HR 4007 – Current Site Security Plans

This is part of a continuing discussion of the recently passed HR 4007, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014. In this post I will be looking at the effect that the passage of HR 4007 has on current site security plans. The previous postings in this series was:

HR 4007 Sent to the President

HR 4007 – An Overview

HR 4007 – Implementation Deadlines

Congress clearly intended that all of the 1370+ facilities with currently approved site security plans would not have to go back and redo those plans because of the passage of HR 4007:

“In the case of a covered chemical facility for which the Secretary approved a site security plan before the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary may not require the facility to resubmit the site security plan solely by reason of the enactment of this title.” {§2102(c)(3)(B)}

What is not clear, however, is what the status of site security plans approved between the date the President signs the bill into law (“the enactment of this title”) and the time that the regulations are finally updated to take into account the changes required by HR 4007. Actually it may be slightly more complicated than that as there is still the date that the current authority for CFATS runs out and the new Title XXI takes effect 30 days after the enactment of the bill.

First 30 Days

Since the bill does not spell out what happens in this period, the Secretary has the discretionary authority to either continue current operations as is or suspend operations pending the effective date of Title XXI. I suspect that current operations will continue as before with the current approval process. It would be helpful if there were a statement to that effect from DHS.

DHS may give Tier 3 and Tier 4 facilities a choice as to whether or not they would prefer to wait and see what the expedited security plan process looks like. This is not required by the legislation, but it would certainly fit with the intent of the legislation. If I were a Tier 3 or Tier 4 facility manager early on in the SSP approval process, I think that I would ask my Chemical Security Inspector if that option was available.

Site security plans approved during this interregnum fall into somewhat of a grey area. They do not have the legal protection of §2102(c)(3)(B) so this falls back to the Secretary’s discretionary authority and that can be changed by a Secretarial whim, particularly if no guidance is published. I do not see any advantage to ISCD to change this at some future date, but I surely think that a successful terrorist attack on a facility with an SSP approved during this period would result in a quick change in policy.

Title XXI and Expedited Approvals

The other time period that is going to be fraught with some potential for conflicts is the time between the effective date of Title XXI and the issuance of the guidance for Expedited Approval Facilities document. Tier 3 and Tier 4 facilities with site security plans approved during that 180 day period will certainly be reviewing that guidance document and will be second guessing the cost of their security plans.

It is almost a certainty that some facilities will find that the EAF plan will be less expensive than the one approved by ISCD. There will be requests from facilities with approved plans to be able to opt out of those plans in favor of the EAF plan. It would be helpful if ISCD had a policy in place (publicly in place) on how they planned to deal with such requests.

Policy Decision

ISCD needs to make up its mind on how it intends to deal with these issues. No one expects that they will stop doing site security plan approvals while this is transition is underway; there has been just to much pressure to complete the SSP approval process. But they do owe it to the regulated community (and their physical and corporate neighbors) to be clear about how they will deal with the situations described above.

Many facilities awaiting SSP approvals have already spent the bulk of the money that their plans require so they have little incentive to wait out the publication of the EAF document. Facilities that are facing large future expenditures for their SSP will almost certainly want to take a wait and see attitude in the hope of lower cost compliance options. Making that decision effectively can only be done if all of the facts (in this case policy facts) are known.

HR 4007 – Implementation Deadlines

This is part of a continuing discussion of the recently passed HR 4007, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014. In this post I will be looking at the various implementation deadlines set by Congress. The previous postings in this series was:

HR 4007 Sent to the President

HR 4007 – An Overview

Congress has been fairly vocal about the delays in getting site security plans approved, so it is not unexpected that there were a number of very specific implementation deadlines put into this legislation. Some of them are very tight deadlines that don’t take into consideration review requirements outside of DHS.

CFATS Repeal

The bill is very clear that, in general, the current CFATS regulations will continue in force with some changes. Section 2107(b)(1) states that “each existing CFATS regulation shall remain in

effect unless the Secretary amends, consolidates, or repeals the regulation”. And it is important to note that the term ‘existing CFATS regulation’ is specifically defined {§2101(5)} to include any guidance documents published in the Federal Register. This would include the Risk Based Performance Standards guidance document and the Clarification to Chemical Facility Anti-Terrorism Standards; Propane and presumably the current Agricultural Facilities Time Extension Notification.

Having given with the one hand, however, Congress required the Secretary of DHS to take away with another. In §2107(b) the bill would require that:

“Not later than 30 days after the date of enactment of the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, the Secretary shall repeal any existing CFATS regulation that the Secretary determines is duplicative of, or conflicts with, this title.”

Now I have not had the time to go through the current regulations and see what if any of the current provisions of 6 CFR Part 27 may be “duplicative of, or conflicts with, this title”. Even though the bill has not yet been signed into law, I’m sure that the Secretary has at least a couple of lawyers looking at this requirement.

Unfortunately, even with the best of intentions and unlimited lawyer power, I am afraid that the Secretary is going to have a hard time meeting this deadline. Forgetting for the moment the amount of time lost to holidays and the resultant short staffing in any agency at this time of year, even if the Secretary meets the 30 day deadline to produce such a regulation change, it will probably take another 30 to 60 days for it to be processed through OMB.

Also, I’m not sure that this requirement is specific enough to allow the Secretary to avoid the publish and public comment process required by 5 USC 553.

Facility Outreach Program

Section 2109 give DHS just 90 days to establish an outreach program to help identify potential chemical facilities of interest (think back to the West Fertilizer incident) and to make “make available compliance assistance materials and information on education and training” {§2109(2)}. Since the Department has done a great deal of work on this topic since the publication of Executive Order 13650 (see requirement here) this requirement should be fairly simple to complete.

Expedited Approval Facilities

As I mentioned in my last post the Secretary is required to come up with a program to help Tier 3 and Tier 4 facilities expedite the site security plan approval process. This is essentially a program where the facility can self-certify that their plan meets the minimum risk based performance standards associated with a facility at their level of risk.

There are actually two prongs to this program, both of which DHS is required to have up and running within 180 days of the bill being signed. Both are set forth in §2102(c)(4). First it requires that the “Secretary shall issue guidance for expedited approval facilities that identifies specific security measures that are sufficient to meet the risk-based performance standards”{§2102(c)(4)(B)(i)}.

Then it allows the Secretary to “develop prescriptive site security plan templates with specific security measures to meet the risk-based performance standards under subsection (a)(2)(C) for adoption and certification” {§2102(c)(4)(H)(i)}.

To aid in DHS being able to meet this deadline Congress has allowed that the Department should not be subject to the administrative rulemaking provisions of 5 USC 553 (publish and comment requirements) or 44 USC Chapter 35, Subchapter I (clearance through OMB’s Office of Information and Regulatory Affairs). These exceptions to the regulatory process will certainly make things easier for ISCD to publish a final guidance document as they essentially have carte blanch to do things their way.

Congress could justify moving this outside of the normal rulemaking process because any Tier 3 or Tier 4 facility has the full option to use this expedited approval method in full or in part or not at all. This means that the guidance cannot ‘really’ be a burden on anyone.

Whistleblower Protections

One of the provisions that was added to this bill to make it easier to obtain bipartisan support was the whistleblower protections set forth in §2105. This requires the Secretary, within 180 days, to “establish, and provide information to the public regarding, a procedure under which any employee or contractor of a chemical facility of interest may submit a report to the Secretary regarding a violation of a requirement under this title” {§2105(a)(1)}.

Setting up the reporting and investigation mechanisms may be possible within the 180 day time frame, but this will also require the publication of a regulation (actually just an addition to 6 CFR 27) and Congress did not try to exempt DHS from the normal regulatory process for this requirement. Since this will place a potential ‘burden’ on every ‘chemical facility of interest’ (NOT just CFATS facilities) the normal process will have to be followed.

Various Reports

All of the remaining time deadlines for implementation processes deal with reports to Congress. And no one (besides some beleaguered staffers at ISCD and various congressional committees) cares about those.