Updated GAO Report on CFATS Program

Yesterday the GAO made available their report on DHS Efforts to Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be Strengthened. As with the earlier DHS IG report, ISCD Director Wulf forwarded a copy of the report to CFATS stakeholders (presumably including covered facilities) with a note saying: “The report includes three recommendations, with which the Department concurs.”

The Report

This latest report is essentially an update on the interim report presented last month at the March 14^th hearing before the Environment and Economy Subcommittee of the House Energy and Commerce Committee. The areas addressed in that earlier report informed much of the discussion that took place in that hearing. Three general areas of concern were reviewed in this report:

• An incomplete risk assessment process is used to assign facility Tier rankings;

• The SSP assessment process is time consuming; and

• ISCD communications with industry lacks an adequate feedback mechanism.

Risk Assessment

The report discusses the general approach that ISCD uses to assign a facility a CFATS risk score which is then used to assign a facility to one of four possible risk Tiers. It notes that the risk assessment process is slightly different based upon the type of chemical risk at the facility; release, theft/diversion or sabotage. It also briefly describes the two problems with the models used in that assessment that were discovered and addressed by ISCD in the last two years.

The GAO continues to take ISCD to task for not utilizing the three factor approach to risk assessment; consequence, threat and vulnerability. ISCD’s current methodology currently only utilizes consequence in its risk assessment model and then only human casualties not economic. Even when analyzing human casualty consequences from an attack the report notes that the data used for that assessment is based upon 5-year old Metropolitan Statistical Area information not the annually updated Urban Areas Security Initiative data.

As a side note, one would assume that if ISCD did use the annually updated data there would be the possibility that some facility tier rankings could change as the population density around them changed. This could result in a requirement for periodic changes in facility security plans to reflect changes in risk. While a theoretical argument could certainly be made that this would provide for more effective security, it would certainly lead to an burden increase on affected facilities and ISCD.

The report notes that ISCD has some programs in place to begin to address this issue, but reports that there does not appear to be a comprehensive plan in place to move these efforts forward. Two of the three recommendations included in the report address these issues:

• Develop a plan, with timeframes and milestones, that incorporates the results of the various efforts to fully address each of the components of risk and take associated actions where appropriate to enhance ISCD’s risk assessment approach consistent with the NIPP and the CFATS rule, and

• Conduct an independent peer review, after ISCD completes enhancements to its risk assessment approach, that fully validates and verifies ISCD’s risk assessment approach consistent with the recommendations of the National Research Council of the National Academies.

SSP Evaluations

The second area addressed in this reports looks at the problems that ISCD has had with its site security plan authorization and approval process. It includes a fairly detailed description of the original review process and the two subsequent revisions to that process that have brought us to where we are today, approving 30 to 40 plans per month.

The report doesn’t really address the process, however. It is more concerned with being able to measure the improvement in the effectiveness of the process since the changes have been made. It does make the point that there are no records of efficacy (or lack thereof) from before the changes were made, so there can be no real evaluation of whether the new process is ‘better’.

Having spent most of my chemical life working as a process chemist, I know the value of being able to evaluate the effects of the changes made. But, when you go from 0 authorizations in two years to 50 in six months to 230 in three months, I think we can all agree that an improvement has been made.

ISCD is beginning to establish project metrics so that they will be able to better document the effects of future changes. The GAO was obviously satisfied; they made no recommendations in this area.

Community Outreach

The final area that this GAO report looks at is the efficiency of the Department’s communications with the regulated community and other entities (local communities, first responders, emergency planners, etc) affected by the CFATS program. The GAO notes that the number of the Department’s outreach contacts appears to have been increasing over the life of the program, but reported that ISCD was doing nothing in the way of evaluating how effective those efforts were.

The GAO conducted a very limited study of how the regulated community viewed those communications efforts. The study wouldn’t have passed muster in any of the statistics classes or the commercial polling class that I have taken, but it certainly seems to indicate that there is room for improvement in how ISCD communicates with the regulated community. And we certainly don’t want to get into their communications over the years with Congress.

With that in mind the report recommends that ISCD should “explore opportunities and take action to systematically solicit and document feedback on facility outreach consistent with ISCD efforts to develop a strategic communication plan” (pg 40).

Moving Forward

As I noted earlier, ISCD and NPPD have generally agreed with the report and its recommendations. Director Wulf has made the appropriate acknowledgement and acceptance of the recommendations. Now we can only sit and wait to see how well he will be able to make the systemic changes needed to comply. An remember that his organization must do this while authorizing and inspecting facilities at an increased pace, put a personnel surety program into place, and stand up an ammonium nitrate security program That is a lot of stuff to get done, but the backlog is of their own making in most instance. Still, the best of luck to David and his folks.

Coordinate Public Warnings

There is a disturbing article over on WLKY.com about a chemical incident in the Rubbertown area in Louisville, Kentucky. An apparently minor railcar leak at the Dow facility there resulted in area chemical alerts to be sounded. While this sounds like the kind of response that could result in saved lives, local activists claim that local residents were never notified of what actions to take to protect themselves from potential exposure. Now this is one of those areas where there have been longstanding conflicts between a number of chemical facilities and local residents, so this could just be a continuation of the ongoing communication problems in the area. It does, however, highlight a key component of any emergency response plan for high-risk chemical facilities, notification of the local community. In this case the chemical cloud did not apparently make it to the facility perimeter, always a good thing for their neighbors. Local alarms were initiated upon detection of the leak; this would allow for the most response time, providing neighbors with hopefully adequate time to take protective actions. Of course, those neighbors would have to know what actions to take for these automated alarms to be truly effective. Just providing detection and alarms is not an adequate emergency response plan. To be effective, these measures have to be backed up by adequate training of those potentially affected by the detected leaks. Providing training to off-site personnel can be challenging, but it is typically much easier to accomplish than would be responding to law suits that would be inevitably be the result of an inadequately prepared emergency response plan. Having worked in chemical facilities, I clearly understand that the management focus in the event of any chemical release is to gain control of the release and return the facility to full functionality as quickly as possible. This is why the planning and practice of the communication response is a key part of the facility emergency response plan. These communications need to become such an automatic response that they do not consume management time and resources during actual events. Finally, after any incident or exercise, every facility should conduct an after action review of what happened. Problems need to be identified in these effective non-events so that they can be prevented from recurring in events that are actually life-threatening. In this case, plant management needs to sit down with the complaining activists and figure out what needs to be done to solve this communications problem. While these two sides are probably never going to see eye-to-eye, they do need to be able to talk to one another.

Reader Comment 04-01-10 LEPC Response

Jim Lupacchino, from Day & Zimmermann Security Services, responded to a blog posting from last week that had been continuing the discussion of hazard communication. Jim wrote: “I respect the spirit of your commentary. Recognizing that wind speed, humidity and dispersion rates impact the spread of a "threat cloud", I would suggest that there are companies that work with chlorine and anhydrous ammonia that are in close communication with LEPCs'.“Perhaps the LEPCs' could stand up and recognize the companies that share the risks of onsite poison inhalation hazards and demonstrate corporate citizenship in their respective communities.” I agree that there are almost certainly companies out there that do a good job of keeping their neighbors informed about their on-site chemical hazards. Unfortunately those companies seldom make the news for their communications skills. This is the reason that I wrote the posting that started the original discussion; they do deserve recognition, both from their communities and others in the industry. When I see news reports about this type of pro-active community outreach, I will certainly recognize it. It does seem to me that most companies seem to be trying to take the tack of remaining invisible. They do everything that they can to stay below the level of public perception. A lot of this has to do with the bad press that the chemical industry gets when individual facilities do a bad job of handling information sharing during incidents. Bayer CropScience got a lot more bad press for their handing of their Aug 2008 incident than Barton Solvents got good press for the proactive way they handled the results of their catastrophic fire in Kansas City in July 2007. Having said that, every company that holds significant quantities of release toxic COI has a legal and moral obligation to keep their potentially affected neighbors fully aware of the potential hazards from those chemicals and how to respond to potential releases. Trying to educate the public during a catastrophic release is a waste of time and could get hundreds of people killed. Hunkering down and ignoring the press when outsiders point out the hazards in ways that are designed to get people upset only ensures that the public gets a one-sided presentation of the hazard. And it certainly won’t do anything to help prevent a panic in the event of a significant yet non-catastrophic event. I agree with Jim that local LEPC’s should let the public know when facilities are cooperative and proactive in providing emergency response planners with the necessary information needed to get their jobs done properly. They also need to blow the whistle when that cooperation is not forth coming, the point made by Fred Millar in his earlier comment. What we really need is a spirit of cooperation and communication between high-risk facilities and their neighbors. After all, they are inexorably tied together; that is what makes the facility at high-risk of being a terrorist target and what puts the community at risk for the consequences of a terrorist attack.