More information on fuel tanks

In a couple of earlier blogs I have mentioned the reference to reporting fuels in the Top Screen. The information in those blogs came from the CSAT Top-Screen User Manual (pages 34 and 36). Well yesterday looking at the DHS CSAT FAQ page I found some updated answers that were entered/updated this week. The questions are numbers 1370 through 1372.

 

First off, facilities do not have to declare fuels unless they have at least one Release Flammable COI in quantities above the STQ for that chemical. That means that a facility that has only Jet Fuel, Kerosene or Diesel in fuel tanks and no other flammable COI above the STQ, does not have to answer the fuel questions on the Top Screen.

 

The question is less clear with respect to gasoline. Gasoline is a blend of oil distillates with various additives. If any of the components of the gasoline mixture are listed on the Release Flammable COI (for example various butenes) and are present at more than 1% the gasoline may have to be reported;

 

·         If the gasoline is an NFPA 4 rated blend andmore than 10,000 pounds have been on site in the last 60 days, it has to be reported in the fuel question. The listed COI components in the gasoline do not have to be reported separately on the Top Screen.

·         If the gasoline is not NFPA 4 rated and it is stored in an above ground tank, the amount of gasoline would have to be reported in the fuel question if any of the listed Flammable COI components are present at more than 10,000 pounds (eg: 10% Concentration x 100,000 Pounds of Gasoline = 10,000 lbs of COI). Again, the listed COI components in the gasoline do not have to be reported separately on the Top Screen.

·         If the gasoline is not NFPA 4 rated and it is stored in a below ground tank, neither the gasoline nor the Flammable COI component needs to be reported in the Top Screen.

 

Other than refineries, most facilities are not going to be able to test for the presence of any of the Flammable COI in their gasoline. They are going to have to rely on the Certificates of Analysis (CoA) provided by the refinery or distributor. Anyone with 10,000 pound bulk storage of gasoline needs to insure that they require their supplier to include on the CoA the Flammable COI concentrations and the NFPA rating of each shipment of gasoline that they receive. Lacking proof to the contrary they are going to have to assume that they have an NFPA 4 rated mixture that contains more than 1% of one or more Flammable COI.

 

There is an interesting environmental component to this requirement. Ethanol is not a Flammable COI. The larger the concentration of ethanol in a fuel blend, the less likely that the blend will have 1% of any of the COI. If the equipment burning the fuel will allow for it, the facility could reduce their Top Screen reporting (and perhaps lower their risk rating) by requiring an ethanol-gasoline blend that would not require Top Screen reports.

Tags: Chemical Facility Security, Top Screen, Fuel Tanks

Update on Agriculture Top Screen Extension

Earlier this week in my “Top Screen deadline nears” blog I mentioned a letter that had been published on the DHS Web Site explaining a Top Screen filing extension (of indeterminate length) that DHS was giving to agricultural operations. Yesterday DHS published the same letter in the Federal Register as part of an official “Notice to Agricultural Facilities About Requirement To Complete Chemical Security Assessment Tool Top-Screen”.

 

Interestingly, this notice contains a new bit of information not provided in the original letter or mentioned on the DHS web site; this is not an all-encompassing extension. The notice includes this:

 

“For purposes of clarification, this time extension does not apply to agricultural facilities that are required to submit a Top-Screen, because they possess a COI (e.g., propane) at or above the applicable STQ for use as a fuel (e.g., for heating) at such facilities.”

 

Propane may not be that much of a problem. It has an STQ of 60,000 lbs. Furthermore, propane stored in tanks holding 10,000 pounds or less need not be counted in the STQ calculations ( 6 CFR § 27.203(b)(3)). Since these rules were specifically crafted to exempt agricultural users of propane, there should be a relatively small number of facilities having to complete the Top Screen based on the presence of this particular COI.

 

Unfortunately, propane is not the only fuel included in the Top Screen. In my earlier “Top Screen User’s Guide: Release COI” blog I noted that fuels, including gasoline and diesel, that are stored in above ground tanks (in excess of 10,000 lbs.) have to be reported on the Top Screen (pages 34 and 36 of the CSAT Top-Screen User Manual). This fuel provision may catch a larger number of agricultural operations that have significant fuel storage on-site for their equipment.

 

This brings up an interesting problem. If a facility received the original letter (“On December 21, 2007, the Department issued this letter to various interested parties.”) from DHS and relied on that letter to not submit a Top Screen (even though it possessed a fuel in excess of the STQ), would it be liable to fines of up to $25,000 per day after the January 22nd deadline? If another facility similarly relied upon the copy of this letter posted on the DHS web site, would it be liable for those fines? Technically the answer would be “Yes” since the Federal Register is the official publication of rules and regulations for the United States Government.

 

In any case, DHS is making the Top Screen more complicated by making these changes on the fly. I would like to think that the government will take this into account when they start to look at enforcement actions on facilities that did not meet the January 22nd deadline for submission of the Top Screen.

Tags: Chemical Facility Security, Top Screen Extension, Propane, Fuels

Why facilities have to worry about CVI?

Last month, before the House Subcommittee on Transportation Security and Infrastructure Protection, Clyde D. Miller; Director, Corporate Security; BASF Corporation, questioned why CVI rules should apply to people at the facility involved “even when people are only getting access to their own company’s information.” This is a question that is being asked at many facilities around the country as companies begin to move deeper into the CFATS program.

 

Having worked as a Staff NCO in both intelligence and operations in various Army units I have a tendency to equate CVI with classified information that I dealt with during my years in the Army. The purpose of classifying information at the levels I was working at was to deny the enemy information that would increase their probability of conducting successful operations against our unit. That is the same reason for ‘classifying’ information as CVI, to deny the enemy (terrorists) information that would increase their probability of successfully attacking a chemical facility.

 

When a military unit prepares an operation plan one of the things that the intelligence section does is to prepare a list of Essential Elements of Friendly Information (EEFI). This is a listing of specific types of information that, if discovered by the enemy, could allow them to determine the commander’s plan of the operation. Understanding the plan, the enemy could develop their own plan for a counter operation. Extra efforts are made to conceal and protect EEFI.

 

If one were to look at Table 1 (pages 5 thru 7) of the CVI Procedure Manual, they would see that this is the EEFI for the plan to prevent a terrorist attack on the facility. Many of these documents include information that was derived from facility records. That does not make those records CVI; it is the act of bringing the data together into an easily understandable record that turns that raw information into CVI.

 

The Top Screen, for example, provides a comprehensive list of the chemicals that could make the facility a target. Facility chemical inventories are not CVI; they are full of extraneous, non-hazardous chemicals; described by abbreviations and trade names that are often incomprehensible to outsiders. A terrorist that obtained a complete copy of the facility chemical inventory might be able to piece together the information included in the Top Screen, but it would take an awful lot of work.

 

But why should the facility keep their copy of the Top Screen under lock and key, restricting access to only those people with a Need to Know (NTK)? Any document in a facility that is left lying around is susceptible to theft during a break in, pilfering by an unescorted visitor or to copying by an employee that has been bribed, blackmailed or recruited to the terrorists cause.

 

Why should personnel with authorized access be required to undergo CVI awareness training, and be required to sign a non-disclosure agreement (NDA)? Signing the NDA drives home the seriousness of the program while the training provides the information necessary to protect CVI. The training is designed to insure that the individual knows:

 

1. What CVI documents are;
2. How they are to be marked;
3. How they are to be stored;
4. To whom they can be shown; and
5. How they can be transmitted.

 

The bulk of the CVI program is directed at government agencies to help protect the facility security information. It also is designed to protect commercial information that the facilities are required to share with the government. Almost everyone associated with protecting the facility will agree that this is important. It is, however, equally important to protect the same information held by the facility and its contractors.

Tags: Chemical Facility Security, CVI Program

Top Screen enforcement

There are sure to be many facilities beginning to think about not completing a Top Screen or filing with deflated numbers in order to avoid being classified as high-risk facilities. While no one knows how much facilities will have to spend to implement adequate Site Security Plans it is sure to be costly. Only facilities that are designated High-Risk will have to spend any additional money on security.

 

We have seen examples in the news of companies that deliberately falsify health and safety data to avoid the cost of government regulations. Surely there will be a significant number of facilities that will do the same with government security regulations. While 100% compliance will probably never be achievable a high degree of compliance will be necessary to provide an adequate level of security for the people of the United States.

 

DHS Enforcement

 

The facilities that do not adequately complete their Top Screen submissions will fall into two categories; those that deliberately falsify or fail to submit data and those that inadvertently submitted incorrect data. Both groups will probably escape detection during the early years of the CFATS program; DHS simply does not have enough enforcement personnel.

 

To make matters worse, those personnel that DHS does have will be working with facilities that have been designated High-Risk, not looking for non-compliant facilities. Because DHS was forbidden from requiring specific security measures the evaluation of site security plans and their implementation will be manpower intensive. Risk Based Performance Standards, while technically appropriate, will require extensive back and forth dialog between facilities and DHS.

 

Because of CVI rules, many of the other methods that federal agencies use to help them identify non-compliant facilities will have little utility in enforcing CFATS. Because of the very limited number of people at a facility that will ever see the submitted Top Screen the chance of having whistleblowers coming forward will be very limited. Likewise, competitors and neighbors will have no way of knowing if a facility has completed a Top Screen or accurately provided the necessary data.

 

Data Mining

 

DHS has taken one important step that could make it easier to detect non-compliant facilities; they required all data submission in CSAT to be done electronically. The data base will be huge and it will be comprehensive. The data includes multiple methods of facility identification, including DUNS numbers (Duns and Bradstreet), NAICS Industry code (Census Bureau), and EPA Registration numbers, along with facility name, address and physical location (longitude and latitude).

 

All of this information will allow DHS to take this data and compare it to other government and private databases to identify facilities that probably should have completed Top Screens. For example, if DHS notes that a large percentage of meat processors completed Top Screens due to having more than 10,000 pounds of anhydrous ammonia on site for their refrigeration system, they could look at the remaining meat processors.

 

The initial follow-up on these non-reporting facilities could consist of a simple letter asking them how much anhydrous ammonia they have on site. This would allow DHS to potentially identify some of the facilities that did not realize they had a duty to complete a Top Screen. Some deliberately non-compliant facilities in that category would also then self-identify once they knew that DHS was looking at them.

 

Future Actions

 

One fairly simple action that DHS could take to make it easier to identify facilities that would be required to complete Top Screen submissions would be to require manufacturers and distributors to report shipments of any COI in excess of the STQ. While this would not capture all facilities, it would identify those facilities with the largest inventories of these chemicals.

 

Registration of suppliers and users of selected chemicals is another possible step. This has been done with Chemical Weapons Convention chemicals (under the Commerce Department). Congress has just taken this step with fertilizer grade ammonium nitrate. This type action would certainly be justified with inhalation hazard chemicals.

Tags: Chemical Facility Security, Top Screen Enforcement

Top Screen deadline nears

With the January 22, 2008 deadline for submission of Top Screens fast approaching, DHS has published some interesting new data on their web site. First on the Chemical Security Assessment Tool page they have posted notice that the deadline is 1-22-08 not the 1-18-08 date that I have been mentioning in my blogs. My date was determined by counting 60 days from 11-20-07. I don’t know how DHS arrived at the 1-22-08 date, but they run the program so theirs should be the date that counts.

 

For the first time on this site, DHS is also noting that extensions for the Top Screen deadline can be requested. DHS had specifically noted this in the Final Rule Appendix A with respect to colleges and universities. This is the first time that this procedure has been generally acknowledged on the DHS web site. There are no details other than a “formal” letter can be sent to:

 

Department of Homeland Security
Chemical Security and Compliance Division
Mail Stop 8100
Washington, DC 20528-8100

 

Also shown on that page is a link to a letter from Robert B. Stephan, Assistant Secretary for Infrastructure Protection, announcing a temporary exemption from the requirement to complete a Top Screen for agricultural operations. Actually the letter calls it an extension of the filing deadline, but does not give a new date by which the Top Screen must be filed. That it should be more appropriately named an exemption is clear from reading the text of the letter.

 

“In the final Appendix A, DHS intended to limit the coverage of that requirement, as related to farmers and other agricultural users of the chemicals of interest, by revising screening thresholds and counting rules for certain chemicals. See 72 FR 65406-65407, 65415 (Nov. 20, 2007). Since publication of the final Appendix A, however, additional questions and concerns have been raised regarding the applicability of the Top-Screen requirement to agricultural facilities and operations. DHS is gathering more information about these issues in order to determine whether any modification of the Top-Screen requirements might be warranted.”

 

Additionally, the letter notes the new authority DHS has been given in the latest appropriations bill to regulate Ammonium Nitrate. This may allow DHS to remove fertilizer grade ammonium nitrate from Appendix A all together since it will be covered under new, as yet to be written regulations.

 

The letter very specifically limits the applicability of this exemption to agricultural operations and not companies that apply chemicals for such operations or chemical suppliers.

 

(2) “This extension applies to facilities such as farms (e.g., crop, fruit, nut, and vegetable); ranches and rangeland; poultry, dairy, and equine facilities; turfgrass growers; golf courses; nurseries; floricultural operations; and public and private parks.

 

(3) “This extension does not apply to chemical distribution facilities, or commercial chemical application services.”

 

We’ll have to watch the web site for further information on this new development. I don’t expect anything to happen too soon. DHS has been very slow to deal with political hot potatoes like this.

Tags: Chemical Facility Security, Top Screen Deadline, Agricultural exemption

Setting up a minimal facility CVI program

Every facility that completes a Top Screen should have program set up to administer the security of Chemical-Terrorism Vulnerability Information. Most of the 40,000+ facilities that are expected to complete a Top Screen are only going to require a minimal facility CVI program.  For these facilities there will only be two documents that will be maintained on file that will require CVI markings; a copy of the submitted Top Screen and a copy of the letter from DHS informing them that the facility is not regulated under 6 CFR part 27.

 

While DHS will probably never inspect these documents, and no one else should ever need to see them, it will be a good idea for most facilities to keep them on hand. They would be beneficial to have when a facility has to re-submit a Top Screen when there are significant changes at the facility to processes, plant surroundings or chemical inventories. There will also be inevitable changes to the regulations that might require re-submission.

 

In setting up a minimal CVI program the first thing a facility needs to do is to appoint a

“CVI point of contact” (para 5.3 of the CVI Procedure Manual). This will be the person responsible for administering the CVI program at the facility. According to para 5.4c the responsibilities of the Point of Contact (POC) are:

 

1. “Demonstrate full familiarity with the minimum requirements for protecting CVI according to Section 550(c), the implementing regulations, and the procedures established in this Manual.

2.  “Ensure the secure dissemination of CVI to authorized users and private third parties with a vested interest in the chemical facility,including:

o Response to, or assistance with, need-to-know inquiries;

o Verification that initial and ongoing training has been completed; and

o Certification that NDAs are executed and implemented, as necessary.

3. “Initiate, facilitate, and promote activities to foster and maintain awareness of CVI policies and procedures.

4. “To the extent practicable, remind individuals of their post-employment CVI responsibilities.

 

The first responsibility can be taken care of by completing the online training program for protecting CVI documents. Once this training is completed and the appropriate background check is completed by DHS, DHS will email the individual a copy of the certificate stating that the individual is an Authorized User. The CVI POC will have to periodically check the DHS web site to insure that there have been no changes to the procedure manual. Whenever a new version is published, it would be a good idea to re-do the training program.

 

For a minimal CVI program there will be little need to have more than the Point of Contact at the facility designated as an Authorized User. Facility management can decide whose job might reasonably require access to those limited CVI documents and have them complete the same online training program. The POC should maintain copies of each certificate as part of the facility’s CVI procedural files. They should probably be maintained in the same locked container as the CVI marked documents for ease of program administration.

 

CVI marked documents are required to be stored in a locked container. This may be a desk drawer or file cabinet as long as only those people who are both Authorized Users and have a Need to Know have access to that container. As a practical matter it would probably be best if only CVI marked documents and program administration documents were stored in that container. In a multi-drawer file cabinet or desk it would be more practical if the drawer were separably lockable so that routine access to non-CVI documents would not compromise the security of the CVI documents.

 

A log must be maintained for tracking production, receipt, transmission and dissemination of CVI marked documents (para 5.3). Each document will be marked with a unique tracking number (See Appendix A, CVI Procedure Manual). The log will include who transmitted and received the document and how their Authorized User status was verified.

 

For a minimal CVI program this probably can be documented on a single sheet of paper. For the Top Screen document the date the Submitter printed the final copy of the Top Screen and submitted it to DHS will be the initial entry. The “who received” entry will be “Secure DHS Website”.

 

For facilities that receive a “may be regulated” letter from DHS the CVI program will be more complicated since more documents and people will be involved. We’ll look at those programs in a future blog.

Tags: Chemical Facility Security, Minimal CVI program

Top Screen User’s Guide: Critical Chemicals

The CSAT Top-Screen User Manual does provide some additional information on the two sections of the Tops Screen dealing with critical chemicals; Mission Critical Chemicals and Economically Critical Chemicals. Most of this additional information deals with definitions and how to find some of the information required to complete these two sections of the Top Screen.

 

As I mentioned in an earlier blog, Top Screen Questions: Mission Critical and Economically Critical Chemicals, these two sections are practically identical in layout and the information they require. The difference lies in the sectors into which the chemicals are supplied. Mission Critical chemicals go into four specific critical infrastructure sectors; Defense Industrial Base, Public Health and Healthcare, Energy (electric generation only), and Public Drinking Water. The Economically Critical chemicals are sold anywhere else in the US economy.

 

The definitions of the four critical sectors (page 47) are very interesting. The Public Drinking Water description is very specific; “facilities that serve at least 15 service connections used by year-round residents or regularly serves at least 25 year-round residents.” I’m not sure why the two different definitions are provided, but they are specific. The Defense Industrial Base definition is very sweeping and inclusive; “Department of Defense, government, and private-sector facilities that perform research and development, design, produce, or maintain military weapon systems, subsystems, components, or parts to meet military requirements.” The other two sectors fall between those two extremes.

 

The questions asked about each chemical are the same in both Top Screen sections. Additional information is provided in the Mission Critical Chemical section for determining the Capacity Utilization Rate (page 49) and the National Emergency Production Rate (page 50). The Economically Critical Chemical section provides information on determining the Total Value of Products (page 51) and the Market Share (page 52). All of this information will be used for both sections.

 

The interesting thing about these two sections is that they have nothing to do with the list of chemicals in Appendix A, nor are they restricted to hazardous chemicals. Both sections include the following in their instructions: “Facilities should consider chemicals listed on Appendix A as well as those not on Appendix A when determining whether their chemical production meets the criteria.” This means that facilities that have none of the Appendix A listed chemicals of interest (COI) still may be required to complete one or both of these sections of the Top Screen.

 

I have seen no discussion of this Top Screen requirement in any of the literature that I periodically review. DHS has either decided that they only want this information from manufacturers of COI, or they are going to come back and publicize this requirement for general chemical manufacturers at some later date.

Tags: Chemical Facility Security, Top Screen, Critical Chemicals