I. OPSEC and Non-Declared Facilities

Traditional operations security practices assume a facility will not open its doors to its adversaries, whether they be hostile intelligence services or industrial competitors. On-site inspection, the verification technique of choice for several international arms control treaties, requires the inspected party to do just that.

In the past, on-site inspection has not been an issue for most of private industry, as only declared facilities have been subject to inspection. However, non-declared facilities may now be inspected under the United Nations Chemical Weapons Convention (CWC), the US/USSR bilateral agreements on chemical weapons, and the Strategic Arms Reduction Treaty (START) [now a multi-lateral agreement between the US and Commonwealth of Independent States [CIS]: Russia, Belarus, Kazakhstan and Ukraine].

Challenge inspections include inspections of non-declared facilities. Inspections of non-declared facilities are known by different names in different treaty documents. In the chemical weapons agreements they are specifically called challenge inspections, while in START, they are termed 'special right of access visits." The CWC also encourages parties to resolve issues between themselves rather than through the UN. specifying that the resolution may include on-site inspection. There is no formal term for this in the text, and parties are not mandated to follow CWC protocols in the conduct of such inspections or negotiations.

The United States On-Site Inspection Agency (OSIA) implements the on-site inspection provisions of these treaties. OSIA provides inspectors who travel to other countries and escorts foreign inspectors in the United States. Their mission is to ensure that on-site inspection is conducted according to treaty protocols. If your facility is to be inspected, OSIA will work with you and offer advice for preparing your facility. It is important to note that OSIA will be notified of inspections of non-declared facilities only hours before the inspection team arrives. Therefore, the burden for preparation falls to your own pre-planning. OSIA will not automatically know what a non-declared facility needs to protect. You must be prepared to tell them. Also, bear in mind that OSIA has to ensure that on-site inspection satisfies the inspectors' reasonable requests, as well as the inspected party's. OSIA's idea of what is unwarranted intrusion may be different from your own; and if you are not prepared to express clearly and convincingly why inspectors should not be allowed to enter an area, OSIA cannot help you.

It all comes down to preparation. Your company must first decide what it has to protect, whether this be national security information or company proprietary information or processes, then evaluate whether the information could be compromised through on-site inspection. Once you determine that you have information or processes that could be compromised through on-site inspection, the next step is to decide how much money to commit to planning countermeasures to minimize such loss. This paper will first present pertinent points of treaty protocols that govern on-site inspection, then focus on how to estimate whether you are a candidate for on-site inspection under current arms control treaties. Finally, the paper will present some suggestions for organizing the evaluation of your own facility.

On-site inspection is intended to: detect violations; deter violations by providing a vehicle for discovery: and build confidence through 'transparency,' a term which means visual proof that the signatories are adhering to the treaty. The Intermediate Range Nuclear Force ((INF)) Treaty was the first disarmament treaty between the US and the USSR involving verification through on-site inspection in the continental US. The nuclear test ban treaties were the first treaties to involve onsite inspection during tests conducted in the continental US. The success of on-site inspection encouraged further agreements with increasingly more intrusive verification protocols.

The INF and nuclear test ban treaties allow on-site inspection of a static list of facilities. START entails declared facilities, declared suspect-site facilities and introduces the concept of special right of access visits wherein the parties may agree to resolve issues through on-site inspection of a non-declared facility. (START 11 further reduces arms, but brings no additional non-declared facility challenges.)

The chemical weapons agreements entail on-site inspection, with the bilateral agreements utilizing the inspection protocols of the CWC. As the CWC is a United Nations initiative, it potentially expands the composition of inspection teams to all member nations of the United Nations. and allows chemical sampling, records reviews and employee interviews at the plant under inspection.

Today's security world is more complicated than when the threat to US national security was clearly defined as the loss of defense information to the Soviet Union. Current national security is defined as much in terms of economic security as in terms of defense. This was graphically illustrated by the economic fall of the Soviet Union that literally changed the world political order. Further supporting this hypothesis, is that economic security and the ability of the US to compete in the world business arena were pivotal issues in the 1992 national elections, resulting in a new administration for the US government. It follows that technology transfer and loss of the economic edge through on-site inspection will be an important issue in future OPSEC planning.

The end of the bi-polar threat philosophy means OPSEC must focus more on countering multi-national collection methodologies, and in particular, industrial espionage. Other nations have been quite open about their intentions. In September 1991, Pierre Marion, former head of the French external intelligence service admitted in a televised interview that the French had spied on US businesses in Europe. The KGB publicly announced they will continue to collect economic and technical data; and for years, American businesses have experienced industrial espionage from the Japanese.

OPSEC should also consider that each nation listed by the United States Department of State as a state sponsoring terrorism. with the exception of Syria, is at least an observer to the Conference on Disarmament, the organ of the United Nations that authored the CWC. These countries, along with all other member states of the United Nations, are potential signatories to the CWC. Representatives from any nation that is a signatory can comprise on-site inspection teams when the CWC enters into force.

÷Under Chemical Weapons Agreements

Any CWC signatory can request a challenge inspection, "for the sole purpose of clarifying and resolving any questions concerning possible non -compliance with the provisions of [the] Convention," by bringing the issue to the Director General of the Technical Secretariat, who will refer it to the Executive Council and notify the party to be inspected not less than 12 hours before the planned arrival at the inspection port of entry. "The Executive Council may, not later than 12 hours after receiving an inspection request, decide by a three-quarter majority of all its members against [emphasis added] carrying out a challenge inspection, if it considers the inspection request to be frivolous, abusive or clearly beyond the scope of the Convention."

The Executive Council will consist of 41 members. It's mandated composition of States Parties is: eight from Africa; nine from Asia five from Eastern Europe; seven from Latin America and the Caribbean; ten from Western Europe and other States (including the US) to be designated by States Parties located in this region; and one rotating member "to be designated consecutively by States Parties located in the regions of Africa, Asia. and Latin America and the Caribbean."

Corporations may believe they will not be inspected because they make no treaty-limited or defense-related item. Especially with CWC challenge inspections, defense contracts are not the discriminator. The ability to quickly convert a chemical plant to chemical weapons agent production opens many commercial plants to suspicion. Consider the case of Libya's "fertilizer" plant at Rabta. The Rabta plant did indeed produce fertilizer, however there were intelligence reports of unusual activity around the plant which piqued the interest of several intelligence services. While the Rabta facility was under construction, it was surrounded by artillery and other military defenses. Security seemed out of the ordinary for the production of legal chemical products. Intelligence reports of unusual activity around the plant caused the international community concern; but, by the time international inspectors were allowed to visit the site, there was no evidence of chemical weapons production. In Business Week International (23 January 1989) Israeli intelligence is cited as stating that the Rabta facility could be converted within 24 hours to produce up to 42 tones of mustard gas and Sarin nerve agent per day.

The CWC identifies chemical and biological toxins that can be used as chemical weapons agents or are precursors to chemical weapons agents. These lists are known as the CWC Schedules. As some of the chemicals listed in the CWC Schedules are used in the production of common products such as plastics and fertilizers. thousands of industrial facilities in the US either produce, store or utilize them in industrial processes.

Not fitting the profile for a US chemical weapons facility will not necessarily save you from being subject to a challenge inspection. Other countries operate under different safety standards. Foreign chemical weapons production is often hidden in populated areas, under innocuous names. This is not done in the US, but it will be foreign countries requesting challenge inspections of the US. They will identify suspicious sites based upon their perceptions, not the US's.

Again, since the profile of chemical weapons activity varies from country to country, it is important not to use only American state-of-the-art standards in deciding whether your company fits the profile. A country that produces chemical weapons under poor safety conditions is not going to take at face value that your company could not produce chemical weapons because it does not meet US safety standards for chemical weapons production.

÷Under START

Special right of access visits are allowed upon agreement of the involved parties or after agreement is reached in the JCIC. START allows seven days after an issue is raised to either resolve it without convening the Joint Compliance and Inspection Committee (JCIC) or by convening the JCIC.

When concerns are raised: 'The requesting Party may also propose a specific method for resolving the concern. Such a method may include, but is not limited to, a visit with special right of access to the facility or location where, in the opinion of the requesting Party, the activity that caused the concern took place." Special right of access visits may then "be conducted in accordance with the provisions of the Inspection Protocol, as applicable . "

START special right of access visits are of more concern to the aerospace industry than others, because START inspections concern the Minuteman 11, Minuteman 111, and MX ICBMs; Poseidon, Trident I (C-4) and Trident 11 (D-5) SLBMs; B-52G, B-52H. B- 1 B. and B-2 heavy bombers. Companies that should be concerned by START special right of access visits are those which produce or have produced missiles or launch vehicles. These companies may have the profile and the physical plant may appear consistent with the production and/or storage of START items.

The CWC provides for protection of national security and other sensitive information not relevant to the objectives of the CWC, principally through managed access. The CWC grants automatic access to a perimeter, and managed access is the process by which inspectors negotiate further into the perimeter to resolve issues. The spirit of the concept is that, if the site in question is not conducting treaty-limited activities, this can be demonstrated by means other than physical access. The goal of managed access is to allow confidence building, yet protect the inspected party by not giving inspectors free rein. The British tested the concept by conducting mock inspections and came to the conclusion that they had no facility so sensitive that they could not allow some sort of access to it.

Managed access may be employed in non-CWC inspections, and could provide a less intrusive inspection; but for managed access to work to your advantage, you must do some homework. Develop explanations of why your plant could not be conducting treaty-limited activities, starting from your widest perimeter, and plan fall-back positions to specific buildings and specific rooms. The methodology described under General Assessment of Threat and Cost/Benefit Analysis (see below) is a starting point for piecing together a managed access plan. Managed access plans must be tailored to individual facilities.

V. Treaty Highlights

The following are highlights of the INF, START and chemical weapons agreements, which show the evolution of verification protocols and briefly explain what you can expect from them.

á The INF was signed on December 8, 1987, and entered into force on June 1, 1988. The last land-based nuclear missile with ranges of 500-5,500 kilometers belonging to either the US or USSR was destroyed on May 12, 1991, at Kapustin Yar. Over the period of the treaty, 2,692 US and Soviet intermediate and shorter-range nuclear missiles and over 1,000 launchers were destroyed. Although the treaty allows short-notice inspections. facilities were chosen from a static list which had been agreed to by both the US and the Soviet Union. There are no challenge inspections at non-declared facilities under INF.

á START, signed July 31, 1991, will allow special right of access visits at any facility agreed to in the JCIC. The JCIC will be established to adjudicate questions. The JCIC will be comprised of representatives from all signatories and any parry can convene the JCIC to address concerns. Requests for special right of access visits will be submitted through the JCIC or agreed to separately by involved parties. Inspection protocols mandate that inspectors notify the JCIC of special right of access visits 16 hours before their arrival at the port of entry and that they arrive at the inspection site within 72 hours thereafter. Movement into and out of the inspected site may be restricted after the special right of access visit has been granted. After a one-hour orientation and safety briefing, the inspection will be conducted over the next 24 hours, with a maximum extension of 8 hours. There is a maximum of two inspections per year at the same facility. START inspectors have the right to inspect any area which could hold a treaty-limited item, but alternate means of demonstrating compliance, other than visual inspect/on, are allowed.

- The bilateral agreement on chemical weapons between the US and Soviet Union (as affirmed by Russia, Belarus, Kazakhstan and Ukraine) provides for on-site inspection of declared sites, as well as up to 10 challenge inspections as in the CWC.

á Chemical compounds identified or used as chemical weapons agents over the years have been categorized into classes of chemical weapons agents, referred to as "Schedules" by the CWC. There are different inspection regimes for each schedule, but allowable inspection procedures for the CWC are: visual inspection of site: air, soil, effluent wipe sampling: records reviews: interviews of personnel: closed circuit television: seals; tags and photographs.

The CWC Schedules are defined as follows:

Schedule 1. Super-toxic lethal chemicals that are actual chemical weapons agents or their precursors.

Schedule 2. Chemicals permitted in modest quantities, including key precursors, which should be submitted to periodic international monitoring.

Schedule 3. Chemicals produced in large quantities for permitted purposes (e.g., fertilizers), but that could be diverted for the production of chemical weapons agents, or that have actually served as chemical weapons agents in World War I and World War II.

á Although CWC challenge inspection requests are to be submitted to the Director General of the Technical Secretariat, the Director General cannot deny a request and must notify the inspected party not less than 12 hours prior to arrival of the inspection team at point of entry. Inspectors may arrive on the inspection site within 72 hours of notification, and inspection will begin within 96 hours after arrival on-site. Inspectors may secure the site by monitoring exit and entry points of the inspected facility within 24 hours of their arrival. CWC inspectors have the right to inspect the interiors of structures. containers and vehicles, and can require partial removal of shrouds. Inspectors may take air, water and soil samples within the perimeter. The actual duration of the inspection will not exceed 84 hours, unless extended by agreement, bringing the total time involved from notification to departure to 120 hours.

á Read the treaties and determine whether your company fits the criteria for a challenge inspection. Remember, the company does not have to conduct treaty-limited activity to be challenged, it only has to appear to one of the signatories that it does. They don't have to be correct to request the inspection.

á Build your own public profile as if you knew nothing about it. Don't be trapped by explaining away mistaken impressions that one might draw from the outside because you know what really goes on. Look at company advertising and contract links to other companies. Do these connect you with activities similar to those limited by the treaties? Does any company to which you are publicly linked by contracts or advertising conduct treaty-limited activities? Also, blue prints and building permits are public records in most states. What blue prints have you filed and what do they tell you? Are the location of your SCIFs designated? Where are they, and what might that make you look like you do?

á Evaluate your facility by its history and exterior appearance. Has the facility ever engaged in treaty-limited activities, even as a sub-contractor? Does the facility now engage in treaty-limited activities? From the exterior, does the facility appear capable of conducting treaty-limited activities? Are the buildings large enough to store treaty-limited items? Are there high-bays large enough to suggest missile production?

á Look at the exterior of your buildings to determine whether their configuration looks like a plant making or using toxic chemicals. Remember to evaluate your facility against the profile of binary chemical production facilities as well. These may not have the plethora of visible vents frequently associated with toxic chemical production.

á Review your company's filings to federal, state and local environmental agencies. These can be public records. What sorts and amounts of chemicals are utilized by your facility? What does your company advertising say you do with these chemicals?

á Are you located next to a chemical or petroleum plant? When the perimeter is drawn for a challenge inspection, your facility could be included as a contiguous area. It does not matter that the two properties are private and unrelated.

á Consider whence the threat: foreign inspectors, safety factors, work stoppages, or news media bringing extra attention to your facility. What are the impacts if you are tagged, even erroneously, as producing chemical weapons because your facility undergoes a challenge inspection?

á Assess what a foreign inspector might seek during a walk through: your industrial processes, your classified programs, your personnel, to disrupt your operations?

á Describe to yourself how you could attack these assets. Is seeing an item or process enough? Would you engage in HUMINT, computer penetration, etc.?

á If you conduct treaty-limited activity, are sensitive areas contiguous to treaty-limited activity?

á Assign a value, whether monetary or other, to the potential loss.

á With management, prioritize the threats you want to commit time and money to countering.

Chemical Weapons Agreements

á Obtain the annual inventory of the chemicals produced, used or stored by your facility. Compare these to the CWC Schedules.

á Compare the CWC Schedules with any list which your company files with the Environmental Protection Agency, Occupational Safety and Health Administration, or other agency. Remember: these are public records which can be accessed through public computer sources, such as DIALOGUE or CHEMLINE.

á Review your chemical emergency and fire emergency plans. (If you are inspected, these are among the first documents inspectors will request from you. They will do this to obtain information and to assure their own safety.) Make sure these are written generically enough that they do not reveal sensitive projects inadvertently.

1. Identify areas which could house treaty-limited activities.

á Obtain a current site map which indicates your property boundaries and locates all buildings and roads therein. Determine the width of all roads and highlight areas which could not pass loads of either 92" by 210" weighing 25,000 pounds (the MX second stage) or 92" by 330" weighing 107,000 pounds (the MX first stage). Mark also tight turns, light bridges, etc.. which could not accommodate these items. [This type of information is necessary to demonstrate compliance with START without granting full physical access to the area.]

- Identify all buildings large enough to hold a MX second stage. Determine whether exterior and interior doors could pass such an item, Could the floors hold the weight? Are there any permanent structural blockages? Repeat the process for the MX first stage and mark separately. [This information can be used to avoid full physical access to the area.]

2. Document actual work conducted in the areas you have just evaluated.

á Examine the activities conducted in areas that can accommodate treaty-limited items. Mark these as to whether they are administrative offices or manufacturing/storage areas. If it is strictly an administrative area, locking safes and turning off computers may be sufficient preparation for on-site inspection, while manufacturing/storage may require more elaborate security planning. 

á Note square footage of work areas and numbers of employees in identified areas. This will help you determine whether specific areas can accommodate treaty-limited items and, simultaneously. keep a tally of the number of personnel potentially affected by the inspection.

á Note high-bays or other large rooms which will attract attention because of their size.

á Note the location of major fixed equipment, as well as weight bearing specifications which may be able to accommodate treaty-limited items. (Some fixed equipment may appear on blue prints which are public records.)

á Note areas where sensitive activities occur, to include both national security and company proprietary. Designate whether these would be compromised through visual inspection or if an inspector were able to pick up materials samples.

á Designate areas which would not be compromised if shrouding were used. Indicate whether the item to be shrouded is classified or company proprietary. Note the dimensions of areas to be shrouded.

á Plan a route through the facility which avoids your sensitive areas. Walk or drive that route and note what you see. Were sensitive operations, such as tests, observable?

á Walk through the areas in buildings that could be inspected, as well as the areas through which you will pass to get to inspection areas. What do you see on the walls? Are there signs indicating what projects are underway or that the area requires a special clearance to enter? Are there warning signs posted indicating toxic chemicals are used on the premises? Look at the work areas. Do the books on employees' shelves indicate what they do? Do the white boards give away project or personnel information? Do the bulletin boards indicate social activities which also identify personnel and their pursuits? Are calibrations scribbled on equipment and consoles? Do packaging labels indicate a flow of activity connecting one building or company to another?

á If you determine you might be inspected, investigate how to shroud sensitive non-treaty-limited equipment. This method of concealment must be carefully considered. It must conceal the equipment without damaging it. Keep in mind that, according to the treaty, shrouding must allow the inspectors to determine that it conceals no treaty-limited-activity. If they can't do that, you might be asked to raise the shroud to the point that the inspector can determine the equipment is not a treaty-limited item. Shrouding is expensive. As an alternative, can you conceal the sensitive information by covering the instrument dials or some part of the equipment?

á You must provide site maps to inspectors. Make up generic maps and pre-plan potential inspection perimeters.

á Preparation is costly; however, no preparation may result in unacceptable loss.

I á Use a multi-discipline team to evaluate your facility that includes experience in your technology, counterintelligence and intelligence gathering.

- Concealment sounds good, but it should be carefully considered. Shrouding can be expensive. Inappropriate shrouding can cause damage to the item it conceals. A shroud that does not allow an inspector to determine there is no treaty-limited item beneath it may have to be removed.

á Plan the inspection route. Company X makes a treaty limited item in room 40 of Building Y. Company X has non-treaty-limited national security projects in Building Y. room 3 and Buildings D, E:, and F. In addition, Company X has nontreaty-limited proprietary processes in Building Y. room 20. as well as in Buildings T. U. and V. According to the treaty, Building Y. room 40 will be inspected.

Company X's options are:

A. Let the inspectors say where they want to go.

B. Pre-plan a route through the facility which avoids sensitive buildings and areas in so far as feasible, while still allowing inspection of treaty-limited activities.

The right answer is to pre-plan. Generally. the inspectors will accept any logical route, as long as they do not perceive the intent to deceive them. Inspections are limited in time and, though there is always the possibility of an intelligence collection mission, inspectors do inspect according to the treaty and must produce a report of their activities by the end of the inspection Because of time constraints. intelligence collection during on-site inspection is mainly by targets of opportunity. Pre-planning avoids inadvertently presenting collection opportunities.

á Keep the inspectors moving. Breaks give inspectors time to refresh themselves and to concentrate on getting to know your personnel for HUMINT collection.

á Plan to brief each employee as to what is expected of them during the inspection. It is not enough to brief management. Make sure no one is left out.

á You will be asked to provide communications and word processing support to the inspection team. If you give them computers. ensure that the hard drives have been scrubbed and loaded with only word processing capabilities--nothing that would allow them to recapture your files. Inspection teams customarily use hand-held radios to communicate while moving through a facility. Identify areas where the radio frequencies might harm tests or equipment and devise alternate means of communication in those areas. Brief OSIA on the potential problem when they arrive at the facility, so that they can present alternatives to the inspection team and avoid the appearance of a deception attempt.

á Conduct a trade-off analysis as part of your pre-planning. Know the difference between what you can let go of if you have to and what you must defend at all costs. The START treaty states grievances that cannot be resolved in another manner are to be raised to the JCIC. It emphasizes reasonableness in conducting inspections in the least intrusive manner possible. The inspectors are supposed to accept proof that an area should not be inspected. If the company has pre-planned the rationale for denying entry into a secure area that does not conduct treaty-limited activity, there is a chance to deny entry. If the company tries to "wing it" or expects Government representatives to "just say no" without solid evidence that no treaty limited activity is conducted in the area in question, the company will be sorely disappointed. OSIA is to make sure the treaty is implemented according to the protocols. OSIA's dilemma is to ensure the inspectors do not abuse the treaty, yet assure that the inspectors see anything they request that fits treaty parameters. It is not OSIA's responsibility to know your facility or your projects. If you do not help them, they cannot help you

- Are computer terminals turned off?
- Are trash cans empty and inverted?
- Have sensitive tests been halted?
- Are white boards and bulletin boards clean?
- Have plaques and framed letters of commendation which indicate sensitive projects or connections with intelligence agencies been removed from the walls?
- Have signs indicating sensitive projects been removed from the roadway on the facility?
- Have maps and timelines which reveal your connection with and schedules for sensitive projects been removed from the walls?

You can mitigate the effect of on-site inspection, but it takes considerable pre-planning. Ultimately, management must decide what is to be protected and how much money is to be expended in the process, but the most costly thing your company or agency can do is to wait until you are notified of an inspection to prepare. Evaluate yourself now, or hire a treaty professional to do it for you.