This is part of a series of blog posts on the recently
introduced S 3416, the Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2020, which would modify and reauthorize the Chemical
Facility Anti-Terrorism Standards (CFATS) program for five years. Other posts
in this series include:
Information Sharing Strategy
The strategy that I discussed in yesterday’s post is also
intended to address “the sharing of information with the local emergency
manager, the local emergency response provider, and any on site emergency
response provider for a covered chemical facility” {§6(a)}. That strategy would
include “guidance on further improving outreach to the local emergency manager,
the local emergency response provider, and any on site emergency response
provider for a covered chemical facility” {§6(b)(3)}. That guidance would
include requirements for:
• A statement of the name or title,
organizational affiliation, and phone number of a local emergency manager or
local emergency response provider, and any on site emergency response provider,
for the covered chemical facility;
• The documented policy of the
covered chemical facility to coordinate access to the facility with the local
emergency manager, local emergency response provider, and any on site emergency
response provider described in sub-paragraph (A), for purposes of training and
pre-incident planning; and
• Written documentation by the
covered chemical facility that the owner or operator has provided the local
emergency manager or local emergency response provider with need to know
(within the meaning of
6
CFR 27.400(e), or any successor thereto) and appropriate chemical-terrorism
vulnerability information credentials the name and amount of each chemical of
interest held, stored, or manufactured at the covered chemical facility.
Information Sharing Requirements
Section 15(a) amends
6
USC 622(e) by adding a paragraph (6),
Sharing Information with Emergency Response Providers. This new paragraph would
require DHS to “make available to State, local, and regional fusion centers and
State and local government officials, including officials of State or local law
enforcement agencies and emergency response providers” {new §622(e)(6)(B)}
information that DHS determines is necessary “to ensure that emergency response
providers are capable to effectively prepare for, respond to, and mitigate
chemical security incidents at covered chemical facilities”. That information
will include:
• The name of the covered chemical
facility;
• The address of the covered chemical
facility;
• The phone number of the covered
chemical facility;.
• The name and Chemical Abstract
Service number of each chemical of interest used, stored, or manufactured as
specified in the Top-Screen submitted by the covered chemical facility;
• The quantity and concentration of
each chemical of interest specified in the Top-Screen submitted by the covered
chemical facility; and
• The name or title, organizational
affiliation, and phone number of a local emergency manager or local emergency
response provider for the covered chemical facility specified in the site
security plan of the covered chemical facility.
The bill would require to DHS to use an existing “single
information technology infrastructure, information technology platform, online
platform, or website” {new §622(e)(C)(i)} for this required information
sharing. Presumably this means the
Infrastructure
Protection Gateway that ISCD
established
in 2015.
DHS would be required to update this information every
90-days.
Emergency Responder Outreach
The new §622(e)(6) above would also require the Infrastructure
Security Compliance Division (ISC) to conduct an outreach to local officials
during compliance inspections or audits. Inspectors would be required to {new
§622(e)(6)(E)}:
• Contact and notify the local emergency
manager or local emergency response provider, and any on-site emergency
response provider, identified by the covered chemical facility that there is a
covered chemical facility in their response area; and
• Inform the response officials
identified by the covered chemical facility of the available secure
communications and information technology infrastructure platforms or other
mechanisms to obtain additional information.
Commentary
I have two major concerns about the emergency response
language in this bill; the lack of definition of key terms and the ‘need to
know’ language used.
There are three new terms used in this bill about emergency
responders that are unique to the bill and require definitions:
• Local emergency manager;
• Local emergency response provider;
and
• On-site emergency response
provider.
First-off, I think that the third term ‘on-site emergency response
provider’ should be eliminated. If the facility management has not provided an
on-site responder with necessary information about all of the chemicals on the
site (not just those covered by the CFATS program), the facility has problems
that need to be addressed by OSHA, not DHS.
Next, instead of the term ‘local emergency manager’ I would
suggest that the terminology that should be used is “the head of the Local Emergency
Planning Committee established under
42
USC 11001. Then, instead of ‘local emergency response provider’ the bill
should use ‘the head of the fire department that provides coverage for the
facility’. Actually, the second term is operationally redundant for most
facilities as local fire departments are supposed to be represented on the
local LEPC. But that is only true for ‘most’ facilities since there are a
number of areas that have no LEPC or the LEPC is not really active.
The bill uses the phrase “with a need to know (within the
meaning of section 27.400(e) of title 6, Code of Federal Regulations” to modify
the term ‘emergency responders’ wherever there is a requirement to share information
with those responders. Now, I understand the need to protect Chemical-terrorism
Vulnerability Information (CVI) which is what §27.400 refers to, and ‘need-to-know’
is a key part of that protection.
The CVI information that DHS is required to share under the
proposed §622(e)(6) is limited to:
• The name and Chemical Abstract
Service number of each chemical of interest used, stored, or manufactured as
specified in the Top-Screen submitted by the covered chemical facility; and
• The quantity and concentration of
each chemical of interest specified in the Top-Screen submitted by the covered
chemical facility
Both of these items of information should be available to
the listed agencies via the Environmental Protection Agency. With that in mind,
I would like to propose striking the phrase “with a need to know (within the
meaning of section 27.400(e) of title 6, Code of Federal Regulations” wherever
is used in §622(e)(6) and adding the following at the end of the paragraph:
(f) The information provided in
(b) is presumed to be Chemical-Terrorism Vulnerability Information in
accordance with 6 CFR 27.400. The individuals listed in (b) with whom that
information is to be shared are deemed to have ‘need-to-know’ under §27.400(e)(i).
One final niggly bit; the inclusion of the requirements for
the outreach to local emergency responders in §6 of the bill is more than a
little confusing since the other part of that section deals with cybersecurity.
The emergency response information share provision of § should have been
included as part of §15 that proposes the addition of §622(e)(6) probably as
part of §15(b).
Posts
