Critical Economic Assets and CFATS – Part 3

This is part of an on-going series of posts looking at the potential for an expansion of the effort of the Chemical Facility Anti-Terrorism Standards (CFATS) program to cover facilities that produce critical economic asset chemicals. The current CFATS regulations specifically allow CISA to declare a facility to be a high-risk facility covered by the CFATS program if they are a producer of critical economic asset chemicals.

The first post in the series looked at the historic background of this type coverage in the CFATS program and how DHS tried to look at the process.

The second post in the series looked at how CISA might go about identifying potential chemicals of economic interest (CEI) for the water treatment sector.

CEI List

With the list of critical water treatment chemicals provided by the request for information (RFI) mentioned in the previous post in the series, CISA would develop a list of CEI. The first step in that list development process would be the removal of any chemicals that were already on the DHS list of chemicals of interest in Appendix A to 6 CFR; chlorine comes immediately to mind.

Next, CISA would identify the minimum concentration for each of the chemicals on the list. Since these treatment facilities would be using commercial grades of material, CISA should have little problem in identifying the minimum concentration. In fact, I suspect that for many of the chemicals on the list, there will be just one or two concentrations that are used by the water treatment industry. Where this is obvious from the data provided in the RFI, CISA might find it useful to define chemicals with both minimum and maximum concentrations. For example, while caustic soda (NaOH) solutions may be used by water treatment facilities for pH adjustment, those facilities would have little use for solid NaOH (100%) because of the material handling requirements.

CEI Top Screen

For the CEI list CISA will not be concerned about the inventory levels of the chemicals on the list. Instead, CISA would be interested only in facilities that produce or distribute the CEI identified above. CISA would determine that by means of a CEI Top Screen.  The reason for a separate Top Screen is that CISA would be using the on-line data collect tool to access different types of information. In addition to the standard location and facility information included in the current CFATS Top Screen, the CEI Top Screen would ask questions about:

• The CEI produced at or distributed from the facility,

• The amount of CEI produced or shipped through the facility,

• The amount of CEI shipped to water treatment facilities, and

• The water treatment facilities to which the CEI are shipped.

Risk Assessment

The whole point of the CEI Top Screen (as with the current CFATS Top Screen) is to provide CISA with the information necessary to complete a facility risk assessment. While the CFATS risk assessment is designed to determine the risk of a facility being attacked by terrorists based upon three specific security issues (release, theft/diversion, or sabotage), the new risk assessment would be based upon a new security issue; denial of chemical use. While this risk could still be based upon a terrorist attack, the risk assessment needs to consider the ultimate target, the water treatment facility.

A future post in the series will take a more detailed look at the risk assessment process.

Critical Economic Assets and CFATS – Part 2

This is part of an on-going series of posts looking at the potential for an expansion of the effort of the Chemical Facility Anti-Terrorism Standards (CFATS) program to cover facilities that produce critical economic asset chemicals. The current CFATS regulations specifically allow CISA to declare a facility to be a high-risk facility covered by the CFATS program if they are a producer of critical economic asset chemicals.

The first post in the series looked at the historic background of this type coverage in the CFATS program and how DHS tried to look at the process.

The problem with the initial effort by DHS to look at this issue was that it took a scatter fun approach to determine if a particular reporting facility was a producer of more than 20% of the domestic production of a chemical. In this blog post, I will look at an alternative of identifying facilities that are producers of critical economic asset chemicals.

Identifying Critical Chemicals

The first thing that is necessary is determining what should be considered a critical chemical that could be used to define a critical economic asset. The CFATS regulations provide a first step in this by their definition in 6 CFR 27.105 of the term ‘security issue’ as “the type of risks associated with a given chemical.” That definition then goes on to list the three security issues used found in the DHS chemicals of interest (COI) list in Appendix A to the CFATS regulations, and then adds a fourth “Critical to government mission and national economy.”

The discussion in the preamble to the Appendix A final rule about the list of COI makes it clear that the Department only considered those chemicals for listing if they were “released, stolen or diverted, and/or contaminated, have the potential to create significant human life and/or health consequences.” This would mean that critical chemicals would not necessarily be included in Appendix A. What is probably needed is a new listing of chemicals that could trigger a reporting of the production or distribution of chemicals of economic interest (CEI), an Appendix B to the CFATS regulations.

CEI Designation

DHS, in crafting the CFATS Appendix A, was aided by the fact that there are a number of different regulatory lists that identify hazardous chemicals. Thus, DHS had a large universe of chemicals pre-defined that it could whittle down to a mere 300+ chemicals divided into three security issues that could help further refine the characteristics of the chemicals that would trigger the Top Screen reporting requirement. There are not such lists for easily defined chemicals of economic interest. So, DHS is going to have to start from scratch.

First, we are going to need an operational definition of the term ‘chemical of economic interest’. I would propose that the term would be defined as ‘a chemical which, if the supply of which was interrupted, would interfere with the completion of a government mission, or create significant economic and/or health consequences’. Identifying specific chemicals that meet that definition would be the next step.

Critical Economic Assets and CFATS – Part 1

When the crafters of the Chemical Facility Anti-Terrorism Standards (CFATS) regulations back in 2007 published 6 CFR Part 27, they envisioned that DHS would regulate facilities that produced critical economic assets as well as the DHS chemicals of interest (COI) listed in Appendix A of those regulations. DHS never did classify any facilities as high risk under the CFATS program for the possession of critical economic assets and the issue died due to lack of interest. With the critical chemical supply issues that we have seen lately, perhaps it is time to rethink that issue.

Definitions

There are two definitions in §27.105 that are key to this discussion:

Present high levels of security risk and high risk shall refer to a chemical facility that, in the discretion of the Secretary of Homeland Security, presents a high risk of significant adverse consequences for human life or health, national security and/or critical economic assets [emphasis added] if subjected to terrorist attack, compromise, infiltration, or exploitation.

Security Issue shall refer to the type of risks associated with a given chemical. For purposes of this part, there are four main security issues:

(1) Release (including toxic, flammable, and explosive),

(2) Theft and diversion (including chemical weapons and chemical weapons precursors, weapons of mass effect, and explosives and improvised explosive device precursors),

(3) Sabotage and contamination, and

(4) Critical to government mission and national economy [emphasis added].

The First Top Screen

In 2007 I did a series of blog posts about the initial Top Screen reporting requirements for chemical facilities under the CFATS program. The last post in that series dealt with the questions on the Top Screen about Mission Critical Chemicals and Economically Critical Chemicals. There was also a follow-up post about Critical Chemicals that addressed additional information provided in the Top Screen User Manual at the time.

As I noted in those earlier posts, one of the problems with the data collected by the critical chemical questions on those early Top Screens was that the only facilities that submitted data were those facilities that had reportable quantities of COI on hand and were thus required to submit Top Screens. That, combined with the fact that facilities had every incentive to determine that they produced less than “20% of the domestic production” of a given chemical as that is not a standard reportable data point, and one can see why DHS dropped that particular data collection and took no actions to identify facilities as a covered facility under the CFATS program.

Water Treatment Critical Mission Chemicals

We have had two news reports (here and here) in the last two weeks about critical chemical shortages in the water treatment industry. If either supply situation were much worse, we would have had news reports of unsafe drinking water in major cities. If that situation were to be the result of ransomware attacks or worse a terrorist attack, the public and political blowback would be intense.

So, maybe it is time for CISA’s Office for Chemical Security (OCS) to start to look at using their existing regulatory authority to determine if there are chemical companies that are supplying mission critical chemicals into the water treatment industry that are not currently covered by the CFATS program.

I will be looking at how such a program expansion could be effected by OCS and how it could work in actual practice in a series of articles on CFSN Detailed Analysis over the next couple of weeks.