IOD and OCS in Conflict?

Back in April I wrote a blog post on CISA’s Integrated Operations Division (IOD) and their oversight responsibility for the local chemical security inspectors (CSI) and the potential conflicts that could arise between the goals of that organization and CISA’s Office for Chemical Security which is responsible for the management of the Chemical Facility Anti-Terrorism Standards (CFATS). I recently received another response (the first was here) from a different reader which may indicate that there is an actual conflict in one or more of the regional offices.

A long-time reader with connections to the program (whom I am not naming) asked:

“What if IOD doesn't support the overall success of the CFATS program. (an end goal of dismantling)?”

I have not asked for any details at this point, so I am not sure if this question reflects an actual conflict or if it is more of a theoretical condition. I will discuss the potential ramifications in both ways.

Theoretical Look

It is not unusual for dual track management of a remote workforce to have divergent goals. In a case like this where we have a workforce management organization like IOD, that organization is concerned with office overhead costs, workforce hours and overtime limits. This will frequently conflict with program management objectives that are focused on trying to ensure that technically complex inspections and reporting requirements are met. Senior chemical security inspectors are going to see the most pressure from trying to meet these conflicting management requirements.

Because of their seniority and the time-in-service investment these people have, they are not likely to complain to the outside organization that is supposed to identify, track, and mitigate these types of conflicts, the DHS Inspector General. An effective IG will be cognizant of this and will take care to be watching for indicators of this type of conflict.

Actual Conflict?

What is concerning to me is the parenthetical reference to the potential dismantling of the CFATS program as and end goal. Generally, bureaucracies are not in the business of self-destruction. If the CFATS program were dismantled, the scope of the IOD mission would also be decreased. Except, we know that there was a political attempt last session of Congress to shut down the CFATS program and to disperse the CSI into the Protective Security Inspector workforce. And those PSI work through the same IOD organization.

That political move was publicly lead in Congress by Sen Johnson (R,WI) and received almost no visible support within either house. Johnson ended up relenting and voted for the three-year extension of the CFATS program. Could there be supporters of that position be in management positions within IOD? It is certainly possible, I just do not know enough about the people in the IOD management structure to make an intelligent comment about how possible.

I suspect, however, that if there were an organized attempt in DHS to switch CSI to PSI positions, that it would not be done with any overt political end in mind. It would probably be more targeted at increasing management authority of one or more regional IOD managers. There is no central program management organization for the PSI program with highly visible regulatory program to support, so IOD regional managers have more effective control over the PSI than they would over CSI because of the high-profile management of the CFATS program.

But again, this would be an IG issue to monitor and resolve.

Another Possibility

There is another, more prosaic source of possible increase in the inevitable conflict between OCS and IOD management of CSI. In January, the long-time head of the CFATS program, David Wulf, left DHS and moved up to a higher-profile job at DOJ, part of the normal progression of career manager like Wulf. The timing, however, was less than fortunate because of the lack of appointed leadership in CISA and DHS. Todd Klessman filled in as the Acting Associate Director for Chemical Security. That left the internal political balance between IOD and OCS tilted in the favor of IOD.

If that is the cause of the apparent conflict, it should be reduced with the recent appointment of Kelly Murray to fill the role of Associate Director. Ms Murray has been working in the CFATS program almost since its inception and has worked directly with the management of the CSI in earlier roles. I would expect that she would be capable of dealing with the inherent conflict with IOD.

Reader Comment – IOD from the Inside

An interesting comment over on LinkedIn about yesterday’s blog post on CISA’s Integrated Operations Division. The commentor is Wade W. Gough, a senior chemical security inspector with the Chemical Facility Anti-Terrorism Standards (CFATS) program. His insider-based feedback is always welcomed. He notes:

“Great discussion on our inner workings. Having worked in more complex environments under more competing command authorities, this hasn’t been an issue to me as IOD understands very well the regulatory nature of CFATS. With that & in my experience, working in a Regional office with IOD has plusses & some neagtives but nothing I would describe as a conflict or real concern & certainly nothing that conflicts w/ the CFATS program & its ability to do its job.”

I would not read too much into his ‘plusses and some negatives’ comment. There is no such thing as a perfect organization, and it is well known that DHS as a whole has had more than its share of negative feedback from its employees over the years. It is, however, heartening to hear that he has not seen anything that “conflicts w/ the CFATS program & its ability to do its job.” He obviously cannot publicly complain too much about agency operations while being publicly identified as a CSI, but there is no reason to question his unsolicited positive comments.

I do stand by my suggestion, however, that this is an organizational situation that is ripe with potential for conflicts. While good people with honorable intentions will certainly be able to make the system work, a single person with a conflicting agenda or a need for personal power could cause all sorts of problems in this type of situation. Again, someone outside of the two agencies needs to keep a periodic eye on the situation to ensure nothing untoward happens. The CFATS program had enough management problems in its early years, it does not need any new organizational blemishes.

CISA Integrated Operations Division

This last weekend I received an interesting direct message on one of my social media accounts asking if I had ever taken a look at CISA’s Integrated Operations Division. I had not, but before I do, I need to take a brief side step and look at a piece of my governmental history.

Chain of Command

Every soldier, sailor, airman and marine learn one basic lesson quickly in their initial training; the chain-of-command. The chain-of-command is the legal fiction that there exists a direct line of authority from the President down to the lowest enlisted members of the Armed Forces. Each and every recruit is required to memorize the title and name of every person in their chain-of-command.

While such a direct linear chain-of-command may have existed at some point in our nation’s history, the structure of a modern military is no longer so clearly defined. I had this fact driven home for me when I served in the G3 Emergency Operations Center in Berlin in the late 70’s and early 80’s. That time was a very warm period of the Cold War and Berlin was, as usual, smack in the middle of things. In the EOC we served two masters; the Brigadier General commanding the Berlin Brigade and the US Commander of Berlin, a Major General. For the BG we were a tactical operations center that typically went ‘to the field’ once a year for a tri-partite war game with our British and French allies.

For the USCOB, however, we were the EOC for a politically responsive military command. The Major General reported directly to the US Ambassador for Germany and we routinely communicated directly with the Pentagon and the National Command Authority as incidents evolved in our area of operations. As political tensions escalated, we frequently operated as both the EOC and the TOC. As operations NCO’s we had to carefully be fully aware of in which role we operated, in each communication in which we took part.

Our chain-of-command in each role was different and would frequently shift in the middle of an operation as the political realities changed around us. Fortunately, we had a great operations officer and an experienced Senior Operations NCO that were aware of the potential problems. They kept us aware of the organizational status of our operations, especially when that status changed in the middle of an operation. This helped us ensure that we did not make any serious reporting or coordination mistakes.

Integrated Operations Division

CISA is the Cybersecurity and Infrastructure Security Agency. They make most of their news recently in their cybersecurity role. The infrastructure security portion of the Agency is, however, a fully functioning and important part of CISA. A major functional part of that other-than-cyber part of CISA operations is found in the Integrated Operations Division. They provide “a national capability to deliver CISA services to our stakeholders and partners across state and local governments and the critical infrastructure community.”

Operating offices out of each of ten CISA Regions (patterned after the FEMA regional organization) the IOD provides local logistical support for CISA personnel in the realms of:

• Chemical Security Inspectors (CFATS program),

• Protective Security Advisors,

• Cybersecurity Advisors, and

• Emergency Communications Coordinators

These regional offices also serve as a point-of-contact for State, local and tribal governments for coordination and support from CISA.

IOD and CFATS

Here is where stuff starts to get complicated. First off, the Chemical Facility Anti-Terrorism Standards (CFATS) program is run by the Office of Chemical Security (OCS) out of the CISA Infrastructure Security Division. OCS is responsible for:

• Developing and maintaining the Chemical Security Assessment Tools (CSAT) used by facilities to provide information to DHS about their chemical security processes,

• All of the back-end operations of the risk assessment process which is used to determine which reporting facilities are considered to be at high-risk of terrorist attack and thus covered by the CFATS program,

• First authorizing and then approving each facility site security plan, and

• Ensuring that covered facilities remain compliant with their approved site security plan responsibilities.

The on-site eyes and ears of OCS are the Chemical Security Inspectors. These are the valued members of the CFATS teams that work directly with the covered facilities in helping them develop effective site security plans and then ensure that they comply with the approved plans and remain in compliance with them over time. The CSI work out of the CISA Regional offices.

Each Regional Office has a Chief of Chemical Security. This is the ranking Chemical Security Inspector in the region who is responsible for the operations of the CSI in that Region. In addition to ensuring that all chemical security inspections, audits and assistance visits are accomplished in a timely and effective manner, the Chief is also responsible for providing response to State, local and Tribal governments in the region in matters related to chemical security, providing outreach to chemical facilities within the region about their reporting responsibilities under the CFATS program, and supporting chemical facilities not covered under the CFATS program is assessing their facility security.

The thing that is not clear to me is to whom does the Chief of Chemical Security report? Certainly, in many of the day-to-day activities of the CSI is responsive to the local official running the Regional Office. But for the purposes of ensuring that the requirements of the CFATS program are met, the Chief should be directly responsible to OCS. One would like to think that there should be no conflicts between the competing requirements of the Regional Office and OCS, but anyone that has ever worked with bureaucracies knows that they seldom work as planned.

Now I have heard nothing about any specific conflicts between regional offices and OCS, but professionals would have to acknowledge that there was the potential for conflict. When organizations are set up in ways that make for potential conflict, controls have to be put into place to identify such conflict early on and resolve that conflict before it gets too far out of hand. In the federal government, the agency responsible for identifying and resolving these types of internal conflicts is the Inspector General. The DHS IG should set up a periodic review of the situation in the CISA Regional Offices to ensure that conflicts between IOD and OCS priorities to not hinder the efficient oversight of the CFATS program.