consequence Management.

13 TRADITIONAL RISK MANAGEMENT Vulnerability Availability Accessibility Organic Security Target Hardness Consequence Asset Losses Life Losses Environmental Losses Business Interruption

14 APPLICATION OF TRADITIONAL RISK TOOLS Prevention factors Prevention factor Control of escalation factor Escalation factors H A Z A R D Threat 1 Threat 2 Threat 3 Barriers to prevent threat release Top event Recovery preparedness measures Consequence 1 Consequence 2 Consequence 3 Bow Tie Methodology Engineering Maintenance Operations

15 SECURITY AND SAFETY Terrorist Attack and other Sabotage Threat Scenarios Infrastructure and Operations Security Vulnerabilities Consequences Contingency Preparedness and Response Plans Physical Information / Chemical releases Emergency Planning Intrude/Take Control & Communications Biological material and Lifeline Damage/destroy with Barriers: Restrictions that releases Protection explosives deter the threat (passive Radiation releases Vulnerabilities Create a pollution incident and active) Fires / Explosions Failing to identify key Take/kill hostages Detection: Ability of scenarios internal and external Collisions / allisions Etc. security to identify an attack Ineffective planning Assaults on people External attack by: (including intrusion sensing, Insufficient coordination alarm communication, alarm Property, cargo and and communication Ramming with a vehicle/ assessment, and entry equipment damage / External vessel loss Attack: control). Failing to establish and maintain preparedness Weapons launched from Response: Ability of Business a distance internal and external Limburg interruption rammed / delays Inadequate by readiness and loss of commerce evaluation (e.g. drills) Etc. security to interrupt or neutralize an attack explosives Etc. laden boat Etc. Fragility: Ability of target 03/03/2003 to withstand attack PLENARIO 15

16 SECURITY AND SAFETY Terrorist Attack and Infrastructure and Terrorist other Attack and Operations Sabotage Threats other Sabotage Threats Security Vulnerabilities Intrude / take control & Damage / destroy with Availability: explosives Create a pollution incident Accessibility : take / kill hostages Unrestricted Access to etc. Vessel for an attack Vulnerable External attack by: Organic Security : Port Ramming with a vehicle / No Ability of internal or vessel external security to interrupt or neutralize an attack Weapons launched from a distance Hardness Etc. Vessel was on a regular course Able to withstand attack without sinking Consequences Chemical releases Biological material releases Radiation releases Fires / Explosions Collisions / allisions Assaults on people Property, cargo and equipment damage / loss Business interruption / delays and loss of commerce Etc. Contingency Preparedness and Response Plans Emergency Planning Emergency and Lifeline Planning and Protection Lifeline Vulnerabilities Protection Vulnerabilities Failing to identify key scenarios Failing to identify key scenarios Ineffective planning Ineffective planning Insufficient coordination and Insufficient communication coordination and communication Failing to establish and maintain Failing to preparedness establish and maintain preparedness Inadequate readiness evaluation Inadequate (e.g. readiness drills) evaluation (e.g. drills) Etc. Etc. Double hull was its only defense 03/03/2003 PLENARIO 16

17 SECURITY AND SAFETY Terrorist Attack and other Sabotage Threats Intrude / take control & Damage / destroy with explosives Create a pollution incident take / kill hostages etc. Infrastructure and Operations Limburg consequences: Fire Pollution External attack by: Ramming with a vehicle / vessel Weapons launched from Security Vulnerabilities Physical Information / Communications Barriers: Restrictions that deter the threat (passive and active) Detection: Ability of internal and external security to identify an attack (including intrusion sensing, alarm communication, alarm assessment, and entry control). Property damage Business implications Consequences Chemical releases Fires / Explosions Property, cargo and equipment damage / loss Business interruption / delays and loss of commerce Contingency Preparedness and Response Plans Emergency Planning and Lifeline Protection Vulnerabilities Failing to identify key scenarios Ineffective planning Insufficient coordination and communication Failing to establish and maintain preparedness a distance Response: Ability of internal and external Inadequate readiness etc. security to interrupt or evaluation (e.g. drills) neutralize an attack Fatality Fragility: Ability of target Etc. to withstand attack 03/03/2003 PLENARIO 17

18 Limburg- Simple Scenario Assessment Case 1 At Time of Incident Vulnerability Score Availability Accessibility Organic Security Consequence Score Hardness Overall High High High Medium High Death/Injury Capital Losses BI Losses Environment Overall Low Medium High Medium Medium Conseque nce Score Vulnerability Score Low Medium High High Consider Mitigate Mitigate Medium Document Consider Mitigate Low Document Document Document 03/03/2003 PLENARIO 18

19 Case 2 Following ISPS Alternate Heading or route Vulnerability Score Availability Accessibility Organic Security Hardness Overall Medium Medium Medium Medium Medium Implement a Watch at X Miles Provide Awareness Training and Route Specific Security Briefs Consequence Score Death/Injury Capital Losses BI Losses Environment Overall Low Medium High Low Medium/Low Consequence Management Plans in place Conseque nce Score Vulnerability Score Low Medium High High Consider Mitigate Mitigate Medium Document Consider Mitigate Low Document Document Document 03/03/2003 PLENARIO 19

20 CONSEQUENCE MANAGEMENT Boat Ramming Change Course CONSEQUENCE Internal Sabotage EVENT CONSEQUENCE Piracy PREVENTION CONTROLS CONSEQUENCE CONTROLS CONSEQUENCE CONSEQUENCE ISPS Code Consequence Management (Part ISPS Code) Threat-Consequence Diagram

21 Port Vulnerability Scenario Two Vessels are sunk in New York Harbour in key positions limiting access and egress out of the port. Salvage of the vessels takes 2 weeks. In the meantime, container vessels are re-routed elsewhere, fuerther more detailed examination of vessels is made. Environmental clean up takes 12 months. Consequences: Loss of life - 20 Loss Of Hull/ Machinery $ M Cargo Loss Business Interruption Environment $25M $ M $5Bn 03/03/2003 PLENARIO 21

22 Consequence Management - Example

23 Summary 1. The threat of Marine Terrorism is Clear and Present 2. The ISPS Code is a major step in reducing risks to ships and ports 3. Reducing to zero is not practicableneed to follow the ALARP Approach 4. BI and Environment are likely to be the biggest losses for Cargo vessels 5. Security is highly dependant on people and process 6. Good consequence management plans c an mitigate the final outcome substantially