CFATS Knowledge Center Update 06-14-11

Today the folks at DHS ISCD updated their CFATS Knowledge Center web page to reflect the publication of three notices in the Federal Register about the proposed CFATS personal surety program. The updated information includes a brief news item, a revised FAQ response and a new article on the program.

Latest News

The Latest News section of the page provides a one paragraph summary of the three documents published in today’s Federal Register. The description if full of jargon and if you don’t follow the ins and outs of the regulatory processes involved, it could be a little confusing. It does, however, identify the event and notes that the Documentation Section at the bottom left of the page contains links to all three documents.

FAQ Update

Both the question and response to Frequently Asked Question 1368 has been updated as was explained in the ICR Response Notice.

The question originally asked: “Are background checks required for fire department personnel (firefighters and fire protection engineers)? If so, would the background check used for initial employment be acceptable?”

The old response was: “6 CFR Part 27 does not require that fire department personnel undergo background checks.”

The revised question now reads: “Are CFATS background checks required for emergency responders prior to access to restricted areas or critical assets during emergency situations?”

The new response now reads: “No. During emergency situations, 6 CFR 27.230(a)(12) does not require CFATS background checks on emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets.”

Again, as I noted in my blog earlier today, this response continues to keep emergency responders (typically considered to be fire and EMS personnel) in a separate category from law enforcement personnel who are exempted from the personal surety requirements when they gain access to restricted areas or critical assets ‘in performance of their duties’.

I sincerely believe that this is a bureaucratic oversight and that there was no intention to require fire fighters and EMS personnel to have to undergo background checks to take part in drills and training at high-risk chemical facilities.

Personal Surety Article

Article # 1721 has been added to the list of articles maintained on the CFATS Knowledge Center. As with most of the other articles, this one provides a fairly high level summary of how the new personal surety program will work. Anyone working CFATS issues should read the article in its entirety. It provides a much more understandable description of the program than did the notices published in today’s Federal Register.

The article provides one very valuable piece of information that was not included in the earlier notices. It notes in the last section of the article that: “DHS anticipates launching the Personnel Surety Program in the fall of 2011.” Given the way the previous CSAT tools were launched, we might expect to see an early version of the program to be run-out with a few Tier 1 facilities this summer to work out the bugs. Those early implementations would have ISCD personnel working side-by-side with the facility personnel submitting the information.

ISCD would then fine tune the program and publish two manuals for use of the tool that would provide detailed instructions for facility personnel to use the system.

NOTE: Links on the CFATS Knowledge Center for articles and FAQ are no longer ‘permanent’ links. This is the reason that I have not provided links within this posting; they would not work when a reader clicked on them. To find the links to the article and FAQ listed in this post go to the CFATS Knowledge Center Page and click on the ‘Personal Surety’ button on the bottom of the page. It will then list the two links.

OUT-OF-DATE INFORMATION: I have been avoiding mentioning this, but I can no longer help but point out that the 4-13-11 news item on the Chemical Sector Security Summit listed on the CFATS Knowledge Center page is woefully out of date. It should have been changed on May 20th when registration was closed. I suspect that the change was not made due to a lack of communications between the Chemical Sector-Specific Agency in OIP and the folks at ISCD.

CFATS Personal Surety Program Moves Forward

Today DHS published three notices in the Federal Register outlining the requirements for submitting data on personnel to DHS as part of the CFATS Personal Surety Program. These notices are:

● Reply to comments from the 30-day CFATS Personal Surety Program Information Collection Request (ICR) (76 FR 34720-34732; ICR Notice)

● Notice of the establishment of a Privacy Act system of records supporting the CFATS Personal Surety Program (76 FR 34732-34736; Privacy Act Notice)

● Notice of proposed rule making (NPRM) proposing a Privacy Act exemption for the CFATS Personal Surety Program system of records (76 FR 34616-34618; Privacy Act NPRM)

These three notices are part of the establishment of a system within CFATS to require covered high-risk chemical facilities to submit information to DHS to allow a determination of whether affected personnel are on the list of known/suspected terrorists, a check required by 6 CFR 27.230(a)(12)(iv). These notices are a legal follow-up to a 60-day ICR notice published on June 10th, 2009 (74 FR 27555) and the 30-day ICR notice published on April 13th, 2010 (75 FR 18850).

Affected Personnel

The ICR Notice outlines two classes of personnel that are covered by the requirement for a high-risk facility to submit personal identifying information to DHS to compare against the TSA Terrorist Screening Data Base (TSDB); these are known as ‘affected personnel’. Additionally, three classes of individuals are listed as being exempted from the terrorist ties screening requirement.

The affected personnel are:

● Facility personnel who have or are seeking access, either unescorted or otherwise, to restricted areas or critical assets; and

● Unescorted visitors who have or are seeking access to restricted areas or critical assets.

The first category caused more than a few complaints in the earlier comment process. Most people who objected to this read §27.230(a)(12) to mean that only people with unaccompanied access required the background checks, including the check for terrorist ties. Unfortunately, the wording of that section is quite clear; the term ‘facility personnel’ is not modified by any discussion of access, so it should apply to all facility personnel. Visitors, however, only require the background checks listed in this paragraph if they have “unaccompanied access to restricted areas or critical assets”.

The one vague area in this discussion is the issue of dealing with contractors and vendors; are they visitors or facility personnel. DHS noted that that “determination should be a facility-specific determination, and should be based on facility security, operational requirements, and business practices”. The facility would outline how it handled the situation as part of its site security plan.

DHS addressed an issue that I have mentioned a couple of times here in this blog in discussing remote access to control systems computers. They specifically note that if “a networked computer system is listed as a restricted area or critical asset in an approved SSP, then individuals with access to that networked computer system would be affected individuals for purposes of RBPS-12”.

The three categories of personnel that are exempted from the background check requirements of RBPS 12, and thus the terrorist ties checks in particular, are:

● Federal officials that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties;

● Law enforcement officials at the State or local level that gain unescorted access to restricted areas or critical assets as part of the performance of their official duties; and

● Emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations.

It is an unfortunate distinction between how law enforcement and emergency response personnel receive their exemption. If an emergency responder is taking part in training or an exercise at a high-risk facility, the ICR Notice seems to indicate that they would require background checks since that is not ‘during emergency situations’. Law enforcement personnel would retain their exemption since they would clearly be in ‘the performance of their official duties’. I’m sure that DHS did not intend for this distinction to exist, but that is the way the wrote their notice.

Other Federal Credentials

There are a number of other Federal programs that require that personnel are vetted against the TSDB. These include:

● Transportation Worker Identification Credential (TWIC) program,

● Hazardous Materials Endorsement (HME) program,

● NEXUS program,

● Secure Electronic Network for Travelers Rapid Inspection (SENTRI) program, or

● Free and Secure Trade (FAST) program.

DHS will ‘accept’ the credentials from these programs, but will still require the facility to submit data to allow DHS to check that the credentials are still current and valid. A slightly different set of data will be acceptable for checking these credentials and a facility is not required to accept these alternative credentials.

Procedure

While we won’t know the details of the procedure until the appropriate manuals are published, the ICR Notice provides an overview of how the personal surety program will work. DHS will develop a Personal Surety Program tool in CSAT. As with the other tools in CSAT, facility management will designate a submitter and other agents to enter data into the tool. Once the data has been submitted and checked by DHS for format and completeness of data, DHS will provide the facility with an acknowledgement of receipt of the data; facilities will use those acknowledgements to demonstrate compliance with the submission requirement for RBPS 12.

Facilities will be able to use a third party background check vendor to submit data in the personal surety tool in CSAT, by designating an individual from that vendor in the appropriate role in CSAT for that tool. Companies with multiple CFATS facilities could consolidate their submission at the corporate level using the same technique; though the individual facility would have to be identified as a place where the individual would have access. Presumably the tool would be designed to make that a relatively simple operation.

Once the data is submitted and checked DHS will then submit the data to TSA’s Office of Transportation Threat Assessment and Credentialing (TTAC) for the check against the TSDB for an initial check of potential terrorist ties. If a match occurs at this point, TSA will forward the data to the FBI’s Terrorist Screening Center (TSC) for a final determination if the individual has been identified as someone with known or suspected terrorist ties.

DHS still maintains that they will not routinely notify a facility if a submitted name comes up as a match through this system. They insist that it could compromise an investigation if routine notice were provided to the facility or the individual prematurely.

This is the main reason for DHS to publish the Privacy Act NPRM today. Privacy Act rules would normally require individuals to be informed when personal information was collected and adverse information was placed into the record. DHS is claiming one of the standard law enforcement exemptions to that Privacy Act communication requirement in their NPRM Notice.

Program Comments

The public comment process has now been completed on the Information Collection Request with the publication of this reply to the 30-day Notice. The Privacy NPRM has a 30-day comment period that starts today. Comments on that NPRM can be made on the Federal eRulemaking Portal (http://www.regulations.gov/; Docket Number DHS-2011-0033). Those comments should be filed by July 14, 2011.

I would expect that the Office of Management and Budget can be expected to make their final ruling on the acceptability of the ICR within the 30-day comment period of the NPRM. Then all that would remain to allow implementation of the program would be the publication of the final rule on the Privacy Act exemption. That process could go fairly quickly and we could have a new CSAT manual covering this new tool being published as early as late July or early August (hopefully this year).