security vulnerability assessment project thomas j. kenney ...thomasjkenneyiii.weebly.com ›...

21
Running head: MSA 515 - PORTFOLIO ASSIGNMENT 1 Security Vulnerability Assessment Project Thomas J. Kenney III MSA 515 - Physical Security Planning and Vulnerability Assessment February 17, 2013 Dr. Paul Baker Southwestern College Professional Studies

Upload: others

Post on 09-Jun-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 1

Security Vulnerability Assessment Project

Thomas J. Kenney III

MSA 515 - Physical Security Planning and Vulnerability Assessment

February 17, 2013

Dr. Paul Baker

Southwestern College Professional Studies

Page 2: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 2

Vulnerability Assessment Report

FOB Freedom, Afghanistan

February 2-4, 2013

Thomas J. Kenney III

Page 3: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 3

TABLE OF CONTENTS

Executive Summary 3

Security Requirements 6

Threats 7

Relevant Policies and Procedures 8

Vulnerabilities and Recommendations 10

Conclusion 18

References 19

Page 4: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 4

Executive Summary

A vulnerability assessment was conducted at the request of the commander of Task Force

(TF) Orion of Forward Operating Base (FOB) Freedom, Afghanistan. The vulnerability

assessment was conducted February 2 – 4, 2013, and was a vulnerability based evaluation of the

FOBs ability to detect, delay and/or respond to its primary threat which is a terrorist incident.

According to the TF Orion commander, the TF controls FOB Freedom through security

and limited counterinsurgency (COIN) operations in order to facilitate the regional commands

ability to support development and stability of Pashtu Province, Afghanistan by protecting the

FOB Freedom compound. The compound includes roughly 1,000 coalition forces and 500

civilian/contractor personnel.

This assessment report identifies vulnerabilities that may be exploited by terrorists and

suggests options that may eliminate or mitigate those vulnerabilities. This assessment focuses on

the overarching program and its compliance with Department of Defense (DoD) Instruction

2000.16 and the Joint Forward Operations Base (JFOB) Protection Handbook.

The assessment team was compromised of subject matter experts (SME) from force

protection, physical security, engineering, and structural design. The objective of this

assessment was to evaluate the overall security posture of FOB Freedom through a review of its

antiterrorism and physical security plans, programs, and operations.

Based on my findings, the assessment team recommended improvements to the physical

security program, plans, and procedures to increase the effectiveness of antiterrorism and

physical planning, while also identifying preventive physical security measures and consequence

management response measures to address the threat of terrorist attack.

Page 5: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 5

The assessment team assumed it was viewing the activities and physical security posture

in normal day-to-day operations while evaluating possible threats to the compound. At the time

of the assessment, the Defense Intelligence Agency (DIA) listed the terrorist threat level as high

for the theater with a significant threat to International Security Assistance Forces (ISAF) and a

moderate indirect fire (IDF) threat.

Findings

Listed here are the major findings during the assessment. Further in the report these

findings will be detailed in-depth with specific recommendations for improvement and

mitigation. The entry control points (ECPs) lack proper force protection design features. ECPs

play an integral part in supporting a layered defense concept; it is more efficient and effective to

stop or minimize a terrorist threat at the perimeter. A strong ECP incorporates procedures and

formidable design features that provide a perception to anyone looking in that the compound

may be a “hard target” or too difficult to exploit.

The main entry control point (MEP) and the other ECP require improvements within their

design. Speed control devices, final denial barriers (FDB), backup power supply, and ballistic

rated gatehouses should all be improved.

During the assessment inadequate protective shelters were also identified as vulnerability.

The bunkers arrayed throughout the compound incorporate varying degrees of protection.

However, some areas lack an adequate number of bunkers. This, compounded with the fact that

some configurations do not provide an entrance that shields from fragmentation or incorporate an

exterior layer of sandbags to absorb fragmentation and blast energy, leaves room for

improvement.

Page 6: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 6

Given the fact that IDF remains a threat for the country, FOB Freedom should consider

reconfiguring and reinforcing existing bunkers IAW the standards required in the Joint Forward

Operations Base (JFOB) Protection Handbook. Provide additional bunkers to accommodate all

assigned personnel on the compound.

No overhead cover is provided for areas with large concentrations of personnel. Given

the continued IDF threat, consider a mitigation strategy for large population areas such as dining

facilities and headquarters compounds. If a review of IDW threats does not indicate overhead

protection is warranted, or does not support a balance between risk cost with mission benefits,

document risk acceptance and ensure the TF Orion commander signs the acceptance letter.

Inadequate or missing sidewall protection for assessed billeting and mission assets is

identified as vulnerability. Sidewall protection is an essential part in the mitigation of blast

effects of near miss IDF impacts. It can also contain fragmentation from one building to the

next. Many of the life support areas (LSA), headquarters areas, and highly populated areas lack

appropriate sidewall protection. Given the protection priorities of the FOB Freedom plan

(personnel and headquarters compound), several billeting and high population areas should be

considered for additional sidewall protection.

The compound has an inadequate mass warning and notification system capability.

Because gaps exist within the external and internal speaker coverage across the FOB, the system

and process is not capable of notifying all personnel in an emergency. Previously FOB Freedom

tested the notification system to identify dead spots and gaps in coverage and purchased the

hardware to mitigate those gaps. However, the funding for operator and maintenance was not

approved. The commander is again pursuing funding, which should cover the loss or gaps in

Page 7: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 7

coverage. The next portion of this vulnerability assessment report will detail the FOB Freedom

security requirements.

FOB Freedom Security Requirements

The assessment included a complete review of all applicable FOB Freedom written

policies and procedures to include the FOB guard force standard operating procedures (SOP).

The SOP does discuss in detail the integrated security system design that includes the proper

choice of: (1) site and building layout and barrier hardening to delay potential adversaries or

threats, (2) access control at the entry control points (ECPs), (3) intrusion detection sensors and

alarms to detect an attack on the FOB or within critical facilities, (4) CCTV and guard

assessments whether an alarm is actually a threat, and (5) what guards to respond to the location

of a real threat.

Detection encompassing intrusion detection and entry control is an important element

since any delay offered by a barrier can eventually be penetrated, and without detection the

response force would not be alerted (DoD 5200.8-R). The delay offered by the both ECPs and

through building design does provide sufficient time after detection for threat assessment and

guard force response.

The guard forces at FOB Freedom are comprised of both military guards and contract

guards. Through interviews conducted with the TF Orion commander, the force protection

officer, and the physical security officer, the guards on FOB Freedom are deployed in operating

configurations that include fixed locations, mobile, reaction force, and a combination of

locations (FOB Freedom guard force standard operating procedure, 2013).

The guards located at fixed locations normally remain at one point within a specific area,

such as ECP gates and guard towers. The mobile guards, both roving and response, are either on

Page 8: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 8

foot or in vehicle patrols that rove within specified areas, and respond as required to alarms. The

reaction force guards are dedicated to protect special assets and facilities and are rotated through

the different permanent units on FOB Freedom. The reaction force guards only respond to

designated facilities or asset alarms (DoD 5200.8-R).

FOB Freedom also incorporates a combination of guard forces which uses roving patrols

that are dispatched to specific alarms to conduct a preliminary assessment followed by a full

response from a reaction guard if a real threat presents itself. As outlined in the Physical

Security SOP, the overall response time of the security system is much longer than if a real-time

assessment using on-site guards or CCTV is provided, or if the initial guard response includes

the full reaction force (FOB Freedom guard force standard operating procedure).

The FOB Freedom physical security standard operating procedure (2012) contains a

section on barriers which was generic. The SOP did not contain specific, detailed procedures for

guards to respond to the location of the alarm, applying restraining or under what circumstance

the use of deadly force would be authorized. In follow-up interviews with two of the guard force

platoon leaders, they did have internal procedures that detailed such response procedures and

deadly force tactics, techniques, and procedures. The next portion of my report will focus on the

various threats facing FOB Freedom.

Threats facing FOB Freedom

The Defense Intelligence Agency (DIA) listed the terrorist threat level as high for the

theater with a significant threat to International Security Assistance Forces (ISAF) and a

moderate indirect fire (IDF) (rockets and mortars) threat. According to the FOB Freedom

intelligence officer, the primary threat to FOB Freedom is a terrorist attack with continued

indirect fire with the intention of harassing, or causing casualties, of forces located on the FOB.

Page 9: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 9

Throughout the region there are also daily incidents of Improvised Explosive Devices (IED),

suicide and rocket attacks, and direct fire attacks on security forces patrols, checkpoints and

bases as well as on the local population.

The most common methods of attack of terrorist organizations are vehicle borne

improvised explosive devices (VBIED and personnel borne improvised explosive devices

(PBIED); both methods are capable of being utilized at either of the entry control points.

Increasingly the insider threat, and inside the wire threat of surveillance is present as line of sight

of the FOB can be obtained from buildings located close to the compound. There are

approximately 60 local national workers on FOB Freedom, with non-existent continuous

monitoring.

Relevant Policies and Procedures

FOB Freedom uses Closed-Circuit Television (CCTV) as its primary means of detection,

which is integrated into the overall electronic surveillance system (ESS). The CCTV is centrally

monitored in the tactical operations center (TOC) which is continuously manned 24/7. The

CCTV provides surveillance, assessment, deterrence, and archival imagery.

The FOB CCTV system of cameras, recorders, and monitors allows viewing and

recording of security events and is used to augment security forces. During interviews with the

physical security and force protection officer, they explained that the compounds CCTV is linked

to motion detectors and a dedicated monitoring system. They indicated approximately 20% of

the FOB CCTVs have pan, tilt, and zoom (PTZ) capabilities and are manually operated to scan

and zoom. The remainder of the CCTVs are not PTZ and only monitor specific areas.

FOB Freedom employs sensors on the FOB perimeter, including both ECPs, and selected

critical assets for early intrusion prevention, detection, and response. Most are integrated into

Page 10: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

the FOB ESS while others such as explosive detectors are stand-alone devices. The sensors

provide security personnel with real time data that classify, pinpoint, and record intruder threats

(Graphic Training Aid 90-01-018, joint entry control point and escalation of force procedures,

2009).

FOB Freedom uses infrared sensors, also known as thermal infrared, which generate

alarms when thermal radiance changes within the detection zone or imaged scene. The FOB also

uses seismic sensors which detect ground motion and are used primarily in its’ the tunnel

detection capacity.

Security lighting is not used on FOB Freedom due to enforcing strict light discipline and

being a blacked out compound. Any light that is used is red or blue light only and all personnel

discretely observe light discipline.

The FOB exercises strict access control measures that screen personnel, vehicles, and

materials to ensure safe, authorized FOB entry. The measures also detect contraband, reduce

theft, prevent trespassing, and discourage terrorism, sabotage, and espionage.

The access control procedures should significantly increase the time required to forcibly

breach an ECP or gate. Control procedures should also delay attackers in reaching critical assets

and inhibit escape from the FOB (Graphic Training Aid 90-01-018, joint entry control point and

escalation of force procedures, 2009).

The FOB personnel access control procedures and policy clearly defines the granting

authority and establishes access criteria. It applies controls uniformly to visitors, vendors,

contractors, local nationals, local national police, and military forces. The access control lists

contain the names of personnel with authorized FOB access and is strictly controlled and updated

Page 11: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 11

frequently. All personnel entering the compound must be positively identified on the access

control list prior to FOB admittance.

FOB Freedom has controls which also establish badge identification procedures and

define personnel search procedures. The FOB has a pass and badge system which is color-coded

according to escort requirements and compound authorizations. The following information is

contained on the badges: photo; name; duty; title; badge number; expiration date; and a unique

mark for counterfeit badge detection.

The installation also has an escort system which is an effective means of personnel access

control, particularly for contracted workers, local nationals and vendors. Escorts must ensure

that all visitor materials are searched for contraband, weapons, or explosives prior to entry.

Also, escorts must secure visited areas prior to departure and ensure no packages or other

materials are left behind. The next portion of my report will address the vulnerabilities found

during the three day assessment and more importantly, the recommendations to remedy or

mitigate the risks.

Vulnerabilities and Recommendations

This assessment used the vulnerability definitions from DoDI 2000.16, which says, “. . . a

situation or circumstance, which if left unchanged, may result in the loss of life or damage to

mission essential resources.”

The additional vulnerability definition used for this assessment was, “the characteristics

of an installation, system, asset, application, or its dependencies that could cause it to suffer a

degradation or loss (incapacity to perform its designated function) as a result of having been

subjected to a certain level of threat or hazard” (DoDI 2000.16).

The recommendations listed here should receive priority consideration in enhancing the

Page 12: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 12

security posture and program at FOB Freedom. The recommendations are primarily based on

ways to avoid mass-casualty incidents and prevention of damage to mission-essential resources.

The recommendations proposed are based on ways to mitigate consequences of terrorist acts,

though implementation of recommendations could benefit controlling the consequences of other

types of events that threaten the safety of assigned personnel.

The processes for conducting threat, criticality, vulnerability, and risk assessments are

inadequate and not in compliance with DoDI 2000.16. TF Orion has a physical security plan that

references the requirement for conducting risk management (RM) assessments, but it does not

define the processes for conducting various assessments associated with RM. These include

threat assessment, criticality assessment, vulnerability assessment, and risk assessment. The

processes for who, what, when, where, why, and how the assessments will be conducted are not

documented. This is especially important due to the high personnel turnover experienced in the

theater and recently happened on FOB Freedom.

Recommendations. Document and clearly define the process to use to conduct risk

management assessments in the future and identify which tools to use in conducting the

assessments. Designate teams or working groups that will be responsible for conducting the

assessments and address the requirements, the training and knowledge required of team

members, and the process to use for each type of assessment. Finally, outline the identification

and characterization of threats, processes for identifying assets and impact of loss, identification

and analysis of vulnerabilities, assessment of risk and determination of priorities for asset

protection identification of countermeasures and development of mitigation measures, and the

identification of residual risk.

Page 13: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 13

The criticality assessment is insufficient and not in compliance with DoDI 2000.16. The

criticality assessment is inadequate because all critical assets were not identified prior to

conducting analysis and prioritization. A previous list of assets that was passed along from the

previous TF was prioritized. After this was completed, mission analysis was conducted and a

new expanded list of assets was identified. The expanded list has not been prioritized using a

criticality assessment matrix.

Recommendations. Compile a list of mission essential tasks (MET) for the base and

conduct a mission analysis based on the MET list, and then identify all assets and infrastructure

required to accomplish each mission.

A risk assessment was not conducted IAW DoDI 2000.16. At the time of the assessment

no process was in place for conducting risk assessments and no risk assessments had been

completed or started. Due to high turnover in the theater, documentation of the processes to be

used is critical in order to provide continuity to the risk management portion of the FOB physical

security plan.

Recommendations. Document a clear process in the FOB physical security plan for

conducting risk assessments and train appropriate personnel on the techniques for conducting

risk assessments. Additionally, conduct a risk assessment on all identified vulnerabilities and

use information from the threat assessment, criticality assessment, and vulnerability assessment.

A surveillance detection / counter-surveillance (SD/CS) program has not been

documented. FOB Freedom has not formally developed a SD/CD program. Though not

formally documented, the base is executing adequate SD/CS operations through a combination

of technical means: cameras, active security patrols, and security force personnel at the gates.

Reporting occurs in an informal manner because procedures are not formally developed or

Page 14: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 14

disseminated to the security forces.

Recommendations. Establish a SD/CS program and document it in the physical security

plan. Survey the perimeter, focusing on areas near the ECPs, and identify and chart possible

hostile surveillance locations. Provide the hostile surveillance locations to security forces and

train them in recognizing indicators of surveillance. Additionally, train all base personnel on the

indicators of surveillance and the reporting procedures of any observed suspicious activities.

Furthermore, make contact with local residents around the perimeter of the base and

distribute contact information. Develop relationships with local, tribal, and community leaders

to raise awareness of the base and its security requirements.

FOB Freedom may become vulnerable to terrorist attack. The base displayed adequate to

good procedures at ECPs as well adequate inspections. The ECPs, though not meeting all

antiterrorism / force protection (AT/FP) design feature requirements, are well manned and

present an intimidating appearance. Additionally, explosive detection equipment and military

working dogs (MWDs) are used to conduct thorough inspections of all contractors and

commercial vehicles.

Upon inspection during a routine security patrol around the perimeter, it was noted that

all culverts that run under the perimeter fence line are fortified with grating and concertina wire,

which further inhibits covert infiltration. The fence line is well maintained and fortified with

berms, counter vehicle ditches, and concertina wire.

Recommendations. Upgrade the ECPs to meet DoD AT/FP requirements to include final

denial barriers by purchasing either Alaska barriers, which is the largest of the precast concrete

barriers at approximately 12 feet high and 6 feet, 7 inches in length, or the T-Wall, which is also

12 feet high, but only 4 feet wide. Both barriers are over 12 inches thick and cost approximately

Page 15: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 15

$520.00 each. Continue to execute aggressive ECP and vehicle and personnel inspection

procedures.

A vehicle barrier plan has not been developed for FOB Freedom which is mandated in

DoDI 2000.16. Barrier plans provide enforced standoff protection for inhabited buildings,

billets, and mission assets when the vehicle borne improvised explosive devices (VBIED) threat

is elevated. At the time of the vulnerability assessment, barriers were placed to provide standoff,

although locations seemed arbitrary. Standoff barriers are placed around life support areas

(LSA), dining facilities, and mission assets.

Additionally, standoff distances vary by area, are nor not based on a specific threat, and

do not provide complete enclosure of assets are required. In general, standoff distances were

judged to be too close to assets for any effective relief from VBIED blast wave pressures.

Barrier plans are developed to provide standoff for protecting personnel and mission assets from

VBIEDs to prevent mass casualty events and disruptions in mission.

Recommendations. Establish barrier plan standoff IAW consideration for building

construction materials and the criticality of the facility. Clearly define the minimum standoff

requirement for each asset protected by the barrier plan. Provide complete enclosure for

protected assets and buildings while ensuring enclosures allow access for emergency responders.

Enforce the vehicle barrier plan by using either Alaska, T-wall, or Jersey barriers. The cost of

the Alaska and T-wall barriers are approximately $520.00 each and Jersey barriers are

approximately $140.00 each.

Entry control points (ECPs) lack AT/FP design features. Both of the ECPs that control

vehicle access to FOB Freedom lack design features that are significant. The Main Entry Point

lacks approach speed reduction devices and clear delineation of inbound lanes to separate

Page 16: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 16

commercial vehicles from military convoys. Overwatch personnel interviews revealed that lack

of separation between military and commercial vehicles was a regular problem, and was often

compounded by limited visibility. Emergency backup power was assessed as limited by the

assessment team infrastructure engineer.

The South ECP includes installed, crash-rated final denial barriers (FDB) at the front and

rear of each vehicle inspection station. However, the FDBs were not being used except at night.

The guard personnel indicated that the FDBs were not used because they were not designed to

open and close frequently, as would be required for inspecting individual vehicles. The South

ECP also lacked backup power, a ballistic rated gatehouse, and approach speed reduction

devices.

Recommendations. Provide backup power generators to both ECPs by using existing

generators that are currently scheduled for turn-in and retrograde. Consider repairs or

renovations for the South ECP to make it usable for vehicle inspections and vehicle counter-

mobility, vehicle stopping for gate runners, and/or reverse entry mitigation. Also consider using

a blocking vehicle as an interim mitigating solution. Use concrete barriers outside each ECP to

control vehicle approach speed. Purchase Jersey barriers, 3 feet high, 9 feet long, at

approximately $140.00 each, and place in serpentine pattern to force vehicle slowing.

Additionally, it is recommended to purchase Jersey barriers and place them so that there

is clear delineation and separation between commercial and military vehicles. The ECP

gatehouse can be easily retrograded and brought up to standard by purchasing six pieces of

E-Glass, Ballistic Grade sheets of 4 feet, x 8 feet at a cost of approximately $603.26 each.

Overhead cover structures have not been provided for the dining facility or for the

headquarters compounds. According to the antiterrorism officer, the TF Orion commander has

Page 17: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 17

decided to accept risk for not providing overhead cover structures for dining facilities and some

mission assets. The commander’s decision was based on an analysis of cost versus benefit, with

consideration for historical threat.

Recommendations. The commander has decided against building overhead cover

structures mission assets. Develop risk acceptance documentation for the commander’s

signature and seek higher headquarters guidance on whether a deviation request is required.

Evaluate current and historical threat as part of the risk analysis associated with the commander’s

decision to not construct overhead cover structures. Consider constructing overhead structures

for dining facilities and for the headquarters compounds. Due to the many different types of

overhead structures, and materials available, purchase recommendations will not be provided.

There is missing or inadequate sidewall protection for assessed billeting. Proper sidewall

protection against near miss IDF fragmentation has not been provided for some billeting

structures IAW DoDI 2000.16. In some areas, sidewall protection is provided, but the protection

is incomplete. It does not provide protection for the full wall height or it does not provide

complete enclosure.

Recommendations. Provide complete sidewall protection for inhabited buildings,

billeting structures, and mission assets IAW DoDI 2000.16 and the Joint Forward Operations

Base (JFOB) Protection Handbook. It is recommended that Alaska barriers, the largest of the

precast concrete barriers; at approximately 12 feet high and 6 feet, 7 inches in length, or T-Wall

barriers, also 12 feet high, but only 4 feet wide are purchased for sidewall protection. Both

barriers are over 12 inches thick and cost approximately $520.00 each.

The quantity and configuration of protective shelters is inadequate. The number of

protective shelters is inadequate for the number of personnel assigned to FOB Freedom. In

Page 18: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 18

addition to the inadequate quantity, two configuration issues were observed for the bunkers.

Bunkers provided are inverted "C" reinforced structural concrete. These are appropriate for use

as the backbone for protective shelters.

However, they should be reinforced with sandbags, because sandbags provide an

additional absorbing effect for fragmentation that a hard surface cannot provide. Also, there

must be shielding to protect bunker entrances from fragmentation. Entrance shielding is usually

accomplished through bunker configuration or through the use of other shielding elements, such

as T-Walls.

Recommendations. Procure additional personnel protective shelters to accommodate the

number of personnel assigned to the base. Locate these bunkers with respect to LSAs and dining

facilities so that personnel have quick access day or night. Ensure that existing and new bunkers

are reinforced with sandbags for additional fragmentation absorption, and configured to provide

entrance shielding. In order to provide sufficient protective shelters, it is recommended that

additional Scud Bunkers are purchased and either Alaska or T-Wall barriers placed across each

end, and sandbags are placed around the body of the bunker. The cost of Jersey barriers is

approximately $140.00 and the cost of both the Alaska and T-Wall barriers is approximately

$520.00 each.

Inadequate mass warning and notification system (MWNS) capability. The MWNS

capability includes a public address system through Wireless Audio Visual Emergency System

(WAVES) that provides exterior coverage (with limited internal speakers) and e-mail, cell

phones, and runners. The external speaker capability provides inadequate coverage for FOB

Freedom. Notification of personnel through e-mails, cell phones, and the use of runners

increases notification and provide some redundancy; however, the MWNS still has a few gaps.

Page 19: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 19

A survey to identify dead spots and gaps in coverage and then acquire additional speakers

to fill gaps has been conducted. The survey identified a need for an additional 32 outdoor

speakers and 19 indoor speakers for primary gathering buildings in order to fill the gaps in the

MWNS. Recommendations. Continue to pursue the additional contract worth $53,749.00 in

order to acquire the operations and maintenance support required for base and use of the system.

Manholes and hand holes lack physical security IAW DoDI 2000.16. Manholes and hand

holes lack physical security around the base lack physical security features such as locking

mechanisms or locking bolts. One hole was observed completely unsecured. Bollards have been

installed around manholes to prevent tactical vehicles from parking on and crushing the covers.

Recommendations. Consider conducting a survey to prioritize manholes/hand holes and

continue efforts to install lockable covers. At a minimum, install on critical communications

paths.

Conclusion

During this three day vulnerability assessment a comprehensive assessment was

conducted in which several vulnerabilities were identified. This assessment is provided with the

ultimate goal to utilize the results and recommendations to make FOB Freedom a hard target for

any insurgent or terrorist group, inside or outside its perimeter. The continued emphasis from

the leadership of TF Orion can serve to eliminate or mitigate all or most of the physical security

challenges identified during this assessment. I stand ready to provide clarification and any reach

back assistance to further mitigate identified vulnerabilities, as well as provide training and

future assessments.

Page 20: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 20

References

Chairman of the Joint Chiefs of Staff. (2007). DoD antiterrorism vulnerability assessment

benchmarks. Washington, DC: Defense Threat Reduction Agency.

Chairman of the Joint Chiefs of Staff. (2002). Antiterrorism vulnerability assessment team

guidelines. Washington, DC: Defense Threat Reduction Agency.

Department of the Army (1991). Army Regulation 190-16, Physical security. Retrieved from:

http://www.apd.army.mil/pdffiles/r190_16.pdf

Department of the Army. (2008). Army Regulation 525-13, Antiterrorism. Washington, DC:

Department of the Army.

Department of Defense. (2007). DoD 5200.08-R, Physical security program. Retrieved from:

http://www.dtic.mil/whs/directives/corres/pdf/520008r.pdf

Department of Defense. (2012). DoD Instruction 2000.12, DoD antiterrorism (AT) program.

Retrieved from: http://www.dtic.mil/whs/directives/corres/pdf/200012p.pdf

Department of Defense. (2006). DoD Instruction 2000.16, DoD antiterrorism (AT) standards.

Retrieved from: http://www.dtic.mil/whs/directives/corres/pdf/200016p.pdf

Department of Defense. (2012). Unified Facilities Criteria 4-010-01, DoD minimum

antiterrorism standards for buildings. Washington, DC: Department of Defense.

Department of Defense. (2008). Unified Facilities Criteria 4-021-01, Design and O&M: mass

notification systems. Retrieved from:

http://www.wbdg.org/ccb/DOD/UFC/ufc_4_021_01.pdf

Department of Defense. (2005). Unified Facilities Criteria 4-022-01, Security engineering:

entry control facilities / access control points. Retrieved from:

http://www.wbdg.org/ccb/DOD/UFC/ufc_4_022_01.pdf

Page 21: Security Vulnerability Assessment Project Thomas J. Kenney ...thomasjkenneyiii.weebly.com › uploads › 2 › 5 › 6 › 3 › ...Running head: MSA 515 - PORTFOLIO ASSIGNMENT 10

Running head: MSA 515 - PORTFOLIO ASSIGNMENT 21

Department of Defense. (2010). Unified Facilities Criteria 4-022-02, Selection and application

of vehicle barriers. Retrieved from:

http://www.wbdg.org/ccb/DOD/UFC/ufc_4_022_02.pdf

Chairman of the Joint Chiefs of Staff (2011). Graphic Training Aid 90-01-011, Joint forward

operations base survivability and protective construction handbook. Retrieved from:

https://atiam.train.army.mil/catalog/view/100.ATSC/0BEF6011-E36F-4F1E-8965

-5DB0931D9010-1300684489163/GTA90-01-011.pdf

Department of the Army. (2009). Graphic Training Aid 90-01-018, Joint entry control point

and escalation of force procedures. Retrieved from:

https://atiam.train.army.mil/catalog/view/100.ATSC/120503F7-BB55-4709-99CC-

F2DD99E2FF57-1300785650409/GTA90-01-018.pdf

Department of the Army. (2011). Graphic Training Aid 90-01-028, Entry control point system

of systems concept of operations and tactics, techniques, and procedures. Retrieved

from: https://atiam.train.army.mil/catalog/view/100.ATSC/4F29888E-5DB9-4D4B-

9395-4857549EB38B-1315507454012/GTA90-01-028.pdf

Department of the Army (2012). Graphic Training Aid 90-01-034, Small-base entry control

point guide. Retrieved from: https://atiam.train.army.mil/catalog/view/

100.ATSC/7C0A24D8-9BC4-45CA-A356-215C9FE43332-1333982642552/GTA90-01-

034.pdf

Forward Operating Base Freedom (2012). Antiterrorism plan. Department of the Army.

Forward Operating Base Freedom (2013). Guard force standard operating procedure.

Department of the Army.

Forward Operating Base Freedom (2012). Physical security plan. Department of the Army.