July 2006, TruckingInfo.com - Cover Story
These days when someone mentions "security threat," we typically think of 9/11 and international terrorist groups such as al Qaeda. We recall terrible scenes of passenger planes crashing into skyscrapers, and we can easily imagine how a truck loaded with explosives could become a weapon of mass destruction.
But security is a much broader issue. There are many types of terrorists and many ways to do harm. In addition to international terrorists, there are extreme fringe groups and even delusional individuals within our own borders who pose security threats.
Transporting large quantities of hazardous materials is a major security concern but, as the U.S. Department of Agriculture has warned, it wouldn't take much for terrorists to contaminate the country's livestock population or poison a tanker load of liquid food products.
There's also the ongoing problem of cargo theft. Every year the losses in the U.S. run into the billions of dollars. Most of it occurs in trucking. Although high-value goods are the most common targets, anything that can be sold easily and quickly is fair game for thieves.
The bottom line: No matter what you carry or how many trucks you own, it makes good sense to periodically assess your security vulnerabilities and come up with ways to protect your cargo, equipment and drivers.
HOW TERRORISTS WORK
One of the best places to start is with a general understanding of how terrorists and cargo thieves work.
Terrorists typically want to do the most damage possible with each action taken. For trucking, that means they're looking for materials and/or vehicles they can convert into weapons of mass destruction.
They might purchase the materials and have them delivered to the target location or to an intermediate location for later transport. They might gain possession of the materials and trucks through hijacking or theft. Or a truck under legitimate control might be converted to a WMD by tampering with the vehicle or cargo.
Cargo thieves are looking for goods they can move quickly and easily. High-value goods such as televisions and computers are attractive targets, but criminals with the right black market connections may also be interested in consumer items such as shampoo or cosmetics.
There are a variety of ways terrorists and thieves "stalk" potential prey. Public documents such as annual reports, marketing brochures and company web sites often provide a wealth of information about cargo and facilities. Cargo thieves frequently monitor loading docks and keep a watchful eye on unsecured areas where trucks often park. Terrorists and thieves also look for opportunities to obtain "inside" information – a dispatcher or dock worker willing to sell cargo and routing information, or even an innocent driver who discusses his load with a friendly stranger.
Federal regulations mandate written security plans for hazardous materials haulers. The U.S. Department of Agriculture recommends security plans for transporters of food and agricultural products. Security experts say planning is smart business for everyone.
Federal rules require assessment and planning to cover three key areas: personnel, access to information and facilities, and en route security.
Since few carriers have the resources to implement every security measure for every possible threat, vulnerabilities should be identified and prioritized. Security experts typically recommend a subjective system where threats are ranked on a scale ranging from "highly likely" to "highly improbable."
Another method is to consider the potential consequences of the terrorist attack or threat. For instance, a hijacked load of biological materials could be far more dangerous than a hijacked load of microwave ovens. Or you might consider both likelihood and consequences to establish priorities.
Some security measures should be applied across the board, but certain circumstances or cargo will require different strategies. Carriers should discuss security measures with shippers and consignees to make sure procedures work together. State, local and federal law enforcement agencies can be valuable resources for security planning and advice.
Employers often don't realize how much sensitive information their employees deal with every day. Thus companies should regularly look deep within the organization to see who has access to security-sensitive cargo, equipment, facilities and data.
One important question: How are employees screened? Federal safety and hazardous materials regulations mandate specific screening procedures for truck drivers. The company should consider equally careful background checks for all employees, or at least those in jobs with access to valuable cargo or security-sensitive information.
Under federal regulations, employers must get a copy of new truck drivers' motor vehicle records going back three years. They must also contact previous employers to obtain safety-related information including data on accidents and any violations of drug or alcohol restrictions.
Before a state can issue or renew a hazardous materials endorsement, the driver must undergo a criminal background check by Homeland Security's Transportation Security Administration. Drivers who have been convicted of disqualifying crimes are denied the endorsement, but employers are not privy to information obtained during the investigation. Moreover, the fact that a driver doesn't have – or won't apply for – a hazmat endorsement isn't necessarily the sign of a criminal past. Many have reportedly opted out of hazmat hauling because the process is too time-consuming, inconvenient or expensive.
Employers likely won't get much more information from TSA's proposed new Transportation Worker Identification Credential program for port workers (see related story, this issue). Individuals required to have the TWIC card will undergo background checks. Under the current proposal, employers may know the results of an individual's security threat assessment, but won't have access to biographical data or the reason for a negative assessment.
Companies that want to go beyond government mandates can start by making sure applicant screeners and others in the hiring process are adequately trained. At the least, companies should verify all information provided on employment applications, including previous employers, education, Social Security numbers and references. Screeners should know how to spot red flags such as gaps in employment, missing information, frequent job changes or multiple prior addresses.
If an applicant lists a former employer that is no longer in business, screeners should ask for names, telephone numbers and addresses of dispatchers, fleet managers or even other drivers the applicant worked with.
Personal interviews and road tests give trained professionals an opportunity to further evaluate an applicant's attitude and temperament while discussing areas of concern.
The Social Security Number Verification Service, offered through the Social Security Administration, is a relatively simple way to match names and Social Security numbers. The service is intended to assure accuracy of reporting, but a mismatch might signal possible identity theft.
The U.S. Citizenship and Immigration Services Bureau's Systematic Alien Verification for Entitlements (SAVE) Program has a pilot program that gives enrolled employers access to the system used by government agencies to verify work authorization for non-citizens.
Consumer credit reports can be used to verify past addresses and previous employment. Large debts don't make someone a credit risk, but serious financial problems can make them more susceptible to cargo theft schemes.
Criminal background checks can be a valuable tool in the screening program, but there are cautions. Private companies don't have access to nationwide databases used by law enforcement, so criminal records must be checked on a state-by-state or even county-by-county basis. Generally that's done in states and counties where the prospective employee is known to have lived or worked, but it's impossible to pinpoint areas where an interstate truck driver may have gotten into trouble. Moreover, identity mix-ups are not uncommon, so criminal reports should be verified before any action is taken.
Using third-party databases or screeners is a quick, easy way to get information on applicants, but the services should be selected carefully. Employers must make sure that the service is well-versed on federal safety regulations regarding truck drivers, and should seek assurances that background investigations are done in compliance with all applicable federal and state laws regarding discrimination and employee privacy.
Personnel files should be updated periodically. Supervisors should be trained to recognize changes in employee work habits or attitudes that may warrant further investigation.
Don't forget contractors or employees of outside product or service vendors, such as landscaping or janitorial services. Make sure those people are thoroughly screened by their employer and properly identified when on your premises. Their access to security-sensitive areas should be restricted and monitored.
The second major factor in personnel security is training and awareness. All hazmat employees must receive security awareness training covering the security risks involved in hazmat transportation, methods to enhance hazmat security, and how to recognize and respond to possible security threats. New hazmat employees must receive security awareness training within 90 days of hire and every three years thereafter.
Employees who are responsible for any part of the security plan must receive in-depth security training within 90 days of being hired, with follow-up training every three years. Instruction should only cover the part of the plan that is their responsibility. The content should include instruction or information on company security objectives, specific security procedures, employee responsibilities, actions to take in the event of a security breach, and the organizational security structure.
Training records for each employee must be maintained with the security plan and updated as training is completed. The records must include the employee's name, date of the most recent training, a description of the training or a copy of training materials, the name and address of the person providing the training, and certification that the employee was trained and tested. Records for each employee should go back three years and should be kept for 90 days after termination.
All employees should receive training in emergency procedures, including evacuation routes. They should know who to contact inside the company if there's a security breach or even suspicious activity. They should also know who to contact outside the company, such as local law enforcement.
FACILITIES AND DATA SECURITY
Any area where large amounts of hazmat or high-value goods are stored is obviously a potential target. Less obvious are administrative offices, which typically have data on cargo, routes and security plans. Unprotected maintenance and fueling areas may offer easy access to trucks. Dispatch operations are a potential source of information and, in a terrorist attack, could be commandeered to redirect trucks to targets or to areas where they could be more easily hijacked.
Tactics will vary with assessed security risks, but here are some possibilities:
• Photo identification badges for all employees that must always be worn on company premises. The rule should be strictly enforced.
• Visitor sign-in and visitor badges. Strictly followed control and custody procedures should keep track of both. Areas that visitors aren't allowed to enter without a company escort should be clearly designated and the restriction should be strictly enforced. Employees should be trained to recognize unauthorized people in the facility, and should know what to do when they see someone who is out of place.
• Employees of outside vendors should be required to produce identification when coming on premise. They also should be required to wear visitor or photo badges and their access should be restricted to areas where they need to be.
• Install perimeter security such as fences, lighting and/or video surveillance. Make sure there are "clear zones" inside and outside the fence for unobstructed observation by security guards and/or law enforcement.
• Install a security alarm system.
• Make sure inside and outside lighting is sufficient for security as well as safety.
• Limit property access to one or two entrances and exits. Post guards during periods of heightened security.
• Monitor critical areas with closed-circuit televisions, security cameras and/or periodic checks by security guards.
• Have separate areas for loading and customer/employee parking.
• Install alarms, intercoms or dedicated communications lines for emergency internal communications. Periodically test those systems.
• Install computer intrusion detection systems. Monitor Internet activity within the organization. Don't pass information regarding hazmat or other high-risk shipments over unsecured Internet connections.
• Establish a system to regularly check locks and other protective equipment to make sure it's functioning and there are no signs of tampering.
• Restrict the size and number of carry bags allowed in security-sensitive areas.
• Appoint one or two people in the organization to liaison with law enforcement and security agencies in the area, including special security or cargo theft units. Solicit their advice. Find out how you can help them.
SECURITY EN ROUTE
Trucks are especially vulnerable to terrorists and thieves because they move in uncontrolled areas with numerous potential threats. Much of the security plan's en route component will center on driver training and awareness, but the company plays a vital role.
All drivers should be briefed on their portion of the security plan, including potential security risks, prevention measures and emergency procedures. They should receive periodic training covering potentially dangerous situations and how to deal with those situations.
Use posters and newsletters to maintain awareness. Identify high-risk areas and talk to drivers about those areas. Identify high-risk loads and make sure drivers are briefed on security measures whenever they're assigned one of those loads.
Federal hazmat regulations have special routing requirements for certain types of hazmat. If no specific routing rules apply, hazmat carriers must – wherever possible – avoid routes through heavily populated areas, places where crowds are assembled, tunnels, narrow streets or alleys, ferries and long-span bridges.
Whenever possible, carriers should analyze routes for possible vulnerabilities such as high crime areas. Keep in mind that route plans can change due to construction, accidents, weather or other circumstances. Have guidelines for drivers and dispatchers when they encounter those situations.
Carrier safety or security personnel should identify safe and unsafe places where drivers can park their rigs for rest and in emergencies. Even areas touted as "secure" should be physically inspected before recommending them to drivers. If there's an emergency and the driver must park the rig or drop the trailer in an unfamiliar area, dispatch or security personnel might call customers, truck dealers, other carriers or anyone else they know who may be able to recommend a safe and legal location.
Federal hazmat rules prohibit trucks carrying certain hazardous materials from being parked on public streets or highways, on private property without permission, close to bridges, tunnels or areas where a lot of people congregate. Many municipalities restrict all truck parking in certain areas. And these days an unattended truck or trailer is likely to raise security concerns.< If the vehicle must be parked in a restricted area, the driver or the company should contact local police as soon as possible. If possible, the driver should stay with the vehicle.
Shippers, consignees and even other carriers sometimes allow emergency parking at their facilities, but they may want a claims waiver or similar document releasing them from liability for theft or vehicle damage. The company or driver should get permission from the facility manager or someone else in charge and should make sure security personnel at the facility are aware of the situation. It may even be worthwhile to have an attorney draw up a parking permission form that can be filled out, approved, and displayed in the window of the truck.
Carriers should make sure drivers know who to call in case of an emergency or if they simply have questions or concerns about a situation. Every contact on that list should be adequately trained to handle those calls and must be available during the times designated.
Company security officials should periodically review technical innovations such as trailer locks and seals; communications, tracking and surveillance systems; alarms; steering locks, electrical cutoff switches and other anti-theft devices.
Vehicle security equipment should be tested frequently to make sure it's working properly. Drivers should be adequately trained in its use. If something is broken, it should be fixed immediately.
The security plan should be a written document accessible only to employees with proper security clearance. Components of the plan must be available to those who are responsible for implementation, but the plan shouldn't be openly distributed throughout the company and should never be released to an outside party that doesn't have a verified need to know.
There should be a periodic review by top executives to determine if security measures have been implemented according to plan, if plan objectives have been achieved, and if changes are necessary.
Large companies, growing companies, or companies with changing operations should review the plan every year
FOR MORE INFORMATION
Details of the Transportation Security Administration's screening process for hazardous materials drivers – including fingerprinting locations – are available at www.hazprints.com or by calling (877)429-7746.
The Social Security Number Verification Service can be accessed online at www.ssa.gov. Search SSNVS.
For information about the U.S. Citizenship and Immigration Services Systematic Alien Verification for Entitlements (SAVE) Program call (888) 464-4218.
Federal regulations regarding security plans for hazardous materials haulers are contained in 49 CFR Part 172. Training requirements are in 172.704. Requirements for security plans are in Subpart I.
The Pipeline and Hazardous Materials Safety Administration's Office of Hazardous Materials Safety, http://hazmat.dot.gov, offers rules, guidelines and tips for carriers and drivers.
The Federal Motor Carrier Safety Administration web site, www.fmcsa.dot.gov, also has a section on security.
The Security Council of the American Trucking Associations offers security guidance, news of security-related regulations and legislation, and certification for cargo security professionals. Information is available at the ATA web site, www.truckline.com, or by calling the council at (703) 838-1718.
The International Cargo Security Council offers educational materials, security-related news and links to other security resources at www.cargosecurity.com.
ATA's Agricultural and Food Transporters Conference offers the Security Practices Guide and Resources Directory developed with the U.S. Department of Agriculture for food transporters. The organization also offers regulatory news and updates. More information can be found at the ATA web site noted above or by calling (703) 838-7999.
A listing of companies that provide employee screening services can be found in the Products & Services Guide at www.truckinginfo.com. Look under Business Services.