Chemical-Terrorism Vulnerability Information – who will be involved?

The Chemical Facility Anti-Terrorism Standards (6 CFR part 27) require many facilities to provide information to the Department of Homeland Security (DHS). Most of that information will deal with security concerns and vulnerabilities at the facility and some of the information will potentially contain commercial information that would be of use to the facility’s competitors. In order to protect this information from inadvertent disclosure, to terrorists or competitors, DHS has developed a set of standards to protect this sensitive, but not classified, material called Chemical-Terrorism Vulnerability Information (CVI).

 

While the rules affecting CVI are directed mainly at government agencies (Federal, State, and Local) and contractors working for those agencies, they also affect the facilities that generate much of the data. Any facility that is required to generate a Top Screen submission under Section 27.200 of 6 CFR part 27 is going to be required to generate, receive and maintain files that should be protected under the rules for protecting CVI. These files include:

 

1. Security Vulnerability Assessments (SVA);
2. Site Security Plans (SSP);
3. Documents relating to the Department's review and approval of SVA’s and SSP’s, including Letters of Authorization, Letters of Approval, and responses to them;
4. Written notices and other documents developed to comply with the interim final rule;
5. Alternative Security Programs;
6. Documents related to inspections and audits;
7. Notices of deficiency;
8. Records of training, exercises, and drills;
9. Incidents and security breaches;
10. Maintenance, calibration and testing of security equipment;
11. Objections and appeals;
12. Records required to be created and maintained by regulated facilities;
13. Sensitive portions of orders, notices, or letters;
14. Information developed pursuant to the Top-Screen process; and
15. Other information designated as Chemical-terrorism Vulnerability Information by the Secretary.

 

Most of the 40,000+ facilities that will be completing the Top Screen will have only a minimal number of documents that fall under the CVI rules. If the facility received an official letter requiring them to complete a Top Screen; that letter would be maintained in CVI files. Copies of the facilities CSAT Registration documents probably should also be filed in these files.

 

A copy of the completed Top Screen Questions workbook used to prepare for filing the on-line Top Screen submission would also be included in the CVI files. The inventory documents that a facility uses to prepare the Top Screen are not considered to be CVI as they are not provided to the government. A high-risk facility would probably want to give these documents similar internal protection to those required by CVI since they would help to define the potential targets for a terrorist, but they would not receive the legal protection of CVI.

 

Most facilities will receive an notification (either immediately after completing the Top Screen on-line or via a letter from DHS) that they are not considered a High-Risk Facility (and are thus exempt from further requirements of 6 CFR Part 27) and a copy of that notification should be maintained in the CVI files for that facility. The only other documents that these less than high-risk facilities will have to maintain would be the records for personnel completing the on-line training for CVI rules.

 

At least one person at each facility will need to have completed the CVI training so that they understand the safekeeping and disclosure rules involved with CVI documents. For facilities that are not designated High-Risk facilities that person would probably be the person for maintaining the other environmental, health and safety files for the facility. Anyone else who’s duties would include routine handling of CVI files should also receive the training as would anyone who is required to coordinate security issues with anyone outside of the facility.

 

For those facilities designated by DHS as High-Risk facilities will have significantly more people dealing with CVI documents on a routine basis. Future blogs will address the additional people required to be CVI literate at those facilities.

Tags: Chemical Facility Security, Chemical-Terrorism Vulnerability Information

House to hold CFATS Hearing

The House Homeland Security Committee announced that it would be holding a hearing on December 12th to review CFATS implementation. The last time that this committee addressed CFATS was in July of this year. Col. Bob Stephan, Assistant Secretary for Infrastructure Protection has been invited to testify. Secretary Stephan is responsible for the implementation of CFATS in DHS.

Additional invitees include two people that can be expected to be less than satisfied with the way DHS is proceeding in securing the chemical industry. They are Mr. Gerald C. Setley, Vice President, Region 3 Director, ICWUC/UFCW, and Mr. Gary Sondermeyer, Director of Operations, NJ Department of Environmental Protection. Unions have been opposed to the CVI rules and the fact that they feel they are being left out of the security planning process at chemical facilities. The NJ DEP is concerned that the Federal rules might supplant New Jersey’s efforts to secure the chemical facilities within its borders and wants the Federal Government to mandate replacement of hazardous chemicals where possible.

Three other invitees round out the people that will be testifying and are to be expected to be more supportive of the current DHS efforts. They are Mr. Clyde Miller, Director, Corporate Security, BASF Corporation; Dr. M. Sam Mannan, PE, CSP, Mary Kay O'Connor Process Safety Center; and Artie McFerrin Department of Chemical Engineering, Texas A&M University System.

Generally speaking, Chairman Thompson has been less than satisfied with the performance of DHS in general and with the progress DHS has made on the Chemical Security issues. I expect that there will questions about the lack of speed with which DHS published the revised Appendix A to CFATS and the resulting delays in getting SVA’s and SSP’s done on the great majority of facilities covered under CFATS. There will also be questions about the perception that most of the changes made to STQs were to the benefit of industry.

The tone of this hearing may provide some indications about the direction of chemical security legislation next year. There are a number of politicians that are still trying to get a more comprehensive chemical plant security bill through congress and this is the key committee in the House of Representatives for action on that type of bill.

Tags: Chemical Facility Security, congressional hearing, CFATS progress

CSAT Registration Review – Facility Information

In an earlier blog we looked at the people involved in the CSAT process and discussed how that affected the registration process. While it is important for DHS to know who will be involved in the CSAT processes, it is even more important for the evaluation of Top Screen data for DHS to know where the facility is located. Identical amounts of the same release hazard chemical stored in an urban area or out in the countryside will have a different level of risk of terrorist attack associated with them. This is the reason that facility location is an important part of the registration process.

 

Note: the following information can be found in the CSAT User Registration User Guide on the DHS web site.

 

The first area of the Facility Information Screen on the CSAT Registration has two fill-in blocks. The first calls for the Notification Code. This is a code supplied by DHS if the facility has been directed to complete a Top Screen submission by a DHS letter. The Notification Code helps DHS track compliance with letter directives to complete Top Screen Submissions. This will not normally apply to facilities that will complete a Top Screen submission due to having a Chemical of Interest (COI) listed in Appendix A to 6 CFR part 27 in an amount excess of one or more of the listed STQs for that chemical. Absent a DHS letter, the Notification Code will be left blank. The other fill-in block in this section is the Name of Organization; the legal name of the parent company is placed in this block.

 

The remaining section of the Facility Information Screen deals with the location of the facility. The first seven fill-in blocks are commonly supplied information; the name of the facility and street address of the facility (to include the county in which the facility is located).

 

Then next two fill-in blocks provide for recording the digital (to five decimal places) latitude and longitude for the facility. The screen provides instructions and links to the Microsoft TerraServer web site to determine the latitude and longitude. It also provides a link to the Google Maps web site to double check that the latitude and longitude reported actually points to the location of the chemical facility. The Google site automatically changes the entered latitude and longitude from the digital to the minute/second format. The DHS site only accepts the digital format. This means that the data should be recorded from the TerraServer site.

 

The first point worth noting on recording the data on the Facility Information Screen is that the first block on the DHS screen is for reporting latitude and the first block on the TerraServer web site is longitude; make sure the right information goes in the correct block. The second point is to ensure that the facility location is reported in the proper hemisphere of the globe; a negative sign must precede the number reported for the longitude.

 

The final fill-in block on the Facility Information Screen is a block for providing an alternative written description of the location. This would be useful for a facility that is located on another company’s site or where only a portion of a larger site has been designated as the chemical facility covered under the CFATS regulations.

 

When a single submitter is registering a number of facilities, the location data for the next facility can only be entered after completing the Preparer Screen (the next screen in the Registration sequence). At the bottom of the Preparer Screen is an Add Another Facility button to lead to the next Facility Information Screen. Subsequent Preparer Screens have an additional question; “Is the information for the Preparer for this facility already entered from a previous facility?” Selecting the Yes button allows bypassing some of the repetitive data entry tasks on the Preparer Screen; double check that the information auto-filled is for the proper Preparer.

 

After the Preparer Screen has been completed for the last facility to be registered the Complete button on the bottom of the screen should be selected. The system will then prompt you to save the form as a .PDF file. Once saved, the file should be printed and signed by the Authorizer, Submitter and all Preparers listed on the registration. Minor errors can be hand corrected (and initialed) on the signed copy of the registration. The signed document should then be mailed or faxed to DHS. A copy of the registration document, a copy of the signed document, should be maintained in the facility security files (more about security file requirements in a future blog). Once DHS receives the document they will email the Submitter and each Preparer a unique User Name and Password. That information will be necessary for all future access to the CSAT system for the registered facilities.

 

Once the registration process is complete the facility can start to worry about completing the Top Screen. When changes inevitably have to be made to the facility registration due to personnel changes, follow the procedures listed in the CSAT User Change Request Guide.

Tags: Chemical Facility Security, CSAT Registration, Facility Location Information

Who should pay the cost of security?

Last week there was an interesting editorial discussion about the cost of implementing the newest round of Chemical Facility Anti-Terrorism Standards (CFATS) Top Screens and the follow-on SVA’s and SSP’s due to the recent release of the final version of Appendix A to 6 CFR part 27. The editor of GSNMagazine.com, Jacob Goodwin, started the discussion with his outlook on the recent DHS cost estimates of compliance with the new final rule for Appendix A (the same estimates that I discussed in my recent blog). This was followed by a response by the editor of HSDailywire.com, Ben Frankel.

 

Both editors appeared to accept the figures DHS provided in the Federal Register Notice; figures that I believe greatly underestimates the number of respondents required by the new rules and thus under count the ultimate cost of those responses. Even with that apparent underestimate, both editors agree that the cost is very large, especially since it did not include the costs associated with implementing the security programs developed under the CFATS rules. Both also agree that the cost of not securing these high risk chemical plants is unacceptably high.

 

Goodwin concludes his editorial by wondering “Does the risk of a terrorist attack on a chemical plant justify this huge investment in manpower and dollars?” and then responds to his own question that the answer is not clear. Frankel, on the other hand, believes that the answer to that question is clearly yes; it is worthwhile. What Frankel questions is why the chemical industry should pay for the security costs when it is the public that gains the benefit of that security suggesting that: “The government may pay for this measure of public good by direct subsidies to plants to improve their security,giving them tax breaks, or in other ways.”

 

I’m sure that there were similar discussions about the costs imposed on the chemical industry in the wake of Bhopal when the OSHA and EPA chemical process safety regulations were put into place. Wouldn’t it have been fair for the government to pay for the costs associated with putting safety processes into place since it would have been the innocent public that would be saved by stopping unsafe chemical releases? No, the government decided then that the costs of chemical process safety should be a cost of doing business.

 

Making process safety an integral part of a chemical company’s business forces those companies to take long hard looks at their process. The costs of safety procedures and devices become part of the business analysis process. If those costs raise the cost of manufacture too high, then the company has to re-evaluate the decision to proceed with that product. In my twelve years of process chemistry work I know of a number of projects that were scrapped because the safety controls were too expensive. Unsafe processes were avoided and the company, the employees and the public were protected as a result.

 

The same thing will happen with security issues if companies must bear the costs associated with adequate security measures. If the use or quantity of a specific chemical places too high a cost burden on the products manufactured with that chemical, the company will have to re-evaluate the use of that chemical or the quantity of that chemical kept on hand. If the market place is willing to pay the security premium, the product will be made; if not, the security problem will disappear as that chemical is replaced with one with a lower security cost.

 

What we must realize as a society is that chemical facility security is not a static, one-time solution to a problem. We will improve security at high risk chemical facilities and, if we do nothing more, terrorists will, sooner or later, figure out a way around those security measures at one or more facilities. To protect against these attacks we must continue to refine and improve our security techniques and procedures. If companies have to pay the costs of their security procedures, they will continue to refine and improve their techniques and procedures so that they can contain/reduce their costs.

 

If the government subsidized the general security costs of chemical manufacture there would be no incentive to decrease those costs. There would be no incentive for companies to find replacement chemicals with lower security costs. There would be no incentive for companies to develop chemical processes that are inherently safer with lower security costs.

Tags: Chemical Facility Security, cost of security, who pays the cost of security

Hole in Propane Rules

The recent publication of Appendix A, 6 CFR part 27 establishes the rules for determining which chemical facilities are required to submit Top Screen data to allow DHS to determine which chemical facilities are at High-Risk for terrorist attack. The rules for all but one flammable release chemical are internally consistent; 10,000 lbs of the listed flammable liquid/gas on site and the facility is required to complete a Top Screen on-line filing with the DHS. In an earlier blog I explained that propane is the exception to the flammable release STQ. 

 

Instead of the 10,000 lbs listed for other flammable release chemicals, propane has a 60,000 lb STQ. DHS set this STQ because this is the “estimated maximum amount of propane that non-industrial propane customers, such as restaurants and farmers, typically use” (page 43, Final Rule Appendix A). Furthermore, facilities are not required to count propane stored in tanks that can store less than 10,000 lbs of propane when determining if they meet the 60,000 lb STQ. This was done out of a “desire to exclude farmers and agricultural users of propane who routinely have three or more propane tanks for heating their homes and/or their chicken/turkey houses” (page 44).

 

In other words DHS set a special STQ for propane because they realized that propane is fundamentally different than most of the other chemicals listed in Appendix A to 6 CFR part 27. Most of the other chemicals are industrial chemicals; used in quantity only in an industrial setting. While propane is used in an industrial setting, principally as a fuel, it is also found in commercial, retail, and even residential facilities. Unfortunately, DHS (for political reasons apparently) decided that this made propane less hazardous; they were completely wrong.

 

A recent incident in Lynchburg, VA illustrates how wrong DHS was in setting a higher than normal STQ for propane. On Monday, November 26th, a car ran into a 1,000 gal propane tank in the parking lot of a hardware store. The collision caused the tank to rupture, leaking propane into the parking lot. Due to quick reactions of on-lookers, first responders, and power company personnel there was no source of ignition to cause the propane cloud to detonate in a violent fuel-air explosion.

 

If this had been a terrorist attack, instead of an accident, there would have been an ignition source (a simple incendiary device) in the vehicle that would have gone off two or three minutes after the collision and no one would have been able to prevent the fuel air explosion in that parking lot. The explosion could have left hundreds of people dead or injured in that commercial district from the primary explosion and the possible secondary explosions of fuel tanks in cars parked near by. It would have been a cheap, easy and effective terrorist attack.

 

These 1,000 gallon tanks (less than 5,000 lbs of propane when full) are common around the country. They are found on farms and ranches, in people’s yards, in shopping centers, and in parking lots at hardware stores. Most people would agree that breaching a tank and detonating the gas cloud on a chicken ranch would not rate high on a terrorist target list, but shopping centers and restaurants would probably be good terrorist targets.

 

Once this round of Top Screens is completed in January, DHS should seriously reconsider the STQ for propane. While a large number of rural propane tanks would not make the High-Risk facility cut off, a similarly large number of tanks at commercial facilities might make that cut. Just like other chemical facilities, DHS needs to be able to evaluate the potential riskfrom these 1,000 gal propane tanks on a facility-by-facility basis.

Tags: Chemical Facility Security, commercial propane use,

CSAT Registration Review – The Players

With the large number of facilities (40,000+ by DHS estimates) that will now be required to complete the Top Screen, it seems like a good time to review the hardest part of the Chemical Security Assessment Tool (CSAT) to understand, the registration process. CSAT is the online tool that DHS will use to accept, review and evaluate all information pertaining to the security situation at a chemical facility. The registration process is the way that DHS gets the facility entered into CSAT, determines who at the facility is authorized access to CSAT, and allows DHS to provide secure access to those personnel.

 

 Actually the registration process is easy to understand once one gets past the roles of the four different players involved in the registration process; the Preparer, the Submitter, the Authorizer, and the Reviewer. Good, legal definitions of these four roles, along with instructions for completing the registration process, can be downloaded from the DHS web site. That lengthy .PDF document is the CSAT User Registration User Guide.  What follows is the stadium program version of the data on these important players in the CSAT game.

 

Authorizer:

 

The Authorizer is the person in the organization that has responsibility for facility security; either a corporate officer or a person appointed by a corporate officer. While the Authorizer does not directly enter or edit information in the online CSAT, he is responsible for signing the final documents certifying the identity of the Preparer and Submitter. The Authorizer must be domiciled in the United States. The Authorizer may full fill that role for multiple facilities in the organization, or there may be a separate Authorizer for each facility.

 

Submitter:

 

Again the Submitter must be a corporate officer or appointed by a corporate officer to fulfill these duties and must be domiciled in the United States. The Submitter may also be the Authorizer. The Submitter is the person that actually submits the information in the CSAT system. As such the Submitter will be provided with a Username and a Password by DHS after the registration process is complete. A single Submitter may be designated for multiple facilities within a corporation.

 

Preparer:

 

The Preparer is not required to be an officer of the corporation or formally appointed by an officer, though the Preparer must still be domiciled in the United States. The Preparer may also be the Submitter or Authorizer. The Preparer is the person that actually enters data into the CSAT, but is not authorized to officially transmit data to DHS. The Preparer will be issued a Username and Password by DHS. While the Preparer may serve that role for multiple facilities, the requirements for data preparation require intimate knowledge of the facility so the Preparer will most often represent a single facility.

 

Reviewer:

 

A Reviewer is a person that is authorized to look at a facilities’ data in CSAT but is not authorized to enter or change that data. There may be multiple Reviewers designated for a single facility and a Reviewer may be designated for multiple facilities. The Reviewer provides an additional set of eyes to make sure that submitted data is correct and allows for personnel at a facility to go back and look at CSAT data after it has been submitted.

 

Designating the Players:

 

What must be kept in mind when selecting the people to fulfill these roles in the CSAT process is that these are the people that will be dealing with the Top Screen Submission. For those facilities that end up being designated High-Risk Facilities, these people will also be submitting Security Vulnerability Assessments (SVA) and Site Security Plans (SSP) within CSAT. Careful thought should go into selecting and designating these roles.

 

Smaller organizations with only a single facility that will be required to submit a Top Screen will have an easier time making these selections. An Environmental Health and Safety Manager will probably fulfill the role of Authorizer; adding Security to the regulatory requirements covered by that individual. The facility manager will probably have the role of Submitter. Depending on the size of the facility that manager may also be the Preparer or that role may be delegated to another manager within the facility. There may be no Reviewers designated or that role may be given to a security consultant hired to help the facility complete the CSAT process.

 

For larger organizations with multiple facilities the situation may get much more complex. There may be a single Authorizer for the organization or there may be multiple Authorizers, each responsible for one or more facilities within the organization. The same holds true for Submitters and Preparers. There can only be a single Submitter and Authorizer on each registration, but there can be multiple facilities with a different Preparer for each facility or the same Preparer for two or more of the facilities all on one registration.

 

Each time a registration is completed the Submitter and Preparer(s) will receive a User Name and Password. To ease the problem of remembering multiple Usernames and Passwords there should be a single registration covering all of the facilities that a Submitter will be responsible for. These facilities will also have to have a single Authorizer. Since an Authorizer does not receive a User Name and Password, there is no reason that a single Authorizer cannot be on multiple registrations.

 

DHS has made provisions to change personnel within the CSAT system. The procedures are relatively simple and they have provided another large .PDF document, CSAT User Change Request Guide, to explain how to make these personnel changes, but that is the topic for another blog.

 

While the selection of Authorizers, Submitters, Preparers and Reviewers is an important part of the CSAT process, facilities should not take too much time in making these selections. Since the registration process requires physically mailing off a signed copy of printouts from the on-line registration process, and DHS will not provide the Usernames and Passwords until that mailed document is received, facilities need to complete the online portion of the registration process in an expedited manner. Facilities that have to submit a Top Screen due to possession of more than the Screening Threshold Quantity of a chemical(s) listed in Appendix A, 6 CFR part 27, have until January 18th, 2008 to complete that Top Screen. Not completing the Top Screen by that date due failure to get the Username and Password back in time due to late mailing of the signed registration documents (and remember that Christmas slows the mail) may result in a fine of up to $25,000 per facility.

 

Completing the registration process for CSAT is an important first step in complying with the Chemical Facility Anti-terrorism Standards (CFATS) outlined in 6 CFR part 27. While the registration has little to do with actual security situation at a chemical facility, it is the first step in the formal security assessment required by these new regulations.

Tags: Chemical Facility Security, CSAT Registration

DHS reports CSAT Data Collection Requirements

Yesterday DHS had a Data Collection Report for the CSAT published in the Federal Register. This is required any time that a federal agency requires the public (or businesses in this case) to provide data to that agency. The report lists who is required to provide information, the expected number of respondents and how much time will be required to provide the information. This report is required under the Paperwork Reduction Act (PRA) of 1995.

 

The table below summarized the data provided in the notice. It appears as if DHS is using a value of $87.81 per hour for determining their cost. I would assume that this value is dictated by the PRA.

 

	Registration	Top Screen	CVI Training	SVA	SSP
# Respondents	16,667	16,667	16,667	2,500	2,167
Hrs/Response	1	30	0.5	153	84
Total Hours	17 K	500 K	8 K	386 K	182 K
Total Cost	$1.5 M	$44.4 M	$0.7 M	$34.8 M	$14.6 M

 

The “Number of Respondents” data does not track with other information provided by DHS. On November 5th, Robert Stephan, DHS Assistant Secretary for Infrastructure Protection, told a news conference that the current estimate of the number of facilities that will be completing the Top Screen is “less than 50,000” and that about “5 to 8,000 facilities” will be classified as High-Risk Facilities that have to complete SVA’s. The Final Rule for Appendix A gives a figure of about 40,000 for the number of facilities expected to be required to submit a Top Screen based on the requirements of that Rule.

 

The difference between the SVA and SSP number is probably due to the fact that facilities that are put into the lowest High-Risk classification (Tier 4) may submit an alternative SSP outside of the CSAT system if they so choose. Given the discrepancy previously noted in the numbers for the Top Screen and SVA, this number also appears to be understated by a significant factor.

 

The assumption that only one person from each affected facility will be completing the CVI training is, in my mind, too low. Because most facilities will have little or no experience handling “classified” information, I would expect that at least two or three people from each facility would need to go through this training program to ensure that an adequate number of people understand the requirements for handling, storing, transmitting, and destroying this information.

 

The time allotted for completing the Registration and CVI training match well with my experience completing these requirements. I think that the estimate for completing the Top Screen is too high, unless DHS is including the data collection organization time. If that is true (and it would seem reasonable in keeping with the purpose of this report), then the time estimates for the Security Vulnerability Assessment (SVA) are an order of magnitude too low if you count total man hours involved in the SVA. Based on my experience with conducting Process Hazard Analysis (a similar type review for process safety) there will be at least four or five people per facility doing about 40 hours of work per chemical/process involved in the review. I would expect that a Site Security Plan would take at least as much time to complete as would the SVA.

 

Anyone wishing to make official comments on this report should send the comments to:

 

Office of Infrastructure Protection 

Attn: Matthew Bettridge 

Department of Homeland Security 

NPPD/OIP/CSCD Mail Stop 8100, DHS, 

Washington, DC 20528

Tags: Chemical Facility Security, CSAT Time-Cost Analysis