HR 3258 Analysis – EPA Enforcement

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review HR 3258 Analysis – Protected Information HR 3258 Analysis – Employee Participation HR 3258 Analysis – Emergency Response Plans HR 3258 Analysis – Risk Based Tiers The Administrator of the US EPA is given responsibility and authority for the assessment of civil penalties for violations of “any requirement of this section, including by not implementing all or part of its site security plan by such date as the Administrator requires” {§1433(o)(1)}. The Administrator may assess civil penalties of up to $25,000 per day. Enforcement Actions When it has been determined that a violation exists, the Administrator will consult with State authorities (except for Wyoming and Washington, DC) and take into account the “the severity of the violation or deficiency and the record of the covered water system in carrying out the requirements of this section” {§1433(o)(2)} before deciding how to proceed. The options would include:

Assessing a civil penalty and requiring compliance within a specified time, or Commencing a civil action in US District Court for ‘appropriate relief’ including injunctive relief.

IST Exemption This section includes a specific exemption form these enforcement actions for activities required under the provisions of §1433(g), commonly referred to as the IST provisions. For systems located anywhere but Wyoming and Washington, DC “the Administrator may not issue an order or commence a civil action under this section for any deficiency in the content or implementation of the portion of the system’s site security plan relating to methods to reduce the consequences of a chemical release from an intentional act” {§1433(o)(3)}. This is a conditional prohibition. If the facility is late in submitting its IST assessment or has failed to implement IST measures as required by the State authorities, the Administrator may take actions under this section after notifying the State authority and giving the facility 30 days to come into compliance. These exemptions were discussed in more detail in the posting discussing IST assessment issues

HR 3258 Analysis – Risk Based Tiers

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review HR 3258 Analysis – Protected Information HR 3258 Analysis – Employee Participation HR 3258 Analysis – Emergency Response Plans The drafters of HR 3258 copied a number of ideas from the current CFATS program. One of these was the idea of four risk based tiers, with a first tier facility having the highest risk and a fourth tier facility having the lowest risk. There is a significant difference between the two risk standards employed; the CFATS standards start with all facilities being at high-risk for terrorist attack, the §1433 standards do not use relative risk to establish that the facilities are covered. Thus, the potential range of risk measured by the four tiers at water treatment facilities is much wider for the water treatment facilities. Assignment of Tier Ranking Section 1433(d) requires that the Administrator establish regulations to assign facilities to the four tiers. Again, patterned after the CFATS regulations the section provides for the Administrator requiring facilities to provide information specifically to allow for assignment to an appropriate tier. This ‘Top Screen’ type information would probably ask for the number of people served by the facility, major industries served, the type of water-treatment regime used, and what substances of concern are found on site. This legislation only generally provides guidance on how the tier assignments will be determined. It does explain that the Administrator will consider “consider the potential consequences (such as death, injury, or serious adverse effects to human health, the environment, critical infrastructure, national security, and the national economy)” {§1433(d)(1)(B)} of an intentional act. It then goes on to specify three types of ‘intentional acts’ that will be taken into consideration:

"(i) an intentional act to cause a release, including a worst-case release, of a substance of concern at the covered water system; "(ii) an intentional act to introduce a contaminant into the drinking water supply or disrupt the safe and reliable supply of drinking water; and "(iii) an intentional act to steal, misappropriate, or misuse substances of concern."

The second type of ‘intentional act’ has nothing to do with specific substances of concern at the facility, though such chemicals could certainly be considered to be a ‘contaminant’ in concentrations higher than those allowed by other environmental laws. The inclusion of this type act is a continued acknowledgement that water treatment systems have their own particular risks beyond those found at other ‘chemical facilities’. While the term ‘intentional act’ is widely considered to be a politically correct euphemism for ‘terrorist attack’, it is not defined in the legislation. This opens up the consideration of the last type of ‘intentional act’ to potentially include anti-drug operations. Many facilities use anhydrous ammonia in their treatment process. This is a critical chemical in the illicit manufacture of methamphetamines and there have been wide spread instances at other storage facilities where the attempted theft of this chemical has resulted in the release of this toxic chemical. Explanation of Tier Assignments Another significant difference between this legislation and the CFATS regulations is that the drafters of HR 3258 are trying to avoid some of the secrecy associated with the CFATS assessments. DHS has been reluctant to discuss how it makes their tier ranking assignments, fearing that it would provide too much potential targeting information to terrorists seeking high-visibility targets. For water treatment facilities §1433(d)(2) would require the Administrator to “provide each covered water system assigned to a risk-based tier with the reasons for the tier assignment”. The information would still be protected information not subject to public disclosure, but it would provide the facility with information that could be used to lower their tier rankings. This would be especially important for facilities in the two highest tiers, since reducing the tier ranking to three or four would remove them from having to do an assessment of methods to reduce the consequences of a chemical release from an intentional act.

HR 3258 Analysis – Emergency Response Plans

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review HR 3258 Analysis – Protected Information HR 3258 Analysis – Employee Participation One of the major differences between this legislation and HR 2868 is that here §1433(i) requires each covered system to prepare and periodically update an emergency response plan (ERP). Such plans are not specifically targeted at chemical issues, but they are only required to look at responses to effects of ‘intentional acts’. I am not familiar enough with other EPA water treatment facility regulations to know if there are similar emergency response plan requirements for results of accidents or incidents due to natural causes such as weather, earthquakes or fires. ERP Certification There are no requirements for facilities to submit their ERP to the Administrator or State agencies with oversight responsibility for the facility. Instead, the drafters of this legislation simply require the facility to certify to the Administrator that they have prepared such a plan. The timing for such certification is based upon the submission of the facility vulnerability assessment. The legislation would require the facility to submit their certification “not later than 6 months after the system’s first completion or revision of a vulnerability assessment under this section and shall submit an additional certification following any update of the emergency response plan” {§1433(i)(2)}. This time limit is interesting because the ERP is required to incorporate the “the results of the system’s most current vulnerability assessment and site security plan” {§1433(i)(1)}. Since the time frame for preparing and submitting a site security plan is not set in this legislation (the Administrator will set that time limit in subsequent regulations), it is not clear that the site security plan will be completed by the time that ERP certification is due. ERP Coverage The ERP will cover ‘plans, procedures and identification of equipment’ that will be used to respond to “an intentional act at the covered water system” {§1433(i)(3)(A)}and “…obviate or significantly lessen the impact of intentional acts on public health and the safety and supply of drinking water provided to communities and individuals” {§1433(i)(3)(B)}. This legislation does do more than look at just chemical related security issues related to water treatment facilities, but the failure to specify that the ERP must outline chemical release notification procedures for neighbors of the facility is difficult to understand. Facilities with substances of concern need to be required to include in their ERP to provide specific coverage of issues related to releases of chemicals, especially when there is a possibility of off-site consequences from such a release. ERP Coordination While §1433(4) is labeled ‘coordination’ it only requires one-way communication of ‘appropriate information’ from the covered facility to “any local emergency planning committee, local law enforcement officials, and local emergency response providers”. The provision of such information (presumably to be more clearly specified in the resulting EPA regulations) is certainly an important first step in the development of a comprehensive ERP, but does not constitute ‘coordination’ in any sense of the word. At the very least, since this is a certification requirement not a requirement to submit an ERP for approval, the facility should be required to include in its certification an acknowledgement by at least one local law enforcement agency and one local emergency response agency that it has coordinated its ERP with that agency. Real Emergency Response Planning As readers of this blog are well aware, I am an outspoken proponent of effective emergency response planning. While I am pleased to see an ERP requirement in this legislation, the specific ERP requirements are weak at best. The legislation should require the Administrator to develop specific requirements for the ERP just as it does for the vulnerability assessment and site security plan mandates in the bill. Certification of the existence of an ERP meeting such requirements might be appropriate for low-risk facilities, but higher risk facilities with the potential for significant off-site chemical release consequences should be required to submit their ERP for approval. A facility has no control of the planning actions or capabilities of other local government agencies that must actually execute the off-site ERP response. Covered facilities must however, be required to initiate specific coordination efforts. For facilities with potential for significant off-site chemical consequences, this legislation should require that they provide local law enforcement and emergency response agencies with the following information, at a minimum:

Identification of on-site chemicals with potential off-site affects; Material Safety Data Sheets for those chemicals; Potential exposure distance for a worst case release for those chemicals; Information about inbound shipments of those chemical; and Facility point of contact for incident information.

The facility should be required to include in their side of the ERP:

Methods for detecting a potential chemical release; Methods for directly notifying immediate neighbors of toxic chemical releases; Methods for notifying local law enforcement and emergency response personnel of initiation of the ERP; and Methods for ensuring communication with local law enforcement and emergency response agencies during a chemical release emergency.

HR 3258 Analysis – Employee Participation

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review HR 3258 Analysis – Protected Information This legislation, like its companion bill HR 2868, specifically addresses the roles of employees in the security process. While certainly a part of labor agenda, these provisions address a reality that facility employees must perform a number of critical roles in addressing the protection of the facility from ‘intentional acts’. Role of Employees Section 1433(f)(1) requires that site security plans and emergency response plans must address the specific roles that employees are “expected to perform to deter or respond to the intentional acts”. While this would seem to be an obvious requirement for any such plan, this has been identified by labor unions as a significant shortcoming in many security plans that they have seen. The inclusion of ‘emergency response plans’ in this section is something that is not seen in HR 2868. An emergency response plan should be an integral part of any security or safety plan. It is should be included as a recognition that there is no such thing as a foolproof plan. Employee Training This legislation carries the same 8-hour training requirement for facility employees that is found in HR 2868. Section 2103(f)(2) of that legislation provides an extensive list of areas that must be covered in that 8-hour training requirement. That is lacking in this legislation. Without this listing of coverage requirements, the 8-hour training requirement is excessive. One provision of the HR 2868 legislation that certainly needs to be transferred to this legislation is the requirement to allow “instruction through government training programs, chemical facilities, academic institutions, nonprofit organizations, industry and private organizations, employee organizations, and other relevant entities that provide such training” {HR 2868, §2103(f)(2)(H)}. With the small size of many of these facilities with their limited training resources it would be extremely difficult to develop such training programs in-house. Section 1433(q)(4) provides for a federal grant program to provide monetary support for training for facility employees and contractor employees. The grant program would be administered through the National Institute of Environmental Health Sciences. Training grants under this program could also be used to train first responders and emergency response personnel that would respond to incidents at the facility. An odd provision of this grant program, and a similar program under HR 2868, is that the monies would not go to the covered facility but to ‘eligible entities’. An eligible entity would be “a nonprofit organization with demonstrated experience in implementing and operating successful worker or first responder health and safety or security training programs” {§1433(q)(4)(D)}. There is no money specifically appropriated in §1433(r) to fund these grants. Employee Participation From the perspective of labor organizations the most important provision of this section is found in §1433(f)(3) which outlines the requirements for employee participation in the development of vulnerability assessments, site security plans and emergency response plans. Labor has long maintained that there members have an intimate knowledge of the facilities in which they work that would be invaluable in the development of safety and security plans. The language of this legislation requires that there must be at least one supervisory and one non-supervisory employee involved in the development of these plans. Where there is a union that is certified or recognized as a bargaining agent for employees or contractors at the covered facility, each such union will have a representative involved in the development of these plans.

HR 3258 Analysis – Protected Information

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments HR 3258 Analysis – VA-SSP Review One of the continuing controversies regarding security programs at chemical facilities, including water treatment plants, is allowing public access to public safety related security information. This legislation takes a fairly conventional type approach by limiting access to specific sensitive information, while requiring information sharing among affected parties. The term ‘affected parties’ includes emergency response agencies, State and local officials, and employees, but does not include the neighboring public. Section 1433(l) does not assign the protected information to any of the current categories of controlled but unclassified information, nor does it try to specifically create a new standard. It does specify SSI protections in some cases and lists protection requirements in other cases. This cut and paste information protection scheme is confusing and part of the larger problem that the government is having in trying to determine how to protect security information for private companies. Freedom of Information Act Exemption Section 1433(l)(1) specifically exempts the ‘protected information’ from public disclosure “under section 552 of title 5, United States Code” and similar State, local or tribal laws. This means that the general public, including news agencies, has no rights to access the information. Security personnel will certainly agree with this exemption while environmentalists and local activists will feel that it shuts them out of determining if the facility is taking adequate measures to protect the public. This is a continuing source of conflict between these two groups and is aggravated in this case by the fact that most of the covered facilities will be publicly owned facilities. Sharing Requirements Section 1433(l)(2)(a) specifies that the regulations developed to implement this legislation will make provisions for sharing ‘protected information’ with a wide variety of categories of personnel. Those categories include:

Federal, State, local, and tribal authorities, First responders and law enforcement officials, Designated supervisory and non-supervisory covered water system personnel with security, operational, or fiduciary responsibility for the system, and Designated facility employee representatives, if any.

Specific provisions in this section require sharing of information related to employee responsibilities for actions under facility Site Security Plan. The complete Vulnerability Assessment and Site Security Plan must be made available to “a representative of each certified or recognized bargaining agent representing such employees”. Presumably this is to allow the experts within those labor organizations to review those documents and ensure that adequate measures are being taken to protect their members from the results of ‘an intentional act’. With the wide number of personnel given access to ‘protected information’ under these provisions, the legislation attempts to limit the subsequent spread of such information by providing sanctions against the unauthorized disclosure of such information. Anyone “who purposefully publishes, divulges, discloses, or makes known protected information in any manner or to any extent not authorized by the standards set by the Administrator” {§1433(l)(2)(B)} may be imprisoned or fined for a misdemeanor violation in accordance with chapter 227 of title 18 USC. Sensitive Security Information This legislation does not make the ‘protected information’ Sensitive Security Information under §525 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295; 120 Stat. 1381). Section 1433(l)(3) does, however, provide the same protections to the ‘protected information’ in ‘adjudicative proceedings’. Thus, the SSI disclosure rules do apply in administrative hearings and court cases. Definition of ‘Protected Information’ The drafters of this legislation start their discussion of what is covered as ‘protective information’ by describing what is not included in that term. First {§1433(l)(4)} they note that the ‘protective information’ protections do not apply to any information required to be submitted to other Federal, State, tribal or local government agencies under any other laws. This should prevent the information disclosure problems seen in the recent CSB investigation of the Bayer CropScience incident, but I would be more comfortable if CSB and other Federal, state and local accident investigations were specifically addressed in the language. Next {§1433(1)(5)} notes that the ‘protected information’ provisions of this legislation may not be used to prohibit sharing information with Congress. That section does not exempt members of Congress or their staffs from subsequent unauthorized disclosure sanctions of §1433(l)(2)(B). I suspect that constitutional scholars would assert that there were other provisions of the Constitution that would protect actual members from those sanctions. Finally, §1433(l)(7) provides a typical list of the types of documents that would be considered ‘protected information’. Even then only specific portions of those documents would meet that definition. Only portions that would be detrimental to the security of the facility, or other covered facilities, if disclosed could be protected. Even then, that information only becomes protected if it was developed “exclusively for the purposes of this section” {§1433(l)(7)(B)(ii)}. This would mean, for example, that the amount of a substance of concern stored on site could not be considered ‘protected information’. Exclusions The final part of the ‘protected information’ portion of this legislation is the ‘exclusions’ paragraph {§1433(l)(7)(C)}. This reiterates most of the previously described types of information that cannot be considered ‘protected information’. One sub-paragraph that appears to be a simple re-wording of previously stated exemption deserves special recognition:

‘‘(i) information that is otherwise publicly available, including information that is required to be made publicly available under any law;”

This section would appear to allow any State, tribal or local government to pass a law that would make any security information publicly available. I’m sure that this is not what was intended, but the broad wording of the section certainly allows for that interpretation. There is certainly a conflict between this section and the wording of §1433(l)(1)(B), but that conflict could be explained away by stating that the earlier wording only applies to ‘protected information’ while the latter wording allows the for the exemption of information being considered ‘protected information’.

HR 3258 Analysis – VA-SSP Review

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments HR 3258 Analysis – IST Assessments I mentioned in an earlier blog that the EPA is likely to work with existing State enforcement authorities to manage this security program. One area of enforcement is reserved to the Administrator in this legislation; that is the review of the submitted vulnerability assessments and site security plans. Section 1433(h) specifies that VA and SSP submissions must be made to the Administrator who will review them and either approve them or require the facility to correct ‘significant deficiencies’. Administrator Review of VA and SSP Even where the legislation provides the Administrator with specific responsibility for enforcement, it still requires this determination to be made “in consultation, as appropriate, with the State exercising primary enforcement responsibility for such system, if any” {§1433(h)(2)}. Once again, this is in keeping with the EPA process for oversight of water treatment systems, so it is not surprising that the Energy and Commerce Committee drafters of this legislation would include such language. Significant deficiencies are determined by finding that a:

Vulnerability assessment does not comply with the requirements of §1433(a)(1); Site security plan does not address the vulnerabilities found during the VA; or Site security plan does not meet all of the appropriate risk-based performance standards (RBPS) required in §1433(b).

No Submission to State or Local Governments Even thought the State enforcement agency is required to be consulted on the determination of deficiencies, the legislation is quite specific in noting that facilities are not required to provide copies of the VA or SSP to State or local agencies. Section 1433(h)(3) states that:

“No covered water system shall be required under State, local, or tribal law to provide a vulnerability assessment or site security plan described in this section to any State, regional, local, or tribal governmental entity solely by reason of the requirement set forth in paragraph (1) that the system submit such an assessment and plan to the Administrator.”

This is a very odd provision given the ‘consultation’ requirements of §1433(h)(2) and the pre-emption provision of §1433(n) that specifically allow for state and local rules that are “more stringent than a regulation, requirement, or standard of performance under this section”. Thus, a State or local agency may not require that the facility provide a copy of a VA or SSP made for regulations developed under this legislation, but may require the completion of a separate VA or SSP with stricter requirements. Risk-Based Performance Standards The RBPS mentioned in the ‘significant deficiencies’ section mentioned above is only very broadly outlined in this legislation. Section 1433(b) only requires the Administrator to set forth RBPS in the regulations supporting this legislation and that those standards will be “increasingly stringent based on the level of risk associated with the covered water system’s risk-based tier assignment”. The Administrator is required to ‘take into account’ the RBPS set forth in the CFATS regulations {6 CFR 27.230} or such successor regulations required by new legislation (like HR 2868). The phrase ‘take into account’ is very vague. It would allow the Administrator to adopt the entire §27.230 as part of the regulations (with or without using the RBPS Guidance document adopted by DHS last year), use parts of that section as a template for writing the EPA rule, or writing off the DHS effort as inapplicable to water treatment facilities as long the matter was addressed in appropriate preamble to the publication of the draft rule. There is nothing in the RBPS section of this legislation that would require, or prohibit the Administrator from requiring specific security measures. Typically risk-based performance standard type regulations specify what must be accomplished rather than how something must be done, but without a specific prohibition against requiring a specific measure (as was found in the §550 authorization for CFATS), there is nothing that would stop the regulations from specifying some specific security measures as long as most of them were performance based requirements.

HR 3258 Analysis – IST Assessments

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 Analysis – Vulnerability Assessments Every covered water treatment facility that possesses a substance of concern (SOC) above the established threshold quantity would be required to conduct an assessment of ‘methods to reduce the consequences of a chemical release from an intentional act’ (Methods) {§1433(g)}. These Methods, commonly referred to as ‘inherently safer technology’ or IST (though those terms are not used in the text of this bill), include {§1433(g)(1)}:

The “use of alternate substances, formulations, or processes”; The “modification of pressures, temperatures, or concentrations of a substance of concern”; or The “improvement of inventory control or chemical use efficiency”.

The wording of this section does not limit which SOC must be covered under such assessments. While most public discussion of IST provisions focuses on toxic chemicals such as chlorine gas, anhydrous ammonia or sulfur dioxide gas, there is no specification of which SOC should be addressed. Presumably then, every SOC possessed or planned to be possessed at the site would be required to undergo such an assessment. The Assessment The assessment of Methods is required to be included in the Site Security Plan submission required under §1433(e) and must be submitted to the Administrator and the State agency exercising primary enforcement responsibility over the facility (except Wyoming and DC). Section 1433(g)(2) specifies what information must be included in the report of the assessment. That section requires that the regulations developed by the Administrator require that the assessment “consider factors appropriate to the system’s security, public health, or environmental mission”. In addition to a description of the methods assessed, the assessment must include a description of how each method would “reduce the potential extent of death, injury, or serious adverse effects to human health resulting from a chemical release” {1433(g)(2)(B)}. These potential benefits are to be contrasted with potential adverse affects of the implementation of the Methods to include how it would affect “the presence of contaminants in treated water, human health, or the environment” {1433(g)(2)(C)}. The assessment would then have to address the feasibility of implementing each Method. It specifies that the facility will use the feasibility rules currently described in §1412(b)(4)(D) of the Safe Drinking Water Act (42 U.S.C. 300i–2). This feasibility assessment would specifically exclude cost factors. Costs will be reported separately from the feasibility assessment. Cost analysis would be done showing the costs of implementation (both capital and operational costs) and the avoided costs (savings and liabilities). This cost analysis would be done for each of the Methods described for that facility. There are no definitions provided for what avoided liabilities should be required in this cost reporting. Finally, after reporting any other “relevant information that the covered water system relied on in conducting the assessment” {1433(g)(2)(F)}, the facility would report if the facility has implemented or plans to implement any of the reported Methods. The assessment report would have to explain why any of the described Methods is not being implemented. Implementation Requirements In regulations implementing this legislation the Administrator will establish a time limit for the administrative review of these assessments. Within that time limit, the State agency exercising enforcement authority (or the Administrator for Wyoming or Washington, DC) over the facility will evaluate the assessment and determine if the facility will be required to implement any of the assessed Methods. Only facilities in the two highest ranked Tiers may be required to implement such Methods. The State agency will report the result of their determination to the Administrator. In making the determination the State agency (Administrator) will “consider factors appropriate to the security, public health, and environmental missions of covered water systems” {1433(g)(3)(C)}. Included in those factors will be an analysis of:

The reduction of “the risk of death, injury, or serious adverse effects to human health”; The “interim storage of a substance of concern”; The ability of the facility to “comply with other requirements of this Act or drinking water standards established by the State or political subdivision in which the system is located”; and The feasibility of the Method under §1412(b)(4)(D)

Enforcement In the event of an incomplete assessment, the Administrator may require an assessment to be re-submitted within 60 days. The Administrator may take enforcement actions under §1433(o) if the assessment is not submitted within the required time frame. If the State agency fails to make a timely determination of whether or not to require a covered facility to implement a Method, the Administrator will provide the agency and the covered facility with a 30 day notice to make the determination. Failure of the State agency to make a determination within that time frame will allow the Administrator the authority to make that determination. A similar 30 day notice would be provided if the State agency fails to take enforcement action for failure to implement a required Method in a timely manner. The ultimate sanction available against the State agency is for failure to act under the provisions of this section includes removing the State agency’s authority to supervise water treatment facilities. There are no provisions included in this legislation for the Administrator to review or overturn a determination made by the State agency to require (or not require) the implementation of Methods. Neither are there any provisions made for the covered facility to appeal a requirement to implement such Methods.

HR 3258 Analysis – Vulnerability Assessments

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background HR 3258 Analysis – 50 Enforcement Agencies HR 3258 Analysis – Substance of Concern HR 3258 requires each covered facility to complete a vulnerability assessment and update that VA every five years or whenever a facility change is made that “could cause the reassignment of the system to a different risk-based tier” {§1433(a)(1)(B)(ii)}. Since the Administrator is required {§1433(d)(2)} to explain the reason for the tier ranking assigned to the facility (which is significantly different that the process under CFATS where the Secretary has decided to keep the reasons for tier assignments restricted information), the facility would presumably be able to determine what changes would result in a reduction in tier ranking. It is less clear that they would be able to determine what changes would raise their tier ranking. Chemical and Non-Chemical Risks Unlike the CFATS regulations, regulations developed to support this legislation would be required to address chemical and non-chemical risks. Section 1433(c) requires facilities to assess the water system’s vulnerability to a range of ‘intentional acts’. While HR 3258 does not define the term ‘intentional acts’ it is generally accepted to mean a terrorist attack. Having said that it could reasonably be stretched to include thefts of anhydrous ammonia for the production of methamphetamines, or even less reasonably stretched to include acts of vandalism. As one would reasonably expect, the vulnerability assessments will be specifically required to address chemical risks. The wording of §1433(c) addresses the issue of chemical security by requiring the vulnerability assessments to look at intentional acts “that results in a release of a substance of concern that is known to cause or may be reasonably anticipated to cause death, injury, or serious adverse effects to human health or the environment”. As far as I can tell, the term ‘release’ in environmental regulations does not typically include theft, so the resulting regulations might not require the prevention of the theft of anhydrous ammonia, chlorine gas cylinders or other dangerous chemicals. Assessment Requirements This bill does provide a list of seven areas that the vulnerability assessment must address. Those areas are:

“(1) pipes and constructed conveyances; “(2) physical barriers; “(3) water collection, pretreatment, treatment, storage, and distribution facilities; “(4) electronic, computer, and other automated systems that are used by the covered water system; “(5) the use, storage, or handling of various chemicals, including substances of concern; “(6) the operation and maintenance of the covered water system; and “(7) the covered water system’s resiliency and ability to ensure continuity of operations in the event of a disruption caused by an intentional act.”

It can be readily seen that these requirements cover a great deal more ground than the CFATS SVA requirements. This is understandable since this revision of the Safe Water Drinking Act replaces the current requirements for protecting water treatment facilities from terrorist attack. Those current requirements are designed to insure that an attack would not compromise the production of potable water for the served community. This revision of that law must continue those protections and while adding protection of dangerous chemicals used at those facilities. State Enforcement Issues This multifaceted approach is one of the main reasons that the drafters of this legislation kept the chemical security coverage of these facilities under the EPA rather than placing it under the CFATS rules at DHS. So many of these requirements are already addressed under EPA regulations that it would seem reasonable to add relatively limited chemical security regulations to the extensive EPA body of regulations for these facilities. The major drawback to this approach is that EPA has already delegated enforcement of water treatment regulations to the states, and continues that delegation in this proposed legislation. Adding chemical security regulatory enforcement to the overloaded state governments is going to result in uneven enforcement at best. The added chemical security issues and the increased enforcement requirements are going to require additional assets at the State level.

HR 3258 Analysis – Substance of Concern

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include:
HR 3258 Section-by-Section Analysis
HR 3258 Analysis – Political Background
HR 3258 Analysis – 50 Enforcement Agencies

Section 1431(a)(4)(B) requires that the Administrator of the US EPA to consult with the Secretary of DHS in the designation of ‘substances of concern’. Later, §1431(a)(5) discusses the requirements for the development of that list. This posting will look at the subject of ‘substances of concern’ (SOC) in this proposed legislation.

Appendix A, 6 CFR Part 27

Readers of this blog will be well familiar with the DHS list of chemicals of concern (COI) found in Appendix A to 6 CFR part 27. The drafters of this legislation clearly require that listing of SOC will be patterned after that list, but did not specifically require that the Administrator use that list of chemicals in the development and enforcement of the regulations that will be written to implement this legislation. There are a number of reasons for this.

First, the SOC will not be used to determine which facilities will be covered under the resulting regulations. DHS uses the list of COI to define which facilities will file a Top Screen. This legislation addresses a much smaller universe of potentially covered facilities and the drafters were able to provide a clear definition of covered facilities in the legislation. This means that the Administrator will put the list of SOC to a much different use than that which the DHS list of COI is used.

Next the number of potential chemicals that will be found at water treatment facilities will be much different than those potentially found at chemical facilities. It is extremely unlikely (approaching impossible) that a water treatment facility would have any of the chemical warfare agents found in Appendix A (chlorine was not listed as a CW agent) for example. This will allow for a much smaller list of regulated chemicals.

Finally the standard which the Administrator would use to establish a ‘threshold quantity’ (TQ), roughly the equivalent of the ‘screening threshold quantity’ (STQ) used by DHS, for each chemical on the SOC list will be substantially different than the standard used by the Secretary. DHS concentrated on off-site affects of a release or theft/diversion of the covered chemicals.

This legislation envisions similar standard, but is also much more concerned with the continued operation of the water treatment facility. Thus a quantity that would severely disrupt operation of the facility if released would be of higher consequence than a similar disruption of a chemical facility.

Reactivity 

One of the characteristics of chemicals that the Administrator is required to consider in the selection of SOC is reactivity {§1431(a)(5)(B)}. The term is not defined in the legislation, nor is it one that was widely used in the development of the list of COI. Part of the problem that the Secretary had in considering the reactivity of chemicals in the development of the list of COI was that such a wide range of chemicals will violently react with a small number of chemicals specific to that chemical. Reactivity is really only a security issue if the other chemical is present on site. As a result, the Secretary only considered reactivity if water was one of the reactive pair.

The Administrator does not face that same daunting task of examining such a wide range of reactive pairs of chemicals in determining which chemicals should make the list SOC. With the smaller number of chemicals that are going to be found in bulk storage at water treatment facilities, it will be easier to develop a reasonable list of reactive chemicals that should make the list.

Sodium Hypochlorite (industrial concentrations of common chlorine bleach) is a good example. It is widely used in the disinfection of drinking water. It violently reacts with a number of other chemicals that are typically found at water treatment facilities including ammonia, hydrochloric (muriatic) acid, and sulfuric acid. The reaction produces large quantities of heat and evolves chlorine gas. The reaction is very fast and the gas produced so quickly that it is quite possible to rupture the storage tank if large volumes of the co-reactant are introduced.

While the chlorine gas cloud is a potential danger to on-site and off-site personnel, it is the destruction of the storage tank that would be of larger concern as it could effectively shut down the facility. Since the list of SOC is not being used to define the list of covered facilities, adding a chemical like Sodium Hypochlorite to the list will not result in any more facilities submitting information to the Administrator.

The Administrator is using the SOC data submitted by the facility (the EPA equivalent of the Top Screen) to help determine the Tier ranking of the facility. Of course, the inclusion of Sodium Hypochlorite would only make sense if all of the typical reactants potentially found in bulk storage at water treatment facilities are also included in the list of SOC.

Propane

One of the chemicals that caused a great deal of controversy in the development of the DHS list of COI was propane. When DHS tried to apply the typical flammable chemical rules to propane, the propane industry mounted a major political effort to get their product exempted from CFATS regulation. In the end DHS reached a political compromise that set a much higher SQT for propane than was reasonable based on objective fact. Again, the expressed reason for the high SQT was to limit the number of covered facilities.

With the current legislation defining ‘covered facility’ by size of the served community rather than the amount of chemicals on-site, there is no need to provide propane with special political treatment. The TQ for propane should be set the same way as other flammable chemicals; based on their potential affect on off-site populations or disruption of facility operations if deliberately released.

HR 3258 Analysis – 50 Enforcement Agencies

This is another in a continuing series of blog postings about the recently introduced HR 3258, the Drinking Water System Security Act of 2009. This bill is designed to be a companion bill to HR 2868, the Chemical Facility Anti-Terrorism Act of 2009, extending chemical facility security rules to water treatment facilities. Previous postings in this series include: HR 3258 Section-by-Section Analysis HR 3258 Analysis – Political Background As I noted in the previous posting in this series, one of the political realities that led to the writing of HR 3258 is that the US EPA is already responsible for a significant portion of the regulation of water treatment facilities, including security against deliberate contamination of the water supply. While the leadership of the House Energy and Commerce Committee obviously feels that this is a logical extension of EPA authority, this does result in some inherent regulatory complications. Covered Facilities When DHS was looking at the possibility of the water treatment facility exemption being removed by HR 2868 they estimated that there would be an additional 3,000 facilities added to the CFATS program based on the presence of COI (typically chlorine, or anhydrous ammonia) at or above the screening threshold quantity (STQ). This would have almost doubled the number of covered facilities. HR 3258 uses an entirely different standard to determine what facilities would be considered ‘covered facilities’. Instead of relying on the presence of a quantity of specific chemicals on-site, the standard set forth in this legislation is the size of the served community. It makes any “community water system serving a population greater than 3,300’ {§1433(a)(2)(A)} a covered facility. While I have not seen any specific figures for the number of facilities that this would cover, but it would be substantially more than 3,000. The reason for this is that these regulations would cover more than just the security of chemicals at these facilities. This legislation would extend and expand the current physical security requirements for protecting the water supply to the protection of the hazardous chemicals used at many of these facilities. This was done to ensure that there would only be one set of security rules covering these facilities. Duplication of Efforts This, of course, raises the question about duplication of regulatory efforts in the EPA and DHS. The argument can certainly be made that DHS has expended a great deal of time, effort, and money setting up the regulatory tools needed to enforce CFATS. Regulations have been written. Innovative on-line reporting and evaluation tools have been developed and supporting documentation has been written and revised. And, the Chemical Security Academy has been developed to train a professional staff of chemical security inspectors. The counter to that argument is that substantial portions of the CFATS program will not actually apply to water treatment facilities. The list of 300+ chemicals of interest (COI) is certainly over-kill when it comes to the limited chemical inventories of these treatment plants. Nor will there be the complexity and variety found in the loosely defined chemical industry; the regulations and reporting tools will be easier to develop for a this relatively uncomplicated industry. This should also make those tools easier to understand and use. One way to look at this issue is to ask would it be easier to add chemical security to existing water security regulations or to add water facility security to existing chemical security regulations. Obviously, Chairman Waxman decided that the former would make more sense, especially since he took the opportunity provided to increase substantially the water security requirements. Enforcement Activities The US EPA currently uses a distributed enforcement model when dealing with water treatment facilities. This means that the Administrator has delegated enforcement authority to the individual States where they have expressed a willingness, and presumably demonstrated an ability, to take on that task. Forty-nine states (Wyoming is the exception) have accepted that delegation. This enables the EPA to have a very small enforcement staff. That delegation has been specifically included in the language of one portion of this legislation. Section 1433(g) gives authority to the State (where the State has primary enforcement authority) the responsibility for determining if a high-risk (Tier 1 or 2) water treatment facility must implement ‘methods to reduce the consequences of a chemical release from an intentional act ‘methods to reduce the consequences of a chemical release from an intentional act’. While provisions have been made to require the reporting of that decision to the Administrator, there is nothing allowing the Administrator to overturn that decision. This is the only portion of the regulation that addresses the use of delegated enforcement authority. But, since the US EPA routinely uses this enforcement model for water facility regulations, I would suspect that the EPA would rely on State officials to enforce this regulation as well. Lacking specific authority to hire and train a significant enforcement staff, it would not only be reasonable, but it would necessary if there is to be even a minimal effort to enforce these requirements. This comes with it own set of problems. First there is the question of uneven enforcement activities. How is the EPA going to ensure a minimal level of training for the inspectors from 49 states? This will be especially important since the Administrator is required to establish risk-based performance standards rather than prescriptive standards for site security plans. The EPA could establish a training program similar to the Chemical Security Academy being run by DHS. Or perhaps they could contract with DHS to conduct that training. The next surmountable problem is the sharing of information with State agencies. The language in HR 3258 requires the submission of ‘Top Screen’ type information, vulnerability assessments and site security plans to the Administrator. All of this information will be protected information under rules that should be similar to the Sensitive Security Information rules established by TSA. Secure methods of sharing that information with States will have to be developed. There will undoubtedly be other issues that will have to be dealt with due to this distributed enforcement model used by the EPA. I can’t think of any that would be insurmountable, but they will complicate the development and enforcement of the regulations that will have to be written to implement these regulations.

HR 3258 Analysis – Political Background

Last week I posted a section-by-section analysis of HR 3258, the water system security companion to HR 2868. That analysis looked at what the legislation said and required. Today I would like to start to look at those requirements as a whole and compare how the affect on water treatment facilities would compare to both the current CFATS program and the updated program envisioned in HR 2868. But first we need to look at the differences between water treatment facilities and commercial chemical facilities. Water Treatment vs Chemical Facilities Before we can look at the affect of these regulations we first have to understand that there are fundamental differences between water treatment facilities and high-risk chemical facilities. These differences are going to color the differences between how chemical security regulations are applied at these two distinct types of facilities. First chemical facilities are privately owned and are operated to produce profits for their owners. Most water treatment facilities are government owned or closely controlled by a local government agency. The reason for government control is that these facilities are almost always a monopoly; the sole source for drinking water for the served population. An important part of this government control is that local politicians typically control the rates that the facility operator can charge for their product. While the US Environmental Protection Agency has some level of regulatory control over almost all CFATS covered facilities the regulations that govern those facilities are significantly different than the regulations that govern the relationship between the US EPA and water treatment facilities. Furthermore, for all but one state (Wyoming) and the District of Columbia, the US EPA has delegated most of the control for water treatment facilities to State agencies. Finally, there are already Federal regulations in place that address anti-terrorism security measures for water treatment facilities. Those regulations are designed to loosely protect water systems from contamination, not control the theft or release of water treatment chemicals. Those regulations do require covered water facilities to complete a security vulnerability assessment, but do not require the completion or independent evaluation of site security plans. Political Considerations One of the considerations that goes into the development of any major legislation in Congress is the determination of which committee has oversight responsibility for that legislation. As many commentators have discussed the formation of the Homeland Security Department has created a problem in Congress because a wide number of government agencies, all with their own history of Congressional oversight, were combined into a new organization with its own oversight committee. Again, many commentators have noted that Congressional committees jealously guard their oversight responsibility. This is a simplistic view of the situation. It is certainly true that surrendering some oversight responsibility to another committee would result in a reduction of the authority of a committee, most importantly the authority to direct the spending of money into member’s districts. But, to be perfectly fair, each committee staff has built-up a level of expertise in the operations, legislative background, developing plans of the supervised agency. Transferring that expertise is not simple, nor is has there been much effort made to encourage that transfer by the Congressional leadership on either side of the aisle. Other fights have had higher priority. This situation has been particularly difficult for those that have been considering the regulation of chemical security at water treatment plants. After 9/11 it was clear that public water treatment works were a potential terrorist target and the EPA and Congress worked out rules for the protection of those facilities from attacks that posed threats to the purity of the water output of those facilities. It was a natural outgrowth of the EPA regulation of water facilities; the EPA’s coverage had always been concerned with the water coming out of the facilities. It has been clear for some time that the regulation of chemical security at water treatment facilities was going to be primarily concerned with preventing the release of toxic inhalation hazard (TIH) chemicals, chlorine gas and anhydrous ammonia in particular. While there are available substitutes for these chemicals, that substitution is not as simple as stopping the shipment of chlorine and starting to receive industrial strength bleach instead. The technical challenges are further complicated by the fiscal realities that govern water treatment facilities; limited capital reserves, limited access to credit, and ultimately, voter approval requirements for any major expenditure of funds. Finally, there is always the conflict between local governance and federal oversight. This is a conflict that dates back to well before the establishment of United States, and is actually a direct outgrowth of revolution that separated the colonies from the control of the British government. Local communities jealously guard their control of police, schools and water treatment facilities. Members of Congress are well aware of this and tend to tread lightly when imposing requirements on local governments, especially laws that require those governments to spend local money, the infamous ‘unfunded mandates’. All of these political considerations color the application of chemical security regulations at water treatment facilities. Problems with these considerations have, to date, prevented the regulation of the widely recognized hazards of TIH chemicals at these facilities. Many water treatment facilities have, however, already started with the development of their own security plans and, frequently, the substitution of less hazardous chemicals. A good analysis of such actions can be found in the June 2008 testimony of Mr. Brad Coffey, Water Treatment Section Manager, Metropolitan Water District of Southern California, before the Subcommittee on Environment and Hazardous Materials. Separate Regulation A good understanding of these political realities is what lead to the development of HR 3258 as a separate bill from HR 2868. First this bill had to amend the Safe Drinking Water Act instead of the Homeland Security Act as that act already regulated the physical security of drinking water facilities. It only makes sense to extend those existing security regulations to include the protection of the chemicals used in water treatment. That logically lead to making the US EPA the lead agency for the expanded security regulations; they were already responsible for the managing the current security regulations. It also acknowledges the fact that the EPA has historically shared the responsibility for regulation of such facilities with State agencies and extends that shared responsibility to chemical security regulations. This will also color the details of the implementation that we will look at in future a future blog.