Critical Economic Assets and CFATS – Part 1

When the crafters of the Chemical Facility Anti-Terrorism Standards (CFATS) regulations back in 2007 published 6 CFR Part 27, they envisioned that DHS would regulate facilities that produced critical economic assets as well as the DHS chemicals of interest (COI) listed in Appendix A of those regulations. DHS never did classify any facilities as high risk under the CFATS program for the possession of critical economic assets and the issue died due to lack of interest. With the critical chemical supply issues that we have seen lately, perhaps it is time to rethink that issue.

Definitions

There are two definitions in §27.105 that are key to this discussion:

Present high levels of security risk and high risk shall refer to a chemical facility that, in the discretion of the Secretary of Homeland Security, presents a high risk of significant adverse consequences for human life or health, national security and/or critical economic assets [emphasis added] if subjected to terrorist attack, compromise, infiltration, or exploitation.

Security Issue shall refer to the type of risks associated with a given chemical. For purposes of this part, there are four main security issues:

(1) Release (including toxic, flammable, and explosive),

(2) Theft and diversion (including chemical weapons and chemical weapons precursors, weapons of mass effect, and explosives and improvised explosive device precursors),

(3) Sabotage and contamination, and

(4) Critical to government mission and national economy [emphasis added].

The First Top Screen

In 2007 I did a series of blog posts about the initial Top Screen reporting requirements for chemical facilities under the CFATS program. The last post in that series dealt with the questions on the Top Screen about Mission Critical Chemicals and Economically Critical Chemicals. There was also a follow-up post about Critical Chemicals that addressed additional information provided in the Top Screen User Manual at the time.

As I noted in those earlier posts, one of the problems with the data collected by the critical chemical questions on those early Top Screens was that the only facilities that submitted data were those facilities that had reportable quantities of COI on hand and were thus required to submit Top Screens. That, combined with the fact that facilities had every incentive to determine that they produced less than “20% of the domestic production” of a given chemical as that is not a standard reportable data point, and one can see why DHS dropped that particular data collection and took no actions to identify facilities as a covered facility under the CFATS program.

Water Treatment Critical Mission Chemicals

We have had two news reports (here and here) in the last two weeks about critical chemical shortages in the water treatment industry. If either supply situation were much worse, we would have had news reports of unsafe drinking water in major cities. If that situation were to be the result of ransomware attacks or worse a terrorist attack, the public and political blowback would be intense.

So, maybe it is time for CISA’s Office for Chemical Security (OCS) to start to look at using their existing regulatory authority to determine if there are chemical companies that are supplying mission critical chemicals into the water treatment industry that are not currently covered by the CFATS program.

I will be looking at how such a program expansion could be effected by OCS and how it could work in actual practice in a series of articles on CFSN Detailed Analysis over the next couple of weeks.