311 Cannon House Office Building
Thank you, Chairman Meehan, Ranking Member Clarke, and distinguished Members of the Subcommittee. I appreciate the opportunity to appear before you today to discuss the Department of Homeland Security’s (DHS) regulation of high-risk chemical facilities under the Chemical Facility Anti-Terrorism Standards (CFATS). Over the past year, the CFATS program has made significant progress, advancing programmatically while simultaneously addressing internal operational concerns. The Department remains committed to working with stakeholders and with Congress on a path forward so that the CFATS program continues to improve. Today I will focus on the progress made over the last year and a half, as well as activities undertaken since the explosion at the West Fertilizer Company in April 2013.
The CFATS program has made our Nation more secure by identifying and regulating high-risk chemical facilities to ensure they have security measures in place to reduce the risks associated with their possession of chemicals of interest. CFATS has also played a role in reducing the number of high-risk chemicals, as more than 3,000 facilities have eliminated, reduced or modified their holdings of certain chemicals of interest. The significant reduction in the number of chemical facilities that represent the highest risk is an important success of the CFATS program and is attributable both to the design of the program as enacted by Congress and to the work of CFATS personnel and industry at thousands of chemical facilities. We welcome the opportunity to work with stakeholders to further improve this vital national security program.
The National Protection and Programs Directorate (NPPD) Infrastructure Security Compliance Division (ISCD) continually evaluates the program to identify areas for improvement to ensure proper implementation. Through ISCD’s comprehensive Action Plan, we have identified and acted decisively to address areas in which improvements to the CFATS program and associated supporting activities were warranted. As of July 15, 2013, 90 of the 95 action items contained in the current Action Plan have been completed. In fact, this spring, the DHS Office of the Inspector General (OIG) issued a report on ISCD progress, which examined many of the program’s historic challenges. The OIG report confirmed what we had made efforts to correct through the Action Plan—23 of the 24 Recommendations were deemed resolved. Now that the Department has concluded this period of internal improvements, programmatic processes and structures are in place so we can focus our efforts on implementing the program.
As you are aware, the Department’s current statutory authority to implement CFATS—Section 550 of the fiscal year (FY) 2007 Department of Homeland Security Appropriations Act, as amended—currently extends through October 4, 2013. DHS recognizes the significant work that the Subcommittee and others have undertaken to reauthorize the CFATS program. The Department supports a permanent authorization for the CFATS program and is committed to working with Congress and other security partners to establish a permanent authority for the CFATS program in Federal law. We firmly believe permanent authorization will provide industry with the necessary stability to move forward in effectively implementing CFATS and will send a clear message to facilities that may be seeking to avoid their obligation to report dangerous chemicals that the CFATS program is here to stay.
CFATS Implementation Progress
The cornerstone of the CFATS program in regulating the security of high-risk chemical facilities is the development, submission, and implementation of Site Security Plans (SSPs), or Alternative Security Programs (ASPs) in lieu of SSPs, which document the security measures that high-risk chemical facilities utilize to satisfy the applicable Risk-Based Performance Standards (RBPS) under CFATS. It is important to note that these plans are not “one size fits all,” but in-depth, highly customized, and dependent on each facility’s unique circumstances.
Status of CFATS Regulated Facilities
| Tier* | Total # of Facilities | Received Final Tier | Authorized SSPs and ASPs | Authorization Inspection Conducted | Approved SSPs and ASPs |
|---|---|---|---|---|---|
| 1 | 125 | 113 | 103 | 85 | 63 |
| 2 | 457 | 367 | 202 | 176 | 91 |
| 3 | 1228 | 1017 | 230 | 97 | 6 |
| 4 | 2426 | 1865 | 1 | 0 | 0 |
| Total | 4298 | 3362 | 536 | 358 | 160 |
In order to determine whether a facility is regulated under CFATS, the facility uses the web-based Chemical Security Assessment Tool (CSAT), to submit a Top-Screen to ISCD. Since we began collecting this information in 2007, ISCD has data from more than 44,000 Top-Screens submitted by chemical facilities, providing important information about their chemical holdings. Based on the information received in the Top-Screens, ISCD identified more than 8,500 facilities that were initially designated as high-risk facilities potentially regulated by CFATS. These facilities then compiled and submitted Security Vulnerability Assessments, which are used by ISCD to identify which facilities present a terrorism risk that is sufficiently high to warrant the assignment of a final high-risk tier under CFATS.
As of July 15, 2013, CFATS covers 4,298 high-risk facilities nationwide; of these, 3,362 have received final high-risk tier determinations and are required to develop SSPs (or ASPs) for ISCD review. The remaining facilities are awaiting final tier determinations based on their Security Vulnerability Assessment submissions. The tiered population is dynamic and subject to change, depending on the conditions at facilities.
As a part of our commitment to continue moving the CFATS program forward, NPPD is conducting a thorough review of the risk assessment process. In support of this, NPPD has implemented a phased approach, which is captured in the ISCD Action Plan and includes: documenting all processes and procedures relating to the risk assessment methodology; conducting an internal NPPD review of the risk assessment process; and initiating an external peer review of the risk assessment methodology. We expect the peer review to provide input on how DHS can enhance the CFATS tiering models as appropriate. ISCD continues to issue final tier notifications to facilities across all four risk tiers. Facilities that receive a final high-risk determination are notified of the requirement to complete and submit an SSP or an ASP. Tiering determinations are dynamic and can change based on actions a facility takes. For example, a tiering determination can change when a facility voluntarily alters its operations in a material way that reduces its risk profile.
Inspections. ISCD is currently carrying out authorization inspections for Tier 1, 2, and 3 facilities. Authorization inspections are scheduled after ISCD’s review of an SSP (or ASP) results in a preliminary determination that the SSP satisfies applicable RBPS and issues a Letter of Authorization. From Fall 2011 to Spring 2012, ISCD updated and revised its internal inspections policy and guidance materials for conducting inspections. After releasing the updated guidance materials, inspector training sessions were conducted, which focused on the updated policy, procedures and related materials to better prepare Chemical Security Inspectors to resume authorization inspections. Since resuming authorization inspections in July 2012, ISCD has conducted more than 350 authorization inspections. The authorization inspection results, as well as any further revisions that the facility may make to the SSP (or ASP), are reviewed to make a final determination as to whether the facility’s SSP satisfies the applicable RBPS and whether to issue a Letter of Approval. ISCD anticipates that we will complete the approvable Tier 1 security plans by first quarter FY 2014 and approvable Tier 2 security plans by third quarter FY 2014. Once issued a Letter of Approval, the facility must implement the security measures detailed in the SSP (or ASP). ISCD has made great strides in improving our inspection process over the past year, and we continue to identify efficiencies to keep moving forward. In September 2013, ISCD plans to begin conducting compliance inspections for facilities with approved SSPs. These inspections will generally be conducted approximately one year after their SSPs were approved.
A Shared Responsibility
We feel strongly that our private sector partners are key to our efforts to enhance data sharing, increase cross-training, and identify areas for possible regulatory changes as well as identifying possible gaps in existing statutory authorities. Enhancing security and building resilience across the chemical sector is not something a single company, industry or even government can do by itself. This has to be a collaborative effort. It also has to be a comprehensive effort, because of the sheer complexity of the sector, its linkages to other sectors, and the potential cascading effects and consequences of a significant attack or disruption.
Since the West, Texas tragedy, we have engaged with numerous members of industry and all have agreed that we must work together to prevent future incidents. Industry has offered to spread our message and do their part to promote safety and security at chemical facilities. The Department appreciates this support and looks forward to working with industry and our government partners to carry out these activities. We’ve made a lot of progress in advancing chemical security in this country, though we still have a lot of work to do. We must remain steadfast in our commitment to continue to collectively identify and develop programs that improve our security posture.
Outreach to Stakeholders
Industry Engagement and Information Sharing. Since the establishment of the CFATS program in April 2007, NPPD has conducted significant outreach to the regulated community and other interested or affected entities so that they are aware of the program’s requirements. NPPD and ISCD management and staff have presented at hundreds of security and chemical industry gatherings and participated in a variety of other meetings. As part of this outreach initiative, NPPD and ISCD leadership have regularly updated affected sectors through their Sector Coordinating Councils and the Government Coordinating Councils—including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. To promote information sharing, ISCD has developed several communication tools for stakeholder use, including: the Chemical Security website (www.DHS.gov/chemicalsecurity); a help desk for CFATS-related questions; a CFATS tip-line for anonymous chemical security reporting; and CFATS-Share, a web-based information-sharing portal that provides certain Federal, state, and local agencies access to key details on CFATS facility information as needed.
Compliance Assistance and Facility Outreach. Chemical Security Inspectors provide assistance and outreach directly to facilities. At any point in the CFATS process, a facility can request a Compliance Assistance Visit to provide support in preparing the necessary security-related documentation required under CFATS. During these visits, chemical inspectors offer compliance and technical assistance in the completion of the CSAT registration, Top Screen, Security Vulnerability Assessment, or Site Security Plan. As of July 15, 2013, ISCD has conducted more than 1,260 Compliance Assistance Visits. In addition to conducting inspections and supporting Compliance Assistance Visits at regulated facilities, NPPD’s chemical inspectors actively work with facilities, local stakeholders, and governmental agencies across the country. Collectively, they have participated in more than 5,260 meetings with Federal, state, and local officials; held more than 4,680 introductory meetings with owners and operators of CFATS-regulated or potentially regulated facilities.
Engaging First Responders. The Department also has engaged numerous local emergency planning committees and routinely interacts with first responders across the country. Additionally, starting in July 2012, the Department began, upon request, sharing lists of CFATS facilities with local emergency responders. The Department has also developed and disseminated outreach material targeted at members of the emergency response community, and encourages facilities to conduct their own outreach to their community, local law enforcement, and emergency responders, to include participation in Local Emergency Planning Committees and similar local emergency responder based organizations. To satisfy CFATS RBPS- 9 (Response), a high-risk facility generally will be expected to maintain and exercise an emergency plan to respond to security incidents internally and with the assistance of local law enforcement and first responders. Finally, DHS, the Environmental Protection Agency (EPA), and the State of New Jersey recently convened a meeting with representatives from approximately 25 fire stations within New Jersey to discuss their level of preparedness to respond to an incident at a chemical facility within their jurisdiction and identify both potential ways to increase their preparedness and lessons learned that can be shared with other fire departments.
Early Efforts to Identify Non-Compliant Facilities
The first step in identifying potentially regulated facilities is through self-reporting by members of the affected population. Under the CFATS, any facility that possesses a threshold level of one or more chemicals of interest established by the Department is required to submit a Top-Screen to DHS. Throughout the existence of CFATS, DHS has undertaken and continues to support extensive outreach and industry engagement to ensure that non-exempt facilities that possess threshold levels of chemicals of interest comply with their Top-Screen submission requirements. These activities have, in concert with the efforts of our industry stakeholders, accounted for the significant number of Top-Screens industry members have submitted to date. The CFATS-regulated community, however, is expansive and dynamic, and, like many other regulators, the Department must be able to count on facilities that possess threshold levels of chemicals of interest to meet their reporting obligations under CFATS. DHS is committed to pursuing all reasonable measures to identify potentially non-compliant facilities, encouraging and assisting them in coming into compliance, and, where appropriate, using the enforcement mechanisms available to DHS to bring any non-compliant facilities into compliance.
Since the inception of CFATS, DHS has undertaken efforts to identify facilities that should have submitted a Top-Screen but have failed to do so. Beginning in the summer of 2008, ISCD identified multiple approaches to identifying and contacting facilities that were potentially non-compliant for failure to submit a Top-Screen, including:
- A pilot program with the state Homeland Security Advisors (HSAs) from New York and New Jersey to identify potentially non-compliant facilities within their respective states
- Exchanges of data with the EPA in an attempt to identify facilities that, based on filings submitted pursuant to EPA regulations, likely should have submitted a Top-Screen but failed to do so
- An analysis—by industry segment/sector and chemical of interest—of the CFATS regulated population to identify communities from which the Department would have expected a higher number of Top-Screen submissions, followed by targeted outreach to the identified communities
- The creation of the CFATS Share tool, through which state HSAs, appropriate DHS components, and other stakeholders have access to data on the CFATS-regulated facilities within their jurisdictions
- The development of a toll-free CFATS Tip Line through which individuals can anonymously submit information on potential security issues, to include facilities that may have failed to submit a required Top-Screen
- A regional pilot program through which Chemical Security Inspectors in one CFATS region reviewed data maintained in EPA’s Computer Aided Management of Emergency Operations system and other sources to identify facilities with threshold levels of chemicals of interest who had not submitted Top-Screens
These efforts resulted in the identification of a small number of chemical facilities that failed to submit a Top-Screen as required under CFATS. Several of these efforts were resource intensive, however, and were not continued beyond the initial pilot efforts as the Division’s resources were determined to be of greater use on other CFATS-related implementation actions. Others, such as the CFATS Share tool and the CFATS Tip Line, are still in use.
Re-focused Efforts to Identify Non-Compliant Facilities
Following the explosion at West, Texas, the Department, in coordination with other federal agencies, has reinvigorated some of the efforts mentioned above and is exploring other potentially cost-effective means for identifying facilities that should have submitted a Top-Screen.
Interagency Data Sharing. One effort involves the review of EPA data under the Risk Management Plan (RMP) program to identify facilities that, based on their EPA RMP submissions, appear likely to possess a threshold amount of one or more CFATS chemicals of interest but have not submitted a Top-Screen to DHS. To facilitate this effort, EPA and DHS both have provided updated lists of facilities (in EPA’s case, the list of RMP facilities; in DHS’ case, the list of facilities that have completed a CFATS Top-Screen) to Oak Ridge National Laboratory (ORNL), which developed a set of heuristics to rate possible matches based on several categories including facility name, address, latitude/longitude, EPA Identification Number, and facility owner/operator. The initial matching process was completed in June, and ORNL has provided DHS with lists of facilities that, based on their filings with one of the two entities, potentially should have submitted a filing to the other entity but appear to have failed to do so. ISCD reviewed the lists to attempt to identify and remove exempted facilities and thereafter contacted through written correspondence the non-exempt facilities identified through this effort to inform them about their potential obligation to submit a Top-Screen.
Even though ISCD previously had limited access to EPA data in late 2008 through a database with information from EPA regulations, differences between the DHS and EPA datasets and taxonomy made it difficult to cross-walk the data in an efficient manner. As a result of the Action Plan implementation, ISCD has realigned its organizational structure and created a branch dedicated to information technology operations. The Division is now in a much better position to utilize the information provided by EPA to successfully compare large quantities of data to identify potential matches and inconsistencies. Depending on the results of the ongoing crosswalk of EPA RMP data and CFATS data and available resources, a determination will be made on how often to repeat this effort. DHS is also looking at similar efforts involving the Department of Labor’s Occupational Safety and Health Administration (OSHA) and data regarding Federal explosives licensees and permittees that has been shared by the Department of Justice’s Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) and facility data that has been shared by the state of Texas.
Outreach to State and Local Officials and Chemical Industry. Most states have at least one state or local authority regulating various aspects of operations at chemical facilities, ranging from workplace safety to emergency planning to security. Given the myriad regimes and approaches that states employ in regulating chemical facilities, the Department primarily works through the State HSAs; the State, Local, Territorial, and Tribal Government Coordinating Council; and state and major urban area fusion centers to coordinate CFATS-related activities with states. Following the incident at West, Texas, we have also initiated steps aimed at increasing information sharing efforts with various state and local partners, as well as increased outreach to the chemical industry and state and local first responders. ISCD has expanded efforts to reach state and local officials, including in-person meetings with state HSAs.
Chemical Facility Safety and Security Improvement
Following the explosion in West, Texas, the Administration has taken a number of steps to try to reduce the likelihood that incidents like this occur in the future. Federal agencies are exploring potential areas for improvement in existing chemical facility safety and security oversight and working to identify and implement steps to ensure that facilities such as West Fertilizer are identified and complying with their chemical safety and security regulatory responsibilities. We have already identified a number of potential activities, including:
- Improving operational coordination with State and local partners
- Enhancing Federal coordination
- Enhancing information collection and sharing
- Policy, regulation and standards modernization
- Identification of best practices
These coordinated efforts will help ensure that the Federal government most effectively uses the collective resources available to us for managing chemical risk. These activities complement many of the individual efforts being taken within the Department, and other Federal departments and agencies, following the tragic events in West, Texas. Should the effort result in proposals for legislative action, we will look forward to working with you to achieve those recommendations. This issue area is a priority for the administration, and will continue to be in the future as we focus on building on steps already underway to mitigate risks.
Ammonium Nitrate Security Program
In addition to carrying out the CFATS program, ISCD also is working to implement the Ammonium Nitrate Security Program. The Department is continuing to adjudicate comments received on the Ammonium Nitrate Security Program Notice of Proposed Rulemaking issued in August 2011 and is developing a final rule. The authorizing statute provides the Department with the authority to require individuals engaging in the purchase, sale, or transfer of ammonium nitrate to register with the Department and submit to vetting against the Terrorist Screening Database, and requires facilities transferring or selling ammonium nitrate to maintain records on such sales and transfers and report any identified thefts or losses of ammonium nitrate to appropriate authorities.
Funding Reductions
The Department is reevaluating the methods and resources dedicated towards encouraging facility self-reporting and identifying facilities that, intentionally or unintentionally, fail to comply with their Top-Screen reporting requirements. However, the expanded efforts noted above must be conducted using current resources while ISCD continues its progress towards security plan inspections and approvals. The House Appropriations Committee has proposed a reduction in funding to ISCD for FY 2014. With this proposed reduction, the Division’s capability to implement and enforce the CFATS regulations, which include activities to identify non-compliant facilities, would be adversely impacted. The Department asks for the Subcommittee’s continuing support in providing adequate resources to successfully carry out this essential mission.
Conclusion
The Department has turned a corner on the CFATS program. We are moving forward strategically to address the challenges before us. As we implement CFATS, we will continue to work with stakeholders to get the job done of preventing terrorists from exploiting chemicals or chemical facilities. We firmly believe that CFATS is making the nation more secure by reducing the risks associated with our Nation’s chemical infrastructure and we are—along with our stakeholders—committed to its success.