CFATA 2009 High Level Summary

On June 16th the 111th Congress will hold its first public hearing on the reauthorization of the CFATS regulations. There is no bill number currently available for the ‘Chemical Facility Anti-Terrorism Act of 2009’, but I have gotten hold of a copy of a committee draft (dated 06-04-09). While this may not be the version that makes it to the first markup it will be close enough so that we can understand some of the questions that will be asked during the hearing. I don’t want to post a 67 page document to the blog so what I will do is to provide a high level summary of the document. There are a lot of similarities to last year’s HR 5577, but this is not exactly the same bill. The most obvious difference is that this year’s bill does not exactly remove the water treatment facility exemption the way HR 5577 did. There is apparently a change in the way that water treatment facilities will be treated, but it is being addressed in a separate title to CFATA that is being written in the Energy and Commerce Committee and I have not yet seen a copy of that portion of CFATA. With that said here is the section by section summary of the draft bill. SEC. 101 - Findings and Purpose Summarizes the political and security situation that led to CFATS and notes that CFATA will ‘modify and make permanent’ the authority to regulate ‘security practices at chemical facilities’. SEC. 102 - Extension, Modification, and Recodification of Authority CFATA amends the Homeland Security Act by adding Title XXI. The remainder of these comments are tagged to the section numbers in that amendment SEC. 2101 – Definitions This is the typical definition of terms. It does codify the ‘Risk-Based Performance Standards’ with some revisions. The most important is the addition of “(S) Assessing and, as appropriate, utilizing methods to reduce the consequences of a terrorist attack.” The term ‘method to reduce the consequences of a terrorist attack’ is also broadly defined. SEC. 2102 - Risk-Based Designation and Ranking of Chemical Facilities The section provides authority to Secretary to designate ‘substances of concern’, a term equivalent to the current ‘chemicals of interest’. It also provides authority for the designation of ‘covered facility’ and requiring chemical facilities to submit information to the Secretary to allow for determination if the facility is a ‘covered facility’. It calls for the ranking of ‘covered facilities’ into four risk-based tiers. It also requires the Secretary to provide facilities with information about potential threats and methods of attack that could be employed against the facility. Sec. 2103 - Security Vulnerability Assessments and Site Security Plans This section provides the Secretary with the authority to establish requirements for Security Vulnerability Assessments (SVA) and Site Security Plans (SSP). This section designates the review and approval of the SVA or SSP as ‘an inherently governmental function’ which disallows for the use contractors to complete these functions. It also provides for the acceptance of Alternate Security Programs (ASP). This section effectively removes the exemption for MTSA covered facilities, and requires coordination with Coast Guard to establish facilities covered under both rules. This section also establishes an 8 hour annual training requirement for employees of covered facilities. Sec. 2104 - Site Inspections This section provides the authority for the Department to conduct inspections under this title. The inspection authority includes access to off-site records, employees and ‘employee representatives’. This section requires unannounced inspections of Tier 1 and Tier 2 facilities. Sec. 2105 – Records This section establishes the right of the Secretary to have access to applicable records. It also requires facilities to provide copies of SVA and SSP to an ‘employee representative’ from each recognized bargaining agent for the facility. These representatives would be required to follow information handling and security rules provided in this legislation. Sec. 2106 - Timely Sharing Of Threat Information This section establishes the requirements for the exchange of threat information. It requires the Secretary, within limits of national security and statutory requirements, to provide covered facilities with threat information. It provides the Secretary with the authority to require reports on threats against the facility to include “any intentional or unauthorized penetration of the physical security or cyber security of the covered chemical facility whether successful or unsuccessful”. Sec. 2107 – Enforcement This section provides the authority and establishes the general procedures for disapproving an SVA or SSP. It also establishes the authority for issuing Orders of Compliance and Orders to Cease Operations. It establishes the maximum level for Administrative penalties ($25,000/day) and court awarded Civil penalties ($50,000/day). Sec. 2108 - Whistleblower Protections This section provides the authority for protection of personnel from retaliation for filing complaints or reporting security related problems under this title. Sec. 2109 - Federal Preemption This section provides a clear and unambiguous provision for states and their subdivisions to establish and enforce stricter regulations pertaining to chemical facility security. It does not provide for the typical ‘unless it conflicts with these regulations’ provision. Sec. 2110 - Protection of Information This section establishes the Sensitive Security Information as the standard to be used for the protection of information provided to DHS instead of the current Chemical-Terrorism Vulnerability (CVI) standard in the current regulations. It also enumerates the classes of information that would be protected. Sec. 2111 - Methods To Reduce The Consequences Of A Terrorist Attack This section provides for the requirement for all covered facilities to assess ‘methods to reduce the consequences of a terrorist attack’ as part of their SSP. It then provides authority for the Secretary to require Tier 1 and Tier 2 facilities to implement methods identified in the assessment that would ‘significantly reduce risk of death, injury or serious adverse affects’, can ‘feasibly be incorporated into the operation of the covered facility’ and ‘would not significantly and demonstrably impair the ability’ of the facility to remain in business at that site. It requires the Secretary to make available information on ‘the use and availability of methods to reduce the consequence of a chemical facility terrorist incident’. Sec. 2112 - Applicability This section exempts DOD owned/operated facilities and facilities regulated by the Nuclear Regulatory Commission (and state entities authorized to act in lieu of the NRC) from coverage under this law. Sec. 2113 - Savings Clause This section provides a list of federal statutes that are not preempted by this law. It also preserves the rights of States and their sub-divisions from adopting/enforcing rules and regulations relating to environmental protection, health and safety. Sec. 2114 - Office of Chemical Facility Security This section establishes the Office of Chemical Facility Security within DHS. It also provides for qualifications and selection of a Director to head that office. Sec. 2115 - Security Background Checks Of Covered Individuals At Certain Chemical Facilities This section establishes the requirement to provide regulatory direction on the requirements for conducting background checks of for employees at covered chemical facilities that have access to restricted or critical areas at those facilities. It also provides for requirements for redress and prohibitions against unauthorized use of the information or process associated with those background checks. It also establishes what types of information uncovered in those background checks would be grounds for denying access. Sec. 2116 - Civil Actions This section provides that anyone can bring a civil action in US District Court against covered facilities or the government to enforce provisions of this Act. Sec. 2117 - Annual Report to Congress This section requires the Secretary to provide an annual report to the relevant committees in the House and Senate on the progress under this Act. Sec. 2118 - Authorization of Appropriations This section provides for the following appropriations to support the provisions of this Act:

FY2011 - $325 million ($100 million for methods to reduce consequences of terrorist attack) FY2012 - $300 million ($75 million for methods to reduce consequences of terrorist attack) FY2013 - $275 million ($50 million for methods to reduce consequences of terrorist attack)

This section also would repeal §550 of the Department of Homeland Security Appropriations Act, 2007 (Public Law 109–295). It would also authorize the Secretary as much of the current CFATS regulations as appropriate to enforce the provisions of this Act. The Secretary would be required to establish a timeline for facilities that have already completed their SVA or SSP submissions under the current regulations to re-submit to comply with the new requirements in this Act. Finally this section gives the Secretary six months to publish an NPRM for implementing these new requirements and publishing a final rule within 18 months.

Terrorist Background Check

Yesterday I reported on the DHS ICR for their proposed solution for conducting terrorist database background checks for personnel with access to restricted areas or secure areas within high-risk chemical facilities. Today I would like to take another look at the issue with less of a reportorial approach. Specifically, I would like to take a look at some of the items I would like to see discussed in public comments on this ICR. Facility Notification I noted yesterday that “The submitting facility would not be notified by DHS of the results of the TSDB screening.” That means that if an employee’s name showed up on the TSDB check, the facility would not be notified by DHS that that employee was potentially a terrorist or linked to a terrorist. At most, the ICR notes that “high-risk chemical facilities may be contacted by Federal law enforcement as a part of appropriate law enforcement investigation activity” (74 FR 27555). There is no explanation of why DHS would not notify the facility that there was a potential terrorist working at that facility. One can make a pretty good guess as to why DHS is taking this stance. First off, the mere presence of a person’s name on the TSDB does not mean that the person is a terrorist or has even associated with Terrorists. As we have seen with the ‘No Fly List’ there have been a number of very public instances of confusion of innocent people with potential terrorists because of name similarity. There are undoubtedly an at least equal number of unreported instances where person’s name was incorrectly placed on the list. This means that requiring or even allowing high-risk chemical facilities to make personnel decisions based on the mere match of an employee’s name with a name on the TSDB would be patently unfair. Civil liberties organizations should certainly applaud the approach that DHS is taking. On the other hand, the match does mean that there is at least a chance that an employee with access to restricted areas or security areas at a high-risk chemical facility is a terrorist planning an attack or a terrorist sympathizer providing information to terrorists planning an attack. While a ‘Federal law enforcement’ agency is getting around to conducting their investigation the planned terrorist attack could happen. The DHS approach is probably the correct way to deal with this situation, but I think that there needs to be a public discussion about the assumptions being made. This ICR and the public comment period is the appropriate place for such a discussion. Notifying Employees about the Check DHS is proposing to effectively transfer responsibility to facility management for informing individual employees about the Privacy Act issues regarding the facility submission of PII (personally identifiable information). Since the facilities are the ones actually collecting and transferring the data, I suppose that this makes a certain amount of sense. At the same time, however, DHS is proposing to publish Federal Register Notices about the same Privacy Act requirements. While it might be reasonable to expect that high-risk chemical facilities would read (or pay someone to read for them) the Federal Register watching for such notices, it is beyond the realm of reasonable supposition to assume that the average employee would do so. I would like to suggest a reasonable alternative. DHS could come up with a poster explaining the program similar to the ubiquitous OSHA posters about a wide variety of regulatory programs. These could be posted on employee bulletin boards at high-risk chemical facilities. While these types of posters are not read with any great frequency, they are much more likely to be read by the affected parties that Federal Register Notices. Unescorted Visitors Having worked in chemical production facilities for a number of years, I agree that there are a number of ‘visitors’ (not employees, not contractors) that frequently move about certain areas of chemical facilities on a fairly routine basis. Small package delivery drivers and a wide variety of vendors (uniform and industrial mats vendors come easily to mind) are frequently overlooked because they are such a common site at these facilities. The big problem with most of these ‘visitors’ is that they are relatively invisible and there is a certain amount of inevitable turnover in these positions. I would like to see some comments on how high-risk chemical facilities would manage the identification and clearance of these personnel. I think that rather than facilities doing background checks on these ‘unescorted visitors’, covered chemical facilities will probably resort to requiring escorts or setting their employers up more like contractors and transferring the background check responsibility to those companies.

DHS FY2010 Budget Changes by House Appropriations Committee

The House Appropriations Committee has just posted two documents to their web site as a result of today’s hearing on the DHS FY2010 budget markup. The Bill Text (as ‘ordered reported’) has not yet been posted on the site. The posted documents are: The Bill Summary Terminations and Reductions Nothing in these two documents refers to CFATS spending or reauthorization, but that isn’t surprising it is a relatively small part of the budget. The reauthorization language would be in the Bill Text. The Committee did reduce the President’s budget request for funding of TSA Surface Transportation Security Inspectors by $25 million “due to a long delay in hiring previously funded inspectors” (pg 3 of Bill Summary). It is not clear how much that will impact the provisions in HR 2200, §302(c) calling for the hiring of “200 additional surface transportation security inspectors in fiscal year 2010” as that language was qualified by the phrase ‘subject to the availability of appropriations’.

CFATA 2009 Hearing 06-16-09

The House Homeland Security Committee just announced that they would be holding a full committee hearing on “The Chemical Facility Antiterrorism Act of 2009” (CFATA 2009) on Tuesday, June 16th, at 10:00 am EDT. Sue Armstrong, Director – Infrastructure Security Compliance Division (the person in charge of the current CFATS program) will be the sole witness on the first panel. The second panel will include:

Paul Baldauf, Assistant Director, Radiation Protection and Release Prevention, New Jersey Department of Environmental Protection; Marty Durbin, Vice President, Federal Affairs, American Chemistry Council; Neal Langerman, Principle Scientist and CEO, Advanced Chemical Safety, Inc.; Martin Jeppeson, Director of Regulatory Affairs, California Ammonia Company.

I have a mostly up to date copy of the committee draft bill (still missing the water works provisions unfortunately) so I will post a high level summary of the bill this some time weekend so that the audience will have a score card to keep track of what is being talked about.

DHS Budget Schedule – Update 06-12-09

Chairman David Obey (D, WI) of the Appropriations Committee earlier this week published a tentative schedule for getting all of the FY2019 Appropriations bills through a House Floor vote prior to the August Recess. The Homeland Security Appropriations bill (still no bill number available) has been through the Subcommittee markup (6-8-09) and the Full Committee markup (earlier today) hearings. From the schedule it looks like the full committee will vote on the final version of the bill on Monday (6-15-09) at 6:30 pm EDT. His calendar calls for this bill to go to the floor for discussion (6-19-09) and a vote (6-23-09) this month. I don’t know how this will fit in with the schedule for the Homeland Security Committee, but they have been holding subcommittee hearings this week. To get to the floor by next Friday, there will have to be at least one full committee hearing between now and then. I haven’t been able to load the webcast of today’s Appropriations Committee mark-up hearing and they have no documentation posted yet to their site. That means that I have no idea what changes, if any have been made to that bill. If the Appropriations Committee is going to vote on it Monday, I expect that the GPO will not have a print version/electronic available before mid-day Tuesday at the earliest.

FY2010 Budget Hearing: NPPD & TSA

I missed watching the subcommittee hearing Wednesday on the NPPD and TSA budgets for DHS. Fortunately, most of these hearings are available on the web, so I went back today to watch it and I am glad that I did. If you read the testimony submitted, there is very little to do with CFATS, but there were certainly some CFATS questions asked. Chairwoman Jackson-Lee The only real mention of CFATS in any of the written testimony (besides a recap of the current status in Deputy Undersecretary Reitinger’s testimony) is one sentence in the opening statement of Chairwoman Sheila Jackson-Lee (D, TX). There she states that: “the Committee [Homeland Security] is moving quickly to extend and comprehensively modify the Chemical Facility Anti-Terrorism Standards”. In her actual opening remarks she added that hearings on the CFATS reauthorization legislation will start next week. CFATS Extension Ms Jackson-Lee did not have any questions about CFATS but two Republican members of the Subcommittee certainly did. Both the Ranking Member, Charles Dent (R, PA) and Congressman Daniel Lungren (R, CA) had some pointed questions to ask Secretary Reitinger. Congressman Dent asked if DHS knew that the Homeland Security Committee and the Energy and Commerce Committee were hard at work on a CFATS reauthorization bill. When Mr. Reitinger replied in the affirmative the next question was then why did the Department include a one year extension in their budget request. The Secretary’s response was well prepared; CFATS has not yet been fully implemented and it would take that long to learn the full lessons of CFATS and work with Congress to fine tune the process with permanent legislation. Mr. Dent agreed with that assessment and mentioned that that was why he had introduced HR 2477 to extend CFATS for three years. The IST Question Both Rep. Daniel Lungren (R, CA) and Rep Dent asked Mr. Reitinger questions about Inherently Safer Technology (IST). It didn’t take any great skill at reading between the lines that neither Congressman liked mandatory IST. Dent started it off by asking how many IST experts were in the employ of DHS. The question was almost rhetorical, but the Undersecretary played the game and answered that there were probably none, but the Department was hiring people with a chemical background for positions as CFATS inspectors. No one was so discourteous as to mention that there is a long way between a ‘chemical background’ and expertise in IST. Mr. Dent then asked another semi-rhetorical IST question; how much money was in the FY 2010 budget for IST experts? Towards the end of his questioning, Mr. Lungren asked if Mr. Reitinger thought that it would be possible to write a ‘reasonable’ IST application into the CFATS regulations. The Undersecretary bypassed the question by reminding the subcommittee that there was nothing in CFATS that prohibited facilities from voluntarily using IST to lower their tier ranking or take the facility right off of the high-risk listing. Surface Transportation Security With a TSA representative, Gale D. Rossides, the Acting Administrator, sitting at the witness table there were a few questions about surface transportation security issues. The TSA Authorization bill that passed in the House last week was written without TSA input, so there were certain disconnects between the funding authorized and the President’s budget request. This is most telling in the number of Surface Transportation Security Inspectors the two documents envision hiring in FY 2010. With the ease with which the HR 2200 passed, it seems obvious that the President’s budget request will see an increase to reflect the larger number of inspectors in HR 2200.

Reader Comment – 06-11-09 – Background Checks

Earlier today MVincenti posted a comment to my posing on the latest CFATS ICR. MVincenti asked:

“Is the background screening for CSAT tool more detailed that for that of TWIC? I am just curious as to whether the same types of procedures are being used for background checks both CFATS and TWIC. I did a quick google search to see if I could find the criteria used to check a TWIC applicant's background without success.”

The terrorist data base search described in the ICR just looks at checking the TSA TSDB. The TWIC background check is more extensive (see 49 CFR 1570 Part B) but it does include checking the same TSDB. The TWIC background check incorporates more of the types of checks that DHS expects high-risk chemical facilities to use in their personnel surety program. If facilities were to get TWICs for each of their employees that had access to restricted or security areas, this would almost certainly fulfill the RBPS #12 requirements. I haven’t priced the various outfits that do background checks, but it just might be that getting TWIC’s for everyone might be cheaper in the long run.