Updates on Chemical Safety and Security WG – 09-27-13

While there still haven’t been any real public comments on the progress being made by the Chemical Safety and Security Working Group, I am hearing some unofficial information about the current status of the implementation of the President’s executive order (EO 13650).

Interagency Pilot Program

It still seems as if the most progress is being made on a program that was actually started before the EO was signed. The Effective Chemical Risk Management Project (ECRM2) is underway in the New York – New Jersey area and includes a variety of State, local and federal agencies trying to coordinate chemical safety and chemical security programs in that area. A couple of group meetings have been held and a variety of working groups established.

I’m hearing that the group, rather than trying to create a program out of whole cloth, is trying to leverage the Local Emergency Planning Committee (LEPC) structure already mandated under the EPAs Emergency Planning and Community Right-to-Know Act (EPCRA)[Updated 9-27-13, 12:20 CDT, in response to reader comment - see below]. Now I’ve commented on the short comings of the LEPC program a couple of times and the ECRM2 project seems to be running into some of the inherent problems with that program.

The EPCRA [Updated 9-27-13, 12:20 CDT, in response to reader comment - see below] program calls for the States to establish the LEPCs and only gives the broadest guidelines of how those committees are to be established and operated. Most importantly from my perspective is that there is no federal funding of these groups and no federal oversight. This means that there are 50 (or more) different implementations of the LEPC structure with varying degrees of effectiveness.

The differences between the two programs in New York and New Jersey give a good perspective on this, especially when the ECRM2 is trying to overlay a new federal working group structure on top of the existing structure. In New York the LEPCs are run at the county level and are more closely controlled by the State so there is a certain level of homogeneity in the local programs. New Jersey takes more of a home-rule approach where the LEPCs are organized at the county, city or even neighborhood level and there is very little supervision. This leads to a wide variety of organizations and the effectiveness depends mainly on the drive of local personalities (a very common problem with the LEPC program).

If the ECRM2 is able to come up with a coordinated federal, State and local program that can be overlaid on these two different styles of LEPCs, they should be able to expand the program to a national level. I wish them the best of luck.

Working Group Progress

The Working Group and its sub-groups continue to slog away at the various problems set before them by the President. The biggest problem that they appear to be facing is the short deadlines included in the EO. As the various deadlines approach there is going to be more of distractive debate whether the Working Group should spend time ginning up some sort of report that ‘meets the deadline’ but doesn’t really accomplish anything or whether they should bite the bullet and tell the President, and the public, that they need more time to get something worthwhile done.

This is the same problem that NIST is going to face in a couple of weeks. Their October 10^th deadline to have a Preliminary Cybersecurity Framework published in the Federal Register is fast approaching. The work of the 4^th Workshop, by all reports, didn’t get them close enough to have a real document ready for the printers by that deadline. If the recently announced 5^th Workshop is really an effort to get the document into publication shape, then NIST will miss the deadline, but will have a better chance of having a workable Framework. I’m afraid, however, that this will just be a public meeting to try to fix a poorly prepared, but on-time document.

It will be interesting to see how the Working Group responds to this problem. I’m hoping that the lack of a public report on the ECRM2 project is a sign that the Working Group is waiting for concrete results instead of just going for the empty-accomplishment announcement route.

I will suggest to the Working Group, though, a lesson I’ve learned in a long professional life. If you have to miss a deadline, tell your boss (the President and the Public in this case) about it in advance with an explanation of what the problems are. The complaints and threats are not nearly as bad that way.