```

[House Hearing, 113 Congress]
[From the U.S. Government Publishing Office]

H.R. 4007, THE CHEMICAL FACILITY ANTI-TERRORISM STANDARDS AUTHORIZATION 
                     AND ACCOUNTABILITY ACT OF 2014

=======================================================================

                                HEARING

                               before the

                     SUBCOMMITTEE ON CYBERSECURITY,
                       INFRASTRUCTURE PROTECTION,
                       AND SECURITY TECHNOLOGIES

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED THIRTEENTH CONGRESS

                             SECOND SESSION

                               __________

                           FEBRUARY 27, 2014

                               __________

                           Serial No. 113-54

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                         U.S. GOVERNMENT PRINTING OFFICE 

88-171 PDF                     WASHINGTON : 2014 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Printing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800 
         DC area (202) 512-1800 Fax: (202) 512-2250 Mail: Stop SSOP, 
                          Washington, DC 20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Paul C. Broun, Georgia               Yvette D. Clarke, New York
Candice S. Miller, Michigan, Vice    Brian Higgins, New York
    Chair                            Cedric L. Richmond, Louisiana
Patrick Meehan, Pennsylvania         William R. Keating, Massachusetts
Jeff Duncan, South Carolina          Ron Barber, Arizona
Tom Marino, Pennsylvania             Dondald M. Payne, Jr., New Jersey
Jason Chaffetz, Utah                 Beto O'Rourke, Texas
Steven M. Palazzo, Mississippi       Tulsi Gabbard, Hawaii
Lou Barletta, Pennsylvania           Filemon Vela, Texas
Richard Hudson, North Carolina       Steven A. Horsford, Nevada
Steve Daines, Montana                Eric Swalwell, California
Susan W. Brooks, Indiana
Scott Perry, Pennsylvania
Mark Sanford, South Carolina
Vacancy
                        Vacancy, Staff Director
          Michael Geffroy, Deputy Staff Director/Chief Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                 Patrick Meehan, Pennsylvania, Chairman
Mike Rogers, Alabama                 Yvette D. Clarke, New York
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Jason Chaffetz, Utah                 Filemon Vela, Texas
Steve Daines, Montana                Steven A. Horsford, Nevada
Scott Perry, Pennsylvania, Vice      Bennie G. Thompson, Mississippi 
    Chair                                (ex officio)
Michael T. McCaul, Texas (ex 
    officio)
               Alex Manning, Subcommittee Staff Director
                    Dennis Terry, Subcommittee Clerk

                            C O N T E N T S

                              ----------                              
                                                                   Page

                               STATEMENTS

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies...................................................     1
The Honorable Yvette D. Clarke, a Representative in Congress From 
  the State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     4
  Prepared Statement.............................................     6
The Honorable Michael T. McCaul, a Representative in Congress 
  From the State of Texas, and Chairman, Committee on Homeland 
  Security.......................................................     7
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Oral Statement.................................................     8
  Prepared Statement.............................................     9
The Honorable Gene Green, a Representative in Congress From the 
  State of Texas:
  Oral Statement.................................................    10
  Prepared Statement.............................................    12

                               WITNESSES
                                Panel I

Ms. Caitlin Durkovich, Assistant Secretary, Infrastructure 
  Protection, U.S. Department of Homeland Security, Accompanied 
  by David Wulf, Deputy Director, Infrastructure Security 
  Compliance Division:
  Oral Statement.................................................    14
  Joint Prepared Statement.......................................    16
Mr. Stephen L. Caldwell, Director, Homeland Security and Justice, 
  U.S. Government Accountability Office:
  Oral Statement.................................................    21
  Prepared Statement.............................................    22
Ms. Marcia Moxey Hodges, Chief Inspector, Office of Inspector 
  General, U.S. Department of Homeland Security:
  Oral Statement.................................................    29
  Prepared Statement.............................................    31

                                Panel II

Mr. Clyde D. Miller, Director for Corporate Security, BASF North 
  America, Incoming Vice Chair, American Chemistry Council 
  Security Committee:
  Oral Statement.................................................    52
  Prepared Statement.............................................    54
Ms. Kate Hampford Donahue, President, Hampford Research, Inc., 
  and Member, Board of Governors, Society of Chemical 
  Manufacturers and Affiliates (SOCMA):
  Oral Statement.................................................    57
  Prepared Statement.............................................    58
Ms. Anna Fendley, Legislative Representative, United 
  Steelworkers:
  Oral Statement.................................................    60
  Prepared Statement.............................................    62

                             For the Record

The Honorable Patrick Meehan, a Representative in Congress From 
  the State of Pennsylvania, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Letter.........................................................    51
  Memorandum From the Office of Enforcement and Compliance 
    Assurance, United States Environmental Protection Agency, 
    Washington, DC...............................................    47

 
H.R. 4007, THE CHEMICAL FACILITY ANTI-TERRORISM STANDARDS AUTHORIZATION 
                     AND ACCOUNTABILITY ACT OF 2014

                              ----------                              

                      Thursday, February 27, 2014

             U.S. House of Representatives,
                    Committee on Homeland Security,
 Subcommittee on Cybersecurity, Infrastructure Protection, 
                                 and Security Technologies,
                                                    Washington, DC.
    The subcommittee met, pursuant to call, at 10:09 a.m., in 
Room 311, Cannon House Office Building, Hon. Patrick Meehan 
[Chairman of the subcommittee] presiding.
    Present: Representatives Meehan, McCaul, Perry, Clarke, 
Thompson, Vela, and Horsford.
    Also present: Representative Green.
    Mr. Meehan. The Committee on Homeland Security, 
Subcommittee on Cybersecurity, Infrastructure Protection, and 
Security Technologies will come to order. The subcommittee is 
meeting today to examine H.R. 4007, which is the Chemical 
Facility Anti-Terrorism Standards Authorization and 
Accountability Act of 2014.
    I now recognize myself for an opening statement.
    Chemical facilities continually rank among the most 
attractive targets for terrorists because an attack on a 
chemical plant would likely result in large-scale damage and 
potentially terrible loss of life. What happened at West, 
Texas, last spring gave us a chilling look at the devastation 
that occurs when a chemical facility detonates.
    To protect against potential catastrophe, Congress in 2007 
authorized the Department of Homeland Security to develop a set 
of vulnerability assessment standards for chemical plants and 
to implement a corresponding set of regulations to ensure that 
physical security of those at the highest risk. That 
authorization was in effect for 3 years.
    Seven years later, the resulting program, which we call 
CFATS, has yet to be reauthorized. Instead, the program simply 
receives appropriations year after year without any hard 
guidance from this authorizing committee. While we have held 
many hearings to assess the CFATS program's effectiveness and 
progress, the Department is still behind in establishing 
several of the program's most basic operational elements, and 
we all appreciate that this is simply not acceptable.
    It is the responsibility of this committee to set official 
guidelines and standards of this very important program. 
Oversight alone is simply not sufficient. We must give CFATS 
the formal and proper direction it needs. Therefore, we must 
resume our jurisdiction of the program.
    H.R. 4007, the Chemical Facility Anti-Terrorism Standards 
Authorization and Accountability Act of 2014, is the product of 
the Homeland Security Committee's consultation with dozens of 
stakeholders, including the facilities regulated under this 
act, community representatives, the Energy and Commerce 
Committee, the Senate Homeland Committee, and the Government 
Affairs Committee in the Senate, as well as the Government 
Accountability Office, the Department of Homeland Security 
itself. In fact, just yesterday, the Secretary of the 
Department of Homeland Security, Jeh Johnson, said about this 
bill that, ``I have looked at it, I have read it, I support it, 
and our critical infrastructure folks support it.''
    Therefore, we have reached the rare occurrence in Congress, 
constructive legislation supported by the White House, multiple 
House committees, the Senate, industry, and both Republicans 
and Democrats. As author of this bill, I take very seriously 
the problems that have plagued this program in the past; the 
now-infamous 2011 leaked memo written by the former ISCD 
Director Penny Anderson and then ISCD Deputy Director David 
Wulf was highly critical of the division and brought to light a 
disturbing litany of management flaws and achievement gaps 
within the ISCD.
    In response, this committee asked both the GAO and the 
inspector general to conduct a thorough review of the ISCD 
operations. The findings weren't surprising. Both auditors 
essentially said that the program's success had been slowed by 
inadequate tools, poorly-executed processes, and harmful 
mismanagement.
    In the 3 years since the Anderson-Wulf memo was leaked, 
ISCD has made substantial progress. The division has further 
accelerated the review process for security plans at facilities 
assigned a final tier under CFATS. It has significantly reduced 
the overall backlog of facilities. It has made notable progress 
in addressing the recommendations made by GAO in its 2013 
report. It has implemented the Infrastructure Security 
Compliance Division Action Plan.
    In addition, ISCD has put in place a new management team, 
headed by Suzanne Spaulding, the acting under secretary for 
NPPD, and David Wulf, who is here with us today, now the ISCD 
director. With a new management team at the helm, and tangible 
progress continuing to be demonstrated, now is the time to help 
CFATS begin its new chapter and take these next critically 
important steps.
    While progress has been made, it is now time for Congress 
to step in to mandate accountability for the Department and 
provide certainty to the regulated community. H.R. 4007 
authorizes CFATS for the short term in order to provide the 
stability and certainty both the Department and industry have 
been calling for, while at the same time using the 
authorization as a vehicle to mandate certain fundamental 
program improvements.
    Specifically, the bill improves the efficiency of a site 
security plan approval process. It amends certain parts of the 
original CFATS regulations to facilitate DHS industry 
coordination and simplify the compliance process. It ensures 
that DHS is communicating with State and local officials, as 
well as other Federal agencies and industry associations, to 
identify facilities of interest and implementing a sensible and 
effective methodology in assessing risk and ensures DHS 
accountability by requiring the Secretary to certify the 
Department's progress and by authorizing GAO to conduct an on-
going assessment and report to Congress with its findings every 
6 months.
    Last summer, the President issued Executive Order 13650, 
which improving Chemical Facility Safety and Security was the 
title of that Executive Order. While I applaud the President 
for his efforts, the security of our chemical facilities is too 
important to be guided by studies and directives alone. It is 
the duty of Congress and this committee to act.
    This bill works as a complementary piece of legislation to 
the President's Chemical Facility Safety and Security Working 
Group. The bill mirrors and reinforces many of the EO's 
initiatives. To suggest that this panel must choose between the 
Executive Order and authorizing CFATS in the short term is to 
create a false choice.
    Secretary Johnson confirmed this sentiment yesterday, 
saying, ``If we have got a good bill and there is an 
opportunity to pass it in this Congress, it supports my goals 
and objectives, and it enhances homeland security, I am going 
to support the measure. I think we in the Congressional, 
Executive branches owe it to the American people to get 
something done.'' Those were his words.
    Before I conclude, there is one final factor that must be 
considered today. The Government shutdown in late 2013 led to 
the first-ever expiration of the CFATS program. While this 
expiration thankfully turned out to be only temporary, the 
event nonetheless served as a wake-up call to the fragility of 
our Nation's chemical security and safety.
    With every appropriations cycle comes renewed anxiety that 
CFATS will cease to exist. Year after year, the authorizing 
committees have the opportunity to provide stability and 
certainty with regard to chemical security. Year after year, 
they have failed to take legislative action.
    As Henry Waxman, who was the Energy and Commerce Ranking 
Member, said, ``Whatever the flaws in the CFATS program, the 
answer is not to let the program sunset. This state of affairs 
leave dangerous chemical facilities unregulated and vulnerable 
to attack.'' I agree with that statement.
    The purpose of today's legislative hearing is to allow the 
subcommittee to hear from industry stakeholders, Government 
auditors, and those DHS officials directly responsible for 
implementing CFATS as to the value of H.R. 4007.
    I firmly believe this bill is a much-needed step in the 
right direction. If this bill takes--it takes a fresh approach 
to addressing some of the CFATS program's most basic issues. 
The bill represents a new partnership among industry, the 
Department, and Congress for the advancement of America's 
chemical security.
    The Chairman now recognizes the Ranking Member of the 
subcommittee, the gentlelady from New York, Ms. Clarke, for any 
statements she may have.
    Ms. Clarke. I thank you, Mr. Chairman. I would like to, 
before beginning my statement, acknowledge and recognize 
Congressman Gene Green and ask unanimous consent that he be 
allowed to sit in on this hearing.
    Mr. Meehan. I thank the gentleman for attending. Without 
objection, so ordered.
    Ms. Clarke. Thank you, Mr. Chairman. Thank you for holding 
this legislative hearing to examine your bill, H.R. 4007.
    This legislation before us today would repeal and replace 
the existing statute that authorizes the Department of Homeland 
Security, DHS, to regulate chemical facilities for security 
purposes. This subcommittee has a great stake and long history 
in attempting to help the CFATS program succeed, and I have 
watched with interest the development of this legislative 
language. However, I do have some concerns about the approach 
the bill takes.
    First, the bill stands alone. It would not amend the 
Homeland Security Act of 2002. This would not affect the 
implementation of the bill, if it is passed and enacted into 
law, but some might argue that such a bill does not provide a 
firm statutory footing for the CFATS program or resolve issues 
of Congressional jurisdiction.
    The bill does contain much of the language in the existing 
statutory authority and includes some new requirements for the 
Secretary to follow. Like in the existing statutory authority, 
the bill authorizes the use of a current regulatory rule that 
requires such facilities to submit security vulnerability 
assessments and to develop and implement site security plans 
and facilities that have approved site security plans as of the 
date of enactment will not have to resubmit those plans for 
approval just because the bill was enacted.
    The bill expressly authorizes DHS to accept the submission 
alternative security programs, or ASPs, with respect to site 
security plans. The practice of using ASPs is already in use at 
the Department, and I am in favor of the ASPs. I think it is an 
innovative approach for companies to address their security 
needs.
    Let me turn to the issue of standards versus regulations. 
The existing statutory authority expressly directs the 
Secretary to inform interim final regulations. H.R. 4007 does 
not, but instead directs the creation of a program establishing 
certain standards.
    The bill mandates the Secretary to establish risk-based 
performance standards designed to protect chemical facilities 
that the Secretary determines represent a high level of 
security risk. This is an important feature, because unlike the 
existing statutory authority, this bill would require the 
performance standards to provide protection from acts of 
terrorism, while the existing statutory authority requires the 
risk-based performance standards be for security. This may help 
with some of our jurisdiction issues, but in my mind, the 
establishment of standards as opposed to a current regulatory 
scheme poses questions as to how the Department would interpret 
such language, if it becomes law.
    For example, I think it is possible that some stakeholders, 
including some of our witnesses today, may assume that since 
such standards would be binding on the public, that this 
language provides an implied authority to issue regulations 
under provisions of the Administrative Procedure Act to 
implement these standards. On the other hand, in a close 
reading of the bill, one might also assert that the removal of 
the requirement to issue regulations reflects the Majority's 
Congressional intent to move the CFATS program away from a 
regulatory framework to a public-private partnership or some 
other unspecified structure.
    I am hoping to get some clarification or opinion from the 
Department on how they view these issues, especially in light 
of their surprisingly full-throated support of this language.
    Another issue I would like to bring up is the use of 
contractors in CFATS. One of the features of H.R. 4007 is that 
it specifically authorizes the Secretary to designate 
inspectors that are not DHS employees. The language says that 
the audit and inspection processes may be carried out by a non-
Department or non-Governmental entity as approved by the 
Secretary.
    I understand that the bill is attempting to aid the 
Department in accelerating the site security authorization 
approval and compliance process, but I have serious 
reservations about the use of contractors in the inspector 
cadre, where this work is generally recognized as an inherently 
Governmental responsibility, especially when it involves 
terroristic threats and risks to the Nation.
    Finally, Mr. Chairman, I am anxious to work with you on the 
pressing issue of personnel surety, and I know your bill 
includes some helping language, but enactment into law for H.R. 
4007 may be a while off. More recently, DHS has issued a 30-day 
information collection request offering its latest personnel 
surety proposal. The proposal, as I understand, would accept 
credentials that are vetted recurrently against the terrorist 
screening database and has their validity verified on a 
continuing basis by electronic or other means.
    However, DHS has previously communicated with stakeholders 
that it would not grant reciprocity to personnel surety 
programs that vet individuals against the terrorism screening 
database on a schedule not equivalent to recurrent vetting. 
This poses substantial problems in a very complex arena.
    Many have expressed concerns about duplication of efforts 
and the burden of multiple background checks, and others have 
rightfully asked about what protections might be offered for 
workers who would be required to secure multiple credentials to 
continue working and what financial and operation problems 
would be put on facilities who are already complying with 
credentialing regulations.
    We must find a way to meet the needs of addressing these 
risks posed by access to chemical facilities through a common-
sense approach that will likely involve multiple program 
efforts to harmonize Government credentialing among the 
agencies and programs. We all know the CFATS program has been 
striving to improve its performance, and we commend the hard 
work and leadership shown at ISCD, and we will hear today from 
two agencies that have looked closely at the program to help us 
determine what we might codify to help the program achieve its 
potential.
    Thank you, Mr. Chairman. I look forward to working with you 
to make the CFATS program one we can be proud of. I yield back.
    [The statement of Ranking Member Clarke follows:]
              Statement of Ranking Member Yvette D. Clarke
                           February 27, 2014
    Thank you for holding this legislative hearing to examine your 
bill, H.R. 4007. The legislation before us today would repeal and 
replace the existing statute that authorizes the Department of Homeland 
Security (DHS) to regulate chemical facilities for security purposes.
    This subcommittee has a great stake, and long history, in 
attempting to help the CFATS program succeed, and I have watched with 
interest the development of this legislative language. However, I do 
have some concerns about the approach the bill takes.
    First, the bill stands alone, and would not amend the Homeland 
Security Act of 2002. This would not affect the implementation of the 
bill, if it is passed and enacted into law, but some might argue that 
such a bill does not provide a firm statutory footing for the CFATS 
program or resolve issues of Congressional jurisdiction.
    The bill does contain much of the language in the existing 
statutory authority and includes some new requirements for the 
Secretary to follow. Like in the existing statutory authority, the bill 
authorizes the use of the current regulatory rule that requires such 
facilities to submit security vulnerability assessments and to develop 
and implement site security plans, and facilities that have approved 
site security plans as of the date of enactment will not have to 
resubmit those plans for approval just because the bill was enacted.
    And the bill expressly authorizes DHS to accept the submission 
alternative security programs, or ASPs, with respect to site security 
plans. The practice of using ASPs is already in use at the Department, 
and I'm in favor of the ASPs, I think it is an innovative approach for 
companies to address their security needs.
    Let me turn to the issue of standards versus regulations. The 
existing statutory authority expressly directs the Secretary to issue 
interim final regulations. H.R. 4007 does not, but instead directs the 
creation of a program establishing certain standards.
    The bill mandates the Secretary to establish risk-based performance 
standards designed to protect chemical facilities that the Secretary 
determines represent a high level of security risk. This is an 
important feature, because unlike the existing statutory authority, 
this bill would require the performance standards to provide protection 
from ``acts of terrorism''; while the existing statutory authority 
requires the risk-based performance standards be for ``security.'' This 
may help with some of our jurisdictional issues, but in my mind, the 
establishment of ``standards'' as opposed to the current regulatory 
scheme, poses questions as to how the Department would interpret such 
language, if it becomes law.
    For example, I think it is possible that some stakeholders, 
including some of our witnesses today, may assume that since such 
standards would be binding on the public, that this language provides 
an implied authority to issue regulations under provisions of the 
Administrative Procedure Act to implement these standards.
    On the other hand, in a close reading of the bill, one might also 
assert that the removal of the requirement to issue regulations 
reflects the majority's Congressional intent to move the CFATS program 
away from a regulatory framework to a public/private partnership, or 
some other unspecified structure.
    I am hoping to get some clarification, or opinion from the 
Department, on how they view these issues, especially in light of their 
surprisingly full-throated support of this language.
    Another issue I'd like to bring up is the use of contractors in 
CFATS. One of the features of H.R. 4007 is that it specifically 
authorizes the Secretary to designate inspectors that are not DHS 
employees. The language says that the audit and inspection processes 
``may be carried out by a non-Department or non-Governmental entity, as 
approved by the Secretary''.
    I understand that the bill is attempting to aid the Department in 
accelerating the site security authorization, approval, and compliance 
process, but I have serious reservations about the use of contractors 
in the inspector cadre, where this work is generally recognized as an 
inherently Governmental responsibility, especially when it involves 
terroristic threats and risks to the Nation.
    Finally, Mr. Chairman, I an anxious to work with you on the 
pressing issue of Personnel Surety, and I know your bill includes some 
helping language. But enactment into law for H.R. 4007 may be a while 
off.
    More recently, DHS has issued a 30-day information collection 
request offering its latest personnel surety proposal. The proposal, as 
I understand, would accept credentials that are vetted recurrently 
against the terrorist-screening database and has their validity 
verified on a continuing basis by electronic or other means. However, 
DHS has previously communicated with stakeholders that it would not 
grant reciprocity to personnel surety programs that vet individuals 
against the terrorism-screening database on a schedule not equivalent 
to recurrent vetting. This poses substantial problems in a very complex 
arena.
    Many have expressed concerns about duplication of efforts and the 
burden for multiple background checks, and others have rightfully asked 
about what protections might be offered for workers who would be 
required to secure multiple credentials to continue working, and what 
financial and operation problems would be put on facilities who are 
already complying with credentialing regulations.
    We must find a way to meet the needs of addressing the risks posed 
by access to chemical facilities through a common-sense approach that 
will likely involve multiple program efforts to harmonize Government 
credentialing among the agencies and programs.
    We all know that the CFATS program has been striving to improve its 
performance, and we commend the hard work and leadership shown at ISCD, 
and we will hear today from two agencies that have looked closely at 
the program to help us determine what we might codify to help the 
program achieve its potential.
    Thank you Mr. Chairman, I look forward to working with you to make 
the CFATS program one we can be proud of.

    Mr. Meehan. I thank the Ranking Member.
    The Chairman now recognizes the Chairman of the full 
committee, the gentleman from Texas, Mr. McCaul, for any 
statement he may have.
    Mr. McCaul. Thank you, Mr. Chairman. I want to thank you 
for holding this hearing, for introducing this important 
legislation that I strongly support, and I want to thank Mr. 
Green, Gene Green, my friend from Texas, for his support of 
this legislation.
    Energy and Commerce Committee has been very accommodating 
with this committee in terms of jurisdiction. We have worked 
out our differences to be able to move forward to this point. 
As Congressman Green and I can appreciate even more so, as the 
events of West, Texas, I think demonstrate, the explosion that 
occurred there, and the loss of life demonstrate the need for 
this legislation now.
    This is a product of, Mr. Chairman, your hard work, Joan 
O'Hara on the staff, over the last 6 months meeting with the 
stakeholders, Government Accountability Office, Senate 
authorizing committees, and most importantly, our Department of 
Homeland Security officials. In my meetings with DHS, they are 
strongly supportive of this legislation. They understand the 
need to authorize. This committee needs to operate and 
authorize.
    This has never been authorized, which creates confusion not 
only in the Government, but in the private sector. This has 
only been done by the appropriators. It is time for this 
committee to stand up and do its job and its responsibility and 
authorize, and that is what I strongly support here today.
    I was very pleased yesterday to hear the Secretary of 
Homeland Security--he gave me private assurances that he 
supports this legislation, but to hear him testify before this 
committee that he is fully supportive I think sends a strong 
message to this committee that we need to get our work done on 
this committee and pass this out of committee.
    We have enjoyed, I believe, on this committee a strong 
bipartisan support on legislation, whether there is a border 
security which passed unanimously out of this committee, 
whether it was a cybersecurity bill that after negotiations 
with the Minority passed unanimously out of this committee. I 
am very proud of that record, very proud of that record.
    I would ask that the Ranking Member of this committee and 
the full committee go forward with that same spirit of trying 
to get something done, and particularly on an issue of this 
importance, and continue our governance in a bipartisan issue, 
because when it comes to matters of security, I don't believe 
that partisan politics have any place in it.
    I will just end with the Secretary's quote, when he said 
yesterday, ``We owe it to the American people to get something 
done.'' I couldn't agree with the Secretary more, and I thank 
him for his testimony yesterday, and I look forward to working 
with the Minority to get something done in this area.
    With that, Mr. Chairman, I yield back.
    Mr. Meehan. I thank the Chairman for his comments and for 
his presence here. I also am very grateful for the presence of 
the Ranking Member on the committee, the gentleman from 
Mississippi.
    Mr. Thompson, you are recognized for any statements you may 
have.
    Mr. Thompson. Thank you very much, Mr. Chairman. I, too, am 
happy that we are moving forward with a discussion of much-
needed legislation. However, there are still some differences 
of interpretation about this legislation, and I think we will 
see that over the course of this hearing.
    However, I do want to thank you for holding this hearing to 
examine your bill, H.R. 4007. As an original author of chemical 
security legislation, I am supportive of DHS's efforts to raise 
the level of security at our Nation's chemical facilities. If 
you would have told me back in 2006, 8 years later, that CFATS 
would still be operating without a free-standing authorization 
in the Homeland Security Act, I would have been shocked. 
Jurisdictional wrangling has been a problem.
    The closest that Congress has come to approving an 
authorization bill was back in 2010 when I teamed up with then-
Energy and Commerce Chairman Waxman. Since that time, the 
program has faced its share of internal and external 
challenges. Today, the program appears to be in a better place.
    That said, there could be some major changes in the program 
once the President's interagency Chemical Facility Safety and 
Security Working Group completes its work to enhance chemical 
sector safety and security. The legislation before us today has 
some good features. Certainly, the mention of personnel surety 
is a positive. However, it has some glaring weaknesses.
    The bill is a stand-alone and would not amend the Homeland 
Security Act. This approach potentially denies CFATS a firm 
statutory footing and adds to jurisdictional conflict. The bill 
maintains exemptions that were put in place in haste in 2006 of 
categories of facilities even as we await the recommendations 
from the President's Chemical Facility Safety and Security 
Working Group.
    One of my biggest issues with the bill is that it is 
written so broadly as to raise questions on whether it is a 
stay-the-course bill or, by making little or no references to 
the existing CFATS program, requires something different. I 
must say that the introduction of this bill was somewhat 
surprising, since after the West, Texas, tragedy, last year, 
Chairman McCaul wrote, along with Energy and Commerce Chairman 
Upton, and Appropriations Subcommittee Chairman Carter, that 
the basic programmatic building blocks of CFATS are missing and 
they are convinced the program should not continue in its 
present condition.
    Since Chairman McCaul's July 2013 letter, the CFATS office 
has made some modest improvement, particularly with respect to 
identifying and reaching out to facilities that should be 
evaluated for risk. Still, fundamental questions about the 
program's implementation persist. Answers to those questions 
and recommendations for reform will likely be down the road.
    I wrote the President last year about my concerns regarding 
the tragedy that occurred in West, Texas, and how we might 
examine the processes here at DHS and other agencies to protect 
citizens from similar catastrophic events, including changes in 
the CFATS program.
    Soon thereafter, the President issued an Executive Order 
that created an interagency working group to undertake an 
across-the-board examination of the programs that regulate 
chemical security and safety in the Federal Government. The 
interagency working group includes the Department of Homeland 
Security, the Department of Agriculture, Department of Justice, 
Department of Labor, Department of Transportation, and the 
Environmental Protection Agency.
    The Chemical Facility Safety and Security Working Group is 
expected to report to the President in May. In fairness, the 
Federal Government shutdown, which resulted in lapses in 
funding and authority, was not helpful. For that matter, 
neither is the current sequester, but we are here to talk about 
making the CFATS program work for the American people and 
making our Nation more secure.
    As a committee, we have an obligation to advance 
legislation that gives effect to our oversight finding. From 
risk modeling to administrative processes, it is an excessive 
and wrongheaded approach to personal security. DHS needs 
guidance.
    Frankly, I see nothing in the scant 11 pages of H.R. 4007 
to deliver the massive reforms that will be required to make 
CFATS and other chemical security programs more efficient and 
productive programs.
    With that, Mr. Chairman, I yield back.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
    As an original author of chemical security legislation, I am 
supportive of DHS' efforts to raise the level of security at our 
Nation's chemical facilities. If you would have told me back in 2006 
that 8 years later that CFATS would still be operating without a free-
standing authorization in the Homeland Security Act, I would have been 
shocked.
    Jurisdictional wrangling has been a problem. The closest that 
Congress has come to approving an authorization bill was back in 2010, 
when I teamed up with then-Energy and Commerce Chairman Waxman. Since 
that time, the program has faced its share of internal and external 
challenges.
    Today, the program appears to be in a better place. That said, 
there could be some major changes to the program, once the President's 
inter-agency Chemical Facility Safety and Security Working Group 
completes its work, to enhance chemical sector safety and security.
    The legislation before us today has some good features; certainly, 
the mention of personnel surety is a positive; however, it has some 
glaring weaknesses.
    The bill is a stand-alone and would not amend the Homeland Security 
Act. This approach potentially denies CFATS a firm, statutory footing 
and adds to jurisdictional conflict. The bill maintains exemptions that 
were put in place, in haste, in 2006, of categories of facilities, even 
as we await the recommendations from the President's Chemical Facility 
Safety and Security Working Group.
    One of my biggest issues with the bill is that it is written so 
broadly as to raise questions on whether it is a ``stay the course'' 
bill or, by making little or no references to the existing CFATS 
program, requires something different.
    I must say that the introduction of this bill was somewhat 
surprising since, after the West, Texas, tragedy last year Chairman 
McCaul wrote, along with Energy and Commerce Chairman Upton, and 
Appropriations Subcommittee Chairman Carter, that ``The basic 
programmatic building blocks of CFATS are missing'' and they ``are 
convinced the program should not continue in its present condition.''
    Since Chairman McCaul's July 2013 letter, the CFATS office has made 
some modest improvement, particularly with respect to identifying and 
reaching out to facilities that should be evaluated for risk. Still, 
fundamental questions about the program's implementation persist. 
Answers to those questions and recommendations for reform will likely 
be down the road.
    I wrote the President last year about my concerns regarding the 
tragedy that occurred in West, Texas, and how we might examine the 
processes here at DHS and other agencies to protect citizens from 
similar catastrophic events, including changes in the CFATS program.
    Soon thereafter, the President issued an Executive Order that 
created an inter-agency working group to undertake an across-the-board 
examination of the programs that regulate chemical security and safety 
in the Federal Government. The interagency working group includes the 
Department of Homeland Security, the Department of Agriculture, the 
Department of Justice, the Department of Labor, the Department of 
Transportation, and the Environmental Protection Agency.
    The Chemical Facility Safety and Security Working Group is expected 
to report to the President in May.
    In fairness, the Federal Government shutdown, which resulted in 
lapses in funding and authority, was not helpful. For that matter, 
neither is the current sequester, but we are here to talk about making 
the CFATS program work for the American people and making our Nation 
more secure.
    As a committee, we have an obligation to advance legislation that 
gives effect to our oversight findings. From risk modeling to 
administrative processes and its excessive and wrong-headed approach to 
personnel surety, DHS needs guidance. Frankly, I see nothing in the 
scant 11 pages of H.R. 4007 to deliver the massive reforms that will be 
required to make CFATS, and other chemical security programs more 
efficient and productive programs.

    Mr. Meehan. I thank the Ranking Member on the committee for 
his comments. Other Members of the committee are reminded that 
opening statements may be submitted for the record.
    Now, before I recognize our distinguished panel before us 
of witnesses today, we are privileged to have a guest at the 
hearing, and I want to use the prerogative of the Chairman to 
take a moment to recognize the gentleman from Texas, Mr. Green, 
for any comments or questions he might have. I appreciate that 
some duties that he has with regard to other committees are 
going to prevent him from attending the full hearing.
    So, Mr. Green, the Chairman recognizes you.
    Mr. Green. Thank you, Mr. Chairman, and I thank Ranking 
Member Clarke for allowing unanimous consent for me to testify, 
and Members of the subcommittee, for the opportunity to speak 
with you this morning regarding this important legislation.
    I serve on the Energy and Commerce Committee and also on 
the Environmental and Economy Subcommittee has jurisdiction 
over CFATS and have worked on the issue literally since its 
inception. Chemical facility security is extremely important to 
the protection of the public health and safety throughout the 
United States, and particularly in my district in Texas, the 
Texas 29th.
    I represent most of the Houston ship channel area, which is 
the heart of the petrochemical complex that stretches along the 
Texas Gulf Coast into Louisiana and produces many products 
essential to modern life, and it is also the largest 
petrochemical complex in the country.
    I cannot stress how important the success of CFATS program 
is to my constituents who are employees and live in these 
communities that surround these facilities. They deserve the 
best security standards possible to prevent the act of 
terrorism on U.S. soil.
    The Energy and Commerce Committee, which I sit on, has been 
very active for the past two congresses on CFATS. The Energy 
and Commerce Committee, like your committee, has held numerous 
hearings with DHS, GAO, and stakeholders on the problem from 
the program's shortcomings. In 2009 and again in 2011, Energy 
and Commerce cleared CFATS authorization bills. Neither were 
perfect bills, just like this one is not, but both provided 
important guidelines DHS needs to proceed in fixing the 
problems in CFATS.
    Both efforts--one led by Democrats, and the other by 
Republicans--failed to become law, and as a result, we are left 
with the status quo, which continues to endanger the security 
of our Nation's chemical facilities and surrounding 
communities, and ultimately resulted in DHS temporarily losing 
its authority to continue running CFATS during the Government 
shutdown last October.
    H.R. 4007, the Chemical Facility Anti-Terrorism Standards 
Authorization and Accountability Act, gives this Congress a 
realistic pathway toward authorization. This bill doesn't solve 
every problem that exists in CFATS, and it isn't meant to do 
so. What this bill will do is provide the Department, industry, 
workers, and our communities the stability and certainty they 
need going forward that CFATS is here to stay.
    It will authorize CFATS for the first time for 2 years and 
give Congress the opportunity to oversee the Department's 
implementation of the program and provide Congress the time to 
come to consensus on how best to fix the lingering issues. The 
bill would also provide guidance on some of the most urgent 
fixes needed in CFATS, including improve the efficiency of the 
site security plans, allow facilities to use existing Federal 
terrorist screening programs, like TWIC, to satisfy personnel 
surety requirements, and limit information collected from 
individuals to only what is necessary to ensure site security.
    I am aware of the concerns of my colleagues that Congress 
should not act on chemical security until the completion of the 
administration's Chemical Facility Safety and Security Working 
Group. The intention of this bill is not to interfere with the 
President's Executive Order. The bill is intended narrowly in 
scope in order to avoid these conflicts.
    As Members of Congress, we shouldn't wait for any 
administration, Democrat or Republican, in order to act and 
author the laws that we know are necessary to protect the 
American people from terrorist threats.
    I would like to remind my colleagues of the words 
yesterday, and this will be the third time you get to hear DHS 
Secretary Jeh Johnson: ``We have got a good bill, and if there 
is an opportunity to pass it in this Congress that supports my 
goals and objectives and enhances homeland security, I am going 
to support that measure.''
    I think we in the Congressional and Executive branches owe 
it to the American people to get something done. I ask my 
colleagues on both sides of the aisle to not let the perfect be 
the enemy of the good and to support this important 
legislation.
    Again, thank you again for the opportunity to speak this 
morning, and I will yield back my time, but also recognize my 
good friend from South Texas, Congressman Vela, who--I am glad 
he is on Homeland Security. He represents also the Port of 
Brownsville.
    [The statement of Hon. Green follows:]
                   Statement of Honorable Gene Green
                           February 27, 2014
    Good morning. I would like to thank Chairman Meehan, Ranking Member 
Clarke, and Members of the subcommittee for the opportunity to speak 
with you all this morning regarding this important legislation.
    Chemical facility security is extremely important to the protection 
of public health and safety throughout the United States and 
particularly for my district, the Texas 29th.
    I represent the Houston Ship Channel area which is the heart of a 
petro-chemical complex that stretches along the Texas Gulf Coast and 
produces many products essential to modern life and it is also the 
largest petrochemical complex in the country.
    I cannot stress how important the success of the CFATS program is 
to my constituents who are the employees and live in the communities 
that surround these facilities. They deserve the best security 
standards possible to prevent act of terrorism on U.S. soil.
    The Energy and Commerce Committee, which I sit on, has been very 
active for the past two Congresses on CFATS. Energy and Commerce, like 
your committee, has held numerous hearings with DHS, GAO, and 
stakeholders on the program's shortcomings.
    In 2009, and again in 2011, Energy and Commerce cleared CFATS 
authorizations bills. Neither were perfect bills, but both provided 
importance guidelines on how DHS needs to proceed in fixing the 
problems in CFATS.
    Both efforts, one lead by Democrats, the other by Republicans, 
failed to become law, and as a result we are left with the status quo, 
which continues to endanger the security of our Nation's chemical 
facilities and surrounding communities and ultimately resulted in DHS 
temporarily losing its authority to continue running CFATS during the 
Government shutdown last October.
    H.R. 4007, the Chemical Facility Anti-Terrorism Standards 
Authorization and Accountability Act gives this Congress a realistic 
pathway towards authorization.
    This bill does not solve every problem that exists in CFATS. It 
isn't meant to do so.
    What this bill will do is provide the Department, industry, 
workers, and our communities, the stability and certainty they need 
going forward that CFATS is here to stay.
    It will authorize CFATS, for the first time, for 2 years and give 
Congress the opportunity to oversee the Department's implementation of 
the program and provide Congress the time to come to a consensus on how 
best to fix the lingering issues.
    The bill will also provide guidance on some of the most urgent 
fixes needed to CFATS, including:
   Improve the efficiency of the site security plans;
   Allow facilities to use existing Federal terrorist screening 
        programs, like TWIC, to satisfy personnel surety requirements, 
        and;
   Limit information collected from individuals to only what's 
        necessary to ensure site security.
    I am aware of the concerns of some of my colleagues that Congress 
should not act on chemical security until the completion of the 
administration's Chemical Facility Safety and Security Working Group.
    The intention of this bill is not to interfere with the President's 
EO. The bill is intentionally narrow in scope in order to avoid these 
conflicts.
    As Members of Congress, we shouldn't have to wait for any 
administration, Democrat or Republican, in order to act and author the 
laws we know are necessary to protect the American people from 
terrorist threats.
    I would also like to remind my colleagues of the words said in this 
very room yesterday by DHS Secretary Jeh Johnson:

``We've got a good bill, and if there is an opportunity to pass it in 
this Congress that supports my goals and objectives, enhances homeland 
security, I'm going to support that measure. I think we in the 
Congressional and Executive Branches owe it to the American people to 
get something done.''

    I ask my colleagues on both sides of the aisle to not let the 
perfect be the enemy of the good and to support this important 
legislation.
    Thank you again for the opportunity to speak with all of you this 
morning and I yield the balance of my time.

    Mr. Meehan. Well, I thank the gentleman from Texas, and I 
appreciate his taking the time out of his schedule to join us 
today.
    So at this point in time, let me turn to the testimony of 
our witnesses. We will have two panels of witnesses, the first 
constructed of members of the Department of Homeland Security 
and the agencies we have asked to participate in oversight of 
this program. So I will begin my identification of each of 
those witnesses.
    The first is Ms. Caitlin Durkovich, is the assistant 
secretary for infrastructure protection at the Department of 
Homeland Security. In this role, she leads the Department's 
efforts to strengthen public-private partnerships and 
coordinate programs to protect the Nation's critical 
infrastructure, assess and mitigate risk, build resilience, and 
strengthen incident response and recovery. Previously, Ms. 
Durkovich served as the National Program and Protection 
Directorate's chief of staff, overseeing day-to-day management 
of the director and the development of internal policy and 
strategic planning.
    Ms. Durkovich is accompanied this morning by Mr. David 
Wulf, the director of the Infrastructure Security Compliance 
Division in DHS's National Program and Protection Directorate. 
Mr. Wulf will not be offering an opening statement, but he is 
here to answer questions, and I do--Mr. Wulf has been 
previously identified in my testimony--but in his role, has 
spent a significant period of time both looking at the 
challenges of--been helping to direct the improvements in the 
response for DHS.
    We will also be joined on this panel by Mr. Stephen 
Caldwell. He is the director in the Government Accountability 
Office's homeland security and justice team. Most recently, Mr. 
Caldwell's focus has been related to protecting critical 
infrastructure and promoting resiliency. He recently raised 
concerns about the risk assessment process used by ISCD in 
assessing terrorist risk to the 3,500 chemical facilities under 
the CFATS program.
    Last on this panel, we will be joined by Ms. Marcia Hodges. 
She is the chief inspector of the office of inspection of the 
Department of Homeland Security's Office of Inspector General. 
Ms. Hodges directly directs highly complex analytical reviews 
of DHS operations and programs to determine their efficiency 
and effectiveness. Prior to her service at DHS, Ms. Hodges 
worked for the inspector general of the Federal Emergency 
Management Agency from 1999 to 2003. In that position, Ms. 
Hodges led a multi-discipline team in New York City to assist 
and facilitate FEMA's response to the terrorist attacks of 
September 11, 2001.
    I thank you all for being here. Full written statements for 
each of the witnesses have been submitted to the Chairman and 
will appear in the record. So I ask you to do your best to keep 
your testimony to our 5 minutes, and I will recognize our first 
witness, Ms. Durkovich.

     STATEMENTS OF CAITLIN DURKOVICH, ASSISTANT SECRETARY, 
    INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND 
     SECURITY, ACCOMPANIED BY DAVID WULF, DEPUTY DIRECTOR, 
          INFRASTRUCTURE SECURITY COMPLIANCE DIVISION

    Ms. Durkovich. Thank you very much, Chairman Meehan, 
Ranking Member Clarke. I do also want to thank Chairman McCaul, 
committee Ranking Member Thompson, Congressman Green, and 
Congressman Vela for their presence here earlier this morning 
and also other distinguished Members of the subcommittee.
    I very much appreciate the opportunity to appear before you 
today to discuss the progress made by CFATS and the need to 
authorize the program. The CFATS program has made the Nation 
more secure. Over the past 2 years, as you have noted, it has 
made significant progress. We are pleased the subcommittee has 
acknowledged this progress by introducing a bill that would 
provide longer-term authorization and the authority to carry 
out the program in a manner that will foster the security of 
America's highest-risk chemical infrastructure.
    As you are aware, the Department's current authority is set 
to expire in October 2014. DHS is eager to work with this 
subcommittee, our other authorization committees, and our 
stakeholders to achieve passage of legislation that provides 
long-term authorization and appropriately matures the CFATS 
program. As I said, the CFATS program has made the Nation more 
secure, and we are seeing the impact of the program at 
facilities throughout the country.
    For example, one facility had numerous positive aspects to 
their security program but failed to address security for small 
containers, which could be easily concealed in a purse or bag. 
After inspection, the facility understood this vulnerability 
and developed measures to prohibit bags within the restricted 
areas and to inspect hand-carrier items when exiting the 
restricted area.
    Another recent example is a tier four facility in Missouri 
that exercised its commitment to CFATS security measures and 
contacted their chemical security inspector when they 
discovered they had only received one of two pallets of a 
chemical of interest. Our chemical inspectors worked with UPS, 
local law enforcement, FBI weapons of mass destruction until 
the pallet was successfully located and delivered to the 
facility.
    These improvements are attributable to the hard work of the 
staff of the Infrastructure Security Compliance Division, which 
implements the CFATS program. I have confidence in the ability 
of Director Dave Wulf, who is here with me today, and the 
dedicated staff of ISCD located across the country to continue 
the success we have made to date.
    The progress made in the last 2 years has helped to put 
CFATS on a path to success, but there still is work to be done. 
We continue to engage with stakeholders and focus on three core 
areas of progress, reducing the backlog of security plan 
approvals, improving the risk assessment process, and ensuring 
that all potentially high-risk facilities are identified and 
meet their CFATS obligations.
    Over the past year, we have authorized, inspected, and 
approved hundreds of security plans. Since Director Wulf 
appeared before you last August, we have made great strides in 
increasing our pace of approvals, despite the 2\1/2\-week 
Government shutdown.
    The number of authorizations has nearly doubled to over 
1,100 authorizations. The pace of inspections has increased 
dramatically, and we have now completed more than 800 
inspections in total, including over 100 in January. We have 
tripled the number of approved site security plans, with over 
500 approved, and we are on pace to hit 1,000 this summer. 
Finally, in September, we began conducting compliance 
inspections at facilities with approved security plans.
    Our progress demonstrates our commitment to ensuring this 
program succeeds. Now we ask Congress to demonstrate your 
commitment to this program in providing long-term 
authorization.
    The Federal funding hiatus last October illustrates the 
complication faced by a program authorized through 
appropriation bills. In addition to stopping all inspections, 
the authorization of the CFATS program expired on October 5, 
2013. The gap in program authorization caused concern among our 
regulated facilities, with many questioning if the regulations 
were still in effect. This uncertainty illustrated the need for 
longer-term authorization outside of the appropriations 
process.
    The Department strongly believes that an authorization 
period longer than the 2 years currently stipulated in the bill 
would benefit Congressional oversight, ensuring maturation of 
the program, and the review and approval of security plans. 
Perhaps most importantly, long-term authorization will provide 
industry with the stability needed to plan and invest in 
measures to harden their sites against terrorist attack or 
exploitation. Companies have communicated to us that their 
capital planning and budgeting process for security 
improvements often runs on a 3-to-5-year cycle, and they 
deserve to know that the program will not be allowed to lapse 
as they invest in many CFATS-related improvements.
    Uncertainty about the future of CFATS has provided 
incentive for potentially regulated facilities to ignore their 
obligations and hope that the program will be allowed to 
sunset. An authorization period of 5 years or longer would 
enable you to send a message to facilities that may be seeking 
to avoid compliance.
    As we approach the anniversary of the explosion in West, 
Texas, the Department remains committed to ensuring that 
facilities are both aware of the requirements to report under 
CFATS and complete their obligations. The committee's efforts 
to codify the Department's authority to seek noncompliant 
facilities will greater support our actions to bring these 
facilities into compliance.
    We have worked closely with our interagency partners to 
implement Executive Order 13650 on improving chemical facility 
safety and security, but we feel strongly that multi-year 
authorization is vital now and will harmonize with the outcomes 
of the Executive Order. With the progress made over the last 2 
years, the CFATS program is ready for stabilization through 
long-term authorization.
    Finally, I want to thank the next panel, Clyde Miller, who 
is representing the American Chemistry Council, and Kate 
Donahue, who is representing the Society of Chemical 
Manufacturers and its affiliates. Both individuals and 
organizations have been important supporters as we have worked 
to implement the program. It is with their input and feedback 
that we have made progress in areas like developing templates 
for alternative security programs, expanding outreach to 
potentially noncompliant facilities, and improving our tiering 
methodology.
    With continued support from industry and action by Congress 
to authorize the program, our mission to protect Americans will 
be strengthened. Thank you. I look forward to your questions.
    [The joint prepared statement of Ms. Durkovich and Mr. Wulf 
follows:]
      Joint Prepared Statement of Caitlin Durkovich and David Wulf
                           February 27, 2014
    Thank you, Chairman Meehan, Ranking Member Clarke, and 
distinguished Members of the subcommittee. I appreciate the opportunity 
to appear before you today to discuss the Department of Homeland 
Security's (DHS) regulation of high-risk chemical facilities under the 
Chemical Facility Anti-Terrorism Standards (CFATS) and the need for 
action to authorize the program. Over the past year, the CFATS program 
has made significant progress, advancing programmatically while 
simultaneously addressing internal management concerns. We are pleased 
the subcommittee has acknowledged this progress by introducing a bill 
that would provide longer-term authorization and the authority to carry 
out the program in a manner that will foster the security of America's 
highest-risk chemical infrastructure.
    As you are aware, the Department's current authority under Section 
550 of the Fiscal Year 2007 Department of Homeland Security 
Appropriations Act, as amended, is set to expire in October 2014. DHS 
is eager to work with this subcommittee, our other authorization 
committees, and our stakeholders both in Government and the private 
sector to achieve passage of legislation that provides long-term 
authorization and appropriately matures the CFATS program. In support 
of this collaboration, our testimony focuses on the progress made over 
the last 2 years, our efforts to continue strengthening the program, 
and the need for permanent authorization in order to fully stabilize 
the program.
                 cfats has made the nation more secure
    The CFATS program is an important part of our Nation's 
counterterrorism efforts as we work with our industry stakeholders to 
keep dangerous chemicals out of the hands of those who wish to do us 
harm. Since the CFATS program was created, we have engaged with 
industry to identify and regulate high-risk chemical facilities to 
ensure they have security measures in place to reduce the risks 
associated with the possession of chemicals of interest. CFATS has also 
played a significant role in reducing the number of high-risk chemical 
facilities that are susceptible to attack or exploitation. To date, 
more than 3,000 facilities have eliminated, reduced, or modified their 
holdings of chemicals of interest. The significant reduction in the 
number of chemical facilities that represent the highest risk is an 
important success of the CFATS program and is attributable both to the 
design of the program as enacted by Congress and to the work of CFATS 
personnel and industry at thousands of chemical facilities.
    The progress made in the CFATS program over the last 2 years has 
helped to put the program on a path to success; however, there is still 
work to be done. The Department continues to engage with stakeholders 
and focus on three core areas: Reducing the backlog of site security 
plan approvals, improving the risk assessment process, and ensuring 
that all potentially high-risk facilities are identified and are 
meeting their regulatory obligations as required by CFATS. Along with 
long-term authorization, our continued focus on these areas will ensure 
our stakeholders have the stability they need to comply with their 
regulatory obligations. We welcome the opportunity to work with you and 
our stakeholders on these important issues to further improve this 
vital National security program.
                     cfats implementation progress
    The cornerstone of the CFATS program is the development, 
submission, and implementation of Site Security Plans (SSPs), or 
Alternative Security Programs (ASPs) in lieu of SSPs, which document 
the security measures that high-risk chemical facilities utilize to 
satisfy the applicable Risk-Based Performance Standards (RBPS) under 
CFATS. It is important to note that these plans are not ``one-size-
fits-all,'' but are in-depth, highly customized, and account for each 
facility's unique circumstances.
    In order to determine whether a facility is regulated under CFATS, 
the facility submits a Top-Screen to the Department's Infrastructure 
Security Compliance Division (ISCD). Since we began collecting this 
information in 2007, ISCD has data from more than 46,000 Top-Screens 
submitted by chemical facilities, providing important information about 
their chemical holdings. Based on the information received in the Top-
Screens, ISCD makes an initial determination that certain facilities 
are considered high-risk and assigns each of these to a preliminary 
tier.\1\ These facilities then compile and submit Security 
Vulnerability Assessments (SVAs), which are used by ISCD to identify 
which facilities present a terrorism risk that is sufficiently high to 
warrant the assignment of a final high-risk tier under CFATS. As of 
February 20, 2013, CFATS covers over 4,200 high-risk facilities Nation-
wide; of these, over 3,300 have received final high-risk determinations 
and are required to develop SSPs (or ASPs) for ISCD review. The 
remaining facilities are awaiting final tier determinations based on 
their SVA submissions. The tiered population is dynamic and subject to 
change, depending on the chemical holdings and other conditions at 
facilities.
---------------------------------------------------------------------------
    \1\ The Department has developed a risk-based tiering structure and 
assigns facilities to one of four risk-based tiers ranging from high 
(Tier 1) to low (Tier 4) risk. Assignment of tiers is based on an 
assessment of the potential consequences of a successful attack on 
assets associated with chemicals of interest.

----------------------------------------------------------------------------------------------------------------
                                       Total No.              Authorized  Authorization   Approved    Compliance
                Tier*                     of       Received    SSPs and     Inspection    SSPs and   Inspections
                                      Facilities  Final Tier     ASPs       Conducted       ASPs      Conducted
----------------------------------------------------------------------------------------------------------------
1...................................         120         111         106           103           99           11
2...................................         392         343         253           234          195            1
3...................................       1,119         957         541           416          241            0
4...................................       2,571       1,914         149            28            5            0
                                     ---------------------------------------------------------------------------
      Total.........................       4,202       3,325       1,049           781          540          12
----------------------------------------------------------------------------------------------------------------
* As of February 20, 2013.
** Totals do not include facilities that are no longer regulated, but have received letters of authorization,
  authorization inspections, and/or approved SSPs/ASPs.

    Over the past year, the CFATS program has authorized, inspected, 
and approved hundreds of security plans. The program has also improved 
the pace of inspections and SSP approvals, developing new processes and 
distributing guidance materials. The majority of Tier 1 and Tier 2 
facilities (the highest of the high-risk), as well as many Tier 3 
facilities, now have an approved security plan. In September, ISCD 
marked yet another milestone when we began conducting compliance 
inspections for facilities with approved SSPs. During compliance 
inspections, the Department verifies that the facility is implementing 
the measures contained in its approved SSP. Initially, these 
inspections will be conducted approximately 1 year after a facility's 
SSP is approved, but the Department is developing a process whereby the 
timing for compliance inspections will be based on a variety of 
factors, such as the facility's risk tier, the facility and/or parent 
company's past CFATS compliance history, and the number of planned 
measures contained in the approved SSP.
    The improvements that have been made have accelerated the pace of 
approvals and we are continuing to explore areas to enhance the 
program. We recognize the projected time frame for all approvals must 
be reduced and we are exploring a variety of ways to increase the pace 
at which approvals are granted while maintaining the quality and 
thoroughness of the security plan approval process and the level of 
security required at chemical facilities. These include encouraging 
increased use of ASPs and supporting stakeholders' development of new 
ASP templates, focusing inspections on key RBPS at lower-tier 
facilities, exploring ways to streamline the security plan review and 
inspection process for facilities owned by corporations with multiple 
CFATS-regulated facilities, and identifying efficiencies in the 
inspection and compliance assistance visit scheduling process to reduce 
travel time per inspector activity. The Department is engaging with 
CFATS stakeholders on efforts to expedite security plan reviews and is 
committed to identifying and implementing appropriate enhancements to 
streamline the CFATS process. ASPs are an important option for 
facilities that desire flexibility in their site security plan, and we 
appreciate the subcommittee's effort to ensure this option remains 
available for the CFATS program moving forward.
                         cfats risk assessment
    As a part of our commitment to continue moving the CFATS program 
forward, NPPD has conducted a thorough review of our risk assessment 
process. In support of this review, NPPD implemented a phased approach, 
which included documenting all processes and procedures relating to the 
risk assessment methodology; conducting an internal NPPD review of the 
risk assessment process; and initiating an external peer review of the 
risk assessment methodology.
    All three of these phases are now complete, with the Department 
receiving the CFATS Tiering Methodology Peer Review Final Report from 
the expert peer review panel in October 2013. Although many of the peer 
review panel's recommendations pertain to areas the Department had 
previously identified for improvement, we felt it was essential to 
engage external stakeholders through an external peer review. As a 
result of continued stakeholder engagement, the Report provides 
valuable perspectives that will inform our efforts to enhance the CFATS 
risk-tiering methodology. We have analyzed the peer review 
recommendations and developed an implementation plan to enable us to 
address the recommendations in a timely and thoughtful manner. We also 
recognize that it is essential to continue to engage our stakeholders 
in implementing changes to risk assessment process.
    As recommended by the Peer Review Final Report, the Department 
intends to adopt appropriate changes to the tiering methodology in an 
integrated fashion, addressing as many issues concurrently as feasible. 
The implementation plan also addresses modifications to the tiering 
methodology stemming from efforts beyond the peer review, such as the 
economic and mission criticality studies being conducted on behalf of 
the Department by Sandia National Laboratories. Additionally, 
consistent with both recommendations within the Peer Review Final 
Report and our response to the Government Accountability Office's 
report on the CFATS tiering methodology, ISCD intends to have a third 
party verify and validate the revised tiering methodology. As we move 
forward with implementing recommendations to the tiering methodology, 
we are committed to ensuring these improvements are balanced with our 
stakeholders need for continued stability in tiering.
      chemical facility safety and security improvement: a shared 
                             responsibility
    Since the inception of the CFATS program, the Department has worked 
to ensure that potentially regulated facilities are aware of their 
reporting obligation under the CFATS regulations and that they comply 
with these existing regulations. Following the explosion in West, 
Texas, this past April, ISCD has taken a number of steps to 
reinvigorate this effort, including supporting the implementation of 
Executive Order 13650, Improving Chemical Facility Safety and Security. 
Under Executive Order 13650, Federal agencies are exploring options for 
improving chemical facility safety and security to reduce the 
likelihood of incidents occurring in the future. The working group is 
developing recommendations to see if there is a need to improve 
information collection, more effectively share information between 
agencies, improve operational and Federal coordination efforts, and the 
working group is analyzing the effectiveness of existing regulations 
and policies governing chemicals and chemical facilities. These 
coordinated efforts will help ensure that the Federal Government most 
effectively uses the collective resources available for managing 
chemical risk.
Promoting Compliance
    The activities taking place in support of Executive Order 13650 
complement many of the individual efforts being undertaken within the 
Department, and other Federal departments and agencies, following the 
tragic events in West, Texas. Since the April explosion, DHS has 
engaged with numerous members of industry and all have agreed that we 
must work together to prevent future incidents. Industry has offered to 
share information about the CFATS regulatory requirements with other 
members of industry and do their part to promote safety and security at 
chemical facilities. The Department appreciates this support and looks 
forward to working with industry and our Government partners to carry 
out these activities. In pursuit of this shared responsibility, the 
Department has undertaken significant outreach efforts throughout the 
years, to inform potentially high-risk chemical facilities of their 
obligations under CFATS. These outreach efforts have been a major 
contributor to the submission of over 46,000 Top-Screens from 
potentially high-risk chemical facilities to date.
    As the tragic incident in West, Texas, demonstrated, however, not 
all facilities with threshold quantities of CFATS chemicals of interest 
have met their obligation to submit Top-Screens. DHS is committed to 
pursuing all reasonable measures to identify potential high-risk 
chemical facilities that are not among those that have already complied 
with initial Top-Screen submission requirements, and we will continue 
to work to get those facilities into compliance. When appropriate, the 
Department can utilize available enforcement mechanisms to bring non-
compliant facilities into compliance. Both increased outreach and, 
where appropriate, the use of compliance enforcement mechanisms are 
part of the Department's overall strategy to reduce the likelihood of 
potentially high-risk chemical facilities intentionally or 
unintentionally evading identification under the CFATS program.
State and Local Partnerships
    The Department's strategy for identifying potentially non-compliant 
facilities also includes enhanced coordination with Federal, State, and 
local partners. One such activity has been reinvigorating efforts with 
the EPA and other Federal partners with regulatory authority over the 
chemical industry to compare lists of regulated facilities to identify 
facilities which may have complied with another regulatory program and 
are potentially regulated under CFATS but have yet to comply with 
CFATS. Initial results from these efforts have been promising, with the 
Department seeing a substantial increase in the monthly rate of new 
Top-Screen submissions having begun in August 2013.
    The Department is also undertaking similar efforts with States and 
localities. Since April, ISCD has reached out to officials in all 50 
States, including State Homeland Security Advisors (HSAs) and the 
Governors Homeland Security Advisory Council, about CFATS requirements. 
These efforts are in addition to continuing to provide State HSAs and 
their designees with access to information on CFATS-regulated 
facilities in their jurisdictions via CFATS Share, a web-based 
information-sharing portal that provides on an as-needed basis to 
certain Federal, State, and local agencies access to key information on 
CFATS facility information.
Outreach to Non-Compliant Facilities
    The Department is expanding outreach efforts to identify 
potentially non-compliant facilities and has developed an Outreach and 
Engagement Strategy as well as an Outreach and Engagement 
Implementation Plan to raise awareness of CFATS, the measures of 
success, roles and responsibilities, and resource implications. DHS 
will continue to operate its CFATS Tip Line and will follow up on any 
information of potentially non-compliant facilities.
    All of the aforementioned efforts are being undertaken in addition 
to the larger-scale efforts being coordinated under E.O. 13650. Of 
particular relevance is the effort being led by DHS under Section 5 of 
the EO, which addresses Enhanced Information Collection and Sharing. 
This section requires the development of recommendations on possible 
changes to improve and streamline information collection from regulated 
industries and recommendations to enhance data sharing between 
agencies, States, localities, and Tribal entities to better identify 
facilities which may not have provided all required information or may 
be non-compliant with requirements.
    We feel strongly that our private-sector stakeholders are key to 
our efforts to enhance data sharing, increase cross-training, and 
identify areas for possible regulatory changes as well as identifying 
possible gaps in existing statutory authorities. Enhancing security and 
building resilience across the chemical sector is not something a 
single company, industry or even Government can do by itself. This has 
to be a collaborative effort. It also has to be a comprehensive effort, 
because of the sheer complexity of affected facilities, the linkages to 
other sectors, and the potential cascading effects and consequences of 
a significant attack or disruption.
                          industry engagement
    Industry engagement has always been an important aspect of CFATS, 
but will be more important than ever as we move forward with program 
improvements. Chemical Security Inspectors play an important role, 
serving as our boots on the ground and the face of CFATS in the field. 
Inspectors provide assistance and outreach directly to facilities and 
play an important role in helping to identify appropriate security 
measures during the authorization inspection process. For example, one 
facility had numerous positive aspects to their security program, but 
failed to address any security measures for small containers, which 
could easily be concealed within a handbag or backpack. After the 
inspection, the facility understood the potential vulnerability and 
developed planned measures to prohibit bags within the restricted area 
and to inspect hand-carried items when exiting the restricted area. 
Another example is a different regulated facility that had effective 
security for the chemicals of interest located within the building, but 
failed to address the chemicals of interest located in the open storage 
yard. As a result of the inspection, the facility identified a new 
restricted area to store the chemicals of interest within the main 
building and added procedures to ensure that upon receipt, the 
appropriate facility personnel immediately moved the chemicals of 
interest into the new restricted area. In addition to conducting 
inspections and providing compliance assistance to facilities, NPPD's 
chemical inspectors actively work with local stakeholders and 
Governmental agencies across the country.
                   the need for program authorization
    DHS recognizes the significant work that the committee and others 
have undertaken to reauthorize the CFATS program. The progress we have 
made over the last 2 years demonstrates the Department's commitment to 
ensuring this program is a success; now we ask Congress to demonstrate 
your commitment to this program in providing a long-term authorization.
    The Federal funding hiatus last October illustrates the 
complications in the current authorization structure. The funding 
hiatus directly impacted the CFATS program because the program is 
authorized through appropriations bills. The shutdown resulted in all 
ISCD staff being furloughed, which resulted in cancellation of numerous 
inspections and immobilized security plan approvals. In addition to the 
shutdown of programmatic activities, the authorization of the CFATS 
program expired on October 5, 2013. The gap in program authorization 
caused concern among regulated facilities, with many facilities 
questioning whether the regulations were still in effect. This 
confusion and uncertainty demonstrated the need for long-term 
authorization outside of the appropriations process. Moreover, it is 
unclear if the Department would have had the authority to act had there 
been an exigent need during the shutdown to take enforcement action 
under CFATS in furtherance of National security interests.
    The Department strongly believes that an authorization period 
longer than the 2 years currently stipulated in the bill would be 
beneficial to your oversight activities by ensuring the full maturation 
of the program and the review and approval of all backlogged Site 
Security Plans. Perhaps most importantly, long-term authorization will 
provide industry stakeholders with the stability needed to plan for and 
invest in CFATS-related security measures to harden their critical 
sites against terrorist attack or exploitation. Companies have 
regularly communicated to us that their capital-planning/budgeting 
processes for security improvements frequently run on a 3-to-5-year 
cycle and they deserve to know that the program will not be allowed to 
lapse as they invest in major CFATS-related security improvements.
    Uncertainty about the future of CFATS also has provided an 
incentive for potentially-regulated facilities storing large quantities 
of dangerous chemicals to ignore their obligations under CFATS in hopes 
that the program will be allowed to sunset. An authorization period of 
5 years or longer would enable Congress to send an important message to 
such facilities that may willfully be seeking to avoid compliance.
    As we approach the 1-year anniversary of the explosion at the West 
Fertilizer plant in Texas, the Department remains committed to ensuring 
that facilities across the Nation are both aware of the requirements to 
report under CFATS and complete their obligations. The committee's 
efforts to codify the Department's authority to seek out non-compliant 
facilities will greatly support our on-going actions to bring these 
facilities into compliance. The Department has worked closely with our 
interagency partners to implement Executive Order 13650, but we feel 
strongly that multi-year CFATS authorization is vital now and will 
harmonize with the outcomes of the Executive Order.
    With the progress made over the last 2 years, the CFATS program is 
ready for program stabilization through permanent or long-term 
authorization. The Department has taken important steps to build a 
strong CFATS program and has a seasoned leadership team committed to 
the success of the program. With support from industry and action by 
Congress to authorize the program, the CFATS program's mission to 
protect Americans will be strengthened.
                               conclusion
    The Department has made significant improvements to the CFATS 
program and is moving forward strategically to address the challenges 
that remain. With your support, we can ensure our Nation is more secure 
by continuing implementation of the CFATS program, and we are committed 
to working with you to pass legislation to establish permanent or long-
term authorization for the program. As we implement CFATS, we will 
continue to work with stakeholders to keep our Nation secure by 
preventing terrorists from exploiting chemicals or chemical facilities. 
We firmly believe that CFATS is making the Nation more secure by 
reducing the risks associated with our Nation's chemical infrastructure 
and we are--along with our stakeholders and partners--committed to its 
continued success.

    Mr. Meehan. Thank you, Ms. Durkovich.
    The Chairman now recognizes the gentleman from the 
Government Accountability Office, Mr. Caldwell.

 STATEMENT OF STEPHEN L. CALDWELL, DIRECTOR, HOMELAND SECURITY 
       AND JUSTICE, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Caldwell. Chairman Meehan, Ranking Member Clarke, thank 
you very much for, again, asking GAO to discuss our CFATS work, 
particularly at your hearing on your bill, H.R. 4007.
    My written statement is based on work we have done over the 
last couple of years, as well as some more recent updates in 
talking to the CFATS staff. We will provide basically a status 
report on four areas that are key to the program. First is 
identifying chemical facilities. Next is assessing the risks 
and prioritizing those facilities to decide which ones are high 
risk and at what tier. The next one is reviewing facility site 
security plans and improving those. Then, finally, inspecting 
the facilities for compliance at the end of the process.
    Based on reports we have done, the recent updates and some 
of the statements by the Department today, there are certainly 
some indications of process across all four of these areas. 
Regarding the identification of the facilities, your last 
hearing raised the issue of outliers, facilities that should 
have applied, but have not. As you know, on that very same day, 
the President issued the Executive Order 13650, to address that 
issue, DHS as a whole has reported on some of the progress by 
the 13650 working group. GAO does have a review in process to 
look at the implementation of that, focused not only on DHS, 
but also at OSHA, EPA, and some of the other facilities.
    Regarding the assessment of risks and the prioritization of 
facilities, DHS is working to implement our recommendations 
related to the risk assessment methodology. As part of response 
to our recommendation, they ask for a peer review from the 
Homeland Security and Studies Analysis Institute. Their study 
had results very similar to ours, and as mentioned, DHS has an 
action plan to address that.
    Regarding the review of site security plans, as noted 
before, we have talked about a long backlog of that, and the 
Department is taking steps to do that. When we restart our work 
on this, that is one of the things will focus on, and if 
appropriate, we will certainly revise our estimate from about a 
year ago that it will take 7 to 9 years to resolve that 
backlog.
    Of course, the outstanding issue for all the facilities, 
those that have had plans approved or not, relates to the 
personnel surety program performance standard 12. Until that is 
resolved, you know, none of the facilities actually have a 
final approval of their site security plan.
    Then regarding the inspections for compliance, as just 
reported, the Department is just starting that process. We have 
not really looked at it, but this is one of the key areas that 
we will focus on as we go forward with our new review.
    Closing, I would like to note the GAO still needs to verify 
a lot of the progress that has been reported by the Department. 
We will do that through in-depth audits, as we always do. We 
are coordinating with the I.G., as we do as well, to make sure 
that we have maximum coverage over the program without 
duplicating work. We plan to go forward with these reviews in 
response to outstanding requests we already have from the 
appropriators and the authorization committees and whether or 
not this bill goes forward in terms of that particular clause.
    So with that, I will be happy to answer any questions. 
Thank you.
    [The prepared statement of Mr. Caldwell follows:]
               Prepared Statement of Stephen L. Caldwell
                           February 27, 2014
                             gao highlights
    Highlights of GAO-14-365T, a testimony before the Subcommittee on 
Cybersecurity, Infrastructure Protection, and Security Technologies, 
Committee on Homeland Security, House of Representatives.
Why GAO Did This Study
    Facilities that produce, store, or use hazardous chemicals could be 
of interest to terrorists intent on using toxic chemicals to inflict 
mass casualties in the United States. As required by statute, DHS 
issued regulations establishing standards for the security of these 
facilities. DHS established the CFATS program to assess risk at 
facilities covered by the regulations and inspect them to ensure 
compliance. In February 2014, legislation was introduced related to 
several aspects of the program.
    This statement provides observations on DHS efforts related to the 
CFATS program. It is based on the results of previous GAO reports in 
July 2012 and April 2013, with selected updates conducted in February 
2014. In conducting the earlier work, GAO reviewed DHS reports and 
plans on the program and interviewed DHS officials. In addition, GAO 
interviewed DHS officials to update information.
What GAO Recommends
    In a July 2012 report, GAO recommended that DHS measure its 
performance implementing actions to improve its management of CFATS. In 
an April 2013 report, GAO recommended that DHS enhance its risk 
assessment approach to incorporate all elements of risk, conduct a peer 
review, and gather feedback on its outreach to facilities. DHS 
concurred with these recommendations and has taken actions or has 
actions underway to address them.
    GAO provided a draft of the updated information to DHS for review, 
and DHS confirmed its accuracy.
  critical infrastructure protection.--observations on dhs efforts to 
     identify, prioritize, assess, and inspect chemical facilities
What GAO Found
    In managing its Chemical Facility Anti-Terrorism Standards (CFATS) 
program, the Department of Homeland Security (DHS) has a number of 
efforts underway to identify facilities that are covered by the 
program, assess risk and prioritize facilities, review and approve 
facility security plans, and inspect facilities to ensure compliance 
with security regulations.
   Identifying facilities.--DHS has begun to work with other 
        agencies to identify facilities that should have reported their 
        chemical holdings to CFATS, but may not have done so. DHS 
        initially identified about 40,000 facilities by publishing a 
        CFATS rule requiring that facilities with certain types of 
        chemicals report the types and quantities of these chemicals. 
        However, a chemical explosion in West, Texas, last year 
        demonstrated the risk posed by chemicals covered by CFATS. 
        Subsequent to this incident, the President issued Executive 
        Order 13650 which was intended to improve chemical facility 
        safety and security in coordination with owners and operators. 
        Under the Executive Order, a Federal working group is sharing 
        information to identify additional facilities that are to be 
        regulated under CFATS, among other things.
   Assessing risk and prioritizing facilities.--DHS has begun 
        to enhance its ability to assess risks and prioritize 
        facilities. DHS assessed the risks of facilities that reported 
        their chemical holdings in order to determine which ones would 
        be required to participate in the program and subsequently 
        develop site security plans. GAO's April 2013 report found 
        weaknesses in multiple aspects of the risk assessment and 
        prioritization approach and made recommendations to review and 
        improve this process. In February 2014, DHS officials told us 
        they had begun to take action to revise the process for 
        assessing risk and prioritizing facilities.
   Reviewing security plans.--DHS has also begun to take action 
        to speed up its reviews of facility security plans. Per the 
        CFATS regulation, DHS was to review security plans and visit 
        the facilities to make sure their security measures met the 
        risk-based performance standards. GAO's April 2013 report found 
        a 7- to 9-year backlog for these reviews and visits, and DHS 
        has begun to take action to expedite these activities. As a 
        separate matter, one of the performance standards--personnel 
        surety, under which facilities are to perform background checks 
        and ensure appropriate credentials for personnel and visitors 
        as appropriate--is being developed. As of February 2014, DHS 
        has reviewed and conditionally approved facility plans pending 
        final development of the personal surety performance standard.
   Inspecting to verify compliance.--In February 2014, DHS 
        reported it had begun to perform inspections at facilities to 
        ensure compliance with their site security plans. According to 
        DHS, these inspections are to occur about 1 year after facility 
        site security plan approval. Given the backlog in plan 
        approvals, this process has started recently and GAO has not 
        yet reviewed this aspect of the program.
    Chairman Meehan, Ranking Member Clarke, and Members of the 
subcommittee: I am pleased to be here today to discuss our work on the 
Department of Homeland Security's (DHS) efforts in implementing and 
managing the Chemical Facility Anti-Terrorism Standards (CFATS) 
program. Facilities that produce, store, or use hazardous chemicals 
could be of interest to terrorists intent on using toxic chemicals to 
cause harm to surrounding populations during terrorist attacks, and 
these chemicals could be stolen and used as chemical weapons, such as 
improvised explosive devices, or as the ingredients for making chemical 
weapons. The danger posed by these chemicals became evident last year 
when ammonium nitrate--one of the chemicals covered by the CFATS 
program--detonated during a fire at a fertilizer storage and 
distribution facility in West, Texas. An investigation by the U.S. 
Chemical Safety Board (CSB) showed that the explosion killed at least 
14 people and injured more than 200 others and severely damaged or 
destroyed nearly 200 homes, 3 nearby schools, a nursing home, and an 
apartment complex.\1\ According to CSB, the fire at the facility 
detonated about 30 tons of ammonium nitrate. This event serves as a 
tragic reminder of the extent to which chemicals covered by the CFATS 
program can pose a risk to surrounding populations.
---------------------------------------------------------------------------
    \1\ Rafael Moure-Eraso, Chairperson, U.S. Chemical Safety Board, 
testimony before the Senate Committee on Environment and Public Works, 
113th Congress 1st Sess., June 27, 2013. The CSB is an independent 
Federal agency charged with investigating industrial chemical 
accidents. The CSB board members are appointed by the President and 
confirmed by the Senate. According to the CSB website, CSB does not 
issue fines or citations, but makes recommendations to plants, 
regulatory agencies, industry organizations, and labor groups.
---------------------------------------------------------------------------
    The DHS appropriations act for fiscal year 2007 \2\ required DHS to 
issue regulations to establish risk-based performance standards for 
securing facilities that possess, store, manufacture, or use chemicals 
that could be of interest to terrorists, among other things. \3\ In 
2007, DHS established the CFATS program to assess the risk posed by 
chemical facilities, place facilities considered to be high-risk in one 
of four risk-based tiers, require high-risk facilities to develop 
security plans, review these plans, and inspect the facilities to 
ensure compliance with regulatory requirements. DHS's National 
Protection and Programs Directorate (NPPD) is responsible for the CFATS 
program. Within NPPD, the Infrastructure Security Compliance Division 
(ISCD), a division of the Office of Infrastructure Protection (IP), 
manages the program.
---------------------------------------------------------------------------
    \2\ Pub. L. No. 109-295,  550, 120 Stat. 1355, 1388 (2006).
    \3\ The CFATS regulation establishes 18 risk-based performance 
standards that identify the areas for which a facility's security are 
to be examined, such as perimeter security, access control, and 
cybersecurity. To meet these standards, facilities are free to choose 
whatever security programs or processes they deem appropriate so long 
as DHS determines that the facilities achieve the requisite level of 
performance in each applicable standard.
---------------------------------------------------------------------------
    On February 6, 2014, Congressman Meehan and other Members of the 
House of Representatives' Committee on Homeland Security, along with 
one Member of the House of Representatives' Committee on Energy and 
Commerce, introduced H.R. 4007, the Chemical Facility Anti-Terrorism 
Standards Program Authorization and Accountability Act of 2014.\4\ This 
bill would authorize the CFATS program for 2 years and would take 
effect 30 days after enactment. This bill includes provisions regarding 
multiple aspects of the CFATS program, including risk assessment, 
security plan reviews, and facility inspections. Among other things, 
H.R. 4007 would:
---------------------------------------------------------------------------
    \4\ H.R. 4007, 113th Cong. (2014).
---------------------------------------------------------------------------
   Require DHS to consult with the heads of other Federal 
        agencies, States and political subdivisions, and business 
        associations to identify chemical facilities of interest;
   Direct DHS to develop a risk assessment approach that 
        includes all elements of risk, including threat data based on 
        available intelligence, the vulnerability of the facility to 
        terrorist attack, and consequence measurements including 
        potential economic consequences;
   Reaffirm the risk-based performance standard approach to 
        facility security plans and the use of Alternative Security 
        Programs;\5\
---------------------------------------------------------------------------
    \5\ Under current regulations, an Alternative Security Program 
(ASP) is a third-party, facility, or industry organization's security 
program that has been determined to meet the requirements of, and 
provides for an equivalent level of security to that established by the 
CFATS regulation. CFATS allows regulated chemical facilities to submit 
an ASP in lieu of a site security plan. 6 C.F.R.  27.235.
---------------------------------------------------------------------------
   Allow chemical facilities to utilize any Federal screening 
        program that periodically vets individuals against the 
        terrorist screening database to satisfy the requirements of a 
        personnel surety performance standard;\6\
---------------------------------------------------------------------------
    \6\ Personnel surety is one of the CFATS performance standards 
under which facilities are to perform background checks and ensure 
appropriate credentials for personnel and visitors as appropriate.
---------------------------------------------------------------------------
   Authorize the use of non-Department or non-Government 
        entities, with the Secretary's approval, for audits and 
        inspections; and:
   Require us to submit a semiannual report to Congress 
        containing our assessment of the implementation of the bill.
    My testimony today summarizes our past work on the CFATS program 
and provides our observations on the status of DHS's efforts in four 
key areas--identifying facilities to be covered by CFATS, assessing 
risk and prioritizing covered facilities, reviewing facility security 
plans, and inspecting facilities to verify compliance with CFATS 
regulations. My statement is based on reports and testimonies we issued 
from July 2012 through August 2013 on various aspects of the CFATS 
program in addition to work we conducted in February 2014 to update the 
status of DHS actions related to these four areas.\7\ To conduct our 
prior work, we reviewed applicable laws and regulations, as well as 
NPPD, IP, and ISCD policies and procedures for administering the CFATS 
program and conducting its mission. We interviewed senior ISCD 
officials along with NPPD and IP officials to obtain their views on the 
program and how ISCD assesses risk. We also reviewed ISCD documents and 
data on tiered facilities and the approach used to determine a 
facility's risk and assessed ISCD's process for reviewing security 
plans. Further details on the scope and methodology for the previously-
issued reports are available within each of the published products. To 
update our work, we met with senior ISCD officials and discussed status 
updates on the four areas (identifying facilities, assessing risk and 
prioritizating facilities, reviewing security plans, and inspecting 
facilities). Where possible, we also reviewed available documentation 
pertinent to each of the key areas. We provided a copy of new 
information in this statement to DHS for review. DHS confirmed the 
accuracy of this information.
---------------------------------------------------------------------------
    \7\ GAO, Critical Infrastructure Protection: DHS Needs to Improve 
Its Risk Assessments and Outreach for Chemical Facilities, GAO-13-801T 
(Washington, DC: Aug. 1, 2013); Critical Infrastructure Protection: DHS 
Efforts to Assess Chemical Security Risk and Gather Feedback on 
Facility Outreach Can Be Strengthened, GAO-13-353 (Washington, DC: Apr. 
5, 2013); Critical Infrastructure Protection: DHS Is Taking Action to 
Better Manage Its Chemical Security Program, But It Is Too Early to 
Assess Results, GAO-12-515T (Washington, DC: July 26, 2012).
---------------------------------------------------------------------------
    We conducted the work on which this statement is based in 
accordance with generally accepted Government auditing standards. Those 
standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives.
observations on dhs efforts to identify facilities, assess risk, review 
                 security plans, and verify compliance
Identifying Facilities Covered by CFATS
    DHS has begun to take action to work with other agencies to 
identify facilities that are required to report their chemical holdings 
to DHS but may not have done so.
    The first step of the CFATS process is focused on identifying 
facilities that might be required to participate in the program. The 
CFATS rule was published in April 2007,\8\ and appendix A to the rule, 
published in November 2007, listed 322 chemicals of interest and the 
screening threshold quantities for each.\9\ As a result of the CFATS 
rule, about 40,000 chemical facilities reported their chemical holdings 
and their quantities to DHS's ISCD.
---------------------------------------------------------------------------
    \8\ 72 Fed. Reg. 17,688 (Apr. 9, 2007) (codified at 6 C.F.R. pt. 
27).
    \9\ 72 Fed. Reg. 65,396 (Nov. 20, 2007). According to DHS, CFATS 
covers facilities that manufacture chemicals as well as facilities that 
store or use certain chemicals as part of their daily operations. This 
can include food-manufacturing facilities that use chemicals of 
interest in the manufacturing process, universities that use chemicals 
to do experiments, or warehouses that store ammonium nitrate, among 
others.
---------------------------------------------------------------------------
    In August 2013, we testified about the ammonium nitrate explosion 
at the chemical facility in West, Texas, in the context of our past 
CFATS work. Among other things, the hearing focused on whether the 
West, Texas, facility should have reported its holdings to ISCD given 
the amount of ammonium nitrate at the facility. During this hearing, 
the Director of the CFATS program remarked that throughout the 
existence of CFATS, DHS had undertaken and continued to support 
outreach and industry engagement to ensure that facilities comply with 
their reporting requirements. However, the Director stated that the 
CFATS regulated community is large and always changing and DHS relies 
on facilities to meet their reporting obligations under CFATS. At the 
same hearing, a representative of the American Chemistry Council 
testified that the West, Texas, facility could be considered an 
``outlier'' chemical facility, that is, a facility that stores or 
distributes chemical-related products, but is not part of the 
established chemical industry. Preliminary findings of the CSB 
investigation of the West, Texas, incident showed that although certain 
Federal agencies that regulate chemical facilities may have interacted 
with the facility, the ammonium nitrate at the West, Texas, facility 
was not covered by these programs. For example, according to the 
findings, the Environmental Protection Agency's (EPA) Risk Management 
Program, which deals with the accidental release of hazardous 
substances, covers the accidental release of ammonia, but not ammonium 
nitrate.\10\ As a result, the facility's consequence analysis 
considered only the possibility of an ammonia leak and not an explosion 
of ammonium nitrate.
---------------------------------------------------------------------------
    \10\ See 40 C.F.R.  68.130.
---------------------------------------------------------------------------
    On August 1, 2013, the same day as the hearing, the President 
issued Executive Order 13650--Improving Chemical Facility Safety and 
Security, which was intended to improve chemical facility safety and 
security in coordination with owners and operators.\11\ The Executive 
Order established a Chemical Facility Safety and Security Working 
Group, composed of representatives from DHS; EPA; and the Departments 
of Justice, Agriculture, Labor, and Transportation, and directed the 
working group to identify ways to improve coordination with State and 
local partners; enhance Federal agency coordination and information 
sharing; modernize policies, regulations, and standards; and work with 
stakeholders to identify best practices. In February 2014, DHS 
officials told us that the working group has taken actions in the areas 
described in the Executive Order. For example, according to DHS 
officials, the working group has held listening sessions and webinars 
to increase stakeholder input, explored ways to share CFATS data with 
State and local partners to increase coordination, and launched a pilot 
program in New York and New Jersey aimed at increasing Federal 
coordination and information sharing. DHS officials also said that the 
working group is exploring ways to better share information so that 
Federal and State agencies can identify non-compliant chemical 
facilities and identify options to improve chemical facility risk 
management. This would include considering options to improve the safe 
and secure storage, handling, and sale of ammonium nitrate.
---------------------------------------------------------------------------
    \11\ Exec. Order No. 13,650, 78 Fed. Reg. 48,029 (Aug. 1, 2013).
---------------------------------------------------------------------------
Assessing Risk and Prioritizing Facilities
    DHS has also begun to take actions to enhance its ability to assess 
risk and prioritize facilities covered by the program.
    For the second step of the CFATS process, facilities that possess 
any of the 322 chemicals of interest at levels at or above the 
screening threshold quantity must first submit data to ISCD via an on-
line tool called a Top-Screen.\12\ ISCD uses the data submitted in 
facilities' Top-Screens to make an assessment as to whether facilities 
are covered under the program. If DHS determines that they are covered 
by CFATS, facilities are to then submit data via another on-line tool, 
called a security vulnerability assessment, so that ISCD can further 
assess their risk and prioritize the covered facilities.\13\ ISCD uses 
a risk assessment approach to develop risk scores to assign chemical 
facilities to one of four final tiers. Facilities placed in one of 
these tiers (tier 1, 2, 3, or 4) are considered to be high-risk, with 
tier 1 facilities considered to be the highest risk.\14\ The risk score 
is intended to be derived from estimates of consequence (the adverse 
effects of a successful attack), threat (the likelihood of an attack), 
and vulnerability (the likelihood of a successful attack, given an 
attempt). ISCD's risk assessment approach is composed of three models, 
each based on a particular security issue: (1) Release, (2) theft or 
diversion, and (3) sabotage, depending on the type of risk associated 
with the 322 chemicals. Once ISCD estimates a risk score based on these 
models, it assigns the facility to a final tier.
---------------------------------------------------------------------------
    \12\ 6 C.F.R.  27.200(b)(2).
    \13\ 6 C.F.R.  27.215, .220.
    \14\ 6 C.F.R.  27.220.
---------------------------------------------------------------------------
    Our prior work showed that the CFATS program was using an 
incomplete risk assessment approach to assign chemical facilities to a 
final tier. Specifically, in April 2013, we reported that the approach 
ISCD used to assess risk and make decisions to place facilities in 
final tiers did not consider all of the elements of consequence, 
threat, and vulnerability associated with a terrorist attack involving 
certain chemicals. For example, the risk assessment approach was based 
primarily on consequences arising from human casualties, but did not 
consider economic criticality consequences, as called for by the 2009 
National Infrastructure Protection Plan (NIPP)\15\ and the CFATS 
regulation.\16\ In April 2013, we reported that ISCD officials told us 
that, at the inception of the CFATS program, they did not have the 
capability to collect or process all of the economic data needed to 
calculate the associated risks and they were not positioned to gather 
all of the data needed. They said that they collected basic economic 
data as part of the initial screening process; however, they would need 
to modify the current tool to collect more sufficient data. We also 
found that the risk assessment approach did not consider threat for 
approximately 90 percent of tiered facilities. Moreover, for the 
facilities that were tiered using threat considerations, ISCD was using 
5-year-old data. We also found that ISCD's risk assessment approach was 
not consistent with the NIPP because it did not consider vulnerability 
when developing risk scores. When assessing facility risk, ISCD's risk 
assessment approach treated every facility as equally vulnerable to a 
terrorist attack regardless of location and on-site security. As a 
result, in April 2013 we recommended that ISCD enhance its risk 
assessment approach to incorporate all elements of risk and conduct a 
peer review after doing so.
---------------------------------------------------------------------------
    \15\ DHS, National Infrastructure Protection Plan (Washington, DC: 
June 2006). The NIPP sets forth the risk management framework for the 
protection and resilience of the Nation's critical infrastructure. DHS 
updated the NIPP in January 2009 to include resiliency. See DHS, 
National Infrastructure Protection Plan, Partnering to Enhance 
Protection and Resiliency (Washington, DC: January 2009). Broadly 
defined, risk management is a process that helps policymakers assess 
risk, strategically allocate finite resources, and take actions under 
conditions of uncertainty. DHS further updated the NIPP, which is now 
called the National Plan, in December 2013. See DHS, NIPP 2013, 
Partnering for Critical Infrastructure Security and Resilience 
(Washington, DC: December 2013).
    \16\ The CFATS regulation states that chemical facilities covered 
by the rule are those that present a high risk of significant adverse 
consequences for human life or health, or critical economic assets, 
among other things, if subjected to terrorist attack, compromise, 
infiltration, or exploitation. 6 C.F.R.  27.105, .205.
---------------------------------------------------------------------------
    ISCD agreed with our recommendations, and in February 2014, ISCD 
officials told us that they were taking steps to address them and 
recommendations of a recently-released Homeland Security Studies and 
Analysis Institute (HSSAI) report that examined the CFATS risk 
assessment model.\17\ As with the findings in our report, HSSAI found, 
among other things, that the CFATS risk assessment model inconsistently 
considers risks across different scenarios and that the model does not 
adequately treat facility vulnerability. Overall, HSSAI recommended 
that ISCD revise the current risk-tiering model and create a standing 
advisory committee--with membership drawn from Government, expert 
communities, and stakeholder groups--to advise DHS on significant 
changes to the methodology.
---------------------------------------------------------------------------
    \17\ Homeland Security Studies and Analysis Institute, CFATS 
Tiering Methodology Peer Review (For Official Use Only) (Falls Church, 
Virginia: October 2013). The Homeland Security Studies and Analysis 
Institute, operated by Analytic Services Inc. on behalf of DHS, is a 
Federally-funded research and development center providing independent 
analyses of homeland security issues.
---------------------------------------------------------------------------
    In February 2014, senior ISCD officials told us that they have 
developed an implementation plan that outlines how they plan to modify 
the risk assessment approach to better include all elements of risk 
while incorporating our findings and recommendations and those of 
HSSAI. Moreover, these officials stated that they have completed 
significant work with Sandia National Laboratory with the goal of 
including economic consequences into their risk tiering approach. They 
said that the final results of this effort to include economic 
consequences will be available in the summer of 2014. With regard to 
threat and vulnerability, ISCD officials said that they have been 
working with multiple DHS components and agencies, including the 
Transportation Security Administration and the Coast Guard, to see how 
they consider threat and vulnerability in their risk assessment models. 
ISCD officials said that they anticipate that the changes to the risk 
tiering approach should be completed within the next 12 to 18 months. 
We plan to verify this information as part of our recommendation 
follow-up process.
Reviewing of Facilities' Security Plans
    DHS has begun to take action to lessen the time it takes to review 
site security plans which could help DHS reduce the backlog of plans 
awaiting review.
    For the third step of the CFATS process, ISCD is to review facility 
security plans and their procedures for securing these facilities. 
Under the CFATS rule, once a facility is assigned a final tier, it is 
to submit a site security plan or participate in an alternative 
security program in lieu of a site security plan. The security plan is 
to describe security measures to be taken and how such measures are to 
address applicable risk-based performance standards.\18\ After ISCD 
receives the site security plan, the plan is reviewed using teams of 
ISCD employees (i.e., physical, cyber, chemical, and policy 
specialists), contractors, and ISCD inspectors. If ISCD finds that the 
requirements are satisfied, ISCD issues a letter of authorization to 
the facility. After ISCD issues a letter of authorization to the 
facility, ISCD is to then inspect the facility to determine if the 
security measures implemented at the site comply with the facility's 
authorized plan. If ISCD determines that the site security plan is in 
compliance with the CFATS regulation, ISCD approves the site security 
plan, and issues a letter of approval to the facility, and the facility 
is to implement the approved site security plan.
---------------------------------------------------------------------------
    \18\ 6 C.F.R.  27.225.
---------------------------------------------------------------------------
    In April 2013, we reported that it could take another 7 to 9 years 
before ISCD would be able to complete reviews of the approximately 
3,120 plans in its queue at that time. As a result, we estimated that 
the CFATS regulatory regime, including compliance inspections 
(discussed in the next section), would likely not be implemented for 8 
to 10 years. We also noted in April 2013 that ISCD had revised its 
process for reviewing facilities' site security plans. ISCD officials 
stated that they viewed ISCD's revised process to be an improvement 
because, among other things, teams of experts reviewed parts of the 
plans simultaneously rather than sequentially, as had occurred in the 
past. In April 2013, ISCD officials said that they were exploring ways 
to expedite the process, such as streamlining inspection requirements.
    In February 2014, ISCD officials told us that they are taking a 
number of actions intended to lessen the time it takes to complete 
reviews of remaining plans including the following:
   Providing updated internal guidance to inspectors and ISCD 
        reviewers;
   Updating the internal case management system;
   Providing updated external guidance to facilities to help 
        them better prepare their site security plans;
   Conducting inspections using one or two inspectors at a time 
        over the course of 1 day, rather than multiple inspectors over 
        the course of several days;
   Conducting pre-inspection calls to the facility to help 
        resolve technical issues before-hand;
   Creating and leveraging the use of corporate inspection 
        documents (i.e., documents for companies that have over 7 
        regulated facilities in the CFATS program);\19\
---------------------------------------------------------------------------
    \19\ According to ISCD officials, these documents would be designed 
to provide examples of standard operating procedures regarding employee 
vetting, chemical handling, or security practices that are standard 
across corporations and that could be placed in a facility's file and 
expedite the inspection process.
---------------------------------------------------------------------------
   Supporting the use of alternative security programs to help 
        clear the backlog of security plans because, according to DHS 
        officials, alternative security plans are easier for some 
        facilities to prepare and use; and,
   Taking steps to streamline and revise some of the on-line 
        data collection tools such as the site security plan to make 
        the process faster.
    It is too soon to tell whether DHS's actions will significantly 
reduce the amount of time needed to resolve the backlog of site 
security plans because these actions have not yet been fully 
implemented.
    In April 2013, we also reported that DHS had not finalized the 
personnel surety aspect of the CFATS program. The CFATS rule includes a 
risk-based performance standard for personnel surety, which is intended 
to provide assurance that facility employees and other individuals with 
access to the facility are properly vetted and cleared for access to 
the facility. In implementing this provision, we reported that DHS 
intended to: (1) Require facilities to perform background checks on and 
ensure appropriate credentials for facility personnel and, as 
appropriate, visitors with unescorted access to restricted areas or 
critical assets, and (2) check for terrorist ties by comparing certain 
employee information with its terrorist screening database. However, as 
of February 2014, DHS had not finalized its information collection 
request that defines how the personal surety aspect of the performance 
standards will be implemented. Thus, DHS is currently approving 
facility security plans conditionally whereby plans are not to be 
finally approved until the personnel surety aspect of the program is 
finalized. According to ISCD officials, once the personal surety 
performance standard is finalized, they plan to reexamine each 
conditionally approved plan. They would then make final approval as 
long as ISCD had assurance that the facility was in compliance with the 
personnel surety performance standard. As an interim step, in February 
2014, DHS published a notice about its Information Collection Request 
(ICR) for personnel surety to gather information and comments prior to 
submitting the ICR to the Office of Management and Budget (OMB) for 
review and clearance.\20\ According to ISCD officials, it is unclear 
when the personnel surety aspect of the CFATS program will be 
finalized.
---------------------------------------------------------------------------
    \20\ 79 Fed. Reg. 6418 (Feb. 3, 2014). DHS previously published a 
notice about the personnel surety ICR on March 22, 2013. 78 Fed. Reg. 
17,680 (March 22, 2013).
---------------------------------------------------------------------------
    During a March 2013 hearing on the CFATS program, industry 
officials discussed using DHS's Transportation Worker Identification 
Credential (TWIC) as one approach for implementing the personal surety 
program. The TWIC, which is also discussed in DHS's ICR, is a biometric 
credential \21\ issued by DHS for maritime workers who require 
unescorted access to secure areas of facilities and vessels regulated 
under the Maritime Transportation Security Act of 2002 (MTSA).\22\ In 
discussing TWIC in the context of CFATS during the August 2013 hearing, 
officials representing some segments of the chemical industry stated 
that they believe that using TWIC would lessen the reporting burden and 
stop facilities from having to submit additional personnel information 
to DHS while maintaining the integrity of the program. In May 2011, and 
May 2013, we reported that the TWIC program has some shortfalls--
including challenges in development, testing, and implementation--that 
may limit its usefulness with regard to the CFATS program.\23\ We 
recommended that DHS take steps to resolve these issues, including 
completing a security assessment that includes addressing internal 
controls weaknesses, among other things. The explanatory statement 
accompanying the Consolidated Appropriations Act, 2014, directed DHS to 
complete the recommended security assessment.\24\ However, as of 
February 2014, DHS had not yet done the assessment, and although DHS 
had taken some steps to conduct an internal control review, it had not 
corrected all the control deficiencies identified in our report.
---------------------------------------------------------------------------
    \21\ A biometric access control system consists of technology that 
determines an individual's identity by detecting and matching unique 
physical or behavioral characteristics, such as fingerprint or voice 
patterns, as a means of verifying personal identity.
    \22\ Pub. L. No. 107-295, 116 Stat. 2064. The TWIC program is 
intended to provide a tamper-resistant biometric credential to maritime 
workers who require unescorted access to secure areas of facilities and 
vessels regulated under the MTSA. TWIC is to enhance the ability of 
MTSA-regulated facility and vessel owners and operators to control 
access to their facilities and verify workers' identities. Under 
current statute and regulation, maritime workers requiring unescorted 
access to secure areas of MTSA-regulated facilities or vessels are 
required to obtain a TWIC, and facility and vessel operators are 
required by regulation to visually inspect each worker's TWIC before 
granting unescorted access. 46 U.S.C.  70105(a); 33 C.F.R.  101.514, 
104.265(c), 105.255(c). Prior to being granted a TWIC, maritime workers 
are required to undergo a background check, known as a security threat 
assessment. See 49 C.F.R  1572.21.
    \23\ GAO, Transportation Worker Identification Credential: Card 
Reader Pilot Results Are Unreliable; Security Benefits Need to Be 
Reassessed, GAO-13-198 (Washington, DC: May 8, 2013); Transportation 
Worker Identification Credential: Internal Control Weaknesses Need to 
Be Corrected to Help Achieve Security Objectives, GAO-11-657 
(Washington, DC: May 10, 2011).
    \24\ Explanatory statement accompanying the Consolidated 
Appropriations Act, 2014, Pub. L. No. 113-76, 128 Stat. 5 (2014).
---------------------------------------------------------------------------
Inspecting to Verify Compliance with Facility Plans
    DHS reports that it has begun to perform compliance inspections at 
regulated facilities. The fourth step in the CFATS process is 
compliance inspections by which ISCD determines if facilities are 
employing the measures described in their site security plans. During 
the August 1, 2013, hearing on the West, Texas, explosion, the Director 
of the CFATS program stated that ISCD planned to begin conducting 
compliance inspections in September 2013 for facilities with approved 
site security plans. The Director further noted that the inspections 
would generally be conducted approximately 1 year after plan approval. 
According to ISCD, as of February 24, 2014, ISCD had conducted 12 
compliance inspections. ISCD officials stated that they have considered 
using third-party non-Governmental inspectors to conduct inspections 
but thus far do not have any plans to do so.
    In closing, we anticipate providing oversight over the issues 
outlined above and look forward to helping this and other committees of 
Congress continue to oversee the CFATS program and DHS's progress in 
implementing this program. Currently, the explanatory statement 
accompanying the Consolidated and Further Continuing Appropriations 
Act, 2013, requires GAO to continue its on-going effort to examine the 
extent to which DHS has made progress and encountered challenges in 
developing CFATS. Additionally, once the CFATS program begins 
performing and completing a sufficient number of compliance 
inspections, we are mandated to review those inspections along with 
various aspects of them.\25\ Moreover, Ranking Member Thompson of the 
Committee on Homeland Security has requested that we examine among 
other things, DHS efforts to assess information on facilities that 
submit data, but that DHS ultimately decides are not to be covered by 
the program.
---------------------------------------------------------------------------
    \25\ Explanatory statement accompanying the Consolidated and 
Further Continuing Appropriations Act, 2013, Pub. L. No. 113-6, 127 
Stat. 198 (2013).
---------------------------------------------------------------------------
    Chairman Meehan, Ranking Member Clarke, and Members of the 
subcommittee, this completes my prepared statement. I would be happy to 
respond to any questions you may have at this time.

    Mr. Meehan. I thank you, Mr. Caldwell, and I thank you and 
your colleagues in the GAO for the extensive work that you do. 
You perform a great service to those of us in Congress in 
helping us to get to, you know, an objective assessment of 
where things are and many challenging areas. Thank you for your 
continuing service.
    Last, I would like to recognize the gentlelady from the 
inspector general's office, Ms. Hodges.

 STATEMENT OF MARCIA MOXEY HODGES, CHIEF INSPECTOR, OFFICE OF 
    INSPECTOR GENERAL, U.S. DEPARTMENT OF HOMELAND SECURITY

    Ms. Hodges. Good morning, Chairman Meehan, Ranking Member 
Clarke, and Members of the subcommittee.
    In response to the leaked memorandum in December 2011, we 
were requested by the former subcommittee Chairman, Chairman 
Lungren, to look at the issues that were identified in that 
leaked memorandum. In April 2012, we were also asked by Member 
Waxman of the House Committee on Energy and Commerce to look at 
the issues that were identified in that leaked memorandum.
    In March 2013, we issued our report, ``The Effectiveness of 
the Infrastructure Security Compliance Division's Management 
Practices to Implement the Chemical Facility Anti-Terrorism 
Standards Program.'' We had three objectives: Whether 
management controls were in place and operational to ensure the 
CFATS program was not mismanaged; whether leadership 
misrepresented program progress; and whether nonconforming 
opinions of personnel had been suppressed or met with 
retaliation. The scope of that review covered the CFATS 
implementation all the way through October 2012.
    We determined that ISCD needs to improve program-related 
tools and processes, reduce its reliance on contractors, 
eliminate program waste and duplication, follow proper hiring 
practices, and provide sufficient training to all CFATS 
personnel.
    When Congress granted DHS the authority to regulate high-
risk chemical facilities, it required an interim final rule to 
be issued within 6 months. While DHS met that deadline, there 
appeared to be confusion within ISCD about the 6-month 
requirement. Some employees interpreted that statute as a 
mandate to stand up and implement the CFATS program within 6 
months.
    Misinterpretations of Congressional intent may have put 
unnecessary pressure on ISCD to develop and implement the 
program, resulting in poor management oversight and internal 
control, personnel issues, and missed milestones. In our 
report, we made 24 recommendations to correct these 
deficiencies.
    When the inspector general issues a report, we go through a 
resolution process on open recommendations, and this procedure 
requires us to perform an analysis of any and all documentation 
and corrective action that has been presented by the Department 
to determine whether this information meets the intent of a 
recommendation. This process is repeated in 90-day intervals 
until all report recommendations are closed.
    Currently, this report has 12 open recommendations, and 12 
are closed. Since we issued the report back in March of last 
year, ISCD has provided our office with correction plan updates 
regarding the progress it has made to address those 
recommendations. Of the nine administrative recommendations 
closed, these include selecting permanent ISCD leadership and 
communicating organizational--and the structure of the staff, 
reducing reliance on contractors, ensuring that proper human 
resources, policies, and procedures are followed, reiterating 
the process of reporting misconduct allegations, implementing a 
plan to ensure long-term CFATS authorization, and establishing 
internal controls for appropriated funds.
    We also closed three programmatic recommendations that 
concern revising the review process to reduce the site security 
plan backlog, implementing a process to improve the timeliness 
of facilities' submission determinations, and metrics that 
measure CFATS's value accurately and demonstrate the extent to 
which risk has been reduced at regulated facilities.
    To close these, NPPD provided our office with evidence 
showing a reduction in the site security plan backlog for all 
tiers, improved response time to facility submissions, 
performance metrics were placed into its annual operating plan, 
as well as the Government Performance and Results Act measures.
    Despite this progress, program challenges remain. Before 
CFATS can attain intended program results, ISCD needs to 
address the opening remaining 12 recommendations. These 
recommendations include improving program tools and processes, 
engaging regulated industry and Government partners, finalizing 
program requirements, providing training and guidance, and 
eliminating inappropriate administratively uncontrollable 
overtime pay.
    This concludes my remarks. Thank you for the opportunity to 
testify. I welcome any questions that the Chairman or the 
subcommittee Members may have.
    [The prepared statement of Ms. Hodges follows:]
               Prepared Statement of Marcia Moxey Hodges
                           February 27, 2014
    Good morning, Chairman Meehan, Ranking Member Clarke, and Members 
of the subcommittee. Thank you for the opportunity to testify on The 
Chemical Facility Anti-Terrorism Standards Authorization and 
Accountability Act of 2014.
    In December 2011, a limited distribution internal memorandum, 
prepared by Infrastructure Security Compliance Division (ISCD) 
management, was leaked to news media. The document disclosed 
allegations of employee misconduct and inadequate performance, as well 
as misuse of funds and ineffective hiring within the Department of 
Homeland Security's (DHS) Chemical Facility Anti-Terrorism Standards 
(CFATS) Program. In February 2012, former Chairman Lungren, of the 
House Committee on Homeland Security, Subcommittee on Cybersecurity, 
Infrastructure Protection, and Security Technologies, requested that we 
review these issues. In April 2012, Ranking Member Waxman, of the House 
Committee on Energy and Commerce, also requested that we review the 
challenges facing this program.
    In March 2013, we issued a report, Effectiveness of the 
Infrastructure Security Compliance Division's Management Practices to 
Implement the Chemical Facility Anti-Terrorism Standards Program, OIG-
13-55. We reviewed whether: (1) Management controls are in place and 
operational to ensure that the CFATS Program is not mismanaged; (2) 
National Protection and Programs Directorate (NPPD) and ISCD leadership 
misrepresented program progress; and (3) nonconforming opinions of 
program personnel have been suppressed or met with retaliation.
    ISCD addressed some issues contained in the December 2011 
memorandum; however, challenges remain. For example, we determined ISCD 
needs to improve program-related tools and processes, reduce its 
reliance on contractors, eliminate program waste and duplication, 
follow proper hiring practices, and provide sufficient training to 
personnel at all CFATS Program levels. When Congress granted DHS the 
authority to regulate high-risk chemical facilities, it required that 
an interim final rule be issued within 6 months. While DHS met this 
deadline when it published the CFATS Interim Final Rule in April 2007, 
there appeared to be confusion throughout ISCD about the 6-month 
requirement.\1\ Some ISCD employees interpreted the statute as a 
mandate to stand up and implement the CFATS Program within 6 months. 
Misinterpretations of Congressional intent may have put unnecessary 
pressure on ISCD to develop and implement the CFATS Program, resulting 
in poor management oversight and internal controls, personnel issues, 
and missed milestones.
---------------------------------------------------------------------------
    \1\ Chemical Facility Anti-Terrorism Standards; Interim Final Rule, 
72 FR 17688, April 9, 2007.
---------------------------------------------------------------------------
    In our March 2013 report, we made 24 recommendations to correct 
program deficiencies and attain intended program results and outcomes. 
After a report is issued, OIG standard operating procedures require 
that we perform analyses of all documentation submitted by the 
Department to determine whether proposed corrective actions meet the 
intent of a recommendation. Corrective action plans are due 90 days 
after a report is issued. Recommendation status is defined as 
``unresolved or resolved'' and ``open or closed.'' An unresolved 
recommendation means the corrective action plan does not meet the 
intent of the recommendation. A recommendation that is resolved and 
open means the corrective action plan meets the recommendation's 
intent, but additional measures and milestones are necessary before the 
recommendation can be closed. A recommendation that is resolved and 
closed means the corrective action plan meets the recommendation's 
intent, corrective action has occurred, and no additional reporting is 
necessary. However, based on the recommendation, final implementation 
of the corrective action may not be required to close a recommendation. 
This process is repeated every 90 days until all report recommendations 
are closed. Currently, 12 report recommendations are resolved and open, 
and 12 recommendations are closed.
    Since we issued the report, ISCD has provided our office with two 
corrective action plan updates regarding its progress toward addressing 
the report recommendations. The nine administrative recommendations 
closed include: Selecting permanent ISCD leadership; reducing reliance 
on contract personnel; developing policy for appointing acting 
management; ensuring that all employees serving in an acting 
supervisory capacity have a supervisory position description; ensuring 
that all employees receive performance reviews; disseminating ISCD 
organizational and reporting structure to staff; reiterating to all 
employees the process for reporting misconduct allegations; 
implementing a plan to ensure the long-term authorization of the CFATS 
Program; and establishing internal controls for the accountability of 
appropriated funds.
    We have also closed three programmatic recommendations pertaining 
to: Revising the long-term review process to reduce the Site Security 
Plan backlog; implementing a process to improve the timeliness of 
facility submission determinations; and program metrics that measure 
CFATS Program value accurately and demonstrate the extent to which risk 
has been reduced at regulated facilities. To close these programmatic 
recommendations, NPPD provided our office with evidence showing a 
reduction in the Site Security Plan backlog for all tiers, improved 
ISCD response times to facility submissions, and performance metrics 
incorporated into ISCD's Annual Operating Plan and Government 
Performance and Results Act measure. Despite this progress, 
programmatic challenges remain.
    Before CFATS can attain intended program results, ISCD must address 
the remaining 12 resolved and open recommendations. The ten resolved 
and open programmatic recommendations, which are 1, 2, 4, 6, 7, 8, 9, 
12, 13, and 24, include: Improving CFATS Program tools and processes; 
engaging regulated industry and Government partners; and finalizing 
program requirements. The two resolved and open administrative 
recommendations, which are 15 and 19, include: Providing training and 
guidance; and eliminating inappropriate Administratively Uncontrollable 
Overtime pay.
    Most industry officials believe the CFATS regulation is sound and 
the performance-based philosophy is appropriate. However, ISCD needs to 
modify its Chemical Security Assessment Tool (CSAT) to make it more 
efficient, effective, and easier to use. For example, the Site Security 
Plan is a list of yes or no questions; it is not a security plan and is 
of limited use to facilities. We recommended that ISCD modify the CSAT 
to capture facility data efficiently and ensure the tools provide 
meaningful end products for industry users and ISCD. In its November 
2013 corrective action plan update, NPPD provided some of the key 
milestones and target dates for modifying the CSAT. We will close this 
recommendation once we receive documentation confirming NPPD has 
completed deploying the modified CSAT.
    As ISCD addresses its Site Security Plan backlog, those facilities 
with approved plans will need inspection. However, when we issued our 
report in March 2013 ISCD had yet to define, develop, and implement 
processes and procedures for Compliance Inspections, or train CFATS 
personnel to conduct Compliance Inspections. In response to our 
recommendation, ISCD developed a Standard Operating Procedure for 
inspections of CFATS Covered Facilities, which defines the different 
types of inspections, enumerates roles and responsibilities related to 
inspections, and details processes and procedures for pre-inspection, 
inspection, and post-inspection activities. ISCD has completed its 
Compliance Inspection guidance and training materials, but this 
recommendation will remain open until ISCD has trained all Chemical 
Security Inspectors.
    Chemical facilities must resubmit a Top-Screen when there are 
changes to the use and quantities of certain chemicals of interest, 
referred to in the CFATS regulation as material modifications and 
changes in ownership.\2\ The regulation also requires resubmission of 
Top-Screens, Security Vulnerability Assessments, and Site Security 
Plans at 2 or 3 year intervals, depending on a facility's tier level. 
In addition, a facility may seek a redetermination of its tier level by 
filing a request with DHS' Assistant Secretary for Infrastructure 
Protection. We recommended that ISCD develop a strategy and implement a 
plan to address facility resubmissions and requests for redetermination 
as prescribed in the CFATS regulation. In its November 2013 update, 
NPPD officials provided some of the key milestones for finalizing the 
procedures and policies associated with receiving, reviewing, and 
responding to facility resubmissions and requests for redetermination. 
The recommendation will remain open pending our receipt of the approved 
final procedures for receiving, reviewing, and responding to facility 
resubmissions and requests for redetermination.
---------------------------------------------------------------------------
    \2\ Ibid.
---------------------------------------------------------------------------
    The CFATS tiering engines were created quickly, leaving limited 
time for quality assurance and internal control. Since December 2009, 
multiple errors in the data and formulas used to tier chemical 
facilities have been identified. Because concerns remained that the 
tiering methodology was still flawed, we recommended that ISCD develop 
a methodology and reporting process to identify and address errors and 
anomalies that arise in the CFATS tiering methodology and risk engine. 
In its November 2013 corrective action plan update, ISCD officials said 
they are undertaking a three-phased approach to review the tiering 
process and indicated that ISCD would be developing a formalized 
process for documenting, reporting, and resolving potential anomalies 
within the risk engine. This recommendation will remain open pending 
our receipt of the finalized process. As the three-phased approach 
includes an external peer review, we also recommended that ISCD provide 
us with the review results and ISCD's action plan to implement peer 
review recommendations. ISCD has received the final peer review report, 
and is developing an action plan with time frames to address the 
recommendations. This recommendation will remain open pending our 
receipt of the integrated plan with time frames and milestones for 
addressing the peer review recommendations.
    Industry representatives favorably view some DHS' Infrastructure 
Protection voluntary programs, and recommend these programs be used to 
assist the CFATS Program. For example, the Protective Security Advisor 
Program has a field cadre that specializes in public and private 
outreach, and activities to reduce security risks of critical 
infrastructure and key resources across all sectors. In addition, many 
industry members use the Voluntary Chemical Assessment Tool, which 
allows owners/operators to identify current facility risk levels using 
an all-hazards approach, and it also facilitates a cost-benefit 
analysis. However, since CFATS Program development, management 
separated the Infrastructure Protection voluntary and regulatory 
programs, impeding ISCD's ability to identify and apply best practices 
across programs. We recommended ISCD document engagement with 
Infrastructure Protection and DHS regulatory and voluntary programs to 
identify and implement existing tools and processes that can be 
leveraged to make Top-Screen, Security Vulnerability Assessments, and 
the Site Security Plan tools more efficient, effective, and easier to 
use for the CFATS Program. In its November 2013 update, NPPD provided 
examples of collaboration since the inception of ISCD. The examples 
NPPD provided demonstrate collaboration; however, these examples 
pertain to the initial CFATS tools and processes development, not 
current efforts to modify existing program areas. This recommendation 
will remain open pending the receipt of documentation demonstrating 
continued engagement between Infrastructure Protection and DHS 
regulatory and voluntary programs has resulted in tangible improvements 
to the Top-Screen, Security Vulnerability Assessments, and the Site 
Security Plan tools.
    The regulated chemical industry has embraced the Risk-Based 
Performance Standards approach and the flexibility it allows. However, 
challenges remain with CSAT tools, and limited feedback is provided to 
facilities following submissions of Security Vulnerability Assessments 
and Site Security Plans. While the industry has applauded ISCD 
leadership for identifying programmatic issues, additional efforts are 
necessary. Industry officials support the CFATS Program, but without a 
clear path forward, they are concerned about industry resources and 
funds spent to meet program requirements. As a result, we recommended 
that ISCD improve the clarity of guidance provided to the CFATS-
regulated industry so that industry can benefit from regular and timely 
comments on facility submissions. In its November 2013 corrective 
action plan update, NPPD officials reiterated that as part of its 
efforts to improve the CSAT, ISCD intends to update guidance materials 
for the Top-Screen, Security Vulnerability Assessment, and Site 
Security Plan. ISCD is also in the process of developing updated 
guidance related to its Chemical-terrorism Vulnerability Information 
program, and intends to release guidance specific to the CFATS 
Personnel Surety Program when the CFATS Personnel Surety Program is 
launched. The recommendation will remain open pending our receipt of 
guidance materials for the Top-Screen, Security Vulnerability 
Assessment, Site Security Plan, Chemical-terrorism Vulnerability 
Information program, and the CFATS Personnel Surety Program.
    Risk-Based Performance Standards-12, Personnel Surety, requires 
regulated facilities to perform background checks and ensure 
credentials for facility personnel, and for unescorted visitors with 
access to restricted areas or critical assets. This includes measures 
designed to: (1) Verify and validate identity; (2) check criminal 
history; (3) verify and validate legal authorization to work; and (4) 
identify people with terrorist ties. Since April 2010, NPPD has paid 
DHS' Transportation Security Administration (TSA) more than $7.7 
million to conduct vetting against the terrorist watch list, although 
no names have been vetted to date. Providing names to TSA for vetting 
is contingent on the Office of Management and Budget's (OMB) approval 
of the program's Information Collection Request. As a result, we 
recommended that ISCD limit funding for Personnel Surety Program 
vetting until the Information Collection Request has been approved. 
Since our review, NPPD will only allocate funding to TSA when deemed 
appropriate given all relevant factors. NPPD has also submitted the 
Information Collection Request necessary to move the Personnel Surety 
Program forward. We acknowledge that Information Collection Request 
approval rests with OMB, and this recommendation will remain open until 
documentation is received that the Information Collection Request has 
been approved by OMB and names have been sent to TSA for vetting.
    In December 2007, Congress directed NPPD to provide a plan to 
regulate the sale and transfer of ammonium nitrate by an ammonium 
nitrate facility to prevent the misappropriation or use of the chemical 
in an act of terrorism. However, as of March 2013, the Ammonium Nitrate 
Program was only in the rulemaking process. As a result, we recommended 
that ISCD develop an action plan and guidance for implementing the 
Ammonium Nitrate Program, which incorporates lessons learned from CFATS 
Program challenges. In its November 2013 corrective action plan update, 
NPPD officials said they have been working to develop a final rule, an 
action plan, and guidance for implementing the final rule. The 
recommendation will remain open pending our receipt of quarterly status 
updates of the Ammonium Nitrate Security Program Action Plan until all 
items on the plan have been implemented. In addition, ISCD is moving 
forward with a dual-functioning inspector cadre and will be hiring 
inspectors for the Ammonium Nitrate Program and cross-training them on 
the CFATS Program. We recommended that ISCD develop and implement a 
curriculum and time line for training inspectors to perform both 
Ammonium Nitrate and CFATS Program duties and responsibilities. NPPD 
provided a copy of the ISCD New Chemical Security Inspector Training 
Work Plan and copies of training materials for courses identified in 
the Work Plan. However, this material does not include necessary 
training for the proposed dual-functioning Ammonium Nitrate Security 
Program inspector cadre. Therefore, the recommendation will remain open 
pending our receipt of training curriculum and implementation data for 
dual-functioning inspectors.
    When establishing the CFATS Program, ISCD leadership envisioned an 
academy to train Chemical Security Inspectors to enforce the CFATS 
regulation. However, ISCD began training personnel before issuing the 
CFATS Interim Final Rule, developing a program vision, or defining 
inspector roles and responsibilities. In addition, by focusing training 
efforts on Chemical Security Inspectors, ISCD has provided limited 
guidance to headquarters staff on responsibilities and career 
development. Most headquarters staff do not have formalized training, 
and frequently have to learn critical position duties and functions on 
the job with little guidance. We recommended that ISCD develop and 
implement a learning curriculum that: (1) Describes position roles and 
responsibilities clearly; (2) provides comprehensive training plans to 
prepare employees to perform assigned duties; and (3) communicates 
measures to assess performance. In its November 2013 corrective action 
plan update, NPPD officials said that ISCD has completed a Strategic 
Human Capital and Training Plan, delivered Performance Management 
Training to all personnel, and is developing an ISCD Employee Handbook. 
The recommendation will remain open pending our receipt of 
documentation that the ISCD Employee Handbook has been developed and 
disseminated to all ISCD employees.
    Since its inception in 2007, ISCD has struggled with applying sound 
Government practices to human capital issues, pay administration, and 
resource allocation. ISCD personnel received inappropriate 
Administratively Uncontrollable Overtime, which is a form of premium 
pay used to compensate employees who occupy positions that require 
substantial amounts of irregular and unscheduled overtime work. We were 
unable to determine a definitive rationale for why inspectors were 
receiving Administratively Uncontrollable Overtime and recommended that 
ISCD eliminate its authorization and payment for all ISCD personnel. In 
its November 2013 update, NPPD officials said that instead of 
eliminating Administratively Uncontrollable Overtime, ISCD leadership 
has determined that the more appropriate path is to continue to permit 
CFATS Chemical Security Inspectors to claim Administratively 
Uncontrollable Overtime in a manner that is consistent with rules and 
regulations, and that is supported by greater oversight, increased 
training, documented policies and procedures, and greater management 
controls.
    We consider NPPD's actions partially responsive to our 
recommendation. Administratively Uncontrollable Overtime is a form of 
premium pay used to compensate employees who occupy positions that 
require substantial amounts of irregular, unscheduled overtime work 
that cannot be controlled administratively and cannot be scheduled in 
advance of the work week. According to the Interim Final Rule, the 
Department will conduct audits and inspections at reasonable times and 
in a reasonable manner, providing covered facility owners and operators 
with advance notice before inspections, with limited exceptions. 
Therefore, inspectors schedule their work in advance, eliminating the 
need for Administratively Uncontrollable Overtime. The recommendation 
will remain open pending our receipt and analysis of documentation that 
demonstrate Administratively Uncontrollable Overtime payments to 
inspectors are supported and justified by current and long-term 
activities across multiple fiscal years.
    Chairman Meehan, this concludes my prepared remarks. I welcome any 
questions that you or the Members of the committee may have.

    Mr. Meehan. I thank each of the panelists for their 
testimony. Thank you, Ms. Hodges. I now recognize myself for 5 
minutes of questions.
    Ms. Durkovich, let me begin with you, because you have 
been, along with Director Wulf, sort-of the closest to this 
process, as we have moved along. This has certainly been 
tenuous, from the legacy, some of which has been inherited, and 
we are dealing with a regulated community that has made 
significant investment over time. We are also dealing with 
outliers that are out there, watching this process, and using 
their assessments of it to determine how they may or may not 
act in accordance with the requirements of our program.
    So will you please discuss for me your assessment of what 
it means to have certainty in a program of this sort?
    Ms. Durkovich. Thank you very much, Chairman, and that is a 
great question. As the Secretary said yesterday, DHS supports a 
bill that provides long-term authorization. We firmly believe 
that H.R. 4007 is an important starting point. We look forward 
to working with you to continue to refine the bill, and as you 
know, we hope to actually get longer-term authorization, 
anywhere from 3 to 5 years, because it is important both for 
our regulated community, industry that in addition to having 
invested the time that they have over the last 7 years to 
submit Top-Screens, to do security vulnerability assessments, 
to work with us on authorization of those SSPs, to begin 
implementing the recommended path forward, and as we come back 
and begin compliance inspection, the investments and time and 
resources--and certainly as they look to the capital planning 
process--to begin to implement some of these recommended 
measures, the certainty is important for them, so as they make 
these investments, they know that the program is going to be 
around.
    As for outliers, for those facilities that have chosen for 
whatever reason not to comply with their requirement to submit 
Top-Screens if they may have one of the 324 possible chemicals 
of interest, this will prevent them from waiting the program 
out. It is certainly, I think, fair to say that there are some 
facilities out there that may be waiting to see whether the 
program is around next year. If we are able to guarantee 
longer-term authorization, I think that that position of 
waiting us out will likely dissipate.
    I do agree with you, sir, that I think that it is--we owe 
it to the American people, but we also owe it to our 
stakeholders and we owe it to the men and women of ISCD to give 
this program long-term or permanent authorization. Thank you.
    Mr. Meehan. We are talking long-term. We are talking not 
just the--where we go into the future, but where we have been. 
We have had a complex process. There has been pain associated 
with taking, first, the identification, but simply the 
winnowing down and to a point in which we have been able to 
significantly identify--albeit we have outliers--but 
significantly identify numbers of people we have had 
significant collaboration and cooperation from industry 
themselves that are looking for more in the way of an ability 
to contribute to moving forward.
    Now, we are also appreciative that there are a lot of 
questions that are being asked in the aftermath of West, Texas, 
and the reality that there are, you know, outliers who are out 
there, but there are also efforts to include a great number of 
more agencies and others to be involved in this process.
    My first question for you is: Do you see anything mutually 
exclusive? The importance of us taking this objective, which we 
had, which was to identify where we needed to secure dangerous 
chemicals from access to those who would want to use them to 
commit acts of terrorism, and that was our focus, and we have 
made significant progress towards that.
    Would it create ambiguity for us now to include a number of 
other considerations that would not just be dealing with 
security, but perhaps questions of safety in the program that 
we have? Are we in any way precluded down the road from 
seriously considering those issues of safety and allowing an 
Executive Order to contribute? But do we have to wait in order 
to authorize--do we have to wait before we authorize this 
program?
    Ms. Durkovich. I want to thank you again for that important 
question. To answer your question directly, I do not think that 
they are mutually exclusive. What our priority is, is to ensure 
that we do have long-term and permanent authorization, and I 
think that is one of the most important things that we can see 
happen in this particular session of Congress.
    As you know, we are very willing to work with you and our 
colleagues in the Minority to get a bill that has bipartisan 
support, but, really, again, at the end of the day, what we 
need is stability and long-term authorization. I think that as 
we continue to look at some of the findings that are coming out 
of the work that is going on between us, between EPA, between 
OSHA and other members of the interagency, that will present 
other opportunities for us to look at legislation that is 
needed to address some of the issues around operational 
coordination, around information sharing, around ensuring that 
we have compatible sets of data.
    Legislation is certainly one way that we can address some 
of these issues. We can work under existing regulation and 
under existing authority. We can continue just to work better 
together, which we have already done with the EPA, in looking 
at both of our data sets and trying to cross-walk those data 
sets to see where we may have outliers and to send out notices 
to those facilities, letting them know that they may 
potentially be regulated both by our program and by EPA.
    We have had a lot of success on that front. I think that we 
have already demonstrated that we can work together. But the 
most important thing at the end of the day, again, is that we 
provide long-term stability of the program.
    It has been successful, sir. We started with 40,000 
facilities that submitted Top-Screens. Through our process, we 
have whittled that down to nearly 4,000 that are regulated. 
Most of them have SSPs in place. We are working through the 
process of authorizing and improving them and going back and 
doing inspections. I think, at the end of the day, the most 
important thing is long-term authorization.
    Mr. Meehan. I thank you. My time is expired, but I will 
before--Mr. Wulf, you have been intimately involved in this 
process, as well, as we have gone, and I asked that question, 
but you have been here from the beginning of the challenging 
moment of trying to really get our arms around this and improve 
the process. Do you have any observations on the question that 
I asked?
    Mr. Wulf. With regard to whether the Executive Order is 
mutually exclusive to the legislation, I would completely agree 
with the assistant secretary. You know, there is a lot of good 
work being done on the Executive Order. Assistant Secretary 
Durkovich is one of three tri-chairs of that effort.
    But I think the absolute priority for us is achieving long-
term authorization of this program. It is something that will 
provide much-needed certainty for industry as they consider 
long-term investments and important security matters, important 
security measures. From a management standpoint, it will 
provide my leadership team with the stability that is needed to 
plan and execute what are some really game-changing initiatives 
to take CFATS even beyond the next level.
    So we are doing a lot of things to continue to increase the 
pace of SSP reviews, authorization inspections, and approvals. 
We are getting into the regular cycle of compliance inspection 
activity. You know, the ability to have a long-term 
authorization would be tremendous from the standpoint of our 
being able to focus on that critical mission and to be able to 
recruit and retain top talent in the division.
    Mr. Meehan. Thank you, Mr. Wulf.
    The Chairman now recognizes the Ranking Member for her 
questions.
    Ms. Clarke. I thank you, Mr. Chairman.
    My first question is to you, Ms. Durkovich. I want to echo 
and sort of drill down a little on something Mr. Thompson asked 
earlier in his statement about H.R. 4007. It provides no 
explicit authorization of a specific level of appropriation. So 
would you want a CFATS authorizing bill to identify funding for 
the program's operations? If not, would it create the 
possibility that funding for CFATS be taken from other programs 
within DHS's budget? I might question whether the absence of an 
authorization of appropriations indicates some Congressional 
intent for DHS to provide funding for this program from within 
its current budget.
    Ms. Durkovich. Thank you, Ranking Member Clarke, and thank 
you for that important question. Ensuring that we have adequate 
funding for the program has been and remains a priority. We 
certainly appreciate your support in the past and would like to 
work with you to see funding authorized for CFATS in 
legislation to ensure that we retain the appropriate levels in 
the future, both as we continue to move the program forward and 
work to implement many of the initiatives under the Executive 
Order.
    Ms. Clarke. So just for clarification, through the 
appropriations process, not from some other means within DHS 
itself?
    Ms. Durkovich. Well, again, we would like to work with you 
to authorize funding through the appropriations process, yes, 
ma'am.
    Ms. Clarke. Got it. Got it, got it. If passed and signed by 
the President, the bill would take effect 30 days after 
enactment. On that day, the existing statutory authority for 
CFATS would be repealed by striking Section 550 from Public Law 
109-295. Thus, the bill creates a free-standing program, apart 
from the original authorizing DHS legislation. Additionally, 
CFATS would terminate or sunset 2 years after the date it would 
take effect.
    Two questions: Would you want CFATS authorizing legislation 
that codified the program in Homeland Security Act of 2002, 
rather than leave the program stand-alone? What would be the 
Department's plan for chemical security in general if Congress 
failed to act if and when CFATS is sunsetted?
    Ms. Durkovich. Thank you very much for that question. It 
certainly does seem appropriate to me that placing a statute 
for the program in the Homeland Security Act is a reasonable 
thing. But, again, our goal, because of the sunsetting of the 
program, is to make sure that we have multi-year or permanent 
authorization, and that is our priority for this session.
    We know that we will be able to work with Chairman Meehan 
and with you, ma'am, I think to get us to a successful outcome 
so we don't have to think about the latter part of your 
question.
    Ms. Clarke. Looking at a stand-alone, but you would like to 
see it comprehensive?
    Ms. Durkovich. If a stand-alone gets us to multi-year or 
permanent authorization, that is our priority. As you know----
    Ms. Clarke. I hear a major emphasis in all of this 
discussion around multi-year, which this bill does not contain. 
So it seems to me that that is a major priority for the 
Department. Is that correct?
    Ms. Durkovich. Yes. We have been clear that, again, while 
we are very supportive of the bill, at the end of the day, we 
would like to see a longer authorization period, either 5 years 
or permanent authorization. Yes, ma'am.
    Ms. Clarke. Okay. Like you, I am supportive of authorizing 
CFATS program in DHS and taking the program off the 
appropriations cycle. That said, I would like to talk through 
the expectations the Department has for such legislation, and I 
just want to get a yes-or-no to each of these questions. Would 
you want it to authorize funding for the program's operations?
    Ms. Durkovich. If that is something that----
    Ms. Clarke. Yes or no. Yes----
    Ms. Durkovich [continuing]. Could be contained in the 
bill----
    Ms. Clarke. Yes or no?
    Ms. Durkovich [continuing]. Yes.
    Ms. Clarke. Yes. Would you want it to reflect the 
forthcoming findings and recommendations from the President's 
Chemical Safety and Security Working Group that DHS is leading?
    Ms. Durkovich. I do not think that it needs to do that, no.
    Ms. Clarke. No? Would you want it to codify the program in 
the Homeland Security Act?
    Ms. Durkovich. That would be a desirable----
    Ms. Clarke. Yes?
    Ms. Durkovich. Yes, ma'am.
    Ms. Clarke. Would you want it to remove the exemptions on 
water facilities and other possible terrorist targets that were 
hastily agreed to in 2006?
    Ms. Durkovich. Again, that is something we would like to 
work with you on, but at the end of the day, what is most 
important----
    Ms. Clarke. Yes, no?
    Ms. Durkovich [continuing.] Is that we get--that is a 
laudable goal, yes, ma'am.
    Ms. Clarke. Yes. You did say yes?
    Ms. Durkovich. Yes.
    Ms. Clarke. That is what I thought. Okay, very well. I 
wanted--Mr. Chairman, my time is----
    Mr. Meehan. You may pursue your questions.
    Ms. Clarke. Thank you. Thank you, Mr. Chairman.
    Ms. Hodges, H.R. 4007 would allow the Secretary to expand 
the CFATS inspector force to include contractors, which begs 
the question as to whether the inspection of chemical 
facilities for possible terroristic vulnerabilities is an 
inherently Governmental responsibility or should be outsourced 
to contractors. In 2007, during comment on the CFATS final 
rule, several stakeholders expressed concerns regarding DHS's 
use of third-party inspectors.
    How would you describe these concerns, including the 
maintenance of confidentiality of facility business 
information, potential variation in training and inspection, 
standards between Federal and third-party inspectors, and DHS 
establishment of qualifications, certification, indemnification 
of third-party inspectors?
    Ms. Hodges. Contractors are used in various components of 
the Department. I think the most important element is the 
decisions being done are applied by Government employees. 
Contractors do serve a very valuable purpose when you have 
limited resources, but ultimately, they may not and should not 
be ever doing anything that would be of a decision-making 
inherently Governmental function.
    Ms. Clarke. So you are saying that if there is a 
supervisory--personnel from a Governmental standpoint, 
basically, overlooking what these contractors would be doing, 
you would feel more comfortable with that, but should 
contractors be in a position to make decisions themselves, that 
would present some discomfort?
    Ms. Hodges. That would get into the area of an inherently 
Governmental function, yes.
    Ms. Clarke. Can you tell me in your opinion if it is 
appropriate for DHS to use third-party auditors and, if so, for 
which tiers of facilities and what the standards and 
requirements would be for those third-party auditors? Who would 
pay for the third-party auditors?
    Ms. Hodges. Right, well, I think that goes back to the 
initial underlying issue here about authorization. Trying to 
make an estimate on resources needed or our contract staff to 
augment the Federal staff is a little bit difficult now, not 
knowing what the on-going appropriation would be for this 
particular program.
    Ms. Clarke. Very well.
    Mr. Chairman, I yield back.
    Mr. Meehan. I thank the gentlelady.
    The Chairman now recognizes the gentleman from 
Pennsylvania, Mr. Perry.
    Mr. Perry. Thank you, Mr. Chairman. Greetings to the panel. 
Thank you for your testimony.
    My questions will be directed to the assistant secretary. 
Madam Secretary, some in Congress and elsewhere have said that 
the CFATS program is not operating efficiently or making 
adequate progress and is in need of a complete overhaul. 
Unfortunately, the individuals that have that opinion are 
waiting for a unilateral overhaul that allows the 
administration to dictate chemical security policy without 
reasonable input from industry. I just listened to some of the 
testimony regarding the backlog and approvals and the 
recommendations, et cetera, and I think it lends itself at 
least a portion to the credibility of that opinion.
    So my questions are as follows: Can you explain to the 
committee how a completed overhaul is not the right approach 
and why waiting for it would make the situation more burdensome 
for the Department and hinder continued progress? Finally, do 
you feel that it is crucial that the industry has substantial 
input into any regulations imposed upon them? If you would 
comment on those two, I would appreciate it.
    Ms. Durkovich. Thank you very much, sir, for that question. 
It is an important question, because I firmly believe we do not 
need a major overhaul of the program. As I noted in my opening 
statement, the program has made this country more secure, and 
we have demonstrated tremendous progress, not only over the 
course of the last 7 years, but certainly over the course of 
the last 2 years.
    We started with over 40,000 facilities that submitted Top-
Screens. Through our process, we now have over 4,000 that are 
regulated in our various stages of having both approved SSPs, 
but now beginning compliance inspections. At every turn, 
Director Wulf is looking at ways to improve the efficiency and 
the effectiveness of the program. We do that in very close 
collaboration with our stakeholders, who have provided 
important input to us on the Alternative Security Program, on 
our tiering methodology, on how to reach outliers, and to 
overhaul the program, again, at a point where we have 
demonstrated success, where we have over 500 SSPs that are 
approved, where we have facilities that are making investments 
and making decisions based on those SSPs again would, I think, 
be unfair both to the industry itself, but also to the men and 
women of ISCD.
    I would like to yield the last 2\1/2\ minutes of my time to 
allow Director Wulf perhaps to speak to a few minutes to that, 
as well.
    Mr. Wulf. I would be glad to. Thank you so much.
    You know, I would add that the core of the CFATS program, 
18 risk-based performance standards, a non-prescriptive program 
that allows for security measures to be tailored to the 
individual needs of our 4,000 regulated facilities, is strong 
and is well-suited to the mission at hand.
    So I would absolutely agree that a major overhaul of the 
program is not needed. The program is moving absolutely in the 
right direction. That is not to say that the regulation is 
perfect or that we won't move forward to try to make some 
tweaks and to further improve the process. Down the road, I 
would anticipate an advanced notice of proposed rulemaking, 
through which we will solicit from our stakeholders across the 
board their thoughts on what can be done to improve the 
program.
    But I would absolutely, you know, want to be clear that the 
core of this program is very strong and well-suited to the 
mission. Appreciate the question.
    Mr. Perry. So the only place that stakeholders will have a 
voice is in the rulemaking or the reform maybe of--or, you 
know, the modification of rules moving forward at this point? 
Is that their place?
    Mr. Wulf. No, we have a continuing dialogue with our 
stakeholders through sector coordinating councils, the chemical 
sector, the oil and natural gas sector, our other stakeholders. 
We are working on a continuing basis to conduct outreach, 
working with the industry associations, including ACC and 
SOCMA, from which you will hear later on during this hearing, 
working together on initiatives to drive the program forward, 
to get the word out, to reach out to facilities that may be in 
the outlier population, to work on efforts such as Alternative 
Security Program templates that can further streamline industry 
members' ability to develop security plans and our ability to 
review, authorize, and approve those plans.
    Mr. Perry. Thank you, Mr. Chairman. I yield back.
    Mr. Meehan. I thank the gentleman.
    The Chairman now recognizes the gentleman from Nevada, Mr. 
Horsford.
    Mr. Horsford. Thank you, Mr. Chairman.
    Ms. Hodges, I want to thank you for coming to testify 
today, and I know that our invitation to you was recent and 
that your report, however, is almost a year old, so I realize 
that the effort that you and your staff had put into the update 
and the review of this report.
    In your 2013 report, you issued 24 recommendations. Since 
that time, we understand that 12 recommendations were closed. 
What does this change in status tell us about the effectiveness 
of the CFATS program to prevent a terrorist incident involving 
a chemical plant?
    Ms. Hodges. Yes, thank you for that question. The change in 
the recommendation status indicates that ISCD is addressing the 
report recommendations to build a basic administrative 
foundation, as well as the core infrastructure to support the 
program.
    While the majority of the closed recommendations involved 
administrative issues that were presented, the majority of the 
unresolved issues have to do with programmatic areas, on-going 
programmatic areas that need to be addressed.
    The program is maturing, but it is not fully operational. 
Even when CFATS becomes fully operational, it can't prevent an 
incident, but what it can do is better prepare industry and 
their facilities to mitigate risk to the incident.
    Mr. Horsford. Okay. So when you assessed DHS's effort to 
implement the CFATS program from inception to the end of fiscal 
year 2012, at the time, among other items, you found that DHS's 
officials' use of, ``confusing terminology'' led to 
misunderstandings of CFATS's program progress. Likewise, we on 
the committee have repeatedly expressed concern in the way that 
NPPD tracks its progress, as it makes it difficult to get to an 
accurate picture of the program.
    Since the release of your program--of your report, excuse 
me, you have made a chance to review the Department's 
materials. Is that correct?
    Ms. Hodges. That is correct.
    Mr. Horsford. What would you say about the quality of 
information that is furnished today by the program and the 
terminology utilized to communicate it?
    Ms. Hodges. I think there has been great strides with their 
annual operating plan. That plan has realistic and thoughtful 
measures. It also has milestones, time frames, and that is a 
really big--from our frame of reference, our fieldwork ended 
back in October 2012. The report was issued in March 2013. From 
where the program was to where they are now, with just the 
foundational documents of having a way forward, that has been a 
big, impressive effort on the part of NPPD and ISCD.
    Mr. Horsford. Do you feel that it is presented in a way 
that is useful for this oversight committee to reach 
conclusions about the efficacy of the program?
    Ms. Hodges. With the time and the distance from our field 
work, we wanted to get the measures in place. We haven't been 
back with the component or with ISCD to look at whether they 
have had results, you know, from those measures. So I would not 
be able to articulate or weigh in if that progress would be 
helpful to the subcommittee and the committee.
    Mr. Horsford. Well, I would see, to the extent we can--I 
mean, my experience here is rather recent, but what I find, Mr. 
Chairman, and to the Ranking Member, is that a lot of times, 
you know, we have these reports and their recommendations and 
conclusions to the agencies, but a lot of time there is not the 
follow-up or the follow-through to help us provide the proper 
guidance and oversight. So that is something that I would be 
interested in as a Member of the subcommittee. Maybe someone 
from the agency can respond. I yield back.
    Mr. Wulf. Yes, I would be glad to, and I appreciate the 
opportunity. Even at the time that the inspector general issued 
its report, many of the recommendations that it made and issues 
it had identified had been previously identified through the 
challenges memo that we prepared in the fall of 2011, and those 
issues had largely been resolved through the implementation of 
the action plan we had put together.
    So we have done a lot of good work putting into place 
important management controls, business practices, streamlining 
processes with respect to the review authorization, inspection 
of facilities, and approval of site security plans. You know, 
acknowledging that the I.G. engagement with our division is 
somewhat dated, you know, I would--I am not sure I would accept 
the premise that our program is not fully operational.
    Every day across America, our inspectors are working 
closely with facilities and working through security measures 
that are fostering security and improving security at America's 
highest-risk chemical infrastructure. So the program is 
absolutely on the move. Since I last testified before this 
committee in August, we have more than tripled our output of 
approved site security plans, more than doubled to more than 
1,100 our output of authorized plans. This program is 
absolutely fully operational, and the pace will only continue 
to increase, and we are certainly committed to continuing to 
work to improve the program going forward.
    Mr. Meehan. I thank the gentleman.
    Mr. Wulf, let me just ask a quick question as a follow-up 
on that. There were 24 recommendations made by the OIG. Twelve 
of those recommendations have been fully closed. Is that not 
correct?
    Mr. Wulf. That is correct. The remaining 12 are noted as 
resolved, but open.
    Mr. Meehan. There are three levels of scrutiny on this, so 
if you had been entirely lacking on those remaining 12, some of 
which, as I have reviewed the report, indicate that there are 
various technical reasons why they may not be, but the bottom 
line is, by having said that they were not yet closed, but you 
are in that middle level of scrutiny, which you have made the 
significant progress, you are pretty close to getting to 
answering the questions of the OIG. Is that not accurate?
    Mr. Wulf. I think that is absolutely correct, sir.
    Mr. Meehan. Do you disagree, Ms. Hodges, or agree?
    Ms. Hodges. I believe that, yes, 12 of the 24 
recommendations are closed. The remaining open recommendations, 
some of them will be more longer-term. When a recommendation is 
indicated as resolved, that means that the inspector general's 
office and the Department have agreed in principle on the way 
forward the action plan, the milestones, the goals.
    Depending on how far we are in achieving those milestones 
and goals and deliverables, we would resolve and close that 
particular recommendation. However, some recommendations 
require a longer period of time to be resolved and then closed.
    Mr. Meehan. Thank you.
    The Chairman recognizes the Ranking Member, Mr. Thompson, 
for questions he may have.
    Mr. Thompson. Thank you very much, Mr. Chairman.
    Ms. Durkovich, a lot has been talked about, about West, 
Texas. Can you tell this committee, since the explosion, that 
those facilities like the one in West, Texas, are now being 
inspected on a regular basis?
    Ms. Durkovich. Thank you for that question. Since West, 
Texas, nearly a year ago, both the Department, but the 
interagency, has undertaken an extraordinary effort to identify 
outliers like West, Texas. We have worked very closely with our 
colleagues at EPA to cross-walk our lists of regulated 
facilities. We are working very closely with State homeland 
security advisers, with State chemists, with State departments 
of agriculture to identify facilities that may not be aware of 
our regulations and/or who may not have decided to comply with 
them.
    We have a number of facilities since our efforts with the 
EPA and to get the word out who have since submitted Top-
Screens. We are in the process of assessing and evaluating 
those Top-Screens to determine which one of those will be given 
a preliminary tier. But the way that our process works, sir, is 
that we are not yet at a point where we are doing inspections, 
but we have certainly undertaken, again, an extraordinary 
effort to identify those outliers and to ensure that they have 
begun the process under CFATS, which begins with a Top-Screen.
    Mr. Thompson. Thank you. So for the sake of the committee, 
can you give us an estimate of how many of those outliers that 
might be out here?
    Ms. Durkovich. I will tell you that as part of our work, we 
sent out--I think it was 3,000 letters to potentially--or to 
facilities that could be potentially regulated under CFATS. 
Those facilities, again, have gone through--or are in process 
of submitting Top-Screens. I am going to defer to Mr. Wulf, but 
I think the number--I will actually let you answer that.
    Mr. Wulf. Absolutely. We have taken in approximately 800 
additional Top-Screen submissions from facilities since we 
started this process, facilities that have threshold holdings 
of high-risk chemicals of interest, beginning the process, then 
as appropriate to go through the security vulnerability 
assessment and sign as appropriate a final tier.
    We found through this that very few of these facilities are 
looking as though they are going to tier into the program. So I 
am pretty confident that we have a good handle on the known 
universe of high-risk chemical facilities as currently defined 
in the United States. Over the course of the program's history, 
we have taken in upwards of 46,000 Top-Screens.
    Mr. Thompson. Right. But what I am trying to get to is--we 
were told that the West, Texas, facility was one of those 
outliers, that there was no review. I am trying to see--you 
said 3,000. Is that the universe to your knowledge?
    Ms. Durkovich. No, go ahead.
    Mr. Wulf. That is the number of facilities that we 
identified through a cross-walk with EPA and subsequently sent 
letters. West, Texas, the West Fertilizer Company did not meet 
its obligation to submit a Top-Screen. That doesn't mean that, 
had it submitted a Top-Screen--and it has subsequently 
submitted a Top-Screen--it would end up as a regulated facility 
under CFATS, that it would be determined to be one of the 
highest risk of a terrorist attack exploitation.
    Mr. Thompson. So at what point would these 3,000 people you 
sent letters to, what is the Department's time table for 
bringing that review to completion?
    Mr. Wulf. It is moving forward right now. I would 
anticipate that the facilities that, you know, have moved 
through and received a preliminary tier, and I believe that is 
only about 40 facilities right now, would be receiving their 
final tier as appropriate, developing their site security plan 
in concert with our physical security specialists and chemical 
security inspectors, and moving through the process of 
authorization, inspection, and approval.
    Mr. Thompson. Well, I guess what I am trying, Mr. Chairman, 
to get to is, if it is 3,000 or the 3,000--is it X number 
that--what is the time table for the agency? You talked about 
it may not be involved for the tiering, but we need assurance 
that these outliers, whether they voluntarily come in or you 
identify them through some other process, that they don't 
endanger the lives and communities just because we didn't know 
they existed.
    Mr. Wulf. Absolutely.
    Mr. Thompson. I am trying to get us to some point of how we 
are going to bring everybody into a system, regardless of where 
they are.
    Ms. Durkovich. So, sir, I think that this is a continuous 
process, frankly. The work that we have done with the EPA to 
cross-walk our list is just one step in the process. But, 
frankly, we will always work very closely not only with the 
major trade associations, again, with State homeland security 
advisers, with State agricultural departments, with State 
chemists. We are working very closely now with smaller State 
associations. Some of these outliers don't always belong to the 
large National associations. We are looking at how through our 
voluntary program, through our protective security adviser 
program, we can utilize those individuals who are--so it is 
going to be an on-going process, sir.
    Mr. Thompson. Well, and I understand that. But, you know, 
the West, Texas, facility was not a new facility. It had been 
there a long time. It had gone through some modifications. So a 
lot of this information and these companies are already there.
    So I am trying to figure out, how did they fall through the 
system to start with?
    Ms. Durkovich. So they--sir, they were in the system. They 
were not necessarily in our system. We have gone through a very 
important process, which is cross-walking our database with the 
EPA's database. That is what resulted in the 3,000 letters that 
we ended up sending out. Part of what we are doing is part of 
the Executive Order----
    Mr. Thompson. Yes.
    Ms. Durkovich. Okay.
    Mr. Thompson. Well, I understand. But if you know there are 
3,000, so you assume these companies will just fill out the 
form and send it back. If you know that 3,000 are there, you do 
not plan to do a physical inspection of the 3,000, just if they 
send it back, fine, if they don't----
    Ms. Durkovich. That is how our process works, yes, sir. 
They submit a Top-Screen, and then based on that Top-Screen and 
the corresponding site--the security vulnerability assessment, 
we then----
    Mr. Thompson. So if they don't submit it, what happens?
    Ms. Durkovich. Then we can issue an administrative order. 
Again, we are going through the process of ensuring that all of 
the people who have received letters, where appropriate, are 
submitting their Top-Screens.
    Because of some of the way the taxonomy of the data is 
structured, a facility that is in an EPA database may be 
identified differently than it is in our database, because we 
look at that long, and they look at addresses, and so we have 
to work through some of that, but there is a process to ensure 
that those need to submit Top-Screens do.
    Mr. Thompson. Mr. Chairman, I hope you can understand the 
need to put some of this under one roof, because there is just 
too much--too many moving parts, and there doesn't appear to be 
one person really in charge. I understand the need to talk, but 
somebody should have the ultimate responsibility. I think the 
public would like to see some entity, DHS or something, in 
charge, and we can talk to other people.
    But if I might ask, Mr. Chairman, that Mr. Wulf or Ms. 
Durkovich provide the committee with the current status of 
those 3,000 facilities that they have identified that are 
outside the system, what kind of time table they are operating 
from to bring them under some kind of review, so we can assure 
the public that a West, Texas-type event, if it happens, we at 
least know the facility is there and that there is some 
regulation being applied to it.
    Ms. Durkovich. We would be happy to do that, sir. Thank 
you.
    Mr. Thompson. Thank you.
    Mr. Meehan. I thank the Ranking Member.
    Let me take a moment just to follow up on a couple of 
questions with regard to that particular issue. We are talking 
about outliers that may or may not be purposefully deciding 
that they don't want to participate, for whatever reason. Is it 
more likely that they will be inclined to participate if, in 
fact, we have an authorized program than whether or not we have 
an ambiguous program about whether it is moving forward or not, 
in your professional opinion?
    Ms. Durkovich. In my professional opinion, it is more 
likely that they will participate, if there is a fully 
authorized program, yes, sir.
    Mr. Meehan. Now, you are also cooperating with other 
members of the industry who are significantly interested in 
working with you, and it is often likely that chemical 
companies who are in possession very infrequently operate 
entirely in isolation. By that I mean they are either selling 
their product to another user or they are purposing component 
chemicals from a user.
    So the privity of relationships with people in the industry 
is well established. So the capacity to identify through other 
members who outliers may be is significantly enhanced when we, 
in fact, have a program which is predictable, dependable, and 
people know that they have made a commitment. Is your 
professional opinion we do better working through industry to 
identify outliers if we had an authorized program?
    Ms. Durkovich. That is my--yes, that is my professional 
opinion. I am happy to let Mr. Wulf just talk a little bit 
about how we are already doing that, but yes.
    Mr. Wulf. Yes, no, I am glad to, and that is absolutely the 
case. We work very well with industry through the National 
associations, through these State-level associations, and 
through the companies that are part of those associations, and 
otherwise, to identify segments of industry that we may need to 
communicate with, working with them to get the word out, you 
know, working together on efforts such as the chemical security 
summit to bring in members of industry and educate them on the 
requirements of the CFATS program and on the availability of 
voluntary programs, as well. So, yes, absolutely would agree 
with that.
    Mr. Meehan. Okay. Well, I thank you. I am aware we have 
another panel to get to, but I want to ask just a few follow-up 
questions and, of course, turn it over to my colleagues to see 
if they have concluding questions for this particular panel.
    But let me just ask Ms. Hodges, as a matter of record, if 
you do know, and I know there have been some questions about 
contract employees. I am referring to the EPA. Are you aware 
that it is their practice to use contract employees for 
inspections and evaluations under such things as the Clean 
Water Act, the Resource Conservation and Recovery Act, the 
Toxic Substances Control Act, the Oil Pollution Act, the Safe 
Drinking Water Act? Are you aware as to the utilization of 
contract employees for those kinds of important programs?
    Ms. Hodges. For the EPA?
    Mr. Meehan. Yes, ma'am.
    Ms. Hodges. No, I am personally not.
    Mr. Meehan. Okay. Okay, well, I will ask that a letter of 
record be submitted, the letter from David Kling, director of 
the Federal Facilities Enforcement Office of the EPA, dated 
November 1. I thank you.
    Without objection, so ordered.
    [The information follows:]
  Memorandum From the Office of Enforcement and Compliance Assurance, 
     United States Environmental Protection Agency, Washington, DC
                              Nov. 1, 2005
                               memorandum
SUBJECT: Use of Contract Inspectors for EPA's Federal Facility 
Compliance Inspections/Evaluations

FROM: David J. Kling, Director, Federal Facilities Enforcement Office 
(2261A)

TO: Regional Federal Facilities Program Managers, Regional Federal 
Facilities Senior Managers

    Since some EPA Regional enforcement and compliance personnel have 
recently raised questions regarding the use of contract inspectors in 
compliance inspections/evaluations of Federal facilities, we are 
writing to confirm that properly trained and authorized contract 
inspectors are appropriate for Federal facility compliance inspections/
evaluations under the Clean Water Act (CWA), the Resource Conservation 
and Recovery Act (RCRA), the Toxic Substances Control Act (TSCA), the 
Oil Pollution Act (OPA) and the Safe Drinking Water Act (SDWA). The 
Federal courts are split as to whether contract inspectors are 
authorized to conduct inspections under the Clean Air Act (CAA), and 
the Federal Insectide, Fungicide and Rodenticide Act's (FIFRA's) 
language limits those who are authorized to conduct inspections.
    Under the CAA, the Courts of Appeals for the Sixth, Ninth, and 
Tenth Circuits have considered the issue of contract inspectors, but 
have reached different conclusions that depend, in part, on the 
specific area being inspected. Without a definitive answer from the 
Supreme Court, we advise that Regions should not use contract 
inspectors for CAA inspections. In the rare circumstance where contract 
inspectors may be needed to conduct a CAA evaluation/inspection, 
written approval for the use of such inspectors must first be granted 
by the Federal Facilities Enforcement Office (FFEO).
    Further, FIFRA's language limits those authorized to conduct 
inspections to ``any officer or employee of the Environmental 
Protection Agency or of any State or political subdivision.'' FIFRA  
9, 7 U.S.C.  136g. Accordingly, we do not advise using contract 
inspectors for FIFRA compliance inspections/evaluations.
    Regional enforcement personnel should reacquaint themselves with 
the requirements for authorizing contractors to conduct inspections. 
These requirements include:
   The inspection contract must contain language per EPA Order 
        3500.1 requiring the contract inspector to meet the training 
        requirements of the Order, including completion ofthe Basic 
        Inspector Course, health and safety training, and medium-
        specific training requirements--prior to leading an inspection.
     Contractors who merely assist, rather than lead, 
            inspections are not required to comply with all of the 
            requirements of EPA Order 3500.1, although meeting the 
            requirements is still recommended. Even if not leading 
            inspections, contract inspectors are obliged to have health 
            and safety training, as specified in EPA Order 1440.3.
   The inspections must be carried out in accordance with 
        approved Quality Assurance/Quality Control plans (that are part 
        of the Regions' Quality Assurance Management Plan) and use 
        established procedures, such as those set forth in EPA's 
        Inspection Manuals.
   Depending on the nature of the inspections to be conducted, 
        a background investigation may be required for contract 
        inspectors. Any background investigation requirements should be 
        included in the contract. Background investigations are 
        especially important in the Federal facilities context--
        particularly at high-risk facilities (e.g., certain military 
        bases, nuclear weapons plants, and Classified facilities).
   A contract inspector may not request or review Confidential 
        Business Information (CBl) unless she or he has been cleared 
        for CBl by EPA under the particular statute for which the 
        authorization is given.
   EPA does not issue the same Federal credential which EPA 
        employees carry to contractors. A few programs issue a statute 
        specific credential authorizing the contractor to carry out 
        inspections under a specific statute. It clearly identifies the 
        bearer as a contractor. In most cases, EPA provides contractors 
        with a letter of authorization. The letter identifies the 
        bearer as a contractor.
    Please note that OECA and OARM are developing an EPA order that 
        addresses the issuance of credentials to Federal employees, 
        State/Tribal government employees, Senior Environmental 
        Employees (SEEs), and contractors.
    Thank you for your interest in this matter and your support for 
using contract inspectors in appropriate circumstances. If you have any 
questions regarding this memorandum, please contact Gracie Garcia in 
OECA's Federal Facilities Enforcement Office or Phyllis Flaherty in 
OECA'S Office of Compliance.
cc (electronic only): Michael S. Alushin, OECA/OC, Kenneth A. 
Gigliello, OECA/OC, Phyllis E. Flaherty, OECA/OC, Sandra L. Connors, 
OECA/FFEO, Bernadette Rappold, OECA/FFEO, Gregory Snyder, OECA/FFEO, 
Gracie Garcia, OECA/FFEO, FFEO Liaisons, Regional Enforcement Division 
Directors, Regional Media Division Directors, Regional Enforcement 
Coordinators.

    Mr. Meehan. Let me just close my comments--my questions. 
Mr. Caldwell, you have done a great deal of oversight in this 
program. I know you are responsible for sort-of looking at the 
activities in response to the directions that have been given 
us, but we are not operating in isolation here. You have also 
been very closely associated with the things that are being 
done to move forward.
    From your position, you have seen this bill. Do you see any 
advantages in it or any of the provisions there that you think 
are helpful?
    Mr. Caldwell [continuing]. Sorry, GAO doesn't have an 
official position on the bill itself, but I can talk about a 
couple of things there. Many of them have been said. I mean, I 
think the multi-year authorization, whether it is 2, 3, 4, 
whatever many years, certainly adds stability to both DHS and 
to industry. I think it also provides some normalcy in terms of 
being an authorized program, whether or not the appropriations 
have been approved or not. As we know from recent years, that 
has not always been a pretty thing.
    The bill codifies some of the activities that are already 
being done in the program, but that also offers some stability 
to industry, because if it is purely something within the 
regulations, the Department in theory could change those quite 
different--you know, could change those quite dramatically. 
Then industry and others, as well as the Department, would have 
to react to that.
    Finally, I think if you look at some of the areas that were 
emphasized in the bill, they certainly are areas where GAO, as 
well as I.G., has pointed out a need for corrective actions and 
emphasis.
    Mr. Meehan. Let me just close by an observation, as well. 
You have watched. We have been through a long history, and one 
of the great frustrations here has been in the past there have 
been requests for responsiveness from DHS with regard to a 
number of matters with Congressional oversight, and your own 
investigations have demonstrated that part of these issues from 
time to time have been related to not just program management 
and other kinds of tools, et cetera, but the overall 
responsiveness, as you have begun, do you believe that you are 
seeing an improvement and important activity along the lines of 
the requests and demands that you have met?
    Mr. Caldwell. Yes, sir. So our first review of CFATS came 
at what might be the low point of the program, when the 
internal memo came out. I think relatively early, when we 
started our work, the top management at NPPD talked to us, 
pledged their commitment to change, as well as the commitment 
from our auditor standpoint, of giving us access to their 
people and documents, which they did. I think since that time, 
we have had very good cooperation in terms of when we have 
actually had an on-going review, getting documents, getting 
access to their people, and reviewing it.
    I would say, we have seen progress since that time, again, 
taking the longer sweep here, in terms of the management 
problems that they have identified. They sit down to track them 
and look at their progress against them. In terms of the 
outlier issue, they are certainly working to match data with 
the other agencies, be it EPA or other ones. Whether that will 
lead to some of the--I am not sure you could prevent all the 
West, Texases, through that process because of the tiering 
process, but at least it is progress in the sense of trying to 
identify them.
    They are speeding up, say, the plan reviews through the 
concurrent review process. They are doing something that used 
to be very sequential and very long to do. I guess maybe the 
biggest thing to GAO--and I would ask Ms. Hodges to comment, if 
she wants to, as well, is I think they are certainly interested 
in any suggestions and recommendations that we have, and there 
is an effort certainly to implement those, sir.
    Mr. Meehan. Ms. Hodges, do you have a comment?
    Ms. Hodges. I do believe that the component has been 
responsive to our follow-up for recommendations and 
documentation, yes.
    Mr. Meehan. Thank you. I turn it to the Ranking Member. Do 
you have any closing questions for the panel?
    Ms. Clarke. I do, Mr. Chairman, but just to put in 
perspective the agencies and the letter that you have submitted 
for the record, those agencies don't have the mandate of 
preventing terrorism. I think that that is the distinction that 
we are talking about with these contractors that we really need 
to make sure we hold fast to.
    Ms. Durkovich, ISCD has on a number of occasions testified 
that the agency is willing to accept any vetting program for 
the Department as an alternative to the PSP under CFATS. 
However, I understand that ISCD does not intend to accept these 
alternative vetting programs without preconditions. Most 
recently, Congress addressed this issue in the fiscal year 2014 
omnibus appropriations bill, but I would like to get the 
Department's most recent views on the PSP issues.
    Ms. Durkovich. Thank you very much. I appreciate the 
opportunity to address this great question.
    The personnel surety program under CFATS presents a 
standard that I think that any prudent company isn't already 
doing or shouldn't be doing. It requires that those companies 
verify the identity of new personnel, that they conduct a 
criminal or a background check, and that they verify that they 
are legal to work.
    For those personnel with access to restricted areas or 
critical assets, as you have mentioned, since this program does 
have a terror--a mandate for terrorism, we are requiring a 
check against the TSDB, the Terrorist Screening Database. We 
have outlined a number of different options that will allow 
facilities to do that, and the information collection request 
that is out right now is part of the basic tenets of our 
program. We allow flexibility and options for companies. We 
can't mandate requirements or prescribe requirements.
    As part of personnel surety and the check against this 
Terrorist Screening Database, we are allowing for other 
credentials to be used. However, what we want to ensure is that 
we have the ability to verify the validity of those credentials 
and to ensure in the intervening period since they have been 
issued that that individual has not committed a crime or has 
for some reason not ended up on the Terrorist Screening 
Database.
    That is the intent of the program, is, again, to verify 
that the individual who will have access to those restricted 
areas and to those critical assets is not on the TSDB. So, yes, 
we are giving companies the option to leverage existing 
credential programs, but, again, we want to verify the validity 
of those credentials to ensure that, again, in the intervening 
time since they have been issued, for some reason, that 
individual has not committed a crime or has not ended up on the 
screening--Terrorist Screening Database.
    Ms. Clarke. What is the process for verification? Is 
there----
    Ms. Durkovich. There are a number of different ways. 
Specific to the credential, through our CFATS tool, they can 
enter their name, their date of birth, and the credential 
number, and that will do a quick verification----
    Ms. Clarke. So is it sort of a self-verifying----
    Ms. Durkovich. No, no, no. No. Either the facility or a 
third party does the verification, but it is--again, either 
through the database or they can do a swipe with a TWIC reader 
card, for example.
    Ms. Clarke. Very well.
    Mr. Chairman, I yield back. Thank you.
    Mr. Meehan. I thank the Ranking Member. I thank each of the 
witnesses, not just for your testimony today, but for the long 
work each of you in your various capacities have given to the 
oversight and continuing progress of this program. I thank you.
    The Members may have additional questions, and if they are 
submitted to you at some point in time, I would ask that you 
respond in writing. Thank you. The panel is dismissed. The 
clerk will prepare the witness table for the second panel.
    I want to welcome our panel. Before I recognize the panel, 
I am going to ask unanimous consent that a letter in support of 
H.R. 4007 that has been signed by 24 industry associations be 
entered into the record.
    Without objection, that will be so ordered.
    [The information follows:]
                Letter Submitted by Hon. Patrick Meehan
                                  February 7, 2014.
The Honorable Michael McCaul (R-TX),
Chairman, U.S. House of Representatives, Committee on Homeland 
        Security, H2-176 Ford House Office Building, Washington, DC 
        20515.
The Honorable Bennie Thompson (D-MS),
Ranking Member, U.S. House of Representatives, Committee on Homeland 
        Security, H2-176 Ford House Office Building, Washington, DC 
        20515.
The Honorable Patrick Meehan (R-PA),
Chairman, U.S. House of Representatives, Subcommittee on Cybersecurity, 
        Infrastructure Protection, and Security Technologies, H2-117 
        Ford House Office Building, Washington, DC 20515.
The Honorable Yvette Clarke (D-NY),
Ranking Member, U.S. House of Representatives, Subcommittee on 
        Cybersecurity, Infrastructure Protection, and Security 
        Technologies, H2-117 Ford House Office Building, Washington, DC 
        20515.
    Dear Chairman McCaul, Ranking Member Thompson, Chairman Meehan, and 
Ranking Member Clarke: We, the undersigned organizations would like to 
express our support for H.R. 4007, the CFATS Authorization and 
Accountability Act of 2014, a streamlined bill that provides a 2-year 
authorization of the Chemical Facility Anti-Terrorism Standards (CFATS) 
program and guidance to the Department of Homeland Security (DHS) on 
key issues of chemical facility security.
    The bill addresses several important policy goals. First, it 
provides a multi-year authorization to allow DHS to confidently 
implement CFATS and industry to make important investments with the 
certainty that goes along with knowing the program will be authorized. 
The current practice of year-to-year extensions, or worse, short-term 
continuing resolutions through the appropriations process is a 
destabilizing force in the implementation and investment process.
    Secondly, the legislation also addresses some of the major 
impediments to completing site security plans and full implementation 
of the program. It addresses certain concerns surrounding the personnel 
surety requirements needed for access; gives covered facilities the 
ability to meet site security plans through alternate security plans 
approved by DHS and an option to use third parties as inspectors; 
improves Congressional oversight regarding the tiering methodology; and 
ensures better coordination with State and local officials.
    We recognize the complexities in implementing a program like CFATS 
and are fully aware of some of the flaws in management exposed over the 
past few years. This multi-year authorization will give DHS the time 
and stability it needs to improve its implementation, but at the same 
time, will ensure that Congress has the ability to monitor the program 
and make any necessary changes to it before the next authorization.
    The organizations and companies listed below represent thousands of 
American businesses that employ millions of American workers. We are 
manufacturers, producers, processors, distributors, transporters, and 
retailers in agriculture, chemistry, energy, forest products, food 
processing, medicine, and other businesses that form our Nation's 
infrastructure. We support H.R. 4007, and urge you to quickly consider 
and pass this important legislation.
    Thank you for your timely consideration.
            Sincerely,
Agricultural Retailers Association, American Chemistry Council, 
American Coatings Association, American Forest & Paper Association, 
American Fuel and Petrochemical Manufacturers, American Petroleum 
Institute, American Trucking Associations, Association of Oil Pipe 
Lines, Edison Electric Institute, Global Cold Chain Alliance, Institute 
of Makers of Explosives, International Association of Refrigerated 
Warehouses, International Dairy Foods Association, International Liquid 
Terminals Association, International Warehouse Logistics Association, 
National Agricultural Aviation Association, National Association of 
Chemical Distributors, National Association of Manufacturers, National 
Mining Association, National Pest Management Association, Petroleum 
Marketers Association of America, Society of Chemical Manufacturers & 
Affiliates, The Fertilizer Institute, U.S. Chamber of Commerce.

    Mr. Meehan. I want to thank our second panel for your 
presence here today and for your willingness to help us draw 
light on this very, very important issue. In order of 
appearance, Mr. Clyde Miller is the director of corporate 
security at BASF Corporation. In this capacity, Mr. Miller is 
responsible for critical security initiatives both at the 
corporate level and at BASF production sites across North 
America, which include the execution of a crisis management and 
response plan, CFATS compliance, and company-wide security 
initiatives. In addition, Mr. Miller has served as the chair of 
the Chemical Sector Coordinating Council, chair of the 
Partnership for Critical Infrastructure Protection, and is 
currently the incoming vice chair of the American Chemistry 
Council's Security Committee.
    Ms. Kate Hampford Donahue is the president of Hampford 
Research, a specialty chemical manufacturer serving Fortune 500 
companies in the electronics, dental, personal care, printing, 
and adhesive markets. In addition, Ms. Donahue's company is a 
member of the board of governors of the Society of Chemical 
Manufacturers and Affiliates. This association supports the 
industry with programs that maximize commercial and networking 
opportunities to increase public confidence and to influence 
the passage of rational laws and regulations.
    We are joined by Ms. Anna Fendley, who represents the 
Health, Safety, and Environmental Department of the United 
Steelworkers of America. USW is North America's largest 
industrial union, representing 850,000 workers across a diverse 
range of industries, including the majority of unionized 
workers in the chemical industry and workplace that use and 
store large quantities of industrial chemicals.
    I may add for the record, I am quite pleased to have good 
relationships with the many fine workers in the refineries in 
the southeastern Pennsylvania portion that I am able to 
represent, and I thank you for being here today.
    In fact, I thank each of you. Your full written statements 
will be entered into the record. You may give your verbal 
testimony, and I am going to ask that you do your best to try 
to keep it within the 5-minute time limit.
    So right now, the Chairman recognizes Mr. Miller for his 
testimony.

STATEMENT OF CLYDE D. MILLER, DIRECTOR FOR CORPORATE SECURITY, 
  BASF NORTH AMERICA, INCOMING VICE CHAIR, AMERICAN CHEMISTRY 
                   COUNCIL SECURITY COMMITTEE

    Mr. Miller. Thank you, Chairman Meehan, and good morning, 
Ranking Member Clarke and Members of the committee.
    I am the director of corporate security for BASF 
Corporation, and I think it speaks to the importance of this 
legislation that we had both Chairman McCaul and Ranking Member 
Thompson from the full committee in the hearing this morning to 
speak to this legislation.
    I am here today on behalf of BASF and the American 
Chemistry Council. As you have pointed out, I am responsible 
for all the security functions at our chemical facilities at 
BASF in North America, as well as the implementation of the 
Chemical Facility Anti-Terrorism Standards, or CFATS.
    For BASF and the chemical industry as a whole, security is 
an important aspect of our operations, and there is no greater 
priority than the safety and security of our employees and the 
communities that surround our sites. I appreciate the 
opportunity to appear this morning to provide feedback on the 
legislation being considered.
    To that end, in addition to my written comments, I would 
like to emphasize the following points. First of all, we 
support moving the CFATS regulation from an appropriations 
process to an authorization process. This bill for the most 
part codifies what is in the original 2006 spending bill, which 
established the Nation's first comprehensive chemical facility 
security regulation.
    Like the original bill, it is short and to the point and 
validates the original premise of risk-based performance model 
focusing on security. The bill does not try to reinvent the 
wheel or add complexity to the program, which seemed to doom 
previous attempts at long-term authorizations. Instead, this 
bill has some narrow fixes in a few areas, such as offering 
options to comply with the personnel surety performance 
standard. It also reiterates a part of the original regulation, 
requiring DHS to use threat, vulnerability, and consequence for 
assessing risk, which they had not been doing.
    I look at CFATS as an essay test rather than a multiple-
choice or fill-in-the-blank exam. Due to the CFATS security 
regulation being a collection of performance standards, a 
facility can implement a solution that draws from all available 
options to meet those standards tailored to address the unique 
needs of that site.
    To effectively comply with CFATS, an essay of measures has 
to be implemented. This can be perimeter-related, as well as 
other security measures, combined with operating measures such 
as process cameras and alarms. The totality or the essay 
becomes the regulation with which the facility complies. A 
long-term authorized regulation provides industry with the 
confidence to make long-term capital investments and having the 
certainty, and having that certainty, by the way, helps DHS and 
recruiting and retaining top talent to effectively oversee the 
regulation.
    Second, we support the implementation of the overarching 
findings and recommendations of the peer review panel in the 
manner mentioned in the bill. The peer review panel was 
established last year by DHS to study the methodology they use 
to tier facilities covered under CFATS. This effort resulted in 
a report setting out key findings and overarching 
recommendations to improve the consistency and transparency of 
the process. As a member of that panel, it is gratifying to see 
that the bill requires DHS to report on the progress and 
implementation of those recommendations.
    Third, Director Wulf and his team have done a tremendous 
job of turning CFATS around and moving toward an effective 
chemical facility security program. Since Mr. Wulf and his 
management team arrived, significant progress has been made in 
carrying out CFATS. For example, to streamline the process, 
they embraced the American Chemistry Council's alternate 
security plan template and are actually working with other 
stakeholders to develop similar plans.
    They significantly increased the number of approved site 
security plans and the pace of inspections without impacting 
the effectiveness of the program. BASF sites have gone through 
these authorization inspections, and I can assure you that the 
heightened pace has not reduced their effectiveness or 
compromised CFATS. Mr. Wulf and his team have also undertaken 
efforts to better identify facilities that should have 
submitted Top-Screens, but failed to do so, by coordinating 
with other agencies to identify those outliers.
    Finally, the passage of this bill by no means conflicts 
with the Executive Order 13650. If anything, it will add to 
enhancing and strengthening security throughout the sector, one 
of the goals of the EO. DHS is undertaking many of the 
activities being considered under the Executive Order. Passage 
of this bill would only complement those efforts and give CFATS 
the permanency it needs so that it does not risk lapsing as 
occurred during the Government shutdown last year.
    To summarize, CFATS has had a positive impact on enhancing 
security at U.S. chemical sites, and we support making it 
permanent. It is a robust program requiring companies to 
continually monitor their operations to ensure compliance. In 
some cases, facilities have evaluated their processes and 
security programs and have taken measures to reduce their risk 
and actually dropped out of CFATS.
    Before CFATS, BASF already had a fairly comprehensive and 
effective security program. However, for our facilities under 
the CFATS regulation, we have increased capital spending and 
operating cost to ensure that we meet or exceed the performance 
standards set out in the regulation.
    A long-term authorization with Congressional oversight will 
provide the regulatory certainty and operational stability to 
give the industry confidence that our long-term capital 
commitments to this program are appropriate. To try to reinvent 
CFATS by passing more comprehensive legislation, I am afraid, 
will have a significantly negative impact. We pledge our 
continued support as this legislation moves forward and to 
continuing to work in partnership with you and your staff. 
Thank you again for the opportunity to testify in support of 
this bill and to highlight improvements by DHS.
    I will be glad to answer any questions you may have.
    [The prepared statement of Mr. Miller follows:]
                 Prepared Statement of Clyde D. Miller
                           February 27, 2014
    Good morning, Chairman Meehan, Ranking Member Clarke, and Members 
of the committee. My name is Clyde Miller, and I am the director of 
corporate security for BASF Corporation. I am here today on behalf of 
BASF and the American Chemistry Council.
    At BASF, I am responsible for all of the security functions at our 
chemical facilities in North America and for the implementation of the 
Chemical Facility Anti-Terrorism Standards, or CFATS, at our facilities 
in the United States. I have been directly involved in that effort 
since CFATS' inception. Last year, I was asked to serve on the 
Department of Homeland Security (DHS)-commissioned Peer Review Panel 
analyzing the CFATS risk assessment methodology that was conducted by 
the Homeland Security Studies and Analysis Institute. For BASF and the 
chemical industry as a whole, security is an important aspect of our 
operations and there is no greater priority than the safety and 
security of our employees and the communities that surround our sites.
    I appreciate the opportunity to appear here this morning to provide 
feedback on the Chemical Facility Anti-Terrorism Standards Program 
Authorization and Accountability Act of 2014. To that end, I would like 
to emphasize the following points in my remarks:
   ONE.--We support moving the CFATS regulation from an 
        appropriations process to an authorization process.
   TWO.--We support the implementation of the overarching 
        findings and recommendations of the Peer Review Panel, in the 
        manner mentioned in this bill.
   THREE.--Dave Wulf and his team have done a tremendous job of 
        turning the CFATS program around and moving toward an effective 
        chemical facility security program.
   FOUR.--The passage of this bill by no means conflicts with 
        Executive Order 13650. If anything, it will add to enhancing 
        and strengthening security throughout the sector--one of the 
        goals of the EO.
    Now, I would like to elaborate on these points.
I. We support moving the CFATS program from an appropriations process 
        to an authorization process.
    This bill, for the most part, codifies what is in the original 2006 
spending bill, which established the Nation's first comprehensive 
chemical facility security regulation. Like the original bill, it is 
short and to the point and validates the original premise of 
establishing a risk-based performance model for enhancing chemical 
facility security across the Nation.
    I look at CFATS as an essay test rather than a multiple choice or 
fill-in-the-blank exam. Due to the CFATS security regulation being a 
collection of performance standards, a facility can implement a 
solution that draws from all available options to meet those standards. 
And since not all facilities are the same, plans can also be tailored 
to address the unique needs of individual sites. To effectively comply 
with CFATS, an ``essay'' of measures has to be implemented. This can be 
perimeter-related measures as well as other security measures, combined 
with operating measures such as process cameras and alarms. The 
totality, or ``essay,'' becomes the regulation with which the facility 
complies and is given a pass or no-pass grade when undergoing a 
compliance inspection by DHS. A long-term authorized regulation 
provides industry with the confidence to make long-term capital 
investments. Further, having that certainty helps DHS in recruiting and 
retaining top talent to effectively oversee the regulation.
    The bill does not try to reinvent the wheel or add complexity to 
the program, which seemed to doom previous attempts at long-term 
authorizations. Instead, this bill has some narrow fixes in a few areas 
that need to be addressed, such as a simplified Alternative Security 
Program, similar to that used by the U.S. Coast Guard under the 
Maritime Transportation Security Act, implementation of third-party 
inspectors and some simplified solutions to the personnel surety 
program. Concerning the Personnel Surety Program, the bill requires DHS 
to accept other well-established Federal credentials that currently 
continually vet their holders against the Terrorist Screening Database 
with no further obligation required of the facility.
    This bill reiterates a part of the original regulation, using 
threat, vulnerability, and consequence for assessing risk, which DHS 
had not been doing, as we discovered during the previously-mentioned 
peer review process. The Peer Review Panel recommended DHS evaluate all 
three elements to fully assess risk, which is also required by the 
National Infrastructure Protection Program of 2009 and 2013. Finally, 
the bill sets up an oversight process to ensure the program continues 
to make improvements and establishes accountability by setting a time 
line for the Secretary of DHS to report to Congress on its progress 
with implementation of recommendations made by the Peer Review Panel.
II. We support the implementation of the overarching findings and 
        recommendations of the Peer Review Panel, in the manner 
        mentioned in this bill.
    A peer review panel was established last year by the Homeland 
Security Studies and Analysis Institute to study the methodology used 
by DHS to tier facilities covered under CFATS. This panel was made up 
of subject-matter experts covering 15 areas of expertise, including 
industrial security, risk analysis, toxicology, process safety, 
infrastructure security, and other pertinent areas. This effort 
resulted in a report setting out key findings and over-arching 
recommendations. As a member of that panel, it is gratifying to see 
that the effort is mentioned in this bill and requires DHS to report on 
the progress in implementation of those recommendations.
III. Since Dave Wulf and his team have arrived at DHS; they have done a 
        tremendous job of turning around the program and moving CFATS 
        toward an effective chemical facility security program.
    First, recognizing that the Chemical Security Assessment Tool 
(CSAT) process could be streamlined, they embraced the American 
Chemistry Council's Alternative Security Plan (ASP) template, which 
provides an alternate path for developing and submitting site security 
plans.
    Second, they significantly increased the number of approved site 
security plans, having recently passed the 500th approved security 
plan.
    Third, they have greatly increased the pace of inspections, up to 
100 inspections per month. They have completed nearly all of the Tier 1 
and 2 high-risk facilities and have started reaching into the Tier 3 
and Tier 4 sites. BASF has had sites that have gone through these 
authorization inspections and I can assure you that the heightened pace 
has not reduced their effectiveness or compromised the program.
    Fourth, they recognized that implementing a new regulatory program 
required significant outreach to the regulated community. As a result, 
they have enhanced their outreach efforts, engaging with industry via 
sector councils and other means. They've increased the number of 
Compliance Assistance Visits and inspectors regularly participate in 
introductory meetings with owners and operators of CFATS-regulated or 
potentially-regulated facilities.
    Finally, DHS has undertaken efforts to better identify ``outlier'' 
facilities that should have submitted Top-Screens but have failed to do 
so by coordinating with other agencies such as EPA, the U.S. Coast 
Guard, and State and local authorities.
IV. The passage of this bill by no means conflicts with Executive Order 
        13650. If anything, it will add to enhancing and strengthening 
        security throughout the sector--one of the goals of the EO.
     As just mentioned, DHS is undertaking many of the activities being 
considered under the Executive Order. Passage of this bill will allow 
DHS to increase these activities that go to the heart of their 
mission--ensuring chemical facility security throughout the sector. It 
is precisely these efforts, without any changes to the program that 
might hamper efficiency or speed, that the EO--and Congress--should be 
encouraging and supporting. Passing this bill will give the program the 
permanency it needs so that it does not risk lapsing as occurred during 
the Government shutdown last year.
                               conclusion
    CFATS has had a positive impact on enhancing security at U.S. 
chemical sites, and we support making this a permanent program for the 
approximately 4,500 sites that are regulated under CFATS. It is a 
robust program, for example at BASF we already had a fairly 
comprehensive and effective security program. However, for facilities 
under the CFATS regulation, we have seen increased capital spending and 
operating costs to ensure we meet or exceed the performance standards 
set out in the regulation.
    In complying with CFATS facilities have evaluated their processes 
and security programs and in some cases taken measures to reduce their 
risk and dropped out of the program. The previously-mentioned Peer 
Review made recommendations to make some process changes to make the 
program more transparent and consistent. To try to reinvent CFATS by 
passing more comprehensive legislation, I'm afraid, would have a 
significantly negative impact on the program.
    Congressional oversight via authorization would help DHS continue 
to address some of the challenges they have faced implementing the 
program, even as the agency has made progress with a new management 
team. The industry has seen considerable increased activity from DHS, 
including improved quality of inspections and faster authorizations. 
Most importantly, DHS leadership has demonstrated a commitment to 
working with stakeholders to improve the implementation of the CFATS 
program. A long-term authorization will provide the regulatory 
certainty and operational stability to give the industry confidence 
that our long-term capital commitments to this program are appropriate, 
and provide a stronger foundation for the overall success of the 
program.
    We support and share in your efforts to provide a long-term 
authorization for CFATS. We pledge our continued support as this 
legislation moves forward, and look forward to continuing to work in 
partnership with you and your staff as this process moves forward. 
Thank you again for the opportunity to testify in support of this bill. 
I'll be glad to answer any questions you may have.

    Mr. Meehan. Thank you, Mr. Miller.
    The Chairman now recognizes Ms. Hampford Donahue.

    STATEMENT OF KATE HAMPFORD DONAHUE, PRESIDENT, HAMPFORD 
  RESEARCH, INC., AND MEMBER, BOARD OF GOVERNORS, SOCIETY OF 
         CHEMICAL MANUFACTURERS AND AFFILIATES (SOCMA)

    Ms. Hampford Donahue. Good afternoon, Chairman Meehan, 
Ranking Member Clarke, and Members of the subcommittee. My name 
is Kate Hampford Donahue, and I am president of Hampford 
Research, a specialty chemical manufacturer located in 
Stratford, Connecticut. We are a second-generation family-owned 
business with 30 employees.
    We supply complex compounds to Fortune 500 companies 
serving the electronics, personal care, printing and 
lithography, and industrial adhesives industries. Some of our 
customers are chemical giants, and some are high-tech firms 
that develop and use engineered materials, but who lack the 
ability or desire to manufacture those materials themselves.
    Hampford Research is a member of the Society of Chemical 
Manufacturers and Affiliates, or SOCMA, where I also serve on 
the board of governors. SOCMA has been and continues to be the 
leading trade association representing the batch, custom, and 
specialty chemical industry. I am proud today to provide 
testimony on behalf of SOCMA in support of H.R. 4007, the CFATS 
Authorization and Accountability Act of 2014.
    SOCMA strongly supports the CFATS program and is wholly 
supportive of H.R. 4007. The program requires chemical 
facilities Nation-wide, including mine, to develop security 
enhancements. It protects facilities against attack without 
impairing the industry's ability to remain innovative. Hampford 
Research takes the security of our facilities and our products 
very seriously, as it does the safety of our employees and our 
communities. We have literally bought into this program.
    We received notice last year that our final CFATS 
authorization inspection was scheduled for October 1. We 
prepared as thoroughly as possible for the audit, but then our 
inspection was delayed due to the Government shutdown. To make 
matters worse, during the shutdown, we learned that the 
legislative authorization for the CFATS program had expired.
    These are the kinds of disruptions and regulatory 
uncertainty that Congress should do its best to avoid. Even 
under ideal circumstances, it costs companies, especially small 
businesses, time and money to plan for, pay for, prepare for, 
and clear days off calendars for multiple employees to comply 
with the full scope of the program. Responsible companies like 
Hampford want the CFATS program, but we want a stable and 
predictable one.
    In our re-scheduled final authorization inspection, we had 
two inspectors who were knowledgeable, professional, courteous, 
and practical. They engaged us in a real dialogue during the 
inspection and continued that dialogue after they left. Their 
focus was on creating layers of deterrent. They offered lots of 
suggestions on options we might consider, but were clear that 
we were the experts on our facility and only we could create a 
plan that would work for us.
    They were very responsive to follow-up questions from us, 
as well. In addition, the entire process, from the time when we 
were inspected on October 23 until we got final approval for 
our plan just February 14 last week was extremely timely and 
efficient.
    The CFATS program went through a difficult period, but we 
believe that our positive experience is an example of the 
broader success story that the CFATS program has become. For 
its part, DHS is making good progress in implementing the 
reforms identified by Deputy Director David Wulf. SOCMA 
applauds the work of Mr. Wulf and his team. We also thank him 
for his quick response in developing a resource at SOCMA's 
request called ``What to Expect from the Inspectors,'' that 
will explain what companies should anticipate for final 
authorization. This is a great example of chemical companies 
wanting to do the right thing and DHS working well with them 
for compliance. We are meeting mutual goals.
    CFATS is reducing risk in a market-based way. Over 3,000 
facilities have changed processes or inventories in ways to 
screen out of the program. CFATS is driving facilities to 
reduce inherent hazards, relying not on regulatory mandates, 
but on the company's expert judgment to do so where it makes 
sense, where it can be done without reducing product quality or 
transferring risk to some other point in the supply chain.
    The CFATS program is working, but would help my company and 
others like it if Congress could ensure CFATS's continued 
stability through a longer-term authorization like H.R. 4007. 
This bill codifies what was in the original 2006 spending bill 
and removes the program from annual funding fire drills. This 
bill also makes a few fixes in areas where legislative change 
could improve the program, including allowing facilities the 
flexibility in satisfying their obligation to help screen 
employees and visitors for terrorist ties if the facilities 
rely on Federal credentials that are vetted against the 
Terrorist Screening Database.
    H.R. 4007 is a simple bill and a strong solution to help 
DHS and facilities like mine concentrate on implementing the 
CFATS regulations without worrying about the future of the 
program. It would help me and my 30 employees of Hampford 
Research significantly.
    The chemical sector is united in support of this bill. Per 
his testimony before the full committee in this room yesterday, 
Secretary Jeh Johnson supports it, as well. Thank you very much 
for this opportunity to testify, and I look forward to your 
questions.
    [The prepared statement of Ms. Hampford Donahue follows:]
              Prepared Statement of Kate Hampford Donahue
                           February 27, 2014
    Good morning Chairman Meehan, Ranking Member Clarke, and Members of 
the subcommittee. My name is Kate Hampford Donahue and I am the 
president of Hampford Research, Inc., a specialty chemical manufacturer 
headquartered in Stratford, Connecticut. We are a second-generation, 
family-owned business with 30 employees. We supply high-purity, complex 
compounds to Fortune 500 companies serving the electronics, dental, 
personal care, printing & lithography, and industrial adhesives 
industries. Some of our customers are chemical giants, and some are 
high-tech firms that develop and use engineered materials but lack the 
ability or desire to manufacture those materials themselves. Hampford 
Research is a member of the Society of Chemical Manufacturers and 
Affiliates, or SOCMA, where I also serve on the board of governors.
    For 90 years, SOCMA has been and continues to be the leading trade 
association representing the batch, custom, and specialty chemical 
industry. SOCMA's 220-plus member companies employ more than 100,000 
workers across the country and produce some 50,000 products--valued at 
$60 billion annually--that help make our standard of living possible. 
Over 80% of SOCMA's members are small businesses and many are covered 
by the CFATS program. I am proud today to provide testimony on behalf 
of SOCMA in support of H.R. 4007, The CFATS Authorization and 
Accountability Act of 2014.
    SOCMA strongly supports the CFATS program and is wholly supportive 
of H.R. 4007. The program requires chemical facilities Nation-wide, 
including mine, to develop security enhancements. Its performance-based 
approach protects facilities against attack without impairing the 
industry's ability to remain innovative and to maintain some of the 
Nation's highest-paying manufacturing jobs. Like most other specialty 
chemical manufacturers covered by CFATS in our industry, Hampford 
Research takes the security of our facilities and our products very 
seriously, as it does the safety of our employees and communities. We 
have quite literally ``bought in'' to the program.
    We received notice last year that our final CFATS authorization 
inspection was scheduled for October. We prepared as thoroughly as 
possible for compliance--but then our inspection was delayed, due to 
the Government shutdown in October. To make matters worse, during the 
shutdown, we learned that on October 4, the legislative authorization 
for the CFATS program had expired, albeit briefly. These are the kinds 
of disruptions and regulatory uncertainty that Congress should do its 
best to avoid. Even under ideal circumstances, it costs companies, 
especially small businesses, time and money to plan for, pay for, 
prepare for, and clear days off of calendars of multiple employees to 
comply with a program like CFATS. Responsible companies like Hampford 
want the CFATS program--but we want a stable and predictable program.
    In our rescheduled final authorization inspection, we had two 
inspectors who were knowledgeable, professional, courteous, and 
practical. They engaged us in a real dialogue during the inspection--
and continued that dialogue after they left. Their focus was on 
creating layers of deterrent. They offered lots of suggestions on 
options we might consider but were clear that we were the experts on 
our facility and only we could create a plan that would work for us. 
They were very responsive to follow up questions from us. In addition, 
the entire process (from when we were inspected on October 23-24 until 
we got approval for our plan on February 14) was very timely and 
efficient.
    The CFATS program went through a difficult period, but we believe 
that our positive experience is an example of the broader success story 
that the CFATS program has become. As a result of the chemical sector's 
strong cooperation with DHS, there has been 100% compliance by industry 
with the requirements to submit Top-Screens, Security Vulnerability 
Assessments and Site Security Plans. For its part, DHS is making good 
progress in implementing the reforms identified by Deputy Director 
David Wulf. SOCMA applauds the work of Mr. Wulf and his team. We also 
thank him for his quick response in developing a resource called ``What 
to Expect from the Inspectors'' that will explain what companies should 
anticipate for final authorizations.
    The Chemical Sector Coordinating Council suggested this idea to Mr. 
Wulf last year and he enthusiastically endorsed it. While it will come 
too late for Hampford Research, we expect that the tool will be very 
helpful to other facilities like ours. This is a great example of 
chemical companies wanting to do the right thing, and DHS working well 
with them for compliance. We are meeting mutual goals.
    CFATS is reducing risks in a market-based way. Over 3,000 
facilities have changed processes or inventories in ways that have 
enabled them to screen out of the program. CFATS is thus driving 
facilities to reduce inherent hazards, relying not on regulatory 
mandates but on the company's expert judgment to do so where it makes 
sense--where it can be done without reducing product quality or 
transferring risk to some other point in the supply chain.
    The CFATS program is working, but it would help my company and 
others like it if Congress would ensure CFATS's continued stability 
through a longer-term authorization like H.R. 4007 would provide. This 
bill simply codifies what was in the original 2006 spending bill that 
established the program, and removes the program from the annual 
funding fire drills. The bill also makes a few simple fixes in areas 
where legislative change can improve the program:
   First, it clarifies that DHS can approve generic alternative 
        security programs that facilities can opt into, rather than 
        having to approve ASPs facility-by-facility. This approach has 
        worked well for the maritime security program and should be 
        extended to CFATS.
   Second, it clearly authorizes DHS to rely on third parties 
        to conduct authorization inspections. DHS has stepped up the 
        pace of inspections, but at the current rate it will still take 
        years and years to get through all the tier 3 and 4 facilities. 
        Leveraging third parties could be the key to dramatically 
        shortening that time table.
   Third, the bill confirms that facilities can satisfy their 
        obligation to help screen employees and visitors for terrorist 
        ties if the facilities rely on Federal credentials that are 
        vetted against the terrorist screening database--without having 
        to supply any other information to DHS.
    H.R. 4007 is a simple bill and strong solution that will allow DHS 
and facilities like mine to concentrate on implementing the CFATS 
regulations without worrying about the future of the program. It would 
help me, and the 30 employees of Hampford Research, significantly. The 
chemical sector is united in support of this bill.
    Thank you for the opportunity to testify, and I look forward to 
your questions.

    Mr. Meehan. Thank you, Ms. Hampford Donahue.
    The Chairman now recognizes Ms. Fendley for her testimony.

 STATEMENT OF ANNA FENDLEY, LEGISLATIVE REPRESENTATIVE, UNITED 
                          STEELWORKERS

    Ms. Fendley. Thank you, Chairman Meehan and Ranking Member 
Clarke, and Members of the subcommittee, for the opportunity to 
testify today.
    I am here on behalf of the United Steelworkers. We 
represent 850,000 workers in many sectors, including the 
majority of organized workers in the chemical industry.
    The massive explosion nearly a year ago in West, Texas, 
brought acute National attention to the vulnerabilities in our 
communities and the potential for the same or much worse is 
present at other facilities across the country.
    CFATS was intended to be an interim measure when DHS was 
given statutory authority during the 109th Congress. Subsequent 
appropriations have not addressed recognized problems with the 
implementation and scope of the CFATS program, and H.R. 4007 
also neglects to address many of the inherent weaknesses of 
CFATS, five of which I will cite today.
    First, H.R. 4007 does not extend CFATS coverage to 
chemicals shipped or stored outside of a facility's fence line 
in nearby rail yards or elsewhere that may have little or no 
security measures. Our members cite rail cars full of hazardous 
chemicals parked outside fence lines near homes and other 
businesses.
    Employers may engage in this form of risk-shifting to be 
taken off the list of high-risk facilities, or it could be 
unintentional. DHS claims that ``more than 3,000 facilities 
removed, reduced, or modified holdings of chemicals of 
interest,'' but maintains no information as to how these 
reductions in holdings were achieved.
    Second, H.R. 4007 does not change the prohibition within 
CFATS of any particular security measure by DHS, including a 
fence in a particular area, a specific control on a unit, or 
any other measure that is well-documented through past practice 
to prevent catastrophic incidents.
    Third, H.R. 4007 does not develop or promote the most 
effective means of reducing a catastrophic chemical incident, 
which is the use of safer chemical processes. Some companies 
have made these changes. According to DHS, nearly 1,300 
facilities have completely removed their chemicals of interest, 
and approximately 600 decreased quantities of chemicals of 
interest to below the threshold. But many companies will never 
even look into innovating with safer processes without a legal 
requirement to do so. A provision addressing this would be a 
particularly effective addition to H.R. 4007.
    Fourth, the personnel surety program under CFATS has the 
potential for unintended consequences. H.R. 4007 does not 
prevent the collection of unnecessary personal employee data by 
employers or third parties that may be inaccurate. There is not 
an adequate appeals process for workers who are wrongly 
discriminated against during the PSP process. DHS statements 
that employers are expected to follow all laws are inadequate 
to protect workers in this regard.
    Many have expressed concern about the duplication of 
efforts and the burden for multiple background checks under the 
PSP. The Transportation Worker Identification Credential, TWIC, 
is an option, but it is not without concerns.
    Fifth, CFATS and H.R. 4007 lack the requirement for a 
meaningful role for workers in chemical security. Workers who 
operate and maintain chemical facilities know the most about 
what needs to be done to reduce vulnerabilities. CFATS should 
require meaningful involvement of plant employees in developing 
security plans and participating in the agency's inspections at 
a facility. Additionally, whistleblower protections should be 
added for workers or others who report vulnerabilities to the 
Secretary of Homeland Security.
    As the first panel cited, there have been a number of 
challenges with implementing the CFATS program. The OIG and GAO 
reports are important documents for serious consideration. 
Another current activity to consider is the report that DHS 
must provide to the House and Senate Appropriations Committees 
by April.
    After the explosion in West, Texas, President Obama signed 
Executive Order 13650 on Improving Chemical Facility Safety and 
Security. The EO's working group has been gathering stakeholder 
input and is currently requesting public comments on policy 
regulation and standards modernization, including issues 
specific to CFATS. A status report is due to the President in 
May. These documents will be very valuable to consider.
    Any legislation authorizing the CFATS program must be 
responsive to the identified shortcomings and challenges of 
CFATS, the oversight recommendations, and other activities at 
the Federal level. Congress should not merely require more 
metrics from an inadequate program when there is consensus 
about problems. Legislative action based on the recommendations 
from OIG, GAO, the EO working group, and other stakeholders is 
necessary to address the gaps in CFATS that leave millions of 
American workers and communities at risk.
    Thank you again for the opportunity to be here today.
    [The prepared statement of Ms. Fendley follows:]
                   Prepared Statement of Anna Fendley
                           February 27, 2014
    Chairman Meehan, Ranking Member Clarke, and Members of the 
committee, thank you for the opportunity to testify today. My name is 
Anna Fendley. I am here on behalf of the United Steel, Paper and 
Forestry, Rubber, Manufacturing, Energy, Allied Industrial, and Service 
Workers International Union--USW for short. We represent 850,000 
workers in the sectors I just mentioned and many others, including the 
majority of unionized workers in the chemical industry and hundreds of 
thousands of men and women whose workplaces use and store large 
quantities of industrial chemicals.
    A massive explosion nearly a year ago at the West Fertilizer 
Company's storage and distribution facility in West, TX killed 15 
people and injured hundreds more. The blast also destroyed a nursing 
home, an apartment complex, schools, and private homes. This incident 
has brought acute National attention to the vulnerabilities in our 
communities. As devastating as the West explosion was, the potential 
for much worse is present at other facilities across the country.
    Our members are well aware of the hazards and the potential for 
wide-spread damage to critical infrastructure and the communities where 
they work and live. Small accidental releases occur more often than the 
public realizes, and it is only a matter of time before the next large 
explosion or release. In one example, our members at a chemical plant 
on the West Coast cite a normal procedure that turned abnormal last 
year and caused a release of sulfuric acid that sent workers at the 
warehouse next door to the hospital. Luckily this release was stopped 
relatively quickly. However, that may not be the case in every 
situation.
    CFATS was intended to be an interim measure when the 109th Congress 
passed legislation providing the Department of Homeland Security (DHS) 
with statutory authority to regulate chemical facilities for security 
purposes. Since that time subsequent Congresses have continued to 
extend the authority to DHS for the CFATS program through 
appropriations. These appropriations have not addressed recognized 
problems within the implementation and scope of the CFATS program and 
have instead allowed an inadequate and ineffective status quo. H.R. 
4007 also neglects to address many of the inherent weaknesses of CFATS, 
five of which of which I will cite today.
    First, H.R. 4007 does not extend CFATS coverage to chemicals 
shipped or stored outside of a facility's fence line in nearby rail 
yards or elsewhere that may have little or no security measures. 
Currently CFATS does not prevent this risk shifting from one location 
to another. I have seen pictures and gotten accounts from our members 
of rail cars full of hazardous chemicals parked for days outside the 
fence line within yards of a busy road near homes and other businesses. 
Employers may engage in this form of risk shifting to be taken off the 
list of high-risk facilities, or risk shifting could be an established 
practice occurring for years because workers and management do not 
recognize the hazard and the potential for a criminal act. Under CFATS 
there is no way of knowing if and how these risks are being shifted, 
which leaves communities in danger. DHS claims that ``more than 3,000 
facilities removed, reduced, or modified holdings of chemicals of 
interest'' but maintains no information as to how these reductions in 
holdings were achieved.\1\ The program does not know or track whether 
the risk was shifted to just over the fence-line.
---------------------------------------------------------------------------
    \1\ http://www.dhs.gov/sites/default/files/publications/
CFATS%20Update_February2014.pdf.
---------------------------------------------------------------------------
    Second, HR 4007 does not change the prohibition within CFATS of any 
``particular security measure'' by DHS including a fence in a 
particular area, a specific control on a unit, or any other measure 
that is well-documented through past practice to prevent catastrophic 
incidents. This capacity-building measure would require covered 
facilities to conduct a structured review of options that avoid 
catastrophic chemical hazards in well-documented assessments and plans 
that are reported to DHS. My colleagues and I work with employers every 
day. Many take safety measures that go above and beyond, but there are 
always some that will only do the minimum required by law and, as we 
all know, some who refuse to even do the minimum required.
    Third, H.R. 4007 does not develop or promote the most effective 
means of reducing a catastrophic chemical incident, which is the use of 
safer chemical processes. DHS,\2\ EPA,\3\ and the U.S. Chemical Safety 
Board \4\ have all highlighted the effectiveness of assessing and, 
where feasible, implementing safer alternatives at high-risk 
facilities. Some companies have shifted to safer processes or reduced 
their inventory of hazardous chemicals so they are no longer listed as 
high-risk. In fact, according to a report from DHS to the Coalition to 
Prevent Chemical Disasters, since the inception of the CFATS program 
nearly 1,300 facilities have completely removed their Chemicals of 
Interest and approximately 600 no longer possess a Chemical of Interest 
at the threshold that requires submission of a Top-Screen to DHS. But 
many companies will never even look into innovating with safer chemical 
processes without a legal requirement to do so. Past legislation in the 
House has included the requirement that covered facilities ``assess 
alternatives, in particular `the technical feasibility, costs, avoided 
costs (including liabilities), personnel implications, savings, and 
applicability of implementing each method to reduce the consequences of 
a terrorist attack'.''\5\ This provision would be a particularly 
effective addition to H.R. 4007.
---------------------------------------------------------------------------
    \2\ http://www.dhs.gov/news/2011/03/30/written-testimony-nppd-
house-committee-energy-and-commerce-hearingtitled-hr-908.
    \3\ http://www.epa.gov/ocir/hearings/testimony/111_2009_2010/
2010_0728_ccd.pdf.
    \4\ http://www.nytimes.com/2014/01/29/opinion/the-next-accident-
awaits.html?smid=pl-share&_r=0.
    \5\ HR 2868--111th Congress. http://beta.congress.gov/bill/111th-
congress/house-bill/2868.
---------------------------------------------------------------------------
    Fourth, the Personnel Surety Program (PSP) under CFATS has the 
potential for unintended consequences. Within the current context of 
the CFATS program, individual chemical facilities are responsible for 
clearing workers under their PSP. H.R. 4007 does not prevent the 
collection of unnecessary personal employee data by employers or third 
parties that may be full of inaccuracies due to errors in reporting. 
CFATS does not include an adequate appeals process for workers who are 
wrongly discriminated against during the PSP process. In a February 3, 
2014 Federal Register notice, DHS stated that employment decisions 
based on background checks are outside of the scope of CFATS and that 
DHS expects employers to comply with applicable Federal, State, and 
local law regarding employment and privacy.\6\ On the whole this is 
inadequate. Workers need an appeals process and whistleblower 
protections under the CFATS.
---------------------------------------------------------------------------
    \6\ http://www.gpo.gov/fdsys/pkg/FR-2014-02-03/pdf/2014-02082.pdf 
(page 6436).
---------------------------------------------------------------------------
    Many have expressed concerns about duplication of efforts and the 
burden for multiple background checks. The Transportation Worker 
Identification Credential (TWIC) is an option, but it is not without 
concerns. What protections would be in place for workers who would 
suddenly be required to secure TWICs to continue working? What 
financial and operational burdens would the installation of biometric 
readers put on facilities? Relying on the TWIC program in this way 
could be problematic, particularly since the Coast Guard has not issued 
a final rule for TWIC readers, it will not be fully deployed in ports 
across the country, and there are examples of some problems with the 
appeals process.
    And fifth, CFATS lacks the requirement for a meaningful role for 
workers in chemical security, and H.R. 4007 does not provide it. 
Workers who operate and maintain chemical facilities know the most 
about what needs to be done to reduce vulnerability and protect against 
a terrorist attack. They would be hurt first and worst in an attack on 
a facility, and therefore have the largest stake in ensuring safety. 
CFATS should require meaningful involvement of plant employees in 
developing security plans. DHS should also be required to include an 
employee representative when the agency does inspections at a facility. 
The Occupational Safety and Health Administration \7\ and the 
Environmental Protection Agency \8\ both have policies that could be 
used as a model for DHS to include workers in inspections. 
Additionally, whistleblower protections should be added for workers or 
others who report problems, deficiencies, and vulnerabilities to the 
Secretary of Homeland Security.
---------------------------------------------------------------------------
    \7\ https://www.osha.gov/Firm_osha_data/100006.html.
    \8\ http://www.epa.gov/compliance/resources/policies/monitoring/
caa/caa112r-rmpguide.pdf.
---------------------------------------------------------------------------
    As the first panel cited, there have been a number of challenges 
with implementing the CFATS program. In a March 2013 report, the Office 
of Inspector General (OIG) found that the program continued to face 
challenges in the areas of submission tools and processes, 
representation and oversight, human capital, and fiscal stewardship.\9\ 
OIG made 24 recommendations to improve implementation of the CFATS 
program, and those recommendations should be considered. Additionally 
the recommendations in the April 2013 Government Accountability Office 
(GAO) report titled ``Critical Infrastructure Protection: DHS Efforts 
To Assess Chemical Security Risk and Gather Feedback on Facility 
Outreach Can Be Strengthened'' should be considered as the committee 
considers risk assessment under the CFATS program.\10\
---------------------------------------------------------------------------
    \9\ http://www.oig.dhs.gov/assets/Mgmt/2013/OIG_13-55_Mar13.pdf.
    \10\ http://www.gao.gov/products/GAO-13-353.
---------------------------------------------------------------------------
    Another current activity to consider is that the Joint Explanatory 
Statement for the Consolidated Appropriations Act, 2014 included a 
requirement that DHS provide a report to the House and Senate 
Appropriations Committees, the House Committee on Energy and Commerce, 
and this committee, the House Committee on Homeland Security by April 
2014.\11\ This report will outline how DHS is using existing resources 
and infrastructure to avoid duplication within the program and how DHS 
is working to ensure that that a facility meets the personnel surety 
standard. The information included in this report will be valuable to 
incorporate into any legislation concerning the CFATS program.
---------------------------------------------------------------------------
    \11\ http://docs.house.gov/billsthisweek/20140113/113-HR3547-JSOM-
D-F.pdf.
---------------------------------------------------------------------------
    After the explosion in West, TX, President Obama signed Executive 
Order (EO) 13650 on Improving Chemical Facility Safety and 
Security.\12\ The EO set up a working group to improve operational 
coordination with State and local partners; enhance Federal agency 
coordination and information sharing; modernize policies, regulations, 
and standards; and work with stakeholders to identify best practices. 
The working group is co-chaired by the Department of Homeland Security, 
the Environmental Protection Agency, and the Department of Labor. It 
has been meeting regularly and has held listening sessions at locations 
across the country to gather stakeholder input about how the agencies 
can more effectively reduce the risks to workers and communities. 
Additionally, there is also a document out for public comment until 
March 31, 2014 requesting public input on policy, regulation, and 
standards modernization. As a part of that public comment, DHS is 
asking for input from stakeholders about the following issues specific 
to CFATS:
---------------------------------------------------------------------------
    \12\ http://www.whitehouse.gov/the-press-office/2013/08/01/
executive-order-improving-chemical-facility-safety-and-security.
---------------------------------------------------------------------------
   Options to improve the secure storage, handling, and sale of 
        ammonium nitrate;
   Potential updates to the CFATS chemicals of interest list 
        and the screening threshold quantities of certain substances 
        contained on that list;
   Options for improving the coverage of reactive substances 
        and reactivity hazards;
   Options for addressing security of chemicals at agricultural 
        production facilities;
   Opportunities to leverage industry best practices in 
        chemical facility security;
   Methods for identifying economically and mission-critical 
        chemical facilities;
   Opportunities to harmonize facility security standards 
        across different programs; and
   Approaches to identifying potential high-risk chemical 
        facilities that have not yet complied with their initial CFATS 
        obligations.\13\
---------------------------------------------------------------------------
    \13\ https://www.osha.gov/chemicalexecutiveorder/
Section_6ai_Options_List.html.
---------------------------------------------------------------------------
    A status report from the working group to the President is due on 
May 1, 2014 along with a comprehensive and integrated standard 
operating procedure that unifies the Federal approach for identifying 
and responding to risks. These documents will be very valuable to 
consider as a part of CFATS reform.
    Any legislation authorizing the program must be responsive to the 
identified shortcomings and challenges of CFATS, the oversight 
recommendations, and other activities at the Federal level regarding 
the CFATS program. Congress should not merely require more metrics from 
an inadequate program when there is consensus about problems in the 
program. Legislative action based on the recommendations from OIG, GAO, 
the EO working group, and other stakeholders is necessary to address 
the gaps in CFATS that leave millions of American workers and 
communities at risk.
    Thank you again for the opportunity to testify today.

    Mr. Meehan. I thank you, Ms. Fendley. I thank each of the 
panelists.
    Let me begin with you, Mr. Miller, representing larger 
industry in this. There has been major investment that has been 
made by the industry in response to the call and a sense of 
responsibility to try to meet the challenge of securing our 
chemicals against the threat of potential use for terrorist 
activity.
    That investment has been made under the basis that there be 
some kind of certainty with regard to the program. What does it 
mean to business to have a question of certainty? How is it 
that people make calculations about the kinds of investments 
and planning that they are going to do in larger organizations 
where oftentimes you can have numerous facilities and literally 
millions of dollars at stake, so to speak, in the decisions 
that you make?
    Mr. Miller. Thank you, Mr. Chairman, for that question.
    It does certainly play into the considerations of capital 
planning. The reality of it is, money spent for security 
measures may be money that was taken away from some other 
process that we wanted to make an improvement on. But knowing 
that the money that we are spending is not necessarily going to 
be--I don't want to say wasted, but certainly the money that is 
spent trying to comply with the program should be spent for a 
good cause. Knowing that this program is going to be around and 
it is going to be something that we will be complying with for 
a number of years would be helpful.
    Mr. Meehan. So the absence of some kind of certainty with 
regard to it may in these times of difficult decision making at 
a corporate level lead people to say, well, if we don't know, 
resources could be shifted until there is certainty into 
another area, leaving some measure of potential vulnerability 
as we move forward?
    Mr. Miller. Well, I think that we as an industry try to be 
responsible in that area and we want to make sure that we are 
doing what we should be doing in the security arena. However, 
having that uncertainty can cause, I think, some companies to 
proverbially kick the can down the road and wait to see what is 
going to happen as to whether this regulation is going to 
continue or not.
    Mr. Meehan. Thank you.
    Ms. Donahue, you represent many of the smaller participants 
in the business. We recognize that there are numerous 
components, and that may be the very place where, you know, we 
have got smaller companies, smaller abilities to be responsive 
to mandates and other kinds of things, and yet a similar 
interest in trying to be responsive to our goal of protecting 
the homeland.
    What does it mean to--you used the word flexibility. What 
about this legislation enables you to have some measure of 
flexibility while still fulfilling the obligations that you 
think the law creates?
    Ms. Hampford Donahue. Well, in general, I mean, in the 
course of our plan being approved, it was a real dialogue with 
the inspectors. They were in our facility. They could see some 
of the space limitations we were dealing with and other issues.
    We talked about how we created more layers of security. 
They had some ideas for us that hadn't occurred to us before, 
and we had some, actually, some insights that they added to 
their list, so it was it was a very collaborative process that 
ended up with a plan that we could execute within our means--
again, goes back to this capital planning--I would echo it is 
probably even more important for a small facility to be able to 
plan capital spending, because we have fewer dollars to spend, 
and chemical manufacturing is an extremely capital-intensive 
business, extremely.
    So the more we can plan for what is going to be required to 
meet the commitments for CFATS, the better it is for us. I 
mean, if we are talking about putting some new camera system 
in, I need to know that that is going to be an investment that 
will be able to keep for years to come and that, in 2 years, I 
won't have some new set of standards that I have to meet, that 
now the candid cameras aren't a good investment.
    So flexibility to look at the standards and create 
solutions that are executable in my facility is important, but 
also this ability to plan long-term.
    Mr. Meehan. That flexibility, as well, is--there is an 
engagement that is taking place, in the sense of you are 
collaboratively looking at the kinds of things that may be 
being requested of you, but there is also a dialogue about 
things, where and how you store your chemicals and otherwise. 
Would it be conceivable you would be asked questions about 
whether you have materials outside of the boundaries of your 
particular plant?
    Ms. Hampford Donahue. Absolutely.
    Mr. Meehan. Would there then be an opportunity for DHS to 
engage with you about ways to assure that they are at least 
either in transit or you could shift things if necessarily to 
assure that they are otherwise secure?
    Ms. Hampford Donahue. Absolutely.
    Mr. Meehan. So this is the part of the flexibility and the 
ability to move forward is the on-going dialogue that takes 
place, so when issues are raised with respect to security of 
these, there is a capacity with the way things are being 
constructed in this bill to be responsive and to take 
appropriate steps to assure that they are taken.
    Ms. Hampford Donahue. Based on what we have seen so far, 
yes.
    Mr. Meehan. Okay.
    Ms. Hampford Donahue. I mean, we have an open dialogue with 
the inspectors that were there, that as we implement our plan, 
should, you know, you hit a speed bump that you weren't 
anticipating, you know, we will be absolutely picking up the 
phone to talk to them about how we best resolve, you know, any 
forthcoming issues. So the dialogue that was created during the 
audit was the cornerstone of this for us.
    Mr. Meehan. Thank you. My time is expired, and I turn to 
the Ranking Member for questions she may have.
    Ms. Clarke. Thank you, Mr. Chairman. Let me thank Mr. 
Miller, Ms. Hampford Donahue, and Ms. Fendley for your expert 
testimony here today.
    My question is to you, Ms. Fendley: In your testimony, you 
mentioned that chemical security measures rarely address 
capacity-building measures that would require covered 
facilities to conduct a structured review of options that would 
help avoid catastrophic chemical hazards and that are reported 
to DHS. I know that you and your organization work with 
employers every day to improve the safety and security of 
workers. We also know that many companies take their corporate 
responsibility to work with the citizens who live nearby 
seriously and take safety measures that go above and beyond.
    But there are always bad actors who do the minimum required 
by law or less. Can you give us some examples of how we can 
help the CFATS program and coverage avoidance of catastrophic 
chemical hazard?
    Ms. Fendley. Sure. Thank you for that question. The most 
effective means, we believe, to avoid these catastrophic 
incidents is to promote and develop the use of safer chemical 
processes. As I included in my testimony, there are many 
facilities that have done that, but that dramatically mitigates 
the risk, should an act of terror take place.
    There has been legislation in past congresses that 
addresses that and included some requirements that facilities 
at a minimum assess the financial and technological feasibility 
to implement those kinds of processes. I think the second thing 
I would add is that the CFATS program does a very good job of 
hearing from industry as a stakeholder, but workers and 
communities also ought to be at the table as stakeholders in 
this process. Workers specifically at facility sites would be 
incredibly useful in creating site security plans and 
participating in inspections, because they are the people who 
are really on the process every day and they understand the 
true vulnerabilities.
    Ms. Clarke. Ms. Hampford Donahue, you are a smaller 
company, and you mentioned that part of what has sort-of 
enabled you to wrap your arms around this process is the 
consultative process with inspection. Part of the challenge 
that we are facing right now is the outlying organization; 
based on the West Virginia--excuse me, the West, Texas, model, 
it seemed to be a small company, as well.
    Through your trade association, have you been able to sort-
of get to those far-flung organizations to have them become a 
part of your association? What are the challenges that we face 
as a Nation in sort of locating those outliers? Because it 
seems to me that that process of collaboration and inspection 
helps those companies that may be isolated to come into 
compliance and have a certain level of comfort in that 
interaction.
    Ms. Hampford Donahue. I am not sure that I can speak 
specifically to the issue of outliers. I can speak to the kind 
of dialogue that we have within the SOCMA membership. I can 
tell you that when we received the call that we were going to 
be inspected, that was the first call I made was to SOCMA, to 
reach out to the staff there and to my fellow board of 
governors, members, to find out who else had been inspected. So 
it is, you know, an active engagement that we have talking 
about, you know, all sorts of issues, but--CFATS being one of 
them.
    Beyond--I mean, talk about outliers. I don't know of any. I 
mean, everybody that is in SOCMA that I know of is compliant 
with whatever Government regulations they need to be.
    Ms. Clarke. I guess my question to you was, have you seen 
in your experience, I guess, the willingness or an ability to 
identify a company that may be out there that sees your 
organization as a place where they can find a home and then 
ultimately become far more engaged in a trade association, 
thereby getting the access to the information they would need 
to be in compliance with CFATS?
    I mean, I am sure there are companies that are coming on-
line every day, but there may be older ones out there that, you 
know, get access to the web and see your organization. Have you 
seen that as an avenue?
    Ms. Hampford Donahue. Well, SOCMA has--you know, got a very 
strong outreach effort to its members. Certainly, legislative 
and regulatory issues are a cornerstone of that. If you go to 
any SOCMA meeting, board meeting or, you know, other seminar or 
session that they have, there is always a regulatory or 
legislative component to what we are talking about.
    So I think for us, certainly, that is one of the benefits 
of SOCMA membership, is that that is the way that I make sure 
that my company is always compliant with what is going on or 
what we need to be, so I would assume that is why other 
organizations would join, as well.
    Ms. Clarke. Very well. Thank you very much, Mr. Chairman. I 
yield back.
    Mr. Meehan. I thank the Ranking Member.
    I just have one sort-of follow-up question that I would 
like to ask for some insight on. I know we have mentioned a 
couple of times the personnel surety performance, and I am 
aware that there is continuing difficulty with some of this. 
Mr. Miller, our committee appreciates that DHS has taken some 
steps. Some have called them a little overly burdensome or 
invasive at times. We also want to make sure that progress in 
this regard that has been made isn't retarded in a way that it 
becomes difficult to do the thing we want to do, which is to 
attest to the ability of somebody who is in a facility to 
appropriately be there.
    With these twin concerns of mine, how would you think you 
would like to see the personnel surety requirement developed?
    Mr. Miller. Thank you, Mr. Chairman. The personnel surety 
performance standard is a tough one, because there is a certain 
element of that performance standard having to do with 
vetting--or vetting people against the Terrorist Screening 
Database, that there is only one way that can be accomplished, 
and that can only be accomplished by submitting data in some 
manner to the Federal Government for them to bounce it off of 
that database.
    So that makes it a little bit of a challenge to say that we 
should have various options to be able to comply, when you have 
that restriction. So I think that is the reason for the 
consideration of having--recognizing multiple credentials that 
are already out there that do that thing to comply with this 
performance standard.
    Another option, though, too, is--and certainly it is 
something that we look at our facilities--is the true issue 
here is allowing people having access to the chemicals of 
interest. Where we have the ability to isolate those materials 
so that we can reduce the number of people that have access to 
that, and we take advantage of that, that way, that reduces the 
total population that we have to submit to DHS. The 
simplification and the reduction of the number of people that 
have access to those types of materials is what we are driving 
for there.
    If I might add one more thing, in some of the other 
questioning--and I apologize for being so bold--but there has 
been a lot of discussion about the facilities and the 
population of facilities that almost sounds like this is a 
static program, but it is not. All of my facilities at any 
given time may decide to change a process. They may decide to 
expand their processes. We have to have a process in place 
where we are continually monitoring what our facilities are 
doing, so that if they suddenly trigger the need for a Top-
Screen, we know about it and we can have that facility to do 
that.
    Same way with our warehouses and so forth, in kind-of going 
to Ranking Member Clarke's question. We make sure that our 
suppliers and that our warehouses and so forth recognize they 
may have to comply with CFATS, because the last thing we need 
is to have a warehouse or a supplier get shut down by DHS and 
we can't get that--can't have that working material there.
    So that is one of the ways that outreach can be done. This 
is a dynamic regulation, in that it is always changing as far 
as the population of facilities that are out there.
    Mr. Meehan. Well, I thank you for that observation about 
not only the dynamism, but we used the word flexibility before 
as with anything, and one of the real objectives of this 
legislation was to make it structured enough that we could be 
able to accomplish the very real objectives that we share, but 
also not to make it so prescriptive or to be introducing so 
many new variables into these that we start to get in the way 
of the very specific objective that we have now, recognizing 
that that concept of flexibility always opens the door to, if 
there is another kind of need, it can be included, but if we 
don't have a baseline that allows us to get started, we are 
going to continue to wallow in the mud and find ourselves 
potentially down here 2 or 3 years later looking at the next 
West, Texas, and saying, why didn't we do something to make the 
difference?
    I want to thank you for your testimony. I want to thank you 
for your work in this very, very important area. We appreciate 
the value of the information you have been able to bring to us 
in deliberations about this important bill. So I thank the 
witnesses.
    The Members of the committee may have some additional 
questions for you, and if they do, I ask that you respond in 
writing. So, thank you.
    Pursuant to committee rule 7(e), the record of this hearing 
will be held open for 7 days. Without objection, the 
subcommittee stands adjourned.
    [Whereupon, at 12:32 p.m., the subcommittee was adjourned.]

                                 [all]

```