Houston Explosive Precursor Meeting – 06-04-19

The DHS (CISA) Infrastructure Security Compliance Division (ISCD) held the third of their Explosive Precursor Chemical Stakeholder Engagement Meetings yesterday in Houston. Two more to go in Indianapolis and Chicago.

I have not been (and unfortunately will not be) able to attend any of the meetings and they are not being web cast. But a long time reader, Cathi Cross, was able to attend today and was able to share some observations about the meeting. Here is what she saw {NOTE: Comments in brackets are my additions; they are not Cathi’s fault (grin)}:

In addition to DHS personnel, the 16 attendees were a mix of industry representatives, trade association representatives, academia, and the general public.

DHS clarified the series of scheduled meeting’s intended purpose is to focus on point of sale risk mitigation for certain precursors identified in the 2017 National Academy of Sciences Study [link to my blog post added], conducted for this purpose. DHS is seeking public comments on the report [link to NAS report web site added] .

DHS clarified that the discussion would intentionally deviate from CFATS regulation or the facilities regulated under its jurisdiction - and focus on mitigating risk at the point of sale [NOTE: ‘point of sale’ potentially includes all venues where precursor chemicals are sold] within the supply chain.

DHS began by reviewing the NAS report, at a high level. Key points: select precursor chemicals used to manufacture homemade explosives (and the prioritization method used by NAS), domestic chemical supply chains, and international regulations, possible control strategies, and the report’s six recommendations.

The Office of Bombing Prevention representative reminded participants of the available resources from their Bomb Making Materials Awareness Program (BMAP). Some of which have been made available on the website for the Center for Domestic Preparedness.

Next, DHS facilitated open discussion on explosive precursor chemicals, the supply chain, and point-of-sale. Topics included chemical prioritization, potential voluntary programs (including industry stewardship programs), potential regulatory programs, additional as of yet-unidentified high-risk points in the supply chain, concerns regarding commerce encumbrances, citizen awareness & worker training ideas, and brainstorming mitigation strategies.

Three specific concerns/ideas raised during the open discussion seemed to resonate with the attendees:

1. Initiator chemicals were removed from the scope of the NAS report. Reconsidering initiator chemicals and limiting the scope of this initiative to only those - may optimize administrative controls to a much smaller footprint while achieving significant risk reduction.

2. All point-of-sale transactions involve a financial transaction. Consult the financial sector for ways to identify, and eventually screen purchases through the financial transactions at point of sale.

3. The recommendation was made that the agency review comments previously submitted for the ANPRM on AN (October 29, 2008) because many of the comments may prove very valuable beyond the scope of that rulemaking, in development of a broader precursor program. [I did a series of blog posts on those comments here, here, here, here, here, here, and here]

Commentary

Back to my voice again.

As Cathi noted any precursor chemical security program is not going to be part of the Chemical Facility Anti-Terrorism Standards (CFATS) program. I have heard this emphatically from folks in and around the program. David Wulf is heading up this effort at CISA because the Ammonium Nitrate Security Program rulemaking was put under ISCD purview and this is an outgrowth of the ANSP.

Again, to be absolutely clear; this is not yet a rulemaking proposal. Congress has provided a mandate for establishing an ANSP, NOT an explosive precursor program. Before ISCD can even begin to start the rulemaking process, Congress is going to have to provide a new/revised authorization. DHS knows that there is a problem with tracking the sale of precursor chemicals, but they are not yet prepared to ask Congress for new/revised authorization to establish such a program. The whole point of these meeting is to gather as much input from the affected (potentially regulated) communities about what might and might not work.

There are two more meetings in the coming weeks;

• Indianapolis, IN                     June 11th, 2019

• Chicago, IL                            June 13th, 2019

Personnel wishing more information about attending the meetings should contact ISCD (CFATS@hq.dhs.gov) [AGAIN this does not mean that this is being added to the CFATS program, it is just a readily available email address that is already being staffed and worked]. If you are working with and/or more importantly selling one of the precursor chemicals identified in the NAS report, you really might want to consider attending one of these two meetings. You might be able to help educate one of your potential regulators.

Senate Passes DOD Authorization Bill

Yesterday the Senate passed S 1867, the National Defense Authorization Act for Fiscal Year 2012, by a strongly bipartisan vote of 97 to 7. There were lots of amendments made to the bill in the last couple of days, but only two of consequence to the chemical or cyber security communities. Both amendments were addressed in some detail in previous blogs.

The Casey amendment (No. 1215) addressed IED chemical precursors in Pakistan (an area the Senate has lots of control over; pardon the sarcasm). The McCain amendment (No. 1229) addressed cybersecurity cooperation between DOD and DHS.

The bill now moves to the House for consideration.

More Amendments to S 1867 – DOD Authorization

I finally had a chance to go through the large volume of amendments proposed for S 1867, the DOD FY 2012 Authorization Act. There are two additional amendments (in addition to the one I mentioned in my post on the introduction of S 1867); both were found in the November 17^th edition of the Congressional Record. One deals with control system security and the other addresses IED precursor chemicals.

Control System Security

Senate Armed Services Committee Chairman Leahy (D,VT) has proposed Senate Amendment 1085, that would add a new Division to the bill entitled “Identity Theft And Data Privacy”. As one would sort of expect this deals mainly with IT security issues, but if you scan down to §106 you find a fairly section entitled: “Damage To Critical Infrastructure Computers”.

This section would add ‘‘Sec. 1030a. Aggravated Damage To A Critical Infrastructure Computer” to 18 USC 47. The term ‘critical infrastructure computer’ clearly includes certain SCADA systems in that it is defined as “computer that manages or controls systems or assets vital to national defense, national security, national economic security, public health or safety, or any combination of those matters, whether publicly or privately owned or operated” in §1030a(a)(2). It then provides a non-exclusive list of areas where such computers might be found:

‘‘(A) gas and oil production, storage, and delivery systems;

‘‘(B) water supply systems;

‘‘(C) telecommunication networks;

‘‘(D) electrical power delivery systems;

‘‘(E) finance and banking systems;

‘‘(F) emergency services;

‘‘(G) transportation systems and services; and

‘‘(H) government operations that provide essential services to the public.”

I personally find it disappointing that chemical manufacturing, storage and transport systems are not included in the list, but many of those facilities would fall under the general description that precedes the list; so they should be covered.

This section would make it an offense to intentionally cause, or attempt to cause damage to a critical infrastructure computer that would result in substantial impairment {§1030a(b)}:

“(1) of the operation of the critical infrastructure computer; or

“(2) of the critical infrastructure associated with the computer.”

There is a major flaw in this amendment though. Section 107 provides some pretty strict guidelines for the sentencing of violators of the new rules contained in this amendment. Unfortunately the definition of the covered offenses only applies to IT systems not control systems as it only deals with theft of information.

IED Precursors

Senate Amendment 1215 has been proposed by Sen. Casey (D,PA) and it deals with certification that the Pakistani government is continuing to make progress in controlling the production of improvised explosive devices by controlling the use of important precursor chemicals. What is unusual here is that the only precursor chemical that it lists by name is ‘calcium ammonium nitrate’.

According to Ask.com ‘calcium ammonium nitrate’ is 5Ca(NO₃)₂.NH₄NO₃.10H₂0. This would give a Nitrogen percentage of 15.5%. That number is important because the DHS Chemical of Interest (COI) list (Appendix A, 6 CFR 27) defines ammonium nitrate (the precursor not the explosive; two separate listings) as having a nitrogen content of 23% or greater.

So it would seem that the military considers calcium ammonium nitrate to be an IED precursor chemical in Pakistan (we pressured Pakistan to outlaw it in the Northwest Frontier Province of Pakistan), but DHS does not consider it to be an IED precursor chemical in the United States. This is obviously explained by the fact that the chemical reaction is more energetic in Pakistan because of local political conditions (pardon the sarcasm).

Consideration of Amendments

Not every amendment proposed will make it to the discussion phase in the Senate and fewer still actually make it to a vote. Two of the three amendments that I have discussed so far (1085, 1215, and 1229) were listed on the ‘pending’ list of amendments to be considered for this bill. Interestingly it is the Levin amendment that has apparently (it could just be an oversight with so many amendments to list) not made the initial cut.

With Congress out of town for the Thanksgiving weekend (the Senate has pro forma sessions scheduled for today and Friday) the next day of debate on S 1867 is scheduled for Monday. This could be a long, drawn out process.

WSJ Misunderstands CFATS

While the Wall Street Journal is not exactly a security (in the physical not the financial sense) publication I was really surprised to see the gross error about the CFATS regulations that was mentioned in an article today found on their on-line site. The article by Cam Simpson was about the recent terrorism story and the purchase of commercially available explosive precursors; “Chemical Purchases Enough for Big Bomb”. Simpson writes: “In November 2007, the Department of Homeland Security published rules for regulating chemicals that can be used by terrorists to make explosive devices, including limits on products that include hydrogen peroxide.” It is a gross misunderstanding of the intent of the regulation to say that the Chemical Facility Anti-Terrorism Standards (CFATS – 6 CFR part 27) were ‘rules for regulating chemicals’. While the November 27th date mentioned by Simpson was the publication of the list of the DHS Chemicals of Interest (Appendix A to 6 CFR part 27), neither that list nor the base regulations were ever designed to regulate chemicals. CFATS is strictly a regulations establishing minimal standards for the security of high-risk chemical facilities. It is absolutely amazing to me that as prestigious a publication as the WSJ could allow such a fundamentally incorrect statement to appear in their publication. The implied criticism of DHS found in the next paragraph is even more surprising. Simpson writes: “But the regulations make clear that DHS and the FBI were envisioning a large car or truck bomb, rather than smaller-style bombs like those used in the deadly July 2005 London transit attacks.” In a modern society there are a number of readily available chemicals that can be used to make explosives. Trying to control access to hydrogen peroxide and acetone would be nearly impossible given their widespread use in commercial products. If controls were instituted on the 10-12% hydrogen peroxide found in the personal care products bought by Mr. Zazi, the chemically knowledgeable terrorist would just buy the 6% hydrogen peroxide solution found in any home and concentrate it to the necessary level using straightforward chemical laboratory techniques. One last word from the WSJ article, it notes that the “threshold for reporting requirements is 400 pounds of hydrogen peroxide”. That is less than complete reporting of the facts. The Appendix A reporting requirements pertaining to hydrogen peroxide only pertain to concentrations of at least 35%. Even if there were storage tanks full of the products bought by Mr. Zazi they would not be regulated under CFATS. DHS understood, even if the WSJ does not, that it is impossible to completely deny terrorists, or even just plain criminals, access to any and all dangerous chemicals that could be used to harm someone. What the CFATS regulations are designed to do is to ensure that the chemical facilities that present the highest risk to American society if attacked by terrorists are required to take reasonable security precautions to prevent such attacks. It was never designed to prevent access to dangerous chemicals; those are too ubiquitous in our industrial society. DHS keeps getting caught in the public crossfire. They were pilloried when they tried to require security controls on facilities that had 10,000 pounds of explosive propane gas on site because it was too restrictive on farmers and home owners. Now the WSJ expects them to keep track of purchases of beauty products containing hydrogen peroxide. I do hope that our friends in the Department have thick hides, but they do not deserve the abuse.