Comments on CFATS Explosive Chemicals ANPRM – 3-13-21

On January 6^th, CISA published an advanced notice of proposed rulemaking (ANPRM) for “Removal of Certain Explosive Chemicals From the Chemical Facility Anti-Terrorism Standards”. This is part of a series of blog posts about the public comments submitted in response to that ANPRM. The earlier posts in the series were:

• Comments on CFATS Explosive Chemicals ANPRM – 1-30-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-14-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-20-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-27-21

• Comments on CFATS Explosive Chemicals ANPRM – 3-6-21

This week there were 43 new comments submitted. The letter writing campaign that I described in a previous post continued this week with four more entries from employees of Owen Oil Tools and eight submissions from employees of Hill Top Energy. Two other commentors provided essentially the same comments as those seen from Owen Oil Tools and Hill Top Energy.

This week’s non-duplicative comments came from:

The American Fuel & Petrochemical Manufacturers (AFPM),

Danielle M. Nelson, Agricultural Retailers Association,

Paul Orum,

Ariel Hill-Davis, Industrial Minerals Association (IMA),

And, of course, my comment from my blog post from two weeks ago was also submitted.

Additional Changes to Appendix A

The AFPM comments suggest that CISA consider revising the current handling of mixtures in Appendix A as a part of this rulemaking. The Appendix currently uses a set percentage of a DHS chemical of interest (separately established for each COI) to determine if a mixture is reportable. AFPM proposes using the NFPM rating of a mixture containing a COI to determine if that mixture would be reportable.

Explosives Incident Reports

Paul Orum points out that the USBDC Annual Explosives Incident Report for 2019 reports that there were “62 thefts of explosives 2015-19 (see Figure 24) and 616 explosives losses (possible diversions) 2015-19 (see Figure 26).”

Additional Costs Identified

The IMA response provides the most comprehensive list of the kinds of additional security measures required by the CFATS program over the ATF rules that I have seen in any of the replies to date:

“Physical measures such as: cameras, intrusions detection systems, gates, and signage necessitate additional capital investments. In addition, programmatic measures such as: written site security plans, training, drills, monitoring of threat levels, cyber security measures, annual internal audits, routine (every 12 – 18 months) inspections by DHS, and recordkeeping, add operational costs to businesses.”

Commentary

This last Monday saw the close of the comment period on this rulemaking. All of the above comments were submitted on/before March 9^th. For all intents and purposes, the ‘public’ has spoken. It is now left to CISA to review the comments and make any appropriate changes to the proposed revision to the CFATS regulations. The hard part now becomes crafting the regulatory language that would implement the proposal.

I would not be surprised to see the notice of proposed rulemaking being sent to the OMB’s Office of Information and Regulatory Affairs (OIRA) for review within the next six months. It could take longer if some of the proposed additional changes are added to the rulemaking. 

Comments on CFATS Explosive Chemicals ANPRM – 3-6-21

On January 6^th, CISA published an advanced notice of proposed rulemaking (ANPRM) for “Removal of Certain Explosive Chemicals From the Chemical Facility Anti-Terrorism Standards”. This is part of a series of blog posts about the public comments submitted in response to that ANPRM. The earlier posts in the series were:

• Comments on CFATS Explosive Chemicals ANPRM – 1-30-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-14-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-20-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-27-21

This week there were 43 new comments submitted. The letter writing campaign that I described in the previous post continued this week with seven more entries from employees of Owen Oil Tools and 30 submissions from employees of Hill Top Energy. And comments from three apparently unrelated companies used the same form letter for their submissions.

This week’s non-duplicative comments came from:

• The Fertilizer Institute,

• Anonymous,

• The American Coatings Association (ACA),

Ammonium Nitrate

The Fertilizer Institute supported the removal of “Ammonium nitrate, with more than 0.2 percent combustible substances, including any organic substances calculated as carbon, to the exclusion of any other added substance” from the Appendix A list of DHS chemical of interest. This is the form of ammonium nitrate that is a Division 1.1 explosive and would be included in the proposed rulemaking. They also specifically supported the retention of the ‘other’ form of ammonium nitrate on the list of COI.

Explosives vs Precursors

Noting the missing security requirements (see my blog post) in the ATF regulations, an anonymous commentor noted that the more dangerous explosives will be less tightly regulated than the less directly dangerous precursors that will remain covered under the CFATS program.

Other COI Should Be Removed

The American Coatings Association supports the removal of the Division 1.1 explosives and suggests that additional chemicals should also be removed or more closely defined. Specifically they would like to see ‘aluminum paste’ removed from the definition of ‘aluminum powder’ and ‘desensitized nitrocellulose’ differentiated from ‘nitrocellulose’.

End of Comment Period

Monday, March 8^th, is the close of the comment period on this ANPRM. Since this is very early in the rulemaking process, comments received a few days late will probably receive full consideration by CISA.

CFATS – Should We Get Rid of 7 RBPS’s?

After writing this week’s review of comments submitted to the CFATS Explosive Removal ANPRM I have been thinking hard about the potential consequences of this ANPRM moving forward. As I continue considering the implications, I think I may be changing my mind about my support for the ANPRM.

General Justification

From the perspective of the 24 facilities that CISA says will be favorably impacted by removing the Division 1.1 chemicals from the Appendix A list of DHS chemicals of interest, support for this rulemaking is easy to justify. They will no longer have to maintain all of the security measures that they put into place for the Chemical Facility Anti-Terrorism Standards (CFATS) site security plans. This will save them significant amounts of money and the time and effort necessary to keep up with the administrative aspects of the program. Easy, peasy.

CISA justifies this deregulatory action by stating that the rules the security and safety rules that the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has in place has ensured that no facility has been placed in the CFATS program for simply for possession of these 49 explosives as a release-security issue. The 24 facilities in the program for just having these explosives on site as a theft/diversion security issue would similarly be adequately protected by those same safety and security measures. Sounds good, but wait.

ATF Generally Aligns with CFATS

Now, all of the recent posts supporting the rulemaking as part of an apparent letter-writing campaign have referenced the same Government Accounting Office report that they claim states that the CFATS program duplicates the BATFE regulations. As I noted in Saturday’s post, that is not what the report actually says.

“ATF’s explosive materials program and TSA’s rail security program contain requirements or guidance that generally align with 11 of 18 CFATS standards.” (pg 21 – .PDF page #)

Now, the key phrase is ‘generally align with’. According to the report (earlier in the same paragraph) that means that they “engage in similar activities”. Later in the report (pg 27) they provide an example of what this means in practice:

“For example, both programs require restricted areas to be secured. Under CFATS, facilities must secure and monitor restricted areas or potentially critical targets within a facility. Security measures may include, for example, physical barriers, guard forces, or intrusion-detection systems. Similarly, ATF requires explosives to be secured. According to ATF, its regulations focus solely on where explosives are stored, rather than the entire facility. In general, ATF requires that its licensees and permittees secure all explosive materials in locked structures meeting ATF-specified criteria.”

If the ATF security rules are adequate for the explosives covered in this rulemaking, would they also not be adequate for all of the other CFATS theft/diversion chemicals of interest? Why should a facility have to pay the cost for the additional security requirements outlined in the CFATS program when cheaper ATF are adequate?

ATF Does Not Address 7 Different RBPS Standards

But remember, the ATF regulations only “generally align with 11 of 18 CFATS standards”. That leaves 7 different risk-based performance standards (RBPS) that the ATF safety and security rules do not address. They are listed on pages 23 thru 26 of the report:

• RBPS #8 – Deter cyber sabotage,

• RBPS #9 – Develop and exercise an emergency response plan,

• RBPS #10 – Maintain effective monitoring, communications, and warning systems,

• RBPS #11 – Ensure proper security training,

• RBPS #13 – Escalate the level of protective measures for periods of elevated threat,

• RBPS #14 – Address specific threats, vulnerabilities or risks, and

• RBPS #17 – Establish officials and an organization responsible for security

Again, if the ATF safety/security program provides adequate security for the Division 1.1 explosives without addressing these seven RBPS, why should any other facility in the program have to comply with these requirements?

Lack of Cybersecurity is Acceptable?

I find it odd in this day and age that the ATF security rules do not address cybersecurity concerns. But what cybersecurity are we really worried about with facilities that store/use the explosives rather than manufacture them? Well, there are two types of cyber systems that a facility that only possesses theft/diversion chemicals would expect to be covered under their site security plan, access control system and the order/delivery systems that route and record sales of the covered chemicals.

Systems that monitor and/or control access to the portions of the facility where covered chemicals or explosives are stored could be a primary target of any adversary that was trying to get unauthorized access to those items. Why wouldn’t these systems have to be protected by adequate cybersecurity? But the ATF does not think that the security of these systems should be regulated (or maybe they were just not given authority to regulate those systems)?

Both the ATF and CISA want their covered facilities to ensure that the facilities vet their customers before delivering chemical/explosives to them. Where that vetting, or more importantly the record of that vetting, is checked on an electronic order approval system, CISA will demand that a CFATS covered facility address the cybersecurity of that system in their site security plan.

How could an adequate security program not address the cybersecurity of these systems? According to this rulemaking, CISA accepts that the lack of cybersecurity in the ATF programs does not affect the adequacy of those security systems. Why then should any other CFATS covered facility be required to address those cybersecurity concerns.

More Comments Coming

We have one more week before the comment period on this ANPRM closes. I will be watching the comment submissions closely over the next week. If I do not see anything that addresses these concerns in that time, I will be submitting a copy of this blog post as a second comment. I think that CISA needs to address these concerns before this rulemaking moves forward to the next stage.

Comments on CFATS Explosive Chemicals ANPRM – 2-27-21

On January 6^th, CISA published an advanced notice of proposed rulemaking (ANPRM) for “Removal of Certain Explosive Chemicals From the Chemical Facility Anti-Terrorism Standards”. This is part of a series of blog posts about the public comments submitted in response to that ANPRM. The earlier posts in the series were:

• Comments on CFATS Explosive Chemicals ANPRM – 1-30-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-14-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-20-21

This week there were twelve new comments submitted. All three supported the proposed rulemaking. The comments were from:

• Clint Fritz,

• James Kinsey, Owen Oil Tools,

• Debbie Payne, Owen Compliance Services,

• Patrick Valentino, Hunting Titan,

• Terry Newton, Nelson Brothers,

• Ralph M. Hymer, Nelson Brothers,

• Ralph M. Hymer,

• Chris Bridges, Owen Oil Tools,

• Jason M Ryan, Orica USA,

• Jon Southerland, Accurate Energetic Systems,

• Lea DeVellis,

• Paul E. Smith, Pyrotechnics Guild International

Letter Writing Campaign

The first eleven submissions listed above have very nearly identical wording. This indicates that there is a letter writing campaign that has been initiated to support this rulemaking. Supportive letter writing campaigns are an interesting effort in influencing regulatory action. CISA does not ‘count votes’ in their consideration of the rulemaking; they are required to review and consider the information provided by the commentors in moving the rulemaking. Multiple submissions with no new information means that CISA has less work to do to move this forward.

GAO Study

All eleven campaign comments contain the following comment:

“On January 21, 2021, the Government Accountability Office (GAO) released their study reviewing the CFATS program and overlap with other chemical security programs. The study found that most CFATS Risk-Based Performance Standards (RBPS) directly overlap with ATF regulatory requirements for commercial explosives.”

What the Report actually says is “ATF’s explosive materials program and TSA’s rail security program contain requirements or guidance that generally align with 11 of 18 CFATS standards.” (pg 27). According to the Report (pgs 23-6) the ATF program does not address the following CFATS risk-based performance standard requirements:

• Deter cyber sabotage,

• Develop and exercise an emergency response plan,

• Maintain effective monitoring, communications, and warning systems,

• Ensure proper security training,

• Escalate the level of protective measures for periods of elevated threat,

• Address specific threats, vulnerabilities or risks, and

• Establish officials and an organization responsible for security

The additional CFATS security requirements explain why the CFATS program has a higher security cost at these facilities. None of the commentors to date have explained why these security requirements are excessive for facilities licensed to handle explosives.

Duplicative Inspections

The one whole original submission this week was from Pyrotechnics Guild International. Smith raises a point that I have not seen in any of the comments to date, duplicative inspections. They note:

“The ATF already does unannounced inspections which require taking time away from that day's production duties.  Adding yet another inspection, of the same materials, and adding duplicative documentation increases time spent on the same or very similar regulatory focus.”

Comments on CFATS Explosive Chemicals ANPRM – 2-20-21

On January 6^th, CISA published an advanced notice of proposed rulemaking (ANPRM) for “Removal of Certain Explosive Chemicals From the Chemical Facility Anti-Terrorism Standards”. This is part of a series of blog posts about the public comments submitted in response to that ANPRM. The earlier posts in the series were:

• Comments on CFATS Explosive Chemicals ANPRM – 1-30-21

• Comments on CFATS Explosive Chemicals ANPRM – 2-14-21

This week there were three new comments submitted. All three supported the proposed rulemaking. The comments were from:

• Institute of Makers of Explosives,  

• Jason Rawlings, Austin Powder Company, and

• Chris MacDonald

 Cost of Compliance

The comments from IME include the results of an internal 2017 study of the cost of complying with the CFATS regulations for three different (unnamed) facilities. One-time costs ranged from $433,820 to $1,000,000. Recurring annual costs ranged from $70,400 to $125,000. Presumably, the costs cited are over and above the costs associated with BATF security regulations.

Commentary

These comments have done little to explicate why the CFATS security costs are higher than those associated with the BATF regulations, nor have they described why the added security requirements from the CFATS program are unnecessary. If the added security measures mandated by the CFATS program to prevent the theft of explosives from have not provided any additional benefit as suggested by these commentors, then perhaps CFATS program should remove those requirements from other facilities that possess the other non-explosive DHS chemicals of interest with a theft/diversion security concern.

Comments on CFATS Explosive Chemicals ANPRM – 2-14-21

On January 6^th, CISA published an advanced notice of proposed rulemaking (ANPRM) for “Removal of Certain Explosive Chemicals From the Chemical Facility Anti-Terrorism Standards”. It has been over two weeks now since a comment was posted about the ANPRM. While it is common for industry to take some time in preparing comments on rulemakings, it has been over a month since this significant ANPRM was published and there has been only one comment from an explosives manufacturer submitted.

I suspect that part of the reason for the delay is that industry is waiting to see what take the new administration has on this rulemaking. At this point the Biden Administration has not made any public comment on its intentions. While they have withdrawn many rulemakings being considered by the OMB’s Office of Information and Regulatory Affairs (OIRA), that option is not available for this rulemaking; it had already been published in the Federal Register. The only other action that the Administration has taken to date on more controversial rulemakings already under public scrutiny is to extend the comment due date. No such action has taken place on this rulemaking.

There have been news reports (see here for example) that the International Chemical Workers Council has at least some objections to the rulemaking, so I had expected to see some early comments on that front, but nothing has shown up yet at Regulations.gov. I suspect that the unions would want to see the CFATS program remain in effect at the potentially affected facilities because that program does contain some specific (if perhaps weakly enforced) worker participation requirements and whistleblower protections that may not be available under the BATF regulations.

I would also have expected to see early comments from the owners of the 24 facilities covered under the CFATS program that would potentially be removed from coverage under those regulations if this rulemaking goes forward. They definitely have a direct stake in this rulemaking, and they should probably consider explaining why this proposed change to Appendix A would not have an adverse impact on security at their facilities.

The March 8^th deadline for comments is fast approaching.

PHMSA Oil Spill Response Plan ANPRM Comments – 09-13-14

This is the first post in a series that looks at the public comments provided to DOT’s Pipeline and Hazardous Material Safety Administration (PHMSA) on their advanced notice of proposed rulemaking (ANPRM) for possible regulations governing oil spill response planning for High-Hazardous Flammable Trains. Fifty comments have been received as of last Friday and 20 comments are posted to the current docket.

Most of the comments (18 of the 20 posted) received to date are from private individuals that feel that they might be impacted by a spill from one of these crude oil trains. Thirteen of those are part of an organized letter writing campaign organized by RiverKeeper.org. I have never understood why environmental organizations think that an organized letter writing campaign will sway regulators in their decisions about how or if regulations should be written. I suspect that these campaigns are more about keeping their members feeling like they are involved and having an effect rather than a real effort to affect the rulemaking process.

There is a very interesting ‘Anonymous’ comment that was obviously written by someone familiar with oil spill response planning. That comment coupled with one from a business group and another from a spill response consultant organization provide the most useful information in the comments to date. All three of these comments look at the rulemaking as an extension of current oil spill response regulations; they have various ideas about how the railroad situation parallels or differs from fixed installation, pipeline or maritime spill response situations. All are worth reading.

The first comment posted to this docket makes a point that PHMSA has yet to address and none of the commenter mentioned above look at, flaming oil. The comment from an individual starts with a very succinct statement of the problem: “Develop a plan for flaming oil running downhill or under other tank cars.” If the PHMSA regulations don’t at least make an effort to deal with that problem they will be incapable of preventing disasters like we saw in Canada last year.