Chemical Security: It’s a Partnership Thing

On Monday, the education session “Addressing Global Challenges for Chemical Security Leadership,” featured Kelly Murray, associate director of chemical security at the U.S. Cybersecurity and Infrastructure Security Agency (CISA), on a panel with chemical industry security representatives—Carey Waltz from Linde and Noel Hsu at Orica USA—to share their experiences.

Main Takeaway

Murray kicked off the session with the main point: the people on the panel. At GSX 2023, a regulator was sharing the stage with representatives from two companies she is charged with regulating. This, she says, symbolizes the key ingredients in the safety and security of hazardous chemicals: trust and partnership.

“One of the reasons chemical security has been so effective in the U.S., is that the regulators and the chemical companies work to solve problems together,” Murray says. “We look at what works for the companies and their business models, and we find solutions together in partnership. And ‘partnership’ was a word I wasn’t allowed to use to describe our relationship with customers a few years ago. But now it’s a model we’re proud of. We learn from companies what is going to work for them.”

Part of that learning process involves the company sharing its plans for safety and security, including any processes.

“It takes trust for a company to open its doors to a regulator. There could be violations, products may not be in the right place,” Waltz says. There’s a risk in having a regulatory agent sift through plans or methods, as he or she could identify reasons to slow down or disrupt operations—and a perceived overreach could sour relationships between parties.

But here, in honor of the partnership, the agency isn’t issuing orders. Instead, the agency will either endorse the plans or send back a list of recommended changes.

“It’s not the government telling us what to do,” Waltz adds. “…It is a true partnership.”

One of the primary U.S. regulations controlling chemicals, the Chemical Facility Anti-Terrorism Standards program, expired in July 2023. Without the enforcement regulation, CISA has called on companies to voluntarily maintain security posture through its ChemLock program. Murray touts the materials available to companies, including fact sheets, flyers, online trainings, and tabletop exercise plans.

Waltz also pointed to the Chemical Sector Coordinating Council, a self-organized and self-governed group of 15 chemical-related trade associations.

“We address a variety of issues [chemical manufacturing companies] face,” she says, “from supply chain issues and distribution problems to learning about how to protect chemicals when facing natural disasters. We have a great back-and-forth dialog.”

For example, when Russia began its war in Ukraine, a company needed to know what to do with a large quantity of a potentially hazardous chemical that was stuck in situ. After consulting with government experts, the council advised that the best solution would be to bury the material.

All the panelists agreed that the partnerships fostered by CISA strengthened the state of chemical security in the United States. On a global scale, however, is where the challenges lie.

Next Steps for Security Practitioners

Supply chains, distribution, and the rise of chemical sales through ecommerce—which increased rapidly during the COVID-19 pandemic. These mark the biggest challenges facing the chemical industry.

“We’re creating many, many tons of ammonium nitrate each day,” Hsu says. “We can’t have that sitting at our facilities, we need to move it out. It puts tremendous pressure on our transport partners, which we contract out. For years we were focused on safety more than security, making sure we had partners who could transfer the material without causing an explosion. But in the last 10 or more years, security is also incredibly important—you want to keep the chemicals out of the hands of those who would do harm. In the U.S., it is not such an issue, but very few countries have the infrastructure the U.S. has.”

Another challenging factor is technology. Murray points to drones as an example of technology that has outpaced government’s ability to regulate or even address. She notes that drones are being manipulated and used by adversaries in novel ways that are difficult to predict.

“With all technology, it’s a constant challenge,” she says. “When we look at AI, for example. We’re trying to figure out how we can bake security in from the beginning. Design its use in such a way that security is not afterthought, it’s in there by default.”

Other Resources

For security practitioners looking to learn more about chemical security, consider attending these GSX 2023 sessions on Tuesday:

Tuesday, 12 September

• 2:00 p.m. to 3:00 p.m.: “Leveraging AI and Other Technology Evolutions in Supply Chain Risk Management: A Post-Pandemic Update”
  
  
• 2:00 p.m. to 3:00 p.m.: “Why Geopolitics (and Geopolitical Risk) Matter in Enterprise Risk Management”

Along with GSX 2023 educational sessions, there are also ASIS resources on chemical security that members and attendees can review:

• “An Explosive Act: Assessing the Safety of Chemical Facilities”
  
  
• “CISA Launches ChemLock Program to Share Security Expertise”
  
  
• On-Demand Webinar: Spies in the Supply Chain

Scott Briscoe is the content development director at ASIS International, the publisher of Security Management and the GSX Daily. Connect with him at [email protected].