30 Day CFATS PSP ICR – Positive Match

This is part of an ongoing series of blog posts about the recently published 30-day information collection request (ICR) published in the Federal Register by DHS. This ICR would support the long overdue personnel surety program requirements for the Chemical Facility Anti-Terrorism Standards (CFATS) program. Earlier posts in the series include:

30 Day CFATS PSP ICR Published

30 Day CFATS PSP ICR – Three Options

One of the controversial issues in the PSP has been the DHS response to positive matches against the Terrorist Screening Database (TSDB). Industry has long expected that DHS would immediately notify them if any of the names that were submitted to the CFATS PSP returned a positive match against the TSDB. That is not, however, the Department’s stance. They have consistently stated that:

Regardless of the option, in the event that there is a potential match, the Department has procedures in place that it will follow to resolve the match and coordinate with appropriate law enforcement entities as necessary.

Information Release Controlled by Law Enforcement

In the earlier iteration of the proposal for the CFATS PSP ISCD made it clear that whenever possible, they would notify the facility as quickly as the investigative process allowed. There have been some people that have interpreted this to mean that ISCD would be handling the investigation of personnel with a positive match to the TSDB. That was specifically addressed in this notice when DHS replied:

The Department does not lead the investigation of any affected individual with terrorist ties; rather the Department supports law enforcement investigation activity.

Typically, since they own the TSDB and are responsible for counter-terrorist investigations within the United States, the FBI will be the lead investigative agency for most positive matches against the TSDB. Depending on how someone was placed on the TSDB, another federal law enforcement agency may take the lead. In any case, the lead investigative agency will be responsible for deciding when the facility management may or may not be told about a positive match by one of their employees.

The Department has made clear they understand the point of view of the facility management:

The Department recognizes the significant and vested interest the high-risk chemical facility or designee may have in ensuring an affected individual with terrorist ties does not successfully carry out a terrorist attack against or involving a high-risk chemical facility.

The Department almost certainly understands that it will look extremely bad if a terrorist attack is successfully carried out while the Department knows that the individual has been listed on the TSDB as being a suspected terrorist. It is in the best interest of the Department to provide information to the facility management as quickly as possible so that a potential threat can be removed from the facility. Still, the Department’s hands may be tied by an on-going investigation being conducted by a law enforcement agency

Other Programs

All other programs vetted through the TSA (and the TSA will be doing the actual vetting of individual information against the TSDB) have a adjudication program requirement where the individual must be informed if the TSA determines that the individual is a security threat based upon any of the background checks conducted by the TSA (the CFATS PSP is the only program that does not have TSA doing criminal background checks in addition to the TSDB vetting).

In those cases there is no imminent danger that the individual will be given unaccompanied access to a protected facility while the background check process is proceeding. This almost certainly means that a criminal investigation, if deemed necessary, would have already been initiated and probably completed by the time that the individual is informed of fact that issuance of the credential has been denied.

Perhaps ISCD should also take the same tack with respect to the CFATS PSP; set up the program in a way that facilities could not allow employees, contractors or visitors unaccompanied access to critical areas of the facility until they have been notified by DHS that the vetting process has been completed and that there is no indication of potential terrorist ties associated with the individual. Industry has maintained, however, that that is not an acceptable method of doing business and have routinely complained about the 48 hour notice requirement in the proposed program.