The Next CFATS Update

Here it is the last day of March already and I expect that we will be seeing the next CFATS update publication from the good folks at the Infrastructure Security Compliance Division (ISCD) in the next week. I have been reporting on these updates since they were first published almost two years ago. What I would like to do today is put in my request for what I think should be included.

First off I want to say that ISCD is to be congratulated on making the effort to share this valuable information with the regulated community. They are under no legal obligation to do so which makes this doubly impressive. Please keep them coming.

Having said that, even good things can be improved. Let’s start with the data; there are two types of data that should be included in the monthly report:

Compliance inspections – With over half of the facilities now having authorized site security plans and having started the compliance inspection process on those facilities that have had approved site security plans for over a year, it is time for ISCD to start providing statistics on compliance inspections; the number of compliance inspections completed, the number of compliance inspections passed.

Facilities no longer covered by CFATS – ISCD has been reporting a declining number of facilities covered by the CFATS program and this is probably a good thing. It would be nice however to know more about how that is happening. ISCD could report the number of facilities that have gone out of business, the number that have reduced inventories to below the Screening Threshold Quantities and the number that have removed the DHS chemicals of interest from the facility.

Starting sometime in the near future ISCD is going to have to start talking about its implementation plan for the new CFATS requirements imposed by the passage of HR 4007 last year. The deadline for the publication of the expedited facility security plan certification process is fast approaching for example. It would be nice if ISCD were to explain its plan for implementing that process.

The current (dead in the water) proposal for the personnel surety program was finally killed by the provisions of HR 4007. It would be helpful if ISCD publicly acknowledged that and withdrew the current information collection request. A brief description of the plan for implementing the HR 4007 personnel surety requirements would also be helpful.

ISCD has tried to establish a reputation for communication with the regulated community. The CFATS Update is one good example of that effort. Expanding that effort to cover the implementation of the HR 4007 requirements would be very helpful.

HR 4007 – Implementation Deadlines

This is part of a continuing discussion of the recently passed HR 4007, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014. In this post I will be looking at the various implementation deadlines set by Congress. The previous postings in this series was:

HR 4007 Sent to the President

HR 4007 – An Overview

Congress has been fairly vocal about the delays in getting site security plans approved, so it is not unexpected that there were a number of very specific implementation deadlines put into this legislation. Some of them are very tight deadlines that don’t take into consideration review requirements outside of DHS.

CFATS Repeal

The bill is very clear that, in general, the current CFATS regulations will continue in force with some changes. Section 2107(b)(1) states that “each existing CFATS regulation shall remain in

effect unless the Secretary amends, consolidates, or repeals the regulation”. And it is important to note that the term ‘existing CFATS regulation’ is specifically defined {§2101(5)} to include any guidance documents published in the Federal Register. This would include the Risk Based Performance Standards guidance document and the Clarification to Chemical Facility Anti-Terrorism Standards; Propane and presumably the current Agricultural Facilities Time Extension Notification.

Having given with the one hand, however, Congress required the Secretary of DHS to take away with another. In §2107(b) the bill would require that:

“Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title.”

Now I have not had the time to go through the current regulations and see what if any of the current provisions of 6 CFR Part 27 may be “duplicative of, or conflicts with, this title”. Even though the bill has not yet been signed into law, I’m sure that the Secretary has at least a couple of lawyers looking at this requirement.

Unfortunately, even with the best of intentions and unlimited lawyer power, I am afraid that the Secretary is going to have a hard time meeting this deadline. Forgetting for the moment the amount of time lost to holidays and the resultant short staffing in any agency at this time of year, even if the Secretary meets the 30 day deadline to produce such a regulation change, it will probably take another 30 to 60 days for it to be processed through OMB.

Also, I’m not sure that this requirement is specific enough to allow the Secretary to avoid the publish and public comment process required by 5 USC 553.

Facility Outreach Program

Section 2109 give DHS just 90 days to establish an outreach program to help identify potential chemical facilities of interest (think back to the West Fertilizer incident) and to make “make available compliance assistance materials and information on education and training” {§2109(2)}. Since the Department has done a great deal of work on this topic since the publication of Executive Order 13650 (see requirement here) this requirement should be fairly simple to complete.

Expedited Approval Facilities

As I mentioned in my last post the Secretary is required to come up with a program to help Tier 3 and Tier 4 facilities expedite the site security plan approval process. This is essentially a program where the facility can self-certify that their plan meets the minimum risk based performance standards associated with a facility at their level of risk.

There are actually two prongs to this program, both of which DHS is required to have up and running within 180 days of the bill being signed. Both are set forth in §2102(c)(4). First it requires that the “Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards”{§2102(c)(4)(B)(i)}.

Then it allows the Secretary to “develop prescriptive site security plan templates with specific security measures to meet the risk-based performance standards under subsection (a)(2)(C) for adoption and certification” {§2102(c)(4)(H)(i)}.

To aid in DHS being able to meet this deadline Congress has allowed that the Department should not be subject to the administrative rulemaking provisions of 5 USC 553 (publish and comment requirements) or 44 USC Chapter 35, Subchapter I (clearance through OMB’s Office of Information and Regulatory Affairs). These exceptions to the regulatory process will certainly make things easier for ISCD to publish a final guidance document as they essentially have carte blanch to do things their way.

Congress could justify moving this outside of the normal rulemaking process because any Tier 3 or Tier 4 facility has the full option to use this expedited approval method in full or in part or not at all. This means that the guidance cannot ‘really’ be a burden on anyone.

Whistleblower Protections

One of the provisions that was added to this bill to make it easier to obtain bipartisan support was the whistleblower protections set forth in §2105. This requires the Secretary, within 180 days, to “establish, and provide information to the public regarding, a procedure under which any employee or contractor of a chemical facility of interest may submit a report to the Secretary regarding a violation of a requirement under this title” {§2105(a)(1)}.

Setting up the reporting and investigation mechanisms may be possible within the 180 day time frame, but this will also require the publication of a regulation (actually just an addition to 6 CFR 27) and Congress did not try to exempt DHS from the normal regulatory process for this requirement. Since this will place a potential ‘burden’ on every ‘chemical facility of interest’ (NOT just CFATS facilities) the normal process will have to be followed.

Various Reports

All of the remaining time deadlines for implementation processes deal with reports to Congress. And no one (besides some beleaguered staffers at ISCD and various congressional committees) cares about those.