2222222222

Black Swan

Toxic Tornado

When a nuclear reactor melts down due to a powerful tornado, deadly contamination rains down on a metropolitan area.
By: | August 4, 2014 • 9 min read

It is a warm, humid spring day in Dallas/Fort Worth when strong thunderstorms begin to develop alongside a high-altitude weather system that includes strong winds and convective energy coming from the Rocky Mountains.

By mid-afternoon, the atmosphere reaches a tipping point. A massive supercell thunderstorm along the weather front produces large, damaging hail and what is later designated as an EF5 tornado, with winds in excess of 200 mph.

The most recent tornado of this size as designated by the National Weather Service was on May 20, 2013, when an EF5 struck Moore, Okla., killing 24 people, flattening neighborhoods and schools, and injuring more than 350 people.

This Texas tornado is much, much worse.

Video: An EF5 tornado in May 2013 flattened much of Moore, Okla.

Moving in the usual southwest to northeast direction, it creates a damage path about 1 mile wide and nearly 200 miles long, and directly strikes the Comanche Peak Nuclear Power Plant in Glen Rose, Texas, about 40 miles west of Fort Worth and 60 miles west of Dallas.

The power plant’s reactor was built to withstand winds up to 300 mph, but it can’t withstand what happens after the tornado throws around multiple gas-filled tanker trucks, which explode and kill numerous workers.

Matthew Nielsen, director of Americas product management at RMS, created the model for our Comanche Peak Nuclear Power Plant black swan scenario.

Matthew Nielsen, director of Americas product management at RMS, created the model for our Comanche Peak Nuclear Power Plant black swan scenario.

Debris fills the air as the powerful winds destroy much of the plant’s emergency equipment, making it impossible to maintain proper conditions and temperature within the reactor. The remaining power plant workers feverishly try to manually shut down the nuclear reactor before it melts down. They can’t.

When the reactor’s heat exceeds the ability of the plant’s processes to cool it down, radioactive gases begin to snake their way into the funnel stacks. The radioactive contamination is carried by the ferocious winds directly toward Dallas/Fort Worth.

Communication fails as area power lines go down, so it is difficult to warn the 7 million residents of the Metroplex, as Dallas/Fort Worth is known. Residents know the tornado has been sighted and try to prepare, but they don’t know that deadly airborne toxins are being carried toward them.

The Damage

About 10,000 homes and 700 commercial structures in the direct path of the tornado are completely destroyed and another 35,000 suffer damage, according to a model built by RMS. Roofs are ripped off apartment houses and multi-family dwellings. Vehicles are tossed around like toys, and with the storm striking at rush hour, workers on the roads are exposed to flying debris and high winds.

Advertisement




Even with residents sheltering in basements and safe rooms, fatalities reach into the 500-700 range — putting this event in line to be the deadliest tornado in U.S. history, after the Tri-State tornado of 1925, which killed 695 people in Missouri, Illinois and Indiana.

But it is the unseen radioactive contamination that ultimately makes the deadliest mark on the area.

Immediate fatalities from radiation poisoning number about two dozen, but as the contaminated rainfall seeps into the ground soil and water supply, the long-term health of the residents — and their descendants — is jeopardized. So, too, are the cattle and other agricultural products of Texas, which leads the nation in the number of ranches and farms it holds.

Chernobyl and Fukushima are the only events of a similar nature, even though the United States has seen its own recent near misses.

The radioactivity causes large swaths of area to be cordoned off, making it difficult to repair transmission and power lines as well as homes and businesses.

“The hard truth is that many businesses will close and many people will move from the area,” said Todd Macumber, president of international risk services, Hub International.

Chernobyl and Fukushima are the only events of a similar nature, even though the United States has seen its own recent near misses.

In 2011, a tornado knocked out power to the Browns Ferry Nuclear Power Plant near Huntsville, Ala., requiring the shut down of its three reactors. The plant fired up backup diesel generators until power was restored. The storm also disabled the plant’s sirens, which are needed to warn nearby residents in a crisis.

That same year, a tornado barely missed damaging 2.5 million pounds of radioactive waste at the Surrey Power Station in southeastern Virginia, although it touched down in the plant’s electrical switchyard and disabled power to the cooling pumps. The operators needed to activate backup diesel generators to run the two reactors until power was restored.

Twenty-eight years after the radioactive disaster at Chernobyl in 1986, some parts of the Ukraine remain a toxic wasteland. And in Japan, an initial evacuation area of about 2 miles surrounding the Fukushima Daiichi Nuclear Power Plant was soon widened to about 12.5 miles.

About 300 tons of  highly radioactive water has leaked from storage tanks at the Fukushima Daiichi Nuclear Power Station.

About 300 tons of highly radioactive water has leaked from storage tanks at the Fukushima Daiichi Nuclear Power Station.

Now, three years after three of Fukushima’s six reactors melted down, the area is still unlivable and 40 miles away, diagnoses in children of thyroid cancer, which is caused by radiation poisoning, are skyrocketing, according to some reports.

Nearly 16,000 people died in the 2011 earthquake and tsunami that struck Japan, causing the meltdown. About 160,000 people were evacuated, 130,000 buildings were destroyed and $210 billion in damage was sustained.

The Texas scenario has a lot of variables, said Matthew Nielsen, director of Americas product management at RMS, who created the model for our Comanche Peak Nuclear Power Plant black swan scenario.

The likelihood of a tornado, with thunderstorms and hail, causing massive structural damage is about 1 in 200 years, he said. Such an event would result in at least $20 billion in insured losses and uninsured losses of about the same amount.

But a tornado following the exact path as this scenario — striking the power plant and heading into the Dallas/Fort Worth Metroplex — has a much, much smaller chance — about 1 in 10,000 years.

“Given the fact that tornadoes are very rare, it isn’t something that I think people should be screaming and running around frantically about,” Nielsen said. “But it’s certainly something that could happen.”

As for losses due to the radiation? “There’s not a lot of historical data points that we can confidently say that that portion would be x or y billion,” he said.

The Recovery

Any rebuilding will be delayed by the threat posed by radioactive contamination, which may spread over a large area via the thunderstorms and storm water runoff.

From an insurance perspective, all personal and commercial lines of insurance have a nuclear energy hazard exclusion. American Nuclear Insurers (ANI) provides third-party liability insurance for all power reactors in the United States.

“We are responsible for the insurance coverage protecting the operators from claims alleging bodily injury or property damage offsite from [radioactive] materials,” said Michael Cass, vice president and general counsel at ANI, a joint underwriting association with 20 insurance company members.

082014_02_cs_tornado_nuclear350pxNEWThe ANI was created under the Price-Anderson Act of 1957 and provides a primary policy limit of $375 million for claims due to offsite consequences from the release of radioactive materials from the 100 operating nuclear power plants in the United States. It also covers some plants that are shut down or in the process of being decommissioned, he said.

The ANI also covers costs related to emergency response and evacuation, including food, clothing and shelter, he said.

The joint underwriting association also administers an additional excess layer of about $13.2 billion, the costs of which would be borne by the power plant operators, and would be apportioned equally among them.

For any claims above $13.6 billion (which includes both the primary and excess layers), the Price-Anderson Act requires the U.S. Congress to “take steps to come up with a scheme to provide full compensation to the public and to continue claims payments,” Cass said.

“They could assess or tax the energy industry in some fashion or form. It doesn’t say that specifically, but that is what is alluded to.”

None of the insurance companies that are ANI members would be adversely affected if such a black swan event were to occur, he said.

Advertisement




“There would be a loss reserve recorded on their balance sheets, per participation in our pool, but we do have funds set aside for these catastrophic events where we wouldn’t be requiring any additional funds,” Cass said.

Damage to the power plant itself would be covered by Nuclear Electric Insurance Ltd., which insures electric utilities and energy companies in the United States. Current limits are $1.5 billion per site on the primary program, and up to $1.5 billion per site in its excess program.

Allan Koenig, vice president, corporate communications at Energy Future Holdings, which operates Comanche Peak, said the plant is robustly protected. It has two independent systems that can provide off-site power as well as backup diesel generators, to allow the units to be safety shut down in the event of natural catastrophes.

He also noted the plant has safety shields for fuel storage casks, a 45-inch-thick steel-reinforced concrete containment building wall, and fire protection redundancies.

As for the affected businesses and homeowners, they may be left in a swirling vortex of coverage confusion. The situation would have the flavor of what happened after Superstorm Sandy, when coverage often depended on whether damage was caused by flooding or wind surge.

The question for Texas insureds would be whether the damage was caused by the tornado or by the radioactivity.

“It’s an incredibly complex question and a complex issue that is really only solvable and resolvable if and when the incident occurs,” said John Butler, vice president of the environmental practice at Hub International.

“What it boils down to is the chicken and the egg scenario,” he said. “What came first? Either event has the ability on its own to create a total loss.”

Resilience and redundancy should be the key takeaways from this, said Peter Boynton, founding co-director of the Kostas Research Institute for Homeland Security at Northeastern University in suburban Boston.

“If we can retain a percentage of the critical function of whatever system we are talking about, the difference between 0 percent and 30 percent when the bad thing happens is huge.” — Peter Boynton, founding co-director of the Kostas Research Institute for Homeland Security, Northeastern University

Instead of viewing catastrophic events from an emergency management perspective, where the discussion revolves around what was — or was not — managed well, it’s better to look at the way design can lead to “continuity of function,” he said.

When Boynton was head of emergency management for the state of Connecticut, he managed the statewide response in 2011 to Hurricane Irene, which knocked out 70 percent of the state’s electric grid, leaving residents unable to access many gas stations, ATMs and grocery stores.

If the state had designed a “resiliency approach” prior to the event, it could have built in a pre-determined amount of redundancy into the system so that, say, an additional 20 percent or 30 percent of the grid remained viable.

Advertisement




“If we can retain a percentage of the critical function of whatever system we are talking about, the difference between 0 percent and 30 percent when the bad thing happens is huge,” Boynton said.

In the Texas scenario, if the crisis planning included a redundancy for warning nearby residents even when the power and communication lines failed — such as by using satellites to create a minimal level of continuity — the amount of death and destruction could have been lessened.

“Otherwise, we really are setting ourselves up for an impossible discussion,” he said. “You can’t just pick up these pieces at the moment of crisis. You have to understand how system design can play a role.”

Analyzing such a black swan scenario is a useful exercise, said Justin VanOpdorp, manager, quantitative analysis, at Lockton.

“Can this actually happen? Yes. Will it? Maybe not,” he said. “I think what it does is, it helps to think through it just to be prepared for those situations when they do arise.”

R8-14p32-36_02Tornado2.indd

____________________________________________________________________

Additional 2014 black swan stories:

Bigger Than the Big One

When the 8.5 magnitude earthquake hits, sea water will devastate much of Los Angeles and San Francisco, and a million destroyed homes will create a failed mortgage and public sector revenue tsunami.

Sub-Zero Sucker Punch

A double dose of ice storms batter the Eastern seaboard, plunging 50 million people and three million businesses into a polar vortex of darkness and desperation.

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Cyber Resilience

No, Seriously. You Need a Comprehensive Cyber Incident Response Plan Before It’s Too Late.

Awareness of cyber risk is increasing, but some companies may be neglecting to prepare adequate response plans that could save them millions. 
By: | June 1, 2018 • 7 min read

To minimize the financial and reputational damage from a cyber attack, it is absolutely critical that businesses have a cyber incident response plan.

“Sadly, not all yet do,” said David Legassick, head of life sciences, tech and cyber, CNA Hardy.

Advertisement




In the event of a breach, a company must be able to quickly identify and contain the problem, assess the level of impact, communicate internally and externally, recover where possible any lost data or functionality needed to resume business operations and act quickly to manage potential reputational risk.

This can only be achieved with help from the right external experts and the design and practice of a well-honed internal response.

The first step a company must take, said Legassick, is to understand its cyber exposures through asset identification, classification, risk assessment and protection measures, both technological and human.

According to Raf Sanchez, international breach response manager, Beazley, cyber-response plans should be flexible and applicable to a wide range of incidents, “not just a list of consecutive steps.”

They also should bring together key stakeholders and specify end goals.

Jason J. Hogg, CEO, Aon Cyber Solutions

With bad actors becoming increasingly sophisticated and often acting in groups, attack vectors can hit companies from multiple angles simultaneously, meaning a holistic approach is essential, agreed Jason J. Hogg, CEO, Aon Cyber Solutions.

“Collaboration is key — you have to take silos down and work in a cross-functional manner.”

This means assembling a response team including individuals from IT, legal, operations, risk management, HR, finance and the board — each of whom must be well drilled in their responsibilities in the event of a breach.

“You can’t pick your players on the day of the game,” said Hogg. “Response times are critical, so speed and timing are of the essence. You should also have a very clear communication plan to keep the CEO and board of directors informed of recommended courses of action and timing expectations.”

People on the incident response team must have sufficient technical skills and access to critical third parties to be able to make decisions and move to contain incidents fast. Knowledge of the company’s data and network topology is also key, said Legassick.

“Perhaps most important of all,” he added, “is to capture in detail how, when, where and why an incident occurred so there is a feedback loop that ensures each threat makes the cyber defense stronger.”

Cyber insurance can play a key role by providing a range of experts such as forensic analysts to help manage a cyber breach quickly and effectively (as well as PR and legal help). However, the learning process should begin before a breach occurs.

Practice Makes Perfect

“Any incident response plan is only as strong as the practice that goes into it,” explained Mike Peters, vice president, IT, RIMS — who also conducts stress testing through his firm Sentinel Cyber Defense Advisors.

Advertisement




Unless companies have an ethical hacker or certified information security officer on board who can conduct sophisticated simulated attacks, Peters recommended they hire third-party experts to test their networks for weaknesses, remediate these issues and retest again for vulnerabilities that haven’t been patched or have newly appeared.

“You need to plan for every type of threat that’s out there,” he added.

Hogg agreed that bringing third parties in to conduct tests brings “fresh thinking, best practice and cross-pollination of learnings from testing plans across a multitude of industries and enterprises.”

“Collaboration is key — you have to take silos down and work in a cross-functional manner.” — Jason J. Hogg, CEO, Aon Cyber Solutions

Legassick added that companies should test their plans at least annually, updating procedures whenever there is a significant change in business activity, technology or location.

“As companies expand, cyber security is not always front of mind, but new operations and territories all expose a company to new risks.”

For smaller companies that might not have the resources or the expertise to develop an internal cyber response plan from whole cloth, some carriers offer their own cyber risk resources online.

Evan Fenaroli, an underwriting product manager with the Philadelphia Insurance Companies (PHLY), said his company hosts an eRiskHub, which gives PHLY clients a place to start looking for cyber event response answers.

That includes access to a pool of attorneys who can guide company executives in creating a plan.

“It’s something at the highest level that needs to be a priority,” Fenaroli said. For those just getting started, Fenaroli provided a checklist for consideration:

  • Purchase cyber insurance, read the policy and understand its notice requirements.
  • Work with an attorney to develop a cyber event response plan that you can customize to your business.
  • Identify stakeholders within the company who will own the plan and its execution.
  • Find outside forensics experts that the company can call in an emergency.
  • Identify a public relations expert who can be called in the case of an event that could be leaked to the press or otherwise become newsworthy.

“When all of these things fall into place, the outcome is far better in that there isn’t a panic,” said Fenaroli, who, like others, recommends the plan be tested at least annually.

Cyber’s Physical Threat

With the digital and physical worlds converging due to the rise of the Internet of Things, Hogg reminded companies: “You can’t just test in the virtual world — testing physical end-point security is critical too.”

Advertisement




How that testing is communicated to underwriters should also be a key focus, said Rich DePiero, head of cyber, North America, Swiss Re Corporate Solutions.

Don’t just report on what went well; it’s far more believable for an underwriter to hear what didn’t go well, he said.

“If I hear a client say it is perfect and then I look at some of the results of the responses to breaches last year, there is a disconnect. Help us understand what you learned and what you worked out. You want things to fail during these incident response tests, because that is how we learn,” he explained.

“Bringing in these outside firms, detailing what they learned and defining roles and responsibilities in the event of an incident is really the best practice, and we are seeing more and more companies do that.”

Support from the Board

Good cyber protection is built around a combination of process, technology, learning and people. While not every cyber incident needs to be reported to the boardroom, senior management has a key role in creating a culture of planning and risk awareness.

David Legassick, head of life sciences, tech and cyber, CNA Hardy

“Cyber is a boardroom risk. If it is not taken seriously at boardroom level, you are more than likely to suffer a network breach,” Legassick said.

However, getting board buy-in or buy-in from the C-suite is not always easy.

“C-suite executives often put off testing crisis plans as they get in the way of the day job. The irony here is obvious given how disruptive an incident can be,” said Sanchez.

“The C-suite must demonstrate its support for incident response planning and that it expects staff at all levels of the organization to play their part in recovering from serious incidents.”

“What these people need from the board is support,” said Jill Salmon, New York-based vice president, head of cyber/tech/MPL, Berkshire Hathaway Specialty Insurance.

“I don’t know that the information security folks are looking for direction from the board as much as they are looking for support from a resources standpoint and a visibility standpoint.

“They’ve got to be aware of what they need and they need to have the money to be able to build it up to that level,” she said.

Without that support, according to Legassick, failure to empower and encourage the IT team to manage cyber threats holistically through integration with the rest of the organization, particularly risk managers, becomes a common mistake.

He also warned that “blame culture” can prevent staff from escalating problems to management in a timely manner.

Collaboration and Communication

Given that cyber incident response truly is a team effort, it is therefore essential that a culture of collaboration, preparation and practice is embedded from the top down.

Advertisement




One of the biggest tripping points for companies — and an area that has done the most damage from a reputational perspective — is in how quickly and effectively the company communicates to the public in the aftermath of a cyber event.

Salmon said of all the cyber incident response plans she has seen, the companies that have impressed her most are those that have written mock press releases and rehearsed how they are going to respond to the media in the aftermath of an event.

“We have seen so many companies trip up in that regard,” she said. “There have been examples of companies taking too long and then not explaining why it took them so long. It’s like any other crisis — the way that you are communicating it to the public is really important.” &

Antony Ireland is a London-based financial journalist. He can be reached at [email protected] Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]