HR 3258 Analysis – Risk Based Tiers

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review HR 3258 Analysis – Protected Information HR 3258 Analysis – Employee Participation HR 3258 Analysis – Emergency Response Plans The drafters of HR 3258 copied a number of ideas from the current CFATS program. One of these was the idea of four risk based tiers, with a first tier facility having the highest risk and a fourth tier facility having the lowest risk. There is a significant difference between the two risk standards employed; the CFATS standards start with all facilities being at high-risk for terrorist attack, the §1433 standards do not use relative risk to establish that the facilities are covered. Thus, the potential range of risk measured by the four tiers at water treatment facilities is much wider for the water treatment facilities. Assignment of Tier Ranking Section 1433(d) requires that the Administrator establish regulations to assign facilities to the four tiers. Again, patterned after the CFATS regulations the section provides for the Administrator requiring facilities to provide information specifically to allow for assignment to an appropriate tier. This ‘Top Screen’ type information would probably ask for the number of people served by the facility, major industries served, the type of water-treatment regime used, and what substances of concern are found on site. This legislation only generally provides guidance on how the tier assignments will be determined. It does explain that the Administrator will consider “consider the potential consequences (such as death, injury, or serious adverse effects to human health, the environment, critical infrastructure, national security, and the national economy)” {§1433(d)(1)(B)} of an intentional act. It then goes on to specify three types of ‘intentional acts’ that will be taken into consideration:

"(i) an intentional act to cause a release, including a worst-case release, of a substance of concern at the covered water system; "(ii) an intentional act to introduce a contaminant into the drinking water supply or disrupt the safe and reliable supply of drinking water; and "(iii) an intentional act to steal, misappropriate, or misuse substances of concern."

The second type of ‘intentional act’ has nothing to do with specific substances of concern at the facility, though such chemicals could certainly be considered to be a ‘contaminant’ in concentrations higher than those allowed by other environmental laws. The inclusion of this type act is a continued acknowledgement that water treatment systems have their own particular risks beyond those found at other ‘chemical facilities’. While the term ‘intentional act’ is widely considered to be a politically correct euphemism for ‘terrorist attack’, it is not defined in the legislation. This opens up the consideration of the last type of ‘intentional act’ to potentially include anti-drug operations. Many facilities use anhydrous ammonia in their treatment process. This is a critical chemical in the illicit manufacture of methamphetamines and there have been wide spread instances at other storage facilities where the attempted theft of this chemical has resulted in the release of this toxic chemical. Explanation of Tier Assignments Another significant difference between this legislation and the CFATS regulations is that the drafters of HR 3258 are trying to avoid some of the secrecy associated with the CFATS assessments. DHS has been reluctant to discuss how it makes their tier ranking assignments, fearing that it would provide too much potential targeting information to terrorists seeking high-visibility targets. For water treatment facilities §1433(d)(2) would require the Administrator to “provide each covered water system assigned to a risk-based tier with the reasons for the tier assignment”. The information would still be protected information not subject to public disclosure, but it would provide the facility with information that could be used to lower their tier rankings. This would be especially important for facilities in the two highest tiers, since reducing the tier ranking to three or four would remove them from having to do an assessment of methods to reduce the consequences of a chemical release from an intentional act.