ISCD Top Screen Webinar

Yesterday the DHS Infrastructure Security Compliance Division (ISCD) held a meeting and webinar to preview their new Top Screen tool that will be coming out later this year. The new Top Screen tool is part of the ISCD effort to upgrade the tools used by facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) program.

Top Screen Demonstration

The webinar included a very detailed review of how the revised tool will work. Attendees were taken step-by-step through the Top Screen preparation process with a variety of chemicals of interest to allow us to see how it will be used in actual practice. It would be very helpful if ISCD included links to a demonstration like this on their Top Screen web-page when the new version of the Top Screen goes live.

The new version streamlines the data entry by ensuring that the questions that the submitter sees are the ones most likely to require responses for that facility. This is tied directly to the list of DHS chemicals of interest (COI) that form the core of the Top Screen submission requirement. When a COI is selected the tool populates a navigation menu on the left side of the screen with that COI and the security issues (release, theft diversion, sabotage, economic) of concern for that particular COI.

Clicking on a security issue for a particular COI will take you directly to the basic questions that would have to be answered for that issue and COI. Additional questions may be added to the list depending on the answers provided to the basic questions. When all of the questions for a COI/security issue are answered that will be reflected in the navigation menu.

The new tool makes use of a visual rendering of the facility based on satellite photography keyed to the latitude and longitude provided during facility registration. This is used to provide ISCD with the location of the areas of the facility with the largest concentrations of each of the listed COI. The tool allows the placement of the 170-ft circle described in the current version of the Top Screen so that it encompasses the storage locations.

RMP*Comp

I noted in an earlier post that recent changes to the EPA’s RMP*Comp tool may have been part of the reason for the development of the new Top Screen tool. That does not seem to be a major driving force, but the folks at ISCD did address the issue of past and future changes in the RMP*Comp tool by removing the requirement for facilities to use the tool to calculate the distance of concern for release toxic COI. The Top Screen tool will collect all of the information needed to make the calculation and ISCD will calculate that distance internally.

This change should directly address the concerns noted in last year’s GAO report on the discrepancies noted in the distance of concern information submitted by some facilities.

New Risk Assessment Model

As I noted in last Sunday’s post about this webinar, ISCD has completed work on the congressionally mandated updating of its risk analysis process. The new Top Screen tool reflects those changes, even if DHS is not yet ready to talk publicly about the details of the new model. They did move some questions from the Security Vulnerability Assessment forward to the Top Screen to make it easier to determine if a facility is to be considered at high-risk of terrorist attack and thus be covered under the CFATS program.

Gasoline Coverage in Top Screen

Last Sunday I also noted that the International Liquid Terminal Association (ITLA) had petitioned for gasoline storage facilities to be specifically exempted from the Top Screen submission requirement. This has not been done, but there have been some changes to the Top Screen questions related to flammable release COI that might alleviate some of the concerns expressed in that petition.

There seems to be more emphasis on the NFPA flammability rating of blends containing flammable release COI. Gasoline was never specifically listed as a COI, but many of the components of gasoline (Butane, pentane, etc) are listed and are found in concentrations above the 1% minimum. We won’t be able to tell for sure if the new Top Screen adequately (from the ITLA perspective) deals with the issue until Top Screens are submitted by fuel storage facilities and the results of the ISCD’s resulting risk determination are forwarded to these facilities.

Agriculture Exemption

The other Top Screen related issue that I mentioned on Sunday was the current exemption from Top Screen filing provided to agricultural production facilities. That does not appear to have been addressed in the revised Top Screen tool previewed yesterday.

Crude Oil Coverage

An interesting question was raised during the public question phase of the webinar yesterday. It came after a couple of questions about the mixture rule as it pertained to fuels. Someone (I did not catch the name) mentioned that the same things that make gasoline fall under the Top Screen (butane and pentane were specifically mentioned) could also apply to crude oil. And this is absolutely true.

It raises an interesting question about whether or not crude oil storage facilities have been completing Top Screens for their inventories of flammable gasses contained in the crude oil mixture. Now most crude oil would have a lower NFPA fire rating so that the blends would not typically be considered high risk under most risk analysis procedures. The large rail shipping facilities in the Bakken fields are typically isolated enough from surrounding communities that they would not likely be considered high-risk of terrorist attack by ISCD.

Having said that, the high gas content of some of the Bakken crudes that makes them more hazardous in shipment could also likely raise the NFPA rating of the mixture to an extent that would make them higher risk. That combined with the location of these large rail shipping yards next to main intercontinental rail lines may raise their risk of being a terrorist target to a high enough level that ISCD would cover them under the CFATS program.

Another crude oil related area of potential concern is the increasing number of facilities that separate out the flammable gasses from crude oil as a precursor to their shipment by rail. The storage of these flammable gasses as part of their separation process should result in a significant number of facilities have to have submitted Top Screens. It would be interesting to see how many of them have.

It is unlikely that most of these storage facilities have submitted Top Screens. This is just one more area that ISCD should look to reaching out to so that at the very least the appropriate data could be collected in order to make a real risk determination. Because of the impending changes in the risk determination model, ISCD may want to hold off until the new Top Screen tool is in place before requiring these facilities to complete Top Screens.

Another Updated CFATS FAQ

This afternoon the DHS Infrastructure Security Compliance Division (ISCD) updated another response to a frequently asked question (FAQ) on the CFATS Knowledge Center. This time the question (# 329) dealt with the EPA’s RMP*Comp on-line tool.

The revised response to that FAQ provides updated links to the EPA RMP*Comp web page and tool. Interestingly the link to the RMP*Comp tool on the bottom of the CFATS Knowledge Center is still the old link that I reported as bad back in December. [NOTE: As of 3:28 pm CST on 2-10-16 the link has been corrected] The bad link resulted from changes to the EPA web site.

BTW: ICSD reported today in a webinar that when the new version of the Top Screen comes out this fall it will no longer include a requirement to use the RMP*Comp tool. Information in the Top Screen submission will be used by ISCD to do the down-wind calculation for the spread of the toxic plume from a toxic COI release. I’ll have more on that new Top Screen webinar later. You can see my TWEETS® from that webinar using #TopScreen hashtag.

ISCD Updates Three CVI FAQ Responses

This afternoon the folks at the DHS Infrastructure Security Compliance Division (ISCD) updated the responses to three frequently asked questions (FAQ) on the CFATS Knowledge Center. There is no notice for these changes in the ‘Latest News’ section of the page, probably because there is no really new information involved in the updates. Links to two Chemical-terrorism Vulnerability Information (CVI) web sites have been updated though the old links still work (right now anyway).

There is also a dead link to the EPA RMP*Comp tool site on the CFATS Knowledge Center. And it appears that there may have been changes to that tool.

Revised FAQs

The three revised FAQs are:

FAQ #321 Where can I locate a copy of the CVI manual?

New Answer - The CVI manual (http://www.dhs.gov/publication/safeguarding-information-cvi-manual) regarding protection of information is available on the DHS website.

Previous Answer - The CVI manual (http://www.dhs.gov/xlibrary/assets/chemsec_cvi_proceduresmanual.pdf) (PDF, 59 pages -228 KB) regarding protection of information is available on the Chemical-terrorism Vulnerability Information website.

FAQ #516 Where can I take CVI training? 

New Answer - Go to the Chemical-terrorism Vulnerability Information (CVI) Authorized User Training website at csat.dhs.gov/cvi_training. [Actually goes to: https://csat.dhs.gov/dana/home/index.cgi]

Previous Answer - Go to the DHS Critical Infrastructure: Chemical Security website (http://www.dhs.gov/chemicalsecurity) and click on the link "Complete Chemical-terrorism Vulnerability Information (CVI) Training."

FAQ #1551 Can individuals who are not US Citizens be CVI Authorized Users?

New Answer - Yes, non-U.S. citizens can be CVI Authorized Users as long as they can complete CVI Authorized User Training. To access CVI Authorized User Training, go to csat.dhs.gov/cvi_training. [Actually goes to: https://csat.dhs.gov/dana/home/index.cgi]

Previous Answer – Yes.

RMP*Comp Problems

The link to the EPA’s RMP*Comp has been changed by the EPA yet again and the link provided on the Knowledge Center does not lead to that changed site. This is the second time (see post here) that there has been a change to the EPA’s web site that was not ‘coordinated’ with the folks at ISCD. The EPA does not date their web page changes so there is no telling when it was changed. The last time that I accessed the site via the link on the CFATS Knowledge Center was for a post back in August.

Actually, I think that the EPA may have changed the RMP*Comp calculations themselves. In my August post I compared the RMP*Comp results to the new Pamphlet 74 from the Chlorine Institute. I don’t remember having to enter the information on the dike protecting the leaking tank. In any case a 150 lb spill of chlorine now produces a toxic end-point of 0.4 miles or 2112 feet. The same spill checked in August showed that the toxic end-point was 4224 feet or twice as far. This may only affect chlorine (see my August post).

Facilities with Release – Toxic COI may want re-run their toxic end-point calculations and compare them to their latest Top Screen submission. If there is a significant difference, I would contact the CFATS Help Desk to see if it is worthwhile submitting a new Top Screen.

New GAO Report on CFATS Program

Last Friday the Government Accountability Office (GAO) published their latest report on the Chemical Facility Anti-Terrorism Standards (CFATS) program. While the report did identify some areas where the DHS Infrastructure Security Compliance Division (ISCD) needed to improve the CFATS program it generally noted that significant improvements had been made and previously identified problems had generally been corrected.

The GAO Report identifies four areas of concern:

∙ DHS has not taken steps to mitigate errors in some facility-reported data;

∙ DHS does not have reasonable assurance that it has identified all of the nation’s highest-risk chemical facilities;

∙ DHS cannot ensure consistency in how it addresses noncompliance in the CFATS program because it does not have documented processes and procedures; and

∙ DHS’s CFATS performance measure does not reflect security measures that facilities have implemented and that ISCD has verified.

Top Screen Data Reporting

The GAO identifies a problem with the reporting of Distance of Concern DOC for the release of toxic chemicals in the Top Screen. The CFATS Top Screen requires the facility to calculate the down wind distance that a worse case discharge of a toxic release chemical of interest (COI) will cause a significant problem. The tool that facilities are required to use is the EPA’s RMP*Comp.

The user inputs the maximum amount of a Toxic COI that they have on site, enters some other basic information (see pages 42 and 43 of the Top Screen User’s Manual) and the tool calculates DOC which is then reported in the Top Screen. DHS then uses this information as part of its determination of whether or not a facility may be covered under the CFATS program as a facility at high-risk of terrorist attack.

The GAO used available Top Screen data to verify the DOC reported for a ‘a generalizable sample of facilities’. Using that data the GAO report indicates that 44% of the facilities (2,700 facilities) had errors in the reported DOC and about 43% under-reported the DOC. It goes on to note that a common potential reason for the under-reporting may be due to one difference in the way the tool is used to calculate EPA and CFATS DOC information, the CFATS program does not allow facilities to take credit for passive mitigation measures such as dikes around tank farms.

The Report provides an example of a facility with more than 200,000 lbs of anhydrous ammonia  (AA) reported in its Top Screen that reported a DOC of 0.9 miles and GAO found a minimum possible distance of 2.4 miles when they calculated the DOC using R*Comp. I have replicated that work and found that there was no way to come up with a DOC of 0.9 miles regardless of whether or not mitigation measures were used. I suspect that the facility used their largest storage tank data (as they would for EPA reporting) instead of the total amount of AA on site as required by DHS. It is remotely possible that GAO’s figure of 0.9 miles came from the DOC value reported for the Area of Highest Quantity (AHQ) instead of the total COI.

The GAO report notes that ISCD has all of the information in its Top Screen Database necessary to verify the DOC data, but does not choose to do so. The first part is not necessarily true. The RMP*Comp tool, when calculating the DOC for materials that are gasses at 25°C, asks if the material is liquefied, and if liquefied whether it is liquefied by refrigeration or by pressure. That information is not included in the Top Screen and makes a big difference in the DOC. This is not important for most toxic release COI, but it is for AA. Using the Report’s example with AA you could get DOC’s of 2.4 miles (unliquified) 6.5 miles (liquefied under refrigeration) vs 8.0 miles for liquefied by pressure (all in an urban setting).

The thing that the GAO failed to take into account in pointing out this deficiency is that ISCD does not verify any of the information provided in the Top Screen. It is true that they could generally check the DOC value (using the ‘unliquified’ data from RMP*Comp), but that might not give a true picture for all COI. But given the fact that ISCD is accepting all other reported information, it would be unusual for them to pick out this one item that could be partially verified in a portion of the instances where it is reported.

Given the fact that the Report notes that only 43% of the discrepancies that it noted were under-reports, it seems to me that their data would tend to indicate that there were systemic problems with the use of the RMP*Comp tool. As ISCD moves forward with implementing the results of the outside evaluation of their risk ranking methodology, they should consider taking this calculation out of the hands of the facility and do the calculations in-house.

The GAO has two recommendations for this area:

∙ Provide milestone dates and a timeline for implementation of the new Top-Screen and ensure that changes to this Top-Screen mitigate errors in the Distance of Concern submitted by facilities, and

∙ In the interim, identify potentially miscategorized facilities with the potential to cause the greatest harm and verify the Distance of Concern these facilities report is accurate.

Facility Identification

The report outlines the measures that DHS has taken to identify facilities that have not submitted Top Screens, but should have done so. While they had conducted earlier out-reach activities, the effort was expanded after the West Fertilizer incident and the issuance of the President’s Executive Order on Increasing Chemical Facility Safety and Security. As a result of these latest efforts just over 3,000 potentially non-compliant facilities were identified and contacted by DHS.

More than 1500 had already submitted Top Screens; the ‘new’ identification was apparently based on differing naming or location information. Over three hundred were exempted from CFATS regulations. Of the remaining just over 1,000 have now submitted Top Screens and just 24 of those have been designated as high-risk facilities covered under the CFATS program with 44 still pending. ISCD is continuing to investigate other means of identifying potentially non-compliant facilities.

The report indicates an interesting problem. ISCD has asked States for information on the chemical facilities that they regulate as part of this program. California recently complied, identifying over 46,000 facilities (ISCD has only processed 50,000 Top Screens since the program started) which ISCD is now going through. Only 13 other States have supplied similar lists.

The GPO did not provide any recommendations for DHS on this issue.

Compliance Inspection Issues

The Report starts of the discussion of this issue with a review of actions that ISCD has taken to increase their rate of site security plan approvals and notes that ISCD has made substantial improvements in that approval rate. Interestingly, even though the GAO calculated that ISCD would have the approval backlog eliminated next year, they did not mention that the EAP process will almost certainly further accelerate the SSP approval process.

The Report then notes that ISCD has completed 83 compliance inspections of facilities with approved site security plans. There is no discussion of how well that reflects the requirement for ISCD to inspect facilities within one year of their site security plan being approved. The number seems low, but it will almost certainly increase as ISCD has fewer authorization inspections to complete.

The GAO reports that nearly half of the facilities inspected have not completely implemented all of the security measures outlined in their site security plans, which of course means that the facilities are out of compliance. The Report notes that ISCD is working with the facilities to get them into compliance.

The GAO notes that none of the non-compliance sanctions available to the Department (including Compliance Orders, Civil fines and even Cease Operations Orders) have been used by the Department to-date. While ISCD is ‘working with’ the facilities, the GAO reports that they do not have any written processes or procedures in place to document the progress that is being made at those facilities. Nor, apparently, does ISCD have any written processes or procedures in place on how they determine whether or not a facility is in compliance.

The GAO had one recommendation for this area:

∙ Develop documented processes and procedures to track noncompliant facilities and ensure they implement planned measures as outlined in their approved site security plans.

CFATS Performance

The last area of concern identified in the Report concerns the program reporting done by ISCD to DHS. This annual reporting requirement is used by DHS and the GAO to assess program performance and efficacy. One of the pieces of information included in that report is the number of security measures implemented by facilities. The GAO notes that ISCD does not distinguish between those measures implemented before the facility site security plans were approved, which measures have been reported as planned, or which of the planned measures have been implemented. Thus, the GAO reports that the numbers do not reflect changes brought about by the CFATS program and ISCD actions in support of that program.

The GAO had one recommendation for this area:

∙ Improve the measurement and reporting of the CFATS program performance by developing a performance measure that includes only planned measures that have been implemented and verified.

Moving Forward

DHS has acknowledged the four recommendations in the GAO report and has reported their intended actions to be taken in response to those recommendations. GAO confirms that if those actions are taken as reported, the recommendations would be considered as completed.

ISCD Updates CFATS Knowledge Center – 04-23-14

Today the DHS Infrastructure Security Compliance Division (ISCD) made a minor revision to one of the frequently asked questions (FAQ) on the CFATS Knowledge Center. The change was so small that there was no mention of the revision in the ‘Latest News’ section of the page.

FAQ #329 (originally published in May of 2009 and revised last in June 2012) had a typographical error in the actual question. It used to read:

What is the Environmental Protection AgencyÂ’s (EPA) RMP*Comp?

It now reads:

What is the Environmental Protection Agency's (EPA) RMP*Comp?

This is certainly a very minor error correction, but it was an error nonetheless and ISCD is to be commended for their diligence. To be fair to ISCD I did not report (nor probably notice) the typo when I reported on the FAQ changes made that day, but my records show that it was certainly there.

ISCD Updates Publications on the CFATS Knowledge Center

Yesterday (coincidentally the first day of the Chemical Sector Security Summit) the folks at ISCD updated some CFATS related publications on the CFATS Knowledge Center web page. Actually they revised an SSP tip sheet that had been removed early this spring, updated their Colleges & Universities pamphlet and added a pamphlet for Emergency Responders.

Brochures

The Latest News section of the page notes that:

“The CFATS Trifold, CFATS Colleges and Universities, and CFATS for Emergency Responders brochures have been updated to reflect the updated CFATS Help Desk e-mail address, CSAT@hq.dhs.gov, and to correct minor grammatical inconsistencies.”

The colleges and universities brochure has been around for a while. The changes to the new version are not really important other than providing a better presentation of the CFATS program. After all good grammar is seen as a sign of intelligence in these communities.

I don’t recall seeing the emergency response brochure before. It is a little bit too simple in the way it deals with CVI and emergency responders. It would be helpful if it was clearer that CVI access would be needed for emergency response planning but not for actually responding to an emergency at a CFATS facility. Oh well, it is only a small brochure, not an instruction manual.

SSP Tips

Back in 2010 the folks at ISCD put together a rather detailed booklet providing some tips for completing the facility site security plan submission. This was done because it was obvious that all of the SSP submissions that they had received to date had been way less than adequate. That booklet was withdrawn from the Knowledge Center this spring when ISCD decided to revamp their SSP authorization program.

This new SSP tips booklet is much smaller (two pages instead of five), but smaller is not necessarily bad. The focus of the new booklet is different than the original and we have to assume that this reflects a change in the way that ISCD is looking at the SSP process.

There is one specific section of the new booklet that I am really happy to see included. It reminds personnel that the existing safety and environmental protections and controls in place can be a valuable part of the site security plan.

EPA RMP*COMP Link Problem

The link to the EPA’s RMP*COMP tool on the bottom of the CFATS Knowledge Center is still a dead link. I pointed this out back in June when ISCD updated the link to that tool in FAQ #329. There really isn’t any point in having a dead link on the main page, but there it is. The good link is: http://www.epa.gov/osweroe1/content/rmp/rmp_comp.htm.

NOTE: As of 2:00 pm EDT 8-2-12 the RMP*COMP link has been fixed.

DHS CSAT FAQ Page Update – 07-10-09

This last week DHS updated five questions on their extensive CSAT FAQ web page. Actually they added three questions/answers and reviewed/updated another two. The five questions were (the last three are new): 1392: When would I have the ability to transfer my account or reassign my user role? 1472: How do I fix a typo in the user registration information I submitted? 1641: In RMP*Comp, what value do I use for the Quantity Released? 1642: I am already a CVI Authorized User. Do I need to take the CVI training again to maintain my CVI Authorized User status? 1643: How will DHS protect the data it collects? Changing Registration Information Two of the questions deal with changing user registration information; transferring accounts or changing information. The procedure is fairly straight forward when one is transferring user roles to someone else in the organization that is already registered. It becomes slightly more complicated when someone new is added because it requires the authorizer to sign and mail in a new registration document. Changing information is more difficult because of the need to make sure that only appropriate people are making changes. Chemical-Terrorism Vulnerability Information The two questions dealing CVI do not provide new information, but should probably be read by everyone involved in the CFATS process at high-risk chemical facilities. The first one deals with why old-authorized users (people who completed CVI training before October of last year) should go back and re-do their training. The second provides a decent overview of how DHS is required to treat CVI. RMP*Comp The question on the use of the EPA tool, RMP*Comp, explains that the Preparer should use the Total Onsite Quantity of toxic release COI as the ‘release quantity’ in this tool. Non-CFATS users of this tool typically use the amount in the largest storage tank for the EPA ‘worst case scenario’ calculation of the potential exposure area. DHS uses the total quantity because it must be expected that a ‘successful’ terrorist attack would target all storage containers for a nearly simultaneous release whereas an accidental release would be unlikely to affect all storage containers.