Monday, December 31, 2007

Top Screen User’s Guide: Theft/Diversion COI

There is little new information in the CSAT Top-Screen User Manual about the theft Diversion chemicals of interest that I haven’t covered in my earlier blog (Top Screen Questions: Theft/Diversion Chemicals of Interest). Neither does the User’s Guide clear up any of the questions I raised earlier.

 

Each of the three sections of the Theft/Diversion COI portion of the Top Screen (EXP/IEDP, WME, and CW/CWP) the User’s Guide specifically states (page 41): “…the facility shall only include theft-EXP/IEDP COI in a transportation packaging….” Then the EXP/IEDP and CW/CWP sections require checking off a block in there is material on site in Bulk Storage.

 

Since the User’s Guide defines bulk storage as (page 42) “a package or container from which the COI could be safely transferred into a portable package or container”, it makes some sense to include this block for CW/CWP chemicals since they were not covered in the Release COI potion of the Top Screen. It still doesn’t make any sense for the EXP/IEDP COI section since most of these would have been covered in the Release section for those chemicals. This is especially true since the WME section of the Theft/Diversion COI does not include a Bulk Storage block, and these chemicals were listed under the Release Toxic COI where a bulk storage quantity would have been reported. I suppose that internal consistency is not required.

 

The User’s Guide does not provide any new information on the reason for not reporting the quantity of the Theft/Diversion COI on site. While most of the EXP/IEDP and WME COI did have a quantity reported in the Release portion of the Top Screen, none of the CW/CWP COI chemicals were included in the Release portion of the Top Screen. Furthermore, there is a wide disparity between the STQ in the Release and Theft/Diversion portions of the Top Screen. This disparity ranges between1,000/45 lbs and 10,000/15 lbs.

 

Add to this the fact that there are at least two chemicals (Nitric Acid and Phospine) that have a lower minimum concentration for Theft/Diversion than for release. This means that it would be possible to have more than an STQ amount for Release at a concentration that is reportable for Theft/Diversion but not reportable for Release. Nitric Acid is the worst case. With an 80% minimum concentration for release and a 68% concentration for Theft/Diversion DHS would have no way of knowing how much Theft/Diversion Nitric Acid was on site from Top Screen data.

 

The only thing that one can reasonably assume is that DHS is either going to give all sites with just Theft/Diversion COI a pass on being declared a High-Risk facility or all Theft/Diversion sites will be declared High-Risk sites. Substantial arguments could be made against either procedure. Of course, there is nothing stopping DHS from declaring these facilities not High-Risk on this pass and then coming back at a not too distant later date and sending letters to these facilities to re-do their Top Screen with a new format requiring reporting of amounts on site.

 

With less than three weeks to go for facilities to complete their Top Screens, it is probably too much to expect further clarification from DHS on these types of questions. In fact, DHS will certainly not tell us how they will decide what Theft/Diversion facilities will be declared High-Risk, they made that clear last December when they released the initial draft regulation.

Saturday, December 29, 2007

HR 4806 – Reducing Over-Classification Act of 2007

Last week Representative Jane Harman (D-Venice), Chair of the Homeland Security Subcommittee on Intelligence, Information Sharing & Terrorism Risk Assessment, along with all of her fellow Democrats on the sub-committee, introduced “The Reducing Over-Classification Act of 2007” (ROC Act, HR 4806). Congresswoman Harmon described the purpose of the bill as putting the “Department of Homeland Security on the path to better information sharing by turning back the tide of over-classification that imperils our ability to make America safer from terrorism.” 

 

According to Harden; “Almost three and a half years ago, the 9/11 Commission made clear the urgent need to eliminate the over-classification of intelligence information by the Federal Government.” Unfortunately, HR4806 goes well beyond decreasing the over classification of intelligence information in the Department of Homeland Security. This bill takes on all classified information as well as all unclassified but sensitive information.

 

 Section 210F(b)(2)(D) of the proposed regulation requires that DHS establish a document control strategy that requires that “documents only be classified for the limited purpose of protecting sensitive intelligence sources or methods….” This would prohibit DHS from producing classified plans to respond to terrorist attacks or other assaults against homeland security.

 

It is in the area of unclassified but sensitive information that this legislation proposes the most sweeping changes in document security. Section 210F(b)(3) requires that DHS establish a new category of information, sensitive and shared information. This category would supercede “any existing policies and procedures relating to the creation, control, and sharing of unclassified information of a sensitive nature….” One such policy/procedure that would be superceded by this classification would be the Chemical-Terrorism Vulnerability Information (CVI) program introduced in the CFATS regulations.

 

While rationalizing the various categories of unclassified but sensitive information may be a bureaucratic improvement, the rules established in this bill are entirely inappropriate for CVI. The one requirement that is most inappropriate is Section 210F(b)(3)(C)(iv) that requires that the markings on the documents would be “of limited duration not to exceed 90 days unless an affirmative showing as described in subparagraph (iii) is made that an extension, of similar limited duration, is warranted….” Under this schedule the CVI protection of the information provided in a facility’s Top Screen would run out before their SVA had to be completed.

 

To keep industry provided information protected from terrorists and competitors, this bill would require an extensive bureaucracy just to keep the CVI marking up to date on all of the documents held by DHS. Furthermore, each state and local office that would be expected to maintain records on chemical facility security plans in their areas, would have to receive communications from DHS for each document on file for these plans, every 90 days to ensure that they had up to date information on its classification status. This would require another bureaucracy at DHS with smaller bureaucracies at each state and local government agency that maintains these records.

 

Another provision of this bill that would present problems for the administration of the CVI program would be the requirement in Section 210F(b)(3)(D)(i) for DHS to provide a process by which “Department personnel, personnel of other Departments and agencies of the Federal Government, or the public may challenge the appropriateness of a marking on a document and seek the removal of the marking….” Labor unions and environmental groups have already complained about CVI protections afforded to designations as High-Risk Facilities, Security Vulnerability Assessments and Site Security Plans. These groups would certainly be expected to keep another bureaucracy tied up with their appeals of the CVI markings on these documents. 

Facilities cannot be expected to share with DHS the security and process data necessary for the implementation of CFATS if DHS cannot make reasonable assurances of the security of that data. DHS cannot, with its limited manpower resources, focus on the proper sharing of that data with state and local governments while they are implementing an intensively bureaucratic document security program.

It would be a shame if, in the name of easing the sharing of intelligence information, we complicated the management of site security documents to the point that site security suffers. The law of unintended consequences rears its ugly head once again. Fortunately we still have time to nip this problem in the congressional bud. Exempting CVI information from the requirements of this bill would be an easy way of ensuring that this happens.

Friday, December 28, 2007

DHS Advisory Council Meeting

DHS announced a meeting of the DHS Advisory Council Meeting (HSAC) on January 10th in Washington DC. The HSAC is an independent group established (IAW the Federal Advisory Committee Act, 5 U.S.C. App.) to provide the Secretary with advice across a wide spectrum of DHS activities.

 

The main purpose of this meeting is to “review recommendations from the Administration Transition Task Force (ATTF)…” The ATTF was formed to help formulate procedures for the upcoming transition between Administrations; to ensure that the wide range of programs that DHS is in the process of implementing will continue through the change of political appointees that is an integral part of that transition.

 

Comments from the public will be considered. Comments can be submitted by email (HSAC@dhs.gov) and must include ``Department of Homeland Security'' and DHS-2007-0086 in the subject line. Comments can be reviewed at http://www.regulations.gov using the Docket Number (DHS-2007-0086).

 

Reports will also be received from other HSAC sub-groups. Reports will be made on:

  • Medical surge capabilities,
  • Real-ID implementation,
  • DHS training and education efforts, and
  • Private sector and state and local information sharing efforts.

DHS and the Omnibus Spending Bill

The President recently signed what the news people are calling the Omnibus Spending Bill, more appropriately known as the Consolidated Appropriations Act, 2008 (HR 2764). This bill contains the appropriations for a number of government agencies, including DHS (Division E of the bill). There are only two provisions in the bill that actually affect the Chemical Facility Security community; sections 534 and 889.

 

Federal Preemption

 

Section 534 amends the legislation authorizing DHS to implement what is now known as CFATS (Section 550 of the Department of Homeland Security Appropriations Act, 2007). It adds the following language to that authorizing legislation:

 

“(h) This section shall not preclude or deny any right of any State or political subdivision thereof to adopt or enforce any regulation, requirement, or standard of performance with respect to chemical facility security that is more stringent than a regulation, requirement, or standard of performance issued under this section, or otherwise impair any right or jurisdiction of any State with respect to chemical facilities within that State, unless there is an actual conflict between this section and the law of that State.”

 

This language was meant to address the apparent (to some people) preemption of the rights of states (particularly New Jersey) to regulate the security of chemical facilities within their states. The current CFATS regulations (6 CFR part 27) only preempt provisions of state and local laws that conflict with the provisions of CFATS; exactly what this amendment states. Of course, this provision will make it difficult for DHS to amend 6 CFR part 27 to further restrict state and local legislation. I would not expect DHS to revise the current regulation due to this amendment.

 

Secure Handling of Ammonium Nitrate

 

Section 889 sets out language directing DHS to:

 

1.      Establish (within 90 days, March 25, 2008) a threshold concentration of ammonium nitrate in a mixture,

2.      Prepare (within 6 months, June 26, 2008) a proposed rule regulating the sale and transfer of ammonium nitrate,

3.      Within 1 year (December 26, 2008) issue a final rule implementing the requirements of this section.

 

These regulations will accomplish the following general requirements:

 

1.      Establish procedures for registering Ammonium Nitrate Facilities.

2.      Establish procedures for registering Ammonium Nitrate Purchasers.

3.      Require records of all transactions transferring Ammonium Nitrate between Facilities or to Purchasers.

4.      Exempt transfers to licensed/permitted manufacturers of explosives from record keeping requirements.

5.      Allow DHS to coordinate with Department of Agriculture and state governments during development of programs. Require DHS to coordinate with state programs regulating ammonium nitrate.

6.      Allow DHS to delegate enforcement to states and requires DHS to delegate when requested by Governor.

7.      Requires notification of Federal law enforcement agency within one day of discovery of any illegal transfer of ammonium nitrate.

8.      Make it a federal crime for unregistered facilities/purchasers to transfer or possess ammonium nitrate or for registered facilities to transfer to unregistered purchasers.

9.      Establish civil penalty of not more than $50,000 per violation.

10.  Provides that nothing in these regulations will preempt regulations of any other department of the US Government.

11.  Provides for preemption of state laws, except where state laws are more stringent.

 

This bill authorizes the appropriation of $2 Million for 2008 for these ammonium nitrate provisions, increasing to $10.75 Million per year for enforcement for the following 4 years.

 

In an earlier blog I wondered if DHS would incorporate such an ammonium nitrate mandate the CFATS regulations. Having seen the details of the new requirements, I think that it is more likely that these regulations would fall under a separate regulatory framework like the ATF regulations. I would hope that the new regulations would incorporate the same concentration requirements set forth in 6 CFR part 27.

Thursday, December 27, 2007

Top Screen User’s Guide: Release COI

For this blog I am going to look at the User’s Guide and the blogs that I wrote about the CSAT Top-Screen Questions document that was published on November 20th. This initial blog will look at the three categories of Release COI; Toxic, Flammable and Explosive. I’ll be looking for differences, additional information and answers to questions that I raised in the earlier blogs.

 

Toxic Release COI

 

No new information presented in the User’s Guide. There is a good explanation of the various terms used. There is a very good step-by-step outline of how to use the RMP*Comp program to calculate Distance of Concern.

 

Flammable Release COI

 

The User’s Guide raises a new issue that I alluded to in my blog (Top Screen Questions: Flammable and Explosive Release Chemicals of Interest); fuels and how they would be dealt with. On page 34 the User’s Guide explains that: “the Top-Screen asks questions about release-flammable COI from Appendix A as well as questions about some fuels, such as diesel, that do not routinely contain Appendix A chemicals.” The guide goes on to say that various fuels are listed and the facility need only report the total amount of that fuel on site. Selecting the fuel will obviate the need to include any Flammable Release COI component of that fuel in the remainder of the Top Screen.

 

The User’s Guide only uses Diesel, Jet Fueland Gasoline as examples of the fuels listed. The Top Screen Questions documentdoes not list either. I have no way of knowing what other fuels are listed. The Guide is very clear that any facility reporting Flammable Release COI needs to report the fuels that they have on hand.

 

To my understanding, when the guide states that: “A facility that possesses only fuel(s) must: 1) indicate the type of fuel it possesses; and 2) provide the total amount of the fuel it possesses at the facility”; it means that any facility that contains fuels also must complete a Top Screen. An example on page 36 clarifies this somewhat by explaining that flammable mixtures with an NFPA rating of 1, 2, or 3 in underground tanks need not be reported. This would exempt most gasoline stations. In any case, a large number of fuel storage facilities that might have thought they were exempt from Top Screen requirements are actually required to submit a Top Screen.

 

In my earlier blog I noted that there was nothing in the Top Screen that covered the peculiar situation regarding propane; the fact that storage tanks of 10,000 lbs and less did not have to be counted when reporting propane inventory. There is a note on page 35 of the User’s Guide explaining that exemption. If the propane industry does not do a good job of communicating this exemption to all of their customers, I expect that there will be a substantial number of facilities that over-report their propane inventory.

 

Explosive COI

 

There is no new information in the User’s Guide about Explosive Release COI that was not covered in my earlier blog.

Wednesday, December 26, 2007

DHS publishes new Top Screen User’s Guide

DHS published the new CSAT Top-Screen User Manual on their web site last week, December 20th. At first glance it is easy to see why it took a month longer to get the user’s manual out than it did the Top Screen Questions; there was almost a complete re-write of this 79-page guide. This manual provides answers to some of the questions I raised in my earlier Top Screen blogs, provides some new information, and raises some new questions. With this blog we’ll look at some of the new information.

 

Top Screen Results

 

The first piece of new information regards the automated response the facility will receive once the Top Screen is submitted. On page two of the manual we find:

 

“Upon completion of the Top-Screen, a facility will see one of two screens: a screen informing the user that a facility “may be regulated” or a screen informing the user that the facility “will not be regulated.”

 

DHS will follow-up with letters to the facility confirming what is seen on the screen. Both letters will be CVI and must be protected as such (6 CFR 27.400). The letter for “may be regulated facility” will (page 3):

 

“…notify the facility of (1) its preliminary status as a high-risk facility, (2) its preliminary placement in a risk-based tier pursuant to §27.220(a), and (3) the specific COI and related security issues that need further analysis in the SVA. (See Attachment C for an example of such a letter.”

 

Top Screen Authorizing Statements

 

Before any actual work can be started on the Top Screen the facility, the facility representative (Preparer or Submitter) will have to complete the Authorizing Statement; an acknowledgement about the site rules similar to those found on many commercial web sites. In this case that acknowledgment includes a non-disclosure agreement with DHS and the rules for protecting Chemical-terrorism Vulnerability Information (CVI). Currently this page serves in lieu of completing the formal CVI training on the web, but “DHS expects that in the near future all Top-Screen Users will need to complete CVI training and become CVI certified.” (page 8)

 

This actually gives rise to one of the sillier pieces of government regulation that I have seen lately. On page 8 the manual says: “If the user does not wish to abide by the requirements and is not willing to accept the conditions, the user will not be able to enter the Top-Screen.” Of course, failure to complete the Top Screen could lead to $25,000 per day fines or even government closure of the facility, but the user does have that option.

 

While there are no provisions on the site for copying this page, it would certainly be worthwhile for the facility to have a copy of this page for their records. Either highlight the text portion of the page and save it to a word processing program, save the whole page from the browser, or use a screen print program to capture and print the data.

 

Top Screen Navigation

 

Unlike the CSAT Registration the, Top Screen is likely to take more than a single session to complete. If the navigation buttons, labeled “Next” and “Back”, on each page are used to move between pages the data entered on each page is saved. Using the browser controls on your computer for navigation will not save the data. When the Top Screen is closed or times out (after 20 minutes of no operation) the data will be saved until the facility re-logs onto the Top Screen. The Top Screen will resume where the user left off.

 

There is limited data validation on the Facility Information portion of the Top Screen. Once the entries have been finished in that section of the Top Screen click on the “Validate Report” button to have the program check for missing entries and entries of inappropriate lengths. Actual accuracy of data entered is solely the responsibility of the facility.

 

Types of Chemical Facilities

 

The Top Screen contains questions about three general types of facilities (page 3):

 

“Chemical manufacturing, storage, use, and distribution;

“Petroleum refining; and

“Liquefied natural gas (LNG) storage (e.g., peak shaving facilities).

 

The questions for the petroleum refining facilities and the LNG storage facilities are peculiar to just those facilities. Those questions will be bypassed for all other facilities. The questions for the first type of facility will require answers by all facilities completing the top screen. Selecting the appropriate response to the “Facility Type” question in the “Facility Description” area (question 1.1-65) will insure that only those questions for that facility type will be displayed.

 

There is a great deal more information available in this new manual. Future blogs will look at some of that information, particularly answers to questions posed in previous blogs.

Friday, December 21, 2007

CSAT Security Vulnerability Analysis News

I periodically go back and spot check some areas of the CSAT Frequently Asked Questions page of the DHS web site. There is no way to tell when this page changes since it is the only DHS web page that I can find that does not have a “This page was last modified on…” listing on the page. One of the ways that I do this is to check on the SVA listings.

FAQ # 803 used to answer the question “When will I be notified if I have to complete a SVA?”. It used to say that DHS would begin notifying users by mail in September 2007 that they needed to complete an SVA. Yesterday there was no FAQ #803. Instead FAQ # 1284 now answers that question with: “In early 2008, DHS will begin notifying users by mail that they need to proceed to completion of the SVA or that their participation is complete.” This is obviously directed at the 40,000+ facilities that are expected to complete a Top Screen before the end of January 2008.

Another new FAQ also showed up; FAQ #1265 answers the question: “Is it possible to review a copy of the SVA or SSP template prior to CSAT registration?” The answer to that question is:

“For security reasons, only authorized users that have been assigned usernames and passwords through the CSAT User Registration process can have access to the Top Screen tool. After submitting the necessary information through Top Screen, DHS will notify those facilities that will need to complete a SVA. The SVA and SSP templates are not yet finalized but will also be restricted to access by registered CSAT users whose Top Screen results obliges their use of the tools."

Since there has been no indication of DHS publishing an SVA template for the 100 or so companies that should have completed them from the initial Top Screen submission requirement in June 2007, I have half expected that DHS would not allow general access to those templates. I would be very interested in hearing the rationale DHS uses to restrict access to this template. I am not talking about actual access to the SVA tool inCSAT and I am certainly not asking about access to the methodology used to evaluate the data reported with that tool.

What I would be interested in seeing is a .PDF document outlining the procedure for entering the data into the SVA tool in CSAT much the same way DHS did for the CSAT Registration tool and the Top Screen tool. This would serve at least two purposes; 1) allow facilities to prepare their SVA documentation to facilitate entry into the SVA tool, 2) allow writers like myself to review and comment on those instructions.

If the facilities knew the requirements for entering data into the SVA tool as they went into their SVA process they could prepare their SVA documentation in such a manner as to allow the straight forward cutting and pasting from their documentation into the on-line tool. They could also shape their analysis process to provide the precise type data that DHS was looking for in their SVA tool

The feedback from writers like me could allow DHS to modify their instructions so that they had a better chance at communicating the requirements that DHS intended to the end users in an efficient manner. As a professional instruction writer (12 years writing manufacturing instructions, laboratory procedures, and facility SOPs) I know how hard it is to get clear, comprehensive instructions done in a single pass. What was perfectly clear to the writer may be imprecise and unclear to the ultimate user. Multiple critical reviews by outsiders makes is easier to get clear instructions into the hands of the people that will use the tool.

I hope that DHS reconsiders and publishes a .PDF SVA User’s Guide on their web site. This would help to make a complex process a little bit simpler to complete.

Changes in CSAT Registration

DHS made a change to their web site on December 19th, they changed the CSAT User Registration User Guide, the .pdf file that provides instructions for completing the CSAT Registration. For facilities that have already completed the CSAT Registration process the changes in the new procedure will have no effect on their registration.

 

The only substantive change is the amount of time that the CSAT registration page can remain idle before it times out and closes (and erases any data entered) from 20 minutes to 120 minutes (pg 13). I would surmise that DHS was having complaints of having their information erased too quickly. This should make it easier for facilities to complete the registration process.

 

There are four other changes made to the registration instructions. DHS added clarifying instructions that consultants cannot be designated as Authorizers (pg 24) or Submitters (pg 22). They also specifically stated that consultants can be designated as Preparers (pg 33) and Reviewers (pg 41). None of these are changes to policy. The definitions and requirements for Authorizers and Submitters were pretty clear that these functions would be served by company officers or employees. There were no such restrictions for Preparers or Reviewers.

 

I am glad to see that DHS is being proactive in tweaking their instructions to make them clearer and more precise. As a person who has written instructions for any number of chemical processes, laboratory procedures, and SOPs I know that it is difficult to get instructions clear enough so that everyone can follow them. Listening to feedback and updating instructions is the only way to ensure that everyone understands them the same way.

 

My main, and continuing complaint, is that DHS is not communicating the details about what has been changed when the publish a new document.

Thursday, December 20, 2007

Department of Homeland Security Appropriations Act, 2008

The House of Representatives just sent to the Senate the revised Department of Homeland Security Appropriations Act, 2008 (HR 2764). While it is not clear that this bill will be approved, or if the funding for DHS and other departments will be included in an omnibus bill, it is informative to see what changes have been made to the previous Senate (S 1644) and House (HR 2638) bills. Rather than trying to analyze the whole bill, I’ll concentrate on provisions affecting the chemical industry.

This bill appropriates $50 Million for implementation of chemical facility security regulations. This is a $10 Million increase over what was previously authorized in the Senate Bill. This increase had previously been identified by the Administration as too large an increase; potentially calling for a presidential veto.

In Section 534 this bill includes the Senate provisions on pre-emption of state or local chemical facility security standards. The House version was similar except that it also included changes in information classification requirements. As I explained in an earlier blog (Revisions to CFATS Authorizing Legislation) the original version would require DHS to modify 6 CFR part 27 within 30 days of this legislation becoming law. As I read the language in the original bill, it should not require major modifications to the wording or intent of the current rules. Federal pre-emption could still prohibit, for example, disclosure of CVI.

Finally, in Section 563 of this bill there would be some new provisions for the secure handling of ammonium nitrate. It would be interesting to see if DHS included these provisions in the 6 CFR part 27 rules or in ATF regulations.

Wednesday, December 19, 2007

Top Screen Questions: Mission Critical and Economically Critical Chemicals

The last two areas of the Top Screen have nothing to do with the chemicals of interest listed in Appendix A to 6 CFR part 27. The other difference is that they only deal with chemical production facilities, not the more loosely defined chemical facility. These are the sections dealing with Mission Critical Chemicals and Economically Critical Chemicals. These are also the most complicated sections of the Top Screen to fill out.

 

Mission Critical Chemicals are those chemicals that a facility produces that go into any one (or more) of four critical infrastructure sectors: Defense Industrial Base, Energy (electricity generation only), Public Health or Healthcare, and/or Public Drinking Water. If a facility’s production accounts for 20% or more of the domestic production of one or more chemicals going into one of these sectors the facility will be required to complete this section of the Top Screen.

 

While this sounds like a fairly straight forward definition, there is very large number of chemicals made by specialty chemical companies that might fit this bill because of the niche market they fill. For example I know of a manufacturer that is the sole producer of a very low production volume polymer that is used by the Department of Defense as a jet fuel additive. I am not sure that this is what DHS was looking for in this section, but it surely fits the definition provided. There will probably be thousands of chemicals like this, especially going into the pharmaceutical industry.

 

There are twelve questions that have to be answered for each chemical that a facility produces that meets the criteria for Mission Critical Chemicals. These questions range from name and CAS# for the chemical thru Average Capacity Utilization Rate to Replacement Costs for Production Units. Two of the questions shown in the CSAT Top-Screen Questions (Capacity Utilization Rate and Emergency Production Rate) refer to additional information that will be provided in the yet to be published Top Screen User’s Guide.

 

The Economically Critical Chemicals section deals with production going into any other sector of the economy where the production facility accounts for 35% of the domestic production of that chemical. The same types of questions that were asked in the previous section are asked for each chemical a facility produces meeting these requirements.

 

Because of changes in the <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" />US chemical industry in the last 20 years, there will be a very large number of industrial chemical producers that will produce one or more products for which they are the sole domestic producer. This is especially true of low volume specialty chemicals.

 

DHS has done very little to advertise these two sections of the Top Screen. They are going to miss a lot of facilities that meet the definitions for these two critical chemical sections because the producers are never going to see the requirement. Most facilities are going to scan the Appendix A chemical list and if they find that they do not have an STQ of a listed chemical on hand, they will never look at the actual Top Screen.

 

These sections are also going to be much harder for DHS to evaluate to determine the relative risk of the facility being the object of a terrorist attack. DHS will not only have to be able to evaluate the criticality of the end use of the chemical and the ease of quickly bringing an alternate supplier on line, but also how hard it will be for a terrorist to identify the same information.

 

It will be interesting to see how DHS treats these two areas of the Top Screen. Sites with large volumes of Flammable or Toxic Release chemicals will make for more spectacular terrorist targets, especially if they are near large populations. Various Theft/Diversion chemicals will allow terrorists to use chemicals to attack people physically separated from chemical facilities. Successfully attacking a few facilities manufacturing Critical Chemicals could cripple essential sectors of our economy. Which of these makes a better, higher-risk terrorist target? That remains to be seen.

Tuesday, December 18, 2007

Problems with CVI rules?

During last week’s Congressional hearing on the progress of CFATS implementation Clyde D. Miller; Director, Corporate Security, BASF Corporation, was generally supportive of DHS efforts to implement these new security regulations. One area that he expressed some concerns about was the rules that DHS had published about security of Chemical-Terrorism Vulnerability Information (CVI). On pages 2 and 3 of his testimony he said:

 

“…The manual requires company staff with access to CVI to go through web-based training and to sign a nondisclosure agreement (NDA) that is more restrictive even than the NDA that is required to have access to national security classified information.  Chain of custody record keeping is also required.  And all this applies even when people are only getting access to their own company’s information.”

 

The requirements that Mr. Miller refers to are found in paragraph 5.3 of the Procedural Manual Safeguarding Information Designated As Chemical-Terrorism Vulnerability Information (CVI). These requirements state that “Chemical facilities including their board members, employees and contractors, who require access to CVI will:

 

a. “Be aware of and comply with the safeguardingrequirements for CVI as outlined in the regulations, in this Manual and in any other guidance or direction issued by CSCD.

b. “Participate in DHS-approved training presented to communicate the requirements for safeguarding CVI.

c. “Be aware that divulging information without proper authority could result in civil penalty or administrative or disciplinary action.

d. “Enter into an appropriate NDA similar to that shown in Appendix B.

e. “Maintain a Tracking Log of the receipt and subsequent dissemination of CVI….

f. “Ensure that all information is marked appropriately.

g. “Complete any required background checks or other requirements for personal identification or trustworthiness that may be required by DHS.”

 

What Mr. Miller does not seem to realize is that failing to secure the information that underlies the physical security measures protecting the chemical facility undercuts those measures. If someone is able to gather information about the security measures at a chemical facility they will have a much easier time by passing those security measures. Restricting access to security program documents is the only way that the information in those documents can be adequately protected.

 

The document security program outlined in the CVI handbook relies on the same type measures that will be used to physically secure the facility;

 

1.      Restricted Access,

2.      Personnel Surety,

3.      Security Procedures, and

4.      Training.

 

Restricted Access:

 

Just as access to the facility needs to be restricted to those who need to be there, access to sensitive documents needs to be restricted to those with a need to know the information. While some parts of the security program will need wide dissemination within the organization to be effective, most of the documents listed in the CVI manual (Table 1) will only need to be seen by a limited number of people who actually work with the security program.

 

Those parts of the security program that will receive the widest exposure are those dealing with the interface between the facility and the public. Access procedures at the front gate will have to be available to anyone that will desire access to the plant; the requirement to show ID, sign in and be escorted while on site. While they will be part of the Site Security Plan (which is certainly CVI material) they can be sanitized to the point that posting this information on a sign at the gate will not compromise the plan. Designating which parts of the Site Security Plan that are not CVI should be delineated in the plan.

 

Personnel Surety:

 

The CFATS regulations already require that some sort of background checks will have to be performed on personnel with unaccompanied access to high-risk facilities. It is only reasonable that those background checks should be extended to people with access to CVI documents. The Chemical Security Compliance Division (CSCD) at DHS is already doing part of this background check when personnel complete the on-line training for CVI and submit their Non-Disclosure Agreement to DHS.

 

Security Procedures:

 

While the CVI handbook provides the general procedures for securing CVI information, the application of those procedures at the facility need to be adapted to the particular situation at the facility. The Site Security Plan should include provisions for document security procedures (para 6.2 of the CVI Handbook) that include: “Physical protection requirements (that) include:

 

1) Secure storage

2) Document marking

3) Application of a tracking number

4) Restricted access

5) Limited reproduction

6) Secure transmission

7) Enhanced automatic data processing system controls

8) Appropriate destruction.”

 

Training:

 

Training is always the first key to ensure that procedures are followed. The on-line training provided by DHS is a good first step for the general training that all personnel that will be handling CVI material must complete. It is, of course, a required step in receiving DHS certification as an “authorized user” of CVI (though not all personnel at the facility need to be certified as authorized users to be granted access to CVI). Further training in specific on-site procedures implementing the CVI rules should also be developed and provided to personnel routinely dealing with CVI documents.

 

Protecting sensitive documents pertaining to the security of the facility is a key part in protecting the facility against a successful terrorist attack. Implementing a workable CVI protection procedure should be part and parcel of the facility Site Security Plan.

Monday, December 17, 2007

Top Screen Questions: Sabotage/Contamination Chemicals of Interest

The last list of chemicals of interest in the Top Screen is for the Sabotage/Contamination chemicals. In the Final Rule Appendix A (pages 41-42), DHS defines Sabotage/Contamination chemicals as:

 

“Sabotage/contamination refers to those chemicals that, if mixed with other readily-available materials, have the potential to create significant adverse consequences for human life or health…. Sabotage/contamination chemicals currently include those chemicals that are capable of releasing a poisonous gas when exposed to water.”

 

There is only a single section in the Sabotage/Contamination chemicals of interest (COI) portion of the Top Screen. There is a listing of the chemical name, CAS #, minimum concentration, and the Screening Threshold Quantity (STQ) for each listed chemical. Then there are two check boxes for indicating if there is an STQ of the chemical on-site. The default value for these boxes is “No” so only the chemicals requiring an affirmative answer need to be checked.

 

All of the chemicals in this COI list have the same concentration limit, ACG, a commercial grade. Again, like in the explosive/IEDP COI, this means that any mixture sold under that chemical name will be counted.

 

The other abbreviation in this list is the “APA” listed under the STQ for each of the chemicals in the list; an abbreviation unique to this COI list. APA stands for “A Placarded Amount”, and refers to any shipment of this chemical that was required to be placarded under CFR 49 rules. If a facility ships or has shipped this chemical in an amount that was required to be placarded, the facility meets the STQ requirements for that chemical. Interestingly, the normal “in the last 60 days” verbiage that is found in each of the previously discussed chemicals of interest tables is not found in this table.

 

Once again there is no provision in the CSAT Top-Screen Questions shown on-line for reporting the actual amount of this chemical that the facility has on hand. This was also seen in the Theft/Diversion COI list. This poses some interesting possibilities for how DHS will treat Top Screen reports for these chemicals. Either DHS will automatically assign any facility reporting the STQ amount of any of these chemicals to a specific tier ranking as a High-Risk Facility, or DHS is only collecting information about these chemicals and will not use the presence of these chemicals in making a High-Risk Facility determination. Neither of these options appears to be particularly palatable.

Saturday, December 15, 2007

Top Screen Questions: Theft/Diversion Chemicals of Interest

In two earlier blogs (Top Screen Questions: Toxic Release Chemicals of Interest, and Top Screen Questions: Flammable and Explosive Release Chemicals of Interest) I looked at the Top Screen requirements for Release chemicals (those chemicals that present a risk is released on site at the facility in question). In this blog we will look at the three categories of chemicals that would pose a threat if they were stolen or diverted to terrorist use outside of the facility. These categories are Explosive/IED Precursor (EXP/IEDP) Chemicals of Interest, Weapons of Mass Effect (WME) Chemicals of Interest, and Chemical Weapons and Chemical Weapon Precursors (CW/CWP) Chemicals of Interest.

 

Since these chemicals are a threat if stolen by, or shipped to terrorists, DHS is only interested in these chemicals in shipping form. According to the Final Rule Appendix A (page 15):

 

In § 27.203(c), DHS provides that facilities shall only count theft/diversion chemicals of interest that are in a transportation packaging. DHS has adopted the Department of Transportation (DOT) definition of packaging, which refers to “a receptacle and any other components or materials necessary for the receptacle to perform its containment function in conformance with the minimum packing requirements of [DOT’s Hazardous Materials Regulations].”

 

There is an apparent and unexplained exception to this rule inthe EXP/IEDP portion of the Top Screen; there is a check box for each chemical under the heading for “Bulk Storage”. Along with this is a definition of bulk storage; “A bulk storage container is one from which the COI could be safely transferred into portable package or could be moved with the aid of powered mechanical devices.” I believe that this is an error in the CSAT Top-Screen Questions as this information was already captured in the EXP/IEDP Release section of the Top Screen. Until DHS eventually publishes the new Top Screen Workbook, we will not know for sure. I would be interested in hearing if the same ‘mistake’ shows up in the actual on-line Top Screen.

 

Each of the three Theft/Diversion areas of Top Screen are divided into two sections. The first is similar to those seen on the Release chemicals portion of the Top Screen. There is a listing of the chemical name, CAS #, minimum concentration, and the Screening Threshold Quantity (STQ) for each listed chemical. Then there are two check boxes for indicating if there is, or has been in the last 60 days, an STQ of the chemical on-site in transportation packaging. The default value for these boxes is “No” so only the chemicals requiring an affirmative answer need to be checked.

 

For most of the EXP/IEDP chemicals the minimum concentration is listed as ACG; a commercial grade meaning that any concentration of this chemical that is sold as an explosive is included. For all Theft/Diversion chemicals for any mixture that meets the minimum concentration specified the entire weight of the mixture (in transportation packaging) will be counted in determining the STQ.

 

Some of the CW/CWP chemicals (Chemical Weapons Convention Schedule 1 chemicals) have an STQ listing of “CUM 100g”. For these chemicals the facility will total the amount of all of the chemicals with that listed concentration that the facility has, or has had in the last 60 days, on site. If that total amount exceeds 100-g each of the listed chemicals on site, regardless of the amount, will be reported as being on-site in excess of the STQ.

 

The second section of each of the Theft/Diversion chemical listings provides the same listing of chemicals, CAS#, Concentration and STQ. In place of the Yes/No boxes there are boxes for describing how the chemicals are packaged on site; “Portable” or “Bulk Transport”. Portable is defined as “A portable package can either be man-portable being movable by 1-3 people without the aid of powered mechanical devices or mechanically portable with the aid of a fork lift, truck or crane.” Bulk Transport is defined as “Bulk transportation containers include tank cars, rail cars and other large storage containers that could be hitched to a vehicle for removal from a site.”

 

Inexplicably there is no place in the CSAT Top-Screen Questions that requires listing a quantity of any of the chemicals on site. Again, until DHS getsaround to publishing their workbook for the Top Screen, there is no telling if this is just an oversight or intentional. If anyone has seen the actual Top Screen on-line (I have not) I would be interested in seeing if it accurately reflects the version published on the open DHS website.

Thursday, December 13, 2007

House Committee Held Hearings on CFATS Implementation

As I mentioned in my blog (House to hold CFATS Hearing) the House Homeland Security Committee, actually the Subcommittee on Transportation Security and Infrastructure Protection, held a hearing on Wednesday entitled “Chemical Security: The Implementation of the Chemical Facility Anti-Terrorism Standards and the Road Ahead.” The ‘Road Ahead’ was the “Chemical Facility Anti-Terrorism Act of 2008.” I haven’t yet had a chance to review that proposed legislation, so I’ll leave that for a future blog. Today I’ll discuss the testimony of the two witnesses that actually addressed the CFATS issue. The other three witnesses were more interested in the new legislation.

 

Bennie Thompson, the Chairman of the House Homeland Security Committee led off with a short prepared testimony. The only thing of real note was the statement that: “The CFATS regulations will sunset in October of 2009 and I feel strongly that Congress and this Committee should consider making these regulations permanent.” This has to be heartening to companies that are getting ready to start spending significant amounts of real money to implement the requirements of CFATS.

 

Once again Assistant Secretary Robert B. Stephan was the voice of DHS for CFATS. His six page prepared testimony was a cogent review of the CFATS development process and how the implementation has gone to date. One interesting piece of information was that there had been a second group of 50 facilities that were notified to complete a Top Screen before the final version of Appendix A was published in November. Here is what he said (on page 5 of his testimony):

 

“In October 2007, Phase 1(b) began, in which approximately 50 additional facilities believed to be high-risk were contacted with the request they begin their CFATS requirements in advance of the release of the final Appendix A. A number of the Phase 1(b) facilities have already submitted Top-Screens to the Department.”

 

He also provided an update on the progress of CFATS implementation to date (as of 11-25-07). The numbers given below reflect 5 days of effort after the publishing of the Final Rule on Appendix A on November 20th. About 1/50th of the projected facilities have completed the Top Screen in 1/12th of the available time. Registrations do look fairly good though.

 

·         “12,267 facilities have registered in the CSAT process;

·             2,079 facilities are in some phase of Top-Screen completion; and

·             1,197 facilities have submitted a completed Top-Screen.”

 

One last area of interest was Secretary Stephan comments on working with local agencies and first responders. While much has been made in the press about the conflict between the CFATS regulations and some State and Local rules, Col Stephan was very clear on the need for local involvement;

 

“Additionally, the Department intends to focus efforts on fostering solid working relationships with State and local officials and first responders in jurisdictions with high-risk facilities. To meet the risk-based performance elements under CFATS, facilities are likely to develop active, effective working relationships with local officials in the areas of delaying and responding to a potential attacks and a clear understanding of roles and responsibilities during an elevated threat situation.”

 

Clyde D. Miller; Director, Corporate Security; BASF Corporation, was the other witness that directly addressed the implementation of CFATS. As I had expected in my earlier blog, he was generally supportive of the current CFATS regulations. One point in particular that he did make was about the cost of implementation:

 

So, even though BASF and the 2000 other American Chemistry Council (ACC) member company facilities have already invested more than $5 billion to enhance security through the ACC Responsible Care® Security Code, the DHS rules leave little doubt that more action will be required of those facilities that are deemed to be high risk under those rules.”

 

He also made the argument that, due to the high cost of implementing the CFATS rules, Congress ought to consider revising and making permanent the current Interim Final Rule rather than trying to completely start new regulations from scratch. He made the argument that many companies might drag out the implementation of CFATS to avoid spending money if it became clear that in 2009 completely new and different requirements were to go into effect.

PA Department of Agriculture warns farmers about CFATS

Yesterday the Pennsylvania Department of Agriculture sent out a press release reminding farmers in the state that DHS had released new chemical security regulations that might affect farmers “storing fertilizers, pesticides and other chemicals might be affected by these new regulations”. The press release lists some of the chemicals found in Appendix A to 6 CFR part 27 that might be found in an agricultural setting.

DHS has pledged to conduct an outreach program to let people that were not normally associated with the Chemical Industry that the new Chemical Facility Anti-Terrorism Standards (CFATS) might classify them as a “Chemical Facility” based on the chemicals that they might have on site. While the PA Dept of Agriculture is certainly not directly associated with DHS, it may have been contacted by DHS to spread the word; figuring that farmers would probably pay more attention to that agency than they would DHS.

This is going to be the main problem that DHS has with the CFATS; so many of the facilities that will be affected are outside the normal chemical manufacturing community that a significant number of the facilities that should respond will not even know that they are covered. Notifications to farmers, food processors and other users of chemicals are going to have to be made to get everyone into the game. Unfortunately we are almost half way through the initial 60 day Top Screen filing period, so it is a little late to start getting the word out.

Wednesday, December 12, 2007

Top Screen Questions: Flammable and Explosive Release Chemicals of Interest

In yesterday’s blog I discussed the Top Screen Questions for Toxic Release chemicals. Today we will look at the same thing for the two remaining Release chemical categories; Flammables and Explosives. Actually, this will be relatively easy since they both have the same sets of data requirements and they are simpler than those for Toxic Release chemicals.

 

The first area for these chemicals has the same layout as found in the Toxic Release chemical section. The first portion of this area of the Top Screen is identifying which chemicals the facility has (or has had in the last 60 days) on site at or above the STQ. The chemicals are listed alphabetically by chemical name. For each chemical there is a CAS number listed to aid in identification of the chemical of interest. There is a minimum concentration that must be equaled or exceeded for the chemical to be counted (only the actual amount of the chemical in a mixture not the entire mixture) in the STQ calculations. Finally there are check boxes to indicate if the listed chemical was present at or above the STQ. The default value is “No”, so the only chemicals that need to actually be marked are those that meet or exceed the STQ.

 

Where there were two questions at the end of this section for Toxic Release chemicals there is only a single question for each of these two Release chemicals. The question asks if you have marked every chemical that should have been marked; responses are yes or no, with the “No” box the default value. Even if no Toxic Release Chemicals of Interest were present on the facility at or above the STQ within the last 60 days a yes response is required to this question to signify that list has been evaluated.

 

The second section for these two Release chemicals is a combination of the second and third section for Toxic Release chemicals, with boxes for “Total On-Site Quantity” and “Quantity in AHQ”. The reason that DHS could combine these two sections is that thereis no requirement to calculate a Distance of Concern for either of these chemicals. 

 

The general rules for the calculations for the quantities for these two Release chemicals is generally the same as used for the Toxics with the exception of how the concentrations are used to calculate the amount of a mixture that will be included in either of these two quantities. For explosives the total amount of “A Commercial Grade” explosive (if it is sold as an explosive it is a commercial grade) is counted regardless of the concentration. For flammable mixtures, if the mixture is an NFPA 4 flammable the total quantity is counted regardless of the concentration. If the mixture is not an NFPA 4 flammable then only the actual amount of the chemical is counted.

 

There is a potential problem with the concentration rule for flammables. If a mixture that is a NFPA 4 flammable liquid contains two or more Flammable Release chemicals at concentrations of more than 1% the total amount of that chemical will have to be counted for each of the listed chemicals. This will make the facility look like a higher hazard than it actually is. I do not see how this can be appropriately captured in the Top Screen. My only suggestion is that any facility that has this happen in their Top Screen and is notified that it is designated a High-Risk Facility should contact DHS directly to see if a more appropriate accounting of their inventory would reduce their risk rating.

 

There is one other exemption to the standard rules for counting the amount of Flammable Release chemicals, propane. DHS has elected to treat propane in a unique manner (see my blog: The politics behind Appendix A propane rules). Propane tanks that hold less than 10,000 lbs are not to be counted in the propane totals. There is nothing in the Top Screen that says this but it is covered in Section 27.203(b)(3). Hopefully there will be detailed instructions in the Top Screen User’s Manual when it is eventually published.

Tuesday, December 11, 2007

Top Screen Questions: Toxic Release Chemicals of Interest

The Top Screen on-line questions are divided up into different groups corresponding to the different types of chemicals and the hazards associated with them. While the instruction manual for the Top Screen has not yet been completed or issued, a copy of the CSAT Top-Screen Questions is available on-line. The first chemical group in the Top Screen is the Toxic Release Chemicals. These are toxic chemicals that if released on site would present a serious off-site consequence in the event of a terrorist attack.

 

The first portion of this area of the Top Screen is identifying which chemicals the facility has (or has had in the last 60 days) on site at or above the STQ. The chemicals are listed alphabetically by chemical name. For each chemical there is a CAS number listed to aid in identification of the chemical of interest. There is a minimum concentration that must be equaled or exceeded for the chemical to be counted (only the actual amount of the chemical in a mixture not the entire mixture) in the STQ calculations. Finally there are check boxes to indicate if the listed chemical was present at or above the STQ. The default value is “No”, so the only chemicals that need to actually be marked are those that meet or exceed the STQ.

 

At the end of this check off list are two questions with appropriate response boxes. The first is the same as the one found at the end of each group of chemicals on the Top Screen; essentially have you marked every chemical that should have been marked; responses are yes or no, with the “No” box the default value. Even if no Toxic Release Chemicals of Interest were present on the facility at or above the STQ within the last 60 days a yes response is required to this question to signify that list has been evaluated. The second question deals with the topography surrounding the facility. If the area is open with few obstructions (buildings, etc) then the “Rural” box will be marked, otherwise the “Urban” box will be selected.

 

The next area of the Toxic Release COI section of the Top Screen deals with the downwind hazard distance for toxic chemicals on site. This data is again organized as a list of the Toxic Release chemicals by name with the CAS number, Minimum Concentration and STQ listed for each chemical. There are then two blocks for each listed chemical.

 

The first block is the “Total On-Site Quantity” box where the maximum inventory in the last sixty days is recorded. If there are on-site storage tanks (including movable tanks like rail cars) the maximum inventory includes what could have been held in those tanks if they were full (unless there are administrative controls that limit the amount kept on hand, in which case that maximum amount is used). If the chemical is part of a mixture, only the actual amount in the mixture will be included. The total amount is rounded to two significant digits (7625 lbs is rounded to 7600 lbs for example). This is the quantity that will be used in subsequent calculations for that chemical.

 

The second block is the “Distance of Concern” block and is calculated with an Environmental Protection Agency program (RMP*Comp) that can be downloaded for free from the EPA. This is the downwind distance that there can be expected to be a dangerous concentration of the chemical in the event of a successful terrorist attack. There are three differences in the way this program is used for the Top Screen as opposed to the EPA RMP calculations that this program was developed for. For Top Screen use:

 

  1. Always use the “Worst Case” scenario, and
  2. The “Total On-Site Quantity” is used for the Quantity Released, and
  3. Passive mitigation measures are not to be taken into account in the calculation.

 

<PCLASS=MSONORMAL style="MARGIN: 0in 0in 0pt">When reporting the results from the RMP*Comp program in the Top Screen any results of less than 0.1 mile will be reported as 0.1 mile and results in excess of 25 miles will be reported as 25 miles.

 

The last area of the Toxic Release COI section of the Top Screen deals with the largest amount of those chemicals stored in the Area of Highest Quantity (AHQ). This is used to distinguish between the threat from chemicals stored in a concentrated area as opposed to more dispersed chemicals (dispersed chemicals are a harder target for terrorists to successfully attack). To determine where the AHQ is a circle with a radius of 170 feet is drawn that will encompass the largest amount of storage for that chemical.

 

The total amount of chemical stored within that circle (maximum capacity for storage tanks within that circle unless they are volume limited by administrative controls) is reported in the “Quantity in AHQ” block. That quantity is then used to calculate the “Distance of Concern” for the AHQ. The RMP*Comp is used for that calculation in the same way that the Total On-Site Quantity distance of concern was calculated.
 

Every chemical that had a “Yes” block marked in the first area of the Toxic Release COI (signifying present at or above the STQ) must have an amount and distance entered in the second (Total Quantity) and third area (AHQ) of this portion of the Top Screen. It should be noted that due to the way capacity is calculated that the Total Quantity may be larger than the amount used to calculate if the STQ has been met or exceeded.

 
/* Use this with templates/template-twocol.html */