HR 3256 Introduced – CFATS Reauthorization - Part I

Earlier this week Rep. Richmond (D,LA) introduced HR 3256, the Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2019. Normally, I wait for the official print of the bill before I review it, but the House Homeland Security Committee has a committee print available and have scheduled a mark-up hearing of the bill on Wednesday, so I will be reviewing the committee print today.

HR 3256 would reauthorize the Chemical Facility Anti-Terrorism Standards (CFATS) program for an additional five plus years (until May 1^st, 2025; §16). The bill also provide a number of amendments to the current authorization language (6 USC Subchapter XVI).

Major Additions

The following sections of the bill show the areas where significant changes would be made to the existing program:

§4. Protection and sharing of information.

§5. Civil enforcement.

§6. Whistleblower protection.

§7. Chemical Security Advisory Committee.

§12. Voluntary mechanism for reporting drones and other emerging threats.

§13. Regulations regarding specific products and mixtures containing chemicals of interest.

The following sections provide information on the studies and reports required by the bill:

§8. Implementation plan and report to Congress.

§9. Study on risks posed by excluded facilities.

§10. Study on feasibility of waiver program.

§11. Comptroller General reports.

Information Protection and Sharing

Section 4 of the bill would make a number of changes to 6 USC 623, Protection and Sharing of Information. The first change would be to rewrite paragraph (a) to read:

(a) In general - Notwithstanding any other provision of law, with respect to information in the possession of the Department, the Secretary shall protect information developed under this subchapter, including vulnerability assessments, site security plans, and other security related information, records, and documents shall be given protections from public disclosure consistent with the protection of similar information under section 70103(d) of title 46 [link added].

Additionally, a complete rewrite of paragraph (b) includes:

(2) NONDEPARTMENTAL INFORMATION. — Information is not protected pursuant to subsection (a) if it is—

(A) not in the possession of the Department;

(B) developed under this title but has been previously produced or developed for other purposes; and

(C) is already publicly available, readily discoverable, or otherwise lawfully disclosed.

Comment: It looks like this is intended to change the Chemical-Terrorism Vulnerability Information (CVI) program to make it more like other sensitive but unclassified (SBU) information protection programs. Currently the CVI program has strict information protection rules for information held at each covered facility. Other SBU only protect information in the hands of the Federal government, its contractors, and such information shared with State, Tribal, and local governments. If that was the intent, it looks to me like the terminal ‘and’ in (2)(B) nullifies that attempt as it does not remove protections already provided in the program. DHS would not be required to change the CVI rules under these changes. If the terminal ‘and’ were changed to ‘or’ then (2)(A) would be the controlling factor for removing CVI protections for information held at facilities.

As noted above §4 also rewrites (b), changing the information sharing requirements of §623(b) to require DHS to provide information (upon request) to {new §623(b)(1)}:

State, local, and regional fusion centers (as that term is defined in section 210A(j)(i) of this Act) and State and local government officials, including law enforcement and emergency response providers;

Members of Congress;

Members of the Chemical Security Advisory Committee under [new] section 2010 of this Act; and

The Comptroller General of the United States.

The addition of fusion centers and members of Congress in this paragraph allows the bill to delete the current paragraphs (c) and (f) from §623.

Comment: This is a proforma change to appease supporters who want ‘better’ information sharing about the hazards associated with covered facilities. This really provides no new requirements for the CFATS program beyond the addition of the new Advisory Committee which will be covered in more detail later in the bill.

Civil Enforcement

Section 5 of the bill would amend §624, Civil Enforcement. The first set of amendments deals with changes to paragraph (a), Notice of noncompliance. The first change the time limits for DHS to provide a written notice of non-compliance from 14-days to 3-days. And the second changes the time limit a facility would have to comply with a DHS order to comply, from 180 days to 30 days.

The next set of changes address paragraph (b)(2) civil penalties for non-reporting chemical facilities of interest. The change clarifies that the subparagraph applies to Top Screen submission requirements or supplemental information thereto.

The third set of changes paragraph (c)(1), expanding the DHS authority for issuing emergency orders due to violations of CFATS program requirements or the risk of terrorist incidents. It now adds a vague “or other malicious act” that may affect a chemical facility of interest to the list of potential causes of “an imminent threat of death, serious illness or severe personal injury that the Secretary could attempt to prevent by requiring facility action.

Comment: This is ‘other malicious act’ is vague enough to provide authority to order cybersecurity measures or even the development of active shooter programs. The current management would be unlikely to use this authority; their emphasis is on cooperative enforcement. Who knows what could happen in the future?

Whistleblower Protections

Section 6 of the bill modifies the existing whistleblower protections found in §625. The bill expands on the existing requirements for:

• Confidentiality;

• Response to reports; and

• Opportunity for review

The bill also adds a new paragraph (c) to the section; Procedure and Remedy. It provides requirements for DHS to “establish a procedure for the review and investigation of complaints of reprisals” {new §625(c)(i)} as well as establishing remedies for violations of the same.

NOTE: I am about half-way through the major CFATS changes proposed by this new bill and we are already at about 1000 words. It is getting a bit long for a blog post; even by me. I will try to finish up by tomorrow.

ISCD Updates Whistleblower Information

Today the DHS Infrastructure Security Compliance Division (ISCD) updated the landing page for the Chemical Facility Anti-Terrorism Standards (CFATS) program, providing more information on how someone can report various concerns about the implementation of the CFATS program at facilities around the country. The new information includes:

• Links to a new ‘Reporting CFATS Violations’ web page;

• Links to a new ‘Report a Violation’ flyer;

• A new email address that can be used to report violations; and

• A brief blurb on the landing page describing all of the above.

Other than the email address there is no new information here. There is an understandable minor expansion of what can/should be reported; the new documentation specifically identifies failure to submit a Top Screen (which is, for some reason, not actually named in the flyer) as one of the things that should be reported to ISCD. That was never specifically mentioned in earlier discussions about CFATS’ violations reporting.

The new version of the landing page also provides a link to another ‘new’ page and an older document. The ‘new’ page is ‘Actions to Improve Chemical Facility Safety and Security - A Shared Commitment. It is dated December 16^th, 2016, but this is the first time that I have seen it. The document linked to from that page is the final report on the response by EPA, OSHA and DHS to the President’s (Obama) Executive Order on Chemical Safety and Security (EO 13650). That reporting document was published in May 2014 and I commented on it soon after.

Whistleblower Problems at CSB?

Yesterday the House Committee on Oversight and Government Reform published a notice that they would be holding a hearing on Thursday concerning “Whistleblower Reprisal and Management Failures at the U.S. Chemical Safety Board”. No other information is available on the Committee web site at this time.

I cannot find any news mentions of a whistleblower case involving the CSB. The CSB has attracted the ire of many within both the Executive Branch and the Congress for their apparent concentration on the lack of action the two branches have taken on recommended chemical safety issues rather than solely concentrating on determining the physical root cause of major chemical accidents. I hope that this hearing is not a response to that anger.

Reader Follow-up – NPPD Complaint

John Doe sent a short note yesterday that was an obvious follow-up to my comment in the blog post this weekend that he sent his complaint to the wrong (okay ‘less effective’ would be more appropriate rather than ‘wrong’) Senator. This new email provided a distribution list that the letter I received had been sent to. The list includes three Senators and two Congressmen and a prosecutor at the DOJ.

Now I’m not going to publish the list here, I don’t think it will do any particular good, but it does present a chance to discuss a little practical politics. First off, not all congresscritters are created equal and the ranking of political power has a lot to do with the issues involved. Now if you’re Average Joe Citizen having problems with a Federal agency, this probably isn’t too much of an issue. But if you’re taking on a dysfunctional agency with a view to correcting wide spread systemic problems, then you need to attract the interest of political power.

Pick Your Time

Filing your complaint in the closing days of a politically confusing Congress practically ensures that the message will be lost, particularly in a year when there are all sorts of high priority pieces of legislation that are already competing for political action. If you send your complaints to congresscritters that won’t be in town for the next Congress, you are certainly wasting your time.

It would have been much better if John Doe had saved his missive until after January 3^rd. Many of the same issues will be facing Congress (and some new ones, of course) but there won’t be the same time pressure.

Pick Your Committee

Committees are where the work of Congress gets done; so one needs to pick the appropriate Committee. Normally, there is a single committee in each house of congress that has oversight responsibility for any particular federal program. Unfortunately, that is not the case with the CFATS program (or DHS in general); both the House Energy and Commerce Committee and the Homeland Security Committee claim some oversight responsibility, but the only Committee that appears to have any real power is the House Appropriations Committee. And there is, of course, the Senate Homeland Security Committee and the Senate Appropriations Committee.

Next you need a Committee head (or maybe ranking member) that doesn’t particularly like the agency involved. If the head of the Committee firmly supports the agency, there is little likelihood that any significant action will be taken. In this case, three of the five Committees are generally behind ISCD; they may ask public questions about efficacy but they have no history of actually taking action to deal with problems.

The only Committees that have actually taken action against the CFATS program are the two appropriations committees. Both have voted to reduce funding (much more in the case of the House) for ISCD as a method of catching the attention of DHS leadership. Unfortunately the message was interrupted the larger political picture, but it will probably come up again next year when Congress tries to pass a spending bill for the remainder of the fiscal year.

Finally, you have to select the person within the Committee to make the most effective contact. That is generally the Committee Chair or Ranking Member, but it is frequently a Sub-committee chair, particularly in the appropriations committees. Now if you happen to have a personal connection to the head of the committee staff that would even be better.

The Press Alternative

The great American whistleblowers have all utilized the press as an alternative to working within the system. While my ego would like to think sending a copy of the letter to me was such an attempt, my blog is not large enough to get the kind of attention that would be needed to overcome political inertia. No, one would need to contact a writer at a nationally distributed publication to become one of the great American whistleblowers. In this case there are a couple that have already broken similar news about ISCD, they would be the ones to contact since they have already done some of the research needed to verify the complaints.

Moving Forward

Well I have had lots of readers look at this particular post so there is some possibility that Congressional attention will be directed at these and other ISCD issues in the coming year. We’ll need a lot more information getting to Congressional staffers before anything concrete will happen.

DHS Updates Chemical Security Web Page

Sometime last Friday afternoon (after I last looked at the page for the day) DHS updated their Chemical Security web page. Nothing major, they moved the CFATS Whistleblower Hot Line (okay, they call it the CFATS Tip Line) information from the ‘I Want To…” block near the top of the page to the more permanent and prominent block along the right side of the page. Not quite ‘black boxing it’ like I suggested last week, but this does make it easier to find.