Slow pace of CFATS implementation

Well the last working day of September 2007 has come and gone. If the DHS website it to be believed, the notifications have gone out to the first chemical plants to complete Security Vulnerability Assessments (SVA). According to the latest data publicly available, Congressional Testimony on July 24th, there are at least 194 facilities that have completed their Top Screen process and could be determined to be at high risk for terrorist attack and thus required to complete an SVA. For many reasons DHS is being spectacularly uncommunicative about the progress of implementation of the CFATS regulations.

 

One thing we do know is that on their public web site, where they have posted extensive documentation on CATS registration, CVI requirements, and Top Screen completion, there are no instructions about how to complete the SVA, other than the general comments on the FAQ page. Now this is either because DHS is restricting access to these instructions (a possibility) or there are no instructions available (more likely). In either case, DHS is doing little to make the critics or supporters of CFATS feel good about the pace of implementation.

 

While I understand that a certain amount of secrecy and discretion is required in the implementation of any security program, DHS is providing too much ammunition to its critics, especially those that accuse DHS, and the Bush Administration in general, of collusion with industry. These are the people that are in favor of nationwide implementation of New Jersey like regulations that favor elimination of all hazardous chemicals and public disclosure of all security plans. If the current management of DHS wants to be forced to implement these types of regulations, then they need to do nothing more than continue on their current course of obfuscation and foot dragging.

 

DHS needs to be more forth coming in its implementation of CFATS. There needs to be a public acknowledgement about the numbers of facilities that have completed the Top Screen and the relative number that have been declared high risk facilities. If there have been any facilities that have been less than cooperative on completing the Top Screen requirements, that number should also be disclosed. The date of official notification to complete the SVA for the first set of high risk facilities should also be disclosed. No one should expect DHS to disclose names or even general location of facilities, but there is no security justification for not disclosing numbers at this point.

 

Finally, DHS needs to be more publicly forthcoming about the reasons behind the delays in announcing the final version of Appendix A, DHS Chemicals of Concern. The vast majority of chemical facilities in the United States are not going to join CFATS implementation until they are required to do so and are waiting for the final version of Appendix A to provide the necessary notification. The chemical industry and the public deserve to know why DHS is dragging its feet in publishing this crucial document.

Tags: Chemical Facility Security, SVA implementation, Appendix A delay

Threat communication

By now, just about everyone has seen the video of simulated hackers destroying an electrical generator or read the news reports about the video. Now, according to an Associated Press article yesterday, that video, the “Aurora Generator Test”, was shown to people at a trade convention in Atlanta last March, shortly after it was made, without proper authorization to disclose the classified, “For Official Use Only (FOUO)”, information. The government had to go back and notify the people that were shown the film that it was classified. Apparently, the unnamed DHS employee that showed the film to a select group of industry researchers felt that they needed to understand the vulnerability that the electrical grid could face in order to be able to develop appropriate countermeasures. Nothing has been publicly said about whether the employee was punished for this “Leak”.

 

This goes hand in hand with my earlier blog, “How do we know we are protected?”, in examining the bounds of the conflicting demands between information security and the dissemination of information required for development of adequate physical security measures. This is an issue that will come up again and again in communicating threat assessment information to chemical facilities. If too much threat intelligence is communicated to the multitude of chemical facilities that might have to respond to the potential threat, some of that information is going to make it into the press. On one hand that may help to prevent attacks; as terrorists realize that their potential operation is compromised, but it will also allow the terrorists to realize that their security has been breached and take appropriate corrective measures.

 

While section 27.215 of 6 CFR requires each covered facility to make a threat assessment as part of their Security Vulnerability Assessment, most organizations are ill prepared to do so. While the Exxons and Dow Chemicals may have intelligence gathering and assessment capabilities, most organizations do not. Chemical facilities are going to have to rely on government agencies, local, state and national, to supply that expertise. Most of the detailed information will be classified at a much higher level than CVI (Chemical Vulnerability Information) or even FOUO and will thus be unavailable to most chemical facilities.

 

Perhaps DHS should modify their CVI information protection system to include threat assessment information disseminated by DHS. Appropriate intelligence information could be cleaned up so as to avoid the most egregious disclosures of collection means and methods (what intelligence agencies want most protected) and then sent out to the applicable facilities. The person responsible for the CVI program at each facility would then become a CVI Security Officer instead of just a point of contact, since they would then also be responsible for the security of information provided by the government rather than just the information provided to the government. The disclosure of CVI at the facility level would have to be more formally controlled than currently planned, but would still not require the level of controls necessary for Classified Documents.

 

Intelligence information is going to have to flow from DHS to chemical facilities if the security at those facilities is going to be adequately maintained. Proper protection of facilities from terrorist attacks will require some level of knowledge of terrorist interests and capabilities. The mechanism for this intelligence transfer need to be established now, as chemical facilities are starting to work on their SVA’s and well before they start developing their Site Security Plans.

Tags: Chemical Facility Security, terrorist intelligence, intelligence information protection and dissemination, threat assessment

Chemical warfare agent injures over 100 in Nevada onion field

News reports out of Reno, NV describe over 120 farm workers being treated at local medical facilities for exposure to chloropicrin, an agricultural chemical that was used as a chemical warfare agent in World War I. The chemical had been spread on a field on Monday and a Wednesday temperature inversion kept the fumes close enough to the ground that workers in an adjacent field were overcome by the fumes; at least two were unconscious but breathing when emergency personnel arrived at the scene.

 

According to the Columbia Encyclopedia, Chloropicrin (CCl₃NO₂) boils at 112° C with partial decomposition to phosgene and nitrosyl chloride. According to a Cornell University Pesticide Profile the half life in air-sunlight is 20 days and the product is normally provided in cylinders or tanks that can be pressurized. According to E-Medicine.com and exposure level of 1 ppm (in the air) causes eye irritation, 4 ppm may incapacitate, and 20 ppm causes lung damage. While this chemical would probably not produce a huge number of deaths in a terrorist attack, the victims would hurt be badly and require extensive treatment for their wounds. Clean up would not be easy. Chloropicrin sounds like a good terrorist chemical weapon.

 

All in all it is easy to see why DHS has this chemical listed in the chemical weapons section of the Top Screen with no minimum level listed for the Screening Threshold Quantity (STQ) in the proposed Appendix A to 6 CFR part 27. How many farmers or agricultural suppliers holding this material were notified by mail when the June 2007 notifications went out to the 50 facilities that are, to date, the only facilities required to submit Top Screen information; almost certainly none. The users and probably manufacturers of Chloropicrin will not be required to start the CFATS process until Appendix A is approved. Isn’t it about time that this Appendix gets the required political approval?

Tags: Chemical Facility Security, Chemical Warfare Agent, Appendix A to 6 CFR part 27, chloropicrin

Another state to check security at chemical plants

According to a story on a Boston, MA television station, Massachusetts may become the second state to have a formal program to check security at local chemical plants. The report quotes a report issued Monday on a homeland security strategy for the state that will include “inspections of smaller chemical facilities”. The report cites the 2006 explosions at a Danvers, MA chemical plant as an example of why the additional checks are needed at smaller facilities.

 

While the Danvers explosions are still technically under investigation by the Chemical Safety Board, a preliminary investigation report cites the accumulation of heptane and isopropanol fumes in the manufacturing building as the source of the explosion. Neither of these chemicals is on the proposed list of DHS Chemicals of Interest (Appendix A to 6 CFR part 27), so it does not appear that the Danvers facility would have been regulated under the Chemical Facility Anti-Terrorism Standards (CFATS). While this was an accident, with the number of houses and local business buildings destroyed and damaged, this could have been a very successful terrorist attack.

 

If DHS cannot include plants like the Arnel Chemical Plant or the Barton Solvents facility that burned in Wichita in their extensive list of chemical facilities to be regulated, and political constraints from Congress do seem to prohibit that, may be the individual states do have the responsibility to protect their citizens from potential attacks against these facilities. First New Jersey, then Massachusetts; keep an eye on California, I expect that they may be next. It will be interesting to see what regulations Massachusetts puts into place to follow their new homeland security strategy.

Tags: Chemical Facility Security, state programs, Massachusetts to check chemical plants

How do we know we are protected?

Is a million plus gallon tank of ethanol a potential terrorist target? Perhaps, but we will not know for sure until it is attacked. Is it covered under the new Chemical Facility Anti-terrorism Standards (CFATS)? Probably not since ethanol is not one of the chemicals listed in the proposed Appendix A, DHS Chemicals of Interest, to that regulation nor has it been publicly designated a chemical of interest like LPG or gasoline refineries. Almost certainly not if that tank is a barge floating up and down the Columbia River transporting ethanol to market; CFATS does not cover chemicals in transit. Perhaps the maritime security rules apply….

 

According to a recent article in the Tri-City Harold (Kennewick, WA) a newly refurbished barge, the New Vision, is being put into just such service; delivering ethanol from a plant in Boardman, WA. The barge is double hulled to help prevent fuel leaks to the river, in line with new federal fuel transport rules. This is especially commendable since a leak of ethanol into the river would be virtually undetectable and impossible to clean up since ethanol is completely soluble in water.

 

What is not covered in the article is what precautions have been taken to protect this barge against terrorist attacks. A large enough mine attached to the hull, a bomb placed in the space between the two hulls, or even a high speed bomb-boat could turn this barge into a very large explosive device or just poison the river all the way to the ocean. What kinds of precautions have been taken to prevent such attacks? If properly protected, we will never know because security people do not broadcast their preparation for very legitimate reasons. If not protected we will never know because the company would not admit to such gross dereliction of their corporate responsibilities.

 

The only way that we can be assured that the necessary protections are in place is by placing trust in the appropriate government agencies to check that such necessary safeguards are in place. In this case it would be DHS and probably the Coast Guard that would have that responsibility, though I’m not certain that current maritime security rules apply to barges on inland waterways; it’s not my specialty so I just do not know.

 

It would be nice if DHS had an outreach program that would assure the people living and working along the Columbia River, in this case, or around chemical facilities in general, that the government is working with the companies involved, ensuring that the appropriate security plans and devices were in place, letting the public know that there was adequate inspection and enforcement activity taking place to ensure compliance with the rules, and finally assuring the public that the rules on the books would provide reasonable protection against a terrorist attack. I do not think that DHS has such an outreach program.

 

I know that DHS cannot tell us which chemical plants are covered under the CFATS rules; that would tell the terrorists what the largest targets are. Neither can they tell us which facilities are having problems implementing their programs; that would tell the terrorists the easiest targets. But they could tell us how many facilities have been directed into the Top Screen Program and how many additional facilities have been voluntarily provided data to that program. They could tell us how many of those facilities have been determined to be at high risk of terrorist attacks. And perhaps, even more appropriately, the could tell us what chemicals are actually of interest to DHS and under what quantities; DHS needs to publish a final version of Appendix A so that chemical facilities across the country know who should be covered under the rules.

Tags: Chemical facility security, ethanol barge target, implementing CFATS, public perceptions of safety

DHS responds to agriculture and propane industry complaints

There has been some organized resistance to the inclusion of propane (at an STQ of 7,500 lbs) in Appendix A to 6 CFR part 27. The propane industry has lead this resistance with a comment campaign in the initial comment period for the appendix and has enlisted various agricultural organizations and their supporting Senators in the campaign to get a propane exemption since then. To date DHS has had very little to say in response other than they were looking into the comments. Today, DHS officially responded with a page on their web site.

 

The page reviews the industry claims and re-affirms that DHS is reviewing the comments that it received in the regulatory process and will make changes as appropriate. The site reiterates that it only intends to regulate high-risk chemical facilities, not isolated poultry farms. It objects to an AP report that claims 40,000 farms would be affected, responding that they only expected 50,000 total facilities to be affected during the first three years of the program.

 

Further, the web site maintains that only those farms storing more than the STQ would have to complete the Top Screen to allow DHS to evaluate the potential risk. The web page describes the Top Screen as a “‘Turbo Tax-like’ online tool that is extremely user friendly”.

 

Given the political rhetoric and threats (Senators threatening to withhold funds for enforcement) employed by the propane industry, this reply by DHS is very mild and probably less than effective; especially since it is buried in the DHS site. Hopefully, they will be replying in a little more public, or noticeable venue in the near future.

Tags: chemical facility security, dhs web site, propane industry campaign,

DHS adds Frequently Asked Questions (FAQ) page to website

During an earlier blog I mentioned that DHS had made some changes to two CSAT web pages. There was a second change made to the Chemical Security Assessment Tool web page that I missed in that blog; DHS added a hyperlink to a Frequently Asked Questions (FAQ) page. 

The new Chemical Security Assessment Tool Frequently Asked Questions page is one of the longest (105 pages in an MS Word document in 10 pt type) and most comprehensive FAQ pages that I have ever dealt with. To make navigation of this page easier DHS has included an integral search feature at the top of the page and a list of categories of questions through which the user can browse. The only major defect that I have found on the page is the lack of a “last modified” date on the page. This will make it nearly impossible to determine if/when DHS makes changes to the page. This could be easily corrected by adding such a date when they do make a change.

 

I have briefly reviewed each of the answers provided and could only find 3 items that caught my attention; questions 55, 800, and 803. Question 55 deals with user fees; the answer states that DHS is considering the use of user fees; “including filing fees, fees for inspections and audits, and fees for screening of individuals against the Terrorist Screening Database”. Question 800 addresses tier levels; the answer refers to tiers 5 and 6 being assigned to facilities that did not meet the requirements of a High-Risk facility. Question 803 deals with notifications to complete SVA’s; the answer mentions that in September 2007 the initial notifications will be going out tofacilities that need to complete SVA’s.

 

User Fees

 

DHS might include such user fees in future rule making. To many members of the regulated community, user fees add insult to injury; it being bad enough that a facility is required to accept the ‘assistance’ of a government agency but they would also have to pay for that assistance. On the other hand, this is just about the only way that the government has to insure that the people who most obviously derive benefit from a regulation pay for it. In this case the assumption would be that the facility owners and their customers derive the most direct benefit from preventing terrorist attacks on the facility. Legitimate arguments could be made on either side of this assumption. As long as the fees are not too high, they may be politically necessary.

 

Tiers 5 and 6

 

Everything that I have read to date in the regulation and supporting documentation refers to four tiers with Tier 1 being the highest risk facilities in the group of High Risk Facilities and Tier 4 being the lowest that still meets the High Risk standard. Adding tiers 5 and 6 could allow DHS to extend the regulation of chemical facilities to lower risk groups if and when Congress changes their mandate. This would help to reduce the number of facilities that had to re-screen if Congress did allow DHS over site of less than High Risk facilities. This would also allow DHS to better categorize facilities that were required to complete the Top Screen, but did not meet the requirements for High Risk facilities.

 

SVA Notifications

 

I have been wondering if DHS would tell us anything more about the progress of the CFATS implementation. This is the first indication that I have seen of any movement beyond the Top Screen Process. It will be interesting to see if DHS provides information on their web site about the SVA procedure or just rely on the notification process to let only the people concerned learn more about the SVA process. I am hoping that they will publish the SVA questions and instructions much the same way that they dealt with the Top Screen. DHS has made it clear that they do not intend to share the details of how they evaluate the Top Screen or SVA data to determine the final risk tier assignment. Their argument that that information could provide terrorists a way to evaluate potential targets does not sit well with many people. Providing more details about how the information is to be collected may help to alleviate some concerns that these opponents have. DHS needs to provide as much information as possible, consistent with protecting facilities and their neighbors from the affects of a successful attack.

 

As I said earlier, this is one of the most extensive FAQ sections that I have seen and I particularly like the search provisions. A few of the answers provided are less than helpful, but that is to be expected in such a comprehensive list of answers. Hopefully, DHS will continue to upgrade its site in general and the FAQ section in particular.

Tags: chemical facility security, DHS Web Site, Frequently asked questions