There was an interesting comment left on TWITTER yesterday
about my post on latest
CFATS update. Marc Ayala
wrote: “Your right Pat, a
decline in the number of covered facilities is actually a good thing. It looks
good on paper that is.” This was in response to my reporting on the decline in
the number of facilities covered under the Chemical Facility Anti-Terrorism
Standards (CFATS) program. While there have only been two straight months of
decline in the number of facilities regulated under the CFATS program, the
number of facilities covered is at its lowest number since June 2020 when 3,341
facilities were covered.
I posited that: “Significant
reduction or elimination of those risks at a facility (necessary for exit from
the program) reduces the risk for the communities around those facilities and
the country as a whole.” Marc’s comment raises the specter that this apparent reduction
in risk is more about regulation avoidance than risk reduction. That is
certainly an idea that should be addressed.
How Do Facilities Leave CFATS
Typically, a
facility initiates the process of leaving the Program by submitting a Top
Screen update showing a change in the inventory quantities of any of 300+ DHS
chemicals of interest (COI). The folks at CISA’s Office of Chemical Security
take the new inventory numbers and run them through the same risk assessment process
that landed the facility in the program in the first place. As I understand it,
if the assessment indicates that the risk is reduced below the threshold that
would land a facility in the program, then a chemical security inspector (CSI)
is dispatched to the facility to physically verify that the risk has been
reduced.
Once the final
determination is made about the change in status, the facility is notified that
it is no longer covered by the program. Presumably, the facility then reduces
its emphasis facility security in order to reduce the costs associated with its
site security plan. That reduction would appear to be reasonable; with a
reduced risk, the level of security does not need to be as high.
Incentives to Leave the Program
Facilities have a
number of reasons to want to leave the program. Security measures are expensive
to install and maintain. They also frequently lead to inefficiencies in
internal processes and controls. Finally, any regulatory program has administrative
compliance costs. Furthermore, the advantages of an effective security program
are hard to quantify, especially since there have been no documented terrorist
attacks (or attempted attacks) on chemical facilities in the US since the CFATS
program was stood up in 2007.
To justify a
removal from CFATS, a facility must reduce its inventory below the reporting
levels set in Appendix
A, 6 CFR Part 27. Facilities that manufacture or distribute COI, can get
out of that business. Facilities that use COI as raw materials can either find
replacement chemicals (not always possible), reduce the maximum amount of
material that is held on hand, or get out of the business that utilizes the
COI. Each of these options carries its own business costs and consequences. Or,
of course, a facility could just lie. That is why OCS sends inspectors to
verify the process changes.
Moving Forward
As long a CISA’s
OCS adequately vets facilities leaving the program, the risk of facilities
cheating to avoid regulatory oversight remains relatively low. And OCS has a
bureaucratic incentive to keep the covered facility number high; if the number
drops too low, Congress will reduce funding and headcount for the Office.
It would be nice
if OCS were able to share more details about how and why facilities continue to
leave the CFATS program, but there are legitimate security and business
confidentiality reasons that limit the information that CISA can share with the
public. I suspect, however, that with the program facing renewal next year
(after the Democrats potentially loose “control” of Congress) that we are going
to start to see Committee interest in all sorts of issues within CFATS. I would
not be surprised to see one or more Committee Chairs asking the GAO to report
on the number and process of facilities dropping out of the CFATS program.
Posts
