Department of Homeland Security

(U//LES) DHS Highway Tunnel Terrorist Indicators Report

Highway tunnels are enclosed passageways for road vehicles to travel through or under an obstruction, such as a city, mountain, river, or harbor. Tunnels may have one or more “tubes,” and some are also equipped with rail lines for trains. Highway tunnels are generally classified with regard to their method of construction: bored, cut and cover, or submerged. Tunnels through hard rock formations are usually bored (i.e., drilled) and finished to facilitate vehicular traffic. Very large boring machines are often used to cut the tunnel tubes through the hard rock formation.

(U//LES) DHS Petroleum Refinery Characteristics and Common Vulnerabilities Report

A refinery comprises upstream components, process units, downstream components, and product storage. There are four basic processes used in refineries to produce products. Distillation is used to separate hydrocarbons of similar boiling range into intermediate and final products. Chemical processes are used to change the structure of the hydrocarbons to give them different properties breaking them into smaller pieces or combining them into larger ones. Treating processes are used to remove impurities such as sulfur, and blending systems are used to combine intermediate products and additives into final products for sale.

(U//FOUO) DHS-FBI Potential for Retaliatory Attacks Following the Death of Osama bin Laden

This Joint Intelligence Bulletin provides law enforcement and public and private sector officials with information for consideration in the wake of the death of Usama bin Ladin. This information is provided to support the activities of DHS and FBI and to help federal, state, and local government counterterrorism and law enforcement officials deter, prevent, preempt, or respond to terrorist attacks directed against the United States.

(U//LES) DHS Chemical Facility Vulnerabilities and Terrorist Indicators Reports

While hazardous and nonhazardous chemicals are stored and used in many industries, the focus of this report is specific to facilities that manufacture chemicals. A chemical manufacturing facility comprises upstream components, process units, downstream components, and product storage. The chemical manufacturing process can be further divided into the following five stages, each of which may contain one or more processing activities: (1) receipt of chemical ingredients, (2) temporarily staging or storing chemical ingredients awaiting use in production, (3) processing chemical ingredients into product, (4) temporarily staging or storing chemical products awaiting shipment, and (5) shipping chemical products.

(U//LES) DHS Fossil-Fuel Power Station Terrorist Indicators Report

Steam power plants burn fossil fuel in the furnace of a steam boiler. Steam from the boiler expands through a steam turbine, which is connected to a drive shaft of an electric generator. The exhaust vapor expelled from the turbine condenses, and the liquid is pumped back to the boiler to repeat the cycle. Steam power plants are designed to use coal, natural gas, or oil. Before combustion gases can be exhausted to the atmosphere, they typically must be cleaned to reduce particulates, NOx, and SO2 to levels required by federal and state regulations.

(U//LES) DHS Subway Vulnerabilities and Terrorist Indicators Reports

A subway system, as defined here, includes not only the portion of a rail rapid transit system that is underground, but also the other portions of the rail rapid transit system, even if they are not beneath the ground surface. Data for U.S. subways are typically collected under the heading of “heavy rail,” which is an electric railway with the capacity to transport a heavy volume of passenger traffic and characterized by exclusive rights-of-way, multi-car trains, high speed, rapid acceleration, sophisticated signaling, and high-platform loading. Heavy rail is also known as “subway,” “elevated (railway),” or “metropolitan railway (metro).” Subway systems are typically only one division of a transit agency. Bus, light rail, and commuter rail often operate as feeders to subway stations.

(U//LES) DHS Shopping Mall Characteristics and Common Vulnerabilities Report

Shopping malls are potential targets for terrorist attacks because of the ability to inflict casualties, cause economic damage, and instill fear. Furthermore, they are “soft targets” in that they are serve the general public, and the presence of a significant number of American citizens is assured at certain times of the day. Due to the nature of their functions, these facilities usually lack perimeter or access controls. Due to their accessibility, soft targets are more vulnerable, and virtually impossible to defend against terrorist attacks. Damage or destruction of a large mall could inflict mass casualties, primarily on site; shut down or degrade its operation, thus having a significant impact on the economic well-being of a large area; have widespread psychological impact; and cause the release of hazardous materials.

(U//LES) DHS Hotel Vulnerabilities and Terrorist Indicators Reports

Terrorists are most likely to choose vehicle bombs if their goal is to cause maximum casualties. This method has been used to attack hotels in the United States (U.S.) and around the world. Hotels that are likely to be most vulnerable are those located in downtown areas of large cities, those hosting a controversial group or special event, those where U.S. or foreign dignitaries are guests, and those with a worldwide reputation and connections to a culture that is seen by some groups as corrupt (e.g., casino hotels).

(U//FOUO) Washington D.C. Fusion Center White Powder Letters Warning

A series of “white powder letters” have been received this afternoon at several District of Columbia schools. First responders are responding to the locations and taking appropriate action. Three of the locations have already been cleared. The letters are identical to white powder letters received by District schools in October 2010 and are believed to contain a harmless white power.

(U//LES) New Mexico Investigative Support Center Dual SIM Cell Phone Warning

A recent narcotics investigation led to the arrest of two subjects after they were found to be in possession of sixty (60) pounds of marijuana. During the investigation Agents observed the male subject repeatedly holding a wristwatch to his ear and later found the item to be a cellular phone. A Cellebrite extraction was conducted on this phone which was found to have two SIM cards. Dual SIM cards enable the user to combine different numbers, plans or network carriers. This particular cell phone had one SIM card from A T & T, and the other one from Telcel, New Mexico’s largest mobile phone carrier. An internet search revealed you can purchase these wristwatch cell phones starting at $50.00. There were no markings to identify the brand or carrier of this phone. Law Enforcement is advised to be on the look out for these communication devices when you are in contact with subjects of criminal investigations.

(U//LES) DHS Hydroelectric Dam Vulnerabilities and Terrorist Indicators Reports

Hydropower, including pumped storage, constitutes about 14% of the electrical generating capacity of the United States (U.S.). Hydropower is the primary source of renewable energy in the U.S. Total U.S. hydroelectric capacity is 103.8 gigawatts (GW), including pumped storage projects. The federal government owns 38.2 GW at 165 sites (excluding pumped storage). Another 40 GW of non-federal, licensed conventional hydroelectric capacity (excluding pumped storage) exists at 2,162 sites in the U.S. (National Hydropower Association). The distribution of hydropower generating capacity by ownership is illustrated in Figure 1. The 10 largest hydroelectric facilities in the country are listed in Table 1 (U.S. Society on Dams).

(U//LES) DHS Underwater Cable Landing Station Vulnerabilities and Terrorist Indicators Reports

Underwater cables carry telecommunications traffic (voice and data) under bodies of water (e.g., lakes and seas). These cables carry about 95% of all intercontinental telecommunications traffic. International banking and finance transactions are highly dependent on underwater (also known as submarine) communications cables. Some military communications traffic is carried via underwater cables. Most underwater communications cables in service are fiber-optic cables. New systems are almost always equipped with fiber-optic cables (rather than older technology coaxial cables). Underwater cable systems have expanded in recent years due to increased demand, changes in technology, and reduction in costs. This paper focuses on the gateway point to underwater cable systems, the cable landing station, including the fiber run from the station to shore where the fiber enters the water. Additional detail on the underwater portion of fiber cabling can be found in Characteristics and Common Vulnerabilities, Infrastructure Category: Underwater Cables (Draft, December 15, 2003).

(U//FOUO) DHS Possible Implications of the Death of Osama bin Laden

The Intelligence Community (IC) assesses the death of al-Qa‘ida leader Usama Bin Ladin could result in retaliatory attacks in the Homeland and against US and Western interests overseas. Attacks might originate with al-Qa‘ida Core elements in the tribal areas of Pakistan, with one of their affiliates overseas, and/or with individuals in the homeland sympathetic to the cause but lacking a formal group association. We have no indications of advanced al-Qa‘ida Core plotting efforts in the Homeland, but the case of now-detained al-Qa‘ida operative Najibullah Zazi—who, along with two associates, planned to attack the New York City subway in 2009 using homemade explosives—demonstrates that unidentified operatives could advance plotting in the homeland.

(U//LES) DHS Milk Processing Facility Vulnerabilities and Terrorist Indicators Reports

Successful contamination of fluid milk can have serious public health consequences, since the product moves through the distribution and consumption stages very quickly. The shelf life of fluid milk is short compared to the shelf life of other food products; fluid milk is bought and used by consumers in short time periods. This leads to the potential for a rapid spread of any contaminated product. Fluid milk is consumed by all segments of the population from infants to the elderly. Health impacts from contamination could reach a wide range of people, including those with limited ability to recover from an induced illness. Some milk products such as cheese and ice cream have longer shelf lives and more limited consumption patterns than does fluid milk. Health impacts from the contamination of these products would be confined to a smaller group. Moreover, the longer times between production and consumption allow for response actions (e.g., product recall) to be implemented more effectively.

(U//LES) DHS Electric Power Substations Terrorist Indicators Report

To consider terrorist threat indicators in relationship to electric power substations, it is useful to understand the basic structure of the industry and what general types of facilities might be attractive targets for terrorist attack. Electric power substations are attractive terrorist targets because the loss of electric power has both direct and indirect impacts. Direct impacts include, for example, interruption of home and commercial building heating or cooling, damage to electronic data and equipment, the inability to operate life-support systems in hospitals and homes, and damage to the electric grid. Without electric power, other critical infrastructures, such as transportation, water supply systems, telecommunications, and banking and finance, cannot function. Indirect impacts may also include fatalities, injuries, and expenses related to failures in these interdependent infrastructures.

(U//LES) DHS Liquefied Natural Gas Terminal Vulnerabilities and Terrorist Indicators Reports

LNG is typically created in a three-step process. First, gaseous-form natural gas, extracted from the ground in neighboring oil reservoirs, is “frozen” into a liquid state through a complex cryogenic process (called liquefaction). The LNG boiling point is -260°F. In a liquid state, the volume of the gas is greatly reduced; it would take 600 ships carrying natural gas to equal the cargo contained on just one LNG tanker. Thus, it is practical and economical to import natural gas from overseas. The density of LNG is 26.5 pounds per cubic foot, or less than half that of water. LNG is odorless, colorless, non-corrosive, and nontoxic.

(U//LES) DHS Agricultural Storage Facility Vulnerabilities and Terrorist Indicators Reports

Traditionally, food in America is produced through a series of processes commonly referred to as the “farm to table” continuum. This process is comprised of multiple components, including production, distribution, processing, transportation, wholesaling, exporting/importing, retail sales, and consumption. Each component of the “farm to table” continuum is achieved in a variety of ways specific to the particular end product being produced. At multiple stages of these processes, raw agricultural products, farm input supplies, and consumer-ready foods are stored in large facilities. These agricultural storage facilities include facilities storing raw agricultural products (wheat, corn, apples, etc.) prior to processing; farm input supplies (fertilizers, chemicals, etc.), live animals (cattle, swine, chickens, etc.), or processed products ready for distribution and consumption (cheese, cereals, packaged products, etc.). In this regard, there is not a “typical” agricultural storage facility. Rather, a variety of facilities specific to the storage requirements of a given product or component serve the “farm to table” continuum.

(U//LES) DHS Wastewater Treatment Facility Vulnerabilities and Terrorist Indicators Reports

Wastewater is water that has been used. It includes substances such as human waste, food scraps, oils, soaps, and chemicals. Wastewater is derived from residential, commercial, and industrial activities. In homes, wastewater is produced from sinks, showers, bathtubs, toilets, washing machines, and dishwashers. Commercial and industrial activities also produce wastewater that must be treated prior to release to the environment. In addition to home and business production, wastewater can also be generated by storm runoff (referred to as inflow) and interception of ground water (infiltration). Because of potentially harmful substances that wash off roads, parking lots, and rooftops, this water must also be treated.

(U//LES) DHS Railroad Bridges Vulnerabilities and Terrorist Indicators Reports

The national economy is based on timely rail deliveries, especially in light of industry’s current practice of just-in-time stocking arrangements. Railroad bridges can be critical chokepoints for high-volume rail lines moving freight from geographic areas of supply to other areas of demand. Furthermore, critical rail bridges are vital assets of the Strategic Rail Corridor Network (STRACNET), a 38,800-mile interconnected network of rail corridors. The STRACNET supports the deployment of military forces across the U.S. to strategically located ports of embarkation.

DHS Critical Infrastructure Vulnerability and Terrorist Activity Indicator Reports

Over the next two weeks, Public Intelligence will be publishing several dozen reports from the Department of Homeland Security’s Protective Security Division concerning vulnerabilities and the detection of terrorist activity at critical infrastructure locations. This information was inadvertently disseminated by a non-profit organization that is concerned with domestic preparedness. Due to flaws in their website’s construction, a members area for sharing documentation was openly accessible to anyone and had been largely indexed in Google’s search results. The documents range in date from 2003-2004 and provide early background on critical infrastructure security activities, including known vulnerabilities that often have not been fixed and tenuous listings of so-called “suspicious activity” indicators. The documents also provide background on a number of “critical infrastructure” categories about which there has previously been a lack of publicly-available information. Some of these categories include railroad yards, wastewater treatment facilities, undersea cable landings and milk processing plants. For easier browsing, reports will be added to the list below as they are published.

(U//LES) DHS Banking Repositories Vulnerabilities and Terrorist Indicators Reports

One of the key roles of the government is to maintain the stability of the nation’s financial system and to address and contain systematic risk that may arise in the financial markets. The financial repositories play an important role in market stability. Several agencies of the government (U.S. Treasury, U.S. Mint, Federal Reserve Board, U.S. Secret Service, FBI) are involved in the supply, distribution, storage, and security of U.S. currency, coins, and other market transactions and clearing transactions.

(U//LES) DHS Railroad Yards Vulnerabilities and Terrorist Indicators Reports

Railroad yards can be located in any type of environment having a flat area sufficiently extensive and elongated to permit emplacement of intermodal loading tracks, sorting “humps,” classification “bowls,” or any combination thereof. Thus, yard properties may be sited in open plains or adjacent to hills or other high ground (Figure 3). In the latter case, there may be vulnerabilities to adversaries using longer range, stand-off weapons. Trains are put together in the classification yard, which is comprised of multiple parallel tracks branching out from a central track and connected by switches. Each of the parallel tracks is designated to receive cars with particular destinations along the route. A special locomotive, or switch engine, transports each car or group of cars to its assigned track. Depending on the sensitivity of the shipment and the type of classification yard, cars may be either “shoved to rest” or “humped.” If shoved to rest, the car remains attached to the engine until it couples with the adjacent car. If humped, the car is uncoupled at the top of a very gentle incline and allowed to travel freely downhill.

(U//LES) DHS Nuclear Spent Fuel Storage Vulnerabilities and Terrorist Indicators Reports

Spent fuel, after it is removed from the reactor core, is safely stored in specially designed pools at individual reactor sites around the country. The spent fuel is first placed into a spent fuel pool (Figure 1), which is like a deep swimming pool with racks to hold the fuel assemblies. It allows the fuel to begin cooling. The spent fuel is moved into the water pools from the reactor along the bottom of water canals, so that the spent fuel is always shielded to protect workers. Fuel assemblies are covered by a minimum of 25 feet of water within the pool, which provides adequate shielding from the radiation for anyone near the pool. Spent fuel pools are very robust structures that are constructed to withstand earthquakes and other natural phenomena and accidents. They are typically rectangular structures 20 to 40 feet wide, 30 to 60 feet long, and at least 40 feet deep. The outside walls are typically constructed of more than 3 feet of reinforced concrete. Spent fuel pools at pressurized water reactors (PWRs) are commonly located within an auxiliary building near the containment. Many of the PWR pools are located in the building’s interior. At boiling water reactors (BWRs), spent fuel pools are typically located at an elevated position within the reactor building, outside the primary containment area.

(U//LES) DHS Nuclear Fuel Cycle Characteristics and Common Vulnerabilities Report

Nuclear power plants in the U.S. use fuel rods that have been enriched in the uranium-235 (235U) fissile isotope. At the time of their insertion to the reactor, typical commercial power plant fuel rods contain approximately 2% to 5% 235U; the exact value depends on the details of the reactor design. This fuel remains in the reactor for up to three years or more, at which time fission product buildup necessitates its removal even though it still contains significant quantities of 235U.