Tuesday, September 30, 2008

Semi-submersible Bill Passes in Congress

After the very public debate and vote on the ‘financial bailout’ legislation yesterday, the House passed a number of bills, largely by voice vote. One such bill was S 3598, the Drug Trafficking Vessel Interdiction Act of 2008. This deals with the submersible and semi-submersible craft that have been increasingly used by drug smugglers (see: “Semi-Submersibles as Terror Weapons”) to smuggle drugs into the United States from South America.


A problem that the Navy and Coast Guard have had with interdicting these vessels on the high-seas is that the crews usually scuttle the vessels before they can be seized. The crew is then rescued by the US vessel, but there is no evidence available of a crime having been committed since the drugs are on the bottom of the Caribbean or the Gulf of Mexico. This law solves that problem by making it a crime to operate a submersible or semi-submersible craft ‘without nationality’. These craft are not registered with any government so they are, by the rules of the sea, ‘without nationality’.


It would seem to me that there are countries in Latin America that would be more than willing to provide a flag of convenience to the operators of these vessels. The governments of Bolivia, Cuba and Venezuela would love to have an additional chance to thumb their noses at the American Government. It would not surprise me to hear future news stories indicating that this registration has begun.


Chemical Facility Security Implications


As I noted in my earlier blog, these vessels would be a good way of getting VBIED (vehicle born improvised explosive devices) into a high-risk chemical facility perimeter where that facility uses barges or ocean going vessels to transport chemicals in to or out of the facility.

More Reader Comments 9-29-08

Fred Millar, a long time reader and commenter, had responses to two of yesterday’s blogs about TIH rail shipments. As old readers are sure to remember, Fred has been working on the issue of re-routing hazmat rail shipments, TIH shipments in particular. That means that I was expecting some input from Fred when I wrote the two blogs.

TIH Tracking System

The first blog was about the Savi SmartChain TSS® tracking system used by Dow Chemical (see: “TIH Shipment Tracking”). Fred responded to my remarks about using the system to get rid of the requirement to placard and mark TIH rail cars. Fred noted that:


  • “Rail workers, fire chiefs, citizen watchdog groups and other also need placards to see what they are dealing with.”

This is a point that I clearly overlooked. Actually, the system that I suggested would include fire chiefs, but that does leave the two other groups. The comments that I made in my second blog on this issue (see: “Reader Comment 9-29-08”) addressing the cell phone dead zones could be used to address this issue. Train crews and yard workers could receive the low-power radio transmissions identifying TIH railcars and their status. The transmissions could be encrypted for security purposes.


Citizen Watchdog Groups


That leaves the issue of Fred’s ‘citizen watchdog groups’. If Fred is limiting this to semi-official groups like Local Emergency Response Committees (LERCs; formed under EPA regulations), then providing them with the secured receivers would certainly raise eyebrows of only the most fanatical security gurus. Unfortunately, I don’t think that Fred would be willing to limit his definition that much.


There are a number of small, vocal groups around the country that have a much more adversarial relationship with their local chemical manufacturer. While a small number are just plain radical, anti-chemical activists, the majority are responses to public relations blunders or, even outright lies and deceptions, surrounding chemical incidents. These organizations keep an eye on chemical facilities because they do not trust the companies to keep them informed of on-site incidents that have off-site impacts.


Any effort to ‘hide’ TIH shipments from groups like this by removing placards and other markings will not be met with fatalistic acceptance. The only thing that will stop this issue from further aggravating the relationships between these groups and the chemical companies is to co-opt them into the process. This is something that should probably be broached and guided by security consultants for the facility. Remember, these groups have a strong interest in preventing terrorist attacks on these local facilities.


Rerouting TIH Shipments


In his closing comment on the first blog, Fred notes that Dow has done the ultimate in re-routing a large part of their TIH rail shipments. They moved the production of their chlorine and shortened their rail shipments from 1200 miles to 400 miles. This reduction in shipping mileage along with avoiding shipping through Chicago should reduce the potential threat of terrorist attack.


In his reply to the second blog Fred takes the opportunity to excoriate the railroads for their failure to re-route TIH shipments around 60 major urban areas in the United States. Actually, Fred is very aware of the complexity involved in the re-routing issue. Because of the varying ownership of rail lines,contractual relationships, and Federal regulations it is very difficult to route these shipments around urban areas. Fred has provided a link to a Friend’s of the Earth (FOE) White Paper examining the complexities of just one such re-routing issue.

Chemical Inventories and CVI

One of the problems that high-risk chemical facilities had with the original CVI Procedure Manual was trying to determine which documents were actually CVI. That manual provided a list of documents that were always CVI {listed in 6 CFR §27.400(b)}, but the question arose about the information that was used to prepare those listed documents. When was that information CVI? The document that most often came into question was the facility chemical inventory.


Pre-existing Records


The new CVI Procedures Manual addresses this issue in section 5.2, Information Not Considered CVI (page 8). This section notes that “pre-existing records that a facility developed for its own business purposes prior to DHS determining the facility to be high-risk are not CVI”. Chemical inventories certainly meet this definition; inventory control certainly serves a business purpose completely separate from chemical facility security.


The status of most records that support listed documents change once a facility is designated a high-risk facility by DHS. The new manual goes on to say that “any such records that a facility updates or creates after DHS determines the facility to be high-risk are subject to the CVI requirements”. How does this affect inventories?


Inventory as a Special Case


Section 5.2 specifically addresses the issue of inventory control documents:


  • “If a facility possess an inventory control document indicating the possession of certain quantities of chemical that is also a chemical of interest under CFATS, that inventory control document and the information in it would not itselfbe considered CVI, even if the information in the inventory control document is later incorporated in a document (e.g. a Top Screen or Security Vulnerability Assessment) that would itself be CVI and subject to all CVI protections.”

The reason for this is that in most cases inventory reports provide information on a wide variety of chemicals (usually a mixture of COI and non-COI chemicals) in different containers and locations. Without a good understanding of local nomenclature it would be difficult for a person without access to the inventory control system to determine the amount and location of Chemicals of Interest.


Inventory Reports May be CVI


Taking all of this into consideration it is easy to see that periodic inventory control documents for most chemical facilities would not be considered CVI. While not specifically addressed in the CVI Manual it is clear that some inventory reports should be considered CVI. These would include any report that isolates and consolidates inventory data on DHS Chemicals of Interest held at the facility. This type of report would be used to prepare Top Screen or Security Vulnerability Assessment submissions.


Another exception to the general CVI exception for inventory control documents would be seen at high-risk chemical facilities that inventory only (or mainly) DHS Chemicals of Interest. These would be facilities, like propane distributors, that only deal with the sale and servicing of a single commodity chemical.


A good rule of thumb (in my opinion) for determining if an inventory report should be considered to be CVI would to look at the document and answer this question:


  • Could an outsider with minimal information about the facility determine from the report the amount or location of a DHS Chemical of Interest at the facility?

Answer ‘Yes’ and the report should be considered to be CVI. A negative answer means that the document does not need the protection accorded to CVI.

Monday, September 29, 2008

DHS FAQ Page Updates – 09-26-08

Last week there were 14 new/revised FAQ answers in three categories on the DHS CSAT FAQ web page. Most of the new FAQ dealt with the new CVI Procedures Manual issued by DHS (see: “Chemical Security Page Update 09-22-08”). The three categories for the 14 new FAQ were:


  • CFATS Regulation
  • Chemical-Terrorism Vulnerability Information
  • Web Portal Troubleshooting

None of the three questions/answers in the CFATS Regulation section of the FAQ page present any new information. In fact, the answer to a question about colleges and CFATS provides some out-dated information; it still notes that colleges and universities have 60 days from the issue of Appendix A (published last November) to request extensions for the Top Screen filing date.


Chemical-Terrorism Vulnerability Information


Because of the recent change in CVI documentation I am going to list all ten of the CVI questions and include the links to their answers. Then I will take a closer look at a couple of the answers that I find interesting.


I think that the single most important thing to take away from these 10 (all right there are only really 9 questions/answers because 1590 and 1591 were duplicates) FAQ responses is that DHS is not requiring that people who have already completed CVI training are not required to complete the training a second time. DHS certainly encourages individuals to go back and re-do the training, but they are not requiring people to do that.


The other interesting answer has to deal with reporting any of a variety of CVI ‘violations’ including:


  • Inappropriate disclosure of CVI
  • Unauthorized attempts to gain access to CVI
  • Misuse of CVI

DHS has elected not to set up a ‘special’ CVI hotline or reporting number. Instead they are going to rely on the CSAT Help Desk (866-323-2957, hours of operation 7:00 a.m. to 7:00 p.m. EDT/EST) as the point of contact for reporting such problems. This saves them from having to set up another office with the attendant staffing problems.

Web Portal Troubleshooting

The final question deals with problems of printing copies of a Top Screen submission or an SVA submission. Since the facility is required to keep copies of both of these documents as part of their CFATS files, this could be a serious problem. The solution is relatively simple; save a copy of the document using the SAVE AS command on your browser. This will save the document as a .MHT file that can be viewed at any time using your browser.

2009 DHS Appropriations Passed

The Senate voted to approve HR 2638 on Saturday by a final vote of 78-12. No amendments were made to the bill so it now goes to the President for signature. There have been no public threats of a veto and a veto is probably unlikely with the financial bailout bill under consideration.


The final version of the bill can be found at the GPO website.

Reader Comment 9-29-08

I had a quick response to today’s blog about the new technology that Dow Chemical is using to track TIH railcars. In that blog I commented that this technology might enable us to do away with placards on TIH railcars; this would reduce somewhat the risk of a terrorist attack on those cars. A sharp reader, Gablehouse, made the following comment:


  • “Only if you can be certain that rural responders can actually receive electronic notices.  We are a long ways away from reliable electronic communication for this purpose in the rural West.”

Gablehouse has a very good point, and it is not just out west that rural areas suffer less than adequate cell phone coverage. I know from personal experience that there are many places in the rural South that suffer from the same problem, though it is not as wide spread as it is in the inter-mountain west.


One possible solution would be to require TIH train cars and trucks to carry an emergency radio that would start a low-power broadcast on a selected frequency to warn first responders of leaks, pressure build-up, or even tampering with tank closures.


We need to come up with some method of removing these tank markings from TIH shipments that does not compromise first responder safety at an accident or incident. Markings like these on TIH rail cars and over the road tank wagons make it easier for potential terrorists to identify high-value targets.

HR 5577 Status Update – 9-29-08

Speaker Pelosi continues to play games with the HR 5577, the Chemical Facility Anti-Terrorism Act of 2008. She extended, twice this weekend, the time limit for the Committee on Energy and Commerce to complete its review of the bill. On Friday it was extended until Saturday. Then on Saturday it was extended until today.


Even if this bill were to be reported out of that committee today, there is little chance that the bill could pass both the House and Senate before congress adjourns sometime later this week.


If anyone can explain to me why this extension was granted, I would certainly like to hear it. There has to be something that I am missing.

TIH Shipment Tracking

Back in June I noted (see: “Hazmat Cargo Notification”) that there should be technology available to provide real-time tracking of railcars that could provide local notification of Hazmat transit. I also proposed that the same technology could be used to detect leaks and notify first responders. Well, last week Dow Chemical announced at the LogiChem Conference, that they were using a technology solution to track their toxic inhalation hazard (TIH) rail shipments that might meet those requirements.


The combination of hardware and software is provided by Savi Technology, a division of Lockheed-Martin (disclosure note, I come from an old Lockheed family. My dad worked for LMSC and my brother works at Lockheed Palmdale). The package is sold under the name Savi SmartChain Transportation Security System.


Leak Detection


The system uses a combination of technologies. GPS tracking combined with RFID, cell phone and satellite communications allows tracking the current location of the railcar. Electronic seals and intrusion detection technology allow for security monitoring. Temperature and pressure sensors can be used to monitor shipment conditions.


I was disappointed that their sales material does not specifically mention leak detection as one of the sensor packages that can be included in their system. For TIH shipments this is one of the most critical aspects of protecting people along the transportation right-of-way. Chemical sensors for TIH chemicals are readily available. I would assume that Savi Technology could readily integrate such sensors into their security package.


First Responder Notification


One thing that Savi claims that their system can do is to provide local first responders notification. “Geo-fencing capabilities that leverage satellite images enable identification of the nearest first responder in the case of an emergency or security threat.” Since their system uses both cell and satellite communication technology, it may be possible for Advanced 911 systems to receive automated cell phone calls from the railcar system for emergency notification.


It is not clear that the Savi TSS has the capability for routine notification to local law enforcement or first responders that a shipment is moving through a jurisdiction. It would seem that the advertised capabilities of their system could provide the hardware necessary for such a system. That leaves only software and coordination issues that might slow the implementation of such a notification system.


No More Placards


If all TIH railcars were equipped with technology like this we might be able to get rid of the requirement for such railcars to be placarded. Those placards make it easy for potential terrorists or criminals to identify the TIH railcars. The placards are currently required to allow first responders to identify the hazards that they would have to deal with in the event of an accident. If they were notified electronically of the location and condition of the TIH railcars, then there would no longer be a need for the visual identification provided by placards.

Friday, September 26, 2008

Senate CR Cloture Vote Scheduled for Saturday

Well the September 26th adjournment date is officially dead. Senator Reid has announced that he intends to hold a cloture vote on the HR 2638 on Saturday, the 27th. There is no word yet if there will be amendments made to the bill that was passed in the House on Wednesday. If there were no amendments an approval vote in the Senate would send the bill to President Bush and Congress could adjourn.


According to an article posted on GovExec.com there were earlier indications that Sen Reid intended to add language “retaining the current ban on producing oil shale in the West”. Amendments like this would require that the bill return to the House for re-approval, after a brief stop in a Conference Committee; there is no assurance that an oil-shale prohibition could pass in the House.


Note: A cleaned up version of the HR 2638 that was passed by the House is now available at the GPOAccess.gov web site.

New CVI Coversheet Now Printable

DHS has quietly corrected a problem with the new CVI Coversheet. The original version that I had mentioned in an earlier blog (see: “Changes to CVI Cover Sheet”) had security protections applied to the .PDF file that did not allow the Coversheet to be printed or copied to other applications for printing. The new version can be printed, but it cannot be copied into another document.


This inability to copy the Coversheet into another document is going to make it difficult to include the cover sheet in electronic versions of CVI documents as required by the new CVI Procedure Manual. You can work around this problem by printing out the Coversheet (in full color) and then scanning your printed copy. This will give you a graphics file that you can insert at the beginning of your document.


If anyone had copied the .PDF file prior to today (it was probably changed sometime yesterday afternoon) they should replace the file with the one currently on the DHS website. Since DHS still has not included a version number or date on the file the only way that you can tell if you have the ‘updated’ version of the Cover Sheet is to open the file. If you see the word (SECURED) after the file name at the top of your computer screen, then you have the old version.

Thursday, September 25, 2008

House Passes Continuing Resolution – 9-24-08

An article over on HSToday.US describes the continuing resolution bill (HR 2638) that passed last night. This is the same bill that I reported on yesterday afternoon (see: “HR 2638CR – The House Continuing Resolution Debated”). The author, Mickey McCarter, provides a good summary of the monies involved, though he does not mention anything about Chemical Facility Security.


The Senate is supposed to take up the bill today and there is no word on a possible veto. We will just have to wait and see what happens.

New CVI Manual – Introduction

As I noted in an earlier blog entry (see: “Chemical Security Page Update 09-22-08”) DHS has revised the CVI Procedures Manual. Along with the new manual there is a new, on-line CVI Training program and a number of explanatory new web pages. Additionally, DHS added nine new CVI-related questions to the CSAT FAQ web page. All in all, this is a well thought out and well explained roll-out of the new CVI procedures.


As I have done with previous DHS rules and regulations, I will try to provide a detailed analysis of the changes that DHS has made to the CVI program in a series of blogs. In this first blog I will provide an overview of the changes made to the program and provide some links to the various supporting documentation provided by DHS.


Procedure Manual Change Log


DHS has documented the changes made to the CVI procedures in the Change Log on page three of the new manual. This provides a good summary of the scope of the changes that have been made. Those changes include:


  • “Removed DHS internal procedures to make the Chemical-Terrorism Vulnerability (CVI) Procedures Manual more user-friendly.
  • “Clarified which aspects of the Manual constitute guidance and which are based on existing statutory and regulatory requirements.
  • “Removed the requirements that individuals enter into non-disclosure agreements (NDAs), whether in the course of completing CVI on-line training or otherwise, to obtain access to CVI. This includes any prior requirements for an NDA as a condition for sharing CVI with third parties. DHS reserves the right under 6 CFR § 27.400(e)(2)(iii) to require NDA’s in the future, as appropriate.
  • “Replaced the previous suggested models for access and disclosure of CVI within and between private and public entities with new, more effective models.
  • “Eliminated the concept of CVI Tracking Numbers.
  • “Clarified the meaning of “need to know”.
  • “Provide greater details about what information is and is not considered CVI.
  • “Clarified that DHS does not need to be notified when CVI is properly disclosed to Authorized Users with a need to know.
  • “Updated CVI Cover Page.”

Chemical Security Web Page


DHS has provided a number of web pages that help to explain some of the changes made in the CVI program. Links to these pages can be found on the Critical Infrastructure – Chemical Security Web page. That page, under its ‘What’s New’ heading provides the following explanation of the importance of the changes:


  • “The Department of Homeland Security has revised the Chemical-terrorism Vulnerability (CVI) Information Procedures Manual and the CVI Authorized User Training. The revisions take into account feedback from the private sector and the experience gained since implementing Chemical Facility Anti-Terrorism Standards (CFATS) in April2007.
  • “Individuals in the private and public sectors impacted by CFATS as well as currently CVI Authorized Users are encouraged to review the changes and complete the updated training.
  • “Covered facilities that have been determined to be high risk by DHS must complete and submit a Security Vulnerability Assessment (SVA). All Chemical Secerity Assessment Tool (CSAT) Users must be CVI Authorized before being allowed to access the SVA.
  • “Become a CVI Authorized User by completing the CVI Training.”

CVI Web Pages


The Chemical Security web page provides a link to a CVI information portal, the Chemical-terrorism Vulnerability Information page. That page provides links to seven additional pages that explain various parts of the CVI program. Those pages are:


 In future blogs I will look at some of this information in greater detail.

Wednesday, September 24, 2008

HR 2638CR – The House Continuing Resolution Debated

Yesterday the House Rules Committee reported HR 2638 CR, the House version of the proposed continuing resolution for funding the US Government for the first part of FY 2009. This is HR 2638 was originally the 2008 DHS appropriations bill that was supplanted by ‘Omnibus Appropriations Bill’ in December of last year. The entire text of the original bill was replaced by the new wording and the title was changed to the Consolidated Security, Disaster Assistance, and Continuing Appropriations Act, 2009.


Division D of the bill (pages 194 – 291) looks to be pretty much the House 2009 DHS Appropriations Bill (HR 6947) though I cannot claim to have made a detailed comparison of the two documents. I have looked at all of the Section 500 ‘add-ons’ and none of them directly affect the chemical facility security community.


As I post this blog entry, the House is conducting a one hour debate of HR 2638.

Update on Possible Continuing Resolution 9-24-08

There was an interesting article on CQPolitics.Com about some of the things that people were talking about adding into a continuing resolution. While a CR should be a fairly clean piece of legislation, there is a lot of unfinished business on the legislative calendar that might get added on. Plus, of course, the usual pork programs used to buy the necessary votes to potentially overturn a possible Bush veto.


According to the article there is even talk of including the complete 2009 appropriations for both Defense and Homeland Security in the CR. The negotiations to get those two sets of legislation complete (there are separate and different House and Senate bills for both of those departments) will certainly go on behind closed doors. If that happens, there is no telling what will come to the floor.


If the Democrats are going to succeed in their plan to adjourn for the year on Friday, they are going to have to give Bush some good reason not to veto the resolution. Even if they have an apparently veto proof margin on the first go round, President can keep things interesting by holding up his veto until Monday or Tuesday. That situation would probably force a clean CR with a mid-November expiration date with a lame duck Congress coming back to town to deal with the budget.


Between the election campaign, the financial system melt-down, and now the broke budget process, this is certainly going to be an interesting month or two.

Tuesday, September 23, 2008

Update on Possible Continuing Resolution 9-23-08

I ran across a brief article on GovExec.Com about a ‘discussion draft’ of a possible continuing resolution be circulated in the House. The resolution would continue the 2008 funding formulas through March 6, 2009. That would give the new Congress about a month and a half to get the 2009 budget passed. According to the article, which originally appeared in the National Journal”


  • “House Democratic leaders are looking to pass a continuing resolution that will fund the federal government until March 6, when a new president and Congress are installed rather than deal with President Bush, who has threatened to veto any appropriations bills that spend more than he has recommended.”

I have looked through the discussion draft and see nothing of specific interest to the chemical facility security community.

Changes to CVI Cover Sheet

Yesterday (see: “Chemical Security Page Update 09-22-08”) I noted that DHS had revised their Chemical-Terrorism Vulnerability Information (CVI) procedure manual. As part of that revision there has been a substantial revision of the CVI cover sheet that is used to ‘protect’ CVI documents. Facilities should replace all current cover sheets with the new version as the document security rules listed on the new version have changed substantially.


The old cover sheet was marked as version 1.0 with an effective date of 06/2007; the new form on the DHS web site does not have a version number or effective date. This lack of version/date is probably an over site. I’ll watch the DHS web site to see if a ‘new’ version makes it to the site.


There are five sections of information on the Cover Sheet. There have been changes made in each of the five sections; some were significant others were simply editorial. Those sections are:


  • Warning
  • Access
  • Handling
  • Sanitized Products
  • Derivative Products

Cover Sheet Warning


At the top of the Cover Sheet is a warning about the legal requirements for protecting CVI. The wording on both pages is identical. The only difference between the two is the final statement; on the old form the warning was printed in red, it is in black on the new form. That statement reads:


  • “By reviewing this cover sheet and accepting the attached CVI you are agreeing to abide by the guidance contained herein. Your acceptance provides immediate access only to the attached CVI.”

Access Information


This section details the requirements for providing document access to others. The old Cover Sheet had some fairly detailed requirements, including the following list:


  • “Government officials and contractors must be covered by a Memorandum of Agreement signed with the Chemical Security Compliance Division
  • “All individuals must complete CVI Authorized User Training
  • “All individuals must demonstrate a valid need-to-know for specific CVI. For state and local officials this determination will be made by the state CVI Security Officer”

The new Cover Sheet has reduced the complexity of the requirements. The list now reads:


  • “All individuals must be CVI Authorized Users.
  • “All individuals must demonstrate a valid need-to-know for specific CVI”

Handling Information


Most of the changes made to the Handling section of the Cover Sheet are editorial in nature; word and phrasing changes rather that requirement changes. The one exception to that is found under the Transmission heading. The old Transmission information read:


  • “You may transmit CVI by the following means to an eligible individual who meets the access requirements listed above. In all cases, the recipient must accept the terms for Non-Disclosure Agreement before being given access to CVI”

The new information is simplified and all references to an NDA are removed. The new Transmission information reads:


  • “You may transmit CVI by the following means to a CVI Authorized User with a need to know.”

Sanitized Product Information


From time to time it may be necessary to take information from a CVI document and convert it into a form that may be shared with personnel that are not Authorized Users or have a need-to-know. The procedure of cleaning up that information is known as ‘sanitizing’. The old Cover Sheet laid out the following requirements for the sanitizing process; nothing can be disclosed that:


  • “Is proprietary, business sensitive, or trade secret;
  • “Relates specifically to, or identifies the submitting person or entity (explicitly or implicitly); and
  • “Is otherwise not appropriately found in the public domain.”

The new Cover Sheet has some substantial differences. The new Cover Sheet says that nothing can be disclosed that:


  • “Exposes vulnerabilities of identifiable critical infrastructure or protected systems of a facility;
  • “Is proprietary, business sensitive, or trade secret;
  • “Relates specifically to the submitting person or entity (explicitly or implicitly).”

Derivative Products Information


Anytime that CVI information is taken from one document and included in a second, the second document becomes CVI as well. The second document derives its CVI status from the first; it becomes a derivative product. There are only two differences between the old and new Cover Sheets in the Derivative section of the cover sheet.


First the following statement was not included in the new Cover Sheet:


  • “The CVI Tracking Number(s) of the source document(s) must be included on the derivatively created document in the form of an endnote.”

Additionally the blank for recording the CVI Tracking Number was removed from the bottom of the new Cover Sheet.


What These Changes Mean


Reviewing the actual changes to the CVI program that are embodied in the new procedure manual will take some additional time. The changes that we can quickly see in the CVI Cover Sheet seem to indicate that DHS is loosening up some of the structure surrounding the handling of CVI, at least at the facility level. I’ll look at the changes to the CVI manual in future blogs and we will see how accurate that perception is.

House Appropriations for DHS – Additional Information

I finally got a chance to do a detailed review of House Report 110-862, the Appropriations Committee Report on HR 6947. This report provides a little more data on the actual funding amounts going into the DHS Appropriations Bill. It also provides some of the justification for the differences between the amount appropriated and the amount the Administration requested.


There are three areas in the report that I think might be of interest to the chemical facility security community. They deal with staffing at the NPPD, funding for CFATS implementation and this year’s new ‘twist’, ethanol transloading facilities.


Staffing Levels for NPPD


The National Protection and Programs Directorate (NPPD) includes, among other divisions, the Infrastructure Security Compliance division, which implements the Department’s chemical facility anti-terrorism standards. The Committee was less than impressed with the ability of the NPPD to fill positions over the last year or two. It reduced by half (page 96) the amount of money ($2.5M vs $5M) allocated for Management and Administration staffing growth.


It appears that this is a headquarters staffing issue, not enforcement. However, anyone that has ever worked at any government job knows that the necessary work at HQ gets done. If bodies have to be pulled up from the line to get it done, so be it. The headcount stays where it ‘belongs’ but the bodies go where they are needed.


CFATS and Ammonium Nitrate


The Appropriations Committed notes that “the number of locations subject to chemical facility regulations is higher than estimated in original DHS plans”. As a result the Committee has increased the money appropriated (page 97) for CFATS implementation by $12M. The Committee also noted that the Ammonium Nitrate program included in last years ‘Omnibus Spending Bill’ was put their too late for DHS to take that program into account in their 2009 budget request. The Committee is adding $5M for the first year of that program.


The increase for CFATS implementation will probably be used for funding additional inspector positions and perhaps some additional field offices. Since we have yet to see the proposed rule for the ammonium nitrate regulations (which was due in June) it is hard to tell if the $5M for that program is adequate.


Ethanol Transloading Facilities


The ‘new twist’ for this year’s legislation is the inclusion of a section (page 98) on vulnerability assessments for ethanol transloading facilities. The Committee gives DHS 90 days to report back to the Appropriations Committee on a vulnerability assessment that DHS is conducting for one such facility (unidentified in the report) in Virginia.


While no regulatory requirements are included in this ‘new twist’ it does signal that at least some influential people in Congress are interested in the security at a new class of chemical facilities. This may indicate that these facilities will be the next to be added to the CFATS umbrella, either by Congressional direction or by Secretarial rule making in the new administration.


There is currently little or no pipeline capability for ethanol distribution either as denatured (contaminated with gasoline to avoid diversion to human consumption) ethanol or various gasoline/alcohol blends (E10 to E85). This means that most long distance distribution is by rail. Much of this rail distribution ends at small transloading facilities where the ethanol is transferred to trucks for distribution to ‘local’ fuel blending facilities.


Many of these transloading facilities are little more than a rail siding in a small town with a pump shack and a hard-pan parking pad for the trucks. In many cases the facilities are not even fenced. Security consists of locks on valves to prevent thefts with little or no concern for potential terrorist attacks.


It will be interesting to see what the DHS vulnerability study comes up with. The CFATS regulations do not address ethanol (it is not explosive enough for a release-flammable COI) or its gasoline blends. In fact it is not clear that the ethanol content in a gasohol blend even has to be counted in the fuel reports on Top Screens, since it is not gasoline, diesel, kerosene or jet fuel.


I doubt that these would be much of an al Qaeda target, but homegrown terrorists of various ilk may find them a very tempting target. It produces a fire that is difficult to fight without the appropriate foam; water/ethanol mixtures actually burn. The flames are difficult to see and that makes the fire more difficult to contain. And besides, it is taking food out of the mouths of starving poor people the world over.


Legislative Prospects


There is still no more word about the prospects of this passing this week or if Reid and Pelosi will change their minds about calling Congress back after the election. The big news this week is with the financial market bailout. That may force the Democratic leadership to bring Congress back for a lame duck session.

Monday, September 22, 2008

National Infrastructure Advisory Committee Meeting 10-14-08

The Department of Homeland Security posted a notice in Friday’s Federal Register that the National Infrastructure Advisory Committee (NIAC) will be conducting a public meeting on October 14th, 2008. While the public is invited to attend, only committee members and personnel specifically invited to speak will be allowed to participate in the discussions.


According to the notice:


  • “The October 14, 2008 meeting will include a final report from the Critical Partnership Strategic Assessment Working Group and a status report from the Frameworks for Dealing With Disasters and Related Interdependencies Working Group.”

Homeland Security Subcommittee Meeting 09-24-08

The House Homeland Security Committee announced that it’s Subcommittee on Intelligence, Information Sharing and Terrorism Risk Assessment would be holding a hearing on 09-24-08. The hearing is entitled “A Report Card on Homeland Security Information Sharing”.


The following witnesses are currently scheduled:


  • Charles E. Allen, Under Secretary for Intelligence and Analysis, DHS
  • Michael E. Leiter, Director, National Counterterrorism Center
  • Leroy D. Baca, Sheriff, Los Angeles County Sherriff’s Department
  • Russell Porter, Director, Iowa Intelligence Fusion Center and Intelligence Bureau, DPS
  • John McKay, Professor from Practice, Seattle University School of Law

Information Sharing and Chemical Facilities


I would be very surprised if any of the witnesses directly addressed DHS information sharing with high-risk chemical facilities. To the best of my knowledge all that anyone could say is that there isn’t any information sharing. If I were a committee member I would certainly like to ask Secretary Allen and Director Leiter what plans the department had for developing and sharing intelligence information for and with high-risk chemical facilities.


Any vulnerability assessment or security plan can not be optimized without understanding the threat facing the facility. Most high-risk chemical facilities are not large enough to be able justify an intelligence collection and analysis operation. These facilities must be able to rely on federal, state and local security and law enforcement agencies for that intelligence assessment. Unfortunately no one seems to have thought of that.

Chemical Security Page Update 09-22-08

Well DHS has been busy. There is a revised Chemical Security webpage. It announces the changes that DHS has made to the CVI program. All of the CVI web pages have also been changed (updated is hardly the word) as has the CVI training program and the CVI Procedure Manual.


If you have not already started your SVA submission, I doubt that you will be able to get started unless you have completed the new training program. It is not clear how that will affect facilities already at work on their SVA on-line.


Much too much changed for me to have conducted a serious review yet. There will be more in a future blog.

DHS FAQ Page Update – 09-19-08

There was only one new FAQ question on the DHS CSAT FAQ Page; it was listed under the ‘Geocoding’ heading. The question was


  • 1584: My latitude/longitude shown on my SVA do not match the latitude/longitude I see on my submitted Top Screen report. Do I need to change it and how do I do that?



When DHS makes their tiering decision they looked at the effects of a successful attack on the surrounding community. They use Landscan data to determine the population at risk. To do that accurately they need an accurate location for the facility location. To insure that the latitude and longitude data was accurate they went back and independantly verified that data based on the facility address. The latitude and longitude reported on the SVA notification letter is the location that DHS used to evaluate the Top Screen data.


This is the reason that DHS is so concerned about the latitude and longitude. Their answer to the question shows this;


  • “If you feel that the latitude/longitude for your facility is incorrect, please examine the address listed for the facility.  It should represent the physical address of the facility, not the mailing address.  The latitude and longitude will be verified against the address and must match; adjustments may have been made to the latitude/longitude as a result of that verification process.  If your address is incorrect, please correct it before requesting a latitude/longitude change.  If you still feel that the latitude/longitude for your facility is incorrect after examining the address information, please request a change in the latitude/longitude from the Help Desk.”

Saturday, September 20, 2008

HR 6947 Review

Well I have now had a chance to review the ‘reported’ version of HR 6947, the DHS appropriations bill for 2009. As we saw in the Senate version, S 3181, (see: “S 3181 – Senate DHS Appropriations Bill 2009”) there are no ‘general’ provisions in the House bill that would add any programs or requirements to the current Chemical Facility Anti-Terrorism Standards (CFATS).


While it is ‘early’ (adjournment is still expected on September 26th as far as I know) in the appropriations process I still expected to see some sort of add-on to CFATS. Both bills have a way to go so I expect that anything is still possible.




Since there are two separate and different bills in the Senate and the House, once the two bills are passed by their respective legislative body the two bills will go to Conference. The differences will be worked out there. The final combined bill will then go back to the House and Senate for a final vote.


I have heard nothing further about the threat of a presidential veto of a continuing resolution (see: “New Appropriations News”) nor have I heard much recently about a continuing resolution in general. As far as I know the House and Senate still plan on adjourning on September 26th. The Democratic leadership in both bodies had wanted to get a DHS budget passed for electioneering reasons. It is now possible that that could happen by Friday.


I would not be surprised to see a Conference report late Thursday that was not published at the GPO (online where I find my copies) until after a final vote on Friday. I’m not predicting any collusion; it just takes time for the GPO to get the documents properly set up and put online. That final document is where I really expect to see section 500 add-ons that have become so dependable.


Remember, we have a number of bills that have passed in the House (see: “House Passes HR 4806 and HR 6193”) that Chairman Thompson has vowed to get added to the appropriations bill during conference. Since he is the Chairman of the Homeland Security Committee, he will have an important voice in that conference, though not necessarily the most important.


A Busy Week Ahead


The final week of any legislative session is always busy and hard to keep track of. With the presidential and congressional campaigns in full flower there will be a number of high-profile votes. Unfortunately the DHS Appropriations bill, and especially the chemical security portion of that, does not fit in that category this year. We’ll just have to keep eyes and ears opened.

Friday, September 19, 2008

House DHS Appropriations Bill

Stop the Presses. Well that’s not really appropriate for a blog but you might get the idea when I say that the House Appropriations Committee has finally reported their DHS appropriations bill. The bill number is HR 6947 and the report is House Report 110-862. I’ll have a more complete report later this weekend. Maybe we will get a DHS appropriations bill passed during the session.

Tags: , ,

DHS Contract Inspectors

Brandon Williams asked me a question in a recent email about whether or not contract inspectors are authorized. He based this question on (and sent me a copy of) an article from the Federal Lawyer (June 2008, pages 41 – 47). It was written by James W. Conrad Jr. and provides a very good summary of how we got to CFATS, a brief summary of the CFATS provisions and a discussion of HR 5577 and HR 5533.


Before answering Brandon’s question I have to say that I thoroughly enjoyed Conrad’s article. I highly recommend this article to anyone that is connected with security at high-risk chemical facilities. It should be required reading for all Security Managers and Facility Managers. It is written by a lawyer who knows how to write so that non-lawyers can understand; a rare talent in my opinion.


Are Contractors Authorized?


Brandon called my attention to a specific statement made in the article; “As a result, DHS has raised the prospect of a future rulemaking to authorize the use of third-party auditors to conduct inspections.” He wanted to know if these third-party auditors (contractors) were authorized under CFATS. The short answer is no, there are no provisions in CFATS for DHS using contractors. That is why Conrad noted the ‘prospect of future rulemaking’.


The more important question would be if contractors were allowed under the Section 550 authorization for CFATS. This is what would control the legal ability of the Secretary of DHS to implement a rule authorizing the use of contract inspectors. The wording in Section 550 does not specifically provide for contractors, but the wording is so wide open that it seems to me that the Secretary could certainly proceed with such a rule making procedure. It is almost certainly too late for Secretary Chertoff to do so (President Bush has reportedly prohibited the wholesale publishing of new rules so common at the ends of recent administrations), but the next Secretary of DHS could publish such a rule.


Legal Standing of Contractors


Brandon noted that the teams from the Commerce Department that support the Chemical Weapons Convention inspections only use government inspectors to avoid non-disclosure issues and authority issues for suggestions made by contractors. He wondered if the same issues would not affect the efficacy of CFATS contract inspectors.


While I have undergone two CWC inspections (10+ years ago) I am not familiar enough with the regulations to comment on why they decided not to use contract inspectors. The problems that Brandon identified are real legal problems that must be addressed before such contractors enter the first facility. The ‘third party’ provisions of HR 5577 specifically addressed each of these as well as requirements for liability insurance.


Regulations issued by DHS could address the same issues and that should be legally sufficient. Legal sufficiency is not always enough. There would certainly be some facilities where management or owners were not confident that mere regulations were sufficient to protect their interests. Without specific authorizing language in legislation there will certainly be attempts to prevent contractor inspections through law suits.


Training and Supervision Issues


The legal issues are relatively easy to solve. It is ‘merely’ a matter of putting the right words in the right order to cover the legal requirements. It is much more difficult to deal with the training and supervision of contract inspectors. Especially if the Department uses a large number of companies for this purpose as is envisioned in HR 5577. As I noted in an earlier blog (see: “Third Party Entities under HR 5577”) the proposed legislation requires that:


  • DHS contractors and sub-contractors come from a wide variety of selected small business and disadvantage business concerns. Among those specifically mentioned are businesses ‘owned and controlled’ by service disable veterans, ‘HubZone’ businesses, and ‘socially and economically disadvantaged’ small businesses. Black, Hispanic and Tribal colleges and universities are also included.”

This means that the training of the individual inspectors is going to be uneven at best. Even if DHS were to prepare and present a centralized training course for all of the contractors the training issue would still exist. Training for this type of position will not be a one-time event. It will have to be on-going and continuous. Multiple contractors and sub-contractors will make it difficult to ensure that training makes it way down to all inspectors in a timely manner.


If inspectors are actually sub-contractors, then the legal requirements for limiting training and supervision will make it even more difficult. Various tax and legal requirements for employing contractors delineate the amount of training and supervision that separates a ‘contractor’ from an employee. Companies violating these requirements can be held responsible for all sorts of additional payroll costs and other legal liabilities.


Multiple levels of contractors and subcontractors will make the supervision and control of inspectors much more difficult, even if the actual inspectors are employees. Each company will have a different background and area of expertise. Some will come from a law enforcement background, others will be from a security equipment background, while still others will be from more of a chemical safety background. These varied backgrounds with their different outlooks and management styles will make it difficult to maintain a common message and enforcement style.


Future of Contract Inspectors


As I have mentioned in an earlier blog (see: “DHS Inspections: Contract Inspectors”) there are a number of viable reasons for DHS to use contract inspectors. If DHS does use contract inspectors, they are going to have to be careful to address these issues. One thing that they are going to have to ensure is that each inspector is actually an employee of someone. This is the only way that they are going to be able to insure adequate ‘command and control’ of the inspection force.

Thursday, September 18, 2008

A New Cold War and Chemical Facility Security

There was an interesting article posted yesterday on StratFor.Com discussing some of the potential implications Russia’s recent confrontational tactics. The authors, Fred Burton and Scott Stewart, believe that recent Russian actions under Putin’s leadership foretell a reemergence of the Cold War between the United States and Russia. They then look at some of the potential consequences of that change in geopolitics.


Return of Proxy Warfare


Burton and Stewart point out that one of the key components of the conflict between the old Soviet Union and the United States was the use of proxies around the world to substitute for direct conflict between the two superpowers. Instead of directly fighting one another, and risking certain global nuclear destruction, both sides used a variety of allied nations and political groups to undermine the other side’s control of portions of their respective ‘spheres of influence’.


The authors point out that Putin was active in the KGB and that agency was the conduit for control of the Soviet Union’s proxy forces. They note that it must be assumed that Putin understands that type of conflict management and knows how it can be used to undermine the United States without the threat of direct involvement of the Russian government. For that reason they expect a resurgence of Russian support for many of the radical movements around the world.


Change in Russian Ideology


The demise of the Communist Party in Russia means that the in a modern Cold War, Russia will no longer have to rely on leftist radicals for the foot soldiers in their proxy war. At the authors note:


  • “Another consideration is that ideological change in Russia could mean Moscow will reach out to radical groups that the KGB traditionally did not deal with. While many KGB officers didn’t completely buy in to communist ideology, the Communist credo did serve as both a point of attraction and a limiting factor in terms of whom the Soviets dealt with. Since the Russian state is no longer bound by Soviet ideology — it is really all about power and profit these days — that constraint is gone. The Russians are now free to deal with a lot of people and do a lot of things they could not do in Soviet times.”

They note, for example, that: “former Ku Klux Klan leader David Duke is very popular in Moscow and very well-connected there, as are a number of other American white nationalists”. Those connections combined with the increased activity of the Russian Mafia (with many old ties to the KGB) in the United States may mean an increase in violent actions against the American government and civilian targets.


Potential Chemical Facility Targets


While the authors do not extend their discussion to potential target selection in the United States, it does not take much of a crystal ball to see that many chemical facilities could be used as weapons in a white supremacist war against minorities in this country. Many people have pointed out that a significant number of high-risk chemical facilities are located in or near minority neighborhoods. A series large scale toxic-chemical releases or chemical conflagrations in or around such neighborhoods would directly harm the targets of the skin heads’ anger. Such attacks would also politically destabilize large portions of the urban population.


Petrochemical facilities would be another potential target for Russian-backed terrorists. In this case the Russian incentive would be more economic than political. As we have seen in the last couple of years a disruption of petrochemical production tends to increase the price of oil. Since the Russian Federation is now a major producer/exporter of oil and natural gas, artificially high energy prices would increase the hard currency reserves of that country. Remember (Putin certainly will), it was the shortage of such currency reserves that was ultimately the downfall of the old Soviet Union.


The Way Forward


Burton and Stewart note that:


  • “In this new-old front, the Russian SVR’s activities will need to be studied carefully. Militant arms caches and ordnance used in attacks will need to be carefully reviewed for potential links to Russia, and potential militant training camps will need to be watched. Doing so will require quite a bit of adjustment for the U.S. intelligence community, which has spent so much effort over the past seven years focusing on the jihadist threat.”

The chemical community will also have to adjust their security outlook to include potential attacks by others than just Al Qaeda and their ilk. The rise of a new Russian-American Cold War could also increase the threat against high-risk chemical facilities within the United States.

/* Use this with templates/template-twocol.html */