CFATS Program Oversight Hearing

Last week the Cybersecurity and Infrastructure Protection Subcommittee of the House Homeland Security Committee held an oversight hearing looking at the Chemical Facility Anti-Terrorism Standards (CFATS) program. According to the opening statement of the Chair, this is the first step in the reauthorization process for that program. The current authorization for the program ends on December 18^th, 2018.

Support for CFATS Program

Three of the witnesses were from chemical manufacturing organizations who represent CFATS covered facilities in a range of industries. The fourth witness was a well-known environmental advocate who has frequently addressed chemical manufacturing safety issues.

Generally speaking, all four witnesses supported the CFATS program and advocated for its reauthorization. All expressed concerns that the reauthorization should not take the form of year-to-year extensions of the program that were seen prior to 2014.

Suggestions for Reauthorization Changes

Chet Thompson, representing the American Fuel & Petrochemical Manufacturers, specifically recommended another medium-term extension of the program requiring specific congressional reauthorization, as was done in 2014. His other recommendations for the reauthorization were generally restrictive:

• Do not include an inherently safer technology mandate (in oral testimony);

• Continue to protect the confidentiality of site security information;

• Require changes in the Appendix A chemical of interest (COI) list to go through comment-response process;

• Avoid extending the anti-terrorist vetting program to Tier III and Tier IV facilities; and

• Avoid any major changes to the program.

Kirsten Meskill, representing the American Chemistry Council, had three recommendations in her written testimony for the reauthorization of the CFATS program:

• Improve transparency in DHS risk determinations;

• Reconsider the value of Terrorist Screening Database (TSDB) screening at low risk facilities; and

• Recognize industry stewardship programs.

Pete Mutschler, representing both the Fertilizer Institute and the Agricultural Retailers Association, included two reauthorization suggestions in his testimony;

• Continue to protect the confidentiality of site security information; and

• Recognize industry stewardship programs.

Paul Orum, representing the Coalition to Prevent Chemical Disasters, was the most detailed in his recommendations for reauthorization changes. In his testimony Orum addressed (with specific suggestions):

• Use all available options – not just management and control strategies;

• Exercise oversight – especially of the ability of CFATS standards to realistically ensure protection;

• Use available resources – especially make better use of employee input;

• To improve public confidence, respect community concerns; and

• Support other programs that improve chemical security;

Commentary

Readers will remember that I started the CFATS reauthorization discussion rolling last fall when I did two blog posts on my suggestions for changes to the program (here and here).

My first post addressed cybersecurity issues. None of the witnesses addressed cyber issues in their prepared testimony and there was only one question about cybersecurity during the hearing (52 minutes). The responses were fairly generic calls for information sharing. Thompson did note that the current Risk Based Performance Standard 8 of the CFATS program addresses cybersecurity.

One interesting topic that did come up during questioning (49 minutes) was the use of unmanned aerial vehicles (UAV) or drones. There was just one question (51 minutes) on the topic and the answers were very generic. Meskil pointed out that drones are a duel edged sword; they are useful in many inspection and maintenance operations at facilities, but weaponized drones are a potential threat that has yet to be addressed. While I will address specific recommendations for drone provisions of the CFATS reauthorization, I will note here that drone rules have to take into account two specific restrictions:

• Interference in the operation of a drone is a federal felony; and

• Tracking and intercepting a drone is technologically and operationally complicated.

Finally, on the topic of inherently safer technology (IST); there should be no mistake made, the CFATS regulations have had a positive impact on the application of risk reduction measures at a relatively large number of chemical facilities. This is clearly seen in the reduction in the number of facilities over the years that have left the CFATS program. Orum is correct that DHS and ISCD could further aid this legitimate risk reduction effort by being more forthcoming about the number and types of facilities that have exited the program by reducing and/or eliminating their COI inventories. As I have said on a number of occasions, requiring a specific IST review/implementation process ignores the complexity of the situation, but ISCD should be providing information gleaned (and anonymized) from former CFATS facilities to similar facilities to make the process somewhat less complicated.