EMTs and CFATS Personnel Surety

Earlier this week there was an interesting article over at NJ.com describing a situation in New Jersey where there is no requirement for Emergency Medical Technicians to have a background check to work in that State; most probably do, but it is not a requirement. The article points out some of the problems that this has caused in New Jersey, but it fails to address another serious security issue; unaccompanied access of EMTs to a high-risk chemical facility in the event of an emergency.

Background Check Requirements

When ISCD first floated their proposed rule for background checks on employees, contractors and any visitors with unaccompanied access to critical areas of high-risk chemical facilities, one of the first questions was if facilities would have to ensure that emergency response personnel would have background checks conducted by the facility. Obviously this could cause serious problems for the facility security manager and would most certainly be ignored in practice when an emergency arose at a CFATS covered facility.

ISCD addressed this in one of their frequently asked questions on their CFATS Knowledge Center web page. FAQ # 1368 (sorry there are no permanent links to FAQs; just enter the FAQ # in the search tool on the page) asks:

“Are CFATS background checks required for emergency responders prior to access to restricted areas or critical assets during emergency situations?”

The response to the question reads:

“No. During emergency situations, 6 CFR 27.230(a)(12) does not require CFATS background checks on emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets.”

There is actually nothing in the language of §27.230(a)(12) that provides that exception, but it is certainly a reasonable acknowledgement of the realities of the situation. Besides, there is a basic expectation that emergency response personnel will have undergone some level of background checks as part of their hiring process. That is almost certainly the case for law enforcement and government fire departments. From this article it is apparent that it is not necessarily the case for EMTs in New Jersey (and maybe elsewhere), and I wonder if it is the case for volunteer fire departments around the country.

Potential Risk

I do not foresee ISCD changing this interpretation of the background check requirements, but it does present some rather spectacular potential security gaps.

At a typical medical emergency at any industrial facility with relatively good security, the gate guard is notified that an ambulance is enroute. As the ambulance approaches the gate, any traffic is diverted and the ambulance is waived through with nary a thought of identifying the driver or searching the vehicle. No one would expect otherwise, fearing that they would be putting the victim at risk by delaying trained medical attention.

Now if the medical emergency was staged this would be a very good method of bringing a VBIED or a small assault force well within the security perimeter. Properly planned and executed this would be a very effective attack method.

Security Management

Facility security managers at any high-risk facility (chemical or otherwise) needs to look into the vetting of local emergency response personnel. As part of their routine coordination with law enforcement, fire, and emergency medical services, they should verify the general background check requirements for responding personnel.

It is unlikely that most departments would include a Terrorist Screening Database (TSDB) check of their personnel. As part of their re-working of the CFATS personnel surety program, ISCD should consider making such screening available to agencies supporting Tier 1 and Tier 2 facilities in the CFATS program at no cost to those agencies identified in the SVA submission of those facilities.