2004 AURIMS Annual Conference University Vulnerability Mitigating New Risks

1. 2004 AURIMS Annual ConferenceUniversity VulnerabilityMitigating New Risks Sheldon Krahe - Sinclair Knight Merz Proudly Supporting - Safeguarding Australia

2. Mitigating New Threats National Security Threats and Hazards Vulnerability Assessment Mitigation Strategies and Protective Design Urban Blast Effects Passive Defence Business Continuity Planning Today I will provide a broad overview of how you can protect your universities against emerging threats to national security. This approach draws heavily of AS 4360, a document which most in this room would be familiar. My first experience with vulnerability assessments followed shortly after September 11 where I assisted a team with developing a framework for evaluating security risks for military establishments as part of Operation Safebase. We then applied this methodology in undertaken a range of vulnerability assessments around the country. Now as a civilian with Sinclair Knight Merz I have taken many of the principles behind this methodology and modified its use to better adapt its use to the private and public sector. Today I will provide a broad overview of how you can protect your universities against emerging threats to national security. This approach draws heavily of AS 4360, a document which most in this room would be familiar. My first experience with vulnerability assessments followed shortly after September 11 where I assisted a team with developing a framework for evaluating security risks for military establishments as part of Operation Safebase. We then applied this methodology in undertaken a range of vulnerability assessments around the country. Now as a civilian with Sinclair Knight Merz I have taken many of the principles behind this methodology and modified its use to better adapt its use to the private and public sector.

3. National Security in 2004 National Security Hotline National Security Web-site National Counter Terrorism Plan $2.3b on National Security Measures post 9/11 2004-05 Budget commits a further $755m There is presently no known specific threat to Australia and the level of national counter-terrorism alert remains at medium under our four-level alert system . Australian security and intelligence agencies are constantly monitoring the global situation Australia and the world at large is a different place compared to say 10 years ago. We now have a National Security Hotline and a National Security Web-site which advises the public on the countries current alert level. We have a National Counter Terrorism Committee and a National Counter Terrorism Plan. The federal and state governments are spending vast sums of money on national security measures. Despite this�...Australia and the world at large is a different place compared to say 10 years ago. We now have a National Security Hotline and a National Security Web-site which advises the public on the countries current alert level. We have a National Counter Terrorism Committee and a National Counter Terrorism Plan. The federal and state governments are spending vast sums of money on national security measures. Despite this�...

4. Risk Management Approach Asset Value Assessment Threat Assessment Vulnerability Assessment How do we protect our organisations against these uncertainties? What can we do against say a suicide bomber? Before we address specific outcomes, we should do what everyone in this room would be familiar with and that is to use a risk management approach. Broadly, this would require a process which examines Asset Value, the Threat or Hazard which is expressed as a likelihood, and a vulnerability assessment which forms the consequences component of a risk assessment.How do we protect our organisations against these uncertainties? What can we do against say a suicide bomber? Before we address specific outcomes, we should do what everyone in this room would be familiar with and that is to use a risk management approach. Broadly, this would require a process which examines Asset Value, the Threat or Hazard which is expressed as a likelihood, and a vulnerability assessment which forms the consequences component of a risk assessment.

5. Asset Value Assessment Identifying Functions and Processes Identifying Buildings and Infrastructure Quantifying Asset Value This phase is highly consultative and aims to identify people and asset value (both tangible and intangible). An intangible asset may be your universities reputation to foreign students that it is a safe place to study. This step is necessary to identify and prioritise the critical assets of the site and to assist in focussing risk reduction activities to the appropriate areas.This phase is highly consultative and aims to identify people and asset value (both tangible and intangible). An intangible asset may be your universities reputation to foreign students that it is a safe place to study. This step is necessary to identify and prioritise the critical assets of the site and to assist in focussing risk reduction activities to the appropriate areas.

6. Threat and Hazard Assessments Law Enforcement Agencies Emergency Management and Response Agencies Australian Security Intelligence Organisation (T4) This is the likelihood phase of the risk assessment and it draws on the advice of those organisations with knowledge of the likely hazards and threats against a particular site or organisation. This information is then grouped and summarised and used as a basis for which event profiles will be in the risk assessment/ Which Organisations to use? T4 - Clients are typically Commonwealth agencies, statutory authorities or government business enterprises. However, when authorised by the Attorney-General and where there is an identifiable Commonwealth interest, ASIO may provide advice to state and local government authorities and private sector companies or individuals. Possible threats to a University: Extended Power Outage Theft (Radioactive Material) Student Demonstrations Hazardous Material Incident Terrorism (majority of the most wanted are university trained) Hoax (Anthrax - exam time and rescheduling) Disgruntled Student At the end of this phase, each of the agreed threats/hazards should be classified into categories relating to their likelihood.This is the likelihood phase of the risk assessment and it draws on the advice of those organisations with knowledge of the likely hazards and threats against a particular site or organisation. This information is then grouped and summarised and used as a basis for which event profiles will be in the risk assessment/ Which Organisations to use? T4 - Clients are typically Commonwealth agencies, statutory authorities or government business enterprises. However, when authorised by the Attorney-General and where there is an identifiable Commonwealth interest, ASIO may provide advice to state and local government authorities and private sector companies or individuals. Possible threats to a University: Extended Power Outage Theft (Radioactive Material) Student Demonstrations Hazardous Material Incident Terrorism (majority of the most wanted are university trained) Hoax (Anthrax - exam time and rescheduling) Disgruntled Student At the end of this phase, each of the agreed threats/hazards should be classified into categories relating to their likelihood.

7. Vulnerability Assessments Multi-Disciplined Team Vulnerability Assessment Checklist Rating of Relative Vulnerability This is effectively the consequences component of the risk assessment and is best performed by a multi-disciplinary team with a good knowledge of the site and also some external people with no familiarity to test assumptions and raise questions. A Vulnerability Checklist can be developed to provide some guidance on the types of information to be captured. I would also undertake a photographic record for future reference. Indicative categories may include: Overall Site Structural Systems Electrical Water and Gas Fire Systems Comms and IT Each of these categories can then be evaluated for a range of consequences such as: Criticality to Other Functions Time to Recover Financial Impact Potential Injuries Social Impacts This is effectively the consequences component of the risk assessment and is best performed by a multi-disciplinary team with a good knowledge of the site and also some external people with no familiarity to test assumptions and raise questions. A Vulnerability Checklist can be developed to provide some guidance on the types of information to be captured. I would also undertake a photographic record for future reference. Indicative categories may include: Overall Site Structural Systems Electrical Water and Gas Fire Systems Comms and IT Each of these categories can then be evaluated for a range of consequences such as: Criticality to Other Functions Time to Recover Financial Impact Potential Injuries Social Impacts

8. Mitigation Strategies & Protective Design Site Planning Parking and Stand-off Vantage Points and High Speed Vehicle Approaches Knowledge and Control of Essential Services Progressive Building Collapse Glazing and Fa�ade Treatments Mailroom Locations Ease of Access (University Cards) Emergency and Disaster Plans

9. Urban Blast Effects Complex & Enhanced Multiple reflected shocks Glazing Damage Blast Effects predictions in an urban environment are very complex due to urban geometries. When a blast wave strikes a solid surface it is reflected and the magnitude is enhanced. Depending on the geometry it will also refract around surfaces. There may even be multiple reflected shocks. Glazing damage is also difficult to predict as it is a function of many things including window size, type of glass (annealed vs tempered), thickness, mountings.Blast Effects predictions in an urban environment are very complex due to urban geometries. When a blast wave strikes a solid surface it is reflected and the magnitude is enhanced. Depending on the geometry it will also refract around surfaces. There may even be multiple reflected shocks. Glazing damage is also difficult to predict as it is a function of many things including window size, type of glass (annealed vs tempered), thickness, mountings.

10. Injury Causes Overpressure induced injuries Ear Drums Lungs Intestines Whole body displacement Skull Fracture Flying glass and debris The human body is not particularly resilient to blast events and can be injured in a number of ways. Overpressure induced injuries typically occur where there is a sudden change of density such as lungs, ear drums etc. Fragmentation from the blast (vehicle) or secondary fragmentation from damaged structures such as glass is often the most significant cause of injury. Finally, whole body displacement for larger blasts where the body is picked up and carried. The human response to blast is reasonably well understood and data is available to predict these effects.The human body is not particularly resilient to blast events and can be injured in a number of ways. Overpressure induced injuries typically occur where there is a sudden change of density such as lungs, ear drums etc. Fragmentation from the blast (vehicle) or secondary fragmentation from damaged structures such as glass is often the most significant cause of injury. Finally, whole body displacement for larger blasts where the body is picked up and carried. The human response to blast is reasonably well understood and data is available to predict these effects.

11. Passive Defence Concealment Deception Redundancy Dispersal Hardening Passive defence is a military concept that is equally application to private industry. Saddam Hussien utilised this concept throughout Iraq and I saw many good examples of its use. C - For examples Air Intakes (don�t put up no smoking signs) D - Using planter boxes and ponds as vehicle barriers R - Power, IT, D - Offsite Data Back-up, Separating Emergency Power from ISS H - Glazing and fa�ade treatment - use of anti-shatter filmsPassive defence is a military concept that is equally application to private industry. Saddam Hussien utilised this concept throughout Iraq and I saw many good examples of its use. C - For examples Air Intakes (don�t put up no smoking signs) D - Using planter boxes and ponds as vehicle barriers R - Power, IT, D - Offsite Data Back-up, Separating Emergency Power from ISS H - Glazing and fa�ade treatment - use of anti-shatter films

12. Resilience of Reinforced Concrete High Strength Good Ductility Ability to Redistribute Loads Good Resistance to Blast

13. Masonry Structures Failure of Mortar Joints Can Sustain Severe Cracking without Stability Problems Arch Action (Redistribute Loads) Typical Yield Line Failures Generally Poor Resistance to Blast

14. Business Continuity Management Business continuity planning is about maintaining, resuming, and recovering the business Assessing business risk Preparing for a possible emergency or incident Developing an incident response methodology Developing a business recovery response Testing and training Regular review and evaluation Preparing for the emergency or incident Emergency response procedures Back up and recovery strategies Roles, responsibilities, supplies Incident response Liaison with emergency services Assessment techniques Incident Response Team Communication and notification measures Media Business Recovery Dedicated team and assigned responsibilitiesPreparing for the emergency or incident Emergency response procedures Back up and recovery strategies Roles, responsibilities, supplies Incident response Liaison with emergency services Assessment techniques Incident Response Team Communication and notification measures Media Business Recovery Dedicated team and assigned responsibilities

15. Conclusion Risk management principles apply to emerging threats Develop Emergency Response Plans Develop Business Continuity Plans Manage your risks