DHS Publishes PSP 30-day ICR Notice

Today the DHS National Protection and Programs Directorate (NPPD) published a 30-day ICR notice in the Federal Register (83 FR 28244-28251) for a proposed expansion of the current personnel surety program process for vetting personnel at facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program against the Terrorist Screening Database (TSDB). The 60-day notice was published in December of 2017 and comments were covered here.

This notice specifically addresses the comments submitted during the 60-day notice comment period. Those comments included:

• Suggestions to delay the expansion of the PSP to Tier III and Tier IV pending further review of the efficacy of the Tier I and Tier II program;

• Objections to railroad employees being subject to PSP screening;

• Questions about the assumptions used in calculating the burden;

• Calls for a phased implementation of the PSP implementation;

• Lower risk at Tier III and Tier IV facilities obviates need for TSDB screening;

• Concerns about the lack of facility notification in case of a positive TSDB screening result;

Almost all of the comments have been previously dealt with by DHS in the original CFATS rulemaking and the earlier PSP ICR process. Obviously, the commenters were not satisfied with the earlier response to those comments and are unlikely to be satisfied with the responses included in this new rebuttal.

The one relatively new objection is the one dealing with the reduced risk at Tier III and Tier IV facilities. The Department’s response is essentially that the PSP vetting against the TSDB is a requirement of  6 CFR 27.230(a)(12)(iv) for all covered facilities and thus must go forward.

DHS is soliciting public comments on this ICR. Comments should be sent electronically to dhsdeskofficer@omb.eop.gov. Comments should be submitted by July 18^th, 2018.

Commentary

First, I would again like to congratulate NPPD on the amount of detail they include in their ICR notices. While people can certainly disagree with the decisions made in responding to comments, all of the ICRs in support of the CFATS program have include much more information than other agencies provide in their ICR notices. These ICR notices should be the gold-standard by which OMB measures acceptable ICR notices.

I was more than a little disappointed in the response to the issues raised about extending the PSP to Tier III and Tier IV facilities. Last week’s congressional hearings on the CFATS programs showed that there is much wider industry concern about this issue than was reflected in the comments submitted to DHS in response to the 60-day notice.

I firmly support the expansion of the TSDB screening to Tier III and Tier IV facilities, but I think that the argument that this is required by the regulation, while legally sufficient, is really rather weak. I think that the Department should have taken the opportunity presented by this ICR notice to more completely address industry concerns. While I think that most of the industry objection to this expansion is really based upon concerns about costs and manpower needs, their specific objections about the lower security risk need to be addressed.

DHS should have addressed the fact that the large bulk of facilities in Tier III and Tier IV are facilities that face a theft and/or diversion threat because of the presence of precursor chemicals that can be used to make improvised explosive or improvised chemical munitions. An insider threat at this class of facilities may actually pose a higher risk of terrorist attack because subsequently produced improvised weapons provide the terrorist organization with more flexibility in carrying out a subsequent attack on specific high-profile targets. Additionally, a terrorist participating in this type of insider attack is more likely to be able to walk away from the attack without personal harm than if attacking a facility with a release security hazard. This would expand the type of individual that would be willing to conduct an attack.

There is an unfortunate tendency in this country to conflate ‘terrorist attack’ with a jihadist suicide-bomber. At Tier I and Tier II facilities with release security issue chemicals of interest (COI) this may be a high-threat attack. At facilities with theft/diversion security issue COI this is legitimately a much lower probability attack. Almost by definition those facilities are much more susceptible to an insider attack attempting to acquire raw materials for attacks on higher profile targets. This is why the PSP terrorist screening database requirement really needs to be expanded to Tier III and Tier IV facilities, not the weak argument that regulation requires the expansion.