COMMENTS

**Agency:** Department of Homeland Security

**Type:** Proposed Rule -- 6 CFR Part 27

**Docket ID:** DHS-2006-0073

**Long Title:** Chemical Facility Anti-terrorism Standards

**Document ID:** DHS-2006-0073-0001

**RIN:** 1601-AA41

**Submitter Information:**

Alfred J. Hancock, CPP, PSP

Senior Security Consultant

Xcel Energy Corporation

Enterprise Security

414 Nicollet Mall

Minneapolis, MN 55401

612-330-6366 w

612-961-1860 c

612-330-6411 f

<alfred.j.hancock@xcelenergy.com>

**Comments:**

I.A.1. - The paragraph stipulates that both the "RAMCAP" Top- screen
containing Detailed Site Information and Undesired Consequence
Information as well as the Detailed Vulnerability Assessment Information
could be sent/communicated to DHS via a secure website. These items
provide the detailed information necessary to target and successfully
attack a facility whether it is deemed critical or not. Cyberspace, the
Internet, computer communications devices, computer peripherals, and
computers were designed to process and transmit and share tremendous
amounts of data. They were not designed to protect the information/data.
Once information is transmitted it is retained somewhere on some
entity's server or other device. It never ceases to exist. Institutions
that are the most sensitive to security and progressive in attempting to
secure their data such as Financial Institutions and Markets, DOD, FBI,
Large Multinational Companies, research Facilities, etc. per public and
DHS reports are continuously penetrated. Web Sites/Pages are changed
and/or hijacked. Computer forensic experts conducting investigations
continuously unearth documents and e-mail traffic.

I find it admirable that DHS is trying to speed up distribution and
collection of information and save the government money by having the
private sector input data into their system/data base. I find it
disturbing and unwise that this is being contemplated and accomplished
at the expense of the security that is the intent of the regulation and
congressional authorization. This method of transmission of Critical
Infrastructure Facility/Site Specific Information should be removed from
the regulation until/unless DHS is able to provide Military
Grade/Quality Encryption Devices/Systems (encoding/decoding
systems/equipment) to the private sector or government locations where
this equipment is available for private sector use. Per DHS Daily
Reports, this is being contemplated for State and Regional Fusion
Centers however, until that time, information should only be transmitted
to DHS in paper form or disc produced on a secured stand-alone computer
(no attachment to a network, internet, printer, etc.) and used only for
that purpose and/or maintaining other security documents. For additional
information regarding computer/system security, I refer you to the
government national labs (Idaho, Sandia, Argonne, etc.) and the
briefings as well as demonstrations they present in various forums.

I.A.2. -- From a Private asset owner/operator perspective the Chemical
BZZP Program is an unrealistic program. Normally the fence lines, walls,
and etc. mark the edge of the property owned and controlled by the
facility/asset owner. Property outside this boundary is under the
ownership and control of other owners. As indicated, the program is
designed to increase the security and safety related capabilities of the
jurisdictions responsible for the security and safety of the surrounding
communities and not the security related capabilities of the
facility/site. The funding is provided to the localities that in turn
will determine the actual end use of that funding not necessarily for
protection of the facility by assigning/placing additional law
enforcement officers/patrols in the buffer zone.

The second element of the program is the BZZP Webcam Program. This
concept is also very suspect. Using a conservative number of 500-1000
Critical Assets in most of the sectors, DHS would need a dedicated large
building to house dedicated equipment and personnel to communicate with
and monitor the critical site cameras installed in the Buffer Zones of
one Sector, let alone 2 or more. Where is the funding for staff,
hardware, software, management, maintenance, upgrade, and etc., coming
from? With the number of sectors and critical assets, and in some
instances the size of the Buffer Zone, 25 million a year would be a
very, very small drop in the bucket.

From personal observation/knowledge it is even more difficult to believe
that localities are going to monitor these cameras. In many instances
they do not have the dedicated personnel to monitor cameras and systems
they have installed for crime prevention and response. Support Staff is
continuously being reassigned/pulled to increase the force presence on
the street.

I find the BZZP concept admirable but somewhat unrealistic in the
present form, context and requirements. The funding would be better
spent providing salaries and equipment to local police agencies to hire
additional, dedicated law enforcement officers to patrol and respond in
buffer zones. Until the program is revised to address issues and
concerns, additional funding for the program that could be put to better
use should not be expended.

I.B. -- The U.S Coast Guard Maritime Security Regulations are not a
detailed part of this review however, as they are referred to in general
and the organization falls under DHS, I will also provide a general
comment.

When Port Commanders have the authority to, and require, asset owners
and operators to purchase, staff and deploy 50-60 foot Patrol Boats and
to Arm them with 50 Caliber Machineguns, (basically abrogating the Coast
Guard function in life to the private sector or adding to its
capabilities/assets by forcing the private sector to fulfill its role
under their control), there is a major issue. The next question is are
Critical Asset Owners also going to be required to institute air defense
measures and/or activities by deploying Stinger Missile Teams and are
these thought processes and requirements going to be included in this
Regulation and future regulations for other Critical Sectors.

I do not believe that Congress contemplated these types of measures when
it passed the Maritime Transportation Security Act of 2002. DHS needs to
perform a detailed review of Port Commander's and Coast Guard authority
and activities under these regulations, particularly as it relates to
security requirements dictated to asset owners and operators.

II\. C. -- Paragraph two stipulates that the Department proposes to
employ a "risk assessment methodology" similar to this RAMCAP Top-Screen
process to determine whether a facility qualifies as high-risk under
Section 550.

The first issue is that a Top-screen to determine the criticality of a
facility and individual assets within a facility are not new concepts or
invented by ASME. Private sector asset owners and operators,
particularly large companies with extensive, diverse and physically
disbursed facilities and/or assets (including internationally) have been
using similar process for many years in their risk management models,
processes and procedures to determine the criticality of their
facilities and/or assets and use the results to prioritize and rank them
based on business as well as security concerns. In the case of sectors,
the Dam Sector for example has used a top screen to identify and rank
the top 800+ Critical Projects within the sector. For this sector, the
process to a certain extent has already been accomplished and in most
instances the critical project owners have completed Risk Assessments
using industry recognized Risk Assessment Methodologies or methodologies
that adhere to the recognized NIPP formula of: R (Risk Value)= C
(Undesired Consequences) x V (Vulnerability of the Project/Asset) x T
(Threat).

The second issue is that a Top-Screen of any kind **[is not a Risk
Assessment Methodology]{.underline}** as described above and recognized
by the NIPP. It is a Top-Screen Methodology or process using values for
select defined categories and levels of undesired consequences. This
portion needs to be rewritten to clearly define that the Top-screen is
just that, not a risk assessment methodology.

The third Issue is "Who Owns" RAMCAP (DHS or ASME)? Private ownership
would create a multitude of issues that would have to be addressed.

The fourth issue is "What is the cost going to be to the private sector
asset owner for the documentation and forms, training and certification
to perform the assessment" or is this going to be dictated as a DHS
employee activity or contractor/consultant activity where the
contractor/consultant is under contract to DHS?

The fifth issue is who is going to be recognized as qualified/certified
to conduct the training; who is paying for it (training/certification);
will it be free; or is DHS going to do it?

The last element of the paragraph seeks comment on how such a process
(Top-screen) should be employed. My recommendation is as follows:

-   DHS in concert with the organizations listed in I.B through I.G and
    the private sector (preferably the Private Sector Coordinating
    Council and Government Sector Coordinating Council) develop a
    Profile for facilities that would be required to complete a
    Top-screen process.

-   DHS direct facilities falling within the profile to complete and
    submit Top-Screen documentation.

-   DHS follow the approach outlined in II. C., paragraph five and
    bulleted subparagraphs.

-   Facilities fitting the profile complete the required Top-screen
    process and submit documentation to DHS.

It must be noted that a request vs. directive presents an information
security issue and concern for the private sector. A request would mean
"Voluntary Submission" of information. Voluntary submissions of
information to DHS would fall under CII and PCII rules. Concerns
regarding the protection, disclosure and security of information
classified CII and PCII are in attached word document 2.

It is preferred that DHS develop, and through legislation provide, a new
Category of Information Classification for ALL Seventeen Critical
Infrastructure Sectors for security specific or related information such
as Top-screens, Risk Assessments, Vulnerability Assessments, Security
Surveys, Security Plans, Security Test and Exercise Results, Security
Inspections, Reports, etc. The level of classification and protection
should at a minimum be the same as those for the current "Safeguards"
classification program for the Nuclear Sector.

II\. D. -- I applaud the use of Risk-Based Performance Standards in the
context of the explanation/definitions provided. My two concerns in this
regard are the interpretation and application of performance standards
by different individuals and organizations and the lack of guiding
criteria. Various Government Agencies such as USACE, DOD, DOS have
developed Technical Manuals and Uniformed Facilities Criteria Manuals
such as TM 5-885-1 etc., and UFC 5-853-1, etc. that are used by
government agencies and government facility/asset owners and operators.
It is recommended that these manuals and documents, (even if
classified), be made available to properly screened and cleared private
sector asset owners and operators to ensure the same criteria are
available for use and used by all.

I also agree with the concept of risk based Tiering and the
quality/quantity/type of security standards/measures varying based on
tier placement of the facility. My concern is that without published
standards/guidelines/criteria, application and interpretation will again
vary. My recommendation is that DHS, working with the Private Sector
Coordinating Councils and the Government Coordinating Councils develop a
Tiering System that can be applied across all sectors (using the same
elements e.g. Human Element-casualties). The work of these groups in the
development of the Tiering System would answer/contain the elements of
information required in the paragraph 5 bullet questions. From my
perspective, the most critical consequence/level of consequence to be
considered in any Tiering system would be the Human Element followed by
National Security/Government Functions, Interdependencies, Economic and
Psychological elements.

II\. E. 1. -- As indicated by this and the remainder of the document,
(as well as in the Chemical Screening and RAMCAP Process for the
Chemical Sector dated Jan, 2006), RAMCAP **[is not a Risk Assessment
Methodology]{.underline}**. I understand that the reason DHS was
initially established was to protect the homeland from terrorist attack.
What DHS also must understand is that from a business and liability
perspective other elements such as the criminal and disgruntled employee
must also be considered in a true Risk Assessment and that the private
sector, unless it receives equipment and personnel from the federal
government, can only protect against realistic, limited elements of the
terrorist threat.

Approximately 33% of the postulated Threat Scenarios in the
Vulnerability Assessment deal with Air Assaults; barge, deep draft
shipping or medium cargo watercraft; etc. From a realistic perspective,
protection against these postulated scenarios are government
responsibilities unless the government is willing to assign military
personnel with appropriate armament such as stinger missiles or large
coast guard type craft armed with anti-armor weapons to all critical
facilities. I do not believe this is a true possibility unless
intelligence identifies a specific facility as a target. I am not
holding my breath on the later two comments based on my conversations
with various military elements. As indicated earlier, the Coast Guard to
a certain extent is already attempting to abrogate an unrealistic
function and responsibility to the private sector.

I understand the concept of a defined set of postulated scenarios being
used by all however, the reality is that not all scenarios will fit a
specific target/facility and that some facilities/targets by the nature
of the beast will require additional/different scenarios if the attacker
wishes to accomplish their objectives. DHS in conjunction with the
sector security specialists, chemical & chemical process engineers,
safety specialists, etc. needs to review the Vulnerability Assessment
methodology/process, revise it, and arrive at a product that is
realistic, meets the need of and is workable for DHS and private sector
purposes. This should be accomplished through the work of DHS with
chemical industry experts, industry security professionals, the Private
Sector Coordinating Council and the Government Sector Coordinating
Council. If the private sector/facility goes broke, the enemy has
accomplished one of its objectives (per Joint Pub 3-05.5) without
engaging in any activity except verbal threats.

II.E.2. -- From a realistic and usable perspective, site security plans
should first describe and address a basic level of security for the
facility applicable under all conditions. These measures must not only
address the terrorist attack but also the criminal or insider threat if
the same undesired consequences can achieved as a result of their
actions. Specific Vulnerabilities identified in the assessment should be
addressed upon completion of the assessment either with permanent
measures or temporary measures until permanent measures can be put in
place.

Secondly, the plan must include increased levels and types of security
measures based on the DHS Threat Level Notification System and DHS
provided Specific Threat Intelligence against the facility or that type
of facility. No facility or organization can remain at and employ
security measures required at the highest DHS Threat Level indefinitely
nor address all the terrorist threat scenarios. It must also be
recognized that for some postulated threat scenarios such as water-borne
explosive devices there are at the present no real, realistic, or
effective protective measures available.

Issues and Concerns regarding the third paragraph bulleted items under
2. are limited. Most bulleted items are basic security measures for
critical facilities/assets. The main concern is that the types of
measures and criteria for those measures are identified and available.
For example:

-   Deter vehicle penetration of the perimeter -- Provide DHS, DOD and
    DOS approved list of vehicle barriers.

-   Perform Appropriate Background Checks -- Provide Background Check
    Criteria.

II.F. - I disagree with the concept of third party inspectors or
auditors unless they are under contract to DHS and meet the same
criteria used to hire DHS employees. If DHS deems it important to
inspect and audit facilities, then it should hire and train personnel to
perform these inspections and audits.

The second issue/concern with third party inspections/audits is who is
certifying and training these third party inspectors and auditors; and
who is paying for the inspections/audits by third parties? DHS or the
facility?

I also do not agree with a third party inspector or auditor as the
approving authority for a facility security plan. If not employed by DHS
this could lead to a conflict of interest (e.g. the same third party
inspector or auditor providing the service of preparing Site Security
Plans, etc.)

The fourth issue/concern is the copying of company proprietary records
by third party inspectors or auditors.

If DHS deems an inspection and audit program is necessary, then it
should establish an office and staff it with an appropriate number of
trained DHS Employees to carry out the program. I sincerely hope it is
not the intent of DHS, or the result of DHS actions, to spawn a cottage
industry of Inspectors and Auditors who are paid for by the private
sector.

II.G. - Based on other regulatory requirements and guidelines many
organizations already perform background checks for employees who have
access to facilities that will fall under this regulation. The issues in
this, and all other sectors with the exception of the Nuclear Sector,
are:

-   There is NO Standard Criteria for Background Checks.

-   Background Check results are not accepted Nation Wide.

-   Requirements for Background Checks vary dramatically. Some
    Organizations do checks on all personnel with access (physical or
    cyber), while others do checks on limited categories of personnel,
    types of access, or area of access.

From a realistic perspective:

-   DHS needs to develop a National Standard/Criteria for Background
    Checks for All Critical Sectors.

-   All individuals with unescorted physical or cyber access to a
    critical facility should have completed checks and a certificate of
    clearance.

-   A national repository for completed checks needs to be established
    for reference and review.

-   Completed checks should be recognized Nation wide.

-   Checks should be updated periodically (every 5 years).

-   Government Security Clearances should be accepted in lieu of
    background checks.

-   If there is no current check on file, checks should be conducted and
    completed prior to employment and prior to unescorted access being
    granted.

-   Current employees who do not have checks should be grandfathered
    until checks are completed.

-   At a minimum, checks should include all the elements under (3).

-   Individuals with completed checks and cleared should be issued an
    identification card that would enable them to work at any critical
    facility under the regulation.

Item (4) is more difficult to respond to. Under ideal circumstances, the
government should conduct the background checks. The issue is, and has
always been, the time period it takes the government to complete the
checks. Until the government can complete these checks in a reasonable
period (5-10 days) as many private sector agencies and organizations now
are able to do, the government and industry by necessity must continue
to rely on private sector parties to conduct the checks in a timely
manner that meets the needs of the private sector.

An option to the above is to consider the background check process
employed by ATF.

II.H. -- In paragraph seven it is stipulated that Vulnerability
Assessments and Site security plans for tier 1 facilities must be
renewed each year. I agree that Site Security Plans should be updated
each year to ensure information, policies, and procedures are current. I
strongly disagree that Vulnerability (or Risk) Assessments need to be
renewed each year.

The basic actions required by a Threat (terrorist, criminal/vandal,
insider) to destroy or damage a facility resulting in the identified
undesired consequences will not change unless a major change in the
process, facility structure or security measures has occurred.
Completing (renewing) a Risk Assessment is a resource intensive (costly)
and time consuming process. My recommendation is that unless there have
been major changes in the process, facility structure (construction), or
physical security measures and plans, Risk Assessments be completed
(renewed) every three years for Tier 1 facilities, every 5 years for
Tier 2 facilities, and every seven years for any other facilities. If
major changes in process, facility structure or physical security
measures occur, assessments should be completed (renewed) immediately
upon completion of the changes. In the private sector, funding for
assessments normally comes from the operations and maintenance budget.
Resources expended to complete (renew) assessments can be better
utilized improving and maintaining security measures already in place.

II.K. -- When it comes to information, it is irrelevant whether a
Critical Facility or Asset is in the Chemical Sector or another Critical
Infrastructure Sector. Security information for a Critical Facility or
Asset in any sector must have the same protection. We currently have
"Safeguards" for the Nuclear Sector and this regulation proposes "CVI"
classification for the Chemical Sector. Is DHS considering inventing new
security classifications for the other 15 Sectors?

17 different classifications, guidelines and rules would be a regulatory
nightmare and totally unnecessary. Someone also needs to remember that
many companies own and operate facilities and assets in more than one
sector. Many Combination Utilities for example are in 6 or more sectors
and have direct link interdependencies with several others

It is preferred that DHS develop, and through legislation provide, a new
Category of Information Classification for **[all seventeen critical
infrastructure sectors]{.underline}** for security specific or security
related information such as Top-screens, Risk Assessments, Vulnerability
Assessments, Security Surveys, Security Plans, Security Test and
Exercise Results, Security Inspections, Audits, Reports, etc. The level
of classification and protection should at a minimum be the same as
those for the current "Safeguards" classification program for the
Nuclear Sector.

Again, it must be noted that a request vs. directive presents an
information security issue and concern for the private sector. A request
would mean "Voluntary Submission" of information. Voluntary submissions
of information to DHS would fall under CII and PCII rules. Concerns
regarding the protection, disclosure and security of information
classified CII and PCII are in attached word document 2.

It is also recommended that penalties and consequences for disclosure of
classified information be the same, and fall under the same federal
statutes, as those for government employees (very large fines and
long-term imprisonment).

III\. I agree with a phased implementation of the 550 Program. I
recommend however that problems, issues and concerns be addressed and
finalized so DHS is not implementing a program with major deficiencies
that require major and frequent changes immediately after
implementation.