CSB ANPRM Comments Posted

Last June the Chemical Safety Board published an advance notice of proposed rulemaking on chemical release reporting. Comments on the ANPRM were required to be submitted to the CSB by August 4th of last year. Today, the CSB published on their Open Government web page a link to a document that compiles all 27 responses that the CSB received about that ANPRM; late is always better than never. I would expect that this means that the CSB will be considering the publication of a notice of proposed rulemaking with the actual language of their proposed rule sometime in the near future. I will be looking at these comments and will probably report on them later this week.

CFATS Background Check ICR Comments – 05-14-10

Last week the 30-day comment period ended on the DHS information collection request (ICR) supporting the proposed CFATS Background Check Tool. These ICR filing seldom garner any comments, but, as was expected, there were a relatively large number of comments, 20 comments, on this ICR. There are a number of important issues raised in these comments, but I would like to address just a couple in this blog post. ICR or Rule On issue that made a reappearance on these latest comments on the proposed information collection request (ICR) was the use of the ICR process versus going through the rule making process to establish this Background Check Tool. These commentors felt for a variety of reasons that the ICR was not an appropriate vehicle for establishing the personnel surety tool. For example the commentor from Shell noted that; “We believe that implementation of a PSP program is of such a impact and significance that using the ICR approach is not adequate for the task at hand, and we see it as a most disturbing precedence.” (pg 2) From a detailed reading of these comments it is pretty clear that these commentors do not object to the actual Background Check Tool so much as the requirements for whom and when the checks will be required. The NPRA commentor noted that: “The processes and procedures outlined in this ICR do not reflect a simple information collection under an existing rule; rather, the prescriptions in this ICR establish new requirements and burdens on industry.” Since these concerns were included in comments made last summer for the 60-day ICR notice, it would seem to me that the folks at ISCD disagree with these commentors assessment of the legal requirements involved. Unfortunately, these types of substantial legal disagreements inevitably end up in court and, in this case, end up slowing the implementation of a necessary security tool. Section 550 Limitation A couple of commentors pointed out that the way the ICR is worded makes it clear that the Background Check Tool (BCT) would be the only way that facilities would be able to fulfill the RBPS 12 requirement to check personnel against the TSDB. This would run afoul of the Section 550 prohibition against DHS mandating any specific security procedure as a pre-requisite for approval of the facility SSP. If ISCD made clear in its documentation for the BCT that personnel with TWICs or other TSDB based clearances would not have to be run through the BCT, the legitimacy of this claim against the §550 prohibition would be greatly lessened. Though the fact that few facilities could legitimately require all of their covered personnel to acquire a TWIC would have the practical effect of mandating the use of the BCT. Background Check Required Coverage A number of commentors were apparently caught by surprise by the number of facility personnel that would be subject to the TSDB check requirement. Section 27.230(a)(12) states that all facility personnel “with access to restricted areas or critical assets” would be subject to the personnel surety program checks. The ‘unescorted’ modifier clearly only applies to ‘visitors’, so all employees have access of one sort or another under this section. The one thing that could cause some problems is how contractors will be treated since many facilities use contractor employees to actually run many, if not all, of the physical processes at the facility. Other Issues There are a number of other issues that were raised by commentors that will have to be addressed by DHS when it refers this ICR to the Office of Management and Budget (OMB). If DHS continues to treat this as a ‘simple’ ICR rather than going to the rule making process, we may never know how DHS responded to each specific comment; there would be no further postings in the Federal Register unless OMB fails to approve the final ICR. Unfortunately, I expect that this ICR will not get submitted to OMB. It will fall behind the other controversial items (ammonium nitrate rule and the ‘temporary’ agricultural exemption for example) in the DHS regulatory black hole, bouncing back-and-forth between the approval and re-write requirements of the political appointees, never again to see the light of day. Until, of course, an attack on a chemical facility blasts it free of the political event horizon.

CSB IST Study Comments 05-14-10

On Friday the Chemical Safety Board (CSB) posted a new document link to their Open Government web page to replace the two earlier documents that provided copies of comments that they had received about their proposal for a National Academy of Sciences study of the use of methyl isocyanate at the Bayer CropScience facility outside of Institute, WV. The purpose of that study is to determine if it is possible to use an inherently safer technology (IST) technique to further reduce or eliminate the storage of MIC at that facility. The Politics of the Study While Congress tasked the CSB to specifically look at the Bayer situation, the CSB formulated their proposal to first have the NAS investigation establish a methodology for evaluating IST techniques. In the long run, this methodology will probably be more politically significant than the application of that method to the CropScience facility. This is especially true as Congress continues to consider as part of the permanent authorization of the CFATS process requiring high-risk chemical facilities to conduct their own IST evaluation. This political situation is certainly reflected in the variety of organizations that contributed to the 28 responses contained in this document. Only four of the comments come from the immediately affected West Virginia community and this includes the Bayer response. Most of the remaining comments come from organizations from both sides of the IST political debate. As I noted in an earlier blog, this is not only appropriate given the proposed scope of the study, but politically important. A rigorously developed methodology for evaluating the relative effectiveness of IST technique that takes into account both the technical and financial issues will go a long way in refining the debate on the IST in CFATS debate. Combined with the soon to be released science-based definition of IST from the Center for Chemical Process Safety (CCPS) this study should provide a detailed, practical basis for the political discussion so that it can move beyond the current philosophical realm; there being no potential short-term resolution to the philosophical differences between the two sides. Study Design CSB now has the difficult task of formulating their formal requirements for this study. They must take into account the issues identified in the conflicting comments received from the larger community as well as the separate requirements of the local issues at the Bayer facility. It might actually be best if they task the NAS with establishing two separate panels. The first would be tasked with the methodology development task while the second would be responsible for implementing that methodology on the specific facts associated with the Bayer CropScience facility. The first panel would have technical experts from academia and organizations like CCPS. Organizations on both sides of the political debate should also provide technical representation on this panel. Additionally, this panel should include some representation that could specifically address the financial analysis questions that will inevitably need to be addressed in the methodology. The second panel would need to be more focused on the specific needs of the local debate. The bulk of the panel would again be technical experts without a specific interest in the local situation. The panel should also include representatives from Bayer, the local government, and the local community advocacy groups. The Way Forward What is not yet clear is how the CSB intends to handle further public discussion of this study formulation process. One school of thought would have the CSB provide a copy of the final draft proposal for additional public comment; roughly the equivalent of posting a ‘final rule’ in the Federal Register. This would be a formal recognition of the political nature of this proposed study. Those that would look at this as a strictly scientific endeavor would note that CSB has already provided more than enough public comment opportunities and further delay would serve no legitimate purpose. I tend to fall more into the middle ground. While I think that further debate might be beneficial, I think that the political need for the IST evaluation methodology is so great that further delays for more discussion is not warranted. I would like to see the CSB post a copy of the formal study requirements on their web site when they send it to the NAS. This would allow for a parallel political discussion to take place while the formal study gets under way.

Water System Security Issues

There is an interesting story on EastBayRI.com that, while it doesn’t deal with water treatment chemicals, does shed some light on how little attention is paid to water supply security issues by the Environmental Protection Administration. According to this local news story the police are investigating the release of 40 million gallons of water from a reservoir. Someone had cut locks on chains securing some large water valve handles which allowed the water to discharge into a creek. Interestingly no one knows when the valves were opened, but it was discovered by a water system employee making a ‘routine check’ of the reservoir. Any security professional knows that locks do not provide any kind of security unless they are watched; bolt cutters are available at any hardware store. Since this reservoir is a secondary water source for the water system, it probably doesn’t make any sense to have anyone on-site watching the locks. There are, however, a number of devices that could do that watching; video cameras, flow meters on the discharge lines, valve position sensors, etc. Any of these would have allowed for a response that would have prevented 40 million gallons of water being discharged. The local police chief told the reporter for this story that, because “it involves a water supply and water safety, it is something we take very seriously”. Unfortunately, current federal regulations do not take water system security seriously. The only requirement is for facilities to certify that they have completed water system security vulnerability assessments. There are no security standards, not even risk-based performance standards. There are no requirements for outside inspectors to check or verify that security measures are actually in place and functional. The EPA has the technical knowledge necessary to assure water quality issues, but does not have the necessary security background to assure that water quality is defended against potential attack or even vandalism. Congress needs to realize that security issues at such a vulnerable yet crucial public resource needs to be overseen by security professionals. Either EPA needs to be given that capability/responsibility by Congress or it should be given to DHS.

ICSJWG Teleconferences

Today the DHS-CERT Control System Security Program Calendar web page shows a series of teleconferences to be held by various elements of the Industrial Control System Joint Working Group (ICSJWG) over the next two weeks. No real details are available, though I expect that the individuals involved probably understand what is going on. I suspect that it has something to do with the recently announced dates for the 2010 ICSJWG Fall Conference, October 25-28, 2010. The following teleconferences have been announced

ICSJWG Government Coordinating Council Teleconference – 5-20-10

ICSJWG Research and Development Subgroup Teleconference – 5-20-10

ICSJWG Vendor Subgroup Teleconference – 5-24-10

ICSJWG Workforce Development Subgroup Teleconference – 5-25-10

ICSJWG Industrial Control System Roadmap Subgroup Teleconference – 5-27-10

The web site provides an email POC, ICSJWG@dhs.gov, for further information about these teleconferences.

Hazardous Materials Seminar

Thanks to the folks at ProgressiveRailroading.com for pointing me at this hazardous material seminar. The Bureau of Explosives and the American Association of Railroads is holding the 23rd Hazardous Materials Seminar on May 25th thru 27th in Kansas City, Mo. The meeting will cover the whole scope of topics concerning shipping hazardous materials by rail, including security issues. According to the schedule on the seminar web site specific topics that might be of interest to the chemical security communities include:

Hazmat Intelligence Portal Beyond the Routing Regulation Rail Car Security Inspections (IEDs and More) TIH Risk Assessment National Hazmat Fusion Center

You can still register for this seminar on line.

NSF Cybersecurity Meeting 05-19-10

In today’s Federal Register the National Science Foundation (NSF) announced that they would be making a public presentation on their recently identified R&D themes that will “exemplify and motivate future Federal cybersecurity game-change research activities” (75 FR 27007) on May 19th at the Claremont Hotel in Berkeley, CA at 1:30 pm PDT. Following that presentation the NSF will be opening an on-line discussion forum for public comments and feedback on the proposal starting May 19th thru June 18th. A separate notice in the Federal Register provides more information on “Federal cybersecurity game-change research and development agenda” (75 FR 27006). There will be three ‘themes’ that will be an integral part of that agenda; “(a) Tailored Trustworthy Spaces, (b) Moving Target, (c) Cyber Economic Incentives”. While most of the discussion will apparently be focused on information technology the NSF definition of cyberspace is the “globally interconnected network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors in critical industries [emphasis added]”. So there may be something of interest to the chemical security community in this discussion.