More Comments on Draft RBPS Guidance – 01-09-09

I’m not sure why I went back and re-checked the RBPS Guidance comment site on Regulations.gov, but I’m glad that I did. There were four comments posted to that site in the last month; well after the comment period was closed. Additionally there was a comment that I had some how missed earlier The five comments were received from: Synthetic Organic Chemical Manufacturers Association US Chamber of Commerce American Chemistry Council Shell Oil Company EnergyAPI 

Synthetic Organic Chemical Manufacturers Association Comments 

SOCMA appreciates that DHS has clearly delineated that the document is a guidance not a requirement. SOCMA would expect that facilities that followed the guidance could expect that their site security plan would be approved. SOCMA questions why Appendix B was ‘intentionally’ omitted from the draft. SOCMA complains that the lack of specificity in the personnel surety section could lead unions to object to any personnel surety action against employees was not required by DHS. SOCMA would like to see more discussion about what types of security forces DHS believes would be most effective in different circumstances. 

US Chamber of Commerce Comments 

The Chamber would like to see DHS clarify that auditors checking SSP compliance will not use an RBPS based checklist, but rather verify implementation of the site plan. The Chamber would like to see DHS confirm that security measures approved under other regulations would be acceptable to meet the requirements of CFATS. The Chamber would like to see DHS address the overlap of various DHS security regulations. The Chamber would like to see more segregation of emergency response and security response functions. The Chamber notes that personnel actions based on personnel surety requirements will be made at the company level not facility level and should not be addressed in the facility security plan. The Chamber complains that the record keeping requirements are not specific enough. 

American Chemistry Council Comments 

 The ACC wants the Guidance to more completely address the wide variety of facilities that are affected by CFATS. The ACC wants DHS to clarify that the guidance will not be used as an enforcement tool or basis for an inspection checklist once site security plans are approved. The ACC wants DHS to more clearly delineate the difference between security response and emergency response. The ACC notes a number of specific instances where the guidance is apparently too prescriptive. 

Shell Oil Company Comments 

Shell would like to see clarification in the RBPS document that it is not intended to be used as a basis for inspections of approved site security plan compliance. Shell would like to see DHS more clearly define terms like ‘critical area’, ‘secure area’, and ‘restricted area’, and suggests the use of MTSA definitions. Shell believes that the use of phrases like ‘dangerous chemicals such as COI’ imply that the security plan should address chemicals other than those specified in the Appendix A. Shell objects to the inclusion of specific percentages in the vehicle screening requirements in Metric 3.4. Shell objects to the requirement that facilities be able to interdict an armed attack on the facility. Shell would like to see the requirement for a ‘know your customer program’ removed from Metric 5.2. Shell objects to a wide variety of requirements in RBPS #12, personnel surety. 

EnergyAPI Comments 

API believes that many of the RBPS do not address the unique nature of gasoline storage and loading facilities; noting that these facilities fall under CFATS due to the benzene content of gasoline. Noting that many of these facilities are unmanned, they object to the identification and inspection requirements of RBPS #3. They also object to the security guard/CCTV requirement under RBPS #4 as unnecessary at these low-risk facilities. 

My Comments on Comments 

From the dates on the individual comments it appears that they were mailed to DHS within the time frame required for comment submissions. I’m not sure where the delays were in getting them posted to the Regulations.gov website. I don’t suppose that it is really relevant since it is their consideration by DHS that is really important. It continues to amaze me that so many commentors praise DHS for providing guidance and not binding requirements and then criticize the document for not providing enough or providing too much detail in the guidance. And I am completely flabbergasted that they can make both of those complaints in the same document. 

 Then API comes along and completely blows me away. Claiming that putting ‘a guard or CCTV’ system at a gasoline storage facility is excessive due to the low risk takes first prize for completely misunderstanding CFATS. If DHS has determined that a large gasoline storage facility is a high-risk facility (and if they are a Tier 4 facility they are, by definition in CFATS, at high-risk for terrorist attack). A gate-guard or CCTV system is going to be the cheapest part of the security that will eventually be put in place at these facilities before their site security plan has any hopes of being approved by DHS. 

 The other area that constantly comes up in the corporate comments to the Draft RBPS Guidance document is the personnel surety issue. DHS has always been adamant that unescorted access to critical or high-risk areas must require background checks. This is a cornerstone of any security program. Industry commentors rightly point out that in most multi-facility companies, the personnel actions are centrally controlled, not facility controlled. What they apparently fail to recognize is that under CFATS the security of high-risk facilities is considered a corporate responsibility, not a facility management responsibility. This is reflected in the requirement for a corporate officer to be the Authorizer in CSAT. If the corporate Human Resources has to be involved in establishing and managing the personnel surety system for the high risk chemical facilities, so be it.

More Comments on Draft RBPS Guidance – 12-05-08

This blog looks at the remaining 8 comments that were filed as of last Friday on the Regulations.gov web site for the Draft Risk Based Performance Standards (RBPS) Guidance document that would be used by high-risk chemical facilities to guide them in developing their site security plan under the Chemical Facility Anti-Terrorism Standards (CFATS). The other 11 comments were discussed in yesterday’s blog. The comments that will be discussed today come from: National Paint and Coatings Association Compressed Gas Association Labor, Public Health, Environmental and Public Interest Groups IBM Industrial Safety Training Council National Petrochemical & Refiners Association Industrial Defender Inc American Gas Association National Paint and Coatings Association Comments The NPCA believes that DHS has developed a reasonable approach to a wide variety of high-risk chemical facilities, especially facilities so designated because they posses theft/diversion COI. The NPCA suggests that the metrics associated with RBPS #1 should explicitly note the acceptability of security restricted areas as opposed to the entire facility. The NPCA believes that many of the metrics need to include more references to measures that would be appropriate theft/diversion risk facilities. The NPCA questions how the requirements for 3rd party background verification can be implemented for less than truck load (LTL) truck drivers that typically deliver theft/diversion COI. Compressed Gas Association Comments The CGA notes that many facilities in their industry are small facilities with minimal staffing that will have extreme difficulties implementing many of the suggested security procedures. The CGA would like to see clarification to a number of specific metrics to address facilities that have only theft/diversion COI on site. The CGA suggests that the TWIC program be expanded for high-risk chemical facilities outside of port facilities. The CGA notes that many companies in its organization will have a corporate security officer who will effectively be the SSO for a number of small facilities. Labor, Public Health, Environmental and Public Interest Groups This coalition of a variety of labor, public health, environmental and public interest groups has been active in lobbying for expanding the current CFATS regulations. They suggest that the RBPS fails to address the use of inherently safer technology as a means to decrease the risk to high-risk chemical facilities. They also suggest that the personnel surety programs outlined in the RBPS inadequate protect worker rights. IBM Comments IBM briefly requests that the RBPS Guidance address how facilities can share Chemical Vulnerability Information (CVI) with local agencies in ‘the course of joint training exercises’ and still maintain the security of that information. Industrial Safety Training Council Comments The ISTC believes that the TWIC credentials are an inadequate screening tool for access to restricted areas of high-risk chemical facilities in that the background check provisions are less than adequate. The ISTC would like to see explicit language that requires that high-risk chemical facilities that are also covered under MTSA are required to comply with the personnel surety RBPS. The ISTC would also like to see the personnel surety RBPS recognize procedures by which a private-sector third-party may provide personnel surety programs for high-risk chemical facilities. National Petrochemical & Refiners Association Comments The NPRA notes the tight timeline DHS is working under to get this document to the affected facilities. The NPRA does note that there is much repetitive and overlapping information in the various RBPS. The NPRA is concerned that DHS inspectors could use the metrics in this guidance document as the de facto standard for measuring site security plan compliance. The NPRA notes that it appears that the guidance was written specifically for large, integrated chemical facilities and thus does not apply well to smaller facilities with limited resources. The NPRA questions the appropriateness of the number of instances where metrics are the same for multiple Tier levels. The NPRA requests that a number of terms used in the metrics be clarified or defined. The NPRA suggests that the Guidance has expanded the requirements for background checks beyond what is required in the regulations. They note that background checks and adjudication processes are normally handled at the corporate level not the facility level. Industrial Defender Inc Comments Industrial Defender provides alternative wording for a variety of areas under the Cyber Security RBPS. This wording provides more detailed guidance for areas such as access control, cyber security controls, network monitoring, incident response, and audits. American Gas Association Comments The AGA would like to see the RBPS explicitly state that security measures required by other Federal agencies would satisfy CFATS requirements. The AGA objects to the implied requirement in Metric 4.5 for a full-time armed security force. My Comments on Comments A number of commenters noted that, in general, the RBPS seem to be written with large chemical facilities in mind, not smaller facilities. I do agree that the wording of the metrics, in particular, does seem to be slanted in that direction. I am not sure how DHS can reword those metrics to address this issue without making the document unwieldy. Perhaps they can provide a section discussing how the metrics should be viewed by a variety of smaller facilities that still fall under the high-risk definition of CFATS. The comments made by the special interest (I do not mean this in a derogatory fashion, I just can’t find a simple method of identifying this group) coalition with respect to the lack of reference to IST are important. DHS does owe it to the public to at least address the possibility of risk reduction as a potential security measure in this document. Unfortunately, I think that the political discussion contained in the submission will over shadow the legitimate case for including IST language in the Guidance. It is interesting that the special interest coalition and the NPRA can provide comments about the same issue, worker protection in the personnel surety process, and come to such widely different views about the effectiveness of the RBPS requirements. The special interest coalition has long expressed concerns that employers could use the personnel process to get rid of troublesome workers and they do not believe that the Guidance provides enough protection in this regard. The NPRA feels, on the other hand, that the Guidance goes overboard in providing for protections. A good rule in politics is that if two sides disagree with a requirement for opposite reasons, then a decent compromise has been reached. The NPRA does bring up one legitimate point in their discussion of this issue. In many instances, personnel decisions (which personnel surety certainly is) are made at the corporate level, not the facility level. This is done for a variety of reasons, but generally does provide for a higher level of worker protection because of the likely removal of personalities from process. The RBPS needs to address the centralization of this process. A number of commenters make the point that their facilities are not manned on a continuous basis and use this as a justification for exemption from some of the security requirements listed in the Guidance. There needs to be a serious discussion of this issue. On one hand it is hard to imagine a high-risk chemical facility that can maintain adequate security without an on-site security presence 24-7. On the other hand it would be difficult for many of these smaller facilities to afford even the services of an unarmed guard when the facility is closed. This goes to the basic question of who bears the cost of security. Does the company that makes a profit from the use or sale of highly hazardous chemicals have an obligation to protect the community? Does society that requires the use of such chemicals to maintain its standard of living bear the burden of self-protection? I believe that the general cost of security is a cost of doing business, the same as personnel costs, and the same as safety or pollution control. There are certain security costs for these facilities, however, that might legitimately fall under the heading of providing for the common defense, something upon which we rely on the government. Emergency response, police, fire and emergency medical, certainly falls under this heading. Perhaps we need to add security forces to the “provide for the common defense” heading.

Comments on Draft RBPS Guidance – 12-05-08

The holiday weekend must have held up a number the comments from getting through to Regulations.Gov. A full week after the end of the comment period and new comments were still being posted to the site. As of last Friday there were twenty new comments submitted. This is too many comments to review in a single blog. The list below shows the commenters that will be reviewed in this blog. The remainder will be reviewed later this week. Marathon Oil Corporation Air Liquide BP Edison Electric Institute and USWAG GB Biosciences Corporation The Aluminum Association Payne Fence Products DCP Midstream LLC The Fertilizer Institute Tectonic Engineering Lubrizol Corporation Marathon Oil Corporation Comments Marathon complains that the Guidance implies that facilities should include provisions for chemicals in the SSP other than those listed in the initial notification letter received after Top Screen submission. Marathon believes that the Guidance should explain how inspectors will use the Guidance to evaluate SSPs. Marathon believes that the wording in Metric 4.5 implies that armed security forces will be required and believes that arming security forces would be unsafe at many chemical facilities. Marathon believes that the redress procedures described for RBPS #12 cannot be applied to DHS disqualifications based on the Terrorist Screening Database managed by DHS. Air Liquide Comments Air Liquide believes that DHS should be more specific in explaining that security measures may be limited to areas in which high-risk materials are stored or handled. Air Liquide believes that DHS should remove specific numeric bench marks found in Metrics 3.4 and 13.2. Air Liquide believes that DHS should include specific time frame bench marks in the discussions for RBPS #4. Air Liquide believes that DHS does not consider other security implications of the strict vehicle parking restrictions found in Metric 3.3. BP Comments BP believes that DHS should clarify the Guidance with respect to the choice between Asset-Specific and Facility-Wide security measures. BP believes that DHS should describe the records that should be maintained as part of RBPS #18. BP believes that the suggestion in the Guidance to co-locate safety and security control systems in a command center is not always feasible. Edison Electric Institute and USWAG The Edison Electric Institute and the Utility Solid Waste Activities Group commend DHS on the development of a useful tool to help guide the development of appropriate security measures at a diverse set of facilities. GB Biosciences Corporation Comments GB Biosciences believes that the Guidance should include a discussion of the coordination with TSA for facilities that might also be hazmat shippers or receivers covered under the new Rail Transportation Security Regulations. GB Biosciences believes that it is not necessary to provide continuous escorts to personnel as implied in Metric 3.2. GB Biosciences believes that the discussion in Metric 4.5 requires the use of armed security personnel, which may be unsafe at many chemical facilities. GB Biosciences believes that the Guidance should discuss how current personnel surety procedures would interface with the requirements of RBPS #12. GB Biosciences would like DHS to clarify the role of Site Security Officer and explain if a safety professional can hold that position. The Aluminum Association Comments The Aluminum Association that the 4 Tier level associated with CFATS provides for too little differentiation between security levels required for facilities. The Aluminum Association recommends that the Guidance be submitted to an outside review by security experts. Payne Fence Products Comments Payne Fence Products believes that the discussion of perimeter barriers should be more robust and include discussion of fencing products other than chain link fences which are relatively easy to penetrate. Payne Fence Products believes that the discussion should include bullet-resistant barriers and anti-tunneling measures. Payne Fence Products believes that reliance on State Department K ratings for vehicle barriers is dated and should be replaced by references to ASTM F2656-07. Payne Fence Products objects to the inclusion of commercial sources of information and recommends that DHS use the American Fence Association web site instead. DCP Midstream LLC Comments DCP Midstream believes that DHS should explain how the department might utilize RBPS #19. DCP Midstream believes that Metric 4.5 requires the use of armed security personnel and DCP Midstream questions the safety of allowing firearms on facility property. The Fertilizer Institute Comments The Fertilizer Institute supports the provision of a Guidance document that does not establish legally enforceable requirements. Tectonic Engineering Comments Tectonic recommends that DHS include a discussion in the Guidance documents on how facilities can resolve disagreements about Site Security Plan provisions with DHS since DHS cannot prescribe solutions. Tectonic also recommends that the Guidance provides a list of acceptable Alternative Security Plans. Lubrizol Corporation Comments Lubrizol appreciates the efforts DHS made in crafting a Guidance document that assists facilities in crafting an acceptable Site Security Plan without specifying legally enforceable requirements. My Comments on Comments It amazes me the number of commenters that noted that some of the requirements were either too prescriptive or not prescriptive enough. With the number qualifiers, explanations and disclaimers that DHS has included in this document, there should be no doubt that DHS has no intention or even legal basis for requiring anyone to comply with anything in this document. That Air Liquide could argue both sides of the prescription argument in the same document is especially intriquing. The most consistent comment in these eleven submissions is the concern expressed about the apparent requirement for armed guards embodied in Metric 4.5. Ignoring for the moment my previous comment about the lack of legal specificity, these comments provide an important point for discussion; do some facilities need to reconsider their stand on armed guards. I have dealt with the issue of arming security guards in some detail in a series of blogs that I wrote back in June of this year. In particular I addressed weapons limitations and the potential for overcoming those limitations by using unconventional weapons. I urge anyone interested in this issue to read those blogs. Here I’ll just discuss the need for armed guards. First off, armed guards are not required in this RBPS Guidance document; nothing can be required by law. Even Metric 4.5, which concerns so many of the commenters, specifically mentions that either armed or unarmed guards may be used to fulfill the ‘requirements’ of this metric. So facilities can rest assured that DHS does not require armed guards. Now, having fulfilled the section 550 requirement, lets discuss reality. First off, not all facilities even need to consider armed guards. Facilities that only have theft/diversion COI only need to delay attackers long enough for local police to apprehend them before they get too far from the facility gate with their stolen chemicals. Armed guards are not required; just good communications and a police response plan. The highest risk facilities, those Tier 1, and possibly Tier 2, facilities, are going to have to take a good hard look at using armed security personnel. There is no other way that they are going to have any significant chance of stopping any half-way organized terrorist attack on their facility. There is no barrier system that cannot be overcome in minutes with a small explosive device. There is no other way to stop a team determined to enter the facility. The only other realistic alternative is to get rid of the Toxic (and possibly flammable) COI that makes the facility Tier 1. Remember, if you get a terrorist attack delayed and rely on the local police for your response force, they are going to arrived armed and trigger happy. They are not going to know the areas of the facility where the simple act of discharging a service revolver may ignite a firestorm. They are not going to pay attention to what is down range of their weapons on the other side of their terrorist target and will certainly puncture the worst possible storage tank with their stray bullets. At least with a trained security force under facility control there is a chance of avoiding the collateral damage; not a good chance, but a chance none the less. Finally, ask yourself if your facility were located in the Niger Delta, would you have armed guards patrolling the facility? If you doubt that your answer would be yes, then ask the security managers from Exxon or Shell facilities that have been attacked in those areas. They certainly have armed security forces protecting their facilities.