A Closer Look at the Heritage Foundation Report – Conclusions

This is the final blog in a series taking a critical look at the recent Heritage Foundation report on the problems with the CFATS program. While the report authored by Jessica Zuckerman is not up to the usual editorial standards of the Heritage Foundation it does raise some interesting issues. The earlier blog posts can be found here:

A Closer Look at the Heritage Foundation Report – CFATS Description

A Closer Look at the Heritage Foundation Report – Four Principles

A Closer Look at the Heritage Foundation Report – More Regulations

The final section of the Heritage Foundation report on the CFATS program is called “Developing Market-Oriented Chemical Security Solutions”. As one would expect with a concluding section of a report it summarizes the author’s conclusions. This post will address those conclusions and some of the other shortcomings of the report.

Report Conclusions

Here is my summary of those conclusions (okay, I stole them from the subheading in the section):

• Take a truly risk-based approach to chemical security;

• Reject calls for greater regula­tion;

• Expand SAFETY Act protec­tions to encourage greater inno­vation;

• Promote public–private part­nerships to enhance aging U.S. infrastructure; and

• Foster greater transparency and cooperation.

I have dealt with most of these conclusions in earlier the earlier posts on this report, so I will not dwell on them further here. There is one new area found in this concluding section that it not addressed anywhere else in the report and that is the one dealing with ‘aging U.S. infrastructure’. It is a shame that Ms. Zuckerman forgot to address this issue in the body of her report because she may have made a potential contribution to the discussion of chemical facility security. Unfortunately, we are left with glittering generalities such as:

“The United States’ overall critical infrastruc­ture, including the chemical sector, is inadequate and aging. Greater investment is needed not only to ensure that U.S. critical infrastructure is protected but that it is capable of bouncing back quickly when disaster strikes.” (pg 10)

In general there is more than a little truth in the description of critical infrastructure as ‘aging’ and ‘inadequate’ covers a wide range of perceived and actual problems. The conclusion that ‘greater investment is needed’ is hardly revolutionary, but it begs the question of where the money is going to come from for that investment. This issue is one that deserves a whole host of reports about specific areas of infrastructure, public and private, that could have a potential effect on chemical facility security.

Industry Response

One would be forgiven for concluding, after reading this report, that industry was widely disillusioned with the CFATS program and wanted to see it replaced with a radically different program. This is never specifically stated in the report, but Ms. Zuckerman does repeatedly talk about the burdens that the program places upon industry.

In the last couple of days, however, the chemical industry has started to respond to this report, and it hasn’t been favorable. An article over at NTI.org (Government Security Newswire, GSN) quotes representatives from two of the largest organizations representing chemical facility owners, the American Chemistry Council (ACC) and the Society of Chemical Manufacturers & Affiliates (SOCMA) as being generally supportive of continuing the CFATS program. They acknowledge problems with the current implementation, but support the basic premise and design of CFATS.

These two organizations certainly don’t represent all of the chemical facilities that are covered under CFATS, but I would be willing to bet that they cover a majority of the Tier 1 and Tier 2 facilities that are having to spend the greatest amount of money on upgrading the security measures at their facilities to comply with the program.

Now part of that support is simply fear of the unknown. Not knowing what type of program would replace CFATS, and Ms. Zuckerman provides nothing beyond glittering generalities, industry would rather deal with the devil they know than accept the potential for an entirely new program.

Given the fact that Congress has been unable to craft comprehensive chemical security legislation since 2001, it is unlikely that it would be able to do so any time in the foreseeable future. Eliminating the CFATS program would leave a void with unpredictable consequences. The GSN article notes that industry fears that an EPA based program might result in requiring IST implementation. What is even more likely is that several State and local governments, no longer restricted by the supremacy of the CFATS program, would craft a patchwork of local regulations that would leave selected facilities with onerous requirements (certainly including IST provisions in many localities) while leaving their competitors with no regulations.

Areas That Were Not Addressed

There are a number of problem areas in the CFATS program that were glossed over, minimally mentioned, or completely ignored in this report. While I have addressed most of these in some details in various posts over the years, I would like to take this opportunity to mention some of the more important ones (in my opinion) so that future researchers might have a better chance of preparing a report that deals with actual issues and problems in the CFATS implementation.

CFSI

Ms. Zuckerman briefly mentions the problem with the qualifications of Chemical Facility Security Inspectors (CFSI). The initial members of the CFSI were drafted from the Federal Protective Service. These were law enforcement personnel with a background in physical security, they had little or no background in dealing with chemical facilities. The folks at ISCD realized this problem and established a Chemical Security Academy. I did an initial blog posting on that topic a number of years ago. Since then I have done a number of other blog postings on the issues related to training of CFSI. They include topics such as:

• The shortage of chemical security professionals;

• The need for control system security expertise;

• The need to look at process safety issues;

• The skills needed for CFSI;

• The skills required for CFSI applicants; and

• The problems with the DHS hiring process;

Armed Security Forces

A number of commenters on the Anderson Memo about the problems associated with the current CFATS program have taken particular issue with the problem of current CFSI who started out as sworn law enforcement personnel wanting to continue carrying their side arms. Leaving aside for the moment the definition of enforcement in the CFATS environment, the failure of ISCD to address the issue of the use of armed security personnel to stop terrorist attacks on high-risk chemical facilities is a much unnoticed failing of the program. I have dealt with this issue in a number of blog posts:

• Armed Guards;

• Comments on Draft RBPS Guidance – 12-05-08;

• More Thoughts on Security Forces;

• Purpose of Security Forces;

• Security Forces at Chemical Facilities – Mission Requirements;

• Security Forces at Chemical Facilities – Mission Definition;

• Security Forces at Chemical Facilities – Weapons Limitations;

• Detection vs Response;

• Perimeter Fencing; and

• Another Look at CFATS and Weapons;

SSP Shortcomings

The biggest current problem with ISCD is their apparent inability to effectively authorize any Site Security Plans. While many commenters have noted this problem, no one has attempted to determine the root cause. While I have not had the opportunity to do a detailed study of the problems on the ground, it is clear from the limited comments we have heard from DHS and the inspected community that there is a serious shortcoming with the current SSP tool in CSAT; it is not adequately soliciting the information needed by ISCD to conduct a paperwork evaluation of the programs at the facility.

Any security professional that looks at the questions asked in the SSP tool would realize that the level of detail required for an adequate assessment of the security plans at the facility would not be provided by those questions as asked. This has resulted in DHS establishing the Pre-Authorization Inspection program where presumably the CFSI are tasked with seeking out the necessary information.

I have addressed the ways that this problem might be addressed by facilities in submitting their SSPs, but it seems to me that the SSP tool needs a fairly extensive revision if it is ever going to provide the level of detail necessary for ISCD or its contractors to evaluate the security planning at CFATS covered facilities. Lacking that ISCD should institute a program where they send a detailed letter to the facility seeking the specific information they need to make their evaluation rather than sending the CFSI out to get the information.

Personnel Surety

While there are any number of other security related issues that might be addressed by any reasonable revamp of the administration of the CFATS program, I’ll just address one more in this posting, the lack of an approved personnel surety program. RBPS #12 requires facilities to conduct background checks on all facility employees and contractors and any visitors requiring unaccompanied access to critical areas of the facility. The provisions for checking identity, criminal history and legal authorization to work can be adequately complied with by using any of a number of commercial organizations to conduct background investigations. The one area that cannot be accomplished by such organizations is the identification of people with terrorist ties.

The failure of ISCD to come up with a reasonable program for allowing facilities to have ISCD or some other agency of DHS to vet personnel against the Terrorist Screening Database is inexcusable. Such a program should allow for the use of any of the currently available TSA vetted identification programs (TWIC, HME, etc) and/or provide a simple method of submitting individual information to ISCD for such vetting. ISCD tried to make their program much more complicated than was necessary. Since that program was recently withdrawn, ISCD’s delay in getting such a program established will continue to put off establishing a terrorist screening program for an even longer period of time.

Moving Forward

ISCD and the CFATS program have a number of challenges and problems to overcome. Documents that are purportedly comprehensive looks at the program like this Heritage Foundation report could provide a basis for the discussion of how to move proceed with developing a workable chemical security program for high-risk chemical facilities. Unfortunately, Ms. Zuckerman did little to move the discussion forward.

Chemical Inspectors and ISCD Problems

I got an interesting email from a reader last week who has an interest in becoming a chemical facility security inspector (CFSI) for the CFATS program at DHS. After reading the FoxNews.com story about the problems at ISCD he was concerned about how those problems might affect his prospects for future employment in that area. That question has specific meaning for the reader, but is also of a more generic concern for the chemical security community.

First off, let me make clear that, in my opinion, the CFATS program is going to be around for quite some time. There has been no serious talk by anyone in Congress about disbanding the program and many who want to see the program expanded to include some of the classes of facilities that are currently exempted from CFATS coverage. In fact, the political debate about the CFATS program has always been about the scope and coverage of the program, not the need for a chemical security program.

Shortage of Chemical Security Professionals

One of the weak spots in the CFATS program has always been the CFSI. This is not due to any personal or professional shortcomings of the current crop of CFSI, but rather the fact that until very recently there was no such thing as a chemical security inspector. In fact, there have been virtually no chemical security personnel at all.

Okay, there have been security personnel at chemical facilities for a long time and their number certainly increased after 9-11, but for the most part these have been standard security personnel concerned with standard security matters such as entry control, perimeter patrols, and loss prevention. The number of people that understood the unique security aspects of process chemistry, both as targets and as potential weapons, was extremely small and most were concerned about security of overseas chemical facilities owned by the major chemical companies.

In the same way there were very few people in the chemical processing industry who really understood security; locks, fences, and rent-a-cops seemed to be adequate security to most chemists and engineers.  Even then the basic necessities of those programs such as key control, clear zones and gate procedures were beyond the understanding or concern of chemical professionals.

CFSI Training Issues

Because of the lack of chemical security professionals, the bulk of the first CFSI hired and trained by ISCD were in fact security professionals; security managers, inspectors and law enforcement types. Most of them came from backgrounds in the Federal Government since this eased many of the vetting requirements.

This created a bit of a training problem for ISCD. While the training should have been concentrated on CFATS related issues (§550 restrictions, RBPS guidelines, etc) much of the focus of the Chemical Facility Security Academy had to do with chemical process and safety issues. Security personnel had to be trained in the basics of chemical process language, equipment, and chemical handling as well as the standard OSHA mandated training for personnel operating in chemical processing facilities. And there had to be at least a couple of trips to actual chemical processing facilities so that CFSI wouldn’t be totally overwhelmed by the complexity of things when they strolled into their first official inspection.

With all of that on the docket there certainly wasn’t time in the 8 week training program to include such things as the pros and cons of various security and chemical safety devices, cybersecurity fundamentals for both IT and control systems, personnel surety standards (that still don’t exist) and a whole host of other matters that would need to be evaluated in chemical security inspections.

I know that ISCD has attempted to recruit more personnel from the chemical industry to fill vacated and new CFSI positions. I have seen no figures to date on the success of that effort, but even if successful, that only complicates the training problem as people with chemical backgrounds have to be taught all of the standard security stuff about which they are clueless.

This training issue is going to plague the CFATS program for the foreseeable future. Until there is a stable stream of personnel with industry experience as chemical security professionals ISCD will be hiring people that lack significant parts of the skill sets needed to be a CFSI. One of the best places that DHS could put some chemical security grant money is to one of the schools that has an industrial chemistry program (a relatively new discipline of its own) to develop a degree program for chemical security professionals.

CFSI Requirements

In my opinion, a CFSI should first be a chemical professional. This means at least a BSc degree in chemistry or chemical engineering, perhaps industrial hygiene. Experience working in a chemical processing facility would be a plus. This background would provide the CFSI the ability to speak with and understand the engineers and chemists that run most facilities.

I don’t mean to denigrate the skill and knowledge necessary to be a security professional, but a large part of the knowledge base in that profession will not be of much use in a chemical processing environment. Besides, the §550 restrictions on specifying security requirements will get many people from a real security background in trouble in the field.

A law enforcement background will not be particularly useful in this position. The skills and training necessary to be a cop do not really apply to security (though cops will generally understand security better than chemists) and there is little need for the investigational skills associated with law enforcement. Any actual attacks or suspected attacks will be investigated by local police or the FBI not ISCD.

Restricting the hiring of CFSI to people with a chemical background will make the training problem easier for the Chemical Security Academy. They would be able to concentrate on security issues and program requirements.

So You Sill Want to be a CFSI?

So after all is said and done what does it take to become a CFSI? The short answer is you put in an application when a position vacancy is announced on USAJobs.gov. I just did a search and there are no such jobs currently listed. You can set up an account on the site and have them notify you when a vacancy is announced. You’ll have to use the ‘Advanced Search’ option and I would limit the search to DHS and NPPD under the ‘Agency Search’ option.

What qualifications are necessary? Well you have to be a US Citizen and be capable of getting a Secret security clearance. Beyond that you’ll have to look at the announcement in USAJobs.gov. This is still an evolving position and I expect further changes to be made in the job requirements based on the ISCD report (though I still haven’t seen the report).

What are your prospects of getting hired? That’s a good question. There are only a limited number of positions available (160 is the latest figure that I recall) and I believe that most are currently filled. I don’t see a major expansion any time soon. I don’t know how much of a turnover the Department is having (I would hope that the ISCD report touches on that, but we still haven’t seen a publicly released copy), but I don’t expect that it is real high.

Oh yes, expect to have to move. DHS has been advertising these positions as location specific for a regional office and the last listing that I saw said that they would not pay relocation expenses for new hires.

CFSI Pay Problems

I continue to hear complaints from chemical facility security inspectors (CFSI) about the way that the management of ISCD is handling their pay issues. It should be clear to anyone that is paying attention that this job is not a typical 9-to-5 job and between travel, inspections and writing up the results of those inspections, the typical CFSI spends much more than 40 hours a week supporting the CFATS program.

Unfortunately, it seems that there may have been mistakes made when the compensation system was established for the CFSI, particularly with the administratively uncontrollable overtime (AUO) system. Given the speed with which the CFATS program was established and the unique nature of the program, such mistakes are not unexpected, and are certainly not reprehensible in and of themselves. The reports I’m getting, however, seem to indicate that more attention is being paid to passing blame than with problem resolution.

What appears to be causing the dissension in the ranks is the perception that the people being brought in to solve the problem do not understand the type of job being done by CFSI and, worse yet, don’t appear to care to try to understand. This combined with still unresolved locality pay issue leaves many CFSI feeling that they are going to be stuck holding the financial bag when these problems are finally ‘resolved’.

One of the things that I learned early in my military career was that if your people trusted you to try to do the right thing, they would put up with a lot of hardship and would do their best to do the right things themselves when it came to making hard choices. If they didn’t trust you, problems get magnified all out of proportion to their actual extent and no one would be willing to take the risk of trying to do the right thing.

Fortunately, the current leadership of ISCD, though certainly not responsible for the initial problems, will probably not remain in their current position much longer, being placeholder, acting management. When a new Director is hired one of the first things that person is going to have to do is to regain the trust and respect of the workforce in the division. In the meantime, the leadership of NPPD and DHS need to assure the CFSI that they will not be stuck paying for the mistakes that were apparently made in setting up the CFSI compensation system. Or perhaps Congress needs to make those reassurances.