Earlier this week Rep. Richmond (D,LA) introduced HR 3256,
the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of
2019. Normally, I wait for the official print of the bill before I review it,
but the House Homeland Security Committee has a committee
print available and have scheduled a mark-up
hearing of the bill on Wednesday, so I will be reviewing the committee print
today.
HR 3256 would reauthorize the Chemical Facility
Anti-Terrorism Standards (CFATS) program for an additional five plus years
(until May 1st, 2025; §16).
The bill also provide a number of amendments to the current authorization language
(6
USC Subchapter XVI).
Major Additions
The following sections of the bill show the areas where significant
changes would be made to the existing program:
§4. Protection and sharing of
information.
§5. Civil enforcement.
§6. Whistleblower protection.
§7. Chemical Security Advisory
Committee.
§12. Voluntary mechanism for
reporting drones and other emerging threats.
§13. Regulations regarding specific
products and mixtures containing chemicals of interest.
The following sections provide information on the studies
and reports required by the bill:
§8. Implementation plan and report to Congress.
§9. Study on risks posed by excluded facilities.
§10. Study on feasibility of waiver program.
§11. Comptroller General reports.
Information Protection and Sharing
Section 4 of the bill would make a number of changes to 6
USC 623, Protection and Sharing of Information. The first change would be
to rewrite paragraph (a) to read:
(a) In general - Notwithstanding
any other provision of law, with
respect to information in the possession of the Department, the Secretary shall
protect information developed under this subchapter, including vulnerability
assessments, site security plans, and other security related information,
records, and documents shall be given protections from public
disclosure consistent with the protection of similar information under section 70103(d)
of title 46 [link added].
Additionally, a complete rewrite of paragraph (b) includes:
(2) NONDEPARTMENTAL INFORMATION.
— Information is not protected pursuant to subsection (a) if it is—
(A) not in the possession of
the Department;
(B) developed under this title
but has been previously produced or developed for other purposes; and
(C) is already publicly
available, readily discoverable, or otherwise lawfully disclosed.
Comment: It looks like this is intended to change the
Chemical-Terrorism Vulnerability Information (CVI) program to make it more like
other sensitive but unclassified (SBU) information protection programs.
Currently the CVI program has strict information protection rules for
information held at each covered facility. Other SBU only protect information
in the hands of the Federal government, its contractors, and such information
shared with State, Tribal, and local governments. If that was the intent, it
looks to me like the terminal ‘and’ in (2)(B) nullifies that attempt as it does
not remove protections already provided in the program. DHS would not be
required to change the CVI rules under these changes. If the terminal ‘and’
were changed to ‘or’ then (2)(A) would be the controlling factor for removing
CVI protections for information held at facilities.
As noted above §4
also rewrites (b), changing the information sharing requirements of §623(b) to require DHS to
provide information (upon request) to {new §623(b)(1)}:
State, local, and regional fusion
centers (as that term is defined in section 210A(j)(i) of this Act) and State
and local government officials, including law enforcement and emergency
response providers;
Members of Congress;
Members of the Chemical Security Advisory
Committee under [new] section 2010 of this Act; and
The Comptroller General of the United
States.
The addition of fusion centers and members of Congress in
this paragraph allows the bill to delete the current paragraphs (c) and (f)
from §623.
Comment: This is a proforma change to appease
supporters who want ‘better’ information sharing about the hazards associated
with covered facilities. This really provides no new requirements for the CFATS
program beyond the addition of the new Advisory Committee which will be covered
in more detail later in the bill.
Civil Enforcement
Section 5 of the bill would amend §624,
Civil Enforcement. The first set of amendments deals with changes to paragraph
(a), Notice of noncompliance. The first change the time limits for DHS to
provide a written notice of non-compliance from 14-days to 3-days. And the
second changes the time limit a facility would have to comply with a DHS order
to comply, from 180 days to 30 days.
The next set of changes address paragraph (b)(2) civil penalties
for non-reporting chemical facilities of interest. The change clarifies that
the subparagraph applies to Top Screen submission requirements or supplemental
information thereto.
The third set of changes paragraph (c)(1), expanding the DHS
authority for issuing emergency orders due to violations of CFATS program
requirements or the risk of terrorist incidents. It now adds a vague “or other
malicious act” that may affect a chemical facility of interest to the list of potential
causes of “an imminent threat of death, serious illness or severe personal injury
that the Secretary could attempt to prevent by requiring facility action.
Comment: This is ‘other malicious act’ is vague
enough to provide authority to order cybersecurity measures or even the development
of active shooter programs. The current management would be unlikely to use
this authority; their emphasis is on cooperative enforcement. Who knows what
could happen in the future?
Whistleblower Protections
Section 6 of the bill modifies the existing whistleblower
protections found in §625.
The bill expands on the existing requirements for:
• Confidentiality;
• Response to reports; and
• Opportunity for review
The bill also adds a new paragraph (c) to the section; Procedure
and Remedy. It provides requirements for DHS to “establish a procedure for the
review and investigation of complaints of reprisals” {new §625(c)(i)} as well as
establishing remedies for violations of the same.
NOTE: I am about half-way through the major CFATS changes
proposed by this new bill and we are already at about 1000 words. It is getting
a bit long for a blog post; even by me. I will try to finish up by tomorrow.
Posts
No comments:
Post a Comment