CFATS Reauthorization – Academic Laboratories

This is part of a continuing series of blog posts on my proposed changes to the CFATS authorization. The current authorization for the program ends on December 18^th, 2018. These posts address some of the language that I would like to see in any re-authorization bill. Earlier posts in the series include:

CFATS Reauthorization – Cybersecurity

CFATS Reauthorization – Agricultural Production Facilities

CFATS Authorization – Protection from Drones

CFATS Authorization – Excluded Facilities

A long-time reader forwarded me some information on a CFATS lobbying meeting that is scheduled for April 20^th. These meetings are not unusual, the regulated community certainly has a legitimate interest in the reauthorization process. This meeting is being hosted by the American Chemical Society and is specifically interested in addressing how the CFATS program affects research and college & university campuses.

The research community has long had concerns with the costs associated with the CFATS program and has generally been concerned that they should not be lumped into a security program with commercial manufacturing facilities. When it comes to release concern chemicals of interest (COI) the large screening threshold quantities (STQ) associated with these COI provide a reasonable dividing line that generally precludes research facilities from CFATS coverage. There may still be university or college facilities that remain under reporting requirements for release security concern COI (ammonia related cooling systems for ice rinks or chlorination facilities for pools for example), but the same risk assessment criteria and risk based performance standards should be applied to those facilities as are used for commercial facilities with the same COI.

Theft/diversion security concern COI present an entirely different problem. These chemicals include explosives, chemical warfare agents, and the precursor chemicals for the same. The much lower STQ for these COI reflect the fact that these chemicals can be used to make improvised terrorist weapons capable of much more targeted attacks. While private sector labs probably have some reasonable level of security measures in place to protect their intellectual property; that security could be expanded to include physical COI protections.

Education laboratories are a completely different story. While locks may exist on chemical storeroom doors, the relatively unsupervised flow of personnel in these settings makes it extremely difficult to establish workable security processes. That combined with a not unusual interest in ‘exciting’ chemistry like explosives by some students and you have a very complicated security situation.

With that in mind, I would like to suggest the following language

Sec. 633 – Academic Laboratories

(a) Definitions -

(1) Academic Laboratory – The term ‘academic laboratory’ means a laboratory (lab), including associated chemical storage facilities, at an educational facility. It specifically includes labs used for hands-on instruction and labs used by researchers associated with the sponsoring educational facility who also have instructional responsibilities at the institution. It does not include laboratories that have release security issue chemical of interest (COI) as listed in Appendix A, to 6 CFR 27, in excess of the STQ reported for that COI.

(2) Theft/Diversion COI – The term ‘theft/diversion COI’ mean those chemicals listed in Appendix A, to 6 CFR 27, identified as having a theft security issue

(3) Screening Threshold Quantity – The term ‘screening threshold quantity’ or ‘STQ’ means a quantity of a chemical identified in Appendix A, to 6 CFR 27, that triggers Top Screen reporting requirements under 6 CFR 27.200(b)(2).

(4) RBPS – The term ‘RBPS’ means the risk-based performance standards listed in 6 CFR 27.230;

(5) Laboratory employee – The term ‘laboratory employee’ means a paid employee (including students receiving a stipend for working in the laboratory) of the educational facility housing the academic laboratory specifically subject to the personnel surety requirements of 6 CFR 27.230(12); and

(6) Student – The term ‘student’ means a person studying at the educational facility that are not being paid for activities in the academic laboratory. Students are not subject to the personnel surety requirements of 6 CFR 27.230(12).

(b) The Secretary will:

(1) Within 180 days of adoption of this bill, publish a draft Academic Laboratory RBPS guidance document described in (c) below in the Federal Register for public comment; and

(2) Within one year of the adoption of this bill, publish a final version of the Academic Laboratory RBPS guidance document.

(c) Academic Laboratory RBPS Guidance Document – The guidance document described in (b) above will:

(1) Address all 19 of the standards outlined in 6 CFR 27.230, except those listed in (2) below;

(2) Academic Laboratories with only theft/diversion COI in excess of the STQ will be exempt from the following RBPS:

(A) Section 27.230(a)(3)(i);

(B) Section 27.230(a)(4)(i);

(C) Section 27.230(a)(4)(iii); and

(D) Section 27.230(a)(4)(iv);

(3) Specifically address the limited perimeter associated with academic laboratories, but will ensure that academic laboratories define the perimeter to include, at a minimum:

(A) The storage facilities used to store the theft/diversion COI;

(B) The laboratories where those COI are used; and

(C) The routes between (A) and (B) where the theft/diversion COI are moved;

(4) Require that a laboratory employee will be physically present in a laboratory where a theft/diversion COI is in use and students are present;

(5) Require that theft/diversion COI be stored in a locked container in a locked room when not in use and that only laboratory employees are provided unaccompanied access to the locked room where theft/diversion chemicals are stored;

(6) Require that inventories of theft/diversion COI be updated every time that the locked container in which they are stored is opened;

(7) Require that any suspected theft of a theft/diversion COI, or any inventory discrepancy of the theft/diversion chemical in excess of the published STQ for that COI, be reported to the local police; and

(8) Require that a copy of the police report for each incident described in (6) above will be:

(A) Included in the records required by 6 CFR 27.230(a)(16); and

(B) Be forwarded to DHS in fulfillment of the requirements of 6 CFR 27.230(a)(15).

(d) The Secretary will develop procedures for Academic Laboratories to request exemptions for any of the specific requirements set forth in (c) above.