OMB Announces Withdrawal of CFATS Personnel Surety ICR

Yesterday the Office of Management and Budget (OMB) announced that DHS/NPPD had withdrawn the information collection request (ICR) necessary to implement the CFATS personnel surety program. This is the program that would have ISCD collect personnel information on facility personnel and visitors with unaccompanied access to high-risk chemical facilities to check those personnel against the Terrorist Screening Database (TSDB). This check is required for Risk-Based Performance Standard #12.

There was no indication in the notice why the ICR had been withdrawn, but this ICR has been opposed by industry as overreaching. It has also been criticized by many members of Congress on both sides of the aisle for not utilizing the TWIC, or at least formally recognizing the TWIC, as the method of vetting personnel with unaccompanied access to high risk chemical facilities. One would hesitate to suggest that political considerations were behind the NPPD action.

One would like to think that the formal withdrawal of this ICR would be an indication that the Infrastructure Security Compliance Division (ISCD) has a new personnel surety program ready for release in the near future. Perhaps there will be an announcement about this program that will be made in association with the Chemical Sector Security Summit at the end of the month.

Of course the problems that we have been seeing with the failure to release new guidance on the SSP implementation process probably argues against any quick resolution to the personnel surety problem. ISCD is getting further and further behind and it is fast reaching the point where if significant progress is not seen in the near future, we should seriously consider disbanding ISCD and re-starting the CFATS program from scratch.

Reader Comment – 06-24-09 – TWIC Availability

Earlier today Wally Magda left a comment about an earlier blog on background checks and TWIC. Apparently responding to my statement that: “If facilities were to get TWICs for each of their employees that had access to restricted or security areas, this would almost certainly fulfill the RBPS #12 requirements.”; Wally writes:

“Great TWIC can't be obtained in some states because there aren't any enrollment centers. One example is Colorado. I would have to travel quite a distance to get a TWIC processed.”

Wally brings up a very good point that I overlooked in my posting. TWIC could be used to fulfill the RBPS #12 background check ‘requirements’, but states removed from the coast or navigable waterways may find it difficult to get ready access to ‘enrollment centers’. TWIC was designed to provide identification for workers at port facilities, not all chemical facility workers. This means that the enrollment centers are more likely to be near those port facilities. Land-locked states like Colorado are less likely to need the services of such a center. This problem may be aggravated by a provision in Safe Trucker’s Act section of HR 2200. That provision, §432 would require DHS to write rules requiring trucker’s carrying ‘security sensitive materials’ to have TWIC. DHS would be required to start issuing these licenses by May 1st, 2010 so maybe they would have time to establish more enrollment centers in parts of the country that are currently underserved.

Terrorist Background Check

Yesterday I reported on the DHS ICR for their proposed solution for conducting terrorist database background checks for personnel with access to restricted areas or secure areas within high-risk chemical facilities. Today I would like to take another look at the issue with less of a reportorial approach. Specifically, I would like to take a look at some of the items I would like to see discussed in public comments on this ICR. Facility Notification I noted yesterday that “The submitting facility would not be notified by DHS of the results of the TSDB screening.” That means that if an employee’s name showed up on the TSDB check, the facility would not be notified by DHS that that employee was potentially a terrorist or linked to a terrorist. At most, the ICR notes that “high-risk chemical facilities may be contacted by Federal law enforcement as a part of appropriate law enforcement investigation activity” (74 FR 27555). There is no explanation of why DHS would not notify the facility that there was a potential terrorist working at that facility. One can make a pretty good guess as to why DHS is taking this stance. First off, the mere presence of a person’s name on the TSDB does not mean that the person is a terrorist or has even associated with Terrorists. As we have seen with the ‘No Fly List’ there have been a number of very public instances of confusion of innocent people with potential terrorists because of name similarity. There are undoubtedly an at least equal number of unreported instances where person’s name was incorrectly placed on the list. This means that requiring or even allowing high-risk chemical facilities to make personnel decisions based on the mere match of an employee’s name with a name on the TSDB would be patently unfair. Civil liberties organizations should certainly applaud the approach that DHS is taking. On the other hand, the match does mean that there is at least a chance that an employee with access to restricted areas or security areas at a high-risk chemical facility is a terrorist planning an attack or a terrorist sympathizer providing information to terrorists planning an attack. While a ‘Federal law enforcement’ agency is getting around to conducting their investigation the planned terrorist attack could happen. The DHS approach is probably the correct way to deal with this situation, but I think that there needs to be a public discussion about the assumptions being made. This ICR and the public comment period is the appropriate place for such a discussion. Notifying Employees about the Check DHS is proposing to effectively transfer responsibility to facility management for informing individual employees about the Privacy Act issues regarding the facility submission of PII (personally identifiable information). Since the facilities are the ones actually collecting and transferring the data, I suppose that this makes a certain amount of sense. At the same time, however, DHS is proposing to publish Federal Register Notices about the same Privacy Act requirements. While it might be reasonable to expect that high-risk chemical facilities would read (or pay someone to read for them) the Federal Register watching for such notices, it is beyond the realm of reasonable supposition to assume that the average employee would do so. I would like to suggest a reasonable alternative. DHS could come up with a poster explaining the program similar to the ubiquitous OSHA posters about a wide variety of regulatory programs. These could be posted on employee bulletin boards at high-risk chemical facilities. While these types of posters are not read with any great frequency, they are much more likely to be read by the affected parties that Federal Register Notices. Unescorted Visitors Having worked in chemical production facilities for a number of years, I agree that there are a number of ‘visitors’ (not employees, not contractors) that frequently move about certain areas of chemical facilities on a fairly routine basis. Small package delivery drivers and a wide variety of vendors (uniform and industrial mats vendors come easily to mind) are frequently overlooked because they are such a common site at these facilities. The big problem with most of these ‘visitors’ is that they are relatively invisible and there is a certain amount of inevitable turnover in these positions. I would like to see some comments on how high-risk chemical facilities would manage the identification and clearance of these personnel. I think that rather than facilities doing background checks on these ‘unescorted visitors’, covered chemical facilities will probably resort to requiring escorts or setting their employers up more like contractors and transferring the background check responsibility to those companies.

CFATS Personnel Surety Program ICR

Yesterday DHS published a notice in the Federal Register about the initiation of a new information collection request. The publication of such ICR’s is a fairly routine occurrence and I frequently mention chemical security related ICR’s in a brief posting in this blog. This particular ICR is going to get much more than a routine treatment in this blog; it is directly related to CFATS and Site Security Plans and it is more than a little unusual. Also, this is the first ‘60-day notice’ and a request for comments; this does not actually count as the filing of the ICR with the OMB.

Screening for Terrorist Ties

In this ICR notice the National Protection and Programs Directorate is announcing a new program of collecting information on individuals working at high-risk chemical facilities in support of the requirements of RBPS #12, Personnel Surety {6 CFR 27.230(a)(12)}. Sub-paragraph (iv) of that section requires facilities to address “measures designed to identify people with terrorist ties” among “facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets”.

DHS is proposing to establish a new CSAT tool to allow high-risk facilities to submit ‘personally identifiable information’ (PII) on facility personnel and unescorted visitors so that the Federal Government can check to see if those personnel appear on the “integrated terrorist watch list maintained by the Federal Government in the Terrorist Screening Database (TSDB)” So far, so good; a high-risk facility will prepare a list of employees and contractors with routine access to ‘restricted or secure areas’ of the facility.

They will require those individuals to provide PII (probably full name, SSN and possibly biometric data) to the facility management. The Facility will enter that data into a secure, on-line application that will become another tool in the Chemical Security Assessment Tool. TSA (they ‘own’ the TSDB) will then check that PII against the entries in the database. Any apparent matches will be turned over to the Terrorist Screening Center (TSC) for final determination of whether or not the indicated individual is actually on the TSDB.

The submitting facility would not be notified by DHS of the results of the TSDB screening. What they will receive is a ‘Verifications of Submission’ that will be used to demonstrate compliance with the ‘terrorist ties’ requirement of risk-based performance standards. Any potential terrorists or personnel with suspected terrorist ties identified by this screening will be identified to an appropriate Federal law enforcement agency for further investigation and/or action. The facility may be contacted by that law enforcement agency as part of their investigation. One final note on the RBPS 12 requirements; DHS is making it clear that this new CSAT Tool will have no affect on the other background checks required under 6 CFR §27.230(a)(12). Facilities will still have to address the issues of identity, criminal history, and authorization to work in their Site Security Plan.

Paperwork Reduction Act Exemption Request

DHS notes that they intend to request an exemption from certain notification requirements of the Paperwork Reduction Act. Those provisions {5 CFR 1320.8(b)(3)} require that “affected individuals whose PII is submitted by high-risk chemical facilities be notified of the reasons for the collection, be notified how the information will be used, be given an estimate of the average burden associated with the collection, and be notified whether responses to the collection are voluntary or mandatory)” (74 FR 27556). Instead, DHS intends to provide a general notification to potentially affected chemical workers via a series of Federal Register notices. Those notices will include:

A specific Privacy Impact Assessment; A specific System of Records Notice; The proposed exemptions for disclosure as required by the Privacy Act; and The final exemptions for disclosure as required by the Privacy Act.

Additionally, DHS will shift the burden of specific notification that the information is being collected and submitted to the high-risk chemical facility. The notice says that they intend to require the individual facility to explain how they will complete their personnel notifications as part of their Site Security Plan submission. Actually this is already included in the SSP; on page 250 of the Questions Manual question number 18.32-18804 asks:

“Will the facility provide notification to facility personnel, and as appropriate unescorted visitors, with access to the restricted areas or critical assets that personal information about them has been or will be submitted to DHS to determine if they have terrorist ties?”

This Federal Register Notice specifically states that this intended request for exemption will not “exempt high-risk chemical facilities from having to adhere to applicable Federal, State, local, or tribal laws, regulations or policies pertaining to the privacy of facility personnel and the privacy of unescorted visitors.”

Request for Comments

The major purpose for this Notice, besides notifying the ‘affected community’ of the initiation of the ICR process, is to request feedback from that community (high-risk chemical facilities and their employees and contractors). OMB has a standard list of questions that they would like to see addressed in any ICR, but DHS is looking for some additional information. DHS is looking for comments that (74 FR 27556):

“Respond to the Department's interpretation of the population affected by RBPS 12 background checks outlined in 6 CFR 27.230(a)(12); “Respond to fact that a Federal law enforcement agency may, if appropriate, contact the high-risk chemical facility as a part of a law enforcement investigation into terrorist ties of facility personnel; and “Respond to the Department on its intention to seek an exception to the notice requirement under 5 CFR 1320.8(b)(3).”

Comments may be submitted electronically at http://www.regulations.gov/, citing docket number DHS-2009-0026. Comments need to be submitted by August 10th, 2009. This will be one of those dockets where I will be tracking and reporting on the comments posted.