Reader Question – Backstory on CSB Problems

I got involved in a brief discussion over on LinkedIn about a chemical incident and OSHA inspectors responding to it. I made the comment that the CSB was underfunded and understaffed and I was asked to explain the backstory of that underfunding.

Current Spending

The currently proposed spending bill that includes the United States Chemical Safety and Hazard Investigation Board (commonly known as the Chemical Safety Board, or CSB) is HR 8262. To find the CSB’s spending you have to go to the Committee Report for that bill. There on page 132, you can see that for FY 2023, the House Appropriations Committee suggests that the CSB should be funded at $14.1 million, a cool million above FY 2022’s funding.

Now I would love for someone to stick $14.1 million into my checking account, but that is not much money for a federal agency charged with investigating deadly and costly chemical facility accidents. For comparison the NTSB, the federal agency that investigates transportation accidents, is due to receive $129.3 million (H Rept 117-402, pg 176) in the THUD spending bill; that is $7.9 million more than for FY 2022.

It is hard to compare two agencies like the NTSB and CSB, and I am not suggesting that the two agencies should receive the same amount of spending, but an order of magnitude difference is uncomfortable to say the least.

The Backstory

The CSB was originally intended to be the NTSB of chemical incidents. It would serve as a non-regulatory agency that would investigate chemical facility incidents and publish reports that would allow others in the industry to learn the hard lessons of chemical safety based upon the pain of others. Like the NTSB, the CSB would prepare recommendations to industry and government agencies on how to prevent similar accidents from happening.

To date the CSB has published 861 recommendations based on their investigations with all but 87 of those having been adopted by the targeted organization. Looking back at the earliest of those outstanding recommendations we can get a look at why the CSB has problems with funding.

Outstanding Recommendations

The CSB website list sixteen recommendations as outstanding from before December 2012. Of those, 8 target OSHA, and one targets the EPA. Those recommendations include:

Updating OSHA RAGAGEP standards to meet industry standards,

Updating OSHA hazard communications standards to include static accumulation hazards,

Updating OSHA PSM standards to include management of organizational change,

Creating OSHA standard to prevent combustible dust fires and explosions,

Including metal dusts in recommended OSHA combustible dust standard,

Revising EPA accidental release rules to include reactive chemical hazard,

Revising OSHA PSM standards to include reactive chemical hazards,

Expanding OSHA PSM standards to include atmospheric storage tanks connected to process with flammable liquids,

Publishing OSHA safety and health bulletin on using flammable liquids in confined spaces.

Those nine recommendations are representative of a large portion of the 87 outstanding recommendations. The regulatory changes (very necessary in my opinion) being recommended will be very costly to industry. Most of them will require legislative action to provide OSHA and EPA clearcut authority to take the regulatory action.

Other Problems

Since about 2012 the Board has had internal political problems with conflicts between Board Members and with the staff. A large part of these problem has been driven by the political appointees trying to reflect the regulatory bias of the president that appointed them. This culminated in 2016 when President Trump tried to defund the Board in two successive budget requests. The five-member board has not been filled since before 2018 when Lemos was appointed by Trump to head the Board. She was the sole board member when Biden took office in 2020. When she leaves later this month there will be just two board members. All of this has had a detrimental effect on staff retention and staff morale.

Currently, the CSB has a long backlog of uncompleted investigations. There are 18 current investigations, dating back to 2016 and the CSB has not initiated a new investigation since July 27^th of last year. In May, the Board was supposed to hold a public meeting looking at the Loy Lang investigation. Typically, this is the last step before a Board investigation report is published. This meeting was cancelled days before it was scheduled. No reason was given, but I suspect that the two new Biden Board Members were not going to support the recommendations that had been developed under the Lemos leadership.

With all of these problems, it is not hard to understand why Congress has not been willing to fund an active and efficient CSB. Biden has a chance to affect the Board for years to come with his nomination of a replacement for Lemos and the two open Board seats. It would be very helpful if he were to nominate someone with strong organizational skills and an established (and well recognized) expertise in chemical process safety.

CFATS and Gun Shot Detection Systems

I got an interesting question from a reader yesterday. I whipped out a quick reply that I still standby, but I thought that it might need some additional discussion.

Question and Response

The original question was:

“Is there a requirement for chemical plants to have gunshot detection/notification? Esp after Metcalf incident, I would think.”

My initial reply was:

“The CFATS program certainly does not include such a requirement. I would not think that this would be cost effective for most manned facilities unless they were in a high crime area.”

CFATS Requirement?

First off, there are very few ‘security requirements’ under the Chemical Facility Anti-Terrorism Standards (CFATS) program. The program was crafted with the idea that each facility is unique and would have to design their security program to fit their unique character while fulfilling 12 operationally defined ‘Risk-Based Performance Standards’ (RBPS). Those standards are outlined at 6 CFR 27.230(a) and discussed in more depth in the RBPS Guidance Document. There is no specific mention of ‘gun shot detection systems’ in either document, thus there is no ‘CFATS requirement’ to employ such a system.

The RBPS Guidance Document does make two important points about detection systems. First:

“For a protective system to prevail, detection needs to occur prior to an attack (i.e., in the attack planning stages) or early enough in the attack where there is sufficient delay between the point of detection and the successful conclusion of the attack for the arrival of adequate response forces to thwart the attempt.” [pg 50]

And second:

“Typically, when a sensor or other IDS [intrusion detection system] component identifies an event of interest, an alarm notifies security, which then will assess the event either directly by sending persons to the location of the event or remotely by alerting personnel to evaluate sensor inputs and surveillance imagery.” [pg 52]

Interior and Exterior Shots Fired

There are two general scenarios where a gunshot detection system might be of use for a CFATS covered facility; shots fired inside the facility and shots fired outside the facility (okay, I guess there are no other scenarios).

For shots fired within the facility, it is, by definition, too late to prevent the attack. Information from a shot finder could provide information to response personnel to help pin down the location of the shooter. That will be problematic for most chemical facilities that do not have armed guards (the vast majority of chemical facilities in the United States). Detailed prior coordination with local law enforcement personnel (lacking at most chemical facilities) would be required to ensure that responding officers knew about the shot detection capabilities and had timely access to the location information when (and after) they arrived on scene.

The problem for shots fired outside of the facility would be determining if the impact area or trajectory of the projectiles was inside of the facility. For incidents where there is no facility impact, the ability to determine that would be helpful to frame interior incident response (do not panic, they are shooting at someone else). For shots targeted at the facility (with malice aforethought or inadvertently), the location of the impact point could have beneficial input into the emergency response within the facility.

Unfortunately, most shot detection systems do not track trajectory or impacts (okay, I do not know of ANY that do, but I am not current on the technology so someone may have addressed this issue). Setting up a system to predict impacts or trajectory would require at least two different detection systems; one to detect the initial gun shot location and one to detect the projectile in flight at at least one position. The second portion of that problem would require multiple sensors around the perimeter of the facility to detect boundary penetration.

The Metcalf Scenario

The original question specifically mentioned the Metcalf situation; the April 16^th, 2013 sniper attack on the unmanned Metcalf Transmission Substation. The sniper was firing at transformers with the apparent intent (this incident is still ‘unsolved’) of causing equipment failure through a loss-of-coolant incident.

A shot detection system at this facility would not have prevented the attack, but it may have provided timely enough notification to have allowed police to have apprehended the perpetrator. Unfortunately, this presumes a timely response to a ‘shots fired’ report without any indication of an antipersonnel attack.

There are few ‘unmanned’ chemical facilities, but many facilities are not manned 24/7 so this scenario could apply to such facilities. Again, the big problem is not being able to determine what the target of the shooting is when the shot detection system goes off. This is a big problem in rural areas where the shots may be from legitimate hunters.

Alternatives

If a facility is concerned with protecting critical infrastructure from gunshot attacks (and storage tanks quickly come to mind in this regards) it is probably more effective to provide some sort of ballistic protection in the form of either intermediate barriers or bullet-proof coatings (ballistic plate or fabrics) for high-risk equipment. Even if gunshot detection is employed, such protection would still be necessary if there is a high-risk for a ballistic attack; gunshot detectors (shot location or impact location) only provide for response, they DO NOT prevent damage.

Conclusion

In short, I stand behind my earlier conclusion that these systems are not required for CFATS facilities and I doubt that they would be cost effective if employed. If systems are available (at a ‘reasonable’ cost) for predicting impact locations for shots fired, and a facility is in an area where there are frequently shots fired, it might be worthwhile to employ such a system to alert internal response personnel for inadvertent bullet impacts on site.

Reader Question - Material Modifications

I had an interesting question sent to me by a long time reader of this blog concerning the term ‘material modifications’ as it is used in 6 CFR 27.210(d). That Chemical Facility Anti-Terrorism Standards (CFATS) requirement states that: “If a covered facility makes material modifications to its operations or site, the covered facility must complete and submit a revised Top-Screen to the Department within 60 days of the material modification.” The reader asks if the term ‘material modifications’ is defined in the CFR.

No Definition

The short answer is no. This is one of many definitions missing from the CFATS rule. In this case, I suspect that the reason is that there is no specific definition that would fit the situation. The issue was discussed, however, in the preamble to the interim final rule that established the CFATS program. We can see that discussion in response to a specific public request for a definition of the term:

“Material modifications can include a whole host of changes, and for that reason, the Department cannot provide an exhaustive list of material modifications. In general, though, DHS expects that material modifications would likely include changes at a facility to chemical holdings (including the presence of a new chemical, increased amount of an existing chemical, or the modified use of a given chemical) or to site physical configuration, which may (1) substantially increase the level of consequence should a terrorist attack or incident occur; (2) substantially increase a facility’s vulnerabilities from those identified in the facility’s Security Vulnerability Assessment; (3) substantially effect the information already provided in the facility’s Top-Screen submission; or (4) substantially effect the measures contained in the facility’s Site Security Plan.”

Change in Chemical Holdings

The most obvious change in chemical holdings that would be considered a material modification would be the introduction of a new DHS chemical of interest (COI) found in Appendix A to 6 CFR 27. Even if the new COI were not held at a screening threshold quantity (STQ) the addition could still qualify as a material modification if the addition met one of the four standards listed in the preamble discussion.

An inventory increase in one or more of the existing COI reported on the most recent Top Screen could also be considered a material modification that triggers a new Top Screen submission requirement. How much of an increase would be a trigger the requirement would depend on the chemical in question. A one pound increase in propane (Release – Flammable) would almost certainly not be a trigger while a one pound increase in Chlorosarin (Theft - CW) would almost certainly trigger the requirement. Again, the four standards would provide guidance on how much is significant.

The addition of non-COI chemicals to facility chemical holdings is even more complicated. The addition of a new flammable liquid in sizeable quantities could increase the size of a potential conflagration at a facility holding flammable-release COI. The addition of another potential (but unlisted) precursor to a chemical weapon could make it easier for a terrorist to manufacture that chemical weapon as a result of a successful attack on the facility. Once again, the four standards are what establishes the existence of a material modification.

Facility Configuration

Changes to the physical structure or operation of a CFATS covered facility could certainly be considered a material modification. Which changes would trigger the new Top Screen reporting requirements would depend on the facility and the COI holdings at that facility.

At a facility with holdings of theft-diversion COI anything that increases the traffic through the facility would almost certainly be considered a material modification. This could include construction activities, changes in the number of contractors on site, or even changes in the number of pick-ups and deliveries at the site. Again, the four standards listed in the preamble will determine which changes trigger the reporting requirement.

Decreased Risk

Facilities also need to remember that the material modification requirement is not limited to changes that increase the risk of terrorist attack at the facility. Changes that decrease risk can also trigger the reporting requirement. The folks at the Infrastructure Security Compliance Division (ISCD) are certainly not going to fine a facility for failing to report changes that reduce risk, but ISCD could lower the facility Tier ranking or even remove a facility from CFATS coverage when material modifications produce significant reductions in the risk of terrorist attack.

Always Consider Material Modification

Just about any change at a facility could have an effect on the security of the facility. CFATS covered facilities have a legal obligation to take a specific look at any changes in facility structure, operation or chemical holdings. This should be a part of the standard management of change process at the facility. Facility management needs to consider the chance that any changes made to the facility may trigger additional security requirements (and the associated costs) if the changes:

• Substantially increase the level of consequence should a terrorist attack or incident occur;

• Substantially increase a facility’s vulnerabilities from those identified in the facility’s Security Vulnerability Assessment;

• Substantially effect the information already provided in the facility’s Top-Screen submission; or

• Substantially effect the measures contained in the facility’s Site Security Plan.

If there are questions about a pending change the simplest thing to do is to ask DHS if they think that a change would be considered a material modification at the facility. For major (read costly) changes at a facility, the earlier the question is asked the better. Remember, the cost of any necessary security changes should be included in estimating costs for any facility modification.

HSAS Elimination and CFATS

Sometime this month the Department of Homeland Security is expected to formally eliminate the Homeland Security Advisory System, the color coded system that was supposed to keep the public updated on the current state of the threat of terrorist attack. I received a reader email yesterday asking the following interesting questions:

“Can you advise very briefly as to how are CFATS Site Security Plan holders revising their SSP security posture change process with the elimination of the DHS HSAS? How or to what are they tying the security level changes too with the termination of that system?”

HSAS and SSP

RBPS 13 in the CFATS process requires facilities to plan for ‘security measures and considerations for elevated threats. The RBPS Guidance document explains:

“The “Elevated Threats” RBPS addresses the need to escalate the level of protective measures for periods of elevated threat designated by DHS. The purpose of the RBPS is to enhance facility and operational security, while reducing the likelihood of a successful attack, through the implementation of scalable security measures and actions in response to changes in the Homeland Security Advisory System (HSAS) threat levels [emphasis added]. The simplest way for a facility to meet the standards sought by RBPS 13 is to have a set of documented and implementable security procedures that provide for a change in the facility’s security posture based on an elevated HSAS threat level. Properly responding to and implementing appropriate security measures in response to different threat levels significantly improves a facility’s capability to “Deter, Detect, and Delay” a threat (see RBPS 4), greatly reducing the likelihood of a successful attack during a period of elevated threat.” (page 101)

The Guidance document goes on to explain that DHS uses a variety of methods of identifying elevated threats including the HSAS, DHS Threat Advisories and DHS Information Bulletins. Having the alternatives, the main part of the discussion in RBPS, as well as the RBPS Metrics clearly tie the expected response to the RBPS to the HSAS. This entire section of the Guidance document will essentially be useless when DHS eliminates the HSAS later this month.

What ever the deficiencies in the HSAS system (and there are many) it did provide something to which a facility could tie their changes in security response. The SSP could be designed for the base condition and enhanced procedures could be defined for each increase in the reported threat level.

No Anchor for Enhanced Security

While the details of the new threat communication system have yet to be published, Secretary Napolitano has made clear that it will be more detail oriented, targeting specific industries or communities that are under an identified increased threat of terrorist attack. The intention is to make the information clear enough and specific enough so that only those people clearly at risk need to respond and may respond in a cost effective manner.

This certainly seems to make sense. There should be no need for most people to worry about most clearly identified threats. And entities under a specifically identified threat probably do not need to take a generic action, but need to formulate a specific, targeted response.

The problem is that security planning and execution take time. The current HSAS allows facilities to identify in advance generic increases in security that would be necessary and make the necessary advanced coordination that would allow for the prompt execution of those measures. When a specific threat is identified further security measures can be developed based upon previously identified measures.

Without the generic threat advisory to which facilities can tie their generic responses, the facility will have to start their security planning from the base case each time a target threat advisory is provided by DHS. Or will they? While the details will depend on the specifics the new DHS alert system, there is a way to address the enhanced threat issue.

Enhanced Security Planning

First we have to assume that the DHS alerts will, in some form, come in both generic and specific forms. The generic forms will still be more targeted than the current HSAS but will apply an area or industry rather a specific facility and will not include much in the way of specifics about expected attack modes. Specific alerts might still address a number of facilities, based upon either area or industry, but would provide more details on the expected form of attack. The most targeted warnings would provide an unusual level of warning about a specific facility.

Now the question becomes, how does a facility provide for these types of alerts in its site security plan? I think the simplest way to do this is to go back to the SVA and look at which terrorist attack scenarios were determined to apply to the facility. Then for each of those scenarios there would be three levels of increased threat that would need to be addressed:

● DHS notification of increased threat to region;

● DHS notification of increased threat to industry; and

● DHS notification of increased threat specifically to facility.

This would give the facility the type of specificity in its threat response that DHS is attempting to achieve with its revised alert system. This should also allow most facilities to reduce their security costs as they should be spending less time in an enhanced security mode.

ISCD Re-write of RBPS Guidance Needed

At least, if I were in charge (and I am certainly not), that is the way that I would organize things. This is an area that ISCD needs to address quickly. Unfortunately, I would suspect that their current focus is more on the completion of SSP pre-authorization and authorization inspections. I would bet that no-one has even considered re-writing the RBPS 13 section of the Guidance document in preparation for the elimination of the HSAS.

That is not a criticism of ISCD, they do have higher priority problems that need to be addressed. Unfortunately, that doesn’t provide much help to people like my reader who need to complete their SSP development or update their SSP submission for the change in circumstances. Fortunately, there are not that many (are there any yet) facilities that have an actual, approved SSP to update (that was a sarcastic criticism).

Reader Question – Water Facilities and IST

Yesterday Corinne, a new reader with a background in water facility security, left the following question on my blog post on HR 908 and HR 916:

“Do you think that the Water Sector or IST could be added back into any of these bills? I know it was a big item last year.”

Both of these controversial issues were important in chemical security legislation during the last session and are still being heavily pushed by environmental activist groups like Greenpeace and are supported by the Obama Administration. The short answer is that , because of the change in leadership in the House, neither will likely to be fully implemented in final legislation.

IST Provisions

In politics the simple answer is seldom really important and inherently safer technology is a good illustration of that point. First off, no one disagrees with the basic IST premise that both safety and security at a facility may be increased by simply modifying the use of highly dangerous chemicals like chlorine or anhydrous ammonia. This universal recognition is exemplified by the fact that Sen. Collins’, whose opposition to IST mandates is well known, included an IST provision in her CFATS extension bill, S 473. That provision (§2104) provides technical assistance when requested by a covered facility in evaluating and implementing facility and process changes that would reduce the risk at the facility.

Republican opposition to IST mandates has stymied passage of ‘comprehensive chemical security legislation’ since probably as early as 2003. This year, with the Republicans fully in charge of the House will make it virtually impossible for any bill with an IST mandate from being passed in that body. While the Democrats nominally control the Senate, there are not enough votes to close debate on any IST mandate amendments to a CFATS bill.

That does not necessarily mean the effective end of IST debate. A properly drafted IST provision could make its way into an approved CFATS reauthorization bill. I think that a narrowly crafted reporting requirement for Tier 1 facilities with release toxic chemicals of interest could be approved in the Senate; it would be more problematic in the House.

What many opponents have failed to realize is that their refusal to discuss IST provisions is that they have made it possible for companies to transfer the risk at their facility to other communities. Such techniques as increasing the number of hazardous material shipments to lower inventories would allow facilities to drop out of coverage under the CFATS program while increasing the risk of release during transit.

Water Facility CFATS Coverage

To date, the public opposition to the removal of the CFATS exemption for water treatment and waste water treatment facilities has been intimately tied to the opposition to IST mandates in the legislation. The argument has long been made that ‘disinfection decisions’ should be made at the local level not the Federal or State level. Removal of IST provisions from the equation, does not necessarily remove the objections of the water treatment community to being included in the CFATS program.

The current EPA security rules do not specifically address the security of high-risk chemicals, including potentially chlorine gas, anhydrous ammonia and sulfur dioxide, used at many of those facilities. Actually they don’t require much in the way of any kind of security. The EPA rules simply require the completion of a vulnerability assessment and the development of an emergency response plan; neither of which is required to be approved by EPA.

To be fair, most of the highest risk facilities (those with multiple railcars of TIH chemicals on-site) do have security measures in place, but there has been no outside evaluation of the adequacy of those measures. Coverage of these facilities in the CFATS programs will inevitably result in increased security costs so there is unlikely to be whole hearted support by the water processing industry for CFATS coverage.

To date there has been no indication that anyone is going to re-address the issue of CFATS coverage for water treatment facilities. Again the Obama administration has pushed for the removal of this exemption, but that has been intimately tied to IST provisions that would address the use of chlorine gas. Without those provisions included in the legislation, there does not seem to be much of a push to address the issue. Of course, the level of opposition to such a provision would also be reduced. If someone were to take the initiative and add a provision removing the CFATS exemption for water facilities, there would certainly be some opposition from that industry, but it might not be enough to derail the legislation.

Political Crystal Ball

A political crystal ball is necessarily murky and as difficult to interpret as a Greek Oracle, but I don’t really expect to see significant IST language in any CFATS bill that would pass this year beyond that that is included in Sen. Collins’ bill. Without an IST mandate, it is unlikely that someone will spend the political capital necessary to remove the water facility exception in CFATS.

CAVEAT: All of the above discussion goes out the window in the event of an attack or serious plot for an attack on a high-risk chemical facility.

Reader Question – Vehicle Inspections

I just received an interesting email from a reader with an important question. He writes that his chemical facility does security inspections of inbound vehicles and tractor-trailers. He wants to know if anyone knows of a training program (preferably in or near the Houston, TX area) that teaches security personnel how to conduct such an inspection.

Please post replies as comments on this blog post.

Reader Comment – 11-15-09 Water Tiering

An anonymous engineer from New Zealand had a question about the potential tier ranking of a water treatment facility that he is working on the design for. He posted the question to one my blogs about HR 3258. Its an interesting question and one that will have to be asked in a lot of facility design operations. So let’s take a stab at giving some sort of answer. Disclaimers We need to start this theoretical discussion with lots of disclaimers. First off, DHS (and likely EPA will follow suit) has been very reluctant to talk about the methodology it uses to rank the security risk for chemical facilities. Without filing an actual Top Screen for the facility, your not going to get a firm answer from anyone. I’m not sure that DHS has developed an internal procedure for dealing with facilities in development. More importantly for water facilities there will be additional complicating factors. First, HR 2868 has not yet been signed into law so numbers of changes can still be made to that legislation. Next EPA will have two years to write their regulations implementing the law. As currently written the EPA is required to ‘consult with’ DHS in establishing their chemical security rules, but that leaves a lot of leeway. Finally, since our NZ Engineer specifically asked about Tier 1 and 2 rankings, I’m going to guess that he was concerned about IST complications. Since that decision, as the bill is currently written, will be made by State agencies, that will be tougher still. I would bet that states like California and New Jersey may be more likely to require IST implementation, but that is a somewhat educated guess, not a prediction. Disinfectant Decisions One of the first decisions that must be made for a water treatment facility is the determination of the disinfection technique that will be used at the facility. I am not qualified to weigh in on the actual decision, but I can offer this; do a detailed assessment of all of the alternatives and do a formal documentation of that assessment. That assessment will form an invaluable starting point for future assessments, Remember to include the costs of security and safety in the assessment. All drinking Water facilities that serve more than 3300 will come under the new federal security rules regardless of what chemicals they use for disinfection. This means that some of the security costs will be there regardless of the chemicals used. Chlorine Gas To get an idea of the tiering for a chlorine gas facility you are going to have to identify the number of people affected by a terrorist related release of chlorine gas. DHS would require you to use the total amount of chlorine on-site for making this determination. The EPA RMP would use the amount in the largest container, but I would guess that for security the EPA will go with the DHS technique. DHS does use the EPA RMP*Comp online tool to calculate the ‘distance of concern’ for a toxic chemical release. Select chlorine gas and enter the maximum on-site inventory to get that distance. Then draw a circle with that radius centered on the facility. Then determine the maximum number of people in that circle during a normal work day. DHS uses both residents and people working in the area in this calculation. The larger the number the more likely the facility is to be a Tier 1 or Tier 2 facility. Security Costs There are two types of security costs that you are going to face when you employ a toxic chemical like chlorine gas. First you need to isolate the storage from the attacker, and then you need to provide mitigation measures to deal with a successful attack. First you are going to have to have a perimeter that looks impressive and will allow for early detection of a penetration. Next, since only the largest facilities will be able to afford having a security force on site to respond to an attack, most facilities will use local law enforcement responding to an incident. That means that there needs to be additional security layers to delay an attacker until the police arrive. If you are using chlorine cylinders like our friend from New Zealand, then keep them in a secure room in a secure building. I would keep my stored cylinders in a separate secured room from the cylinders in use. The more you can isolate the cylinders, one from another, the more difficult it will be to release the total on-site inventory in a single attack. Mitigation costs can be divided into active and passive measures. Active measures work to reduce the off-site movement of the toxic cloud while passive measures alert the potentially affected population to take appropriate action. Active measures can include water deluge systems or scrubbers protecting the tank storage rooms. Passive measures would include a reverse 911 system or sirens to warn of the release and an education program to teach neighbors how to respond to the warning. In Closing… This is, of course, just a brief over view. The American Water Works Association is supposed to be developing a computerized assessment tool. They won’t release it to outsiders like me, but it will probably help in the assessment process. The Metropolitan Water District in Southern California seems to have a pretty good handle on this situation; you might want to talk to them. I hope I have been of some small measure of help.

Reader Question – 10-07-09 – Top Screen

One of the interesting things about my blog is that I have a steady flow of new readers stumbling onto old postings through their internet search engines looking for information on CFATS. Today our good friend Anonymous left a question on an old blog posting from December 2007. Anonymous writes: “Do you have any information on the way DHS is ranking facilities meeting these Mission Critical and Economically Significant criteria?” As best I can tell DHS is not currently using the information from the ‘Mission Critical’ and ‘Economically Significant’ Top Screen questions for determining if a facility will be preliminarily tiered as a high risk facility. I base this on the fact that there are no ‘follow-up’ questions of these chemicals in either the SVA or SSP. I seem to recall reading an article some where last year (and I can’t find it in my records) that said that DHS did not intend to directly use the information collected in these portions of the Top Screen for immediate enforcement efforts under CFATS. It seems that they are using these questions to collect information on these types of chemicals to see how they might attempt to include them in future risk determinations. If someone has more recent information on this topic, please let me know.

CFATS Training

I received a series of emails last night from a reader in the security industry. He wanted to know if I new of any training programs that could be used for security personnel working at CFATS covered facilities. I had to tell him that I had not heard of any training programs other than one Chemical-Terrorism Vulnerability Information training program that I had written about last spring. Unfortunately I forgot about a DHS general awareness training program [NOTE: Updated Link 9-18-09, 14:39] that is available through the Sector Specific Agency Executive Management Office that I wrote about last year. He was, of course, familiar with the CFATS CVI training program used to become an authorized user of CVI.

Training Requirements

He does bring up an interesting problem that high-risk chemical facilities are going to have to start looking seriously as they think about moving into the SSP implementation phase of the CFATS process. That is how to go about training facility employees and security personnel. The Risk-Based Performance Standard Guidance document does address the training issue in RBPS #11. The introduction to that RPBS (pg 90) provides this explanation about the importance of training:

“Training details the performance standards related to security and response training, exercises, and drills. By performing proper security training, exercises, and drills, a facility enables its personnel to be better able to identify and respond to suspicious behavior, attempts to enter or attack a facility, or other malevolent acts by insiders or intruders. Well-trained personnel who practice how to react will be more effective at detecting and delaying intruders and provide increased measures of deterrence against unauthorized acts.”

The emphasis here seems to be on facility/security group response training. In fact, a large portion of the discussion in RBPS #11 is focused on this type of group training. But anyone with training development experience is aware of the fact that before training can be conducted on group response, individuals must be trained in the skills that they will need to participate in those group actions.

The RBPS does provide a detailed list of the training topics (Table 13, pgs 93-4) to which various personnel probably need to be exposed. The list is broken down into requirements for three categories of employees; Facility Security Officer (FSO) and Assistant FSO, Personnel with Security Responsibilities, and All Remaining Employees. Obviously the most extensive training will be required for the FSO.

The ‘All Remaining Employees’ category will receive the least training, what is usually termed ‘general awareness’ training. This is the type training that companies usually use professionally developed training videos to present the general concepts followed by a brief discussion of company specific policies. I have not yet heard of anyone developing this type video for CFATS general awareness training.

There is one interesting pair of items in the Table 13 list of training subjects; CVI and SSP training requirements. As you would expect, both the FSO and Personnel with Security Responsibilities groups will be required to be CVI Certified.

There is no such requirement for the All Remaining Employees group. But there is a requirement to train that group on “Relevant provisions of the SSP”. Since the SSP is clearly CVI it will take some careful preparation to extract relevant information for presentation to a non-CVI certified audience. One last point about the RBPS training ‘requirements’; the RPBS recommends the inclusion of off-site personnel in the training program. The RBPS #11 introduction (pg 90) notes that:

“A strong training program typically includes not only personnel-specific exercises and drills but also joint activities involving both facility personnel and law enforcement and first responders. Including law enforcement and first responders in training, exercises, and drills improves responder understanding of the layout and hazards associated with the facility while strengthening relationships with the emergency response community.”

One thing that facilities need to remember when they bring outsiders on site for this type training is that they need to include at least some minimal Hazcom training for those personnel. If these personnel are going to be moving about the facility, even escorted, they need to be made aware of the chemical safety considerations that must be taken into account at the facility.

Training Development Ideas 

I have more than a little experience in training development and presentation. I spent fifteen years as an Infantry NCO, developing and executing informal and formal training programs for individuals, small units and up to company size units. While working in the chemical industry for 16 years I developed and presented Hazcom and process safety training. And for the last year or so I have been doing contract training development and presentation for Georgia QuickStart, an industrial training program run by the State of Georgia.

Professional training development takes time. If you are just developing a simple stand-up classroom presentation using tools like PowerPoint® it can easily take 20 to 40 hours for each hour of instruction. Most of that work goes into the task identification process, determining what information actually needs to be communicated to the target audience. Making a training video or developing a computer based training program takes a great deal more time. Needless to say, all of that time takes money.

This is one of the reasons that most companies turn to the use of generic training videos for a wide variety of periodic government-required training programs. Usually a one hour period of instruction will include a 20 minute video, a 20 minute discussion of company or facility specific requirements and then a written test with a post-test review of the answers. This type training would probably be okay for the training requirements for the ‘All Remaining Employees’.

A training video along the lines of the computer based awareness training developed by DHS Infrastructure Protection would be valuable. An experienced instructor could even use that DHS computer based training program for group instruction, using discussion techniques to identify the security problem and appropriate response in that program.

Another training requirement from the RBPS #11 that is clearly amenable to this type of video training program would be the “Recognition and detection of dangerous substances and devices” requirement for all personnel in Table 13 (pg 93). I know that TSA has developed a similar DVD based training program for IED’s on railcars, but I have not been allowed to review the program. A generic training video for would be a valuable addition to the CFATS training process.

Most of the training for FSO’s will be given to such a small target audience (two or three people per facility) that it would probably not make financial sense to develop a training video for the limited market. On-line computer based training would make much more sense. Most of the FSO unique training is generic CFATS, security or intelligence information. Since the work of the FSO is such a key component of a successful security program it would probably be better for DHS Infrastructure Security and Compliance Division (ISCD) to develop this training as part of the CSAT tool. It would be done along the same lines as the CVI certification.

There is a large number of training requirements in Table 13 that the FSO and ‘Personnel with Security Responsibilities’ have in common. A generic video could be developed to deal with many of these requirements, but many will have to be dealt with on a facility specific basis. While small facilities may be able to get away with in-house developed training for these objectives, most large facilities are going to have to turn to professional training developers.

One final note; the Table 13 group “Personnel with Security Responsibilities’ is actually going to be at least two and possibly more groups at most high-risk facilities. The most obvious members of this group will be security personnel including guards, roving patrols and monitoring personnel (including off-site monitors). Next there will be production personnel that have a variety of security plan responsibilities including controlling access to secure/critical areas. Finally, there will be the maintenance personnel (including contractors) that will be maintaining security related equipment. The training programs for these three groups will be substantially different.

Complex Training Requirements 

So you can see that the training requirements for supporting the CFATS program at a high risk facility are going to be complex. It is no wonder that my inquisitive reader was looking for someone who was working on the issue. Oh, there is some bad news associated with this. While the RBPS #11 training guidance is relatively general, there are more specific training requirements being considered in the CFATA legislation currently being considered in Congress. Most importantly the legislation requires 8 hours of training per year for all employees.

Final note: If anyone knows of someone developing security related training programs for high-risk chemical companies please let me know. I would certainly like to share that information with my readers.