A Practitioner's Guide to Effective Maritime and Port Security

Introduction xiii

Foreword xvii

Part OneThe International Maritime Operating Environment

Chapter 1 Unique Characteristics of Ports and International Shipping 3

Introduction 3

The Multinational Nature of Shipping and Business Driversin Port Operations 6

Flag States 7

Vessel Registries 7

Types of Vessel Registries 8

Implications for Security 10

Third Country Owners 11

Implications for Security 11

Multinational Crews 13

Implications for Security 14

Port States 14

Regulatory Requirements 16

International Treaties and Codes 16

Oversight Mechanisms 18

Ship-Port Relationships 19

The Supply Chain 20

Just-in-Time Delivery 20

The Components of a Maritime Supply Chain 21

Regulatory Issues 22

Intermodal Links 24

Chapter 2 The Criticality of Ports: Why and How They Matter 27

Introduction 27

Geopolitical Considerations 27

Trade Routes 27

Trade Chokepoints 28

Sea Lines of Communication 30

Ports 33

Ports as Targets 34

Ports as Conduits 36

Cargo Theft 38

Smuggling 40

Ports as Borders 41

Intermodal Connections 42

Part TwoThreats to Ports and the Maritime Domain

Chapter 3 Threats 47

Introduction 47

Threats by States 49

State Actors 49

Conventional Military Attacks Against Ports 49

Conventional Attacks Against Supply Chains 51

Asymmetric Attacks 52

State Proxies 56

Proxy Tactics 57

Nonstate Actors 58

Terrorism 61

Criminal Activity 62

Piracy 67

Terrorism, State Actors, and Criminal Nexus 68

Part ThreeCurrent Approaches to Maritime and Port Security

Chapter 4 Approaches to Security Policy Development 73

Introduction 73

Political Considerations 73

Commercial Interests 74

Costs of Implementation 74

Increased Government Oversight 74

Potential Delays 75

Domestic Political Constituencies 76

Container Screening 77

Port Security Grants 79

Measuring the Effectiveness of Security Measures 81

Deterrence 81

Punishment 81

Denial 82

Consequence Management 84

Measurement of Activity vs. Effectiveness 87

Measurement of Activity 87

Resources Expended 87

Measurement of Criminal Activity 88

How to Measure Effectiveness 91

Why Don’t We Do This Already? 92

The Maritime Context of Assessing Deterrence 93

Lack of a Risk Approach 94

What is Risk? 95

Dynamic Risk 96

Pure Risk 96

Fundamental Risk 97

Particular Risk 97

Components of Security Risk 97

Threat 97

Vulnerability 98

Consequence 98

Risk Management 99

The Weaknesses of Current Risk Management Approaches 99

Lack of Understanding of Security Risk Components 100

Lack of a Process to Determine Risk Tolerances 100

Tendency Towards Risk Aversion or Avoidance 101

Focus on Risk Mitigation (Reduction) instead of

Risk Treatment 101

viii Contents

Lack of Recognition of Critical Nodes in the

Maritime Domain 101

Overquantifying Security Risk 102

Tendency to Use the Rubric of All-hazard Risk 104

A Propensity to Minimize the Element of Threat in Performing

Security Risk Assessments 104

Chapter 5 A Critique of Current Maritime Security Measuresand Approaches 107

Introduction 107

Regulations and Their Limits 108

The ISPS Code 109

Supply Chain Security 112

International Organization for Standardization 116

Lack of Recovery Planning for Key Maritime

Supply Chain Components 117

A Disjointed International Regulatory Environment 117

Overreliance on Technology 118

Maritime Domain Awareness (MDA) 118

The Fallacy of 100 Percent Container Screening 120

The 'Magic' of Closed Circuit TV (CCT V) 121

Failure to 'Fire for Effect' 122

The Staten Island Barge Explosion 122

Minimizing the Importance of Understanding Threat 123

Hurricane Katrina--the Wrong Lesson Learned 124

Assessing Threat is Hard 126

Why Understanding Threat Matters 126

Bomb in a Box? 127

Deconstructing the Threat 127

Biological and Chemical Agents 128

Radiological Material 128

The Nuclear Grail 128

The Risk Conundrum 129

The Consequences of not Understanding the Threat 130

Hitting the Bystander 130

Al Qaeda’s View of Saddam’s Iraq and Vice Versa 130

The Threat That Wasn’t 131

The Fallout 131

The Lack of a True Risk-Based Approach 131

Insufficient Focus on System Integrity 135

Transparency 135

Corruption 135

Implications for the Maritime Domain 135

The Impact of Corruption 136

Lack of Incentives for the Private Sector 137

Part FourPrinciples for Effective Maritime and Port Security

Chapter 6 Security as an Enabler 141

Introduction 141

Why is it Important for Security to be an Enabler? 142

Security as a Value-Add 142

A Culture of Security 142

Changing Security’s Image 143

Security a Key Organizational Component 143

Resilience 144

Why Resilience? 145

Risks of Ignoring Resiliency 145

Additional Risks 147

The Benefits of a Resilience Approach 147

Resilience and Maritime Security 149

Resilience Guidance 149

Integrating Security into Resilience 150

The Elements of Resilience 151

The Medical Comparison 155

Enabling Resilience 156

Chapter 7 Standards and Regulations 159

Introduction 159

Review of the ISPS Code 159

The ISPS Code 160

ISPS Code 2.0 161

Use ISO 28000 as the Foundation for a new ISPS Code 162

Considerations 164

Acceptance Issues 164

Implementation Issues 167

Other Implementation Considerations 171

Notional Contents and Structure of a New Code 173

The New Code 174

Chapter 8 Assessing and Managing Risk 177

Introduction 177

ISO 31000 178

Risk Terminology 180

Risk 180

Risk Management 180

Risk Assessment 180

Risk Analysis 180

Risk Appetite or Tolerance 180

Other Definitions 181

Threat 181

Hazards 181

Vulnerability 181

Likelihood 181

Consequence 181

Core Components of Risk 182

Establishing the Risk Management Context 182

Identify Risks 183

Analyze Risks 185

Evaluate Risks 186

Treat Risks 188

Making the Business Case for Risk Treatment 190

What is a Business Case? 192

Composition of the Business Case 192

The Business Case and Risk Treatment 193

Monitor and Review 194

Communicate and Consult 195

Maritime Considerations 197

Chapter 9 Measuring Effectiveness 199

Introduction 199

Measure Effectiveness, Not Security Activity 200

Measurement of Activity 201

Resources Expended 201

Measurement of Criminal Activity 201

Uniform Crime Reporting System 202

CompStat 202

The Black Swan Effect 202

Measuring Effectiveness 203

A Hybrid Solution 203

Ask the Enemy 204

Crunch the Numbers 207

Deterrence as the Primary Measure 207

Deterrence 208

Ensuring Integrity and Countering Corruption 209

Foster Continuous Improvement 210

Chapter 10 Conclusion 211

Appendices

Appendix A Conducting Security Risk Assessments 215

Introduction 215

Risk Assessment Steps 216

Establish the Risk Management Context 217

Identify Risks 217

Analyze Risks 218

Evaluate Risks 218

Conducting Risk Assessments 219

Assessment Team Composition 219

All Assessors 219

Lead Assessor 219

Assessment Team Members 220

Facility Risk Assessment Process 220

Facility Risk Assessment Preparation 221

Written Notification to Facility Operators 221

Planning Assessment Activity 222

Facility Risk Assessment Administration and Logistics 223

Facility Risk Assessment Activity 223

Document Reviews 224

Formal and Informal Interviews 224

Observations 224

Assessment Opening and Closing Meetings 224

Opening Meeting 224

Closing Meeting 225

Facility Assessment Reporting 225

Assessing Vulnerability 225

Assessing Consequence 227

Developing a Risk Rating 227

Appendix B Conducting Threat Assessments 231

Introduction 231

Consistency with ISO 31000 232

Threat Identification 233

Identify the Range of Potential Threat Actors 234

Identify an Extensive List of Threat Actor Characteristics 234

Identify Sources of Threat-Related Information 234

Analyze and Organize Threat-Related Information 238

Threat Evaluation 238

Threat Actors and Scenarios 241

Develop The Design Basis Threat 241

Appendix C Tips for Assessing Risk Appetite 259

Introduction 259

Defining Risk Appetite 259

Risk Appetite and ISO 31000 260

Assessing Risk Appetite 260

Helping a Client Determine Risk Appetite 261

Pairwise Exercise 262

Risk Appetite and Risk Treatment 263

Index 269