This is part of a continuing series of blog posts on the public comments submitted about the DHS 60-day ICR notice for the CFATS Personnel Surety Program (PSP). The other post in the series is:
This last week of the comment period saw 17 submissions, almost exclusively from corporate sources or industry groups.
There is continued expressions of support for the provisions for allowing third-party submissions of personally identifiable information (PII). Air Liquide asks for additional details about how the third-party submitters would be identified to CSAT. GIS, a background-check provider, requests that ISCD provide a method for bulk-data submissions for third-party information providers.
48-Hour Advance Submissions
Air Liquide joins the chorus of complainers about the requirement to submit PII data on individuals 48 hour prior to their being granted unaccompanied access to critical or restricted areas of the CFATS facility. The National Association of Chemical Distributors (NACD) makes the point that there is no justification for the 48 hour submission rule if ISCD continues to refuse to notify facilities of the identification of personnel with terrorist ties. This point is clearly echoed by Rep. Thompson (D,MS) and the American Petroleum Institute (API). Allied Universal Corp. states it more bluntly: “As such, the PSP provides facilities no security value.”
The Society of Chemical Manufacturers and Affiliates (SOCMA) maintains that the possible requirement to shut down a facility because of the inability to comply with the 48-hour rule should have been addressed in the burden estimates.
PII Protection Rules
The American Coatings Association (ACA) questions whether the PSP ICR adequately addresses the various federal, state and local requirements to protect PII that will impact how facilities will collect and submit that data to DHS. The American Fuels and Petrochemical Manufacturers (AFPM) notes that this is an added burden because they are not currently required to maintain PII on contractors and visitors.
Other DHS Vetted Credentials
The ACA complains that the requirement for providing ISCD data on individuals with other TSA vetted individuals (holders of TWIC or HME for instance) defeats the purpose of using these credentials as alternatives to ISCD data submission for vetting. The Agricultural Retailers Association (ARA) maintains that “DHS should not require any further submission of information for those individuals holding federally issued credentials”.
SOCMA notes that it does not believe that DHS has the authority to compel facilities to provide information on personnel with other TSDB vetted identifications. AFPM agrees that “DHS is not authorized to impose prescriptive measures in order to comply with the performance-based rulemaking”.
The ARA supports the initial limited application of the PSP submission requirements to Tier 1 and Tier 2 facilities, noting that any future expansion to lower tiered facilities would benefit from the experiences obtained from this initial implementation.
The Edison Electric Institute complains that the ICR notice does not make it clear what employees would be covered by the PSP data submission requirement.
Inaccurate Burden Data
The API notes that the Burden Data estimates in the ICR notice are flawed because they do not rely on information already provided to ISCD via the submitted site security plans provided by all of the currently covered facilities. The American Chemistry Council estimates that the actual annualized burden costs of the PSP would be $5.22 million.
This should be the last comments on the 60-day notice. DHS-ISCD will massage these comments, make changes as they deem appropriate and then issue a 30-day notice (if they ignore the suggestions to go to a rule making instead of an ICR) sometime in the next couple of months.
I’ll be looking at a couple of the issues raised in these comments in some detail in future blog posts.