FEMA Publishes CBRNResponder Network 60-day ICR Notice

Today FEMA published a 60-day information collection request (ICR) notice in the Federal Register (91 FR 237-6238) for a new ICR for “CBRNResponder Network”, collections that are already in use without an approved ICR number. According to the FEMA website: “CBRNResponder is a secure platform for chemical, biological or radioactive/nuclear (CBRN) incident data sharing and multi-hazard event management. It serves as a hub and one-stop shop for all-hazards planning, preparedness, operational tools and resources.” The ICR will support three FEMA forms:

FEMA Form FF-104-FY-24-125, New Users Request for an Account,

FEMA Form FF-104-FY-24-124, New User Request for an Organization, and

FEMA Form FF-104-FY-24-126, Users Submitting Hazard Specific Data.

NOTE: Links to the forms will be available when FEMA submits the 30-day ICR notice to OMB’s Office of Information and Regulatory Affairs (OIRA).

The table below shows the burden estimate for this new ICR:

The CBRNResponder Network website consists of a common set pages for all CBRN responders and separate resources specifically for ChemResponders, BioResponders, RadResponders, and the Interagency Modeling and Atmospheric Assessment Center (IMAAC). Most of the resources on these pages are only fully accessible to registered responders.

FEMA is soliciting comments on this burden estimate. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov: Docket # FEMA-2024-0032). Comments should be submitted by April 13^th, 2026.

OMB Approves Public Assistance NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NMRM) from DHS’ Federal Emergency Management Agency on “Update of FEMA's Public Assistance Regulations”. FEMA submitted this NPRM to OIRA on February 5^th, 2024.

According to the ‘Statement of Need’ for this rulemaking in the Fall 2023 Unified Agenda:

“FEMA proposes to amend its Public Assistance and Community Disaster Loan program regulations to incorporate statutory changes that have amended sections of the Stafford Act relating to Public Assistance and Community Disaster Loans and to improve program administration. These include the Post-Katrina Emergency Management Reform Act of 2006 (PKEMRA), Pub. L. 109-295, 120 Stat. 1394, the Security and Accountability for Every Port Act of 2006 (SAFE Port Act), Pub. L. 109-347, 120 Stat. 1884, the Pets Evacuation and Transportation Standards Act of 2006 (PETS Act), Pub. L. 109-308, 120 Stat. 1725, the Sandy Recovery Improvement Act of 2013 (SRIA), Pub. L. 113-2, 127 Stat. 39, the Emergency Information Improvement Act of 2015, Pub. L. 114-111, 129 Stat. 2240, the Bipartisan Budget Act of 2018, Pub. L. 115-123, 132 Stat. 64, and the FAA Reauthorization Act of 2018, Division D, Disaster Recovery Reform Act of 2018 (DRRA), Pub. L. 115-254, 132 Stat. 3438.  FEMA also proposes to implement program improvements and make clarifications and corrections to existing regulations.”

I do not expect that I will be covering this rulemaking in any depth, but I will be watching it for any language or definitions that would specifically include responses to chemical incidents.

S 4166 Passed in Senate – Technological Hazards

On Wednesday (late reporting due to Congressional Record delay at Congress.gov) the Senate passed S 4166, the Technological Hazards Preparedness and Training Act by unanimous consent. There was no debate and no vote.

The bill would expand the operations of the FEMA Technological Hazards Division, allowing FEMA to provide support communities that surround CBRN research facilities, nuclear enrichment facilities, or chemical manufacturing facilities.

I expect that we may see action in the House under the suspension of the rules process, but not until after the election as the House will not return to Washington until November 14^th.

Review - S 4166 Reported in House – Technological Hazards

Last month, the Senate Homeland Security and Governmental Affairs Committee published their Report on S 4166, the Technological Hazards Preparedness and Training Act of 2022. The Committee took up the bill in a business meeting on May 25^th, 2022. Two amendments were considered with one being adopted by a voice vote. The Committee recommended that the bill, as amended, be recommended favorably to the full Senate, again by a voice vote. The bill would expand the operations of FEMA’s Technological Hazards Division.

Moving Forward

This bill is now cleared for consideration by the Senate. It is not, however, important enough to take the time necessary to go through the cloture, debate and amendment process associated with regular order consideration in the Senate, especially in the last four months of the Session. There is a chance that the bill could be considered under the unanimous consent process, but all sorts of political plays could interfere with that consideration. This bill is more likely to move forward as part of a large bill, either as part of substitute language or as an amendment from the floor.

For more details about the amendment and FEMA’s Technological Hazards Division, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-4166-reported-in-house - subscription required.

Chemical Sector Security Awareness Training – March 2021

FEMA now has an on-line Chemical Sector Security Awareness Training (AWR-912) program available for use by the public, including personnel working at chemical facilities. This training program is not specifically targeted at employees at facilities regulated under either the Chemical Facility Anti-Terrorism Standards (CFATS) program or the Maritime Transportation Security Act (MTSA) program, but it could be used for general security awareness training by facilities in either program. Before an individual attempts to complete the course, they must register with FEMA and obtain a FEMA Student ID (FEMA SID).

NOTE: Readers who have received the March 2021 Chemical Security Quarterly email, will already have heard about this training program. You can sign-up to receive this email (and other CISA information via the https://public.govdelivery.com/accounts/GOVENGAGE/subscriber/new website).

Commentary

This is the new training program that CISA’s Chemical Sector-Specific Agency announced at the 2020 Chemical Security Summit last December. It is actually a rework of the training program that was originally introduced in 2008 and then discontinued sometime in 2015 without notice or explanation.

While this is billed as ‘Chemical Sector Security Awareness Training’ there is actually very little in this program that is uniquely targeted at the chemical sector. There are two video scenarios that use chemical imagery (totebins in one and a chemical railcar in another) to illustrate the need for individuals to be aware of their surroundings and the need for reporting unusual situations, but that hardly makes this chemical sector specific training.

There is no mention of the two federal regulatory programs that address security at chemical facilities, the Chemical Facility Anti-Terrorism Standards (CFATS) program and the Maritime Transportation Security Act (MTSA) program. There are certainly more ‘chemical facilities’ that are not covered by either program than there are covered facilities, it seems to me that there should at least have been some mention of these two important security programs.

Nor was there any discussion of the two specific reasons that a security awareness program at chemical facilities is important, deliberate release of hazardous chemicals as a means of attack on the local community or the theft/diversion of precursor chemicals for the manufacture of improvised explosives or improvised chemical weapons that could be used in a subsequent attack.

If CISA is expecting CFATS facilities to use this training program to satisfy the RBPS 11 annual training requirement for ‘All Remaining Employees’ it sadly only addresses one of the Training Topics listed in Table 13 of the RBPS Guidance Document; “Recognition of suspicious behavior”. Facilities would have to separately address the remaining training topics:

• Recognition and detection of dangerous substances and devices,

• Techniques used to circumvent security measures,

• Relevant provisions of the SSP, and

• The general meaning and consequential requirements of the different DHS Threat Levels

This training program hardly seems worth the effort.

HR 4 Further Amended and Passed in House – FAA Authorization

Today the House finished consideration of the amendments cleared by the House Rules Committee for HR 4, the FAA Reauthorization Act of 2018. They then passed the bill by a strongly bipartisan vote of 393 to 13; the No votes were nearly evenly split between Republicans and Democrats.

There were two remaining amendments from those I described earlier left to be considered today. Amendment #111 (FEMA emergency response plan support) was passed by a voice vote as part of en block amendment 4. Amendment #98 (FAA artificial intelligence report) was not offered during the consideration of the bill either today or yesterday.

The Senate will probably take up the bill with a substitute language amendment that will address a number of different issues with some language in common. This typically would lead to a conference committee to work out the differences between the two bills.

OMB Approves Emergency FEMA Harvey ICR

On Friday, the OMB’s Office of Information and Regulatory Affairs (OIRA) approved an emergency information collection request from the DHS Federal Emergency Management Agency (FEMA) for a new electronic form to collect information from survivors of a major disaster residing in shelters. The purpose of the new data collection is to aid in the rapid transition of those people from shelters into more appropriate living situations.

The impetus for the emergency submission of the Survivor Sheltering Assessment ICR is the current situation in Texas and Louisiana that resulted from the unprecedented flooding from Harvey. This is clear from the wording of the ‘Emergency Justification’ portion of the ICR approval notice. It is also clear from the Abstract that this is a new tool that FEMA expects to use in any future situation where that agency is going to be expected to provide support to people in emergency shelters.

While this ICR was submitted on Friday, it is clear that the ICR was being prepared a week or two before that as it used some extremely outdated estimates (eg: “An incredible amount of rain, 15 to 30 inches with isolated amounts of up to 40 inches, is predicted…”) of the scope of the potential damage from the storm. This also resulted in an almost certainly low estimate of the number of people (30,000) that will be expected to complete the form.

Commentary

It seems clear to me that the collection of data of this sort from a large emergency shelter population is necessary to effectively work to move that population out of shelters and into more appropriate housing conditions in the aftermath of a major disaster. It is actually quite surprising to me that such a data collection effort did not already exist.

It is heartening to me to see that the Trump Administration had started work on this effort before the true extent of the Harvey disaster became known. While this still may (and that is not entirely clear at this point) have been a reactive effort to this specific incident, it still shows a welcomed ability to look ahead and plan ahead. This is especially important to see in an anti-government and anti-regulation administration like the one we currently have.

Whether or not this particular tool is effective, or whether or not FEMA (and the remainder of the Federal government) is up to the task of dealing with the aftermath of Harvey (and do not take your eyes off of Irma) remains to be seen. But, this is an important first step in dealing with the Administration’s first major domestic crisis.

FEMA Publishes HMGP ANPRM

Yesterday the Federal Emergency Management Agency (FEMA) published an advance notice of proposed rulemaking (ANPRM) in the Federal Register (79 FR 13970-13975) regarding possible changes to the Hazard Mitigation Grant Program that would establish criteria to delegate authority to States to administer HMGP. This rule would implement requirements of the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 USC 5170c).

This ANPRM seeks to establish requirements for Program Administration by the States (PAS) in accordance with the requirements set forth by §51709c(c). FEMA is already establishing a pilot program that would delegate certain HGMP responsibilities to participating States. To participate in the pilot a State would have to have:

• An approved State Mitigation Plan;

• Demonstrated an ability to manage the HGMP; and

• Demonstrated commitment to mitigation activities.

To develop a full PAS program FEMA is going to have to determine how the program will operate, how available resources can facilitate program performance and what FEMA administrative responsibilities can be delegated to the States. In making these determinations FEMA is soliciting input in the form of responses to the following questions:

• How to assess the State's ability to manage the HMGP throughout the program lifecycle?

• What should the relationship be, if any, between having a FEMA-approved Enhanced Mitigation Plan and receiving a PAS designation?

• How to assess the State's demonstration of commitment to mitigation?

• What performance measures from other State-administered Federal programs could be considered or incorporated in PAS designation requests?

• What additional elements, if any, should FEMA consider requiring in Administrative Plans for States with PAS designation?

• How can States demonstrate impartial and consistent selection and management of applications when they are also eligible to be program participants and submit and manage their own subapplications?

• What should be the level of interaction between FEMA, the State, local governments, and other program participants regarding day-to-day program administration?

• Should PAS designation include limits or factors that would affect the level of State responsibility granted by FEMA?

• Which EHP responsibilities should be delegated to States under applicable Federal law?

• What criteria should FEMA use to assess performance of those States that receive PAS designations?

• How could the analysis of program benefits justifying program costs be an indicator of state performance?

• What would constitute a significant non-compliance deficiency warranting temporary withdrawal or full termination of PAS designation?

• What, if any, are the States' concerns regarding the use of existing FEMA grant reporting and management electronic systems (such as NEMIS) when mandated for PAS participation?

• What factors should FEMA consider and use to encourage Tribal participation in PAS?

• What are the potential challenges for States in maintaining PAS designation?

• How would program participants be impacted when their State administers HMGP under a PAS designation? 

• Would your State or Tribe consider applying for the PAS option for your next disaster declaration?

• Do you think PAS would be beneficial in streamlining the provision of funding under the HMGP?

FEMA is soliciting public feedback on this ANPRM and the specific questions described above. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # FEMA-2014-0013). Comments should be submitted by May 12^th, 2014.

FEMA SAR Privacy Exemption NPRM

Yesterday I wrote about a new Privacy Act system of records being established by the Federal Emergency Management Administration (FEMA) to support that agency’s implementation of the Department of Homeland Security’s ‘See Something Say Something’ program. Today, FEMA published in the Federal Register (76 FR 60387-60388) the notice of proposed rulemaking (NPRM) that I mentioned in that posting proposing the standard law enforcement Privacy Act exemptions for disclosure of personal information be applied to this new system of records.

Generally the Privacy Act provides that if a Federal government agency is keeping personal information on an individual that agency has a responsibility for notifying the individual of that record keeping, allowing the individual access to the information in those records, and providing a method for the individual to correct any incorrect information in that record.

The Privacy Act provides guidance on when those rules may legitimately be ignored by Federal agencies upon notice of proposed rulemaking. One of the typical examples is for records maintained for law enforcement or national security related investigations. Obviously law enforcement and intelligence type agencies cannot be forced to disclose information obtained in the process of an investigation while that investigation is on-going; that would allow subjects of investigation to better hide their illegal activities.

This NPRM is proposing that the FEMA Suspicious Activity Reporting system of records be exempted from four specific requirements related to the processing of requests for information under the Privacy Act. Those exemptions would be applied on a case-by-case basis when such requests are received by FEMA. Those exemptions cover:

• Accounting for disclosure of information to other Federal, State and local investigational agencies;

• Allowing individuals access to personal information being held about them in the system of records;

• Justifying the relevancy and necessity of the information being held in the system of records; and

• Maintaining rules and procedures for allowing access to the information being exempted.

As with all NPRM’s, public comments are being solicited. Comments may be posted to the Federal eRulemaking Portal (www.regulations.gov; Docket Number: DHS-2011-0091) and need to be submitted by October 31, 2011.

FEMA SAR Privacy Act Notice

Today, the Federal Emergency Management Agency (FEMA) published a notice in the Federal Register (76 FR 60067-60070)that they were establishing a new system of records covered under provisions of the Privacy Act of 1974; the DHS/FEMA – 012 Suspicious Activity Reporting System of Records. In general this system of records would allow FEMA to implement a formal system to support the Department’s ‘See Something Say Something’ program.

This FEMA SARs program would be operated by the Office of the Chief Security Officer’s Fraud and Investigations Unit. Suspicious activity reports received by FEMA elements would be forwarded to this office for analysis. Reports determined to have a ‘nexus to terrorism or hazards to homeland security’ would be shared with the FBI Joint Terrorism Task Force, Federal Protective Service or other appropriate federal agency with the responsibility to investigate and respond to terrorist threats.

In addition FEMA will be publishing a notice of proposed rulemaking (these NPRMs are normally in the same issue of the Federal Register, but I don’t see it today) providing this new system of records with the standard law enforcement exemption from certain disclosure provisions of the Privacy Act.

While certain elements that see FEMA black helicopters supporting the new world order will be alarmed about this notice, this is a standard bureaucratic notice supporting a minor program of a small office within FEMA. Every DHS agency that doesn’t have existing law enforcement systems of records will eventually get around to issuing similar notices. This will almost certainly include the CFATS program at ISCD.

Public comments are being solicited on this notice. They may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # DHS-2011-0090). They need to be submitted by October 27^th, 2011.

Congressional Hearings Week of 12-06-10

With a lame duck session of Congress one does not expect a large number of hearings to be held, and, with the exception of a few committees in each house this lame duck session is no surprise. Next week there is only one hearing scheduled that might possibly be of interest to the chemical security community. That will be a hearing by the Senate Homeland Security and Governmental Affairs Committee entitled: “Catastrophic Preparedness: How Ready Is FEMA for the Next Big Disaster?” It will be held on December 7th, 2010 at 2:30 pm EST.

According to the Committee web site there is only one panel set to testify. It includes a trio of government witnesses:

● The Honorable W. Craig Fugate; Administrator, Federal Emergency Management Agency, U.S. Department of Homeland Security
● The Honorable Richard L. Skinner; Inspector General, U.S. Department of Homeland Security
● William O. Jenkins, Jr.; Director, Homeland Security and Justice Issues, U.S. Government Accountability Office

With the focus of this hearing being the ‘Next Big Disaster’, I would like to think that someone would ask about preparedness to respond to a successful terrorist attack on a Tier 1, high-risk chemical facility. I am not, however, going to hold my breath. It seems to me that FEMA has concentrated its preparedness efforts on natural catastrophes like fires, floods, hurricanes and tornados. Since these arguably are much more common than terrorist attacks, successful or otherwise, I think that someone at FEMA needs to take a hard look at the possible consequences of an attack on one of these facilities.

All Hazards CFATS and Emergency Response

While DHS-ISCD is understandably reticent about detailing just how they make the decision to include, or not include, a facility in the list of High-Risk Chemical Facilities covered under the CFATS regulations, it does not take any regulatory genius to realize that the off-site consequences of a successful terrorist attack must be an important part of the consideration process. With than in mind, it is quite surprising to the novice observer of Federal Government operations, that the CFATS program pays practically no attention what so ever to the actual off-site consequences of a successful attack in the security planning process.

No CFATS ERP Requirement

The reason is not that DHS-ISCD believes that the security plans developed will absolutely prevent all successful terrorist attacks; no one with any background in security would think for a second that any security program would be capable of stopping all determined terror attacks. No, I’m sure that everyone connected with ISCD is well aware that there will likely be a successful terrorist attack on a high-risk chemical facility (and ISCD will be unfairly blamed by Congress and the media for the failure to stop the attack).

No the reason that effective emergency response planning is ignored in the CFATS (and the OSHA/EPA chemical safety) regulations is two-fold. The first is that the facilities that will be attacked will have no authority to plan and/or direct the emergency response efforts beyond the boundaries of their facility. The second is that no one in Congress or the Executive Branch wants to be responsible for placing a dreaded ‘unfunded mandate’ on a State or local government body.

Inadequate EPA ERP Requirement

Actually, there are provisions in EPA regulations for emergency response planning under the Emergency Planning & Community Right-to-Know Act (EPCRA, 40 CFR 355). For the covered facility the requirements are quite simple; notify the Local Emergency Planning Committee (LEPC) that the facility is covered, appoint an Emergency Coordinator to work with the LEPC, and provide the LEPC with information they request. Finally, facilities must report significant releases of covered chemicals to local emergency response agencies..

Unfortunately, the LEPCs have little funding beyond some FEMA grant monies, their members have little or no training in emergency response planning, and no one is responsible for ensuring that they are doing the job for which they were intended. While there are a few activist LEPCs that are well known within their communities, most people wouldn’t know if their community even had an LEPC (many communities with high-risk chemical facilities do not), much less what evacuation plans had been put into place for their protection.

Actually, it is quite surprising that DHS did not take the easy way out when they were developing the CFATS program and simply piggy-back an emergency response planning requirement for a terrorist attack on top of the LEPC program requirements for an accidental release. The EPA has been getting away with it for years.

All Chemical Hazards ERP

Actually, consolidating all emergency response planning for chemical release incidents does make a certain amount of sense. It doesn’t make much difference if the release is due to an industrial accident or a terrorist attack, most of the emergency response actions will be the same. Since FEMA is the all hazards emergency response agency for the Federal Government it would make sense that they would be the agency that should be responsible for overseeing the ERP efforts supporting both EPCRA and CFATS programs.

In fact, we could expand the ERP requirements to include high-risk chemical transportation releases due to potential terror attacks or accidents. We would probably want to limit that to those rail shipments of security-sensitive materials covered under rail route security and safety assessment requirements since there are no current efforts to regulate other hazmat routes at the Federal level.

Under such a program, there would be a Federal requirement for the establishment of an LEPC in every county potentially affected by a chemical release from an EPCRA or CFATS covered facility or a rail-line identified as a primary or alternative route for security-sensitive materials. This would require the establishment of a Chemical Emergency Response Office (CERO) in FEMA to which EPCRA and CFATS covered facilities and railroads would report the physical area affected by a potential release of a covered chemical.

To ensure that LEPC’s were actually established, the chair of each LEPC would be a CERO employee. Additional federal staffing would depend on the number of covered facilities that were potentially affecting the LEPC county and the number of residents of that county. The assistant chair would be from the appropriate State emergency response agency and the deputy chair would be a member of the local county government. Additional LEPC members would represent each emergency response agency within the county and each covered facility and/or railroad affecting that county.

CERO would also be responsible for providing routine funding for and the oversight of the chemical emergency response planning efforts of the affected LEPCs. The ERPs would be required to be submitted to CERO for review and approval. CERO would also ensure that ERPs are routinely exercised through periodic table top exercises and drills. The CERO would also be responsible for establishing and enforcing the regulatory aspects of the ERP program, including establishing the minimum standards for ERPs.

FEMA ICRs Rejected by OMB

I frequently mention various information collection requests (ICR) that are submitted to OMB for approval. These are an important part of the regulatory process as this is the mechanism that has been designed to protect the public from having to provide inappropriate information to government agencies. Usually this is just a formality; sometimes OMB will approve an ICR with a note that some minor changes are required, on a relatively rare occasion they will return an ICR unapproved because major changes are made. On Tuesday OMB probably set a record with the number of ICR’s they returned to a single agency, FEMA. I did not count them all, but there were seven that would probably be of interest to the chemical security community.

Rejected ICRs

All of the rejected ICRs dealt with FEMA grant applications. Since FEMA administers most of the grant programs for DHS, this affected a wide variety of programs. The grant programs that would be of interest to the chemical security community include:

● Trucking Security Program (TSP)
● Freight Rail Security Grant Program (FRSGP)
● Interoperable Emergency Communications Grant Program (IECGP)
● Regional Catastrophic Preparedness Grant Program (RCPGP)
● Port Security Grant Program (PSGP)
● Buffer Zone Protection Program (BZPP)
● Homeland Security Grant Program (HSGP)

The information being collected for these grant programs that would be covered by the ICRs is the standard information that the applicant fills out when requesting these grants; information used by FEMA to determine who would get grants of how much money. None of this is new information because these grant programs have been around for some time. I’m not sure why these new ICRs were being submitted this year; they should have been submitted when these individual programs were first started.

Reason for Rejection

According to the OMB web site, each of these ICRs was rejected for the same reason; “DHS did not properly attribute burden change to a potential violation of the PRA.” I’m not exactly sure what that means, but it sounds like there was a bureaucratic error made on the paperwork. If that is the case, I expect that we’ll see these ICRs re-submitted to OMB in the near future. It doesn’t sound like they will have to be republished for public comment.

Practical Effect of Rejection

The practical effect of this rejection, other than requiring additional work by someone at FEMA, is non-existent. The public is not required to complete any form used by the Federal Government if it does not have an approved ICR collection number on it. Of course since there hasn’t been an approved ICR for these forms since they were initiated, no body has been paying any attention.

Practically speaking, if a State or local government agency or a private entity wanted to get money from these grant programs they are going to provide the information required by FEMA. This would probably extend to some inappropriate information; people will do a lot to get free money and that ‘people’ includes government agencies. Of course, that is the reason that the ICR program was established.