Committee Hearings – Week of 09-08-19

This week both the House and Senate will be back in Washington after their long summer recess. Spending bills will be the big news this week, but congressional committees will be tackling some other issues as well. Of concern here will be a Chemical Facility Anti-Terrorism Standards (CFATS) hearing, DOE security, homeland security threats, and TSA oversight.

Appropriations

With spending bills (or continuing resolution) due by the end of the month, the Senate Appropriations Committee will start marking up spending bills this week (they were waiting on the budget deal to be completed before they started their work). The following hearings are scheduled:

• Defense Subcommittee – 9-10-19;

• Labor, Health and Human Services, Education, and Related Agencies Subcommittee – 9-10-19;

• State, Foreign Operations, and Related Programs Subcommittee – 09-11-19; and

• Full Committee – 09-12-19

It looks like the Full Committee bill will be minibus combining the bills from the three committees listed above. This would be the equivalent of the first minibus (HR 2740) that was passed in the House back in June. We are likely to see this bill next week on the floor of the Senate. Even if it is passed then, it will likely have to go to conference with the House before it can be sent to the President. That is unlikely (possible though depending on how partisan the bill is) to happen before the end of the month.

Homeland Security Threats

On Tuesday the House Homeland Security Committee will hold a hearing on "Global Terrorism: Threats to the Homeland, Part I". No witness list is available. I doubt that there will be much (if any) focus on cybersecurity or specific threats against chemical facilities, but we will have to wait and see.

CFATS Hearing

On Wednesday the House Energy and Commerce Committee will hold a hearing on "Protecting and Securing Chemical Facilities from Terrorist Attacks". The witness list includes:

• David Wulf, DHS;
• Matthew Fridley, Brenntag North America, Inc;

• Michele Roberts, Environmental Justice Health Alliance (EJHA);

• John Paul Smith, United Steelworkers (USW); and

• Scott Welchel, Dow Chemical Company

NOTE: Wulf is listed as the “Acting Deputy Assistant Secretary for Infrastructure Protection” not the Director of the DHS Infrastructure Security Compliance Division (ISCD). This is a recurring problem for Wulf, every there is a vacancy up the chain of command at DHS Wulf moves up to the IP position.

The ‘missing’ witness here is a representative from the GAO. We typically see the GAO representative on these CFATS hearings. The other, oddly refreshingly, thing about the witness list is that it presents a balanced list of witnesses, two activist organizations and two industry organizations. Typically, a committee controlled by Democrats has three activist and one industry representative on the witness panel (and to be fair, Republican controlled committees generally reverse the ratio).

This is being billed as a ‘legislative hearing’ focusing on HR 3256, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2019. In other words, the Committee would expect to hear the witness opinions about the provisions of the bill. Interestingly, the copy of the bill is the copy of the bill as introduced, not the amended version that was passed in the Homeland Security Committee. The summary provided in the Staff Briefing Memo, however, refers to the amended version of the bill.

DOE Security

On Wednesday the Senate Energy Subcommittee of the Energy and Natural Resources Committee will hold a legislative hearing looking at nine pending bills. The witness list includes:

• Mark Menezes, DOE; and

• Anton Porter, FERC

One of the nine bills one has been covered here: S 2095, Enhancing Grid Security Through Public-Private Partnerships Act.

TSA Oversight

On Wednesday the Senate Commerce, Science, and Transportation Committee will hold a hearing on “Protecting the Nation’s Transportation Systems: Oversight of the Transportation Security Administration”. The current witness list has only one witness, Patricia Cogswell, Acting Deputy Administrator, TSA,

As with most TSA related hearings, I suspect that this vast majority of the discussion at this hearing will be targeted at passenger air security, not surface security issues.

HR 3310 – Chemical Emergency Response

Last month Rep. Jackson-Lee (D,TX) introduced HR 3310, a bill that would require a DHS study on emergency response capabilities in areas with high concentrations of chemical facilities (note: there is no fancy title for this bill).

The Study

The bill would require the DHS Science and Technology Directorate “conduct a study on how to improve training and support for local emergency response providers in areas with high concentrations of covered chemical facilities in how to respond to a terrorist attack on a chemical facility” {§1(a)}. In conducting the study, DHS would consider {§1(b)}:

• The degree to which jurisdictions with high concentrations of covered chemical facilities have fire, police, medical, and other response personnel trained and equipped to respond to a terrorist attack on a chemical facility;

• What, if any, distinctions are there in preparedness for a terrorist attack on a chemical facility in jurisdictions that rely on volunteers to carry out fire, police, medical and other response and jurisdictions that do not rely, in whole or in part, on volunteers; and

• All training, equipment, and support provided by the Department of Homeland Security to local emergency response providers in areas with a high concentration of covered chemical facilities and chemical facilities of interest.

A subsequent report to Congress on the study would include {§1(d)}:

• Improve the Department’s counterterrorism preparedness and response planning, training, and equipment efforts to ensure that they are better tailored and resourced to address the unique needs of local emergency response providers in areas with a high concentration of covered chemical facilities and chemical facilities of interest; and

• Improve coordination among Federal, State, local, tribal, and territorial government officials in emergency planning and response in areas with high concentrations of covered chemical facilities, chemical facilities of interest, or other facilities with large quantities of hazardous chemicals.

Moving Forward

Jackson-Lee is an influential member of the House Homeland Security Committee, the primary committee (of two) to which this bill was assigned for consideration. It is very likely that her influence on the Committee will be sufficient to have the bill considered in Committee. There is nothing in the bill that would engender any significant opposition since it is just a study and report requirement. The bill would likely be considered by the full House under the suspension of the rules process which requires a super-majority for passage, limits debates, and prohibits floor amendments from being considered.

Commentary

This bill is almost exactly the same language as found in §16 of HR 3256, the Chemical Facility Anti-Terrorism Standards (CFATS) reauthorization bill which is currently working its way through the House. I suspect that Jackson-Lee offered this bill as a stand alone measure to ensure that this study does get done even if the current language in the reauthorization bill does not make its way to the President’s desk (a very high probability).

When this language is in the CFATS reauthorization bill, the language covering what types of facilities would be covered in the study was carefully tailored to ensure that it was focused on facilities in the CFATS program. This is why we see the undefined use of ‘covered facilities’ and ‘chemical facilities of interest’; those terms are defined in the underlying program language which the bill amends.

In this bill, lacking the references to the previously defined terms, definitions really should have been included. On the other hand, there really is no need in this bill to limit the coverage to just CFATS covered facilities. There are chemical facilities not covered under the CFATS program that would have potentially severe consequences from a terrorist attack due to chemical releases or theft and diversion. These would include facilities covered under the Maritime Transportation Security Act (MTSA) program administered by the Coast Guard. Additionally, any number of water treatment facilities covered by EPA programs and possessing large quantities of chlorine gas, while not necessarily part of a ‘high-concentration’ of chemical facilities, could be expected to have wide-spread community impacts if successfully targeted in a terrorist attack.

With that in mind I would like to suggest this definition of ‘covered facilities’ be included in a new §2, Definitions, of the bill:

(1) Covered Chemical Facilities – the term ‘covered chemical facilities’ means any facility covered under one or more of the following federal programs:

(A) Chemical Facility Anti-Terrorism Standards under 6 CFR Part 27;

(B) Maritime Transportation Security Act under 33 CFR Part 105, limited to facilities that store, produce or ship large quantities of hazardous chemicals;

(C) Public water systems as defined under 42 USC 300f, limited to facilities where large amounts of chlorine gas are stored; and

(D) Treatment works as defined under 33 USC 1292, limited to facilities where large amounts of chlorine gas are stored.

(2) High Concentration – the term ‘high-concentration’ means:

(A) any grouping of three or more covered facilities where any portion of those facilities’ boundaries could be included within a circle with a diameter of 5-miles; or

(B) any single facility where a release due to the effects of a successful terrorist attack could be expected have a significant effect on more than 20% of the population protected by a single off-site fire department.

With this expanded definition of ‘covered facilities’ it would also be appropriate to bring into the study a look at the effectiveness of Local Emergency Planning Committees {established under 42 USC 11001(c)} in developing emergency response plans for incidents at covered chemical facilities and whether those plans considered responses to a terrorist attack on the covered facilities. With this in mind I would add a new study requirement to §1(b):

(4) Determine if a Local Emergency Planning Committee (LEPC), established under 42 USC 11001, is in existence that would have responsibilities for conducting emergency response planning for the covered facility and whether an existing LEPC has prepared a response plan that specifically covers a terrorist attack on the covered facility.

HR 3256 Amended and Adopted in Homeland Security Committee

Yesterday the House Homeland Security Committee amended and subsequently adopted HR 3256, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2019. The alternate language was adopted by a voice vote (pretty much along party lines by the sound of it) and the final action was taken by a recorded vote of 14 to 12; strictly along party lines.

The Republican opposition to the bill was voiced by Ranking Member Rogers (R,AL) and addressed predictable issues. One notable portion of that opposition narrative was voiced at 17:25 into the video when Rogers stated: “The bill enlarges the whistleblower protection program in an agency that does not have the capacity or skills to administer such a program.” Comment: This is perhaps why the Democrats felt that changes in the current whistleblower provisions were needed.

All three statements on the bill {Chairman Thompson (D,MS), Rogers, and Subcommittee Chair (and author of the bill) Richmond (D,LA)} all emphasized how important reauthorization of the CFATS program was and how hard everyone was working together to get this done. They all agreed that additional work needs to be done to bill to get it to the point where there can be strong bipartisan support for the bill when it gets to the floor of the House.

The next venue for consideration of the bill will be the House Energy and Commerce Committee. Further amendments of the bill are sure to be seen there.

Watching this hearing it was clear that it was a closely scripted proceeding with every remark read from the script to ensure that nothing was said that was out of line. Even so, there was some minor drama when it came to the final vote on the adoption of the bill due to the number of Democrats that were not able to make it to the hearing. This made the vote much closer than it would have been.

HR 3256 Introduced – CFATS Reauthorization – Part 2

This is the second installment of a look at HR 3256 (note: an official copy of the bill is now available), the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2019. The initial post was made on Sunday. The House Homeland Security Committee will markup this bill tomorrow and substitute language for the bill will be considered. Things are moving fast here.

New Sections Added

The substitute language is adding the following new sections:

§11. Review of tiering methodology.

§15. Voluntary program.

§16. Study on local emergency response capacity to respond to chemical security incidents.

§17. Previously approved facilities.

Changes to Previously Reported Provisions

The substitute language does change some of the provisions that I reported upon in my last post.

Section 4 of the bill is substantially changed. The new version removes the rewrite of paragraph (a) that I previously described. It also rewrites paragraph (b), but the new version (along with a small format change) revises the language on State and local government officials by clarifying that the information sharing will take place only “with respect to information on any chemical facility of interest within the jurisdiction of the official, but only if such information may not be disclosed pursuant to any State or local law” {new §623(b)(1)}. It also clarifies the information sharing with the new Chemical Security Advisory Committee will only be for the purposes of “conducting official duties and responsibilities as described in such section” {§623(b)(3)}.

Comment: These changes clearly protect the current Chemical-Terrorism Vulnerability Information (CVI) program.

No significant changes were made to the other two sections which I discussed. The remainder of this post will only deal with the provisions found in the substitute language that the Committee will markup tomorrow.

Chemical Security Advisory Committee

Section 7 of the bill would add a new section (§2110) to the Homeland Security Act of 2002 which would become (probably) 6 USC 630. The new section would require DHS to form the Chemical Security Advisory Committee. The new CSAC would consist of 12 members representing {new §630(b)(1)}:

• Industry;

• Academia;

• Labor;

• Emergency response providers;

• Local emergency planners;

• Environmental, community, or public health advocates, particularly for communities with high concentrations of covered chemical facilities; and

• Cybersecurity and information policy.

The purpose of the CSAC is broadly written; to “advise the Secretary on the implementation of this title” {§630(a)}. The only other operational guidance provided is the recommendation that the Committee “may establish subcommittees to assesses and recommend improvements to the risk tiering methodology for chemical facilities, the risk-based performance standards for chemical facilities, risk reduction strategies, and other aspects of the program under this title as the Secretary determines appropriate” {§630(c)}.

Comment: Other advisory committees have been very helpful to their Federal Agency in providing insight and technical support for policy development. One provision that is sometimes seen (particularly for DOT advisory committees) is a requirement for the Secretary to seek advice from the committee on all proposed rulemakings under the committee’s charter. That might be a useful addendum to this section.

Review of Tiering Methodology

I generally do not worry too much about mandated studies and reports to Congress in authorization bills, but I do want to briefly mention the provisions of §11 of this bill because of one of the requirement. This section would require the DHS Cybersecurity and Infrastructure Security Agency (CISA) to conduct a review of the current tiering methodology used by the Infrastructure Security Compliance Division (ISCD) to assess the relative risk of terrorist attack at a facility covered by the CFATS program. One of the items that the review is supposed to take into account is {§11(a)(1)(c)}:

The vulnerabilities of chemical facilities to cybersecurity threats, including the vulnerabilities of facilities’ information technology and operational technology and the implications on the potential for penetration of both the physical security and cybersecurity of facilities.

Comment: I generally applaud this idea, but it would pose some significant challenges to expand the Top Screen submission to provide adequate information for ISCD to properly asses this risk. What might be need to implement this would be to go back to the requirement to submit a security vulnerability assessment report to DHS prior to ISCD making a tiering decision. That is not, however, something that the lawmakers would necessarily want to consider in requiring this review and report.

COI Mixture Appeals

Section 14 of the revised bill would require DHS to establish “a process through which the Secretary can be petitioned to exclude a product or mixture” from consideration in the risk assessment process used to establish that a facility is a covered facility or to tier the facility. The only guidance provided on this process is that the information collected will not be subject to the requirements of 44 USC Chapter 35 (presumably the information collection requirements of §3507) or the Freedom of Information Act requirements.

This requirement supports a change made to §622 {a new paragraph (f)} by §3 of the bill. That new paragraph would authorize DHS to exclude a product or mixture from the Top Screen reporting requirements if DHS determines “determines that the product or mixture does not present a terrorism risk for which the chemical of interest contained within the product or mixture was included on Appendix A [COI list for 6 CFR 27]”.

Comment: The current mixture rules used by ISCD are very broadly written and almost certainly cause reporting of mixtures that do not pose the hazards associated with the underlying DHS Chemical of Interest. I am thinking primarily of flammable liquids; a mixture containing 2% of a flammable COI may not itself be flammable. The problem is that the way (f) is written this would affect Top Screen submissions. This would require additional access to the Chemical Security Assessment Tool prior to CVI training.

Moving Forward

This bill will probably amended further tomorrow, but it will certainly be adopted by the Committee. The only question is how much support it will receive from the Republicans. It looks to me that the Democrats have moderated their changes enough that there could be some support, or at least acquiescence by the part of the business community. This would allow some of the Republicans to vote in favor of the bill.

The main problem will be in the Senate. This bill will almost certainly not be considered in the Senate Homeland Security and Governmental Affairs Committee. Sen. Johnson (R,WI) will almost certainly introduce his own legislation and the Committee will consider that instead of this bill. The question will then be how the Senate leadership decides (if it decides) to proceed; it could bring Johnson’s bill to the floor and send it to the House for consideration, consider the House bill as passed, or (more likely) consider the House bill by substituting Johnson’s language.

I do not expect the Senate to take any action of CFATS authorization until just before the current expiration next year. And that may just take the form of another extension.

HR 3256 Introduced – CFATS Reauthorization - Part I

Earlier this week Rep. Richmond (D,LA) introduced HR 3256, the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2019. Normally, I wait for the official print of the bill before I review it, but the House Homeland Security Committee has a committee print available and have scheduled a mark-up hearing of the bill on Wednesday, so I will be reviewing the committee print today.

HR 3256 would reauthorize the Chemical Facility Anti-Terrorism Standards (CFATS) program for an additional five plus years (until May 1^st, 2025; §16). The bill also provide a number of amendments to the current authorization language (6 USC Subchapter XVI).

Major Additions

The following sections of the bill show the areas where significant changes would be made to the existing program:

§4. Protection and sharing of information.

§5. Civil enforcement.

§6. Whistleblower protection.

§7. Chemical Security Advisory Committee.

§12. Voluntary mechanism for reporting drones and other emerging threats.

§13. Regulations regarding specific products and mixtures containing chemicals of interest.

The following sections provide information on the studies and reports required by the bill:

§8. Implementation plan and report to Congress.

§9. Study on risks posed by excluded facilities.

§10. Study on feasibility of waiver program.

§11. Comptroller General reports.

Information Protection and Sharing

Section 4 of the bill would make a number of changes to 6 USC 623, Protection and Sharing of Information. The first change would be to rewrite paragraph (a) to read:

(a) In general - Notwithstanding any other provision of law, with respect to information in the possession of the Department, the Secretary shall protect information developed under this subchapter, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with the protection of similar information under section 70103(d) of title 46 [link added].

Additionally, a complete rewrite of paragraph (b) includes:

(2) NONDEPARTMENTAL INFORMATION. — Information is not protected pursuant to subsection (a) if it is—

(A) not in the possession of the Department;

(B) developed under this title but has been previously produced or developed for other purposes; and

(C) is already publicly available, readily discoverable, or otherwise lawfully disclosed.

Comment: It looks like this is intended to change the Chemical-Terrorism Vulnerability Information (CVI) program to make it more like other sensitive but unclassified (SBU) information protection programs. Currently the CVI program has strict information protection rules for information held at each covered facility. Other SBU only protect information in the hands of the Federal government, its contractors, and such information shared with State, Tribal, and local governments. If that was the intent, it looks to me like the terminal ‘and’ in (2)(B) nullifies that attempt as it does not remove protections already provided in the program. DHS would not be required to change the CVI rules under these changes. If the terminal ‘and’ were changed to ‘or’ then (2)(A) would be the controlling factor for removing CVI protections for information held at facilities.

As noted above §4 also rewrites (b), changing the information sharing requirements of §623(b) to require DHS to provide information (upon request) to {new §623(b)(1)}:

State, local, and regional fusion centers (as that term is defined in section 210A(j)(i) of this Act) and State and local government officials, including law enforcement and emergency response providers;

Members of Congress;

Members of the Chemical Security Advisory Committee under [new] section 2010 of this Act; and

The Comptroller General of the United States.

The addition of fusion centers and members of Congress in this paragraph allows the bill to delete the current paragraphs (c) and (f) from §623.

Comment: This is a proforma change to appease supporters who want ‘better’ information sharing about the hazards associated with covered facilities. This really provides no new requirements for the CFATS program beyond the addition of the new Advisory Committee which will be covered in more detail later in the bill.

Civil Enforcement

Section 5 of the bill would amend §624, Civil Enforcement. The first set of amendments deals with changes to paragraph (a), Notice of noncompliance. The first change the time limits for DHS to provide a written notice of non-compliance from 14-days to 3-days. And the second changes the time limit a facility would have to comply with a DHS order to comply, from 180 days to 30 days.

The next set of changes address paragraph (b)(2) civil penalties for non-reporting chemical facilities of interest. The change clarifies that the subparagraph applies to Top Screen submission requirements or supplemental information thereto.

The third set of changes paragraph (c)(1), expanding the DHS authority for issuing emergency orders due to violations of CFATS program requirements or the risk of terrorist incidents. It now adds a vague “or other malicious act” that may affect a chemical facility of interest to the list of potential causes of “an imminent threat of death, serious illness or severe personal injury that the Secretary could attempt to prevent by requiring facility action.

Comment: This is ‘other malicious act’ is vague enough to provide authority to order cybersecurity measures or even the development of active shooter programs. The current management would be unlikely to use this authority; their emphasis is on cooperative enforcement. Who knows what could happen in the future?

Whistleblower Protections

Section 6 of the bill modifies the existing whistleblower protections found in §625. The bill expands on the existing requirements for:

• Confidentiality;

• Response to reports; and

• Opportunity for review

The bill also adds a new paragraph (c) to the section; Procedure and Remedy. It provides requirements for DHS to “establish a procedure for the review and investigation of complaints of reprisals” {new §625(c)(i)} as well as establishing remedies for violations of the same.

NOTE: I am about half-way through the major CFATS changes proposed by this new bill and we are already at about 1000 words. It is getting a bit long for a blog post; even by me. I will try to finish up by tomorrow.

Bills Introduced – 06-13-19

Yesterday with both the House and Senate preparing to leave for the weekend (and the House only about half-way through consideration of HR 2740, the first FY 2020 spending minibus) there were 104 bills introduced. Six of those bills are likely to see future consideration in this blog:

HR 3256 To amend the Homeland Security Act of 2002 to reauthorize and improve the Chemical Facility Anti-Terrorism Standards Program, and for other purposes. Rep. Richmond, Cedric L. [D-LA-2]

HR 3261 To direct the Secretary of Transportation to establish a Smart Technology Traffic Signals Grant Program, and for other purposes. Rep. Cardenas, Tony [D-CA-29] 

HR 3266 To direct the Secretary of Defense to carry out a program to enhance the preparation of students in the Junior Reserve Officers' Training Corps for careers in computer science and cybersecurity, and for other purposes. Rep. Fletcher, Lizzie [D-TX-7]

HR 3270 To amend title 18, United States Code, to provide a defense to prosecution for fraud and related activity in connection with computers for persons defending against unauthorized intrusions into their computers, and for other purposes. Rep. Graves, Tom [R-GA-14]

HR 3290 To provide for mandamus actions under chapter 601 of title 49 of the United States Code. Rep. Speier, Jackie [D-CA-14]

S 1867 A bill to amend the Homeland Security Act of 2002 to establish in the Department of Homeland Security an Unmanned Aircraft Systems Coordinator, and for other purposes.

I will be watching HR 3261 for cybersecurity requirements and HR 3266 for control system security language. HR 3270 is the ‘hack back’ bill that was in the news yesterday. Chapter 601 is the Pipeline Safety portion of the USC.