Reader Question - Material Modifications

I had an interesting question sent to me by a long time reader of this blog concerning the term ‘material modifications’ as it is used in 6 CFR 27.210(d). That Chemical Facility Anti-Terrorism Standards (CFATS) requirement states that: “If a covered facility makes material modifications to its operations or site, the covered facility must complete and submit a revised Top-Screen to the Department within 60 days of the material modification.” The reader asks if the term ‘material modifications’ is defined in the CFR.

No Definition

The short answer is no. This is one of many definitions missing from the CFATS rule. In this case, I suspect that the reason is that there is no specific definition that would fit the situation. The issue was discussed, however, in the preamble to the interim final rule that established the CFATS program. We can see that discussion in response to a specific public request for a definition of the term:

“Material modifications can include a whole host of changes, and for that reason, the Department cannot provide an exhaustive list of material modifications. In general, though, DHS expects that material modifications would likely include changes at a facility to chemical holdings (including the presence of a new chemical, increased amount of an existing chemical, or the modified use of a given chemical) or to site physical configuration, which may (1) substantially increase the level of consequence should a terrorist attack or incident occur; (2) substantially increase a facility’s vulnerabilities from those identified in the facility’s Security Vulnerability Assessment; (3) substantially effect the information already provided in the facility’s Top-Screen submission; or (4) substantially effect the measures contained in the facility’s Site Security Plan.”

Change in Chemical Holdings

The most obvious change in chemical holdings that would be considered a material modification would be the introduction of a new DHS chemical of interest (COI) found in Appendix A to 6 CFR 27. Even if the new COI were not held at a screening threshold quantity (STQ) the addition could still qualify as a material modification if the addition met one of the four standards listed in the preamble discussion.

An inventory increase in one or more of the existing COI reported on the most recent Top Screen could also be considered a material modification that triggers a new Top Screen submission requirement. How much of an increase would be a trigger the requirement would depend on the chemical in question. A one pound increase in propane (Release – Flammable) would almost certainly not be a trigger while a one pound increase in Chlorosarin (Theft - CW) would almost certainly trigger the requirement. Again, the four standards would provide guidance on how much is significant.

The addition of non-COI chemicals to facility chemical holdings is even more complicated. The addition of a new flammable liquid in sizeable quantities could increase the size of a potential conflagration at a facility holding flammable-release COI. The addition of another potential (but unlisted) precursor to a chemical weapon could make it easier for a terrorist to manufacture that chemical weapon as a result of a successful attack on the facility. Once again, the four standards are what establishes the existence of a material modification.

Facility Configuration

Changes to the physical structure or operation of a CFATS covered facility could certainly be considered a material modification. Which changes would trigger the new Top Screen reporting requirements would depend on the facility and the COI holdings at that facility.

At a facility with holdings of theft-diversion COI anything that increases the traffic through the facility would almost certainly be considered a material modification. This could include construction activities, changes in the number of contractors on site, or even changes in the number of pick-ups and deliveries at the site. Again, the four standards listed in the preamble will determine which changes trigger the reporting requirement.

Decreased Risk

Facilities also need to remember that the material modification requirement is not limited to changes that increase the risk of terrorist attack at the facility. Changes that decrease risk can also trigger the reporting requirement. The folks at the Infrastructure Security Compliance Division (ISCD) are certainly not going to fine a facility for failing to report changes that reduce risk, but ISCD could lower the facility Tier ranking or even remove a facility from CFATS coverage when material modifications produce significant reductions in the risk of terrorist attack.

Always Consider Material Modification

Just about any change at a facility could have an effect on the security of the facility. CFATS covered facilities have a legal obligation to take a specific look at any changes in facility structure, operation or chemical holdings. This should be a part of the standard management of change process at the facility. Facility management needs to consider the chance that any changes made to the facility may trigger additional security requirements (and the associated costs) if the changes:

• Substantially increase the level of consequence should a terrorist attack or incident occur;

• Substantially increase a facility’s vulnerabilities from those identified in the facility’s Security Vulnerability Assessment;

• Substantially effect the information already provided in the facility’s Top-Screen submission; or

• Substantially effect the measures contained in the facility’s Site Security Plan.

If there are questions about a pending change the simplest thing to do is to ask DHS if they think that a change would be considered a material modification at the facility. For major (read costly) changes at a facility, the earlier the question is asked the better. Remember, the cost of any necessary security changes should be included in estimating costs for any facility modification.

Reader Question – 9-13-13 – Changing Tiers

I had an interesting question Friday from a Reader who will remain unnamed. He stated that he was a security officer for a CFATS Tier 3 chemical facility and wanted to know what his facility could change to reduce their tier ranking to Tier 4. He didn’t specifically state it, but the intent was almost certainly to lower to cost of their security program.

This a very common business objective. It is difficult to reduce costs on a security program that has to be authorized, approved and inspected by a federal agency. The CFATS program provides only one real way to achieve significant cost savings in a security program and that is to lower the tier ranking of the facility; lower ranked tiers have less stringent risk-based performance standards with which to comply.

Tier Ranking Standards

There is a basic problem in accomplishing this task; ISCD will not discuss the standards they use to perform tier rankings. The closest you’ll get from them is an explanation of how to get removed from the list of high-risk chemical facilities covered under CFATS. That is to remove all DHS chemicals of interest (COI) from the facility or to reduce the inventory levels below the screening threshold quantity (STQ). And actually, it may not be enough for a covered facility to just reduce their inventory below the STQ; more about that in a later post.

DHS has always maintained that the rules that they use to determine CFATS coverage are based upon a complex analysis of risk and that sharing the details of those rules would make it easier for terrorists to select appropriate chemical facility targets. I’m not sure that I totally agree with that, but it is the policy that DHS has fairly firmly stuck with since the inception of the CFATS program.

The GAO and Congress are not really satisfied with the risk assessment process. They would like to see some additional factors added to the risk assessment process, but that will not make it simpler and ISCD is unlikely to share the details of how those factors are implemented if and when that takes place. On a side note; I suspect that, when these factors are included, it will result in expanding the number of facilities covered under the CFATS program and raising some tier rankings of some facilities already covered.

Tell Me What, Not How

My facility security manager reader could care less how ISCD determines their tier rankings. He just wants to know what he has to do to reduce his. He would clearly be satisfied if ISCD were to tell him to A, B and C and we will reduce you to a Tier 4 facility. Unfortunately, the ISCD stance on this is that they are forbidden by Congress from doing this.

Section 550(a) of the Homeland Security Appropriations Act of 2007 (PL 109-295), the Congressional authorization for the CFATS program, states that “the Secretary may not disapprove a site security plan submitted under this section based on the presence or absence of a particular security measure”. Industry has insisted on a strict interpretation of this standard that ISCD may not tell facilities what they must do to secure their facilities. As a consequence ISCD has been very careful (read restrictive) about what they tell facilities in advance about making changes to their program.

A facility may get a Chemical Facility Inspector or the Regional Commander, in a very private conversation, to give them suggestions about what may work in getting a tier ranking lowered, but there is no guarantee that complying with the suggestions will actually result in the actual lowering of the ranking; it is very unlikely that even the regional commanders are fully read into the ranking evaluation process.

Trial and Error

The only sure way to find out how a given facility will be able to lower its tier ranking is through the very inefficient trial and error method. This would entail making changes to the amount inventoried and the storage methods used for the facility’s COIs, submitting the appropriate information to ISCD and waiting for their response.

This is not real helpful for Tier 1 and Tier 2 (and some Tier 3) facilities that have already had their SSP authorized. Most of their security apparatus is already in place so the only capital costs that could be avoided would be those currently budgeted for planned security measures. Even those costs would only be avoided if the ISCD response came back before the monies were actually spent. Operational and maintenance costs could be avoided, however, for some of those security measures at a lower tier ranking.

Tier 3 facilities that are not already well into the authorization process may be able to avoid some significant capital costs by being changed to a Tier 4 ranking and would certainly avoid the operation and maintenance costs of the avoided security measures.

How one goes about submitting this change is the subject for another blog post.

Suggested Changes

DISCLAIMER: I do not know the details of how ISCD ranks tiers. The following discussion is based upon my military physical security experience, years of working in chemical facilities, and a variety of discussions with chemical security professionals over the last six years of writing this blog.

Tier ranking is based upon a risk assessment process. Lowering the risk posed should result in a lowering the tier ranking if enough risk is reduced. Different types of COI present different risks so different types of changes will have to be made depending on the types of chemicals involved.

The ‘easiest’ change to make is to get rid of one or more COI. This could be accomplished by removing the COI from the processes on site, substituting some alternative chemical or eliminating a product line. Frequently this is ‘easy’ only in the eyes of environmental activists, but it is a sure way to reduce on-site risks.

The second easiest change is to reduce the amount of a COI on site. This is particularly true for release security issue chemicals, the lower the amount on hand the lower smaller the area potentially affected by catastrophic release. This is probably not as effective a method of risk reduction for theft/diversion security issue chemicals. The much smaller STQ for these chemicals reflects the fact that it is the risk of these chemicals being converted to improvised weapons (chemical or explosive) that is of concern.

For release threat COI another version of this tactic it to disperse the chemical into multiple smaller containers; typically we are talking storage tanks here. The containers would have to be separated enough that a single attack would not result in the release from multiple containers.

For theft/diversion threat COI the opposite operation can actually reduce risk. Taking these chemicals out of man-portable containers and placing them in storage tanks makes it more difficult to steal the material and easier to secure.

Another possible (though more controversial) method of reducing the risk is to place all of your COI in a relatively restricted area within the overall facility and isolating that area from public view and access. This is particularly useful in a very large facility as it also potentially reduces the portion of the facility that has to be secured to CFATS standards; a significant cost savings.

Remember, circumstances alter the effectiveness of all of the above.

Changes to CFATS

In light of the above discussion, I would like to make a suggestion to lawmakers for consideration when they finally get around to making a permanent (or at least long-term) chemical security program. The language of the legislation should make it clear that DHS has a responsibility to work with high-risk chemical facilities in determining methods of reducing the risk at a facility. This should include making non-binding suggestions as to what security measures could be considered (what has worked at other facilities for instance) as well as what non-security measures facilities can take to reduce their risk rankings.