System safety traditionally concentrates on identifying and mitigating hazards that pose threats to systems' integrity by becoming accidental risks. Should system safety's principles be employed more broadly to mitigate the effects of deliberate acts designed to increase risks of death, injury or destruction? We believe that they should. Consider the following case:

"Hundreds of Pounds of Explosives Missing in ABQ"^[1]

In December 2005, residents of Albuquerque and northwestern New Mexico were shocked out of their holiday laissez-faire at the joint announcement by local, state and Federal public safety agencies that 150 pounds of C-4 plastic explosive, 250 pounds of sheet explosive, 20,000 feet of detonator cord and 2500 blasting caps had been stolen from an ATF-approved storage area on the city's West Mesa^[2]. At their television interview the local Chief of Police and the County Sheriff looked angry. The State Director of Public Safety and the FBI Resident Agent-in-Charge looked grim. The Director of the local office of the Bureau of Alcohol, Tobacco, Firearms and Explosives looked embarrassed. He should have been. After all, it was just 25 months since 350 pounds of ammonium nitrate^[3] was stolen from the same ATF Approved Storage Facility.

How Could They Steal My Explosives? They Were in Approved Storage!

Regulations governing the handling, storage and permits for use of explosives are contained in Title 27, U.S. Code of Federal Regulations, Chapter II - Bureau of Alcohol, Tobacco, Firearms, and Explosives; Part 555: “Commerce in Explosives.” Within that part, Section 555.11 contains “Meaning of Terms,” among which are the following:

C-4 and sheet explosive are high explosives. They are required to be stored either in a “Type 1” magazine - a permanent magazine for the storage of high explosives - or a “Type 2” magazine - a mobile/portable indoor or outdoor magazine for similar storage. ^[4] Construction specifications for both Type 1 and Type 2 outdoor magazines each contain the following identical language:

The storage from which the Albuquerque explosives were stolen were Type 2 magazines; they were originally semi-trailers that had been modified to comply with requirements that they be immobilized by having their wheels removed “when unattended.”^[6] Other than specifying that outdoor magazines be fitted with locks, 27CFR555 has no specifications for security of high explosives storage sites.

Thus the explosives storage site was adjudged compliant by ATF, although secured only by a barbed wire fence, a gate secured by a lock and chain, and warning signs that advertised “Caution - Explosives - Keep Out,” an obvious invitation to anyone with access to a cutting torch who was in the market for enough explosives to blow up a substantial building.

We Were Lucky! - or - Were We Lucky?

ATF was lucky. The thieves who cut the locks off the approved magazines and stole the explosive materials weren't the sharpest knives in the drawer. They apparently had little idea of the hazards of the stuff they had stolen. After loading the explosives into a trailer (which was conveniently available at the site), they hooked it up to a stolen pickup truck and drove 200 miles to the northwest corner of the state.

Residents of New Mexico were lucky. Had the explosives detonated enroute, the explosion would likely have wiped out everything (and everyone) within a several hundred yard radius.

The country was lucky. The thieves weren't terrorists. Had they been, they would have possessed enough high explosives to destroy a substantial building or its equivalent.

But maybe we're not so lucky after all: in 2005, through December 22nd, 38 storage depots similar to the one on Albuquerque's West Mesa had been burglarized. In 2004, there were 56 incidents of high explosive theft^[7]. From all appearances ATF had not yet absorbed the fact that its regulations did not, and could not assure the public's safety.

The Fallacy of Mistaking Managerial Doublespeak for Action

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives is a branch of the U.S. Department of Justice^[8]. Its “Explosives and Arson Strategic Goal” includes as Objective 2.1:

Most rational persons accept that explosives are inherently hazardous. The U.S. federal government has established regulations for commerce in explosives, ostensibly for the purpose of mitigating the transformation of explosives' inherent hazards into risks. The ATF example demonstrates what happens when regulations are assumed, without further analysis, to provide solutions to all possible hazards: those with blind faith in that assumption actually increase risks to the public.

Putting Spin on Fecklessness

Ironically, on January 12, 2006, ATF's Phoenix Field Office issued a press release titled “ATF arrests additional suspects in connection with theft of New Mexico explosives” that continues: “Special agents from the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) have arrested two more men in connection with the theft of 400 pounds of explosives from an ATF explosives licensee,” seemingly implying that now the public was safe again^[9]. It made no mention that the licensee's site had previously been judged to be fully compliant with ATF regulations, even the part requiring theft resistance, or that the risk of theft continued unabated.

Considerations for the System Safety Community

Were the hazards of deliberate attempts to penetrate the integrity of ATF's Approved Storage Facilities subjected to system safety-type analysis? We don't know, but the evidence indicates that it's unlikely. Analyses of several deliberate attempts at destruction reveal that they appear not to have been subject to prior system safety hazard or risk analyses, despite foreseeable threats of deliberate harm since September 11, 2001. We believe that creative application of system safety principles can contribute substantially to improving not only the safety, but the security of persons and property. All events that threaten expectancies of safety and security should be analyzed critically. By uncovering the decisions that facilitate undesired outcomes, whether accidental or deliberate, we can develop protocols for avoiding them.

To testing the perceptibility of potential risks in the foregoing example, photos of “Caution -Explosives - Keep Out” signs were shown to an 8-year-old grandson, who was asked if he thought they'd be an effective security device for keeping out thieves. His unequivocal response was “DUH!!” We're quite certain that a competent system safety analyst would reach the same conclusion, and revise the regulation to make it consistent with its intent.

Expanding the causation side of the equation to include deliberate acts should not present a hurdle to applying traditional system safety methodologies. What will change is the traditional practice of converting those concepts into probabilistic assessments. The usual “Risk Matrix” charts Probability vs. Severity^[10]. When the causal action is deliberate, probability becomes P=1; the entire risk matrix moves into the “Red Zone.” All the more reason for bringing traditional system safety techniques to bear.

At least one additional dimension always influences the risk-management decision: cost, usually cast in terms of a ratio between the expenses of mitigation and the anticipated benefits. In the case of deliberate action, the perpetrators' objective is total system destruction. Successful intervention thus increases the returned benefit substantially. Preventing potential collateral losses are even greater benefits, all for the same price.

What Lessons Have Been Learned?

As far as we know, or can determine from the ATF website, there have been no changes proposed to 27CFR555 that would improve the security requirements at high explosives storage sites. But Albuquerque's mayor isn't waiting around. Criticizing “woefully deficient” security, he cited the fact that the facility was “…in full compliance with federal regulations for securing those types of explosives. Therein lies the problem.”^[11] He has been joined by Albuquerque's elected congressional representative and New Mexico's two senators.

ATF seems to have recognized explosives theft as a threat; its regulations require “theft-resistant” storage, yet it has neglected to establish any provisions for security against theft^[12]. We suggest that lesson #1 for ATF is to analyze its regulations to assure that they support its objectives realistically. Effective anticipation of deliberate acts of destruction requires a two-edged sword: realistic policies and procedures, and continuing analyses to ensure that they do the job for which they are intended.

Is ATF staffed with specialists knowledgeable enough in system safety practices and methodologies to mitigate the hazards of deliberate attempts at destruction? If so, are they imaginative enough to consider that ATF's own regulations are major contributors to risk? We don't know the answers, but we believe that diligent application of system safety principles can assist those who should be held accountable to focus on their responsibilities, rather than on excuses for neglecting them.