Member Article

On Nov. 20, 2007, the Department of Homeland Security (DHS) officially published “Appendix A” of the Chemical Facility Anti-Terrorism Standards (CFATS) in the Federal Register. This comes as part of the DHS’s ongoing efforts to ensure the adequate security of chemical facilities in the United States. Appendix A, which is an addendum to 6 C.F.R. § 27, identifies over 300 chemicals perceived by the DHS to create a significant threat to human life or health if mishandled. Concerns surrounding these listed chemicals include the risk of chemical release, the potential for theft and diversion, and the prospect of sabotage and contamination. In addition, Appendix A establishes a baseline Screening Threshold Quantity (STQ) for each chemical of interest (COI) subsequently listed. If a facility possesses, or later comes into possession of, a COI that meets or exceeds the specified STQ, the facility must then undertake certain detailed procedures as specified in the regulation. The text of Appendix A can be found on the DHS website at this link.

If a facility is currently meeting or exceeding a STQ for a listed COI, it has until Jan. 18, 2008 (60 days from publication of Appendix A in the Federal Register) to register with the DHS and to complete an online assessment called a Top-Screen. Failure to do so could result in civil penalties or an Order to Cease Operations.

Some of the common chemicals listed by the DHS include propane, chlorine, hydrogen sulfide, hydrogen peroxide, ammonium nitrate, potassium nitrate, sodium nitrate, and triethanolamine. Possession of these chemicals, and others identified in Appendix A, above the STQ may trigger further requirements on the facility. For example, the STQ for propane is now set at 60,000 pounds. Previously, the draft propane STQ was set at 7,500 pounds. The DHS found it necessary to increase the propane STQ to its current 60,000-pound threshold in order to exclude many non-industrial users. In addition, facilities possessing propane need not include those quantities in 10,000-pound tanks or less when calculating whether the facility has a total inventory of 60,000 pounds.

Not only are chemical facilities targeted by this regulation, a wide range of other facilities also are affected. This includes “any establishment that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Secretary to be potentially dangerous or that meets other risk-related criteria.” 6 C.F.R. § 27.105. Potentially regulated entities include colleges and universities, medical research organizations, various industrial laboratories, fumigation companies, and farming and agricultural industries. However, select facilities have been exempt from regulation, as noted in § 27.110(b). Various forms of chemical storage are to be considered in a facility’s STQ calculation. For example, listed chemicals stored in underground storage facilities and above-ground tank farms must be included in the facility’s STQ calculation, along with listed chemicals in certain transportation containers and peak shaving facilities.

Background
On Oct. 4, 2006, President Bush signed the Department of Homeland Security Appropriations Act of 2007. This provided the DHS with authority to regulate the security of chemical facilities that pose a high-risk to human life and health. The Secretary of the DHS was subsequently mandated to promulgate interim regulations “establishing risk-based performance standards for the security of chemical facilities.” On April 9, 2007 the DHS issued an Interim Final Rule (IFR) establishing the risk-based performance standards.

This rule provides threshold criteria designed to assess the security of all facilities possessing a predetermined quantity of a regulated chemical and requires certain facilities to create a Security Vulnerability Assessment (SVA) that identifies vulnerabilities in the facility’s security infrastructure. In addition, certain facilities are required to submit and implement a Site Security Plan (SSP) to address deficiencies in the facility’s current security strategy. Excluding the official publication of Appendix A in the Federal Register, the IFR went into effect on June 8, 2007.  An up-to-date Appendix A went into effect on Nov. 20, 2007 by publication in the Federal Register.

 

The Procedural Steps

The DHS has developed a web-based Chemical Security Assessment Tool (CSAT) to identify facilities that meet the Department’s criteria for high-risk chemical facilities. In addition, CSAT provides the methodology needed to assess a facility’s security vulnerability and to develop security plans. The CSAT includes four steps:

1.Facility registration

2.A Top-Screen questionnaire

3.A vulnerability assessment tool

4.A security plan template

If a facility believes it may be covered by this regulation, the facility should register on the DHS website for a user identification number and password. To register, facilities may go to the DHS web site and follow the step-by-step instructions. Once the DHS validates a facility’s registration, DHS will notify the facility about how to access other tools, including the Top-Screen.

 

A facility may be prompted to complete a Top-Screen in two distinctive ways. First, a facility may be independently contacted by the DHS and instructed to complete the Top-Screen. These facilities will be notified of this requirement through publication in the Federal Register or by direct, written notification to the facility on an individual basis. Second, a facility must complete a Top-Screen if it possesses a COI at or above the STQ listed in Appendix A. Section 27.203 of the regulation instructs the facility on how to properly calculate the STQ for each listed chemical.

The published Appendix A addendum also lists seven different “security issues” identified by the DHS for each listed chemical. These include:

1. Release - Toxic: chemicals that may create a toxic cloud if released
2. Release - Flammable: chemicals that may create a vapor cloud explosion if intentionally released
3. Release - Explosive: chemicals with the potential to affect populations if intentionally detonated
4. Theft - Chemical Weapons/Chemical Weapon Precursors: chemicals that could be used as chemical weapons if stolen or diverted
5. Theft - Weapons of Mass Effect: chemicals that could be used directly as weapons of mass effect if stolen or diverted
6. Theft - Explosives/Improvised Explosive Device (IED) Precursors: chemicals that could be used in explosives or IEDs if stolen or diverted
7. Sabotage/Contamination: chemicals having the potential to create significant adverse consequences if mixed with other readily available materials

These security issues classify the nature of the risk posed by each chemical. In determining whether a facility possesses a chemical in excess of the STQ, each security issue must be evaluated separately.

The Top-Screen asks a series of questions regarding the chemicals manufactured, processed, used, stored at, or distributed by the facility. Responses to these questions are then used by the DHS to determine whether the facility meets the regulatory definition of “high risk.” If a facility is not considered high risk, it has no further obligations until further notified. However, facilities meeting the high-risk definition will be preliminarily placed into one of four “high risk” tiers;  “tier 1” representing the highest risk facilities and “tier 4” representing lower risk facilities.

 

If the DHS categorizes a facility as “high risk” through the Top-Screen process, the facility will have 90 calendar days from the date of notification to complete a SVA; thereby, identifying any security vulnerabilities at the site. The SVA entails several components, including:

• Asset Characterization, which includes identifying potentially critical assets, infrastructure concerns, and potential hazards;
• Threat Assessment, which includes describing possible internal and external threats;
• Security Vulnerability Analysis, which includes the identification and description of possible security vulnerabilities and existing countermeasures;
• Risk Assessment, including a determination of relative risk to the facility;
• Countermeasures Analysis, including strategies to reduce the probability of future attacks.

Based on the information provided in the SVA, a facility may be reclassified into a different risk tier from its original tier designation.

 

In addition to completing the SVA, high-risk facilities must also complete a SSP within 120 calendar days of notification. The SSP must:

• Address each vulnerability identified in the SVA, and describe the security measures to be employed to minimize the vulnerability;
• Identify and describe how the selected security measures will address the applicable risk-based performance standards (discussed below) as well as potential modes of terrorist attack;
• Explain how each selected security measure will meet or exceed applicable performance standards for the appropriate risk-based tier for the facility.

The regulation identifies numerous risk-based performance standards that must be addressed in the SVA. These include, but are not limited to, restricting access to the site, it’s perimeters, and site assets; screening individuals and vehicles as they enter the facility; adopting measures to deter, detect, and delay a potential attack; performing appropriate background checks on facility personnel; and conducting proper security training for site employees. The top three tiers will have to complete the SVA, and upon request of the DHS, the SSP. However, a facility in one of the top three tiers may elect to submit an Alternate Security Program (“ASP”) in lieu of a SSP; although the facility is still required to submit the SVA. A tier 4 facility may instead submit an ASP in lieu of a SVA, a SSP, or both. The DHS is requiring those facilities in tiers 1 or 2 to update their Top-Screen, SVA, and SSP every two years. Facilities in tiers 3 or 4 must update this information every three years. Aside from the previously mentioned requirements under the regulation, facilities must also maintain adequate records of certain activities for a three-year period. These include personnel training events, any breaches in security, and security drill exercises. Further, facilities will be subject to site inspections and audits by the DHS staff.

 

Conclusion
As explained, the breadth of this regulation extends well beyond those facilities traditionally viewed as chemical plants. It is important that facilities make a diligent and timely inquiry into whether they are impacted by this regulation. Any facility that has been contacted by the DHS, or is in possession of a listed chemical above the Appendix A STQ, may be required to undertake further action otherwise, the facility could face civil penalties or be forced to cease operations. For more information on this important issue, or for a copy of the “Appendix A” addendum and the Department of Homeland Security regulation, please contact Bob Martineau at Waller Lansden at .


The opinions expressed in this bulletin are intended for general guidance only. They are not intended as recommendations for specific situations. As always, readers should consult a qualified attorney for specific legal guidance.

 

Link to article