2019 CSSS Presentations Available

Yesterday the DHS Cybersecurity and Infrastructure Security Agency (CISA) updated both the Chemical Facility Anti-Terrorism Standards (CFATS) landing page and the Chemical Sector Security Summit (CSSS) web site to provide a link to the presentations page for the 2019 CSSS. As is usual for the CSSS, even given the advent of live web casts of many of the presentations, the presentations page just provides copies of the slides used during the CSSS, not the voice or text of the actual presentation, so many of the details have been lost to posterity.

The list of presentations, however, is impressive (see the presentation page for links to the documents):

• Air Domain Awareness           522.67 KB

• Assessing the Risk from Stolen or Diverted Toxic Industrial Chemicals 2.61 MB

• Building an International Network of Chemical Security Practitioners   994.41 KB

• CFATS and the Personnel Surety Program (PSP) Overview      1.74 MB

• CFATS Deep Dive     2.3 MB

• CFATS Personnel Surety Program      781.18 KB

• Chemical Sector 101  2.81 MB

• Chemical Security Analysis Center (CSAC) Overview 3.55 MB

• CISA Regional Service Delivery Model           2.02 MB

• Compliance Requirements for Release Chemicals        2.13 MB

• Dow Incident and Crisis Management 420.26 KB

• Extreme Weather Impacts       3.29 MB

• Federal Emergency Management Agency's Chemical, Biological, Radiological, and Nuclear (CBRN) Office: Chemical Portfolio Overview    1.44 MB

• Industrial Control Systems Vulnerabilities and Resources         1.63 MB

• International Chemical Security Framework     831.89 KB

• International Supply Chain Protection Challenges and Solutions           1.85 MB

• Introduction to the Maritime Transportation Security Act (MTSA)        2.12 MB

• Jack Rabbit II Update and Impacts      2.65 MB

• Little Arc-Flash: How Digital Attacks Can Cause Physical Ramifications          1.45 MB

• Multidisciplinary Partnerships in Chemical Security and Preparedness  1.68 MB

• Office for Bombing Prevention (OBP) Overview         417.7 KB

• Reducing the Threat of Improvised Explosive Device Attacks by Restricting Access to Explosive Precursor Chemicals        737.28 KB

• Supply Chain Risk Management         1.63 MB

• U.S. Coast Guard Cyber Risk Management      1.17 MB

• Waterside Security of Especially Hazardous Cargoes (EHC)     1.83 MB

• Weather Hazard Preparedness 5.12 MB

• What to Expect During a CFATS Inspection    1.01 MB

I have not had a chance to do a detailed review, or even look at all of the presentations, but a quick review of the CFATS Deep Dive presentation shows that the slides may contain a great deal of useful information for CFATS facilities and chemical facilities that are not currently involved in the CFATS program but are concerned about their facility security. Interesting bits of information from this presentation include:

• Shipping/Receiving COI slide contains note about “In-Transit Security and Tracking”;

• Response slide contains note that: “Local Emergency Planning Committees (LEPC) may be contacted by local Chemical Security Inspectors to verify that facilities have developed plans for emergency notification, response, evacuation, etc.”;

• Good detail in Crisis Management slide;

• Outreach with Local Responders slide includes note to: “Invite Local Law Enforcement and Responders to DHS Inspections”;

• Cybersecurity slide provides brief discussion of what computer systems might be covered under CFATS program;

• Personnel Surety slide contains a good ‘Hiring Checklist’, but missed the opportunity to provide a similar ‘departure checklist’ (maybe it was discussed in the actual presentation?);

• Annual Audit Example slide contains a detailed example of how to record (and by inference conduct) an annual audit of the facility’s CFATS program;

I really like the idea of inviting off-site response personnel to CFATS inspections. It helps keep them involved in the process, aware of what is going on, and should provide some chemical security training that is missing from most professional training programs for these personnel. A copy of invite letters should be kept in the facility’s CFATS records to demonstrate positive outreach to these folks, even if they do not participate.

I hope to get to do more detailed reviews of some of the presentations here over the next couple of weeks.

2012 CSSS Presentations Available – Really

Okay, five days later DHS NPPD has finally gotten the dead link problem taken care of on the 2012 Chemical Sector Security Summit page, but they sure went around the block to do it.

The first thing that they did was to take the links to the presentations off of the CSSS page and provide a link to another page, the 2012 Chemical Sector Security Summit Presentations page. They also modified the list of presentations from the earlier version of the page and made it more difficult to read by centering the list of presenters vertically next to the subject title when there were multiple presentations under the same heading. Okay, that sounds confusing; just look at the page and you’ll figure out what I was trying to say.

The list of presentations on the second page is not in the same order or organized in the same manner as on the front page. No real big problem here, but it does make it more difficult to find a particular presentation to look at. Okay, it is only 18 presentations so it really isn’t that big a deal.

There are active links on the presentations page, but they don’t actually take you to the presentations. Click on any of the links provided and it takes you to a separate page with a link to that particular presentation. That page provides a little bit of information about the presentation, the most valuable of which is the file size. There is a link to that presentation that does actually go to the presentation.

Okay, it’s not like they were cutting down trees to put these 18 extra web pages up. But it did take some extra site design time and wastes some space on a server that is consuming some level of additional power to maintain the extra pages. Oh yes, it does take some additional time for the reader to click through, but who cares about them. Not apparently anyone at DHS.

Have I said yet that I think the new DHS web site design sucks? The attentive reader may have noticed that I am less than thrilled that DHS has lowered its standards to those of DOT.

One last complaint: they are still only PowerPoint® presentations. For those of us who cannot afford a yearly junket to Washington to attend the CSSS, this is the only real source of information we have from this important information sharing session. Ignoring for the moment muckrakers like me, the 600 person attendance limit shuts out most of the CFATS covered facilities from attending this function. Then limiting the information shared to these slide presentations is ludicrous. At the very least there should be an audio file so we can hear the presenters’ explanation of the slides. What we really should have is a web cast of these presentations.

Okay, enough complaining. I’ll cover some of the presentations in more detail in upcoming blogs.

CSSS Presentations - DHS IST Proposal Confusion

As part of my review of the presentations made at the recent Chemical Sector Security Summit (CSSS) I was looking at the three presentations made as part of the Inherently Safer Technology (IST) panel when I received an email from a long time reader. That email contained a copy of an article, “US safer technology trial balloon draws fire”, by Joe Kamalick posted on July 15th on ICIS.com (unfortunately I do not have a subscription to ICIS and the reader did not have the URL of the article). The article essentially says that Larry Stanton of DHS proposed in his presentation a new way to handle the imposition of an IST requirement in the CFATS program without having to rely on a Congressional legislative mandate. Kamalick reported comments by SOCMA that they were surprised by this proposal, and comments by the NPRA that they were waiting for a formal proposal by DHS before they would look at the idea. Not a New Proposal First off, Stanton’s presentation is hardly new. It was made first to a Center for Chemical Process Safety meeting last year (6th Global Congress on Process Safety) at an inherently safer technology and security panel discussion. At that meeting Stanton explained that with the political push to include an IST mandate in any CFATS authorization, DHS had been tasked with looking at how such a program could be actually established. Since then, Under Secretary Beers formally announced that the Administration supported such a mandate in testimony before the Senate Homeland Security Committee. Back in May I interviewed Stanton for an article that I wrote for the May-June issue of the Journal of HAZMAT Transportation (21:1, pgs 12-3) on this subject. In that interview Stanton reiterated what Beers told the Committee; DHS wanted to work closely with industry to come up with a practical method of using IST to address security issues. This cooperative attitude was emphasized by asking us to include Larry’s contact information in the article; this was also included in the CCSP and CSSS slide presentations. In both slide presentations and in my interview Stanton made clear that DHS does not believe that they have authority to include an IST implementation mandate in the current CFATS program. Actually the current CFATS authorization prohibits DHS from requiring any specific security measure. But DHS does believe that a ‘Consider, Document, and Report’ could be added with an appropriate rule making process under the current authorization. Part of the reason that DHS is interested in pursuing a CDR requirement is that there is a concern that facilities have been effectively instituting their own IST initiatives and the Department has no idea of how these facility programs have been affecting the larger nationwide chemical security situation. Some IST security measures could, for example, shift the risk to other locations or populations and DHS doesn’t want to encourage that type of security change. IST Limitations DHS is fully aware of the limitations of Inherently Safer Technology. As Stanton points out in his presentations, IST is explicitly a safety evaluation tool not a security measure. This presents DHS regulators with a problem, IST “is a concept, not a list of some kind. Hence, ‘consideration’ becomes an open-ended proposition limited only by the imagination” (Slide 6). From a regulatory point of view this makes it very difficult to require a facility to ‘consider’ IST changes to its processes. Do you have an exhaustive set of techniques that you would list in the regulation for each chemical to be evaluated by every facility producing or using that chemical? A comprehensive list would be very long and most applications would not be appropriate to all users of a given chemical. The cost of conducting and documenting such reviews would be huge while auditing and verifying compliance would be nearly impossible. Look at the relatively simple example of the use of chlorine gas as a disinfectant in the water treatment industry. Possible ‘alternatives’ include on-site chlorine generation, industrial strength bleach shipments, on-site bleach production, ozone treatment, UV light treatment, reverse osmosis filtration, and even steam distillation. The effective evaluation of anyone of these techniques would require each local chlorine-using treatment facility to hire a consultant to conduct the appropriate engineering design studies to gauge the technical and financial feasibility of that technique. Defining the problem to be reviewed, posting the requests for proposals, reviewing the submissions and choosing a contractor could consume all of the 120 time limit for producing an evaluation as part of the process of producing a site security plan. Do you allow a facility to choose a single technique to evaluate? This could allow some facilities to choose a cheap alternative that simple shifted the risk to other, perhaps larger populations. For example, how many people are now potentially exposed to the chlorine used to make the industrial strength bleach that Clorox will substitute for the chlorine that it used to use to make household bleach. Or would a facility choose a very expensive alternative, sure in the outcome that it could not be a financially feasible alternative. Political Decisions These are the kinds of questions that DHS is asking industry to help it solve. If industry abdicates and refuses to be associated with any kind of IST program, then it is likely that the backers of a radical IST agenda (elimination of the production and sale of chlorine for an extreme example) will have the majority of the input on how an IST provision is formed by Congress. The people that are advocating an IST implementation mandate have a very one dimensional view of the issue; chlorine is bad, use something else. For industry to maintain an equally myopic view of ‘leave my process alone’ is just as destructive. Those either-or decision making processes just set up the kind of back and forth regulatory environments that industry cannot afford. Change the rules when you change administrations is easy politically and only marginally difficult regulatorily. When it comes to planning for and running a business it is a sure way to bankruptcy. The professionals at DHS are trying to put together a program that will help industry to protect their facilities and neighborhoods in a predictable regulatory environment, one that is based on a level playing field where competitors will have similar security requirements. They are proficient at writing regulations, conducting inspections and investigations, and enforcing rules. They do not have a detailed background in the chemical and process engineering disciplines necessary to write effective regulations in this area. They need the proactive help of industry to determine what can be reasonably done and how to do it in an economically responsible manner. So, industry lets get off the dime. You have some of the best engineering and safety professionals in the world working for you. Help DHS figure out how to make this work. Just remember, Greenpeace and the Center for American Progress are certainly willing to give their assistance to DHS.