CFATS Reauthorization – STQ Adjustments

This is part of a continuing series of blog posts on my proposed changes to the CFATS authorization. The current authorization for the program ends on December 18^th, 2018. These posts address some of the language that I would like to see in any re-authorization bill. Earlier posts in the series include:

CFATS Reauthorization – Cybersecurity

CFATS Reauthorization – Agricultural Production Facilities

CFATS Authorization – Protection from Drones

CFATS Authorization – Excluded Facilities

CFATS Reauthorization – Academic Laboratories

CFATS Reauthorization – Inherently Safer Technology

As I discussed in an earlier post the regulatory triggers for the CFATS program (known as ‘screening threshold quantity’ or STQ) are a politically influenced approximation of a risk assessment of the threat that a particular chemical poses in a potential terrorist attack on a facility. The CFATS program acknowledges that the assessment of the potential threat associated with holding a chemical of interest (COI) is much more complex than just looking at the physical characteristics of the chemical or potential uses of that chemical in a subsequent attack. That is why facilities possessing COI at or above the designated STQ are required to report information to ISCD utilizing the Top Screen tool. That information is used to make a detailed threat assessment of the threat of a terrorist attack on that facility.

Recently ISCD completed a re-assessment of the threat of terrorist attack on the full range of facilities that had previously submitted Top Screens using a revised Top Screen tool and a more formally vetted threat assessment protocol. The large number of facilities involved in that reassessment provide a unique opportunity to make a more detailed and statistically verifiable determination of STQs. To that end, I would suggest the following language.

Sec. 635 – Screening Threshold Quantity Adjustments

(a) The Comptroller General, within 90 days, will initiate a study of the results of the CSAT 2.0 reassessment initiated for the CFATS program in October of 2016. The study will look at the information reported by facilities in their Top Screens and results of the risk assessment subsequently conducted by DHS to determine the adequacy of the current screening threshold quantity (STQ) used by DHS to trigger reporting requirements for the CFATS program.

(b) Definition – COVERED FACILITY – In this section the term ‘covered facility’ means any facility that, subsequent to the submission of a Top Screen was provided with a Tiering Letter by DHS requiring the facility to submit a security vulnerability assessment / site security plan.

(c) For DHS chemicals of interest (COI) listed in Appendix A to 6 CFR Part 27 as a release security issue or theft security issue, the study described in (a) will look at:

(1) The inventory reported for each of the chemicals list in Appendix A to 6 CFR Part 27;

(2) Whether or not the facility was subsequently notified that it was a covered facility under the CFATS program;

(3) Based upon the lowest quantity of a COI reported for all facilities possessing that COI that were subsequently notified that they were a covered facility under the CFATS program, the study will report if:

(A) the STQ is too low – the lowest quantity reported is statistically greater (at the 95% confidence level) than the STQ; or

(B) the STQ is not too low – at least one covered facility reports a COI inventory level at the STQ level.

(4) For each COI found to have an STQ that is not too low, DHS will be required to re-run the risk assessment process for each facility possessing that COI. Those reassessments will be run with an artificial Top Screen reported value of 90%, 80% and 70% of the STQ value. The study will report the results in (3) for the COI at those values.

(d) For DHS chemicals of interest (COI) listed in Appendix A to 6 CFR Part 27 as a sabotage security issue, the study described in (a) will look at the lowest amount reported for any facility subsequently determined to be a covered facility under the CFATS program.

(e) Within 60 days of the completion of the report required in (a) the Secretary will initiate a rulemaking to adjust the STQ values in Appendix A, 6 CFR Part 27. Those adjustments will:

(1) For any COI evaluated as ‘too low’ under the requirements of (c)(3), increase the STQ to the lowest value reported for any facility deemed to be a covered facility;

(2) For any COI evaluated under (c)(4), decrease the STQ to the highest value where a ‘too low’ report was made or 70% of the STQ, whichever is higher;

(3) for any COI evaluated under (d), adjust the STQ to the lowest value reported by a facility subsequently reported to be a covered facility.