Today the Drug Enforcement Agency (DEA) published a 60-day information collection request renewal notice in the Federal Register (78 FR 76656) This notice supports the legal requirement in 21 USC §830(b) for manufacturers of certain controlled drug related chemicals and manufacturing equipment to report suspicious orders or theft/diversions of those chemicals and devices to the DEA.
Now I’m not going to start covering the DEA in addition to the other agencies that I routinely watch, but the idea or requiring this type of reporting is something that the Department of Homeland Security might want to include in the CFATS program. This would easily fall under the requirements of §27.230(a)(6); deter theft or diversion of potentially dangerous chemicals.
While the Secretary may not require a specific security measure to be part of a site security plan some sort of reporting program should obviously be part of the site security plan for any facility with a Theft/Diversion chemical of interest (COI) on site. The obvious question becomes to whom should the reports be made?
In the case of the DEA’s requirement noted above, it is obvious that the DEA would be the agency to receive the report. It is an investigative agency with law enforcement powers. That is not true of the Infrastructure Security Compliance Division (ISCD), the agency that enforces the CFATS program. Any report of a theft/diversion (suspected or obviously real) would have to be forwarded to an appropriate investigative agency like the FBI.
On the other hand there would be a benefit of having the report made through ISCD. Information shared with ISCD about such a theft/diversion could be shared as an intelligence matter with other facilities with similar COI. This could enable them to take additional or increased security measures to protect their facilities against similar actions.
Still, requiring CFATS facilities to submit such reports through ISCD could delay the start of important investigations necessary of catching the perpetrators before they have a chance to potentially employ improvised weapons made from the stolen or diverted chemicals. But, reports made to the local police or FBI are not going to get back to ISCD for forwarding to similar facilities.
What is probably necessary is to require (ah… I know, the CFATS authorization does not allow the Secretary to ‘require’) that CFATS facilities make initial reports of suspected or identified thefts or diversions of theft/diversion COI to the FBI and/or local police (in most cases a local police investigation will start faster than an FBI investigation, but the FBI is a more appropriate investigative agency of potential terrorist activities) and then submit a follow-up report with ISCD.
NOTE to Congress: This type of reporting should be required in any comprehensive chemical facility security regulations that may eventually get adopted by Congress.