CFATS Reauthorization – Emergency Response

This is part of a continuing series of blog posts on my proposed changes to the CFATS authorization. The current authorization for the program ends on December 18^th, 2018. These posts address some of the language that I would like to see in any re-authorization bill. Earlier posts in the series include:

CFATS Reauthorization – Cybersecurity

CFATS Reauthorization – Agricultural Production Facilities

CFATS Authorization – Protection from Drones

CFATS Authorization – Excluded Facilities

CFATS Reauthorization – Academic Laboratories

CFATS Reauthorization – Inherently Safer Technology

CFATS Reauthorization – STQ Adjustments

CFATS Reauthorization – WMD Criminal Activities

In light of the recent GAO report on the Chemical Facility Anti-Terrorism Standards (CFATS) program and its findings on problems with information sharing between DHS and local first responders, I would like to suggest the following language on information sharing:

Section 636 – Information Sharing

(a) IP Gateway - The Secretary will establish an on-line portal for sharing information about covered facilities with the local first responder community and local emergency response planners.

(A) The portal will provide information in two tiers of accessibility:

(I) The Tier One will allow open access to information that will include the following information about all covered facilities:

(i)  Name;

(ii) Location;

(iii) Geospatial information; and

(iv) Inventory and location information for all COI reported on the current Top Screen that are subject to the reporting requirements of §§ 311 and 312 of the Emergency Planning and Community Right-to-Know Act (EPCRA) regardless of the threshold quantities of that Act.

(II) The Tier Two will include additional information that is protected by the Chemical-Terrorism Vulnerability Information (CVI) program described in 6 CFR 27.400, including:

(i) Complete list of COIs, to include amounts and locations;

(ii) Facility tiering information; and

(iii) Facility security information.

(B) The Secretary will establish procedures to register and authorize access to the portal for all members of a recognized Local Emergency Planning Committee (LEPC) established under EPCRA, and at least one designated representative from each local law enforcement agency (LLEA), fire department and hospital operating within 10 miles of each covered facility. Access will be provided on the following basis:

(I) Registered LEPC members will be provided access to both tiers of information described in (A) for all facilities in their county or within 10 miles of their county;

(II) Registered LLEA representatives will be provided access to both tiers of information described in (A) for all facilities in jurisdiction or within 10 miles of their jurisdiction;

(III) Registered fire department representatives will be provided access to all Tier One information and Tier Two information specifically related to COI for all facilities in jurisdiction or within 10 miles of their jurisdiction; and

(IV) Registered hospital representatives will be provided access to all Tier One information and Tier Two information specifically related to the types COI (excluding amounts and locations) for all facilities in jurisdiction or within 10 miles of their jurisdiction.

(C) The LEPC members and designated representatives from LLEA, fire departments, and hospitals listed above will be considered to be a covered person under §27.400 and deemed to have a need-to-know under the CVI rules for information about covered facilities.

(D) The Secretary will contact each LEPC, LEEA, fire department and hospital within 10 miles of each covered facility explaining the existence of the portal described in (a), the procedures for registering for the portal, and the requirements for protecting CVI provided in the portal.

(b) Facility information sharing requirements. Each CFATS covered facility is required to:

(1) Contact in writing their local LEPC, LLEA, fire department and nearby hospital and inform them about the existence of the portal described in (a).

(2) Designate a security representative to the local LEPC in addition to any other facility representation to the LEPC. If a local LEPC does not exist, that fact will be reported in writing to the Director, Infrastructure Security Compliance Division.

(3) Invite a representative of the local LEPC, LLEA, local fire station and nearby hospital to participate in or observe each security exercise conducted by the facility.

(4) Conduct an annual training class for representatives from each local LEPC, LLEA, fire station and nearby hospital about the chemical hazards associated with each release security issue COI reported on the most recent facility Top Screen.

(5) Conduct an annual training class for representatives from each local LEPC and LLEA with the potential chemical weapon or improvised explosive device hazard associated with each theft/diversion security issue COI reported on the most recent facility Top Screen.

(c) Joint Exercises

(1) The Secretary will encourage each LEPC, LLEA, fire department and nearby hospital to participate in annual security exercises conducted by each CFATS covered facility. This encouragement may include providing access to FEMA grants for such exercises.

(2) 15 USC 2229(c) is amended by adding:

“(4) FEMA is directed to give priority consideration to grants providing for planning, training, and the conduct of exercises involving facilities covered under 6 USC Part 27.”

(3) 6 USC 609 is amended by inserting a new:

“(14) Planning for emergency response to attacks on chemical facilities covered under 6 USC Part 27, to include the conduct of exercises under the resulting plans; and”