All Hazards CFATS and EPA-OSHA Inspections

OSHA and EPA both have active responsibility for overseeing various aspects of chemical safety regulation of high-risk chemical facilities. Readers of this blog should be well aware of my belief that neither organization does enough to actively promote and inspect those programs to ensure that they are being adequately complied with at these facilities. It is certainly not due to any malfeasance on the part of these two organizations, it is mainly due to the lack of funding for an adequate and effective inspection force by Congress. Most effective inspections by these two Federal agencies are made only when there is a chemical release or on-site injury or death.

Effective implementation of the chemical safety programs mandated under OSHA and EPA rules will actively support chemical security programs covered under the CFATS rules. It might make a certain amount of sense to include inspection of the process safety programs as part of the SSP inspection process. The only real question is who should inspect process safety, DHS or OSHA/EPA.

OSHA/EPA Inspection

The most obvious answer is that the agencies mandating the program specifics should be the ones doing the inspections. They have the people that are fully trained to look at the process safety programs. Each of the two agencies could temporarily attach an inspector to each of the DHS CFATS teams. They would accompany the DHS team during the site security plan assessment inspection for any facility that was required to have either an OSHA or EPA mandated process safety program. They would look at the covered processes to ensure that the safety programs were being complied with.

This would serve three mutually supporting objectives. First it would provide these two organizations a chance to do a detailed pre-emptive inspection of their respective safety programs at facilities that were at high-risk of having a significant off-site impact. Second it would allow the government to assess how disparate process safety and facility security programs interacted in a real world environment; this would be invaluable information for Congress to have for their consideration in updating the requirements for these three separate yet interlocking programs. Lastly, it would provide on-site expertise that could help the site-security inspectors understand the potential processes hazards that would impact susceptibility for off-site impacts during a successful terrorist attack.

ISCD Process Safety Inspection

Since neither OSHA or EPA apparently have enough inspectors on staff to be able to complete the type of routine inspections necessary to ensure that covered facilities are actually complying with the letter and spirit of the process safety rules currently on the books, they probably don’t have enough inspectors available to attach to DHS inspection teams. This means that the Chemical Facility Security Inspectors (CFSI) from DHS-ISCD would be the more likely candidates to look at the facility’s process safety efforts.

To be fair to the DHS folks, they already have their hands full looking at security issues, so we wouldn’t expect them to do a full scale process safety inspection. But, it would be fully within their security mandate to take enough of a look at the facility process safety program to gain a better understanding of how the safety efforts tie into the security aspects.

Of course this would mean that at least one member from each CFSI team would have to have detailed training on the process safety programs run by OSHA and EPA. Certainly those organizations could provide enough personnel to provide such instruction as part of the curriculum at the Chemical Security Academy.

Of course the inspections done by CFSI would probably not be turned over to OHSA or EPA since they would be covered by Chemical-Terrorism Vulnerability Information (CVI) rules. The other two Federal agencies would have a hard time demonstrating a need-to-know necessary to get access to the data. I mean, if they really did have a need-to-know then they would have had their inspectors collecting the data.

Process Safety and Security

What sorts of process safety information (PSI) would the DHS CFSI need to know about to allow them to do their security inspections? For facilities with release COI, any PSI relating to the prevention of a chemical release would have a bearing on the security plan. For example, a key component of the process safety efforts at covered facilities is the detailed review of how covered chemicals are stored and used.

Where highly hazardous chemicals (most of which are DHS COI) are stored on-site, there have to be systems in place to prevent releases and mitigate releases that do occur. Systems that prevent releases would have to be overcome in any successful terrorist attack, so they should be considered, at least in part, to be part of the security apparatus for that facility. Similarly, damage to those systems might be a method of attack that could be used in a successful attack.

Process safety tools used to monitor the storage of highly hazardous chemicals could also be invaluable tools for the security people to monitor to ensure that they can monitor the progress or success of a potential terrorist attack. It would also allow them to detect an attack more subtle than vehicular borne improvised explosive devices (VBIED) or an armed assault.

Automated process safety systems are typically stand alone computer systems kept separate from process control systems. Since disruptions to the process safety systems could cause the same type of catastrophic chemical releases desired by successful terrorists preventing attacks on these systems is just as important as preventing attacks on the process control system.

Similarly the detailed review of production processes that use or produce highly hazardous chemical are required to identify the process upsets that could result in the catastrophic results that would be so desirable from the point of view of the terrorist attacker. Once again, the equipment, processes and procedures put into place by the process safety program to prevent these catastrophes should again be included as part of the chemical security program for the facility.

Expanding Chemical Security

From this limited look at the processes safety information that should be available to OSHA and EPA trained investigators we can see that large portions of the facility process safety efforts will have implications for facility security inspections. Ensuring that process safety information is available to CFSI and that those inspectors have the training and tools necessary to evaluate that information is critical to the type of in depth security inspections envisioned under the CFATS program.

Whether the expertise is made available through the attachment of chemical safety inspectors to the chemical security teams or whether the CFSI get at least minimal training in the evaluation of PSI is a subject to be judged at the highest levels of the Executive Branch. But one of the options needs to be implemented to ensure that a truly comprehensive evaluation of the chemical security program of these high-risk facilities is made.