GAO Publishes Report on Chemical Plant Personnel Screening

Today, the Government Accountability Office (GAO) announced the publication of their report on “Chemical Security: DHS Should Provide Options for Voluntary Vetting of Facility Personnel for Terrorist Ties”. GAO was asked to evaluate the effects of the end of the CFATS program in 2023 and the decline in CISA chemical security staffing since 2025 on chemical facility security.  

The report noted that (pg 5): 

“According to CISA officials and representatives from the private sector coordinating council, the three selected chemical associations, and the six selected chemical companies we interviewed, losing the Personnel Surety Program is the most significant challenge high-risk chemical facility owners and operators have faced following the discontinuation of the CFATS program. CISA officials also stated that discontinuing the Personnel Surety Program left a gap in chemical facility security that poses significant risks.” 

The Report made one recommendation (pg 16): 

“Identify, evaluate, and implement voluntary options for chemical facility owners and operators to address insider terrorist security risks by vetting their personnel and unescorted visitors with access to restricted areas or critical assets, and, if necessary, seek the legislative authority to do so.” 

The official CISA response to the recommendation (pg 16): 

“The voluntary collection and handling of sensitive personal information necessary to conduct such vetting would raise significant legal, privacy, compliance, and resource considerations. These considerations include proper collection, use, maintenance, and protection of sensitive personal information necessary to support such activities, as well as requirements associated with safeguarding personal data and providing appropriate redress” 

Review - ChemLock Fact Sheets – August 2026

For those of you familiar with my “Looking Back” series of blog posts (latest here), there was almost one today about a post of mine from December 2021 on “Review - ChemLock Fact Sheets”. However, after reviewing the CISA ChemLock web site, I decided that it was probably more appropriate to do a new blog post on the topic. 

Fact Sheets 

Early in the CFATS program, DHS started producing a number of short informational brochures about various chemical security topics. Typically just two pages, these Fact Sheets provided a brief look at a specific topic and provided links to other, more detailed information about the topics. They were never designed to make someone a chemical security expert, but they did form a valuable library for chemical professionals to become more aware of security issues. 

When I wrote that first blog post (CFSN version here) there were just seven fact sheets on the ChemLock web site. Now there are three separate pages listing listing 14 separate ChemLock Fact Sheets: 

• ChemLock General Fact Sheets, 
• ChemLock Security Consideration Fact Sheets, and 
• ChemLock Security Goal Fact Sheets. 

Commentary  

The Office of Chemical Security continues to have a problem publicly sharing information on the ChemLock Program. While there have been training announcements from @CISAgov for various ChemLock classes (here is the most recent), I have not seen any other outreach efforts and no mentions of these new fact sheets. I understand that CISA is still recovering from the emasculation of the agency that occurred last year, but if they want to keep the ChemLock program going, they are going to have to start making more of an effort to bring facilities into the fold. Publicly talking about the program is an important part of that effort. 

For more information on these fact sheets, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/chemlock-fact-sheets-august-2026 - subscription required. 

Looking Back – 8-3-2009 – HR 3258

 Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 17 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list. 

Today, a blog post from August 3rd, 2009, “HR 3258 Analysis – Substance of Concern”, made the list. This was part of a series of posts that I did on HR 3258, the Drinking Water System Security Act of 2009. That bill was successfully reported out of the House Energy and Commerce Committee but never made it to the floor of the House. This was part of the ongoing effort by Democrats of that Committee to expand the CFATS program to include water treatment facilities. They were generally opposed in that effort by the House Homeland Security Committee, just part of the inter-committee conflict about the program. 

It is interesting to note that this post drew two comments that reflected the international interest in chemical facility security regulation. 

Looking Back – 6-2-2010

 Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list. 

Today, a blog post from June 2nd, 2010, “Chemical Storage Dikes”, made the list. It looks at a common safety feature at chemical facilities and its importance to chemical security plans. Anytime a facility relies on chemical safety measures to limit the consequences for a potential terrorist attack, a fresh look needs to be taken at that safety measure to ensure that it will adequately perform its function in the event of an attack on the facility. 

Reports of the Demise of the ChemLock Program Premature

While the current Administration announced their intent to cancel the ChemLock Program, I just saw this on CISA announcement on X:

Apparently CISA expects Congress to ignore this portion of the DHS budget request and continue to provide some level of chemical security funding in FY 2026.

Drones and Chemical Plants

Recent headlines for the Ukraine War highlight a new dimension in the use of drones as a weapon. A report from UPI.com notes: “Ukraine officials say forces struck Russian chemical plant overnight”. This was part of the continuing use of uncrewed aircraft systems (UAS) to strike at military targets deep in Russia by the Ukraine military. The attack reported here was on a munitions factory. Attacks at military-manufacturing targets well behind the active battlefield is nothing new and is part of long accepted military doctrine. Fires and explosions reported occurred, but there is no confirmation (actually there are denials) from the Russian government.

The headline, however, presages a potential problem that I identified in a 1988 article in Army Chemical Review, attacks against chemical manufacturing facilities releasing toxic chemicals into the environment acting as an ‘inadvertent’ chemical warfare attack. Such attacks could be used as a military terror attack in enemy rear areas without having to worry about manufacturing chemical weapons. Drones could be used to attack large water treatment facilities, for example, potentially releasing large clouds of chlorine gas.

Unfortunately, such UAS attacks need not be limited to attacks by military forces. Terrorists could conduct such attacks with relatively low-cost commercial drone attacks on any number of chemical manufacturing facilities. Currently, there is little or nothing being done to prevent such attacks, and the one program in the United States that could have possibly been used for defense of such facilities, the Chemical Facility Anti-Terrorism Standards (CFATS) program ended in 2023 due to congressional inaction. Actions to revive that program are unlikely in the incoming Trump Administration, Trump after all did try to defund CFATS back in 2020.

2024 Chemical Sector Seminar Presentations Online

CISA has updated their ‘Chemical Security Summit’ web page to include a link to a new page that provides .pdf copies of some of the presentations from last month’s 2024 Chemical Security Seminars. That page includes the following presentations:

• Drone Policy and Impacts to Critical Infrastructure,

• The Impacts of Artificial Intelligence on Chemical Security,

• Response Strategies for Hazardous Chemical Incidents,

• State of Chemical Security, and

• "Wicked Problems" in Chemical Security

As always, these static presentations provide a great deal of interesting information, but a great deal of the information that was included in the live/virtual presentation is missing from these slides. Hopefully, we will be seeing links to copies of the live-streamed presentations on this new page in the near future.

The following presentations have not yet been made available:

• Transnational Threats Impacting Chemical Security,

• Federal Partner Priorities for Addressing Emerging Chemical Threats,

• The Impacts of Artificial Intelligence on Chemical Security, and

• Tactics and Resources for Managing Physical and Cyber Threats

The absence of the ‘transnational threats’ presentation is not surprising. The press was restricted from participating in this presentation because of the sensitive information included. That information is still sensitive.

Interestingly the AI presentation seems to have been included in the ‘Wicked Problems’ presentation that is available today.

Chemical Security Seminars – 7-11-24

I got an email today from “CFATS@messages.cisa.gov”, that caught my attention, you bet. It was a reminder about the virtual 2024 Chemical Security Seminars that start this week. Session 1 is on Thursday, the 11^th; Session 2 is the following Thursday. A reminder that the two sessions are different, but there is a single signup for both. You can still register here (Note: Not a .gov website), no charge.

This week’s sessions include:

• Opening and Keynote Remarks (Secretary Alejandro Mayorkas),

• State of Chemical Security (Associate Director Kelly Murray),  

• Transnational Threats Impacting Chemical Security, (FBI and Interpol),

• Federal Partner Priorities for Addressing Emerging Chemical Threats (TSA, CIRCIA, CG, and DOE), and

• The Impacts of Artificial Intelligence on Chemical Security (Sean Ekins, CEO, Collaborations Pharmaceuticals)

I have been registered to attend since the original announcement.

Review - HR 8572 Reported in House – FY 2025 DHS Spending Bill

Last week, the House Appropriations Committee published their report for HR 8572, the Department of Homeland Security Appropriations Act, 2025 and the text of the reported version of the bill. There is on specific cybersecurity language or chemical security language in the bill. The report contains discussions about both, but no mention of the Chemical Facility Anti-Terrorism Standards (CFATS) program.

The House Rules Committee is scheduled to meet on Tuesday to formulate the rule for the consideration of three spending bills, including HR 8572. There have been 232 amendments submitted to the Rules Committee to date for consideration in the debate on the DHS spending bill; two of possible interest here. One is a CFATS amendment that does not extend the program. The second is a cybersecurity amendment to increase funding for research on preventing cyberattacks. The bill is scheduled to be considered by the Full House this coming week.

Spending Bill Items of Interest

As I noted above, there is no language related to chemical security or cybersecurity in the bill itself. I have extracted some of the spending numbers that may be of interest here, along with comparisons to the version of the FY 2024 spending bill reported in the House last year. This allows for a look at how the Appropriations Committee has changed their DHS outlook over time.

Moving Forward

It is clear from the ‘Minority Views’ portion (pgs 173-5) of the Committee Report that HR 8752 as written and reported is a very partisan bill. If it passes it will be by a narrow, nearly party-line vote. Thus, it will have to be considered under a rule to be crafted by the Rules Committee, what is not yet clear is if it is partisan enough to get at least two of the three radical Republican votes in that Committee and avoids Republican votes against the rule on Wednesday.

 

For more details about chemical security and cybersecurity discussions in the Report, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-8572-reported-in-house - subscription required.

CISA Announces 2024 Chemical Security Seminars

CISA updated their Chemical Security Summit web page to announce the “2024 Chemical Security Seminars” to be held online on July 11^th and July 18^th, 2024. While that web page (and an email sent out by CISA today) reports that a preliminary agenda “will be released in the coming weeks”, the registration site includes an agenda page.

Registration is now open (no fee). Register soon, I have.

CISA Publishes ‘Secure Your Chemicals: Potential Threats’

Recently, CISA added a new infographic to their stable of publications supporting the two agency chemical security programs, the currently inactive Chemical Facility Anti-Terrorism Standards (CFATS) program and the voluntary ChemLock program. The new “SECURE CHEMICALS: POTENTIAL THREATS” page shows a brief overview of the potential threats to chemical facilities. The page notes that:

“By considering the potential avenues of attack and approaching security holistically, facility owners and operators can choose cost-effective, efficient security measures that work best to protect their dangerous chemicals from the threats and hazards most likely to occur at their facility.”

100-day Chemical Cybersecurity Sprint

I missed the Chemical Sector Summit this week because of vacation. I have been, however, receiving lots of questions about the reported 100-day cybersecurity sprint for the chemical sector that was discussed at the Summit. Fortunately, CSPAN televised portions of the day-2 presentations including the ‘fireside’ chat’ between Director Easterly and Associate Director for Chemical Security Kelly Murray.

At 15:07 minutes into the video Easterly begins a discussion about the strategic priorities for CISA in the coming year. It was in this section of the talk where she noted:

“We were asked last year by the White House to focus on protection of industrial control systems. I think the chemical sector is next in line that we will kick off the 100-day plan, probably later this year. The other thing I'm excited about is cybersecurity goals that reflect both IT and OT and we will be kicking off with some work on chemical sector goals.”

NOTE: Thanks to CSPAN for providing the written text (from close captioning) to accompany the video on their website.

There is still not much information publicly available on this 100-day sprint, but I have learned that the CFATS folks at CISA are not going to be leading this effort. In some ways, that is a disappointment because of their long work with industry in this field. In a larger sense, however, it is understandable because the CFATS program is targeted at just a portion of the chemical industry. It is a large part (44,000 plus facilities have participated to at least some degree), but it is still just a part of the larger chemical picture.

Review - ChemLock Fact Sheets

Back in November, CISA established a new voluntary chemical security program called ChemLock. Based on the experience that the Office of Chemical Security had developed overseeing the Chemical Facility Anti-Terrorism Standards (CFATS) program, the ChemLock program provides a number of free resources that chemical facilities can use to help protect chemicals produced, used, or stored at their facilities from use in a terrorist attack. The simplest of these are the seven fact sheets that provide brief looks at various aspects of a chemical security program. Those fact sheets include:

CISA ChemLock Overview,

ChemLock: Chemical Product Stewardship,

ChemLock: Chemical Security Considerations for No-Notice Events,

ChemLock: Chemical Security on a Budget,

ChemLock: Conducting a Chemical Security Self-Assessment,

ChemLock: Drone Activity, and

ChemLock: Reporting Suspicious Activities and Security Incidents

These two-page fact sheets are not comprehensive educational materials. They provide facilities with some basic information and links to additional resources. CISA can be expected to add additional fact sheets to the ChemLock Resources page as time passes.

For a description of each of the fact sheets, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/chemlock-fact-sheets - subscription required.

Correct FAA Failure to Act

Earlier this week the Department of Transportation published a regulatory review notice in the Federal Register seeking public comments on its current review of “existing regulations and other agency actions to determine whether they are consistent with the policies and National objectives set forth in these executive orders [EO 13990 and EO 13992].” The ‘action’ that I would like to draw to the Department’s attention is the inaction of the Federal Aviation Administration in complying with §2209 of PL 114-190 (130 STAT. 634) , the FAA Extension, Safety, and Security Act of 2016.

The Requirement

On July 15^th, 2016 President Obama signed into law HR 636. Section 2209 of that bill required the FAA to “establish a process to allow applicants to petition the Administrator of the Federal Aviation Administration to prohibit or restrict the operation of an unmanned aircraft in close proximity to a fixed site facility” {§2209(a)}. Fixed facilities in the following categories would be able to request designation as an area where unmanned aircraft systems would be restricted from operation {§2209(b)(1)(C)}:

• Energy production, transmission, and distribution facilities and equipment,

• Oil refineries and chemical facilities,

• Amusement parks, and

• Other locations that warrant such restrictions.

Section 2209 gave DOT 180 days from the signing of the bill to establish the process described above. That would have been January 12^th, 2017. To date no rulemaking activity has been published, nor is their a listing of such a rulemaking in either the current Unified Agenda or Long Term Actions Agenda.

To Limit Exposure

Part of the intent of Biden policy outlined in §1 of EO 13390 is “to limit exposure to dangerous chemicals and pesticides”. It would seem to me that a key component of ‘limiting exposure’ would be to help chemical facilities prevent accidental or deliberate releases of dangerous chemicals caused by actions or activities of UAS over their facilities. Clearly, this is the intention of §2209. Failure to provide chemical facilities with this security tool substantially limits their ability to address this mode of limiting exposure.

Proposed Action

The Department of Transportation should take immediate action to begin the rulemaking process on this requirement.

NOTE: A copy of this blog post will be submitted as a comment on the referenced DOT notice.

Bills Introduced – 2-18-21

Yesterday with the House meeting in proforma session and the Senate recovering from the impeachment trial, there were 121 bills introduced. Three of those bills may receive additional coverage in this blog:

HR 1119 To codify an Executive order securing the United States bulk-power system.  Rep. Duncan, Jeff [R-SC-3] 

HR 1162 To make supplemental appropriations for the Departments of Agriculture, the Interior, Homeland Security, Labor, and Commerce for the fiscal year ending September 30, 2021, and for other purposes  Rep. Neguse, Joe [D-CO-2]

HR 1178 To establish the National Commission on Domestic Terrorism, and for other purposes. Rep. Speier, Jackie [D-CA-14]

I will be watching HR 1162 for spending related to cybersecurity or chemical security issues.

HR 1178 probably will not fit into any of the ‘normal’ categories of topics that I cover in this blog, but I suspect that it will have future impacts on chemical security and transportation security down the road. It also might have impacts on cybersecurity, but that is less certain.

NOTE: The Government Printing Office is getting further and further behind in publishing official copies of legislation. As I write this the latest bill printed is HR 550 which was introduced on February 5^th. As congress continues to accelerate its bill writing efforts, this is going to have an impact on the ability of legislative analysts like myself to provide timely analysis of legislation before it is considered by Congress.

CISA Publishes 2020 Chemical Security Webinars Agenda

Sometime this week (they still have not resumed dating web page changes) the Cybersecurity and Infrastructure Security Agency (CISA) updated their Chemical Security Summit web page to provide updated information for the 2020 Chemical Security Summit. As I had noted earlier, CISA will be holding this mostly-annual summit this year as a three-day virtual event held on consecutive Wednesday’s in December. This week’s update provides an agenda for the three-day event.

I misunderstood the previous update to mean that CISA would be holding one seminar on three-separate dates. The agenda published this week makes it clear the CISA will be holding three separate seminars, one on each day of the scheduled event. This closely parallels the organization of the Chemical Sector Security Summits that have been held over the last 10+ years.

While there are (currently?) no speaker names included in the published Agenda, there are some topics that look to be very interesting (all would appear to be worthwhile). These call-out topics include:

• Jack Rabbit III Demonstration – 12-2-20,

• Security Incidents Trends & Challenges During the COVID-19 Pandemic and Supply Chain Constraints – 12-2-20,

• Chemical Security Threat Briefing – 12-2-20,

• Hurricanes, Wildfires, Floods, and Pandemics – 12-9-20,

• TSA Surface & USCG MTSA Program Updates and Information – 12-9-20,

• Cybersecurity & Physical Security Working Together, 12-16-20, and

• Chemical Security Tools (Virtual Expo), 12-16-20

Registration information is still not available.