Recently (last Friday and today) the DHS Industrial Control System Cyber Emergency Response Team (ICS-CERT) updated two previously issued control system advisories. These updates covered the DLL Hijacking vulnerability in the Ecava IntegraXor system and the multiple denial of service (DOS) vulnerabilities in the 7-Tecnologies IGSS system.
Ecava IntegraXor
The original vulnerability advisory was published on May 27th. There was apparently an update published the same day with a revised link for the patch provided by Ecava, but I cannot find anywhere on the ICS-CERT site where it was actually published. This second revision (‘B’ Version) corrects the impression left by earlier versions that this vulnerability could only be accessed locally. It also provides yet another link for the patch that is available to correct this vulnerability
7 Technologies IGSS
The original advisory was published on May 12th. This update reports that both ICS-CERT and Joel Langill (the researcher that identified the vulnerabilities) have validated the patches provided by 7 Technologies. It also updates the list of affected versions of the software. It also provides updated patch information since it is now apparent that each of the affected versions requires a slightly different patch.
Monday, June 6, 2011
DHS Updates Chem Sector Security Summit Page
Today DHS updated their web page for the 2011 Chemical Sector Security Summit (CSSS) which will take place in Baltimore on July 6th and 7th (and 5th and 8th if you include the pre- and post-summit programs) this year. The updated information includes the agenda for the summit and procedures for getting your name on the standby list for attendance at the summit.
Agenda
The general outline of the agenda is pretty much the same that was outlined in the preliminary agenda (there is still a link to the preliminary agenda on the current page; kind of odd in a pleasantly quirky way) that I discussed in an earlier blog post. The main difference is that there is a lot more detail provided in the descriptions of the agenda items.
Given the recent reorganization of ISCD it is interesting to note that there will be some familiar faces from the old regime making presentations at this Summit. Sue Armstrong will be reprising her presentation on the status of the CFATS – Ammonium Nitrate programs and Larry Stanton will be updating his presentation from last year (and the two years before that) on Theft and Diversion Chemicals.
Recorded Presentations
There is another interesting development mentioned in this agenda that I certainly applaud. On the listing for the 9:30 session on July 6th on “DHS Voluntary Programs and Resources Panel” there is a special note; “This session may be recorded and may be posted on the Web after the Summit.” I would have preferred to see all of the sessions recorded and posted, but it is a new technique for the organizers of this Summit, so a limited trial is certainly reasonable.
I personally would have liked to see one of the other presentations used for this trial (based upon my personal interests, of course), but I do have to admit that this presentation has the largest potential audience in the chemical community. That makes this a very reasonable choice for this experiment.
Hopefully this will be a wildly successful experiment and will attract wide spread attention in the chemical security community. The more hits/views that this presentation logs in the coming months, the more likely that this will be expanded next year; providing the bulk of the chemical security community with virtual access to this Summit.
Agenda
The general outline of the agenda is pretty much the same that was outlined in the preliminary agenda (there is still a link to the preliminary agenda on the current page; kind of odd in a pleasantly quirky way) that I discussed in an earlier blog post. The main difference is that there is a lot more detail provided in the descriptions of the agenda items.
Given the recent reorganization of ISCD it is interesting to note that there will be some familiar faces from the old regime making presentations at this Summit. Sue Armstrong will be reprising her presentation on the status of the CFATS – Ammonium Nitrate programs and Larry Stanton will be updating his presentation from last year (and the two years before that) on Theft and Diversion Chemicals.
Recorded Presentations
There is another interesting development mentioned in this agenda that I certainly applaud. On the listing for the 9:30 session on July 6th on “DHS Voluntary Programs and Resources Panel” there is a special note; “This session may be recorded and may be posted on the Web after the Summit.” I would have preferred to see all of the sessions recorded and posted, but it is a new technique for the organizers of this Summit, so a limited trial is certainly reasonable.
I personally would have liked to see one of the other presentations used for this trial (based upon my personal interests, of course), but I do have to admit that this presentation has the largest potential audience in the chemical community. That makes this a very reasonable choice for this experiment.
Hopefully this will be a wildly successful experiment and will attract wide spread attention in the chemical security community. The more hits/views that this presentation logs in the coming months, the more likely that this will be expanded next year; providing the bulk of the chemical security community with virtual access to this Summit.
DHS Publishes Plan for Review of Regulations
Today the Department of Homeland Security published a notice in the Federal Register noting the public availability of their Preliminary Plan for Retrospective Review of Existing Regulations and requesting public comments on that plan. This plan outlines how the Department expects to comply with Executive Order 13563, “Improving Regulation and Regulatory Review”.
In general, the Department is going to focus its review effort on the regulations written and maintained by the six operational components of DHS with regulatory responsibilities. Those components are:
DHS had requested public comments on items to be include in this plan back in March. DHS set up an IdeaScale web page to accept such comments as well accepting comments on the Regulations.gov website. Readers of this blog will be interested in the comments received on the CFATS program. Those comments addressed:
Regulations to be Reviewed
The Preliminary plan provides three appendixes that list the regulations that are currently covered in the review process. Appendix A lists recently published regulations and Information Collection Requests (ICRs) that DHS is taking credit for having completed this review process. Appendix B lists the regulations and ICRs currently under review for a variety of reasons. Appendix C lists the regulations and ICRs that are candidates for the retrospective review process covered in this Preliminary Plan.
The CFATS regulations are listed in Appendix C.
In general, the Department is going to focus its review effort on the regulations written and maintained by the six operational components of DHS with regulatory responsibilities. Those components are:
• Citizenship and Immigration Services (USCIS)Public Comment Support Plan
• Coast Guard (USCG or Coast Guard)
• U.S. Customs and Border Protection (CBP)
• Federal Emergency Management Agency (FEMA)
• U.S. Immigration and Customs Enforcement (ICE)
• Transportation Security Administration (TSA)
DHS had requested public comments on items to be include in this plan back in March. DHS set up an IdeaScale web page to accept such comments as well accepting comments on the Regulations.gov website. Readers of this blog will be interested in the comments received on the CFATS program. Those comments addressed:
• Overlapping jurisdictions covering chemical facility security;The Preliminary Plan addresses the first three comments by stating:
• Application of CFATS to research laboratories;
• Application of CFATS to gasoline; and
• Reducing the burden associated with Chemical-Terrorism Vulnerability Information
“During the CFATS rulemaking in 2007, commenters raised similar issues, and DHS considered them in the final rule. Regarding the gasoline related issues, DHS issued a Federal Register notice in January 2010, seeking additional comment on several gasoline-related issues; comments received in response to that notice are currently under review. DHS is continuing to review these retrospective review focused comments more closely to determine the appropriateness and scope of retrospective review of the CFATS regulation.”DHS noted that the CVI issue is being addressed under a separate Executive Order; EO 13556, “Controlled Unclassified Information”.
Regulations to be Reviewed
The Preliminary plan provides three appendixes that list the regulations that are currently covered in the review process. Appendix A lists recently published regulations and Information Collection Requests (ICRs) that DHS is taking credit for having completed this review process. Appendix B lists the regulations and ICRs currently under review for a variety of reasons. Appendix C lists the regulations and ICRs that are candidates for the retrospective review process covered in this Preliminary Plan.
The CFATS regulations are listed in Appendix C.
Sunday, June 5, 2011
Congressional Hearings – Week of 6-6-11
Well last week the Senate was out-of-town; this week it will be the House that will be back home talking with constituents. There will only be two hearings of possible (and I’m really stretching it this week) interest to the chemical or cyber security communities. One will deal with the Surface Transportation Board and the other with emergency response.
STB Authorization
On Wednesday the Senate Commerce, Science and Transportation Committee will be holding a Full Committee mark-up of a number of bill including S. 158, Surface Transportation Board Reauthorization Act of 2011. Most of this bill is rather arcane railroad related stuff but there is a study requirement about interchange rules that I mentioned in my blog about the introduction of this bill. As I concluded in that blog, it will be interesting to see if this provision is changed in the legislative process to clearly include a requirement to analyze the affect of these interchange rules on the route selection process for security sensitive materials.
Of course, given the way this Committee operates it will be months before we see anything about changes made to the bills during this markup. We won’t have any idea what changes are made until the Committee finally prints their report on the bill.
Emergency Management
The Senate Appropriations Committee’s Subcommittee on Homeland Security will hold a hearing on Wednesday looking at “the status of emergency management in the U.S., including the important role communications systems play during a disaster”. I’m assuming that this is designed to inform the Subcommittees funding of interoperable communications in the Senate’s version of the DHS FY 2012 appropriations bill.
It would be interesting to see if anyone asks the two government witnesses about planning for emergency response at large high-risk chemical facilities, but I won’t hold my breath. This is another issue that everyone is happy to ignore until it comes time for finger pointing.
STB Authorization
On Wednesday the Senate Commerce, Science and Transportation Committee will be holding a Full Committee mark-up of a number of bill including S. 158, Surface Transportation Board Reauthorization Act of 2011. Most of this bill is rather arcane railroad related stuff but there is a study requirement about interchange rules that I mentioned in my blog about the introduction of this bill. As I concluded in that blog, it will be interesting to see if this provision is changed in the legislative process to clearly include a requirement to analyze the affect of these interchange rules on the route selection process for security sensitive materials.
Of course, given the way this Committee operates it will be months before we see anything about changes made to the bills during this markup. We won’t have any idea what changes are made until the Committee finally prints their report on the bill.
Emergency Management
The Senate Appropriations Committee’s Subcommittee on Homeland Security will hold a hearing on Wednesday looking at “the status of emergency management in the U.S., including the important role communications systems play during a disaster”. I’m assuming that this is designed to inform the Subcommittees funding of interoperable communications in the Senate’s version of the DHS FY 2012 appropriations bill.
It would be interesting to see if anyone asks the two government witnesses about planning for emergency response at large high-risk chemical facilities, but I won’t hold my breath. This is another issue that everyone is happy to ignore until it comes time for finger pointing.
STB TIH Advisory Committee Killed
Last August I wrote about [link added 6-5-11; 11:45] a move by the Surface Transportation Safety Board to establish an advisory committee, the Toxic by Inhalation Hazard Common Carrier Transportation Advisory Committee (TIHCCTAC), that would help the Board develop the information necessary to resolve a variety of disputes between TIH shippers and the carrying railroads. I hadn’t heard anything about the actions of this board so I went searching and found that the STB had killed the idea [link added 6-5-11; 11:45] back in April.
In its decision [link added 6-5-11; 11:45] canceling the formation of the TIHCCTAC, and closing out the open docket on the examination of the common carrier obligation to carry TIH chemicals, the STB cited fundamental disagreements on legal issues between the chemical producers and the railroads, as well as concerns about the anti-trust issues.
It was always a long shot that an Advisory Committee like the one proposed by the STB last summer would be able to get these two groups to sit down and iron out the serious differences between them. But, as the STB points out, the failure of this attempt leaves the board to decide these issues on case-by-case basis, like the two chlorine transportation disputes currently before the board.
TIH Transportation Dispute
There is a fundamental issue dividing these two groups. The position of the TIH producers and shippers is clear; they need the railroads to transport their products, including such chemicals as chlorine gas and anhydrous ammonia (the two largest volume toxic inhalation chemicals shipped in the United States). Not only is rail transportation generally cheaper than transporting their products by truck, but it is inherently safer for a variety of reasons.
The railroads don’t really want to carry these dangerous chemicals. Under current laws and regulations they bear sole financial responsibility (actually the railroads and their insurance carriers) for damages resulting from a release of the chemicals in transit. While the railroads have a good safety record transporting these chemicals, the Graniteville, SC accident (hardly a worst case scenario accident by any means) shows how expensive a TIH accident can become.
Railroads have little option when it comes to deciding whether or not to accept these chemicals for transportation. Under Federal laws they were given virtual monopolies for major portions of their routes. To protect shippers from monopolistic economics, the railroads are required to accept all properly offered shipments, commonly known as their common carrier obligation.
When it is suggested that the shippers should share in the financial responsibility for transit releases the chemical industry is quick to point out that the most of the catastrophic releases that do occur have been the result of problems caused by the railroads or their employees. They note that they still have legal responsibility for any releases caused by their failure to properly prepare the railcars for shipment.
Transportation Security
The conflict between shippers and railroads are further complicated by the issue of transportation security. Given the nature of the physical hazards associated with TIH chemicals these TIH railcars are an obvious potential terrorist target. Given the amount of TIH chemical transported in a single railcar they have the potential for generating a toxic cloud that can cover an extensive area in the event of a catastrophic release. It is obvious why this is just about the only mode of surface transportation that is significantly regulated for transportation security issues.
The most significant and burdensome security regulations concern points in transit where there is a change in possession of the railcars. The transitions between shipper and carrier, between carriers, and from carrier to receiver have well defined security responsibilities and procedures. Thus it is in the best interest of railroads to minimize these transitions. Additionally the railroads have informally agreed with the Transportation Security Administration (TSA) to minimize the time these railcars sit idle during transit.
With the way that rail lines have been designed and urban areas have grown up around node points in the rail network, it is inevitable that long distance transportation of TIH chemicals results in their routing through urban areas. This, in turn, causes the risk of attack on these railcars to increase as urban areas are a much more lucrative terrorist targets than open country.
Urban security and safety planners readily recognize the extent of the potential hazard associated with the transit of TIH chemicals. Unless the shipper or receiver of TIH railcars reside within their jurisdiction, there is no economic incentive or benefit to having these chemicals move through ones jurisdiction to compensate for the huge potential liability of a terrorist attack or even a transportation accident resulting in a catastrophic release of these chemicals that could cause hundreds of thousands of injuries and deaths.
An effort was made to regulate the routing of TIH chemical shipment. Because of the complex nature of the routing decision, the physical limitations associated with rail transportation, and political constraints, these routing regulations are so vague as to be practically meaningless beyond being a documentation exercise.
Case-by-Case Problem Resolution
It is in this environment that the Surface Transportation Board is called upon to resolve conflicts between TIH shippers and railroads. These conflicts generally boil down to railroads attempting to limit their physical or financial liability for TIH shipments while the shippers are trying to maximize their economic benefit from shipping the chemicals to various markets.
One can sympathize with the STB for not wanting to become involved in these convoluted conflicts. Both sides have utilized their substantial political power to ensure that Congress is unable to come down clearly on one-side or the other in these disputes. So they continue to fight at the margins in these disputes, trying to gain advantage before the STB.
As long as this remains essentially a safety issue, there will be no real resolution to the underlying problems. The safety record for both shippers and railroads in this area is really pretty impressive. But, as soon as this actually involves a real terrorist attack (successful or otherwise) on a TIH shipment in a major urban area, the political situation will drastically change and the third party to this dispute, the pubic put at risk, will be heard. When that occurs, the political knee-jerk reaction will be swift and uncomfortable in the extreme for both the railroads and the shippers.
The only one to benefit in that situation will be the Surface Transportation Board; they will then have much clearer guidance upon which to base their decisions.
In its decision [link added 6-5-11; 11:45] canceling the formation of the TIHCCTAC, and closing out the open docket on the examination of the common carrier obligation to carry TIH chemicals, the STB cited fundamental disagreements on legal issues between the chemical producers and the railroads, as well as concerns about the anti-trust issues.
It was always a long shot that an Advisory Committee like the one proposed by the STB last summer would be able to get these two groups to sit down and iron out the serious differences between them. But, as the STB points out, the failure of this attempt leaves the board to decide these issues on case-by-case basis, like the two chlorine transportation disputes currently before the board.
TIH Transportation Dispute
There is a fundamental issue dividing these two groups. The position of the TIH producers and shippers is clear; they need the railroads to transport their products, including such chemicals as chlorine gas and anhydrous ammonia (the two largest volume toxic inhalation chemicals shipped in the United States). Not only is rail transportation generally cheaper than transporting their products by truck, but it is inherently safer for a variety of reasons.
The railroads don’t really want to carry these dangerous chemicals. Under current laws and regulations they bear sole financial responsibility (actually the railroads and their insurance carriers) for damages resulting from a release of the chemicals in transit. While the railroads have a good safety record transporting these chemicals, the Graniteville, SC accident (hardly a worst case scenario accident by any means) shows how expensive a TIH accident can become.
Railroads have little option when it comes to deciding whether or not to accept these chemicals for transportation. Under Federal laws they were given virtual monopolies for major portions of their routes. To protect shippers from monopolistic economics, the railroads are required to accept all properly offered shipments, commonly known as their common carrier obligation.
When it is suggested that the shippers should share in the financial responsibility for transit releases the chemical industry is quick to point out that the most of the catastrophic releases that do occur have been the result of problems caused by the railroads or their employees. They note that they still have legal responsibility for any releases caused by their failure to properly prepare the railcars for shipment.
Transportation Security
The conflict between shippers and railroads are further complicated by the issue of transportation security. Given the nature of the physical hazards associated with TIH chemicals these TIH railcars are an obvious potential terrorist target. Given the amount of TIH chemical transported in a single railcar they have the potential for generating a toxic cloud that can cover an extensive area in the event of a catastrophic release. It is obvious why this is just about the only mode of surface transportation that is significantly regulated for transportation security issues.
The most significant and burdensome security regulations concern points in transit where there is a change in possession of the railcars. The transitions between shipper and carrier, between carriers, and from carrier to receiver have well defined security responsibilities and procedures. Thus it is in the best interest of railroads to minimize these transitions. Additionally the railroads have informally agreed with the Transportation Security Administration (TSA) to minimize the time these railcars sit idle during transit.
With the way that rail lines have been designed and urban areas have grown up around node points in the rail network, it is inevitable that long distance transportation of TIH chemicals results in their routing through urban areas. This, in turn, causes the risk of attack on these railcars to increase as urban areas are a much more lucrative terrorist targets than open country.
Urban security and safety planners readily recognize the extent of the potential hazard associated with the transit of TIH chemicals. Unless the shipper or receiver of TIH railcars reside within their jurisdiction, there is no economic incentive or benefit to having these chemicals move through ones jurisdiction to compensate for the huge potential liability of a terrorist attack or even a transportation accident resulting in a catastrophic release of these chemicals that could cause hundreds of thousands of injuries and deaths.
An effort was made to regulate the routing of TIH chemical shipment. Because of the complex nature of the routing decision, the physical limitations associated with rail transportation, and political constraints, these routing regulations are so vague as to be practically meaningless beyond being a documentation exercise.
Case-by-Case Problem Resolution
It is in this environment that the Surface Transportation Board is called upon to resolve conflicts between TIH shippers and railroads. These conflicts generally boil down to railroads attempting to limit their physical or financial liability for TIH shipments while the shippers are trying to maximize their economic benefit from shipping the chemicals to various markets.
One can sympathize with the STB for not wanting to become involved in these convoluted conflicts. Both sides have utilized their substantial political power to ensure that Congress is unable to come down clearly on one-side or the other in these disputes. So they continue to fight at the margins in these disputes, trying to gain advantage before the STB.
As long as this remains essentially a safety issue, there will be no real resolution to the underlying problems. The safety record for both shippers and railroads in this area is really pretty impressive. But, as soon as this actually involves a real terrorist attack (successful or otherwise) on a TIH shipment in a major urban area, the political situation will drastically change and the third party to this dispute, the pubic put at risk, will be heard. When that occurs, the political knee-jerk reaction will be swift and uncomfortable in the extreme for both the railroads and the shippers.
The only one to benefit in that situation will be the Surface Transportation Board; they will then have much clearer guidance upon which to base their decisions.
Saturday, June 4, 2011
DHS Incident Reporting Page Update 06-02-11
On Thursday DHS updated their web page for incident reporting. They added a new section and removed a section that was on the earlier version of the web page.
See Something Say Something
The added information is a section at the top of the page for the Department’s “See Something Say SomethingTM” campaign. It advises people to report suspicious activity to the local police and to dial 911 in the event of an emergency. It also provides a link to the web site for “See Something Say Something” campaign.
This is, of course, good information, but it is a sad comment on the state of security awareness in the country when a Federal agency like DHS has to take this kind of formal effort to push a publicity campaign to get the public to report suspicious activity to their local police.
FBI Removed from Site
The 4S blurb actually replaces a section found on the earlier site for reporting suspected criminal or terrorist activity. That earlier section urged reporting to the FBI instead of local police and provided multiple links to the FBI. That section didn’t provide a distinction between suspicious activity and an emergency situation which would require notification via 911.
Sadly, when the 4S section was added it did totally replace the earlier information and there is now no link to the FBI on this web page. It’s sad because the FBI is the agency on the Federal level that is tasked with investigating terrorism. Of course, one would like to think that a suspicious activity report specifically linked to a possible terrorist attack submitted to the local police would automatically be forwarded to the FBI in a timely manner.
Now I understand that the distinction between what suspicious activity should be reported to the local police and which should be reported directly to the FBI is a fairly sophisticated concept. I would suggest, however, that someone who is going to look for a DHS web site on incident reporting to look for suspicious activity contact information is probably capable of understanding that distinction if even a modicum of writing talent is used in the explanation.
Missing Information
This site provides contact information for reporting suspicious activity for immigration issues, chemical facility issues, computer issues and activity in and around Federal Buildings. It doesn’t, however, provide contact information for incidents involving either transportation or maritime related activity. I don’t understand why the two largest counter-terrorism programs within the Department (TSA and Coast Guard/MTSA) are ignored like this.
See Something Say Something
The added information is a section at the top of the page for the Department’s “See Something Say SomethingTM” campaign. It advises people to report suspicious activity to the local police and to dial 911 in the event of an emergency. It also provides a link to the web site for “See Something Say Something” campaign.
This is, of course, good information, but it is a sad comment on the state of security awareness in the country when a Federal agency like DHS has to take this kind of formal effort to push a publicity campaign to get the public to report suspicious activity to their local police.
FBI Removed from Site
The 4S blurb actually replaces a section found on the earlier site for reporting suspected criminal or terrorist activity. That earlier section urged reporting to the FBI instead of local police and provided multiple links to the FBI. That section didn’t provide a distinction between suspicious activity and an emergency situation which would require notification via 911.
Sadly, when the 4S section was added it did totally replace the earlier information and there is now no link to the FBI on this web page. It’s sad because the FBI is the agency on the Federal level that is tasked with investigating terrorism. Of course, one would like to think that a suspicious activity report specifically linked to a possible terrorist attack submitted to the local police would automatically be forwarded to the FBI in a timely manner.
Now I understand that the distinction between what suspicious activity should be reported to the local police and which should be reported directly to the FBI is a fairly sophisticated concept. I would suggest, however, that someone who is going to look for a DHS web site on incident reporting to look for suspicious activity contact information is probably capable of understanding that distinction if even a modicum of writing talent is used in the explanation.
Missing Information
This site provides contact information for reporting suspicious activity for immigration issues, chemical facility issues, computer issues and activity in and around Federal Buildings. It doesn’t, however, provide contact information for incidents involving either transportation or maritime related activity. I don’t understand why the two largest counter-terrorism programs within the Department (TSA and Coast Guard/MTSA) are ignored like this.
Friday, June 3, 2011
NRC Facilities Exempt from CFATS
As I noted yesterday DHS and the Nuclear Regulatory Commission (NRC) have signed an memorandum of understanding (MOU) that addresses the provisions of the §550 CFATS authorization language that exempts from CFATS coverage “any facility subject to regulation by the Nuclear Regulatory Commission”. It clarifies the ‘subject to regulation’ wording, establishes procedures for DHS and NRC to evaluate the status of individual facilities, and provides for changes to that status brought about by changes at the facility.
Subject to Regulation
Section 4b of the MOU provides the definition of the Section 550 exemption language as agreed to by DHS and NRC. That definition has three core ideas. First it clarifies that the exemption may apply to just part of a facility. Next it requires that NRC or an Agreement State (a State that has reached an agreement with the NRC to enforce NRC regulations) “imposes significant security requirements that protect an NRC-licensed or Agreement-State-licensed material”. Finally it requires that “the licensee has implemented security requirements” for the definition to apply.
Section 5a addresses the issue of facilities that may only be partially exempt from CFATS coverage. It specifically notes that: “DHS and the NRC acknowledge that a facility that is subject to NRC regulations could contain areas that are not subject to NRC regulations and that such areas, as determined by the parties under Section 6(b) of this MOU, may be subject to DHS regulations under CFATS.”
Section 5c provides that the NRC will provide DHS with a list of facilities that NRC believes are covered, or partially covered by the NRC CFATS exemption. For partially covered facilities it specifies that “the NRC will provide DHS with sufficient information to identify any area within the facility that should not be subject to the exemption from the CFATS rule”. Once DHS and NRC staffs agree on a list of exempted facilities, DHS will notify facilities of their exemption or the limits of their exemption from the CFATS requirements.
Yesterday’s publication of the Federal Register notice marked the end of the 60-day period that NRC was allotted in the MOU to provide the list of covered facilities to DHS. There is nothing in the MOU that indicates when we might expect to see DHS provide facilities with their notification of exemption. Hopefully ISCE will provide a date by which covered facilities would expect to have received their notification. That would be the only way that facilities not covered by the NRC exemption might know that they have fallen outside of that process.
Dual Coverage Facilities
The NRC will provide DHS a list of facilities that might contain areas not exempted from CFATS coverage. I would expect that DHS would use that list to specifically notify those facilities that areas of their facility are not exempt and for those facilities to submit a Top Screen for those areas if they have covered COI at or above the screening threshold quantity set for those COI.
Once DHS makes a determination that an ‘uncovered’ portion of an NRC regulated facility is a high-risk chemical facility the life for the security management team at that facility is bound to get interesting. Since it would not be unexpected for there to be conflicting security requirements under CFATS and NRC regulations, §7a provides that “DHS and the NRC may jointly establish implementing agreements specific to the responsibilities and authorities of their respective agencies at any facility subject to both DHS and NRC regulation, as well as information-sharing protocols, or similar agreements with respect to such a facility”.
Public Information
I want to congratulate the NRC for making this MOU public in this manner. We had been led to believe that the discussions between the Coast Guard and ISCD on the limits of the MTSA exemption to CFATS were more advanced than those with the NRC. That would be expected since ISCD and the CG both work for the DHS Secretary. When that MOU is finally signed, I would hope that DHS follows the example set by the NRC in publishing the details of that MOU.
Subject to Regulation
Section 4b of the MOU provides the definition of the Section 550 exemption language as agreed to by DHS and NRC. That definition has three core ideas. First it clarifies that the exemption may apply to just part of a facility. Next it requires that NRC or an Agreement State (a State that has reached an agreement with the NRC to enforce NRC regulations) “imposes significant security requirements that protect an NRC-licensed or Agreement-State-licensed material”. Finally it requires that “the licensee has implemented security requirements” for the definition to apply.
Section 5a addresses the issue of facilities that may only be partially exempt from CFATS coverage. It specifically notes that: “DHS and the NRC acknowledge that a facility that is subject to NRC regulations could contain areas that are not subject to NRC regulations and that such areas, as determined by the parties under Section 6(b) of this MOU, may be subject to DHS regulations under CFATS.”
Section 5c provides that the NRC will provide DHS with a list of facilities that NRC believes are covered, or partially covered by the NRC CFATS exemption. For partially covered facilities it specifies that “the NRC will provide DHS with sufficient information to identify any area within the facility that should not be subject to the exemption from the CFATS rule”. Once DHS and NRC staffs agree on a list of exempted facilities, DHS will notify facilities of their exemption or the limits of their exemption from the CFATS requirements.
Yesterday’s publication of the Federal Register notice marked the end of the 60-day period that NRC was allotted in the MOU to provide the list of covered facilities to DHS. There is nothing in the MOU that indicates when we might expect to see DHS provide facilities with their notification of exemption. Hopefully ISCE will provide a date by which covered facilities would expect to have received their notification. That would be the only way that facilities not covered by the NRC exemption might know that they have fallen outside of that process.
Dual Coverage Facilities
The NRC will provide DHS a list of facilities that might contain areas not exempted from CFATS coverage. I would expect that DHS would use that list to specifically notify those facilities that areas of their facility are not exempt and for those facilities to submit a Top Screen for those areas if they have covered COI at or above the screening threshold quantity set for those COI.
Once DHS makes a determination that an ‘uncovered’ portion of an NRC regulated facility is a high-risk chemical facility the life for the security management team at that facility is bound to get interesting. Since it would not be unexpected for there to be conflicting security requirements under CFATS and NRC regulations, §7a provides that “DHS and the NRC may jointly establish implementing agreements specific to the responsibilities and authorities of their respective agencies at any facility subject to both DHS and NRC regulation, as well as information-sharing protocols, or similar agreements with respect to such a facility”.
Public Information
I want to congratulate the NRC for making this MOU public in this manner. We had been led to believe that the discussions between the Coast Guard and ISCD on the limits of the MTSA exemption to CFATS were more advanced than those with the NRC. That would be expected since ISCD and the CG both work for the DHS Secretary. When that MOU is finally signed, I would hope that DHS follows the example set by the NRC in publishing the details of that MOU.
Subscribe to:
Posts (Atom)
Posts
