CFATS Authorization – Excluded Facilities

This is part of a continuing series of blog posts on my proposed changes to the CFATS authorization. The current authorization for the program ends on December 18^th, 2018. These posts address some of the language that I would like to see in any re-authorization bill. Earlier posts in the series include:

CFATS Reauthorization – Cybersecurity

CFATS Reauthorization – Agricultural Production Facilities

CFATS Authorization – Protection from Drones

The current CFATS authorization lists five types of facilities that are ‘excluded’ from the requirements of the CFATS program {6 USC 621(4)}:

• A facility regulated under the Maritime Transportation Security Act of 2002 (Public Law 107–295; 116 Stat. 2064);

• A public water system, as that term is defined in section 300f of title 42;

• A Treatment Works, as that term is defined in section 1292 of title 33;

• A facility owned or operated by the Department of Defense or the Department of Energy; or

• A facility subject to regulation by the Nuclear Regulatory Commission.

The presumption is that the federal programs that are responsible for the facility oversight already adequately address site security concerns. This presumption was a political decision made when the CFATS program was originally authorized in 2006. Since the program was developed there has been no outside comparison of the various security requirements of the various programs.

Study Requirement

The major problem in comparing these security programs is that only the CFATS program is specifically targeted at protecting chemicals from terrorist attacks. What is needed is a formal program comparison that specifically addresses the security controls that provide protections to on-site chemicals found in Appendix A to 6 CFR 27. To that end, I would include the following language:

Sec. 632 – Excluded Facility Study

(a) The Comptroller General will, within 180 days, prepare a report to Congress on the comparative security requirements between the existing CFATS regulations, as defined in §621(1), and the provisions associated with the federal programs regulating excluded facilities, as that term is defined in §621(4). The study will compare the program requirements that would prevent:

(1) The release of chemicals identified as a release security issue in Appendix A to 6 CFR Part 27;

(2) The theft or diversion of chemicals identified as theft security issue in Appendix A to 6 CFR Part 27; and

(3) The sabotage of chemicals identified as a sabotage security issue in Appendix A to 6 CFR Part 27.

(b) The report will specifically identify any deficiencies in the respective regulatory program as compared to the CFATS regulations to provide equivalent levels of protection for chemicals identified in (a)(1), (2) and (3);

(c) The report to Congress will be unclassified with a classified annex if deemed appropriate by the Comptroller General. The unclassified version of the report will be published on the CFATS web site.

(d) The Secretary, in consultation with the Environmental Protection Agency, the Department of Energy, the Department of Defense and the Nuclear Regulatory Commission, will, within 1 year of the publication of the report required in (a), report to Congress on any recommendations for changes in changes in the excluded facilities provisions of this subchapter that would correct deficiencies noted in (b) above.