Read more

Serious Incidents

There was a total of five incidents in the week that were reported as “Serious Incidents” as defined by PHMSA. Four were classified as ‘serious due to bulk discharges of hazardous materials, and one involved a fire on an aircraft.

Three of the bulk discharge incident…

Read more

• Looking Back – 3-4-11 – Unusual Order Reporting – Keeping precursor chemicals out of the hands of terrorists - https://chemical-facility-security-news.blogspot.com/2026/08/looking-back-3-4-11-unusual-order.html

• FRA Sends Electric Brake Final Rule to OMB - https://chemical-facility-security-news.blogspot.com/2026/08/fra-sends-electric-brake-final-rule-to.html

• Short Takes – 8-29-26 – Federal Register – CG hurricane safety – Space Geek ICR – EO 14421 – 10 FRA deregulation final rules - https://chemical-facility-security-news.blogspot.com/2026/08/short-takes-8-29-26-federal-register.html

• NOTE: I published “Chemical Resiliency – A Short Story” on Substack today. Free Subscribers will receive their copy on Monday night.

I have removed the following articles from the CFSN Detailed Analysis paywall:

• (2021) HR 4431 Introduced - FY 2022 DHS Spending,

• (2022) HR 2471, Division B, CJS Provisions,

• (2023) Public ICS Disclosure – Week of 3-3-23,

• (2024) S 3594 Introduced - Federal Code Sharing, and

• (2025) Public ICS Disclosures – Week of 1-4-25.

I posted the following to my social media feeds (X, Mastodon, Substack, and LinkedIn):

• I posted the following to a discussion on Substack Notes about $0.35/gal gas prices: “Yep. Minimum wage was $1.35 hr and a brand new 71 VW Bettle was $1,845.”

Stretching, I answered the call; “This is Joe, what’s wrong.” Something had to be wrong for them to call me this late.

“Joe, it’s Craig. There’s been a cyberattack on the Georgia plant.” Craig was my boss, the Safety Manager for Median Chemicals, a specialty chemical company out of Baton Rouge.

“Craig, I’m not your cyber guy. Call Steve.”

“Steve’s already on it, but the plant manager says that he needs your help.”

“Kind of late for safety training isn’t it, Craig?” I have been the corporate safety trainer for the last five years.

“Harry says he needs your help running a couple of batches, and the Boss says you’re going. You have a six AM flight to Columbus. Take your laptop, just don’t take it to the plant. Steve’s still not sure of the extent of the problem.”

“If Bill says I’m going, then I am on my way. Okay, on the 6 AM flight, I’ll be there. How long?”

Bill Median was founder’s son and current CEO of Median Chemical.

“At least a week. Oh, if you have anything on the glycidyl ether process, take it with you. Call me tomorrow night.” He hung up; Craig wasn’t one for long goodbyes.

“What’s wrong Joe?”, the wife said, standing there in the hall behind me.

“Some problem at the Columbus Plant, I have to fly there on the early flight in the morning.”

“Been a long time since they called you in the middle of the night, honey. Go get your shower and I’ll make coffee. Is your travel bag packed?”

• • • •

Harry Lourdes, the Columbus Plant Manager, picked me up at the airport, an expensive chauffer. He had been the shift supervisor that trained me on the third shift as an operator at the plant twenty-five years ago. We were never personally close, but we trusted each other. Over the years we had gone in different directions up the corporate ladder, but we bumped into each other periodically along the way.

We walked through the airport, talking business casual. After we got in the car, it got more serious.

“What’s going on Harry?” I asked after he paid the toll to get out of the parking lot.

“Cyberattack on the control system yesterday afternoon. When they lost control, the shift supervisor got everything safely shut down. Steve is working on the cyber issues, but the control system is down for at least a week, maybe longer.”

“Okay, but why am I here?”

“I have to ship two batches of HE 64 by Friday at 5:00 pm. They got through the epi add on the first one just before the shutdown. We got to finish that one and run another before Friday noon.”

Pretty sure I knew the answer, but I had to ask the question, “But why am I here?”

“You and I are the only ones still in the company that have ever run it by hand, and you were better.”

• • • •

Glycidyl ethers are a fairly straight forward product to make. You add epichlorohydrin to an alcohol using a ring-opening addition reaction. Then you close an epoxy ring on the chlorine end of the propyl addition by adding sodium hydroxide. Finally, you wash out the produced sodium chloride and dry the product.

While handling epichlorohydrin has its own safety issues, HE 64, with linear alcohols and no solvents required, is a fairly safe chemical process; nothing is likely to blow up or poison the neighborhood. Still, before we did anything else, we needed to do a safety review. Since I was the Safety Manager’s representative, I get to lead that mess.

After Steve Gorden briefed us about the cyberattack, at least what was known about the attack at that point, Harry updated us about the six batches that were in kettles when the attack was noticed. Two batches were in the early portion of the charging process; no chemical reactions had yet been started, and they could stay in the closed kettles for a couple of weeks, at least. One batch was completed and needed to be drummed out. Two others were at stable intermediate stages and could be transferred into empty tank trucks for storage.

That left just the HE 64.

“Can we finish the HE 64 batch in Reactor 6 without using the control system?” Harry asked the group.

“What do you need in the way of controls?” Steve asked in response.

George Simpson, the first shift production supervisor, had been tasked earlier with providing a list of the valves, pumps, and gauges that would be necessary. Everyone agreed that manual controls were in place to operate all of the required equipment. The problem was the instrumentation. Currently, there are digital readouts on the wall in the control room, but all of them were wired through the suspect PLCs. The instrumentation tech, Calvin Jones, told the assemblage that he could probably rewire the sensors directly to the panel in a couple of hours.

“What else do we need to finish the product that we currently have in Reactor 6?

“We probably need to update the process hazard analysis before we start opening valves,” I offered.

“The whole PHA?” George asked.

“Eventually yes, but to finish the current batch we just need to look at the caustic cook, wash and drying.” I explained.

“Okay, can we start that in an hour?”

“Give me an hour and a half, so I can get the paperwork together. Oh hell, is there a printer I can use?”

“Don’t hook your laptop to anything in the plant until we clear everything. I have a clean printer in my van if you need to print anything from your system. Printer cable only.” Steve replied; as with any good cybersecurity professional, Steve was paranoid. Maybe not paranoid enough, or we wouldn’t be going through this process now.

• • • •

As we continued to work through the process step-by-step, I asked, “How are we going to start the caustic flow?”

“An operator at the caustic storage tank will open the bottom valve on the storage tank when notified by the control room by radio and then start the pump. Then the control room operator will open the manual charging valve.” George replied.

“How do we know when to stop the caustic flow?”

“Well, we can either use the inch count from the tank radar gauge to calculate the weight of the caustic, or we can use the load cell readout in the control room.” The plant manager offered.

“Which is more accurate?”

“Vessel weight.” The first shift supervisor replied.

“What happens if there is an overcharge?”

“No safety or quality issues, but we would have to use more sulfuric acid during pH neutralization of the wastewater.”

“What happens if there is an undercharge?”

“Excess time as more caustic is added after QA testing.”

We continued the step-by-step process analysis for another four hours.

“So, Joe, do we have any outstanding issues?” Harry formally asked.

“No, we’re good.”

“George, can your people finish the current HR 64 batch using this process?” Again, the formal question.

“Yes sir, especially since nothing else will be running.”

“Okay, Joe write this up and get it to me for signature. First shift will run this tomorrow morning.”

• • • •

The next morning, I sat in the classroom as Harry briefed the first shift on the manual process for completing the HR 64 batch. As the de facto corporate representative, I was happy with Harry’s explanation and the active discussion about the revised process. It wasn’t that much different from the process the team had been using other than manually opening and closing the valves.

I was more concerned about starting the second batch. The epichlorohydrin add was always tough when done manually. The reaction was exothermic, and it was tough keeping the reaction vessel within the appropriate operating temperature range. Fortunately, with no solvents present in the process, you could not get enough heat out of it even with the entire epi charge to get to the boiling point of the long chain alcohols in the vessel, so there was no possibility of an explosion; you could certainly fry the batch, but it was physically safe.

As the first shift filed out of the classroom to finish the current HM 64 batch, yesterday’s PHA team filed back in with a senior operator from first shift standing in for George. He wanted to be on hand to run the manual batch, and Harry wanted him there. Loretta was an experienced operator. I had run PHAs with her in attendance before, and she could be counted upon to participate fully and informatively.

As we went through the step-by-step review of the epi addition process, it quickly became obvious that we had come to rely upon the control system almost too much. Harry and I were the only ones that had watched the epi add in enough detail to understand all of the things that could go wrong. The only saving grace was that there was not much in the way of safety issues that arose during that portion of the process, and none of those were novel to the manual process. I had spent a great deal of time yesterday and last night, looking at the old PHA files to confirm that.

We continued step-by-step through the entire epi addition process, working out the issues as they arose. A couple of hours after lunch we got to the point where Harry asked Loretta if she thought that she could complete the epi addition using this process. Unfortunately, she shrugged her shoulders and said, “Safely, probably. Make a good batch, probably not.”

There was a lot of back and forth, but it came down to the fact that this was a complex process that needed someone with experience to run. Everyone turned and looked at me...

“Hey, it’s been almost 20 years since I last ran one of these batches.” I paused, took a deep breath and then said, “Okay, I’ll give it a try.”

• • • •

The next morning, after Harry had his process update briefing in the classroom, we all filed up to the control room. Everyone had either seen me in the front of a classroom or running a PHA, but I was still an outsider, so things were unusually quiet in the control room. Loretta took care of charging the alcohol, getting it dried, and the catalyst added. She then turned to me and said: “It’s all yours Joe.”

I checked that Loretta had set the appropriate target weight on the flowmeter controls (now hardwired to the control meter) and started the feed at 50-lbs/min. The vessel temperature dropped below the lower limit since the epi was cooler than the reaction mass. I stopped the feed and waited to see if the temperature would rise on its own, realizing that we should have started closer to the upper end of the limit.

I waited for five minutes with no temperature rise noted. Just before I was going to start blowing the internal coils empty to start heating the vessel, I saw a 0.1°C uptick, so I continued waiting. Once the temperature got back into the target range, I restarted the epi feed at a slightly reduced feed rate. With the temperature continuing to rise, I started the cooling flow, opening the manual handle only about halfway.

For the next 90 minutes, I continued to play with the epi and cooling feed rates, trying to keep the temperature between the indicated 5°C temperature range. There were numerous excursions outside of the range, but usually within just 1 or 2°C of the expected range. I remembered back to the earlier days when I had run this process, and we were happy to keep it within 5 or 10°C. Fortunately, I had taken the time yesterday to have Calvin explain the programming of the PLC for the control of the epi feed. I was not as quick or accurate as the PLC, but with constant attention I was able to generally mimic its control scheme.

When the epi feed was done and the one-hour reaction hold ended, I called down to QA to have them do their in process testing. Having transferred responsibility to QA, I took a deep breath and slowly let it out, draining some of the tension.

While I was taking a moment to relax, Loretta asked me, “And that is how you used to run it all of the time?”

“No. We were usually slower to react and frequently had to turn off the epi feed to let the batch get back into range. I remember one batch where we got to 20° out of range on the high side; that batch was out of spec. Actually, I think that about one batch in five was out-of-spec.”

“And that was accepted?” She asked, amazed.

“Well, that was before we understood just how important the temperature range was and then reduced the epi addition range to the 5° C range that we are currently using.”

“But the rework?”

“We could usually blend off the rework batches into good batches, so the cost was not as bad as it sounds. That would be harder now since we added a color spec as we were better able to control our process. The rework is almost always yellow; current good product is almost colorless.”

“I hope they get the control system back working quickly.”

“So do I, Loretta, so do I.”

• Review – Bills Introduced - 8-27-26 – 42 bills – HR 10151, Water system technical assistance – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-bills-introduced-8-27-26.html

• Chemical Transportation Incidents – Week of 7-25-26 – 627 incidents (584 highway, 33 air, 10 rail) - 5 serious incidents (4 Bulk release, 1 injury, 10 fire/explosion, 30 no release) - week_0927046400.html

• FCC Sends Direct-to-Device NPRM to OMB - https://chemical-facility-security-news.blogspot.com/2026/08/fcc-sends-direct-to-device-nprm-to-omb.html

• CSB Publishes Update for Dynawave Tank Failure Investigation - https://chemical-facility-security-news.blogspot.com/2026/08/csb-publishes-update-for-dynawave-tank.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• (2021) Public ICS Disclosure – Week of 8-7-21 – Part 2,

• (2022) 1 Advisory and 1 Update Published – 3-22-22,

• (2023) 4 Advisories and 1 Update – 3-2-23,

• (2024) 7 Advisories and 1 Update Published – 1-30-24, and

• (2025) HHS Publishes HIPAA Cybersecurity NPRM.

• HR 10151 To amend the Safe Drinking Water Act to adjust the limits for technical assistance, grants for small systems, and the authorization of…

Read more

• Short Takes – 8-27-26 – Federal Register – TSCA risk evaluation – ICR notices: EPA, EPCRA reporting; NHTSA, HMI design study - https://chemical-facility-security-news.blogspot.com/2026/08/short-takes-8-27-26-federal-register.html

• Review - S 5067 Introduced – Cybersecurity Training - Would require CISA to establish a cybersecurity apprenticeship program – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-s-5067-introduced-cybersecurity.html

• Review – NCCIC-ICS control system security advisories – Updated Mitsubishi advisories – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-5-advisories-and-2-updates.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• (2021) S 2407 Introduced - Cyber Incident Notification,

• (2022) HR 7077 Introduced - Fire Investigations,

• (2023) FHWA Publishes Electric Vehicle Infrastructure Final Rule,

• (2024) S 3635 Introduced - President’s Cup Update, and

• (2025) CISA Publishes OBP TRIPwire 60-day ICR Notice.

I posted the following to my social media feeds (X, Substack, and LinkedIn):

• Interesting note from NHC about the naming of TS Dolly https://www.nhc.noaa.gov/text/refresh/MIATCDAT4+shtml/271449.shtml?

  

Advisory Summari…

Read more

Read more

• BIS Sends CWBC Sudan Sanctions Final Rule to OMB - https://chemical-facility-security-news.blogspot.com/2026/08/bis-sends-cbwc-sudan-sanctions-final.html

• CSB Releases Fatal Nitrogen Gas Release Safety Video - https://chemical-facility-security-news.blogspot.com/2026/08/csb-releases-fatal-nitrogen-gas-release_02093785741.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• HR 8560 Introduced – Advanced Automotive Tech,

• (2021) Public ICS Disclosure – 8-13-21 – Part 1,

• (2022) Public ICS Disclosures – Week of 3-12-22,

• (2023) 2 Advisories and 1 Update Published – 2-28-23, and

• (2024) CSB Updates Accidental Release Reporting Data – 1-25-24.

• Short Takes – 8-25-26 – Federal Register – TSCA finding – UAS imports – ICR notice – Space Geek - https://chemical-facility-security-news.blogspot.com/2026/08/short-takes-8-25-26-federal-register.html

• Review - HR 10108 Introduced – Hazmat Transparency Act – Shaped by the GKN Aerospace incident – Would require DOD guidance to DIB for chemical community engagement and emergency response – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/reveiw-hr-10108-introduced-hazmat.html

• Review – 7 Advisories and 2 Updates Published – 8-25-26 – NCCIC-ICS control system security advisories and 2 updates – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-7-advisories-and-2-updates.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• Public ICS Disclosures – Week of 6-13-26 – Part 3,

• 7 Advisories and 3 Updates Published – 6-23-26,

• Bills Introduced – 6-24-26,

• 9 Advisories and 1 Update Published – 6-25-26, and

• (2021) 2 Advisories and 1 Update Published – 8-12-21.

Advisory Summaries

Furuno Advisory - This advisory desc…

Read more

Read more

Serious Incidents

There was a total of two incidents (here and here) in the week that were reported as “Serious Incidents” as defined by PHMSA. Both of those incidents concerned bulk releases (300-gal and 230-gal) from plastic IBC due to forklift strikes. No injuries resulted in either …

Read more

• PHMSA Sends LNG Amendments NPRM to OMB - https://chemical-facility-security-news.blogspot.com/2026/08/phmsa-sends-lng-amendments-nprm-to-omb.html

• Review - TSA Sends HMI Threat Assessment ICR to OMB – Declining HMI enrollments will be a problem for the chemical industry – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-tsa-sends-hmi-threat-assessment.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

1. (2021) 9 Updates Published – 8-10-21,

2. (2022) 1 Update and 1 3rd Party Advisory Published,

3. (2023) DHS Congressional Oversight,

4. (2024) Public ICS Disclosures – Week of 1-20-24, and

5. (2025) BIS Publishes Security ICTS Supply Chain (UAS) ANPRM.

Read more

• Looking Back – 9-17-13 – Disclosure – An Opposing View - https://chemical-facility-security-news.blogspot.com/2026/08/looking-back-9-17-13-disclosure.html

• Chemical Transportation Incidents – Week of 7-18-26 – 645 incidents (608 highway, 33 air, 4 rail) - 2 serious incidents (2 Bulk release, 1 fire/explosion, 40 no release) - https://chemical-facility-security-news.blogspot.com/2026/08/chemical-transportation-incidents-week_0653264316.html

• Short Takes – 8-21-26 – Federal Register – EPA: TSCA risk assessment ethylene-dibromide – EOP: UAS imports proclamation – FEMA, Stakeholder Preparedness Review ICR extension - https://chemical-facility-security-news.blogspot.com/2026/08/hort-takes-8-21-26-federal-register.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• Bills Introduced – 6-17 thru 6-19-26,

• HR 7885 Introduced – Cybersecurity Skills Integration,

• Public ICS Disclosures – Week of 6-13-26 – Part 2,

• (2021) 9 Advisories Published - 8-10-21,

• (2022) 1 Advisory and 1 Update Published – 3-15-22, and

• (2023) HR 1160 Introduced - DOE Cybersecurity Reporting.

• FCC Sends Satellite Spectrum Abundance Final Rule to OMB - https://chemical-facility-security-news.blogspot.com/2026/08/fcc-sends-satellite-spectrum-abundance.html

• 1 Advisory Published – 8-20-26 – One NCCIC-ICS control system security advisory for products from Johnson Controls - https://chemical-facility-security-news.blogspot.com/2026/08/1-advisory-published-8-20-26.html

Yesterday, I published the following on Chemical Facility Security News:

• Review - ChemLock Fact Sheets – August 2026 – CISA has doubled the number of ChemLock Fact Sheets on their website – Little or no outreach to publicize them – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-chemlock-fact-sheets-august-2026.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• (2021) ChemLock Fact Sheets,

• Bills Introduced – 6-16-26,

• HR 9022 Introduced – FRY 2027 EWR Spending,

• 8 Advisories Published – 6-18-26,

• HR 7525 Introduced – State cUAS Authority, and

• Public ICS Disclosures – 6-13-26 – Part 1.

Program Background

In November …

Read more

• Short Takes – 8-18-26 – Federal Register – DOE, Energy Advisory Board – EPA, FIFRA SAP – DOT, America’s Great Corridors of Commerce – Space Geek: FAA Reditus Space ENOS Reentries EA - https://chemical-facility-security-news.blogspot.com/2026/08/short-takes-8-18-26-federal-register.html

• Review - S 4565 Introduced – Chinese Cyber Threats – Would require CISA to establish interagency task force to respond to cybersecurity threat from State-sponsored actors – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-s-4565-introduced-chinese-cyber.html

• Review – 2 Advisories Published – 8-18-26 – NCCIC-ICS control system security advisories for products from Siemens and CISA – DTRH look at CISA vulnerability reporting – Short version of article published here (premium content) - https://chemical-facility-security-news.blogspot.com/2026/08/review-2-advisories-published-8-18-26.html

• CISA Adds VMware Vulnerability to KEV Catalog – 8-18-26 - https://chemical-facility-security-news.blogspot.com/2026/08/cisa-adds-vmware-vulnerability-to-kev.html

On Saturday, I published the following on Chemical Facility Security News:

• S 5313 Introduced – FERC Quantum Cybersecurity – FERC to consider quantum computer risk in future standard setting - Post includes discussion of the definition of Operational Technology – Short version of article published here - https://chemical-facility-security-news.blogspot.com/2026/08/review-s-5313-introduced-ferc-quantum.html

I have removed the following articles from the CFSN Detailed Analysis paywall:

• (2024) HR 9769 Introduced - Chinese Cyber Threats,

• Public ICS Disclosures – Week of 6-6-26 – Part 3,

• HR 7552 Introduced – Fentanyl and CBWC,

• CSB Publishes FY2026 – FY2030 Strategic Plan,

• HR 7696 Introduced – Grid Scale Testbed, and

• CSB Updates Accidental Chemical Release Reporting Data – 6-1-26.