Natural Gas Perspective

Jul 15, 2008

Critical Infrastructure Security

Today, the threats to industry vary from those of a decade ago. The natural gas ­distribution industry has responded to the challenge – we have improved our understanding of new threats; and we have taken steps to ensure the continued reliability of the critical infrastructure that delivers 24% of Canada’s end-use energy to Canadian industry, businesses and homes, and exports half of our production over 3 trillion cubic feet of natural gas to the U.S.

Texas Wetlands are an example of the many diverse geographic areas through which gas pipelines run.

Still, there’s room for advancement in the areas of communication between ­government and private sector owners and operators and clearer understanding of critical infrastructure interdependencies. This would provide improved understanding of domino effects, and increased knowledge of effective responsibility and communication channels. We need this type of knowledge and communication between government and industry to get the right info to the right person at the right time; supporting industry’s readiness to respond when it matters the most.

The Change
9/11 was the catalyst that changed the way industry thinks about asset vulnerabilities and resilience. Historically accustomed to dealing with threats to our infrastructure from digging activity and from nature, the owners and operators now have an enhanced understanding of deliberate, malicious, cyber and human resource threats to our systems. Our industry has responded to these potential threats by focusing on improved emergency response plans.

Given the diffuse characteristics of the natural gas infrastructure, securing the reliable operation of this critical infrastructure in large part is in response, not protection. The natural gas industry has significant reserve in its infrastructure and focuses on rerouting and other immediate responses rather than building barriers to protect itself.

In Canada alone, Canadian Gas Association (CGA) members have over 580,000 km of distribution pipeline composed of mainlines and services which are fed by 80,000 km of high pressure transmission pipelines. The majority of our lines and valves are buried, with stations and some valves above ground. The substantial number and vast distribution area of our facilities make it impractical to protect the assets. Focusing on Emergency Response is the best way to secure the resilience of the critical natural gas delivery infrastructure.

New Initiatives
Post 9/11, CGA formed a task force to examine additional threats to our system and review major issues related to protection and emergency response. Companies exchanged best practices and compared the results of independent security reviews. We also partnered with the RCMP who brought in other government agencies (intelligence, security and law-enforcement) and carried out a joint study on our vulnerabilities. Several of our members participated in cross-border studies with the US. As a result, natural gas delivery companies reviewed and enhanced their security and response plans to deal with potential deliberate malicious attacks, and more.

The majority of gas infrastructure is buried.

We have an industry-wide Mutual Aid Agreement in place and have developed an Influenza Pandemic Planning Guide. Our members continue to exchange best practices and emergency response procedures and participate in mock emergency response scenarios. These exercises are now common­­place within companies.

Our members are involved with the national effort, led by the National Energy Board, to develop a new security standard for natural gas pipelines through the Canadian Standards Association. We welcome and support security standards. For us, however, standards determine the minimum performance requirements, or setting ‘the floor’ for ­company practices. The ceiling is set by the rigorous ongoing exchange of best practices and exercises.

Interdependency – The Domino Effect
These are steps that natural gas distribution utilities have taken to enhance the security and resilience of our assets. Yet, our understanding of the domino effect is still primitive.  The study of interdependencies among different critical infrastructures is a journey, not a destination; some local level progress has been made, but work is sorely needed at the national level. Working with government and other critical infrastructure owners and operators will take time. As the layers are peeled away, greater understanding of how we are connected is gained, revealing further layers to be examined and resolved.

We must work together to improve our understanding of interdependencies. For instance, since 2001, Gaz Métro has been involved in a research initiative with the École Polytechnique de Montréal and ­critical infrastructure operators like CGA, Hydro-Québec, Bell, the city of Montreal (potable water supply), and the Ministry of Transportation. Geographical and functional issues are being examined in Québec City and downtown Montreal on how an incident on one system can affect the critical infrastructure of another. The scenario of a major water pipe break identified serious infrastructure domino effects and time lags. As a result, individual plans addressed such potential effects; critical zones were ranked, and harm reduction measures developed. Industry is considering the establishment of early warning systems and the use of alternative resources. This research led to concrete operational changes and understanding; and also increased cooperation and trust among the stakeholders.

While there are obvious benefits to understanding the interdependencies of energy, banking, telecom, transport and other critical infrastructure, complex and practical issues remain around business confidentiality challenges. Local exercises are easier to implement, and have been an ongoing focus for most companies. Continued work is needed, with the understanding that effort with different industries will take time.

While the threat profile has changed in the recent past, the net effect on our system from a deliberate and malicious attack is similar to any other disruption. Our members have been operating the natural gas delivery infrastructure for over a century; we have robust emergency response procedures in place and we continuously improve our understanding of interdependencies.

The Private/Public Sharing of Responsibility
Another key issue that remains to be addressed fully is the private/public responsibility in ensuring the security of the critical infrastructure. Government’s interest in ensuring the safety and security of critical infrastructure is obvious. What is less clear is the delineation of responsibilities between the government and the private sector (owners/operators of over 80% of the critical infrastructure) to ensure overall security of all citizens.

Good management of our infrastructure security is based upon the ability to have timely knowledge of threats and the ability to respond. Government has a responsibility to ensure safety. Its responsibility lies in informing the commercial owners of infrastructure of threats in a timely manner. It is then up to industry to make the decisions in response to threats and ensure continuity of critical services. This reality mandates a close collaboration between governments and the critical ­infrastructure owners and operators. In the past several years, major progress has been made in this area, yet much work still remains and needs attention.

Government has access to information from intelligence, security and law-enforcement. Compiling, analyzing and translating this information to relevant knowledge about threat situations relating to different critical infrastructures and then communicating it to the owner operators of the infrastructure in a timely fashion is one of the key roles of government. There is not yet the necessary single government point of contact that private sector owners and operators of critical infrastructure need and can approach to understand the threats and agree on the best protection and emergency response measures.

There is a plethora of agencies on the government side: intelligence and law-enforcement agencies, agencies focused on terrorist threats and those focused on emergency response and preparedness against all threats and the different federal, provincial, territorial and sometimes local agencies. This defines the challenging domain in which critical infrastructure owners and operators operate. It also makes these same operators less receptive to meeting multiple agency demands for information on their infrastructure without a clear understanding of how that information will be used, who will have access to it, and how it will be kept secure.

The One-Stop Government Shop
The pursuit of a single stable government agency, a one-stop-shop for critical infrastructure operators, still remains our goal. It will allow governments to develop the experience and knowledge of how industry works while providing us with meaningful information. With ongoing communication and support from one source, industry will be confident that we are obtaining the right information and guidance from government when threats are imminent. Industry will also find it easier to provide the confidential information on our actions to protect and respond confidently.

One example of success has been the way Canada and the U.S. have handled the security of cross-border critical infrastructure. These two governments engaged the private sector as an equal partner. Company representatives were teamed with intelligence officers, defense experts, assault planners, specialists on interdependencies and policy, first responders, explosive analysts, modelers, and government representatives. Several joint vulnerability assessments were completed on natural gas pipelines that cross the border. The outcomes were very positive.

We can build on successes such as the cross-border efforts to enhance ongoing dialogue between Canadian government and industry. The roles and responsibilities of the public and private sectors need to be more clearly understood and accepted. What government asks of us should balance with what industry needs from government. Governments need to avoid asking for duplicated efforts and variations of information from industry; figure out how to streamline communications both within different government agencies and between local, municipal and provincial levels. Industry needs a one-stop contact that speaks our language.

Let Us Progress Together
The natural gas distribution industry is ready to meet the security challenges of today. While we continue to work on securing our critical infrastructure through internal exercises, there remain key pieces of work to improve response in a crisis. Better understanding of interdependencies and government support through the establishment of a one-stop contact will ensure the right communications are in place during an emergency. The new National Strategy plan from government is a step in the right direction, let us now work on the implementation with industry.

Dr. Shahrzad Rahbar, is Vice-President Strategy & Operations, Canadian Gas Association and a graduate of London University in England, BSc in Mechanical Engineering and her PhD in heat transfer from Queen Mary College. She has more than 16 years of experience in the natural gas industry in Canada and holds patents as inventor of two technologies.
© FrontLine Security 2008