Auditors and drones: are you at risk?

Author : Douglas Leech, Special Projects Director, Chemical Business Association

11 September 2023

In addition to ongoing challenges and disruptions, the chemical industry is facing a new threat – increased auditor and drone activity around their facilities and assets. Douglas Leech, Special Projects Director at the Chemical Business Association (CBA), looks at how companies in the chemical supply chain and beyond should prepare for and respond to this problem.

Image: Shutterstock

(Click here to view article in digital edition)

Traditionally, an auditor was a person or company, possessing specific qualifications, which was appointed by an organisation to conduct an audit. In recent years, however, a new type of auditor has emerged – someone who, in pursuit of supposedly educating the public, puts themselves in situations where they know that the police will likely be called.

Several incidents involving such auditors have occurred at chemical sites across the UK, mainly at facilities under the scope of the Control of Major Accident Hazard (COMAH) regulations. These incidents follow the same modus operandi – individuals or groups of people will appear at a site perimeter and begin filming, often adding inaccurate and ill-informed commentary. When challenged by site staff, they turn to verbal abuse to elicit a reaction, filming all the while. Their footage is then shared online.

Unfortunately, there are no powers or laws prohibiting the taking of photographs, film, or digital images in a public place. Once an image has been recorded, the police generally have no power to delete or confiscate it without a court order. This creates a serious issue for businesses, as it is impossible to distinguish between attention-seeking auditors and hostile reconnaissance.

Of course, the threat does not end there – whilst auditors generally use a handheld camera or phone to record footage, they are increasingly turning to Unmanned Aerial Systems (UAS) or drones to obtain footage.

Understanding aerial threats

UAS consist of three key components: an unmanned aerial vehicle (UAV), a ground control system which allows the UAV to be controlled remotely, and a wireless link between UAV and the ground system to provide telemetry, control messages and relay imagery.

The emergence and evolution of UAS technology has brought about a host of exciting benefits and the systems are used by a wide variety of industries and public sector services around the world. From flood warnings and search and rescue missions to conservation, law enforcement, and filmmaking, these systems have been driving more efficient and expansive ways of working.

However, they also pose severe security risks. Whilst some operators may be unaware of the regulations or may cause danger or disruption by flying a UAS in a reckless and irresponsible manner, others turn to these systems with hostile intent.

In fact, the reckless use of drones is becoming widespread across the country, an example of which was the sustained disruptive activity at Gatwick Airport in 2018, and at Heathrow Airport in 2019, respectively. These systems are also increasingly used for protests – Greenpeace activists crashed a Superman-shaped drone into a French nuclear power station in 2018 – as well as for criminal purposes, such as smuggling contraband into prisons. In the commercial space, drones are being used to steal proprietary intellectual property.

Image: Shutterstock

With this in mind it is vital that companies across the chemical supply chain, and the chemical sector as a whole, assess the risks posed by UAS, and that they put adequate and effective measures in place to mitigate these risks.

Assessing the risks

It is important for chemical companies to make a realistic assessment of the risks posed by UAS, as understanding how a site may be vulnerable will help identify suitable mitigation options.

Following the UAS threats at Gatwick and Heathrow, there has been a substantial increase in demand for a programme which provides protective security advice, informs and advises policymakers, supports the response to incidents, and advises on the capability of counter measure technology.

To this end the Centre for the Protection of National Infrastructure (CPNI) has developed a Counter UAS (C-UAS) Programme, which focusses on an effective operational response to UAV incidents. It essentially consists of seven steps:

1. Identify the components of a strategy and plan, focussed on UAS.

2. Understand the risks posed by UAS and conduct a site vulnerability assessment.

3. Determine what can be done to reduce reckless/negligent use and deter hostiles.

4. Identify the role that physical hardening can play.

5. Ascertain whether deploying C-UAS technology is appropriate.

6. Develop reporting and response procedures.

7. Review the strategy and plan.

Developing a C-UAS strategy

Image: Shutterstock

C-UAS is used to describe a wide range of protective security measures and processes that can be used to mitigate the risk of hostile UAS activity, and developing a C-UAS strategy must achieve an all-inclusive security solution.

The plan developed should define the response to the risk and support the delivery of a safe and secure site by setting out how the mitigations will be managed and delivered. It must outline:

- Who owns the risk?

- Who is responsible for the delivery of the plan?

- Who will make key decisions?

- How are roles and responsibilities split?

To achieve this, vulnerability assessments must be conducted. These assessments will not only identify assets but will also help develop an understanding of threats and how they may manifest themselves. The results of the vulnerability assessments must then be used to inform steady state procedures.

Aspects to consider include site view, for example what can and cannot be seen from a public area outside the perimeter; sensitive assets, for example which areas may not be filmed; and sensitive practices for example what takes place in public view and whether these activities can/should be moved elsewhere.

Implementing mitigating measures

Industry’s biggest security challenge is simply staying one step ahead. This means that tailored measures must be put in place to not only reduce negligent and reckless use, but also to deter hostile activity. As a first defence, straightforward and less expensive measures should be adopted.

Other factors to be considered include community engagement and security minded communications. These are aimed at building awareness of the threats posed by UAS and encouraging the local community, site staff and other stakeholders to report and respond to suspicious UAS activity over and around facilities and assets.

Physical security measures, such as introducing cover from view, creating physical barriers, restricting access or hardening can also be taken. The goal here should be to make sites less appealing. Moreover, airspace restrictions and geo-fencing, the creation of virtual boundaries around specific zones or locations, should be investigated.

Douglas Leech, CBA

Reporting and response

People working on site can be prepared to deal with auditor and UAS risks in various ways. For example, when responding to a situation where a site or facilities are being recorded, it is important that staff remain calm and professional. It is equally important that they have prepared an appropriate response, if questioned by an auditor, with the knowledge that they are looking for an inappropriate answer or action.

For example, site staff could approach auditors with a friendly greeting such as “How’s it going today?”, followed by “Some people are finding it suspicious and concerning that you are recording our premises and staff. I would simply like to find out what you are doing out here so I can reassure our staff about what’s happening.” This generally leads to better results than a terse “What are you doing out here?” or “Why are you recording our building?”. It is important to keep in mind that quite often, your staff’s first words or actions will set the tone for the rest of the exchange. An additional precaution in this instance is to provide staff with earpieces for radios so that site communications cannot be overheard or filmed while staff interact with auditors.

In addition to guidance on dealing with auditors, staff must be instructed on how to report UAV sightings, actions to follow if the presence of a UAV or operator is verified, and what to do should UAVs or related equipment be found on or around sites.

A series of exercises should be developed to ensure all aspects are understood, integrated, that technical capabilities are working and there is a clear understanding of each stakeholder’s roles and responsibilities. Additionally, tabletop drills should be used to ensure that the right solutions are being selected and that there is a proper understanding of the implications of each.

Finally, relationships with law enforcement are key. This engagement may provide support in various ways, including in developing an understanding of the risk to the site, the provision of guidance in relation to the mitigation of these risks, and the development of the overall strategy.

Auditors and UAS may now be a fact of life for companies in the chemical supply chain and the wider sector, but it does not have to become an unmanageable or unmitigable risk. There is plenty of assistance available, with guidance and resources on dealing with auditors and UAS constantly growing.

About the author:

Douglas Leech is the Special Projects Director of the Chemical Business Association based in Crewe. He joined the association in 2003 following over twenty years in the product formulation sector in both health & safety and R&D roles. In his role, Doug’s focus involves overall strategy and objectives, and close collaboration with key stakeholders and organisations. In particular, he focuses on working towards an alternative UK REACH model.