Wednesday, November 28, 2007

CSAT Registration Review – The Players

With the large number of facilities (40,000+ by DHS estimates) that will now be required to complete the Top Screen, it seems like a good time to review the hardest part of the Chemical Security Assessment Tool (CSAT) to understand, the registration process. CSAT is the online tool that DHS will use to accept, review and evaluate all information pertaining to the security situation at a chemical facility. The registration process is the way that DHS gets the facility entered into CSAT, determines who at the facility is authorized access to CSAT, and allows DHS to provide secure access to those personnel.

 

 Actually the registration process is easy to understand once one gets past the roles of the four different players involved in the registration process; the Preparer, the Submitter, the Authorizer, and the Reviewer. Good, legal definitions of these four roles, along with instructions for completing the registration process, can be downloaded from the DHS web site. That lengthy .PDF document is the CSAT User Registration User Guide.  What follows is the stadium program version of the data on these important players in the CSAT game.

 

Authorizer:

 

The Authorizer is the person in the organization that has responsibility for facility security; either a corporate officer or a person appointed by a corporate officer. While the Authorizer does not directly enter or edit information in the online CSAT, he is responsible for signing the final documents certifying the identity of the Preparer and Submitter. The Authorizer must be domiciled in the United States. The Authorizer may full fill that role for multiple facilities in the organization, or there may be a separate Authorizer for each facility.

 

Submitter:

 

Again the Submitter must be a corporate officer or appointed by a corporate officer to fulfill these duties and must be domiciled in the United States. The Submitter may also be the Authorizer. The Submitter is the person that actually submits the information in the CSAT system. As such the Submitter will be provided with a Username and a Password by DHS after the registration process is complete. A single Submitter may be designated for multiple facilities within a corporation.

 

Preparer:

 

The Preparer is not required to be an officer of the corporation or formally appointed by an officer, though the Preparer must still be domiciled in the United States. The Preparer may also be the Submitter or Authorizer. The Preparer is the person that actually enters data into the CSAT, but is not authorized to officially transmit data to DHS. The Preparer will be issued a Username and Password by DHS. While the Preparer may serve that role for multiple facilities, the requirements for data preparation require intimate knowledge of the facility so the Preparer will most often represent a single facility.

 

Reviewer:

 

A Reviewer is a person that is authorized to look at a facilities’ data in CSAT but is not authorized to enter or change that data. There may be multiple Reviewers designated for a single facility and a Reviewer may be designated for multiple facilities. The Reviewer provides an additional set of eyes to make sure that submitted data is correct and allows for personnel at a facility to go back and look at CSAT data after it has been submitted.

 

Designating the Players:

 

What must be kept in mind when selecting the people to fulfill these roles in the CSAT process is that these are the people that will be dealing with the Top Screen Submission. For those facilities that end up being designated High-Risk Facilities, these people will also be submitting Security Vulnerability Assessments (SVA) and Site Security Plans (SSP) within CSAT. Careful thought should go into selecting and designating these roles.

 

Smaller organizations with only a single facility that will be required to submit a Top Screen will have an easier time making these selections. An Environmental Health and Safety Manager will probably fulfill the role of Authorizer; adding Security to the regulatory requirements covered by that individual. The facility manager will probably have the role of Submitter. Depending on the size of the facility that manager may also be the Preparer or that role may be delegated to another manager within the facility. There may be no Reviewers designated or that role may be given to a security consultant hired to help the facility complete the CSAT process.

 

For larger organizations with multiple facilities the situation may get much more complex. There may be a single Authorizer for the organization or there may be multiple Authorizers, each responsible for one or more facilities within the organization. The same holds true for Submitters and Preparers. There can only be a single Submitter and Authorizer on each registration, but there can be multiple facilities with a different Preparer for each facility or the same Preparer for two or more of the facilities all on one registration.

 

Each time a registration is completed the Submitter and Preparer(s) will receive a User Name and Password. To ease the problem of remembering multiple Usernames and Passwords there should be a single registration covering all of the facilities that a Submitter will be responsible for. These facilities will also have to have a single Authorizer. Since an Authorizer does not receive a User Name and Password, there is no reason that a single Authorizer cannot be on multiple registrations.

 

DHS has made provisions to change personnel within the CSAT system. The procedures are relatively simple and they have provided another large .PDF document, CSAT User Change Request Guide, to explain how to make these personnel changes, but that is the topic for another blog.

 

While the selection of Authorizers, Submitters, Preparers and Reviewers is an important part of the CSAT process, facilities should not take too much time in making these selections. Since the registration process requires physically mailing off a signed copy of printouts from the on-line registration process, and DHS will not provide the Usernames and Passwords until that mailed document is received, facilities need to complete the online portion of the registration process in an expedited manner. Facilities that have to submit a Top Screen due to possession of more than the Screening Threshold Quantity of a chemical(s) listed in Appendix A, 6 CFR part 27, have until January 18th, 2008 to complete that Top Screen. Not completing the Top Screen by that date due failure to get the Username and Password back in time due to late mailing of the signed registration documents (and remember that Christmas slows the mail) may result in a fine of up to $25,000 per facility.

 

Completing the registration process for CSAT is an important first step in complying with the Chemical Facility Anti-terrorism Standards (CFATS) outlined in 6 CFR part 27. While the registration has little to do with actual security situation at a chemical facility, it is the first step in the formal security assessment required by these new regulations.

Saturday, November 24, 2007

DHS reports CSAT Data Collection Requirements

Yesterday DHS had a Data Collection Report for the CSAT published in the Federal Register. This is required any time that a federal agency requires the public (or businesses in this case) to provide data to that agency. The report lists who is required to provide information, the expected number of respondents and how much time will be required to provide the information. This report is required under the Paperwork Reduction Act (PRA) of 1995.

 

The table below summarized the data provided in the notice. It appears as if DHS is using a value of $87.81 per hour for determining their cost. I would assume that this value is dictated by the PRA.

 

 

Registration

Top Screen

CVI Training

SVA

SSP

# Respondents

16,667

16,667

16,667

2,500

2,167

Hrs/Response

1

30

0.5

153

84

Total Hours

17 K

500 K

8 K

386 K

182 K

Total Cost

$1.5 M

$44.4 M

$0.7 M

$34.8 M

$14.6 M

 

The “Number of Respondents” data does not track with other information provided by DHS. On November 5th, Robert Stephan, DHS Assistant Secretary for Infrastructure Protection, told a news conference that the current estimate of the number of facilities that will be completing the Top Screen is “less than 50,000” and that about “5 to 8,000 facilities” will be classified as High-Risk Facilities that have to complete SVA’s. The Final Rule for Appendix A gives a figure of about 40,000 for the number of facilities expected to be required to submit a Top Screen based on the requirements of that Rule.

 

The difference between the SVA and SSP number is probably due to the fact that facilities that are put into the lowest High-Risk classification (Tier 4) may submit an alternative SSP outside of the CSAT system if they so choose. Given the discrepancy previously noted in the numbers for the Top Screen and SVA, this number also appears to be understated by a significant factor.

 

The assumption that only one person from each affected facility will be completing the CVI training is, in my mind, too low. Because most facilities will have little or no experience handling “classified” information, I would expect that at least two or three people from each facility would need to go through this training program to ensure that an adequate number of people understand the requirements for handling, storing, transmitting, and destroying this information.

 

The time allotted for completing the Registration and CVI training match well with my experience completing these requirements. I think that the estimate for completing the Top Screen is too high, unless DHS is including the data collection organization time. If that is true (and it would seem reasonable in keeping with the purpose of this report), then the time estimates for the Security Vulnerability Assessment (SVA) are an order of magnitude too low if you count total man hours involved in the SVA. Based on my experience with conducting Process Hazard Analysis (a similar type review for process safety) there will be at least four or five people per facility doing about 40 hours of work per chemical/process involved in the review. I would expect that a Site Security Plan would take at least as much time to complete as would the SVA.

 

Anyone wishing to make official comments on this report should send the comments to:

 

Office of Infrastructure Protection 
Attn: Matthew Bettridge 
Department of Homeland Security 
NPPD/OIP/CSCD Mail Stop 8100, DHS, 
Washington, DC 20528

Wednesday, November 21, 2007

Chemical Security makes the DHS Leadership Blog

Secretary Robert B. Stephan, the man at DHS with responsibility for CFATS {Assistant Secretary for Infrastructure Protection}, penned the November 21st blog on the DHS Leadership Journal. While there is nothing materially new in this blog, Stephan does point out that this entry is; “one of many ways that DHS is reaching out to remind facility owners and operators of their responsibility to comply with the regulation and complete the Top-Screen."

 

DHS is going to have to be very proactive in getting information out to the 40,000+ chemical facilities that it estimates will be required to complete Top Screen entries into the CSAT before 1-22-08. Based on my experience there will be few people in the industry that will actually read 6 CFR part 27, much less the preambles to the two Final Rules that brought the regulation and Appendix A into being. Most facilities will not understand the requirements of the regulation until an inspector comes around to explain it to them.

 

The initial education effort will have to be two fold; letting the affected facilities know that there are actions they have to take, and then teach them how to complete those actions. The DHS web site actually has the second part covered pretty well; there are some pretty well written instructions about how to provide information into the CSAT.

 

The hardest part of completing the Top Screen will not be filling out that online document itself (DHS has done a pretty good job making that procedure relatively painless, much easier than IRS tax documents), but rather more people will have problems with the registration process to get into the Top Screen. The problem there is the complexity of the authorizer, preparer, submitter relationship that will confuse people. That plus the factthat the mail back of user names and passwords must be completed before the Top Screen can be started; I expect a large number of registrations to be submitted after January 1st.

 

In either case, if DHS can convince industry groups to communicate to their members the basic rules of who will have to file Top Screens, the word should get out to the affected facilities. Then if the facilities can be convinced to go to DHS web site and down load the PDF worksheets and instructions explaining how to complete the CSAT Registration and Top Screen, the process should go fairly smoothly.

 

It will be interesting to see next year how DHS goes about tracking down the facilities that do not complete the process. The easy ones to find will be those facilities that have filed EPA risk management plans; most of the toxic release and flammable release chemicals in Appendix A came from the RMP list. Not every facility that was required to file RMP documents will have to file a Top Screen, but a very large number of them will. There are probably other government lists that cover most of the chemicals on the COI, but tracking them all down will take a lot of foot work and most of the DHS chemical security people will be looking at SVA’s and SSP’s for the next year or so, not tracking down people who have not filed.

 

The other thing that normally helps the government enforcement efforts in programs like these, peer informers and whistle-blowers, will not function well in this effort. Because of legitimate requirements of Chemical Vulnerability Information (CVI) rules, outsiders will not be able to tell if any particular facility has completed a Top Screen or not. Even most people working in the facility will not know for sure if a Top Screen had been completed because of CVI rules.

 

We will have to wait and see how well DHS does on picking up those facilities that “forget” and “didn’t know” about the requirements of these regulations. That will have to wait for a while though; DHS will have its hands full getting 40,000+ facilities through registrationand Top Screen Submission.

DHS publishes new Top Screen Questions

Since the Federal Register officially published the final version of Appendix A to 6 CFR part 27, it is expected that about 40,000 chemical facilities will have to complete the Top Screen portion of the on line Chemical Security Assessment Tool (CSAT) within the next 60 days. DHS has put the revised Top Screen on line and published a PDF version of the Top Screen that facilities can use as a worksheet to make completing the online version easier. The revised instruction manual is not yet on-line.

 

Other than revising the Chemical of Interest List (COI) and Screening Threshold Quantities (STQ) to reflect the data in the final version of Appendix A, the Top Screen is essentially the same. The only other significant difference is that DHS added the following statement at the start of the process:

 

Submission Statement:

My statements in this submission are true, complete, and correct to the best of my knowledge and belief and are made in good faith. I understand that a knowing and willful false statement on this form can be punished by fine or imprisonment or both. (See section 1001 of title 18, United States Code).

 

One interesting observation; While the revisions to 6 CFR part 27 that go along with the final version of Appendix A {Section 27.203(b)(3)} state that; “In calculating whether a facility possesses an amount that meets the STQ for propane, a facility need not include propane in tanks of 10,000 pounds or less.”, there is nothing in the Top Screen Questions that reflects this. Unless the Top Screen Preparer/Submitter is aware of this exemption ahead of time, there is a possibility that the facility will unintentionally over-report the amount of propane on hand. This will probably be addressed in the instruction manual for the Top Screen when that is published.

Tuesday, November 20, 2007

Appendix A published in Federal Register

The revised Appendix A to 6 CFR part 27 was published today in the Federal Register. That now makes Appendix A official and starts the clock for about 40,000 chemical facilities to file their Top Screen within the next 60 days. While there should not be any differences between the version published on the DHS web site earlier this month and the version published today, today’s version is the legal version of Appendix A and the various changes to 6 CFR part 27.

 

In support of the official publication DHS has made changes to the following pages on their web site:

 

Critical Infrastructure: Chemical Security

 

Identifying Facilities Covered by the Chemical Security Regulation

 

How Appendix A: Chemicals of Interest Was Developed 

 

None of the changes on these web pages is unexpected. Mainly they removed the note on the previous copy that said that Appendix A would not become effective until it was published in the Federal Register. The new page says that Appendix A was published in the Federal Register on November 20th and that the 60 day clock for submission of Top Screens started on that (this) date.

 

Perimeter Security: Personnel Access Control

Once the perimeter of the high-risk chemical facility is secured people have to be let in and out of the facility so that work can actually get done, products produced and shipped to the customer. Allowing the appropriate people to enter and leave the facility while keeping potential terrorists and other associated evil doers outside of the facility is called access control. This blog deals with personnel access control only, not vehicle or package control; those are extensive topics in their own right.

 

For the purposes of access control to the facility there are three classes of personnel, those with unaccompanied access, those with accompanied access and those that are not authorized access. In all secured facilities the first class is limited in size and the last class is very large. The relative size of the middle class will vary with the level of risk associated with the facility (Tiers 1 thru 4 for purposes of CFATS) and the day to day security situation.

 

People that have unaccompanied access (UAA) to the facility are those employees and contractors that have been adequately screened and checked to ensure that they have no known association with known terrorist groups and that their jobs require general access to the facility. There may be areas of the facility where they are not authorized unaccompanied access, but those areas are limited and well defined (more discussion in a future blog). The level of security screening will vary according to the level of risk associated with the facility, but at a minimum {Section 27.230(12)} all personnel authorized unaccompanied access to a high-risk chemical facility will have their names submitted to DHS for check against terrorist watch lists. Management will have to decide (and document) what level of criminal background check is necessary for such employees and having that background check conducted.

 

The next largest group of people that will be allowed entry to the chemical facility are those that are authorized only accompanied access (AA) to the facility. These will be the delivery personnel, vendors, limited duty contractors, officialvisitors, and the unofficial visitors to employees that periodically enter and exit the facility. In the highest risk facilities these people will be physically accompanied by someone with UAA from the time they enter the facility to the time they leave the facility. At lower risk facilities there may be designated areas within the perimeter fence (offices, break rooms, parking lots, etc) where the accompaniment rule may be relaxed somewhat. At those facilities where the volume of AA personnel would be so high as to be disruptive, management may want to set up the security perimeter to exclude areas like the parking lot, break areas and offices.

 

Even those people given AA to the facility have to undergo some sort of screening to ensure that they are not a specific threat to the facility. This does not normally rise to the level of conducting a background check or having DHS conduct a terrorist watch list check, but the basic identity of everyone entering the facility must be checked. At higher risk facilities, or when the general threat level is elevated, verifying that identity with their parent organization should be required. In all cases someone at the chemical facility must be able to verify that the person is expected and should be allowed even AA.

 

Anyone that does not fit within the first two groups falls within the last group, those not authorized access to the facility. Since this class includes most people in the world, it does not mean that the person denied access to the facility is, or even is suspected of being, a specific threat to the facility. Special care must be taken when dealing with this class of people that one does not convey the impression that because they are denied access that there is something wrong with them. Remember, they may be customers.

 

Provisions have to be made to identify each person entering the facility and identify which of the three classes to which they belong. In most cases this means that a guard will be responsible for checking identification and assigning people to the appropriate class. Clear instructions andadequate training must be given to the guard force to allow them to make these decisions on a daily basis with a very low error rate.

 

Given the limited employee base of most chemical facilities and if there is enough continuity in the guard force, most guards will soon be able to personally identify each person at the facility that is authorized UAA. Until such time as that happens, and to allow for the addition of new UAA personnel or guards, the guard force needs to have a way to positively identify UAA personnel. Clearly marked photo identification badges are the most common method for doing this, but giving the guard a facility UAA roster (preferably with photos) can also be used. The use of biometric identification of personnel for routine entry into the facility by UAA personnel is seldom necessary.

 

The most efficient way of dealing with the daily routine AA personnel is to provide the guard with a daily list of personnel that are expected to request entry to the facility that day. That list would include name, parent organization and the person to contact for providing an escort. For those personnel requesting entry to the facility that are not on that list the guard would be responsible for getting the identification information and then contacting someone on the UAA list to authorize AA for that visitor. At the higher risk facilities only a limited number of personnel (normally the facility security officer or someone in the security office) would be allowed to give that authorization.

 

Everyone that requests and is denied access needs to be documented. This should be done for a number of reasons. First it is done to protect the guard force from complaints. If they document everyone that requests entry and on what authority they were denied entry, there can be little question about the guards exceeding their authority. Furthermore, the possibility exists that those personnel being denied access are probing the facility security and Section 27.230(16) requires facilities to maintain records of potential security incidents or suspicious activities.

 

Personnel access control is an integral part of any Site Security Plan. Defining who is authorized access to the high-risk chemical facility and under what conditions is an important part of denying access to those people who might be interested in attacking the facility.

Monday, November 19, 2007

Restricted areas at chemical facilities: The outer perimeter

As more and more chemical facilities start to progress through the CFATS process, more facilities are going to start looking at establishing restricted areas as part of their site security plans. Restricted areas can form the basis for the layered defense that DHS envisioned in their preamble to the final rule for 6 CFR part 27; a layered defense that is supposed to deter, detect and delay any terrorist attack long enough for an appropriate response to be made.

 

Every facility covered under CFATS will have at least one restricted area, the facility itself. The first Risk Base Performance Standard that all Site Security Plans must address is securing the facility perimeter {Section 27.230(1)}. Typically this will entail establishing a perimeter barrier of some sort with entrance and egress controlled through a restricted number of openings in that barrier. These are the two main keys to any restricted area; a perimeter barrier and access control.

 

At most chemical facilities in the United States, the perimeter barrier is a 6 foot chain link fence with barbwire strung on 18 inch outriggers along the top. It is relatively inexpensive to erect and maintain. It is also very easy to penetrate. No one with any significant military or paramilitary training will be delayed by such a barrier by more than a minute or two. Surreptitious entry may take a few minutes more.

 

Penetration of this type barrier is made easier by two common mistakes; failure to establish and maintain clear zones on either side of the fence and failure to monitor the fence. Brush and debris along the outside of the fence allows the intruder to approach the barrier without being observed and makes it easier to cut or climb the fence. The same type obstructions on the inside of the fence make it easier to disappear into the facility without being detected. Failure to maintain observation of the perimeter fence will allow the most incompetent intruder access without detection.

 

Most facilities construct their perimeter fence right inside of their property line. This may make it impossible to prepare and maintain a cleared control zone outside of the fence. The easiest way to deal with this is to construct a second fence within the property line fencing, allowing the facility easier control of the cleared zones. The property line fence can be used as all, or part of, the restricted area security fence when outside cleared zones can be maintained.

 

There is no requirement that the security fence be at or even near the property line. If there is a significant amount of unused land around the facility it may make economic and security sense to establish the security fence well inside of the property line to reduce the amount of fencing required.

 

To deter and detect the breaching of the security fence, the fence must be maintained under constant observation. In the old days that would have meant guard towers/houses around the fence or constant foot patrols by guards. Today, fortunately, there are a wide variety of electronic systems that perform the detection duty at least as well as an extensive security force. The system used at any facility will have to be tailored to the local conditions by a trained security expert but should include at a minimum some sort of closed circuit television system (CCTVS) for observation and an intrusion detection system (IDS) to alert the security personnel to watch a particular section of the barrier.

 

Any good IDS system will give a number of false positive alarms or it isn’t sensitive enough to detect the well trained intruder. This is the main reason for the use of a CCTVS; it allows a relatively small guard force to check out each of the IDS alarms quickly and securely. Ideally the IDS would detect a possible intruder outside of the fence, allowing the security personnel to alert responders before the penetration is made.

 

Yes, responders; a response of some sort will have to be made to any breach ofthe security fence. This is another reason that a good CCTVS is required; identification of the security threat presented by the intruders is going to have to be made to craft an appropriate response. The facility would respond one way to a couple of kids coming over the fence for some sort of prank and in a completely different way for a team of armed intruders. A good visual identification is key to responding appropriately.

 

Few but the largest, highest risk chemical facilities will be able to afford or to justify having an armed response force on-site. Since sending out anything but armed responders to deal with armed intruders is ludicrous, alternative responses will have to be crafted. While almost all responses will include notifying local police and emergency responders other actions that might be considered include (but are certainly not limited to):

 

1.      Shutdown of key processes and evacuation of personnel.

2.      Lockdown of key portions of the facility.

3.      Initiation of emergency response procedures for chemical storage facilities.

4.      Moving chemical processes into inherently safe modes.

5.      Initiating automated fire fighting and or response equipment.

6.      Emergency notification of surrounding facilities or the community.

 

None of these actions are to be taken lightly since they may include significant economic and political ramifications. They must be thought out and planned for well in advance. Clearly spelled out in a Security Response SOP, the security force and facility personnel must be trained and drilled in their implementation and appropriate advanced coordination must be made with outside agencies.

 

How elaborate these perimeter security measures are for any given facility will be dictated by the potential threat. A Tier 1 chemical facility will certainly require a much more elaborate response to a security breach than a Tier 4 facility. The basics will, however, remain the same; the establishment of a security barrier under constant observation and a planned/rehearsed response to the breach of that barrier consistent with the threats identified in the Security Vulnerability Assessment.

Friday, November 16, 2007

New Appendix A changes CVI Training?

There has been another recent change to the DHS web site that is hard to see. A couple of the pages dealing with Chemical Vulnerability Information (CVI) have changed with a new modified date of 11-15-07. Comparing the new page with the old page, there does not appear to be any difference between the two. That is no difference until you click on the link to CVI Training. Click on any of those links and you get taken to a page that says:

 

Chemical-Terrorism Vulnerability Information (CVI)

The CVI training site is currently off-line and will be available when Appendix A is published in the Federal Register. For additional information regarding Appendix A, Chemical Facility Anti-Terrorism Standards, 6 CFR Part 27, please visit:   www.dhs.gov/chemicalsecurity.

 

Now I have completed the CVI training (within a couple of days of it becoming available) and I do not recall anything of substance in that training that would have had to have been changed because of the changes in Appendix A. We will not know for sure until the CVI Training site is back-up for operation.

 

The interesting question is, if there are substantive changes in the training, will everyone that has completed the training to date have to re-take the training? Since DHS has email addresses, and snail mail addresses for that matter, for all of us that have completed the training (and I would assume that thousands have) it would be a simple matter for them to contact us about the new requirement.

 

As I mentioned in yesterday’s blog on this site, DHS still has some way to go about how they notify people about changes to their site. Again this is not a page (or actually pages) that is covered by their change notification system (or at least I have not been notified of this change by their system). Nor does their system explain what the change is or explain the reason for the change. All it does is notify you what page has changed.  

 

Any way, this information junkie will keep an eye on the DHS site and let you know what is going on. I may not know, or be able to guess, why something is changed, but I will tell you what has changed. Of course, I’ll also give you my opinion of the efficacy and/or effect of the change.

Thursday, November 15, 2007

DHS provides notification of Web Site Changes

I started to write about a change that DHS made to their web sites on October 31st, but skipped it for the more important news about the issuing of the final version of Appendix A to 6 CFR part 27. Now that I have covered the high points about that document in multiple blogs, I have time to go back and review this change to the DHS website.

 

At the top of many of the web pages is a shortcut to a new set of web pages. The short cut is shown below. Clicking on the link provided will take you to a series of pages where you can sign up for email notification when that page changes.

 

Get e-mail updates when this information changes

 

I applaud DHS for taking this action. Readers of this blog are well familiar with my complaints about important changes being made to the DHS web site without an effort being made to let the public know about the changes. While many of the changes have been of a more cosmetic nature, there have been changes that have provided important information about changes in the CFATS program and implementation that have been posted to the DHS web site. Until this recent change only those of us who have made nearly daily trips to the site would be aware of the new information on a timely basis.

 

Unfortunately, this change notification does not cover every page of the web site; it only covers the main entry pages. For example, I signed up on the evening of October 31st when this first became available, but I did not receive notification of the changes to the pages that resulted from the publication of Appendix A. I have received notification from the system for some other pages that I monitor and had signed up for the change notification.

 

Changes like the pre-publication of Appendix A (which has still not been published in the Federal Register) are important news to anyone that is responsible for security at chemical facilities. To get prompt spread of this type information, DHS should include these type changes in their notification system. This will help DHS get accurate information out to the affected community without having to rely on the distortions found in most of the press articles.

 

In any case, this is a good first step that DHS should be commended upon. I urge anyone that is interested in the CFATS regulations to sign up today for the web site change notification program. The short cut can be found on many pages, but probably the most appropriate one for people interested in chemical security would be the Activities & Programs (10-31-07) page.

Wednesday, November 14, 2007

DHS to conduct a workshop on CCTV, Security and Privacy

Yesterday DHS announced that the DHS Privacy Office will be conducting a public workshop entitled: CCTV: Developing Privacy Best Practices. The two day workshop will be conducted on 17th and 18th of December in Arlington, VA. People wanting detailed information should contact DHS at privacyworkshop@dhs.gov.

 

While DHS is conducting this workshop primarily to look at how the government can best employ closed circuit television systems to protect the public while at the same time protecting privacy, there are issues that will affect any chemical facility that includes CCTV systems in their security plan. One area particularly noted in the DHS notice in the Federal Register was: “What measures are necessary to protect privacy and civil liberties when governments have the ability to link into privately owned CCTV networks or have access to images and footage that such networks have captured?” (page 63919)

 

Some other points that must be considered when setting up a CCTV security system deal with the expectation of privacy. Do employees have to be specifically notified that they will be under periodic surveillance while at work? What expectation of privacy do people other than employees (contractors, vendors, visitors, delivery and pick-up drivers for example) have when on the property? If company CCTV systems can image off-site areas, then what responsibility does the company have to protect the privacy of off-site personnel?

 

Probably only the largest chemical facilities will find actual attendance at this work shop to be worth while, it would behoove any facility that will use CCTV systems (and that should probably include all facilities notified that they have been designated a high risk facility by DHS) to check up on the Privacy Office Workshop Webpage after this work shop is completed. DHS will post a written transcript of the workshop as well as copies of all comments submitted ahead of time.

Tuesday, November 13, 2007

Ammonium Nitrate Rules Tightened

Spencer S. Hsu in his Washington Post article, DHS Relaxes Chemical Plant Storage Rules, parrots the view of many liberal commentators that DHS has reduced the effectiveness of the requirements of the CFATS regulations with the new limits set by the revised Appendix A to 6 CFR part 27. While he barely mentions that political pressure by Democratic Senators was responsible for the whole sale gutting of the propane provisions he implies that changes to the Ammonium Nitrate STQ will enable future attacks like those in Oklahoma City and the first Trade Center attack. This article shows that he has failed to read the preamble to the Final Rule on Appendix A.

 

The proposed Appendix A treated ammonium nitrate as a unitary chemical, an explosive. There are actually two different chemicals generally found in commerce under the generic name of ammonium nitrate. The most common form of ammonium nitrate is that widely used as a fertilizer and then there is the commercial explosive ammonium nitrate. The difference between the two is generally the amount of organic material added to ammonium nitrate to make it an explosive. DHS, recognizing this difference, decided to regulate these two different chemicals in keeping with their respective hazard.

 

Ammonium nitrate explosives are, by far, the more hazardous of the two forms. In keeping with this fact, DHS has set the Release STQ for the explosive at 5,000 pounds, the same as all other explosives. The Release STQ is set to acknowledge that if this amount of ammonium nitrate were detonated at the chemical facility that there is the potential for significant off-site consequences.

 

As with other explosives there is also the threat that a terrorist would steal ammonium nitrate explosives for use off-site. DHS has addressed this with a separate Theft/Diversion STQ of 400 pounds. The material difference between these two STQs is that for material to be counted in the Theft/Diversion STQ it has be packed in shippable containers; containers that a terrorist could reasonably be expected to steal. The 400 pound STQ is substantially less than the 2,000 pound STQ found in the earlier version of this list. Meeting the STQ in either case (or both cases) would trigger the requirement for the facility to complete a Top Screen notification to DHS.

 

Ammonium Nitrate, the fertilizer, is not much of an explosion threat in its commercial form. For this reason, DHS has not set a Release STQ for this type of Ammonium Nitrate; it does not pose a significant on-site explosion risk. It can, however, be converted to an explosive by adding an accelerant such as fuel oil or various solvents. With that in mind DHS did set a Theft/Diversion STQ for the fertilizer form of Ammonium Nitrate (as an explosive precursor) at 2,000 lbs. This STQ is the same as the 2,000 pound STQ found in the original list.

 

DHS has implemented a set of dilution rules that allow for some chemicals to only be counted in their actual amount in a mixture. For example, a 10,000 lb mixture containing isobutene in a concentration of 10% would only count 1,000 lbs of that mixture as isobutene. That rule does not apply to explosives or explosive precursors. The total amount of the mixture, as long as it meets the minimum concentration listed in the table, will be counted when calculating whether or not the amount on hand meets or exceeds the STQ.

 

For the explosive grade of ammonium nitrate the minimum concentration is listed as “ACG” or any commercial grade. In other words, any concentration of ammonium nitrate that is sold commercially as an explosive meets the minimum concentration limit and the entire amount on site is counted towards the Release STQ. That amount packed in shipping containers will be counted towards the Theft/Diversion STQ. The fertilizer grade ammonium nitrate has a listed minimum concentration of33%. Thus any mixture of ammonium nitrate that contains at least 33% ammonium nitrate (not the lower % nitrogen that is commonly listed on the fertilizer label), if packaged in shipping containers, will be counted towards the Theft/Diversion STQ.

 

Mr. Hsu clearly had his facts wrong when he stated that; “DHS also increased the disclosure threshold for ammonium nitrate from 7,500 pounds to 10,000 pounds.” First off, DHS had initially listed the STQ as 2,000 lbs (not 7,500 lbs) and the old Top Screen Manual clearly listed this as a Theft/Diversion issue not an on-site Release issue. The Theft/Diversion STQ was significantly reduced from 2,000 pounds to 400 pounds for the explosive form and a Release STQ for the explosive form has also been set. Set at 5,000 pounds, this STQ would capture all manufacturing and nearly all distribution facilities for this material. The Theft/Diversion STQ for the fertilizer form remains at 2,000 pounds reflecting the fact that terrorists would have additional work to do to convert this material to the explosive form of this chemical. All in all, DHS has significantly tightened the reporting requirements on ammonium nitrate.

 

Friday, November 9, 2007

Laboratories get some breaks in the Chemicals of Interest List

When the proposed Appendix A to 6 CFR part 27 was published last spring two groups were very surprised to see that they could potentially be seen as high-threat terrorist targets. The largest group, the propane industry, quickly staged a write in campaign (4,000 of the 4,300 comments received by DHS came from the propane industry) and started pulling political strings to get that changed. They were very successful. The other people that were caught by surprise were people that operated laboratories at educational institutions, medical facilities and industrial research labs. They were not as organized in their response, but they did get some relief from some of the proposed requirements.

 

The first thing that these labs complained about were the large number of chemicals listed with an “any quantity” Screening Threshold Quantity (STQ). Almost 100 separate chemicals; identified by DHS as being chemical weapons (CW), their precursors (CWP) or inhalation hazard chemicals (WME); had this STQ listed in the proposed Chemicals of Interest (COI) list. While many of these chemicals have no use beyond chemical weapons, a number of them are frequently used in chemical labs.

 

DHS did listen to the complaints about the “any quantity” STQ and set specific STQs for each category of chemicals on the list. The table below shows the STQ for the chemicals that used to have an “any quantity” STQ. “CWC” stands for Chemical Weapons Convention. “PIH” stands for Poisonous by Inhalation. “Cum 100g” means that an aggregate weight of all chemicals in this class greater than 100g will trigger the Top Screen requirement.

 

Type Chemical

STQ

CWC – Schedule 1

Cum 100g

CWC – Schedule 2

2.2 lbs

CWC – Schedule 3

220 lbs

PIH Zone A

15 lbs

PIH Zone B

45 lbs

PIH Zone C

500 lbs

Theft/Diversion STQ for CW/CWP and WME

 

Because of the size of the STQs most labs will not have to consider Schedule 3 CWC chemicals or Zone B or C PIH chemicals when doing their calculations to determine if they exceed the STQ. While the 100-g aggregate limit for Schedule 1 CWC chemicals may seem steep, these are actual chemical weapon chemicals and have few legitimate laboratory uses other than making pesticides, so few labs should be affected by this STQ.

 

DHS also included a laboratory exemption for most release hazard chemicals. This means that most flammable chemicals will not have to be counted by labs. Not that most labs would have been affected anyway; very few labs have use for 10,000 lbs of any given hazardous chemical. This lab exemption does not apply to labs making production batches of chemicals.

 

Another area that labs disagreed with the proposed Appendix A was that it listed acetone as an Improvised Explosive Device Precursor (IEDP) chemical with an STQ of 2000 lbs. Acetone is a very common solvent used in organic chemistry. While few labs would be expected to have 2000 lbs of acetone on hand, many universities (with multiple labs) might receive acetone in quantities that large in a centralized receiving facility.

 

While acetone is a precursor to a very dangerous improvised explosive (Triacetone Peroxide – TAP) DHS decided that it would be impractical to try to regulate the acetone component since it is so widely used. Instead DHS will regulate the hydrogen peroxide (≥35%) portion of the production of that explosive.

 

The one area that college and university labs lost out completely on was a broad exemption from all requirements of the CFATS regulations. DHS was adamant in its opposition to this exemption. On page 65 of the Final Rule for Appendix A DHS made the following comment:

 

“Furthermore, given the apparent current state of security at academic institutions, DHS believes that exclusion of colleges and universities is not warranted. Based on the comments DHS received from colleges and universities, the Department understands that security varies dramatically across academic institutions. Representatives of the academic community acknowledged that they possess chemicals of interest. While some adhere to broad security strategies, others admitted having an incomplete or non-existent inventory of the contents and quantities of chemicals and no affordable or timely means of compiling an inventory.”

 

DHS has said that they will, upon request, grant colleges and universities a 60 day extension of the time necessary to complete an initial Top Screen. When granted, this extension would allow these facilities up to 120 days to complete their initial Top Screen. Additionally, DHS notes that they will give colleges and universities wide latitude in the way they define chemical facilities at their institution. Some schools might want the chemistry and biology departments to be classified as separate facilities, for example.

 

While college and university laboratories did not get the free ride granted to the propane industry, DHS did take notice of their legitimate complaints. The “any amount” STQ has been replaced by more reasonable STQ weights, and acetone was removed from the list. DHS did not give these labs a blanket exemption to avoid the security implications of their chemical inventories. Many educational, medical and research laboratories will find that they will be required to complete the Top Screen portion of the on-line Chemical Security Assessment Tool. Only time will tell how many of these labs will come under the increased security requirements that come along with being declared a high-risk facility by DHS as a result of their Top Screen filings.

Updated Information about CFATS Participation

In an earlier Chemical Facility Security News blog I bemoaned the fact that DHS was not keeping people up to date on how many facilities had completed work on their Top Screens. Well the November 2nd press conference by Under Secretary Stephan did briefly address that issue. According to Secretary Stephan about 90 facilities were directed to complete the Top Screen when the regulation first went into effect. Additionally, another 150 or so facilities have voluntarily completed the Top Screen. On top of this about 10,000 facilities have registered in the Chemical Security Assessment Tool (CSAT) and are ready to begin or have begun the Top Screen Process.

 

When DHS issued the Final Interim Rule on CFATS last spring they estimated that about 40,000 facilities would be required to complete the Top Screen and that 5,000 to 8,000 of those would be designated High Risk Facilities, thus coming under the provisions of CFATS requiring the preparation of Security Vulnerability Assessments (SVA) and Site Security Plans (SSP). Secretary Stephan said that he now expects the total number of facilities required to complete the Top Screen to be about 50,000.

 

This means that there are about 49,000 facilities that need to complete the CSAT registration process. (Detailed instructions about the registration process can be found on the DHS web site.) These are the facilities that have had one or more chemicals found in Appendix A at or above the STQ for either the release quantity or the theft/diversion quantity listed in the appendix. There is no need for these facilities to wait for Appendix A to be published in the Federal Register to begin the registration process.


Tags: , , ,

Tuesday, November 6, 2007

DHS increases the number of flammable chemicals regulated under CFATS

While there are many that have complained about DHS relaxing its Chemical Facility Anti-Terrorism Standards (CFATS) with the publication of the revised Appendix A (including my complaints about the treatment of propane), it seems to have escaped general notice that DHS has potentially expanded the number of chemicals that is has included in the release-flammables category.

 

In the original Appendix A only the specific chemicals listed in the Appendix would be used to determine whether or not a facility had to complete a Top Screen under Section 27.200(b)(2). In my comments to DHS on the proposed Appendix A, I recommended that DHS adopt something similar to the DOT “Not Otherwise Specified” classification to capture those chemicals with a similar hazard to the listed chemicals (see page 82 of the Final Rule). DHS rejected that idea saying that: “…DHS has included chemicals on the COI list if they are uniquely identifiable” (page 83).

 

While it may be true that they only included uniquely identifiable chemicals on the list of chemicals in Appendix A, they also added a mixture rule {§ 27.204(a)(2)} that could  bring a number of less identifiable commercial chemicals under the STQ counts for some of those identified chemicals. According to DHS this mixture rule says that:

 

“…if a release-flammable chemical of interest is present in a mixture in a concentration equal to or greater than one percent (1%) by weight of the mixture, and the mixture has a NFPA flammability hazard rating of 4, the facility shall count the entire weight of the mixture toward the STQ” (page 27).

 

This means that if a company manufactures, uses, or stores a chemical that has an NFPA flammability rating of 4 (gasoline or various solvents for example) and that product contains a chemical listed as a release-flammable chemical (more than 80 chemicals) in Appendix A at more than 1% of the amount of that commercial chemical, then the facility must count the entire amount of that commercial chemical as part of weight of the “uniquely identifiable” chemical found in Appendix A when calculating the STQ. Of course, mixtures that are not rated NFPA-4 will only have the weight of the component listed in Appendix A counted in the STQ calculations.

 

The point is, of course, that these flammable chemicals, if released will form fuel air mixtures that could be easily detonated and cause harm to the facility and surrounding community. This makes these mixtures as much of a potential terrorist weapon as the pure chemicals that go into them.

 

DHS carries this a step further when it comes to fuels. While gasoline is not listed in Appendix A, various components of gasoline and other fossil fuels are listed. In § 27.203(b)(1)(v) the mixture rule for release-flammables is extended to fuels with NFPA ratings lower than 4; all the way down to combustible fuels with an NFPA rating of 1. DHS addresses this on page 4 of the final rule:

 

“….facilities must also include chemicals of interest in fuels when stored in above-ground tank farms (italics mine), including tank farms that are part of pipeline systems. See § 27.203(b)(1)(v). This includes fuels with any one of the four National Fire Protection Association (NFPA) flammability hazard ratings and not just fuels with a NFPA flammability hazard rating of 4.”

 

Fuels, because of their nature and the common understanding of their potentially explosive nature, are a more recognizable target than many of the chemicals listed in Appendix A. Additionally, the large amounts of fuels used means that the tank farms for these materials usually hold very large quantities of these potentially dangerous chemicals. This makes these tank farms an even more attractive potential terrorist target.

 

Fuels may be a problem for facilities that have fuel tanks on site for use in boilers and heating equipment. Most of these facilities are not going to have any idea what components of the fuel might be listed on Appendix A or which of these chemicals might be present in concentrations in excess of 1%. DHS might want to address this issue in further communications to users of distilled fossil fuels.

 

I don’t think that anyone has any idea how many chemicals will be brought into the STQ counts with these new mixture rules. The way that the Top Screen was set-up would not have allowed DHS to determine the difference between mixtures and the pure compounds. The hopefully the soon to be published new Top Screen may require a breakout of the mixtures to allow DHS to see how much this change has affected the number of facilities that are included in the Top Screen requirement.

Monday, November 5, 2007

The politics behind Appendix A propane rules

Today DHS published a poor transcript of a Press Conference held last Friday about the release of the revised Appendix A to 6 CFR part 27. I say that it is a poor transcript because who ever put it together makes Assistant Secretary Robert B. Stephan and Maribeth Kelliher sound like illiterate people who know nothing the Chemical Security Anti-terrorism Standards (6 CFR part 27) or Appendix A. One has to read through serious misspellings and incorrect word choices by the transcriber to try to piece together what was probably said.

 

One thing that Secretary Stephan tried to make clear (I think that was what he said) was that lobbying and politics had little to do with the final product that was released on Friday. This point was also made in the final rule in response to various comments about exempting various classes of facilities (pages 69 thru 71 of the Final Rule published on the DHS Website) from coverage under the regulation. Specifically the rule states:

 

“There are risks with facilities possessing certain amounts of certain chemicals, and the Department is seeking to address these risks under its new authority in Section 550. This extends to all facilities that present high levels of security risk and possess chemicals that may be of interest to terrorists. Moreover, these risks are associated with the characteristics and quantity of the chemical, rather than the business or activity associated with the industry or facility. As such, it would not be appropriate for DHS to exempt, by regulation, entire types of activities or industries.” (pages 70-71)

 

While, in my opinion, DHS has generally done a pretty good job of ignoring political pressure to lessen the impact of the regulations, it has completely caved in with respect to propane. Of course the political pressure was intense. Almost 4,000 of the 4,300 comments received (page 54 of the Final Rule) dealt with propanein an obvious organized writing campaign. In my blog on MySpace in June I wrote about two Senators making public threats to withhold enforcement funding from DHS if they did not exempt propane users from CSAT regulations. I later reported on this blog that DHS felt it necessary to respond with a page on their web site about the pressure to exempt propane from being listed as a dangerous chemical.

 

In the end the political pressure obviously became too great. According to the final rule the criteria for flammable release chemicals are: “chemicals with the potential to create a vapor cloud explosion that would affect populations within and beyond the facility, if intentionally released” (page 8). All other flammable liquids and gasses have an STQ set at 10,000 lbs in keeping with the EPA estimates of the amount required for significant off-site consequences. For propane, DHS set the STQ at 60,000 lbs and exempted any propane in tanks holding less than 10,000 lbs from being included in the calculations to determine STQ.

 

In its comments about setting this politically motivated STQ DHS made the statement that; “Sixty thousand pounds is the estimated maximum amount of propane that non-industrial propane customers, such as restaurants and farmers, (italics mine) typically use.” (page 43). While reasonable people would probably agree that the detonation of a 60,000 lb tank of propane on a remote farm would probably not produce a politically important result; the detonation of the same size tank at a crowded restaurant would certainly make for a politically successful terrorist attack.

 

The purpose of Appendix A is not to determine what constitutes a high risk target. The purpose is to provide a screening tool that will allow DHS to collect data that will allow it to capture most of the chemical facilities that would present a high risk for terrorist attack. On page 19 of the final rule DHS states that: “The STQ is not the threshold for establishing whether a given facility is a high risk facility, but it is a threshold for determining whether the facility must complete and submit a Top-Screen.” The data provided in the Top Screen is the first in a series of tools that DHS utilizes to determine if a facility is a high risk facility.

 

In this case, political pressure has become the screening tool that DHS uses to determine if a facility is at high risk for a chemical based terrorist attack. One can now only hope that this politically motivated STQ is not responsible for providing a terrorist group with an unregulated weapon to use against the American Public.
 
/* Use this with templates/template-twocol.html */