U.S. GOVERNMENT PUBLISHING OFFICE

34–591 WASHINGTON : 2019

THE CHEMICAL FACILITIES ANTI-TERRORISM 

STANDARDS PROGRAM (CFATS)—A PROGRESS 

REPORT 

HEARING 

BEFORE THE

SUBCOMMITTEE ON ENVIRONMENT 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

SECOND SESSION 

JUNE 14, 2018 

Serial No. 115–138 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

(II) 

COMMITTEE ON ENERGY AND COMMERCE 

GREG WALDEN, Oregon 

Chairman 

JOE BARTON, Texas 

Vice Chairman 

FRED UPTON, Michigan 

JOHN SHIMKUS, Illinois 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

GUS M. BILIRAKIS, Florida 

BILL JOHNSON, Ohio 

BILLY LONG, Missouri 

LARRY BUCSHON, Indiana 

BILL FLORES, Texas 

SUSAN W. BROOKS, Indiana 

MARKWAYNE MULLIN, Oklahoma 

RICHARD HUDSON, North Carolina 

CHRIS COLLINS, New York 

KEVIN CRAMER, North Dakota 

TIM WALBERG, Michigan 

MIMI WALTERS, California 

RYAN A. COSTELLO, Pennsylvania 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

JEFF DUNCAN, South Carolina 

FRANK PALLONE, JR., New Jersey 

Ranking Member 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

G.K. BUTTERFIELD, North Carolina 

DORIS O. MATSUI, California 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

JERRY MCNERNEY, California 

PETER WELCH, Vermont 

BEN RAY LUJA ́ N, New Mexico 

PAUL TONKO, New York 

YVETTE D. CLARKE, New York 

DAVID LOEBSACK, Iowa 

KURT SCHRADER, Oregon 

JOSEPH P. KENNEDY, III, Massachusetts 

TONY CA ́ RDENAS, CaliforniaL RUIZ, 

California 

SCOTT H. PETERS, California 

DEBBIE DINGELL, Michigan 

SUBCOMMITTEE ON ENVIRONMENT

JOHN SHIMKUS, Illinois 

Chairman 

DAVID B. MCKINLEY, West Virginia 

Vice Chairman 

JOE BARTON, Texas 

TIM MURPHY, Pennsylvania 

MARSHA BLACKBURN, Tennessee 

GREGG HARPER, Mississippi 

PETE OLSON, Texas 

BILL JOHNSON, Ohio 

BILL FLORES, Texas 

RICHARD HUDSON, North Carolina 

KEVIN CRAMER, North Dakota 

TIM WALBERG, Michigan 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

JEFF DUNCAN, South Carolina 

GREG WALDEN, Oregon (ex officio) 

PAUL TONKO, New York 

Ranking Member 

RAUL RUIZ, California 

SCOTT H. PETERS, California 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

JERRY MCNERNEY, California 

TONY CA ́ RDENAS, California 

DEBBIE DINGELL, Michigan 

DORIS O. MATSUI, California 

FRANK PALLONE, JR., New Jersey (ex 

officio) 

(III) 

C O N T E N T S 

Page 

Hon. John Shimkus, a Representative in Congress from the State of Illinois, 

opening statement ................................................................................................ 1 

Prepared statement .......................................................................................... 3 

Hon. Paul Tonko, a Representative in Congress from the State of New York, 

opening statement ................................................................................................ 4 

Hon. Frank Pallone, Jr., a Representative in Congress from the State of 

New Jersey, opening statement .......................................................................... 5 

Hon. Greg Walden, a Representative in Congress from the State of Oregon 

prepared statement .............................................................................................. 7 

WITNESSES

Dave Wulf, Acting Deputy Assistant Secretary, Infrastructure Protection, U.S. 

Department of Homeland Security ..................................................................... 8 

Prepared statement .......................................................................................... 11 

Answers to submitted questions ...................................................................... 121 

Chris P. Currie, Director, Emergency Management, National Preparedness, 

and Critical Infrastructure Protection, Homeland Security and Justice 

Team, U.S. Government Accountability Office .................................................. 50 

Prepared statement .......................................................................................... 52 

Answers to submitted questions ...................................................................... 137 

Doug Brown, President and COO, Brown Chemical Company ............................ 68 

Prepared statement .......................................................................................... 70 

Answers to submitted questions ...................................................................... 146 

Mike Wilson, National Director, Occupational And Environmental Health, 

Bluegreen Alliance ............................................................................................... 75 

Prepared statement .......................................................................................... 77 

Answers to submitted questions ...................................................................... 152 

Steve Roberts, Principal, Chemical Security Group, LLC .................................... 88 

Prepared statement .......................................................................................... 90 

Answers to submitted questions ...................................................................... 178 

James Conrad, Principal, Conrad Law and Policy Counsel, on Behalf of Society of Chemical Manufacturers and Affiliates ................................................... 100 

Prepared statement .......................................................................................... 102 

Answers to submitted questions ...................................................................... 187 

Vette Arellano, Policy Research and Grassroots Advocate, Texas Environmental Justice Advocacy Services ....................................................................... 107 

Prepared statement .......................................................................................... 110 

SUBMITTED MATERIAL

Statement of the Chemical Facility Anti-Terrorism Standards Coalition .......... 119 

(1) 

THE CHEMICAL FACILITIES ANTI–TERRORISM 

STANDARDS PROGRAM (CFATS)—A 

PROGRESS REPORT 

THURSDAY, JUNE 14, 2018 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON ENVIRONMENT, 

COMMITTEE ON ENERGY AND COMMERCE

Washington, DC. 

The subcommittee met, pursuant to call, at 10:00 a.m., in room 

2123 Rayburn House Office Building, Hon. John Shimkus (chairman of the subcommittee) presiding. 

Members present: Representatives Shimkus, McKinley, Harper, 

Olson, Johnson, Flores, Walberg, Carter, Duncan, Walden (ex officio), Tonko, Ruiz, Peters, Green, DeGette, McNerney, Ca ́ rdenas, 

Dingell, Matsui, and Pallone (ex officio). 

Staff present: Mike Bloomquist, Deputy Staff Director; Samantha 

Bopp, Staff Assistant; Kelly Collins, Staff Assistant; Jerry Couri, 

Chief Environmental Advisor; Margaret Tucker Fogarty, Staff Assistant; Jordan Haverly, Policy Coordinator, Environment; Mary 

Martin, Deputy Chief Counsel, Energy & Environment; Sarah Matthews, Press Secretary; Drew McDowell, Executive Assistant; Peter 

Spencer, Professional Staff Member, Energy; Austin Stonebraker, 

Press Assistant; Hamlin Wade, Special Advisor, External Affairs; 

Everett Winnick, Director of Information Technology; Jean Fruci, 

Minority Energy and Environment Policy Advisor; Caitlin 

Haberman, Minority Professional Staff Member; Rick Kessler, Minority Senior Advisor and Staff Director, Energy and Environment; 

Jourdan Lewis, Minority Staff Assistant; Alexander Ratner, Minority Policy Analyst; Tuley Wright, Minority Energy and Environment Policy Advisor; C.J. Young, Minority Press Secretary; and 

Catherine Zander, Minority Environment Fellow. 

OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

Mr. SHIMKUS. The subcommittee will now come to order. The 

chair recognizes himself for 5 minutes for the purpose of an opening statement. 

Today, the subcommittee will check on the progress of the Chemical Facilities Anti-Terrorism Standards Program, or CFATS, allowing our subcommittee to review the progress of the CFATS program, including overall implementation by the Department of 

Homeland Security as well as overall achievement of benchmark 

2 

objectives identified in the past by the Government Accountability 

Office. 

This program, which Congress authorized in the fall of 2006 was 

a continuation of congressional efforts since the terror attacks of 

September 11, 2001, to surgically and directly address gaps in Federal law regarding terrorism or other intentional acts against highrisk facilities due to their use or possession of chemicals of concern 

at levels of concern. The core of this new security-focused law was 

a process where DHS issued risk-based performance standards that 

required vulnerability assessments and the site security plans by 

covered facilities. Most importantly, to avoid overlapping with 

other Federal programs, CFATS was designed to foster collaboration between government and regulated parties. Having finally set 

up this program, many had great optimism about its possibilities. 

Unfortunately, the early years of CFATS program implementation 

were marked with several growing pains, some more hurtful than 

others. No one knows that more that our witness from the Department of Homeland Security, David Wulf. Very few people have 

demonstrated the courage, commitment, and longevity with the 

program that he has. He’s kind of the Cal Ripken of CFATS. 

Based on this subcommittee’s hearing in March 2014, we know 

Mr. Wulf not only set many remedial goals to address issues he 

found in the CFATS program, but GAO also found areas that needed serious attention. GAO provided recommendations to DHS on 

how to correct these areas. I look forward to hearing about the 

progress DHS is making here from Mr. Wulf on the first panel, and 

from Christopher Currie at GAO, who is on the second panel. 

I also look forward to a meaningful dialogue with our other witnesses representing CFATS regulated stakeholders as well as those 

of organized labor, environmental, and community advocacy interests. 

Particularly, I am interested in knowing what steps DHS has 

taken to improve its risk assessment methodology and what that 

has meant for facility tiering, what DHS has done to become more 

effective and efficient carrying out the CFATS program, and, finally, what steps has DHS taken to improve CFATS program 

transparency and communication with regulated facilities, whether 

it relates to the facility tiering or employee screening. In my opinion, CFATS has had four uninterrupted years to course correct and 

these are threshold questions that must be addressed in evaluating 

whether CFATS is a worthwhile investment for the United States 

taxpayer. 

I know there are some who would like to see the CFATS universe 

expand to also do EPA’s job, or OSHA’s job, or FEMA’s job, or addressed some other way and we have had lively discussions on the 

advisability of these changes in the past. My own thinking has 

been guided by two thoughts. Are these new requirements advisable as a legally enforceable part of this program, filling a security 

gap that does not exist or are they merely an additive burden without security benefits, and recognizing the challenges CFATS has 

faced in the past, CFATS must excel at its present obligations before being given new responsibilities. 

I want to thank our witnesses for being with us today. We look 

forward to having your experience, wisdom, and ideas. 

3 

[The prepared statement of Mr. Shimkus follows:] 

PREPARED STATEMENT OF HON. JOHN SHIMKUS

The Subcommittee will now come to order; and the Chair recognizes himself for 

5 minutes for the purposes of an opening statement. 

Today, the Subcommittee will check in on the progress of the Chemical Facilities 

Anti-Terrorism Standards Program or CFATS, allowing our Subcommittee to review 

the progress of the CFATS program, including program implementation by the Department of Homeland Security (DHS) as well as overall achievement of benchmark 

objectives identified in the past by the Government Accountability Office (GAO). 

This program, which Congress authorized in the fall 2006, was a continuation of 

congressional efforts since the terror attacks of September 11, 2001, to surgically 

and directly address gaps in Federal law regarding terrorism or other intentional 

acts against high-risk facilities due to their use or possession of chemicals of concern 

at levels of concern. The core of this new security-focused law was a process where 

DHS issued risk-based performance standards that required vulnerability assessments and site security plans by covered facilities. Most importantly, to avoid overlapping with other Federal programs, CFATS was designed to foster collaboration 

between the government and regulated parties. Having finally set up this program, 

many had great optimism about its possibilities. Unfortunately, the early years of 

CFATS program implementation were marked with several growing pains, some 

more hurtful than others. No one knows that more that our witness from the Department of Homeland Security, David Wulf. Very few people have demonstrated 

the courage, commitment, and longevity with the program that he has—he’s kind 

of the Cal Ripken of CFATS. 

Based on this Subcommittee’s hearing in March of 2014, we know Mr. Wulf not 

only set many remedial goals to address issues he found in the CFATS program, 

but GAO also found areas that needed serious attention. GAO provided recommendations to DHS on how to correct these areas. I look forward to hearing 

about the progress DHS is making here from Mr. Wulf on our first panel, and from 

Christopher Currie at GAO, who is on the second panel. 

I also look forward to a meaningful dialogue with our other witnesses representing CFATS regulated stakeholders as well as those of organized labor, environmental, and community advocacy interests. 

Particularly, I am interested in knowing what steps DHS has taken to improve 

its risk assessment methodology and what that has meant for facility tiering, what 

DHS has done to become more effective and efficient carrying out the CFATS program, and, finally, what steps has DHS taken to improve CFATS program transparency and communication with regulated facilities—whether it relates to facility 

tiering or employee screening. In my opinion, CFATS has had four uninterrupted 

years to course correct and these are threshold questions that must be addressed 

in evaluating whether CFATS is a worthwhile investment for the United States taxpayer. 

I know there are some who would like to see the CFATS universe expanded to 

also do EPA’s job, or OSHA’s job, or FEMA’s job, or addressed some other way— 

and we have had lively discussions on the advisability of these changes in the past. 

My own thinking has been guided by two thoughts: (1) are these new requirements 

advisable as a legally enforceable part of this program, filling a security gap that 

does not exist, or are they merely an additive burden without security benefits, and 

(2) recognizing the challenges CFATS has faced in the past, CFATS must excel at 

its present obligations before being given new responsibilities. 

I want to thank our witnesses for being with us today. We look forward to having 

your experience, wisdom, and ideas. 

With that, I yield back the balance of my time. 

Mr. SHIMKUS. With that, I have a minute left. Anyone seeking 

time? No one is seeking time so I will yield back and recognize the 

ranking member of the subcommittee, Mr. Tonko from New York, 

for 5 minutes. 

4 

OPENING STATEMENT OF HON. PAUL TONKO, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF NEW YORK 

Mr. TONKO. Thank you, Mr. Chair, and thank you to our witnesses for your testimony, the Department of Homeland Security’s 

Chemical Facility Anti-Terrorism Standards, or CFATS program. 

CFATS is an important part of our nation’s counterterrorism efforts to secure high-risk chemical facilities. The program was first 

created in late 2006 through a DHS appropriations bill. In the 

early years, Congress extended the program through annual appropriations under the passage of a long-term authorization in 2014. 

Without further congressional action the program will terminate in 

January of 2019. 

Under CFATS certain chemical manufacturing, handling, and 

storage facilities must implement risk-based performance standards for vulnerability assessments and site security plans. Facilities that possess certain chemicals of interest must be screened by 

DHS. If a facility is deemed a high risk, it will be placed in one 

of four tiers that will establish standards appropriate to secure the 

site. As of May 30th of 2018 the CFATS program identifies 3,395 

facilities as high risk with 159 in tier one and 78 in tier two. 

While there is complete agreement around the need for a program to keep these chemicals out of the hands of terrorists, even 

the program’s most ardent supporters would admit there have been 

implementation problems. 

Over the years, DHS has addressed a number of concerns with 

the program including some of GAO’s recommendations which we 

will hear about today, I am certain. 

As Congress considers reauthorization, this is an opportunity to 

review the program and consider what is working, working well, 

and how the program could be improved. This includes how we 

might continue to reduce risks at these sites and ensure that workers, first responders, and local communities have the information 

they need to stay safe. 

In my view, we should be working to reauthorize CFATS and, 

hopefully, improving it. But I would caution against a permanent 

reauthorization. It is rare for us to discuss this program and a permanent reauthorization may result in even less congressional oversight. 

We should also keep in mind that CFATS is not the only Federal 

program to regulate chemical facilities. While others are beyond 

the scope of DHS, I strongly believe Congress should be looking at 

all aspects of risks at chemical facilities, not just terrorism. 

Recent incidents should remind us that our concerns must not be 

limited to security issues alone. We should take a holistic approach 

to chemical risks which, obviously, includes facility security as well 

as safety, accounting for the risks to the people working there and 

living in nearby communities and facilities’ resilience. 

Chemical fires, explosions, and releases can have serious consequences regardless of whether an incident was an accident, a 

natural disaster or an act of terrorism. For example, EPA’s risk 

management plan program is focused on reducing chemical risk in 

the event of an accidental release. RMP establishes emergency 

measures which help local first responders prepare for and respond 

to a chemical accident. 

5 

In January of 2017, the Obama administration finalized an RMP 

amendments rule but in June of last year EPA delayed that rule’s 

implementation, and a few weeks ago EPA proposed a reconsideration of the RMP program, which would essentially roll back nearly 

all of the safety measures that were adopted in 2017. 

In addition to safety issues, chemical facilities are also vulnerable to climate change and natural disasters as we have seen during Hurricane Harvey when a power outage and equipment failure 

led to a significant chemical fire at the Arkema facility in Crosby, 

Texas. The Chemical Safety Board’s post-Arkema report recommended the development of comprehensive industry guidance to 

help companies assess their risk for potential extreme weather 

events. 

While we all support keeping these facilities secure, I hope we 

can also address these critical safety and resilience issues, and if 

there is an opportunity to improve CFATS in a way that close security gaps, reduce risks, better address emerging threats such as cybersecurity and keep first responders and workers safer, now is an 

excellent opportunity to consider those changes to the program. 

Again, I thank the chair for calling this hearing and thank our 

witnesses for being here today, and I yield back, Mr. Chair. 

Mr. JOHNSON [presiding]. I thank the gentleman for yielding 

back. 

The chair now recognizes the ranking member of the full committee, Mr. Pallone, for 5 minutes. 

OPENING STATEMENT OF HON. FRANK PALLONE, JR., A REPRESENTATIVE IN CONGRESS FROM THE STATE OF NEW JERSEY 

Mr. PALLONE. Thank you, Mr. Chairman. 

It’s been over 5 years since this committee held a hearing on the 

Department of Homeland Security’s Chemical Facility Anti-Terrorism Standards, or CFATS. Given CFATS’ inauspicious history, 

I believe we should have conducted more regular oversight. Existing CFATS authorization expires on January 2019 so it’s important 

that Congress act to continue this program. 

At the same time, there are well-documented gaps in the current 

statute that Congress should address instead of simply rubber 

stamping an extension of the existing program. 

I’ve been an advocate for increased safety and security at our nation’s chemical facilities for many years, well before the CFATS 

program was established in 2006. 

My home State of New Jersey, which has a high population density, also has a large number of chemical facilities. So the consequences of insufficient security are dire. 

The program shouldn’t have any gaps, and while it took the program five years to approve its first chemical facility security plan, 

I understand we will hear today that improvements have been 

made. 

Nevertheless, there are still shortfalls in the program that DHS 

cannot address without changes to the law. For example, several 

significant categories of facilities are exempt from the standards, 

such as public water systems and wastewater treatment plants, 

and they should be added. 

6 

We should also reject a suggestion from Senate Republicans that 

we exempt explosive manufacturers from this anti-terrorism program. 

We also cannot have a conversation about chemical facilities 

without discussing the Trump administration’s reckless proposal to 

dismantle EPA’s risk management program, or RMP, improvement 

rule. 

This is a common sense update to a nearly 20-year-old risk planning and reduction policy for our nation’s chemical facilities. The 

rule would have improved chemical process safety, assisted local 

emergency authorities and planning for and responding to accidents and improved public awareness of chemical hazards at regulated facilities. 

Unfortunately, the administration’s decision to walk away from 

the RMP improvement rule has widespread and harmful ramifications. Dangerous incidents at chemical facilities across the country 

are happening too often. Forty-six incidents have occurred at RMP 

facilities since Administrator Pruitt blocked the RMP improvement 

rule. Had the rule been in place, those facilities would have been 

required to prepare for and implement safety improvements to reduce the frequency and severity of those events. The highest profile 

case occurred in the aftermath of Hurricane Harvey at the Arkema 

chemical plant in Crosby, Texas. Heavy rains flooded the facility, 

causing equipment to fail, triggering a chemical fire, and releasing 

hazardous fumes and smoke into the air. 

Last month, the Chemical Safety Court released an investigative 

report on the incident and found that chemical facilities are wholly 

unprepared for extreme weather events like floods and hurricanes. 

Improving the resiliency of these facilities will only become more 

critical as the climate continues to change. More frequent flooding 

and powerful storms associated with unchecked climate change increase the risk to workers and vulnerable populations in and 

around these facilities which too often are low-income communities 

and communities of color. 

Earlier this year, the New York Times reported that more than 

2,500 sites handling toxic chemicals are located in flood-prone 

areas across the country. It is clear that far more remains to be 

done to ensure chemical facilities are truly resilient to this growing 

threat. 

Mr. Chairman, I also believe we must examine Federal chemical 

safety and security policy holistically. We can’t turn a blind eye to 

the administration’s actions to undermine the efficacy of EPA’s 

RMP program. Preventing terrorism at these facilities is important, 

but accidents and industrial incidents due to extreme weather are 

far more common and they should also be given due consideration 

by this committee. 

We have to ensure the safety and security of workers, first responders, and communities living near our nation’s chemical facilities are being prepared on both fronts. 

And with that, Mr. Chairman—I don’t think anybody wants my 

time—I’ll yield back. 

Mr. MCKINLEY [presiding]. Thank you, and absent the chairman 

of the full committee, we will now conclude the members’ opening 

remarks. 

7 

The chair would like to remind our members that pursuant to 

the committee rules, all members’ opening statements be made 

part of the record. 

[The prepared statement of Mr. Walden follows:] 

PREPARED STATEMENT OF HON. GREG WALDEN

Good morning, Mr. Chairman, and thank you for yielding me this time. 

I am glad you have decided to have an oversight hearing on the Chemical Facility 

Anti-Terrorism Standards program—or CFATS, which is a program the Committee 

has been overseeing since its inception. This hearing continues Energy and Commerce’s work this month on Federal preparedness laws for deliberate events—like 

last week’s hearing on pandemic and health hazard preparedness and response and 

tomorrow’s hearing examining the federal reaction to biological attacks. 

In the wake of the terrorist attacks of September 11th, Congress assessed Federal 

authority to address theft, diversion, and terrorism at chemical facilities and decided accident prevention and process safety laws were insufficient to tackle these 

malicious, and intentional acts. Instead, Congress decided a separate and distinct 

body of law and requirements were needed for security purposes. Leaving the Clean 

Air Act to address general safety and accident concerns, Congress used CFATS to 

fill legal gaps in addressing intentional acts against this critical infrastructure sector. In addition, to avoid overlapping with other Federal programs, CFATS was designed to foster collaboration between the government and regulated parties. 

Since each chemical facility faces different security challenges, CFATS established 

18 layered, risk-based performance standards for security at chemical facilities. It 

is important to point out that CFATS is a program that not only covers huge chemical and petrochemical complexes, but also race tracks, wineries and breweries, universities and colleges, and hospitals and health care providers—3,400 hundred facilities in all. 

However, the CFATS program had to overcome some tough years. While there 

have not been any documented attacks on these facilities to date, the program has 

suffered in the past from poor accomplishment numbers, inadequate support from 

senior DHS officials, management and workforce issues, and a lack of transparency 

about the program, especially with the stakeholder community. Since we last heard 

from DHS on the status of CFATS, the Department has had four years to correct 

the program and I understand DHS has been steadily making progress on these 

areas. I am eager to find out first-hand what that means, not just from DHS, but 

from some of its past critics—the Government Accountability Office and the regulated community. 

CFATS must provide value to taxpayers, the Federal government, and the facilities that could fall victim to intentional attacks. To do that, it needs to not just focus 

on its outputs and become highly proficient at those but stay in its lane and not 

try to emulate or replicate other laws whose primary purpose is safety, not security. 

I want to welcome our witnesses for being with us today and thank them for sharing their views with us. 

With that, Mr. Chairman, I yield back the balance of my time. 

Mr. MCKINLEY. We wish to thank all of our witnesses for being 

here today, taking the time to testify before this subcommittee. 

Today’s witnesses, beginning with the first panel, will have the 

opportunity to give opening statements followed by a round of 

questions. You know how this works. 

Our first witness panel for today’s hearing includes Mr. David 

Wulf, the Acting Assistant Secretary for Infrastructure Protection 

with the Department of Homeland Security. 

Mr. Wulf, we appreciate you being here today and we will begin 

the program with you and you’re recognized for your 5 minutes to 

make an opening statement. 

8 

STATEMENT OF DAVE WULF, ACTING DEPUTY ASSISTANT SECRETARY, INFRASTRUCTURE PROTECTION, U.S. DEPARTMENT OF HOMELAND SECURITY 

STATEMENT OF DAVE WULF 

Mr. WULF. Thank you so much, Mr. Chairman. I really do appreciate the opportunity to be here and thanks as well to Ranking 

Member Tonko and other members of this committee. 

I am excited to be here to provide an update on the progress that 

the Chemical Facility Anti-Terrorism Standards, or CFATS program, continues to make in fostering security at high-risk chemical 

facilities across this nation. 

When I last testified before this committee in 2013, no question 

but that the CFATS program was in a very different place, having 

experienced some significant difficulties in its early years. But we 

had at that point implemented a comprehensive corrective action 

plan and had begun making measurable forward progress. 

At the time, I emphasized the importance of long-term authorization for this critical anti-terrorism program and I am very grateful 

for the leadership that you all provided—that this committee demonstrated in securing the 4-year CFATS authorization that was 

signed into law in December of 2014. 

So as we now find ourselves nearly 3 1⁄2 years into the authorization period, I am grateful that this committee is, again, taking a 

lead role in ensuring continuing long-term authorization of CFATS. 

Now, as I am sure you’ll hear me say once or twice today, the 

stability that has come along with long-term authorization has 

driven unprecedented progress as we have worked with CFATScovered facilities to make America’s high-risk chemical infrastructure a truly hard target with literally tens of thousands of security 

measures having been put in place at high-risk chemical facilities 

across the nation. 

So the stability afforded by long-term authorization has facilitated our planning and execution of important programmatic improvements while it has also afforded regulated industry stakeholders with the certainty they deserved as they planned for and 

made significant investments in CFATS-related security measures. 

I am very pleased that you’ll be hearing today directly from 

CFATS industry stakeholders about their direct experience with 

CFATS. Doug Brown, Jamie Conrad, Steve Roberts, along with a 

host of industry associations, have been true leaders in promoting 

a strong culture of chemical security across the Nation and I really 

appreciate their presence and that of the other witnesses here 

today. 

As we are all too aware, the threat of chemical terrorism remains 

a real and very relevant one. Around the globe, we continue to see 

bad actors seeking to acquire and using in attacks chemicals of the 

sort that trigger coverage under CFATS and the threat stream continues to reflect that chemical facilities themselves remain an attractive target for terrorist. 

I can tell you with certainty that the work we are doing in concert with our committed stakeholders across the wide variety of industries and facilities that compose the CFATS-covered universe is 

making a real difference in protecting the nation, and having had 

9 

the opportunity to work closely with my counterparts in other nations and to co-chair the G-7 Global Partnerships’ Chemical Security Working Group, I can absolutely tell you that what we are 

doing here in the United States through CFATS what you have 

helped build with your support for long-term authorization is absolutely the envy of the world. 

With its 18 comprehensive risk-based performance standards and 

its nonprescriptive flexible approach, CFATS is well suited to enhancing security across the very diverse universe of high-risk 

chemical facilities. 

So what have we been doing to make CFATS even stronger as 

we have enjoyed the stability of long-term authorization over the 

past 3 1⁄2 years? 

Well, we have improved processes and we have seen unprecedented progress in the pace of inspections and in the review and 

approval of facility site security plans, eliminating a backlog of security plan reviews 6 years ahead of earlier GAO projections. 

We have developed and launched an improved risk assessment 

methodology that effectively accounts for all relevant elements of 

risk and have reassessed the level of risk associated with nearly 

30,000 facilities across the Nation. 

We have implemented the CFATS personnel surety program, affording the highest tiered CFATS-covered facilities the ability to 

ensure that individuals with access to those facilities have been 

vetted for terrorist ties and we have significantly reduced burden 

across our stakeholder community, having built and launched a 

streamlined more user-friendly suite of online tools through which 

facilities submit risk assessment or top-screen surveys and develop 

their site security plans. 

So in addition to facilitating all this progress, long-term authorization as compared to our former reality of authorization through 

the annual appropriations process enabled us to continue to recruit 

and retain top talent and it reduced the possibility of another lapse 

in authority such as occurred during the October 2013 government 

shut down. 

In addition to the confusion this situation created among our industry stakeholders, the need had arisen for us to take enforcement action to address the national security threat at a CFATS facility during this period of lapse in appropriations. The underlying 

statutory authority for such enforcement action would have been in 

doubt. 

I know this is not a situation that anyone wants to see repeated. 

So to finish on a bit more of a positive note, I would, again, like 

to thank this committee and your top-notch staff for your leadership in the CFATS reauthorization process. 

We are fond of saying that chemical security is a shared commitment and, not unlike the role of our industry stakeholders who 

have embraced and helped us to build this program in so many 

ways and the role of our committed and very talented team at 

DHS, the role of Congress and of this committee in shaping and 

authorizing CFATS for the long term has been hugely important 

and I am looking forward to working further with you as we drive 

toward reauthorization this year. 

10 

So thank you so much, Mr. Chairman. I look forward to your 

questions and to the dialogue here today. 

[The prepared statement of Mr. Wulf follows:] 

11 


34591.001

Written Testimony 

of 

David Wulf 

I\cting Deputy Assistant Secretary for Infrastructure Protection 

National Protection and Programs Directorate 

U.S. Department of Homeland Security 

Before the 

United States House of Representatives 

Committee on Energy and Commerce Subcommittee 

On the Environment 

Regarding 

The Chemical Facility Anti-Terrorism Standards Program 

June 14, 2018 
12 


34591.002

Introduction 

Chairman Shimkus, Ranking Member Tonka, Members of the subcommittee, 

I appreciate the opportunity to appear before you today to discuss the development and 

maturation of the Department of Homeland Security's (DHS) regulation of high-risk chemical 

facilities under the Chemical Facility Anti-Terrorism Standards (CFATS) Program. 

Threat Landscape 

Chemicals are vital to our way of life, to include a strong economy. They arc used to 

develop medicines that maintain our health, provide refrigeration for our food supply, 

manufacture fuel for our vehicles and build the microchips that run our smartphones. Despite 

these benefits, the usc of chemicals does not come without risk. 

The CF A TS Program was born out of the recognition that, though we had worked hard to 

strengthen our homeland security in the atlermath of the September II, 200 I attacks, the Nation 

continued to face very real threats. In particular, it was noted by Congress that in the hands of 

terrorists or others seeking to do us harm, chemicals can cause death and mass casualties. 

Moreover, Congress noted that security gaps at chemical facilities had left our Nation vulnerable 

to the illicit acquisition and use of chemicals in attacks. It was this recognition that led Congress 

to establish the CFATS Program under Section 550 of the Homeland Security Appropriations 

Act for Fiscal Year 2007. 

As we are all too aware, we live in a dynamic threat environment and the threat of a 

terrorist attack using chemicals is as real and relevant today as it was when CF A TS was first 

created. We continue to see potential adversaries around the world seeking out and using in 

attacks such chemicals that arc regulated under CFA TS. We need look no further than to the 

2 
13 


34591.003

continuing threat streams, the intelligence community assessments, and incidents in Belgium, 

Syria, France, and the United Kingdom, to know that this is not a time to stop addressing the 

security threat posed by chemicals. 

The CFATS Program is a vital part of our Nation's counterterrorism efforts as we work 

with industry stakeholders to keep dangerous chemicals out of the hands of those who wish to do 

us harm. Since the CF A TS Program was created, we have engaged with industry to identify and 

regulate chemical facilities that are at the highest risk of terrorist attack or exploitation and to 

ensure that these facilities have security measures in place to reduce the risks associated with the 

possession of chemicals. As a result of implementation of the CF A TS Program, the level of 

security across the chemical industry has significantly increased, not only making a successful 

attack on a chemical facility more difficult, but also serving as a significant deterrent to 

adversaries who might seck to attack facilities or acquire chemicals for use in an offsite terrorist 

attack. 

CFATS Act of2014 Afforded Stability and Certainty 

In December 2014, Congress passed the Protecting and Securing Chemical 

Facilities .from Terrorist Attacks Act of 20/.f (CFATS Act of 2014). This statute, which 

enjoyed strong stakeholder support, brought stability for both the Department and the 

regulated community and provided stakeholders with confidence in the program's future. 

Until the passage of that legislation and its four-year authorization, the program had been 

authorized through appropriations legislation--from fiscal year to fiscal year (or even 

more challenging, from continuing resolution to continuing resolution). Subjecting this 

important anti-terrorism program to the vicissitudes of the appropriations process put our 

3 
14 


34591.004

nation at risk, as evidenced by the funding lapse in October 2013. During this lapse, not 

only did the programmatic activities of CFATS cease, its authorization also expired. This 

gap caused many facilities to question whether the program's provisions were still in 

effect and the Department to question whether it had the authority to take enforcement 

action had there been an exigent need or imminent threat. Enacting a multi-year CF A TS 

authorization as Congress did in 2014 marked an important turning point for the program. 

Among other things, it: 

• Provided industry stakeholders with the certainty they needed to plan for and 

invest in CF A TS-related security measures to harden their critical sites against 

possible terrorist attack or exploitation; 

• Afforded the stability needed to enable the Department to make programmatic 

improvements as well as strategic, long-term planning decisions regarding 

staffing, program development, and process efficiency; and 

• Sent a clear message to potentially-covered facilities storing and utilizing 

threshold quantities of dangerous chemicals that the CF ATS Program is here 

to stay. 

With long-tcnn authorization, chemical facilities have become further incentivized to 

engage with the Department with regard to facility security. Returning to the instability of shortterm renewal of CF A TS would represent a significant step backwards for the Nation's chemical 

security efforts, inhibit long-term planning, and undermine stakeholder confidence in the 

longevity of the program. 

4 
15 


34591.005

CFATS Program Overview 

The cornerstone of the CFATS Program is the development, submission, and 

implementation of Site Security Plans (SSPs), or Alternative Security Programs in lieu of 

SSPs that document the security measures that high-risk chemical facilities utilize to satisfy 

the applicable Risk-Based Performance Standards (RBPS) under CFATS. Due to the diversity 

of facilities that hold chemicals of interest, it is important to note that these plans are not "onesize-fits-all," but are in-depth, highly customized, and account for each facility's unique 

circumstances and risks. 

In order to determine whether a facility is covered under CF A TS, the facility submits a 

Top-Screen to the Department's Infrastructure Security Compliance Division within the 

National Programs and Protection Directorate's Office of Infrastructure Protection. Since we 

began collecting this information in 2007, more than 40,000 facilities have reported chemical 

holdings. Based on the information received in the Top-Screens, DHS determines which 

facilities are at high-risk of terrorist attack or exploitation and assigns each of these to a tier. 

Facilities determined to be high-risk must submit a Security Vulnerability Assessment 

(SV A) and SSP or Alternative Security Program to DHS for approval. The plan must include 

security measures that address the 18 RBPS established by DHS. The Department performs an 

authorization inspection at the facility prior to granting a security plan approval to ensure that 

the measures contained in the security plan are appropriate given the facility's specific 

security issues and unique characteristics. CF A TS has been established as a non-prescriptive 

regulatory framework, which means that a chemical facility has flexibility to work with Df!S 

to negotiate security measures that are uniquely tailored to the circumstances of the individual 

facility. This makes CFATS particularly well-suited to addressing the diversity of the universe 

5 
16 


34591.006

of covered chemical facilities-which includes not only traditional chemical manufacturers 

and distributors, but oil refineries, semiconductor-fabrication plants, and university labs, 

among many others. Once a facility's plan is approved, DHS conducts regular compliance 

inspections to verify that the facility is implementing the agreed-upon security measures. 

Accomplishments Since the CFATS Act of2014 

Due in large part to the stability afforded by passage of the CFA TS Act of 2014, I am 

happy to report today that much has been accomplished in the past four years and that our 

program continues to make significant forward progress. Through the collective efforts of our 

dedicated Federal workforce, industry and other stakeholders, and the leadership of Congress, 

the CF A TS program has matured significantly in this time and is poised to continue this progress 

in the coming years. 

Clearing the SSP Backlog and Moving into "Steady-State" 

In July 2016, after more than 6,000 inspections and Compliance Assistance Visits, and 

review of nearly 3,000 SSPs; I approved an SSP which marked a milestone for the CF ATS 

program. This approval, after three years of concerted effort to move the CF A TS program 

forward, effectively eliminated the backlog of SSP reviews six years ahead of GAO projections. 

With this achievement, we transitioned from "start up" to a more mature "steady-state" 

posture, and are now able to more fully focus on conducting compliance inspections and building 

a stronger culture of security. Whereas previously our inspections were overwhelmingly of the 

pre-approval Authorization Inspection variety, now the majority of the inspections we are 

conducting are post-security plan-approval Compliance Inspections (Cl). To illustrate how far 

6 
17 


34591.007

we have come in this regard, at the end of fiscal year 2013, the Department had completed only 

one compliance inspection. Since that time, the Department has conducted 3,552 compliance 

inspections. I'm pleased to note that, nearly across the board, the results of these inspections 

have been positive. Facilities across the nation are effectively executing their comprehensive 

CFATS SSPs. Where issues have been identified during inspections, they have nearly always 

been quickly remedied; where needed, however, we have utilized our enforcement authorities to 

incentivize compliance. 

Enhanced Risk Tiering Methodology and Chemical Security Assessment Tool (CSAT) 

Version 2.0 

In the fall of2016, the Department launched an enhanced risk-assessment and tiering 

methodology that more-fully accounts for all elements of risk and addresses statutory 

requirements laid out in the Protecting and Securing Chemical Facilitiesfrom Terrorist Attacks 

Act of 2014. The result of three years of work by DHS risk experts, the methodology has 

benefited from and has been informed by analysis and input from panels of external experts from 

industry, government, and academia. Sandia National Laboratories has also performed an 

independent validation. 

The enhanced tiering methodology uses a scientifically-supported approach to calculate 

each facility's risk as a function of information related to terrorist threat, the facility's inherent 

vulnerabilities, and the potential consequences of a terrorist attack. Enhancements include the 

addition of physics-based models for chemicals that are susceptible to being taken offsite and 

used in an attack, updates to the threat model informed by intelligence, and improvements to the 

7 
18 


34591.008

population modeling for release facilities. We believe that these changes make this methodology 

a more accurate reflection of a facility's risk. 

All facilities with holdings of chemicals of interest have been asked to resubmit 

information to inform a risk-assessment using the new methodology. To date, nearly all 28,000 

facilities that had previously reported holdings of chemicals of interest at or above the screening 

threshold quantity have submitted a revised Top-Screen. All Top-Screens receive an eyes-on 

quality assurance review to ensure the data reported makes sense for the type of chemical and 

facility reporting. In cases in which there are concerns with the data reported, the Infrastructure 

Security Compliance Division contacts the facility for clarifications. When necessary, the facility 

is asked to make corrections to appropriately reflect the data. 

The Department began issuing tiering determination letters using the enhanced 

methodology on April4, 2017. We anticipate that we will have tiered the entire current 

population of chemical facilities of interest using the new methodology by October 2018. Having 

received almost nearly all revised Top-Screens and having completed analysis on those facilities, 

we have seen a shift in the populations as follows: 

All facilities that were high-risk (Tier 1-4) have been notified of their revised tier. 

Approximately 36% of the previous high-risk population has remained at the 

same risk tier. 

Approximately 48% of the previous high-risk population has moved from one tier 

to another tier. 

Approximately 15% of the previous high-risk population has been determined not 

to be high-risk. 

8 
19 


34591.009

Approximately 4% of the previous not high-risk population has been determined 

to be high-risk. 

In concert with this re-tiering effort, the Department also deployed CSAT 2.0, a 

streamlined, user-friendly update to its online portal and Top-Screen, SV A, and SSP suite of 

online reporting tools. The CSAT 2.0 Top-Screen collects the data necessary to process facilities 

through the enhanced tiering engine and improves the integration between the CSA T SV A 

application and the CSAT SSP application, which has resulted in a dramatically simplified 

experience for facilities submitting Top-Screens, SV As, and SSPs. 

As an example, under the previous format, completing a Top-Screen was estimated to 

take just over 11 hours. The current format has reduced that to just six hours. In addition, 

building upon lessons learned over the life of the program, the Department eliminated 

duplication and reduced the number of questions on the SV A and SSP questionnaires by more 

than half. 

Personnel Surety Program 

Vetting individuals who have access to chemicals of interest and other sensitive parts of 

high-risk chemical facilities is a key aspect of facility security. Under RBPS 12, Personnel 

Surety, facilities must implement (1) measures to verify and validate identity, (2) check criminal 

history, (3) validate legal authorization to work in the United States, and (4) identify individuals 

with terrorist ties. While all tier 1 through 4 facilities have been implementing the first three 

elements ofRPBS 12, the Department began working with tier I and tier 2 facilities to 

implement the fourth element in December 2015 after the Office of Management and Budget 

9 
20 


34591.010

approved the Department's Information Collection Request for the CF A TS Personnel Surety 

Program (RPBS 12(iv)). 

This approval closed a critical gap by allowing facilities in these two tiers to submit 

names to DHS for vetting individuals' potential terrorist ties. Going forward, the Department is 

planning on expanding its implementation to tiers 3 and 4. The Department is in the process of 

requesting approval, through the Paperwork Reduction Act process, to collect information about 

individuals who have or who are seeking access to high-risk chemical facilities for all four tiers. 

In anticipation of this request, the Department published a 60-day notice in December of2017 

and will be publishing a 30-day notice soon. 

Extensive Stakeholder Engagement 

Recognizing that chemical security is a shared responsibility, we continue to 

prioritize outreach to various stakeholder communities-including relevant industries and 

organizations, but also with a specific emphasis on first responders and emergency 

managers with the aim of ensuring that information is flowing to those who have a need 

to know about high-risk chemical facilities in their jurisdictions. By the end of fiscal year 

2017, DHS had conducted outreach with more than 1,200 state and local offices and 

I ,400 Local/Tribal Emergency Planning Committees (LEPCsffEPCs) in all U.S. states 

and territories. Specifically, we reached nearly all State Homeland Security Advisors (or 

their representatives), State Fire Marshals, and State Public Safety officials and we plan 

to continue these engagements on a recurring basis. Further, the Department regularly 

participates and presents at State Emergency Response Commission meetings, Area 

Maritime Security Meetings, and IIAZMA T conferences. 

10 
21 


34591.011

The Department prioritizes engagement with LEPCs based on the existence of 

CFATS covered facilities in their counties as well as their level of activity. Further, we 

work to build relationships with less-robust LEPCs/TEPCs to create future opportunities 

for providing presentations/briefings on CF A TS-program requirements and resources. 

Also, outreach to first responders is incorporated into the development of site 

security plans through Risk Based Performance Standard 9 (RBPS 9) - Response. This 

standard requires covered facilities to have a documented, comprehensive crisis 

management plan that details how the facility will respond to security incidents and 

requires that the facility run exercises and drills-and make contact with local firstresponders--to improve its ability to implement these provisions. DHS verifies this 

outreach during on-site compliance inspections. In many instances, the Department has 

facilitated contact between the first responders and the facilities. 

The Road Ahead and Reauthorization 

Four years ago, in my testimony at CFATS-focused hearings, I outlined the 

improvements we had made and assured the Congress that we would move forward strategically 

and aggressively to address the challenges that remained. Today, I am proud to say that we have 

made good on that assurance. The CFA TS universe is as diverse as the world of regulated 

chemicals. The program's non-prescriptive, flexible design allows each regulated facility to 

customize security measures, while also meeting the required risk based performance standards. 

Through CFA TS and the hard work of our industry stakeholders who continue to harden 

America's highest-risk chemical facilities, we have collectively accomplished much since 2014. 

II 
22 


34591.012

This progress would not have been possible without the stability and certainty afforded by 

enactment of the CFATS Act of2014. 

Long term reauthorization will allow the Department and the chemical security 

community to continue to work together to secure the Nation's chemicals and keep them out of 

the hands of terrorists. The Department will be able to continue to focus on pursuing more 

efficient ways to implement the program, to include the enhancement of existing materials and 

tools, while industry will have the confidence to continue to make important investments in 

security. 

Chemical security is very much a pressing need and must remain a continuing high 

priority for the nation in view of the threat environment. The CF A TS program has positioned the 

United States as world-leaders in building the culture of security necessary to secure our nation's 

highest-risk chemical facilities. I look forward to working with this Committee to chart a path 

towards permanent reauthorization of this critical national security program, and I thank you in 

advance for your continuing leadership in this regard. I look forward to your questions. 

12 
23 

Mr. MCKINLEY. Thank you for your testimony, Mr. Wulf, and if 

I could recognize myself for 5 minutes to begin the round of questioning. 

Mr. Wulf, last time you testified before the committee one of the 

key issues identified by GAO regarding CFATS was Homeland Security’s approach to calculating risks and in fact they concluded 

DHS did not take into consideration all the elements and consequences of threat risk and vulnerability. 

Your written testimony mentions an enhanced risk assessment 

and tiered methodology that Homeland Security believes more accurately reflects a facility risk. 

Has DHS changed its policy to risk analysis? 

Mr. WULF. Yes. In fact, Mr. Chairman, we have. 

So we took very seriously the dialogue we had with this committee—took very seriously the recommendations we received from 

GAO, recognizing that our previous risk-tiering methodology was 

not as comprehensive as they could have been. It was very focused 

on the consequences of terrorist attacks and less so on vulnerability 

and threat. 

We commissioned a peer review with a committee drawn from a 

panel of experts from across academia, government partners, and 

industry. We received some excellent recommendations as to ways 

in which we could enhance our risk-tiering methodology and we set 

about doing just that. 

So in the fall of 2016, we did in fact launch a new and improved 

risk-tiering methodology that accounts for all relevant elements of 

risk. So consequence, vulnerability, and threat, and we set about 

retiering the universe of chemical facilities against that new tiering 

methodology. 

Mr. MCKINLEY. With this tiering methodology, I am just curious—has it been peer reviewed what you’ve done on that methodology? 

Mr. WULF. Yes. It sure has. So after we developed the methodology we drew together another group of experts, again, from 

across government academia and our industry community to go 

over the methodology—to make recommendations for potential 

tweaks before we finalized the methodology. 

And following that, we embarked upon a verification and validation process that was conducted by Sandia National Labs, which 

advised us that our methodology was in fact sound, was working 

as intended, and at that point, we launched upon the retiering 

process. 

Mr. MCKINLEY. Again, back on the tiers, Mr. Wulf, almost half 

the group changed tiers onto this new methodology. Fifteen percent 

apparently left the program and four became newly regulated. 

And so my question is, is what quality reviews and are there updates occurring to make sure that you are appropriately tiering everybody that should be in the system and, as the engineering room 

counts up the numbers, your numbers total over 100 percent. So 

I am curious if there is a discrepancy in your math. 

Mr. WULF. That is a good question. So I would say the way to 

look at the math is, looking at the number of facilities that had 

been previously tiered, that group should add up to 100 percent. 

24 

So of that group, about 36 percent of previously tiered high-risk 

facilities stayed put at the same tier level. 

About 48 percent, as I think you mentioned, moved across tiers 

from one tier to another and about 15 percent of that previously 

tiered population was determined to be no longer high risk, using 

the new methodology, and fell out of the high-risk category. 

So those three numbers add up to 100 percent when you take 

into account the decimals. The additional 4 percent is from the population that had previously been not determined to be high risk— 

those previously untiered facilities. Four percent of those were subsequently determined under the new methodology to be high risk 

and moved into the risk tiers. 

Mr. MCKINLEY. Just in the time that remains—the 30 some seconds—how do we have confidence that you’re appropriately tiering 

people, risk-tiering companies. 

Mr. WULF. So, the risk-tiering methodology is a sound one and 

is very robust and now takes into account all relevant elements of 

risk. 

We have built a system in which human eyes look at tiering for 

each facility as we move through the process and before a final 

tiering decision is issued and if anything looks off—if it appears as 

though a facility might have submitted information in a way that 

doesn’t quite make sense, we are able to reach out directly through 

our field inspectors, through our compliance case managers directly, to the facility to resolve any discrepancies and to ensure 

that we are in fact issuing the correct tier. 

Mr. MCKINLEY. Thank you. Thank you for my question. 

Now, recognize the ranking member, Mr. Tonko from New York, 

for 5 minutes. 

Mr. TONKO. Thank you, Mr. Chair. 

And Mr. Wulf, again, welcome and thank you for your testimony. 

I commend you on the progress that has been made over the recent 

years. 

I believe, however there are ways we can continue to reduce risks 

and improve the program. I want to reference a few issues that 

came up when DHS last testified before this committee on the 

CFATS program. This includes the importance of closing security 

gaps. Is it true that drinking water and wastewater facilities are 

statutorily exempt from the CFATS program? 

Mr. WULF. Water and wastewater facilities are among the statutory exemptions along with facilities regulated by our friends in the 

Coast Guard through the NHTSA program and a handful of other 

exemptions. 

Mr. TONKO. Thank you. And do you think they were exempted 

because there are no risks of terrorist attacks at these sites? 

Mr. WULF. I was not here when when that exemption went into 

effect. Certainly, I think it might be worth studying what gaps may 

exist in that arena. I think that might be a sound next step. 

Mr. TONKO. OK. And is it true that nuclear facilities are also 

statutorily exempt from the CFATS program? 

Mr. WULF. Facilities regulated by the NRC are exempt. 

Mr. TONKO. And what about Federal facilities that have large 

amounts of chemicals of interest? Are they exempt? 

25 

Mr. WULF. Facilities owned and operated by the Department of 

Energy and the Department of Defense, both of which have robust 

standards and audit controls of their own, are exempt as well. 

Mr. TONKO. Just because a facility is not covered by CFATS does 

that mean it is not a potential target by terrorists? Should these 

sites be monitored at all? 

Mr. WULF. So, CFATS is very focused. It is a risk-based program. 

It is targeted at the highest—those facilities that are assessed to 

be at the highest risk of terrorist attack or exploitation so I think 

it is an appropriate targeting of our best resources to the facilities 

that are at the highest risk. 

That is certainly not to say that other facilities do not present 

a risk. We have within the Department of Homeland Security a 

suite of voluntary tools and resources that are available to other 

chemical facilities through our chemical sector-specific agency. 

We have protective security advisors who work with facilities on 

a voluntary basis across the Nation every day. So yes, certainly—— 

Mr. TONKO. But that’s statutorily imposed. So—— 

Mr. WULF. Yes. Those are not a statutory requirement. 

Mr. TONKO. OK. Obviously, there are very different security and 

regulatory regimes at nuclear facilities—Federal facilities—and 

other sites that have received exemptions. 

But in the past, DHS has expressed concerns over the gaps created by these exemptions. A number of years ago, DHS testified 

that the administration’s position to support closing security gaps 

at drinking water and waste water facilities—is that still the administration’s position? 

Mr. WULF. I think I would have to take that back. 

Mr. TONKO. OK. And does the administration still support maintaining EPA as the lead agency for drinking water and waste water 

facility security with the DHS supporting EPA’s efforts? 

Mr. WULF. I think that is another one we would need to take 

back. 

Mr. TONKO. All right. If you can get back to the committee, 

please. 

And can you explain how DHS has worked with EPA in recent 

years to encourage improvements in chemical security at water facilities? 

Mr. WULF. So I can speak more broadly to the work we have 

done with EPA across the chemical sector. So as you probably 

know, in the wake of the tragic explosion at west Texas, an Executive order on improving chemical security safety and security was 

issued. 

In implementing that order, we developed a national working 

group composed of us at DHS along with EPA, OSHA, Bureau of 

Alcohol, Tobacco, Firearms, and Explosives and others with a role 

in assuring chemical facility safety and security. 

We took steps to ensure that we were sharing information as 

fully as possibly, comparing notes on inspections, comparing notes 

on facilities that existed in our relative respective jurisdictions and 

ensuring that word was getting out as widely as possible about all 

of the different regulatory and other requirements. 

Mr. TONKO. OK. I would simply encourage the committee to consider how we might close some of these security gaps before we deVerDate Nov 24 2008 15:21 Feb 08, 2019 Jkt 037690 PO 00000 Frm 00029 Fmt 6633 Sfmt 6633 I:\MY DOCS\HEARINGS 115\HEARINGS\115-138 CHRIS
26 

bate creating new ones through additional exemptions and I think 

it’s important that we have this holistic approach to cover everyone 

that might be impacted. 

With that, I yield back, Mr. Chair. 

Mr. MCKINLEY. Thank you. 

And now I recognize my colleague from Mississippi, Mr. Harper, 

for 5 minutes. 

Mr. HARPER. Thank you, Mr. Chairman. 

Mr. Wulf, thank you for your time being here, and we appreciate 

it. It’s such an important issue and topic for us to continue to look 

at and we know that we all want to be on the same page here on 

where we go, what we look at, and how we try to strengthen this 

in the future. 

One of the issues that was identified by the GAO, and also a second witness that will be on the next panel, as a place that needed 

improvement was compliance, inspections, and enforcement, and 

I’d like to know what steps DHS has taken to improve in this area. 

Mr. WULF. I appreciate the question. We have made really unprecedented progress in our conduct of inspections in our review 

and adjudication of site security plans and have moved as well in— 

as a result have enclosed the backlog of site security plan reviews 

and adjudications. 

We have moved now into steady state phase of the program. So, 

more than 90 percent of the inspections we are now conducting for 

post site security plan approval, compliance inspection, variety of 

inspections. So we have developed standard operating procedures 

for these inspections and I will say that the inspections that are 

happening across the country are going well almost across the 

board. 

Facilities are taking seriously their obligation to implement their 

site security plans. They are putting in place planned or new security measures in accordance with agreed upon timelines where 

issues are being identified or found by inspectors. 

Nearly always they are being resolved quickly and in good faith 

by the facility. We are not hesitant though where needed to use the 

enforcement authorities with which we have been entrusted. 

But our overwhelming bias continues to be to work with facilities 

that are working with us in good faith to come into compliance. 

Mr. HARPER. Mr. Wulf, let’s talk about your—the inspectors for 

just a moment. Is there a—does DHS have minimum qualification 

requirements for inspectors so they could demonstrate the knowledge and understanding of the facilities that they encounter and 

relevant guidance on enforcement requirements. 

Do you have the minimum qualifications there and, if yes, will 

you provide the committee any written items the department has 

governing inspector qualifications and training? 

Mr. WULF. Glad to do that, sir, and absolutely, we have minimum standards—a pretty high bar for those standards as well for 

our inspectors who go through a comprehensive training program 

when they first come on board at DHS and to whom we provide advanced training throughout their careers on specific topics such as 

cybersecurity or personnel surety background check focused program among many others. 

27 

There is an exam at the end of the basic training and it is rigorous. We also focus heavily on on-the-job training and on fostering 

consistency across our inspector cadre and the inspections they conduct. 

We have put in place relatively recently a group of senior inspectors in each of our 10 regions and their job is to foster training, 

the development of our inspector cadre and to ensure that we are 

working in a consistent way. But absolutely glad to provide you information. 

Mr. HARPER. And that would be great. Obviously, the goal here 

is that if you had any inspector come in to any facility that there 

would be a consistent review and finding, do you sense that the ongoing training for those inspectors is going to meet that? 

Mr. WULF. Yes, I do. I think, it’s never completely perfect. We 

strive for absolute consistency. We appreciate the feedback we receive from our industry stakeholders, many of whom own and operate companies that have facilities in different parts of the country 

and, if we hear things are perhaps a little different in one part of 

the country than the other, we work quickly to address that. 

In some cases there are reasons for that. It may be that, one of 

the kind of game changing things we have done as an organization 

is to begin to take more of a corporate approach to inspections. 

So we are looking at a number of issues at the corporate headquarters level so if there are policies that apply across facilities it 

may be that a company’s facility that is hit from an inspection 

standpoint early on in the process it might appear to that facility 

that it’s getting a little more thorough treatment than one that’s 

hit later in the process. But that is likely only because we have 

—— Mr. HARPER. My time has expired, Mr. Wulf. My time has expired. Thank you so much, and I yield back. 

Mr. WULF. Thank you so much. 

Mr. MCKINLEY. Thank you, and now 5 yield 5 minutes to one of 

my latest friends, Mr. Peters from California, for 5 minutes. 

Mr. PETERS. Thank you, Mr. Chairman. 

Thank you, Mr. Wulf, for being here today. I want to commend 

you for the improvements in the CFATS program over the last few 

years. 

A longer-term authorization or focus on fixing the known deficiencies in program management have helped to eliminate the site 

security plan backlog and start the process of compliance inspections. 

However, a program can only be as good as the statute that authorized it. So I wanted to talk a little bit about how we might improve the statute, if you thought that was useful, starting with effective enforcement. 

In your testimony, you note that where issues have been identified during inspections they have nearly always been quickly remedied where needed. However, we have utilized our enforcement 

authorities to incentivize compliance. 

So can you explain to me, Mr. Wulf, what kind of types of enforcement mechanisms you’ve been able to use under the program? 

Mr. WULF. So yes, I appreciate the question. So the enforcement 

process within the program I think is in line with the flexible nonVerDate Nov 24 2008 15:21 Feb 08, 2019 Jkt 037690 PO 00000 Frm 00031 Fmt 6633 Sfmt 6633 I:\MY DOCS\HEARINGS 115\HEARINGS\115-138 CHRIS
28 

prescriptive approach to the program and our general orientation 

to work with facilities to foster compliance. 

So where issues are identified on inspections, we work with a facility, assuming the facility is working with us in good faith to resolve them. 

So, occasionally, if, for instance, a planned measure that has 

been agreed in the site security plan to be put into place on a certain timeline has slipped on that timeline, it may be that there has 

been a change in personnel, sort of a lack of understanding of what 

was in the site security plan. 

We will work on an agreeable quick time frame to get that 

planned measure in place and frequently those sorts of things are 

resolved at that point. 

If we get into the enforcement structure it is a two-step process. 

The first step involves the issuance of essentially, a notice of noncompliance, which gives a facility formally a certain period of time, 

generally, not too much time to come into compliance and I am 

pleased to say before a penalty order is issued—I am pleased to say 

that 95 percent of the cases that is enough to bring the facility into 

compliance. 

Where if we get to a point where a facility has run through that 

period we will go ahead and issue a penalty order. We do take into 

account facility status as potentially, a small business, a facility’s 

ability to pay in determining the ultimate penalty. 

It’s only happened in a small number of cases. 

Mr. PETERS. I was going to ask you, so how many times have you 

had to use penalties or cease operation orders for facilities that 

aren’t executing their—— 

Mr. WULF. So we have issued penalty orders in three instances 

at this point. 

Mr. PETERS. Three instances. OK. 

So that’s the number of times you had to enforce against a noncompliant facility? 

Mr. WULF. That’s the number of times we have gotten to the 

point of—— 

Mr. PETERS. To that point, right. 

Mr. WULF. A penalty, probably in about 70 occasions begun the 

process. 

Mr. PETERS. Great. And do you see that the bill that acts as it’s 

written—does it give you enough authority to do what you have to 

do? It sounds like that’s going fairly well. 

Mr. WULF. I believe that we have the authority that we need to 

do to foster security at America’s highest-risk chemical facilities. 

I think it is a regulatory framework that is really well suited to 

the mission at hand and to the diversity of America’s chemical infrastructure. 

Mr. PETERS. Great. Just one other topic then—the effective and 

adequate enforcement mechanisms are crucial to preventing noncompliance. We saw the dangers of noncompliance when the West 

Fertilizer Company in West, Texas exploded. 

Facilities that don’t report their holdings to DHS and are otherwise not identified to the department still pose a risk to workers, 

first responders, and surrounding communities. 

29 

What kind of steps have you taken to address the problem of 

these so-called outlier facilities? 

Mr. WULF. Yes. So, certainly, a high priority for us, ensuring 

that we are getting the word out as widely as possible to facilities 

about their obligations to report information to us through the topscreen. 

So we work through industry associations. We participate in conferences. We drill down to the state and local level through state 

industry associations, though recognizing that not all chemical facilities, companies are members of these associations. 

Wee get creative. We work through—— 

Mr. PETERS. I am going to run out of—— 

Mr. WULF [continuing]. The state and local law enforcement, preparing lists of facilities and comparing information about—— 

Mr. PETERS. We are out of time. But I have 5 seconds for you 

to tell us if there is anything Congress can improve in this area. 

Is there anything you would ask us to improve within the law? 

Mr. WULF. No. I think we have what we need from an outreach 

standpoint. 

Mr. PETERS. Thank you. 

Mr. Chairman, I yield back. 

Mr. MCKINLEY. Thank you, and the chair now recognizes Mr. 

Johnson from Ohio for 5 minutes. 

Mr. JOHNSON. Thank you, Mr. Chairman, and Mr. Wulf, thanks 

for joining us today. 

I’ve heard concerns that any changes to Appendix A including 

through guidance might not be subject to notice and comment. 

So would changes to Appendix A by guidance be subject to public 

notice and comment based on requirements of OMB? 

Mr. WULF. So yes, I appreciate the question, and Appendix A is 

a list of chemicals of interest—320 or some chemicals—is part of 

our regulation and so, under the Administrative Procedures Act it 

cannot be adjusted or changed without going through the notice 

and comment rulemaking process. So as things currently stand, 

that would be the—— 

Mr. JOHNSON. Even through guidance? 

Mr. WULF. Pardon me? 

Mr. JOHNSON. Even through guidance. 

Mr. WULF. That’s right. 

Mr. JOHNSON. OK. 

Mr. WULF. I think it would be considered significant guidance 

that would need to go through notice of rulemaking. 

Mr. JOHNSON. OK. Great. 

Previously, GAO indicated that DHS does not systematically solicit feedback to assess the effectiveness of outreach efforts and 

does not have a mechanism to measure effectiveness of your outreach activities. 

Mr. Currie, in his written testimony, indicated that DHS developed a questionnaire to solicit feedback on outreach with industry 

stakeholders. 

Would you please walk us through the questionnaire and explain 

whether it’s been effective? 

Mr. WULF. Yes. Absolutely. I am glad to do that. 

30 

So, we have taken GAO’s recommendations seriously. As you 

mentioned, we have developed that outreach questionnaire. I do believe it is effective. We are in the relative early stages of its deployment. 

We are using it as we go out to conferences as opposed to going 

facility by facility during inspections or compliance assistance visits. 

We ask in this questionnaire those who participate in our engagements to give us some feedback on the content, on the speaker, 

on the relevance of the information, on the extent to which they expect to be using the information to inform their chemical security 

risk-based decisions. 

You know, the challenge sometimes is to get the questionnaire 

into the hands of the people who have actually participated in the 

event as we are guests at these conferences. We don’t necessarily 

control the attendee email distribution lists. 

So we work with organizers of the conference to push it out. To 

this point, we have received upwards of 60 responses back. Ninetyseven percent of those who responded reported that information 

was relevant and highly useful. 

So we are going to continue to look at how we can expand the 

use of the questionnaire. I think it is very much a worthwhile tool. 

Mr. JOHNSON. Good. OK. 

Well, since the last time the department testified before our committee the Government Accountability Office has made 10 recommendations for improvements to the CFATS program. 

What progress have you made on those recommendations? 

Mr. WULF. I appreciate that, and I appreciate GAO’s engagement 

and very helpful oversight and recommendations over the course of 

the year. 

I am confident that we are among the most thoroughly scrutinized programs in the government and pleased that GAO has recognized our significant forward progress over the year and, happy 

to report that we have made a lot of progress in implementing 

GAO’s recommendations. 

I think those recommendations, broadly speaking, fall into a couple of different bins. One of those focused on our risk assessment 

process, our tiering methodology. 

We, as I’ve mentioned in this hearing, made a lot of progress in 

developing our new risk-tiering methodology, one that comprehensively accounts for all relevant elements of risk. Along with that, 

we have launched a new and very much streamlined and userfriendly suite of online tools to facilitate tiering. 

I am confident that when GAO issues its next report it will recommend or it will close out the remaining recommendations related 

to our development of our tiering methodology—the conduct of the 

tiering peer review among other tiering-related issues. 

The second bin I think concerns, broadly, our internal processes 

and controls and, we have made a lot of progress on that front, too, 

executing a 95-point action plan to improve the program, developing standard operating procedures on things like enforcement 

and on the conduct of inspections, developing metrics to measure 

the effectiveness of the program and, pleased to report, based upon 

those metrics, facilities that are within the program have enhanced 

31 

their security very, very measurably under CFATS. It’s a program 

that is working. 

Mr. JOHNSON. Well, great. Well, thank you for your responses. I 

yield back, Mr. Chair. 

Mr. MCKINLEY. Thank you. 

And I now recognize our colleague, Mr. Green from Texas, for 5 

minutes. 

Mr. GREEN. Thank you, Mr. Chairman. 

Secretary Wulf, thank you for being here. I have a very urban 

district in Houston in East Harris County that’s home to one of the 

largest petrochemical complexes in the world so I know how important CFATS is and I’d like to thank you for your work in implementing these safety standards, and I’d heard a lot of good things 

about the work. 

I was glad in your earlier testimony or question you acknowledged that CFATS, because it was called anti-terrorism standards, 

we are more likely to have a natural disaster than we are a terrorist. 

In fact, in my area, I think we could take care of the terrorists 

pretty quickly. As I say in Texas, we don’t have any shortage of 

small arms. So but Hurricane Harvey that hit our community—and 

I know the other issue was the—that facility out in Crosby, Texas, 

and that’s not my area but East Harris County is. 

But a lot of our refineries literally were under water in the Houston Ship Channel and that’s what my concern is and maybe we 

need to focus on that, although, admittedly, when we passed the 

Chemical Facilities Anti-Terrorism Standards program we didn’t 

think about natural disasters. 

But now we need to recognize that because about every 7 years 

in Houston, Texas or southeast Texas we get a tropical storm or 

a hurricane, and although the last one with Harvey I don’t know 

how we could ever plan for 55 inches of rain in 4 days. 

So but can you talk about how subjecting CFATS to a yearly authorization through the appropriations process before 2014 put a 

burden on the program? 

Mr. WULF. Yes, absolutely. Glad to. Until we attained long-term 

authorization, we were subject to the vicissitudes of the appropriations process. 

So going from year to year or, worse, from continuing resolution 

to continuing resolution. When the government shut down—— 

Mr. GREEN. I think every federal agency has that problem. 

Mr. WULF. Yes. When the government shut down in October or 

November—October 2013, our stakeholders didn’t know whether 

CFATS continued in force. 

We didn’t know if we needed to take enforcement action to address a national security threat at a CFATS facility, whether the 

underlying statutory authority was in existence. 

So long-term authorization in December of 2014 was huge for us. 

It enabled us to plan for and execute important improvements to 

the program, some of which I have detailed here today. 

It provided our industry stakeholders with the certainty that 

they deserved as they thought through making significant investments in CFATS-focused security measures. 

32 

So I cannot underscore enough how important continuing longterm authorization for the program is. 

Mr. GREEN. Do you think we need to put specific language in 

there? Because when we have these shut downs that our committee 

doesn’t have a whole lot to do with since we are not appropriations. 

Mr. WULF. Yes. 

Mr. GREEN. But our military still functions. Our law enforcement 

functions. Why would we not want our terrorism safety or even if 

there is a natural disaster during a shut down? So do you think 

we need specific language to say that? 

Mr. WULF. So I think the language we have in the current authorization does the trick there. 

But I think you have summed up exactly the importance of 

longer-term authorization to continue—the program continues in 

force regardless of what is happening on the appropriations front. 

Mr. GREEN. Do you currently feel that the facilities labeled high 

risk have enough incentive through the program to reduce that risk 

and do you see facilities switching tiers commonly after a high risk 

designation? 

Mr. WULF. So, as we have gone through the retiering process 

using our new risk tiering methodology, we have seen some shifting across tiers. We have seen some new facilities come into the 

program, some previously designated high-risk facilities move out 

of the program. But I do think that organically the CFATS program promotes the consideration by facilities of safer processes, 

consideration of different chemicals. 

So, there is an incentive for facilities to lower their level of risk 

by doing things differently based on the CFATS program and over 

the course of the program we have seen about 4,000 facilities that 

have changed their processes, changed their chemical holdings, and 

dropped out of high-risk status, which we view as a good thing. 

Mr. GREEN. Well, in a way that’s good—they are responding to 

the threat. Has the industry response been in revamping of the 

chemical safety assessment tool, or CSAT? 

Do you feel the program is now easy enough to comply with if 

you’re a small-scale manufacturer? 

Mr. WULF. Yes, I do. I think we made some significant strides 

forward with CSAT 2.0, that new online suite of tools. The amount 

of time it now takes facilities to work through the process of submitting a top-screen or a site security plan has been cut by about 

75 percent across the board. 

The tool is much simpler. It’s more of a Turbo Tax sort of model. 

Duplicative irrelevant questions are no longer seen by facilities. So 

greatly simplified and we have had really tremendous feedback 

from our industry stakeholders on it. 

And, in many respects they helped us to develop it. They were 

closest to the pain of working through the old system. They were 

able to help us understand ways in which we could simplify it and 

make it more user friendly. 

Mr. GREEN. Well, Mr. Chairman, thank you for your patience. In 

my area, we don’t have those smaller facilities that you have. 

Mr. WULF. Yes, I know. 

33 

Mr. GREEN. Chemical plants and refineries who run 250,000 barrels a day. So but I know that we like to go where the problems 

are, not just be a paper pusher. 

So thank you, Mr. Chairman. 

Mr. WULF. Yes. You’re in the center of the petrochemical universe. 

Mr. MCKINLEY. Thank you. 

And the chair now recognizes Mr. Duncan from South Carolina 

for his 5 minutes. 

Mr. DUNCAN. Thank you, Mr. Chairman. 

Back in 2014, I was on the Homeland Security Committee and 

I worked with them to help reauthorize CFATS for 4 consecutive 

years. 

H.R. 4007, Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014 was under jurisdiction of both Homeland 

and Energy and Commerce. Now we are back to yearly funding extensions and this creates instability for both DHS and companies 

operating under the program. 

If Congress were able, Mr. Wulf, to provide multi-year authorization like we did back in 2014 how can we ensure DHS will update 

the program as intended? 

Mr. WULF. So we are very incentivized to try to continually improve the program. I think a long-term authorization gives us the 

stability that we need to focus on those improvements. 

We have made a number of them over the course of the last 4 

years. We are eager to push forward through the rule making process to engage with our stakeholders through notice and comment 

in a number of different areas—— 

Mr. DUNCAN. How can we be certain that you will take the stakeholders’ comments into consideration? 

Mr. WULF. I think we have demonstrated over the course of the 

last 4 years that we take very seriously our stakeholders’ comments and that we seek to involve them in the program. 

This whole effort is a shared commitment. It wouldn’t work without the buy-in of our stakeholders. We have put into place tens of 

thousands of security measures at facilities across the country. 

So, they know in many ways best ways in which we can improve 

the program. That’s why we have involved them in the development of the new risk-tiering methodology. That’s why we have involved them in the development of the new suite of online tools and 

their input on those fronts has been invaluable. 

Mr. DUNCAN. I think as long as they know how to comply and 

what you’re going to expect of them it makes it easy for them. 

Let me shift gears for just a minute. There is a company in my 

home county, Austin Powder, and it’s a company facility there in 

Clinton and previously noted how duplicate regulations cost them 

substantial amounts of money. 

The facility has explosive regulated both by the ATF and by DHS 

under CFATS. The compliance mandated under CFATS does not 

measurably improve their facility security. It seems ATF adequately protects against theft and diversion. 

So given the cost of compliance, which stakeholders in the explosives industry face in return for no measurable security gain, what 

34 

is your opinion on exempting those in the explosive industry already regulated by ATF from the CFATS program? 

Mr. WULF. So we are certainly sympathetic—sensitive to concerns about duplicative regulation. I think in the case of explosive 

materials, there is regulation in place with ATF. 

I think we are talking about a universe of about 30 facilities that 

are regulated both by CFATS for explosives only and also by ATF. 

ATF and DHS have different programs but I think they are both 

solid programs. So, we are open to working with the committee on 

a path forward there. 

I am not sure I completely agree with the premise that CFATS 

doesn’t provide any additional security benefit but there are certainly measures in place at ATF-regulated facility. I’ve spent a 

dozen years myself at ATF. A very solid program there. And so, 

among the things that I would not lose too much sleep over exiting 

the program, explosives are one of those. 

I will note, though, that ATF’s program does not address explosives’ precursor chemicals. So, I think many of those facilities receive benefits still under CFATS with respect to the regulation of 

security of explosives’ precursor chemicals—for instance, ammonia 

nitrate. 

Mr. DUNCAN. So do you think the redundancy and overlap of regulations are OK? I don’t hear a whole lot of jurisdictional prejudice 

in your answer there. 

We are going to look at that. We are going to look and see, because what we are trying to do is make sure that businesses aren’t 

faced with multiple compliance burdens when one agency can handle it, and we run into that too much in government, I think, where 

you’ve got this jurisdictional overlap and one agency is coveting 

that and they don’t want to give it up when there maybe be a better agency that can handle it. And in this case, DHS might be the 

best agency and take it away from ATF—I don’t know that—or vice 

versa. 

Mr. WULF. Yes. We are happy to work with you on that. 

Mr. DUNCAN. Thank you. 

Mr. Chairman, I yield back. 

Mr. MCKINLEY. Thank you. Now I recognize my colleague, Mr. 

McNerney from California, for 5 minutes. 

Mr. MCNERNEY. I don’t know if I sense a little reluctance in that 

acknowledgment, Mr. Chairman. 

I thank the panelist. Mr. Wulf, I missed your testimony and I 

apologize about that. Now, there are several categories of threats. 

I am going to list a few of them. 

There is natural disasters. There is physical attacks. There is industrial accidents and cyber attacks. Do you feel that cyber attacks 

are on par with the others in terms of risk to public safety and 

health? 

Mr. WULF. I think cyber is a very important threat vector and 

I think that, no question but that America has critical infrastructure and that includes America’s chemical infrastructure is in the 

cross-hairs of cyber criminals. 

Mr. MCNERNEY. Well, I’ve learned from the utility industry that 

there is some difficulty getting information sharing across because 

35 

of lack of security clearance within the utility industry mainly because of the length of time it takes to get a security clearance. 

So you think that that is also an issue with the chemical industry is a lack of security clearance within the industry prohibiting 

information sharing that could be helpful in safety areas? 

Mr. WULF. I think, certainly, getting appropriate folks across the 

industry cleared to receive classified threat information is helpful. 

We maintain a program called the private sector clearance program through which we grant clearances to folks in the private sector to include those who serve on our sector coordinating counsels. 

So I think, certainly, to the extent we can streamline that process, that’s a good thing. 

Mr. MCNERNEY. Would it be helpful for the legislative branch to 

get involved in streamlining that process or would that be cumbersome? 

Mr. WULF. I think we are working the issue. It is a high priority 

for us. I think it’s sort of a process thing, in my view, that, we need 

to continue to focus like a laser beam upon and we are certainly 

committed to doing that. 

Mr. MCNERNEY. Well, suppose someone goes into the industry, 

say, from the Department of Energy with a pretty high clearance 

level—a Q clearance or some clearance—top secret clearance. How 

long would it take them to get the clearance to get information 

sharing once they go into industry? 

Mr. WULF. Yes. I would hope not very long. I might have to get 

back to you on exact time lines. 

Mr. MCNERNEY. Yes. I have a specific case where it took someone 

with a top secret clearance 18 months to get a secret clearance in 

industry. 

Mr. WULF. Yes, not good. 

Mr. MCNERNEY. OK. Well, I’d like to follow up on that and hear 

specifically how that that’s going to be—— 

Mr. WULF. Happy to talk with you more about that program. 

Mr. MCNERNEY. OK. Do you think that there is—on a different 

subject, is there resistance to safety regulations by industry of regulations that actually provide safety to the public? 

Mr. WULF. Although our security-focused regulation has positive 

benefits from a safety standpoint, I don’t know if I am in a position 

to talk about the extent to which there may or may not be resistance to EPA’s or OSHA’s safety-focused regulations. 

I would hope not. I think there is a strong culture across the 

chemical industry of safety and security. So my expectation is that 

they are meeting requirements across the board. 

Mr. MCNERNEY. Right. It just takes one bad player to cause an 

accident to hurt the whole industry. 

Mr. WULF. Yes. Absolutely. 

Mr. MCNERNEY. So I think we both and industry understand 

that and are anxious to work with regulatory bodies such as yours. 

Mr. WULF. Yes. 

Mr. MCNERNEY. OK. Mr. Chairman, I am going to yield back. I’ll 

give you a minute. 

Mr. MCKINLEY. Thank you. 

Now the chair recognizes Mr. Flores from Texas for 5 minutes. 

36 

Mr. FLORES. I thank the chairman and I thank this subcommittee for holding this important hearing. 

On April 18th, 2013 one of the communities in my district, that 

being West, Texas experienced a disastrous explosion that took 15 

lives. Twelve of them were first responders. So CFATS is important 

to me and to my district. 

Furthermore, it was really disturbing to learn from the findings 

that were released 3 years later that this wasn’t an industrial accident. It was actually arson. 

That said, the citizens of West deserve great credit for how 

they’ve been resilient in rebuilding their community and the rebound of West today is really remarkable. 

As the current authorization for CFATS is set to expire in January of next year, we must carefully consider how the program is 

measured and what improvements should be made or could be 

made in the reauthorizing legislation. 

I want to thank all of today’s witnesses for their insight in this 

hearing. And so now I’ll move to my question for Mr. Wulf. 

Some people argued that the greater public sharing of chemical 

vulnerability information—or the CVI, as we call it—is necessary 

for communities to be better prepared. 

So, Mr. Wulf, I have three subquestions under that. First of all, 

to whom does Section 2103 currently allow access to CVI? 

Mr. WULF. So that section of the statute currently allows access 

to state and local government officials who essentially have a need 

to know that information in performing their official duties in the 

first response arena—emergency planning arena. 

Mr. FLORES. So the next question would be do you think it’s wise 

to have CVI publicly disclosed? 

Mr. WULF. I do not. The reason we developed the chemical terrorism vulnerability information protection regime was to keep 

close hold among those who have a need to know information about 

high-risk chemical facilities and the chemical holdings at those 

sites. 

Mr. FLORES. OK. And so that brings us to the next one. Some 

people have suggested that local emergency planning commissions 

should have access to CVI. Is there a reason to not provide it to 

them? 

Mr. WULF. So local emergency planning commissions perform an 

important function. But they vary in their—in their composition. 

So there are certainly folks who are members of local emergency 

planning missions who do have a need to know information about 

high-risk chemical facilities and chemical holdings. 

So those first responders, those emergency planners, we absolutely want to ensure that they have the information they need to 

perform their official duties. 

But we need to balance that with the need to ensure that we are 

not sharing so broadly that we make it easy for terrorists and other 

adversaries to obtain information to effectively have a roadmap to 

America’s highest risk facilities. 

Mr. FLORES. If you have first responders that are CVI trained, 

would it be appropriate to share the information with those first 

responders? 

Mr. WULF. Absolutely. 

37 

Mr. FLORES. OK. Mr. Chairman, this has been helpful and I 

thank you. 

I yield back the balance of my time. 

Mr. MCKINLEY. Thank you very much, and now the chair recognizes Mr. Ca ́ rdenas from California for 5 minutes. 

Mr. CA ́ RDENAS. Thank you very much, Mr. Chairman. I appreciate the opportunity to discuss this very, very important issue that 

affects all Americans. 

Thank you for being here, Mr. Wulf. Earlier this year at a subcommittee hearing before the House Committee on Homeland Security, chemical safety advocate Paul Oram testified that facility 

owners should be required to develop and maintain employee input 

plans. 

Mr. Oram commented that, ‘‘Employees are often the most vulnerable in the chemical release but also the most knowledgeable 

about problems and remedies.’’ 

So with that, has DHS encouraged or required facility owners to 

consult with employees when developing security vulnerability assessments? 

Mr. WULF. So I appreciate the question. We certainly urge companies—we urge high-risk facilities to involve their employees in 

development of site security plans and I would say that almost 

across the board employees are involved in the development of 

those plans. 

The 2014 long-term authorization act makes clear that to the extent practicable, facilities should be involving employee and my expectation and my general understanding is that facilities are doing 

just that. 

I mean, facility employees are the ones developing plans. 

Mr. CA ́ RDENAS. So the facilities’ owners—these plants voluntarily 

give that feedback to you? If it’s not one of the checklist things that 

the department asks, by the way, do you have an employee input 

plan on your site? 

Mr. WULF. It is not a checklist thing. We are not really a checklist program. But we are a program that engages very constructively with facilities. So that is voluntary feedback. That’s the experience—— 

Mr. CA ́ RDENAS. OK. 

Mr. WULF. —of our inspectors working with these facilities. 

Mr. CA ́ RDENAS. So that feedback right now is ad hoc? It’s just 

as—— 

Mr. WULF. I don’t know if I’d characterize it as ad hoc, and there 

is not a check box. 

Mr. CA ́ RDENAS. OK. Well, I’ll describe it as ad hoc if there is not 

a formal process. Five years ago when the last oversight hearings 

on the CFATS program then under Secretary Rand Beers noted on 

the record that the department’s strategic communications plan 

may eventually include ‘‘systematic outreach to facilities including 

employees at the facilities.’’ 

Has systematic outreach become the norm in the CFATS program? 

Mr. WULF. Yes. I am pleased to say that it has and we have an 

outreach engagement plan. We identify areas of priority from year 

to year and we focus on ensuring that we are getting the word out 

38 

to those relevant communities and that certainly includes to the organized labor—relevant organized labor communities. 

Mr. CA ́ RDENAS. Mr. Oram also stated that public confidence is 

critical to the success of the CFATS program and the secrecy is not 

in the best interest of the communities. 

I couldn’t agree more. As a parent, I would not want to know if 

I lived down the street from a facility that puts my family at risk. 

I would want to know as much as we believe possible. 

Do you agree that this is important to proactively engage communities living near or next to these facilities? 

Mr. WULF. So I think, again, it’s a balance. I think we need to 

ensure that those who are charged with protecting our communities, our first responders, our emergency planners have the information that they need. The balance, though, is in ensuring that we 

are not making sensitive information so widely available that it can 

be accessed by those who would seek to do harm to the community. 

So it’s a balance. 

Mr. CA ́ RDENAS. So what, if any, specific steps has DHS taken to 

improve community outreach and engagement through the CFATS 

program? 

Mr. WULF. So, as part of our outreach engagement plan we are 

out talking to local emergency planning committees. Those can include members of—and frequently do include members of the community and public officials, first responders, emergency planners. 

That is one of the main means by which we are out across the relevant communities. 

Mr. CA ́ RDENAS. Thank you. I can’t stress enough how important 

it is for employees and local members of the community to be involved in disaster assessment and preparedness process. 

These individuals are the ones bearing the greatest risk. They 

work, live, shop, walk to school, pray, and drive to jobs near these 

facilities and they might be at high risk and they need to know 

about that. And yet, they are often left in the dark when it comes 

to disaster preparedness. Their voices are critical to the facility and 

community safety and I hope that we can work together to improve 

engagement efforts under the CFATS. 

So I appreciate your time. Thank you very much. I yield back. 

Mr. WULF. Thank you. 

Mr. MCKINLEY. Thank you very much. 

The chair recognizes Mr. Walberg from Michigan for 5 minutes. 

Mr. WALBERG. Thank you, Mr. Chairman, and thank you, Mr. 

Wulf, for being here. 

In your written testimony you indicate that DHS has conducted 

over 3,500 compliance inspections and that, and I quote your statement, ‘‘Nearly across the board results of these inspections have 

been positive.’’ 

That’s good. Could you elaborate a little bit more for us? 

Mr. WULF. Yes. No, I am glad to. 

So we are in sort of steady state compliance inspection phase. 

Most of the inspections we are doing across the country are postsite security plan approval inspections. 

So we are assessing the extent to which facilities are doing what 

they signed up to do in developing their site security plans, whether they are implementing those plans, whether they are putting in 

39 

place new security measures along the time lines agreed to in the 

plans and I’d say almost across the board that is absolutely happening. That has been our experience in conducting these inspections. 

Where we have identified issues nearly always we are able to resolve those with the facility in pretty short order. 

So, the chemical industry stakeholder community is taking its 

obligations seriously under CFATS. Those facilities that have been 

identified as being at the highest risk of terrorist attack or exploitation that are covered by CFATS are taking their obligations seriously and are implementing their plans. 

They have put into place literally tens of thousands of security 

measures at facilities across the country. So, really appreciate their 

commitment to the program and their buy-in. 

Mr. WALBERG. Do you sense and your inspectors sense that they 

see you as a partner with them—that it’s a benefit and not a burden? 

Mr. WULF. I do. Yes, I do. And I think, the program is one that 

lends itself to a little bit of that partnership approach. Certainly, 

we are regulators. 

But this is a nonprescriptive regulatory framework. So we are in 

a position to work with facilities to identify security measures within a site security plan that make sense, given that specific facility’s 

unique circumstance. 

So, really pleased to be able to work with facilities that way, and 

we will say also that we prioritize not just being out there to conduct inspections but to provide compliance assistance. 

So to talk with facilities, to talk with those who own and operate 

those facilities about options for meeting the spirit of the 18 

CFATS risk-based performance standards. 

So, I think it is a really unique and—I want to say uniquely effective program that is well suited to the diversity of the Nation’s 

chemical industry infrastructure. 

Mr. WALBERG. I encourage that. We certainly know of other entities that are involved in regulating and inspecting at the work site, 

at the business, that there is no relationship. This seems to be a 

partner relationship. 

Mr. WULF. Yes. 

Mr. WALBERG. This is an important—— 

Mr. WULF. Absolutely, and we rely on our industry stakeholders 

very much to help us think through potential improvements to the 

program, to develop new tools like our new and improved suite of 

online tools through which top-screens and site security plans are 

developed to help us develop things like our new risk-tiering methodology. 

So, in a lot of ways it is a thriving partnership relationship with 

our entire stakeholder community. I am very grateful for that. 

Mr. WALBERG. Thank you. 

Your written testimony notes that where necessary DHS has utilized our enforcement authorities to incentivize compliance. Can 

you elaborate on that? Explain that a little more? 

Mr. WULF. Yes. I am glad to. 

40 

So we have a two-step enforcement process. As I mentioned, the 

vast majority of the time we are able to resolve issues without getting into the enforcement process. 

But in about 70 instances over the history of the program we 

have begun the process. We have issued a notice of not compliance 

that, under the law, gives a facility a specific amount of time to 

come into compliance. 

I am happy to say that most of time that is sufficient where cooperative work with the facility has worked to nudge the facility into 

compliance. 

But if that doesn’t work we will go ahead and issue a penalty 

order, and in all cases—and it’s only three cases in which we have 

had to get to the penalty order—that has been the thing that has 

compelled compliance. 

So our overwhelming bias is to work with facilities and, certainly, the vast majority of facilities out there are acting, in my experience, in good faith and are committed to the program and understand—committed to meeting their obligations under CFATS. 

But in the small number of instances where that is not happening, we will go ahead and use those enforcement authorities. 

Mr. WALBERG. Thank you. 

I yield back. 

Mr. MCKINLEY. Thank you very much. 

Now the chair recognizes Ms. Matsui from one of the three possible states of California for the next 5 minutes. 

Ms. MATSUI. I think we are still going to be united—still one 

state. 

Thank you, Mr. Chairman. Today we have talked a lot about the 

industries and facilities that we calmly associate with chemicals. 

But the CFATS program also covers many types of facilities that 

we don’t always think of as using high-risk chemicals like hospitals 

and universities. 

In Sacramento, we have four major hospital systems including an 

academic medical center, which represents the second largest employer in the district. 

So I am pleased that DHS has emphasized the importance of 

stakeholder involvement, and I’ve also heard that the agency and 

hospitals in California collaborate well. 

You’ve emphasized the CFATS as a nonprescriptive regulatory 

framework, which gives flexibility to regulated facilities. 

What are some of the unique challenges that hospitals face under 

CFATS and how has DHS worked with hospitals to tailor security 

measures to those challenges? 

Mr. WULF. And I appreciate that question. You’re absolutely 

right. The universe of facilities covered under CFATS is a very 

broad one. 

So, we prioritize getting out across the relevant communities and 

working to address the unique circumstances of facilities such as 

hospitals. 

So hospitals, college university campuses can’t necessarily be secured in the same way as a more traditional chemical manufacturing or chemical distribution site. 

We need to maintain reasonably open access to the site. You 

have members of the public coming in and out so, what we have 

41 

recommended in cases like that and in the conduct of our compliance assistance with those sites is taking kind of an asset-based 

approach to security. 

So you’re not necessarily constructing a perimeter around the entirety of the hospital but ensuring that where those sensitive 

chemicals are being held you have the requisite security in place. 

So that tends to be the approach for facilities such as hospitals. 

Ms. MATSUI. OK. Thank you. 

I understand the CFATS has improved its risk-based performance standards and risk calculations based upon actual threat level 

and facility vulnerability. 

It makes me wonder—as climate change is increasing the frequency and severity of extreme weather if the CFATS couldn’t be 

used to address weather-related vulnerabilities. 

Recently, the Chemical Safety Board released their investigative 

report on the Arkema chemical plant fire and explosion in Crosby, 

Texas. The CSB found that the plant was not adequately prepared 

for the extreme flooding that occurred during Hurricane Harvey 

and that a number of equipment failures occurred as a result. 

The CSB also indicated that other facilities in flood prone areas 

face similar problems and made recommendations on how to address some of these risks. 

I think that many of these recommendations are relevant to 

CFATS facilities. Do you believe that the damage extreme weather 

causes facilities covered by CFATS is a serious threat to the safety 

of surrounding communities? 

Mr. WULF. I think, certainly, natural hazards are just that and 

we have certainly seen them impact chemical facilities. 

Ms. MATSUI. OK. Do you think a CFATS security plan should 

consider the threat of severe weather and help protect facility 

worker and communities? Why or why not? 

Mr. WULF. So I think it’s important that CFATS be able to stay 

focused on security. It is a security-focused anti-terrorism program. 

But I will note that there is a lot about the CFATS program and 

about security measures that are put into place or that are required to be put in place at CFATS-covered facilities that has a 

positive impact in addressing the facilities’ resilience in the face of 

natural disasters. 

So, we require facilities to develop response plans, to conduct 

training, to conduct exercise, to conduct exercises to make contact 

with their local first responders and all of those things are equally 

important in both the terrorism context, in the deliberate manmade attack context, as well as in the natural disaster context and 

we have seen it play out in instances in which, for instance, a tornado hit a CFATS-covered facility in Illinois and it was very well 

prepared. 

Ms. MATSUI. So you’re really preparing—in essence, to really coordinate these activities more in the sense of part of the program 

to review how to do this so, in a sense, it’s part of the program? 

Mr. WULF. I don’t believe it makes sense to make it a formal part 

of the program. I think it’s important that we retain our focus on 

security. But, again, I think their security and safety are very 

much complementary. 

42 

There are agencies that focus squarely on the safety issues on 

those hazards. We work very closely with the likes of EPA, OSHA, 

with our friends at FEMA, within the Department of Homeland Security. 

So I think as a Federal Government community we are very 

much committed to that. 

Ms. MATSUI. OK. Thank you very much. 

I yield back. 

Mr. MCKINLEY. Thank you. And now the chair recognizes the 

chairman of the full committee, the gentleman from Oregon, Mr. 

Walden, 5 minutes. 

Mr. WALDEN. Thank you very much, Mr. Chairman, and thanks 

to you for holding this hearing and, Mr. Wulf, thank you for being 

here. We appreciate your guidance. 

I just have a couple of questions. You’ve been with the program 

a long time—I won’t say a very long time—a long time, and, frankly, many people credit your leadership and your committed staff 

with the gains the program has made in recent years. So, we go 

through this with different agencies and, frankly, depending on 

who’s in charge doesn’t seem to matter sometimes who’s in the 

White House. 

So this isn’t a partisan issue because we have seen it in other 

agencies. But having seen how a less committed senior political 

leadership can wreak havoc on a program, how do we know these 

reforms are permanent? 

Mr. WULF. Thank you. Thank you, Mr. Chairman. I appreciate 

very much the kind words. We have a great team in place within 

our program and great buy-in and commitment across our industry 

stakeholder community. So it’s very much a team effort. 

I can tell you that our new senior political leadership with the 

change of administration is very, very committed to the future of 

CFATS. It remains a priority with this administration, very focused on ensuring that we are able to maintain positive momentum 

that we have the resources we need to do just that. 

So, we remain focused like a laser beam. I’ve seen nothing but 

support from the upper reaches of the department and the administration. 

Mr. WALDEN. Right. And some of the witnesses on the second 

panel in their testimony today on CFATS that they say that 

CFATS has made serious improvements in problems it was facing 

4 years ago. 

What do you attribute the progress of CFATS program over the 

course of the last 4 years? 

Mr. WULF. I appreciate that question. 

I think, first and foremost, I attribute the progress we have been 

able to make to the environment of stability that has been fostered 

by long-term authorization on which this committee showed so 

much leadership in 2014. 

So that gave us the stability that we needed to plan for and execute many of the improvements I’ve detailed here today. It afforded 

our industry stakeholders the certainty they deserved as they were 

thinking through making significant investments in CFATS-focused security measures. 

43 

I would say also I would credit a lot of the progress to the spirit 

of openness and transparency which we have strived to operate 

over the past 4 years. 

So, we have a very strong relationship with our industry stakeholders. We take their feedback very seriously. We involve them in 

efforts to improve the program. We very much value their input. 

And, thirdly, I would point maybe to a willingness to change 

processes—to not stick with the status quo to do game changing 

things like take a corporate approach to inspection activity, to take 

a fresh look at our suite of online tools and see what we can do 

about making them more user friendly, more streamlined, and 

more useful in the development of top-screen risk assessment surveys and site security plans. 

So all of the above but at its core, the stability of that long-term 

authorization has been absolutely key. 

Mr. WALDEN. Well, and as chairman of the full committee, you 

have my assurance that we are going to move expeditiously to reauthorize this work. 

Mr. WULF. We appreciate that. 

Mr. WALDEN. We know of its critical importance. You keep this 

up, you may get cloned and your staff too because not every program and agency achieves these kinds of results. 

So we do appreciate your leadership and that of your team and 

you look forward to working with you so we meet our deadlines 

here and get this reauthorized. 

So with that, Mr. Chairman, I’d yield back. 

Mr. MCKINLEY. Thank you very much. 

The chair recognizes Ms. DeGette from Colorado for 5 minutes. 

Ms. DEGETTE. Thank you, Mr. Chairman. 

Thank you for coming today, Mr. Wulf. Right on the border of my 

district is the Suncour oil refinery. 

There are 53,000 people that live within a 3-mile radius of that 

refinery and that includes over 5,000 children under 5 years old 

who are particularly susceptible to air toxins. 

The neighborhood that’s the closest to the refinery, Elyria-Swansea, has a population that’s over 80 percent Latino with over 25 

percent of the residents living with incomes below the poverty line, 

and as you know, these characteristics are pretty common for 

neighborhoods that are nearby industrial facilities. 

So I wanted to ask you would you agree that while security is 

important for all chemical facilities, additional considerations like 

mitigation are necessary when you’re dealing with urban facilities 

with large populations right nearby. Security is not the only issue 

that these institutions or that these refineries and others are facing. 

Mr. WULF. Well, sure. Yes. Absolutely. 

Ms. DEGETTE. And one thing that happened over at Suncour we 

have had problems with interruptions from the external power supply and, as you know, even brief disruptions to the power supply 

can cause harmful chemical emissions. 

In October 2016, the Suncour refinery suffered an accidental 

power failure that led to release of a yellow cloud of smoke, which 

closed the highway and caused 14 local schools to go into lockdown. 

44 

And then they had a second power outage in March 2017 which 

released more than 500 pounds of sulfur dioxide gas and a hundred 

pounds of hydrogen sulfide gas. 

So my question is—I know, you look a little puzzled because— 

but I am wanting to know is power supply security a consideration 

when the Department of Homeland Security considers site security 

plans submitted by high-risk facilities? 

Mr. WULF. So, yes, the power supply is certainly something 

that—— 

Ms. DEGETTE. Is one of the things? 

Mr. WULF [continuing]. Something to be considered and also considering what contingencies are in place it is certainly important 

from a security perspective when the power goes out. 

Ms. DEGETTE. OK. Does DHS have specific recommendations for 

providing a secure power supply under CFATS? 

Mr. WULF. I will get back to you on that, certainly. 

Ms. DEGETTE. Thank you. OK. Now, DHS is not allowed to disapprove of the site security plan because it lacks specific security 

measures. Is that right? 

Mr. WULF. That is correct. It’s a nonprescriptive program so we 

work with facilities to assess what makes sense and meets the intent of the relevant risk-based performance standards. 

Ms. DEGETTE. So would you consider a facility secure if it suffered a significant chemical release due to a brief power outage or 

would that show that the facility might be susceptible to deliberate 

disruption? Would you look at that? 

Mr. WULF. It would be something we would look at, certainly. 

Ms. DEGETTE. Now, the CFATS program is intended to protect 

chemical facilities from terrorist attacks. Is that right? 

Mr. WULF. That is correct, to protect against terrorist attack or 

exploitation. The majority of the facilities we have in the program 

that have been designated at high risk are designated as such 

owing to the threat of theft or diversion of chemicals—— 

Ms. DEGETTE. OK. 

Mr. WULF [continuing]. Being taken offsite and deployed. 

Ms. DEGETTE. Off site. So the Suncour refinery incidents I talked 

about before caused by accidental power outages they would be included in the scope of the program though, right? 

Power outages that are causing chemical releases. 

Mr. WULF. Yes. The power situation and resilience in the face of 

power, ensuring that the security systems are resilient is important. 

Ms. DEGETTE. Now, what about emissions caused by negligence, 

natural disasters, or other types of actions? That would not be included? 

Mr. WULF. That is not within our purview. But, as I’ve mentioned here, many of the measures that we require to be put in 

place through CFATS such as the conduct of training, exercise the 

development of response plans that are applicable—— 

Ms. DEGETTE. They would—— 

Mr. WULF [continuing]. In both the natural disaster context or 

manmade attacks. 

Ms. DEGETTE. They would have that potential spillover effect, 

right? 

45 

Mr. WULF. Right. Right. A complementary—— 

Ms. DEGETTE. Yes. But, Mr. Chairman, the reason why I bring 

this up is because security is really important to me but there is 

so many other issues. 

I would hope that we can also come to bipartisan agreement on 

how we address these toxic releases, because in my district and 

many other districts in the country, people are living right next to 

these plants and even if it’s not a terrorist attack or a natural disaster, they are at risk of contamination every day. 

So I would hope that would be another issue that we could work 

on in this committee. 

Thank you, and I yield back. 

Mr. MCKINLEY. Thank you very much, and I hope we can continue that dialogue on that. 

Now the chair recognizes from Texas Mr. Olson for 5 minutes. 

Mr. OLSON. I thank the chair, and welcome, Mr. Wulf. 

As you know, I am a congressman from Texas 22. I like to call 

that the suburbs of the energy capital of the entire world, the massive petrochemical complex along the Port of Houston and Houston 

ship channel. 

Mr. WULF. Absolutely. 

Mr. OLSON. As you know, there are lots of nasty chemicals on our 

highways and our railroads. In fact, this last month, Houston had 

the anniversary but remembered that—see, was it in 1976 had a 

tanker turn over a truck with ammonia. 

Six people died. Over 60 were hospitalized. That was right by 

Interstate 610 U.S. 59, right by the Galleria. I know that’s not 

CFATS, but my point is those chemicals are all over our roads, and 

that’s just ammonia going by traffic. 

It’s been talked about, some of the issues with the Crosby fire 

during Hurricane Harvey. I want to talk about cyber attacks, because the bad guys now are adjusting to attack us through cyberspace. 

What happened at Crosby was a failure of the backup system. 

They had backup power but they didn’t test enough. They fired up 

for maybe a minute or two—hey, it’s working. It had to work. It 

didn’t. And as you know, the chemical—once you lost control of the 

process it was going to come through and have an emission. 

And so terrorists could easily hack into there and open up those 

things, do exactly what nature did. So how is CFATS adapting to 

terror attacks through cyberspace? 

Mr. WULF. Yes, you’re absolutely right. Cyber attacks—very significant threat vector. Chemical facilities vary in the level to which 

cyber systems are integrated with their industrial control systems, 

with their process systems, and, for that matter, with their security 

systems. 

But there certainly exists a decent population of facilities where 

those systems are very much integrated and so one of our riskbased performance standards—and I think this was in place before 

any folks were thinking about cybersecurity—one of the 18 riskbased performance standards under CFATS focuses specifically on 

cybersecurity. 

Mr. OLSON. All right. Good. 

46 

Mr. WULF. So we have trained a large number of our inspectors 

to work with facilities that have the fuller integration of cyber systems with their industrial control systems. 

We have cyber experts on our staff at headquarters who review 

those facility site security plans and provide guidance to the inspectors in the—in the field. 

We ask facilities to put in place sound cybersecurity practices or 

other site security things—a very important part of our program. 

Mr. OLSON. Thank you. That is music to my ears. 

More of a softball question for you. As you noted, CFATS was authorized a little over one decade ago. Looking back, could you talk 

about the single biggest lesson learned that you’ve had the first 

years of the program? What’s one thing you’ve learned over those 

first couple years? 

Mr. WULF. So I think the most important thing is that it takes 

a community to secure America’s chemical infrastructure—that it’s 

not something we can do alone and it’s not something we can do 

without the feedback of our industry stakeholders. 

So, the importance of transparency, the importance of openness, 

the importance of a community wide approach. A shared commitment to chemical security is absolutely key and I think as a result 

we have seen a great deal of buy-in and a great deal of commitment across our community of owners and operators of high-risk 

chemical facilities. 

Mr. OLSON. Thank you. That brings up the next question and 

that is domestic community. How about international community? 

As you note in your opening statement, the threats we have seen 

in our homeland have spiked up following terrorist attacks overseas. 

NATO and our allies in Europe are dealing with these attacks 

every single day as are allies all across the world. Can you discuss 

how our CFATS program compares with their programs and are we 

exchanging data with NATO, with other countries? Are they exchanging with us? Are we working together to address this problem? 

Mr. WULF. That’s a great question, and we are prioritizing international outreach. So I actually have the privilege of chairing a G7 global partnership working group on chemical security. 

We are engaging with our European Union partners and a number of other nations to sort of share best practices, to compare 

notes on chemical security. 

I will tell you that what we are doing here is in many, many 

ways the envy of the world—significantly more comprehensive. 

There is a large threat out there. We have been relatively privileged not to have as many chemical-focused attacks. But no question adversaries around the world continue to seek out and to use 

in attacks chemicals of exactly the sort that trigger coverage under 

CFATS. 

So, we need to remain vigilant. There are other approaches to securing certain chemicals, in particular, IED precursor chemicals. In 

Europe, that seemed to be making some headway. I think we want 

to learn from our colleagues over there what is working as we 

think through potentially new approaches at the point of sale to 

high threat IED precursor chemicals, whether of a voluntary or a 

47 

regulatory nature and that’s probably another hearing for another 

day. But we learn a lot from our international colleagues and I 

think they learn a lot from us. 

Mr. OLSON. I thank you. So my time is expired. 

A final closing comment—you always have a standing invitation 

to come to Houston, Texas, see all that stuff with your own eyes. 

Also, enjoy the best barbecue at the Swinging Door in Fort Bend 

County and also the best Mexican breakfast at Bob’s Taco Station 

in Rosenberg, Texas. 

Mr. WULF. OK. What was the first one? I want to make—— 

Mr. MCKINLEY. OK. 

Mr. OLSON. The Swinging Door. That’s in Richmond. Bob’s Taco 

Station is in Rosenberg. 

Mr. WULF. All right. We are down there quite a bit so I will—— 

Mr. OLSON. Yield back. 

[Laughter.] 

Mr. MCKINLEY. Thank you. 

Mr. OLSON. Thank you, Chairman. 

Mr. MCKINLEY. The chair now recognizes the very patient member from Georgia, Mr. Carter, for his 5 minutes. 

Mr. CARTER. Well, it’s certainly going to be hard to follow that 

but I’ll do my best. 

Thank you, Mr. Wulf, for being here. I appreciate it. 

I want to echo the comments of the chair of the full committee. 

Just from listening to you, it appears that you have a firm grasp 

of this and have a handle on it and I appreciate that. That’s good 

to know. 

I wanted to ask you, it appears that improvements have been 

made in the program as it’s gone along, and from what I understand in some of my reading that since the implementation of 

CFATS the GAO makes a number of recommendations that appear 

to have improved the program, and I just wanted to ask you specifically about two things—: vulnerability and economic consequences. Those two things are of concern to me and I just wanted 

to ask, have you changed your overview of these two things, particularly of economic consequences? Or the management of the program—have you tried to address this at all? 

Because I believe that GAO had noted that that was one thing 

that was not taken into consideration enough and that was the economic consequences. 

Mr. WULF. That’s exactly right. So GAO made a number of recommendations related to tiering and we have taken them all very 

much to heart in developing our new and improved risk tiering 

methodology which does take a significantly more comprehensive 

approach to addressing all relevant elements of risk to include consequence, vulnerability as well, looking at the sort of inherent 

vulnerabilities associated with facilities on a facility by facility 

basis—things like, how chemicals are stored, the types of containers, among many other things, and threat. 

With respect to economic consequences, we have studied this 

very hard in response in response to the recommendation and I 

think just makes sense to have done that anyway. 

Our ultimate conclusion was that the threshold, which is actually 

a classified threshold for significant economic consequences to the 

48 

Nation from an attack on a specific chemical facility, is a pretty 

high one. 

And so, it was based on a review of the facilities in our program. 

They were not facilities on which an attack would move the needle 

from a risk tiering perspective with respect to economic consequences. 

So it is not included in our tiering methodology right now but we 

have the resources. We have the knowledge from the study to include it as needed if we get to a point where economic consequences are, potentially, significant enough from one attack on a 

single facility. 

Mr. CARTER. Let me ask you just a couple of simple questions, 

if you will. How do you determine who is to comply? Is that incumbent upon the business itself or do you determine that or what? 

Mr. WULF. Yes. So the way the process works is that facilities 

that have holdings of one or more of our 320 chemicals of interest 

that are in the regulation self-identify if they have those chemical 

holdings at or above the specified threshold or at or above the specified concentration. 

They submit to us what we call a top-screen, so basic information 

about the facility, about the chemical holdings, and we run that 

through our risk tiering methodology and make a determination as 

to whether the facility, based on the totality of the circumstances 

of its facility, of its chemical holdings, of its location as relevant— 

whether it’s in an urban or rural area, whether that facility is at 

high risk of terrorist attack or exploitation, and if it is—and about 

10 percent of the facilities that submit this paperwork to us ultimately are determined to be high risk—if a facility is issued that 

determination we then issue it a risk tier. 

So it’s placed in one of our four risk tiers and then embarks upon 

the process of collaborating with us as it develops a site security 

plan that’s ultimately approved and then entering into the regular 

cycle of compliance—— 

Mr. CARTER. So it is incumbent upon the business to initiate it? 

Mr. WULF. It is. 

Mr. CARTER. OK. 

Mr. WULF. But we prioritize getting the word out about those reporting obligations because the community of those who hold 

chemicals is very diverse. 

Mr. CARTER. I see. Right. 

Mr. WULF. So it’s not only the traditional chemical manufacturers. 

Mr. CARTER. Well, very quickly, because I want to get this in. I 

have two major seaports in my district. 

That seems like that would be a bugaboo to try to really have 

an overview of that—— 

Mr. WULF. Yes. No, that’s—— 

Mr. CARTER [continuing]. Of everything that’s going through 

those ports. 

Mr. WULF. Yes. There is a lot of chemical infrastructure on the 

water at the ports. Our friends at the Coast Guard have the responsibility actually—— 

Mr. CARTER. OK. 

49 

Mr. WULF [continuing]. For managing that. So facilities that are 

regulated by the Coast Guard are specifically exempted from 

CFATS. 

Mr. CARTER. Right. 

Mr. WULF. So we work very closely with the Coast Guard. 

Mr. CARTER. Good. Thank you very much. 

Mr. WULF. Absolutely. 

Mr. CARTER. And I yield back. 

Mr. MCKINLEY. Thank you very much. 

Now, if I could, you’ve been going here almost 2-plus hours on 

this thing. But let me just conclude with one question, if I could— 

the privilege of the chair. 

I want to clarify your answer to Congressman Johnson about the 

listing of items on Appendix 1, because I’ve spoken to several 

chemical manufacturers in our district and they claim that on Appendix 1 is this designation of high priority chemicals—you understand that. They claim the existing statute is silent over whether 

it’s subject to notice in rulemaking versus the sole discretion of 

DHS. 

I thought you said that it had to go through notice in rulemaking. I just want for the record you saying it does go under—— 

Mr. WULF. Yes. It is part of our regulation and so I have a crack 

team of lawyers who tell me that as a result of its status in the 

regulation it is subject to notice and comment rulemaking pursuant 

to the administrative procedures. 

Mr. MCKINLEY. So these manufacturers maybe are just mistaken 

where they think it’s silent? 

Mr. WULF. Yes. It may not be explicitly addressed in the statute 

but there are other legal frameworks that apply to it. 

Mr. MCKINLEY. OK. Thank you very much. Thank you. 

Mr. WULF. Absolutely. 

Mr. MCKINLEY. Seeing that there are no further members wishing to participate and ask questions, I’d like to thank our witness 

again for being here today. 

And with that, we will end the first panel. 

Mr. WULF. Thank you so much. 

[Pause.] 

Mr. MCKINLEY. So if we could, we call up the second panel now— 

and your placards. 

[Pause.] 

OK. We want to thank our witnesses for being here today, many 

of you just went through the first panel and so we begin the second 

panel so—and your taking the time to testify before this subcommittee. 

Today’s witnesses will have the opportunity to give opening 

statements followed by a round of questions from the members that 

are present. 

Our second panel for today’s hearing includes Chris Currie, Director of the Emergency Management National Preparedness and 

Critical Infrastructure Protection, Homeland Security, and the Justice Team in the U.S. Government Accountability Office; Mr. 

Brown, President and CEO of Brown Chemical Company; we also 

have Mike Wilson, National Director for Occupational and Environmental Health in BlueGreen Alliance; Mr. Roberts, Principal of 

50 

Chemical Security Group, LLC; and James Conrad, the Principal 

of Conrad Law and Policy Council on behalf of the Society of Chemical Manufacturers and Affiliates; and lastly, Yvette Arellano, the 

Policy Research and Grassroots Advocate of the Texas Environmental Justice and Advocacy Services. 

So we appreciate you. The subcommittee appreciates all of you 

for being here today and the patience of working with us on this, 

and we will begin the panel discussion with Mr. Currie for his 

opening statement of 5 minutes. 

STATEMENTS OF CHRIS P. CURRIE, DIRECTOR, EMERGENCY 

MANAGEMENT, NATIONAL PREPAREDNESS, AND CRITICAL 

INFRASTRUCTURE PROTECTION, HOMELAND SECURITY 

AND JUSTICE TEAM, U.S. GOVERNMENT ACCOUNTABILITY 

OFFICE; DOUG BROWN, PRESIDENT AND COO, BROWN 

CHEMICAL COMPANY; DR. MIKE WILSON, NATIONAL DIRECTOR, OCCUPATIONAL AND ENVIRONMENTAL HEALTH, 

BLUEGREEN ALLIANCE; STEVE ROBERTS, PRINCIPAL, 

CHEMICAL SECURITY GROUP, LLC; JAMES CONRAD, PRINCIPAL, CONRAD LAW AND POLICY COUNSEL, ON BEHALF OF 

SOCIETY OF CHEMICAL MANUFACTURERS AND AFFILIATES; 

YVETTE ARELLANO, POLICY RESEARCH AND GRASSROOTS 

ADVOCATE, TEXAS ENVIRONMENTAL JUSTICE ADVOCACY 

SERVICES 

STATEMENT OF CHRIS P. CURRIE 

Mr. CURRIE. Thank you, Mr. Chairman, Ranking Member Tonko, 

other members of the committee that are here. 

I think this hearing is really well-timed. CFATS is over 10 years 

old. We have spent almost a billion dollars of taxpayer money implementing it, getting it up and running, and industry has spent 

its own dollars doing the same thing. 

GAO has been assessing this program for almost a decade, and 

I want to be clear that we have no position on reauthorization. 

That’s a decision for Congress. 

Our jobs, as always, is to help you make those decisions with information on how well programs like this are working. In that regard, it’s no secret that this program has had challenges. 

Today, after numerous GAO recommendations and heavy oversight by Congress, CFATS has addressed many of the management 

challenges it faced early on. I think DHS deserves a lot of credit 

for that. I think Congress deserves a lot of credit for the oversight. 

I’d like to summarize just some of our past work and where DHS 

is in addressing the recommendations. First, just identifying facilities originally that could have been subject to this regulation was 

daunting and a huge challenge. 

In 2014, we identified, through our own work, chemical facilities 

that were not reporting ammonium nitrate holdings, for example, 

to DHS as they were required to do. 

We recommended the DHS work with EPA, other agencies, and 

states to better share their separate data sources to close this gap. 

Since then, DHS implemented this recommendation and identified 

1,000 additional facilities that should have complied with CFATS. 

51 

Assessing facility risk levels, as was discussed a lot on the first 

panel, and improving site security plans has also been a complicated process. 

Specifically, we recommended that DHS improve its process for 

assessing facility risk, or tiering, as was mentioned, and have this 

process peer reviewed, and DHS has taken steps to address these 

issues as well. 

DHS also eliminated the backlog for reviewing and approving facility site plans, which at one point we estimated to be 7 to 9 years 

long. 

More recently, DHS overhauled and streamlined its tools for 

gathering information from facilities and assessing the risk and, 

according to most industry officials and facilities we have talked to 

so far, the new tool is much easier to use and understand. 

As of June 2008, DHS told us they’ve processed hearing results 

for all but 226 facilities nationwide. Compliance inspections are 

also a critical piece of the program. These inspections ensure that 

facilities are implementing and maintaining the security measures 

in their plans. 

In our 2015 report, at that time DHS had only done 83 of these 

inspections. They recently told us the number is now up to over 

3,500, and this is promising, but DHS still hasn’t fully implemented our recommendation to establish a final procedure for conducting these inspections. 

They have one in draft that they are using and they tell us they 

expect to finalize that later this year. However, just fixing past 

problems is not enough to declare victory. Now it’s an important 

time, I think, to shift our mind set from establishing the functional 

components of a regulatory program to questions about what do we 

expect from CFATS in the future. 

Many of these will be addressed in the report we plan to issue 

next month. First, it’s critical that the CFATS program be able to 

measure over time how risk and vulnerability are actually being reduced and not just focus on outputs like inspection numbers. 

In the past, we have found weakness in how the program measures performance and we continue to assess their progress in this 

area. 

Second, the program must evolve and can’t be static. New security threats such as cyber have to be constantly considered. Also, 

the program is in a unique position to help the industry by communicating these threats and best practices. 

Further, a balance must be struck between sharing information 

and protecting security. For example, recently deadly incidents 

show how important it is that first responders know what they are 

responding to at these facilities and how to address it. 

We are assessing these and other issues in our ongoing work 

and, as I mentioned, we expect a report out on those specific things 

next month. 

This concludes my statement and I look forward to the discussion. 

[The prepared statement of Mr. Currie follows:] 

52 


34591.013

For Release on Delivery 

Expected at 10 a.m ET 

Thursday, June 14, 2018 

GA0-18-613T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on 

Environment, Committee on Energy and 

Commerce, House of Representatives 

CRITICAL 

INFRASTRUCTURE 

PROTECTION 

Progress and Challenges 

in DHS's Management of 

Its Chemical Facility 

Security Program 

Statement of Chris Currie, Director, 

Homeland Security and Justice 
53 


34591.014

Highlights of GAO·i8-613T, a testimony before the Subcommittee on Environment, 

Committee ~m Energy and Commerce, House 

of Representatives, 

Why GAO Did This Study 

Thousands of facilities have hazardous 

chemicals that could be targeted or 

used to inflict mass casualties or harm 

surrounding populations in the United 

States. In accordance with the DHS 

Appropriations Act, 2007, DHS 

established the CF ATS program in 

2007 to, among other things, identify 

and assess the security risk posed by 

chemical facilities. DHS inspects highrisk facilities after it approves facility 

security plans to ensure that the 

facilities are implementing required 

security measures and procedures. 

This st9:tement sumtnatizes progr~ss 

and challenges related to DHS's 

CFATS program management. This 

statement is based on prior products 

GAO issued ftom July 2012 through 

June 2017, along with updates 

conducted in June 2018 on DHS 

actions to address prior GAO 

recommendations. To conduct the prior 

work, GAO reviewed relevant laws, 

regulations, and DHS policies for 

administering the CFATS program, 

how OHS assesses risk, and data on 

high-risk chemical facilities. GAO also 

interviewed DHS officials and reviewed 

information on OHS actions to 

implement its prior recommendations. 

What GAO Recommends 

GAO has made various 

recommeridations to strengthen DHS's 

management of the CFATS program, 

with which PI:IS has generally agreed. 

DHS has implemented or described 

planned actions to ad'clress most of 

these recommendations. 

VIew GA0'...18:'613T. For more information, 

contact Chrls 'Currie at (404} 67S..1875 or 

curriec@giJo.gov. 

CRITICAL INFRASTRUCTURE PROTECTION 

Progress and Challenges in OHS's Management of Its 

Chemical Facility Security Program 

What GAO Found 

The Department of Homeland Security (DHS) has made progress addressing 

challenges that GAO's past work identified to managing the Chemical Facility 

Anti-Terrorism Standards (CFATS) program The following summarizes progress 

made and challenges remaining in key aspects of the program. 

Identifying high-risk chemical facilities. In July 2015, GAO reported that DHS 

used self-reported and unverified data to determine the risk of facilities holding 

toxic chemicals that could threaten surrounding communities if released. GAO 

recommended that DHS should better verify the accuracy of facility-reported 

data. DHS implemented this recommendation by revising its methodology so it 

now calculates the risk of toxic release, rather than relying on facilities to do so. 

Assessing risk and prioritizing facilities. In April2013, GAO reported 

weaknesses in multiple aspects of DHS's risk assessment and prioritization 

approach. GAO made two recommendations for DHS to review and improve this 

process, including that DHS enhance its risk assessment approach to 

incorporate all of the elements of consequence, threat, and vulnerability 

associated with a terrorist attack involving certain chemicals. DHS launched a 

new risk assessment methodology in October 2016 and is currently gathering 

new or updated data from about 27,000 facilities to (1) determine which facilities 

should be categorized as high-risk because of the threat of sabotage, theft or 

diversion, or a toxic release and (2) assign those facilities deemed high risk to 

one of four nsk-based tiers, GAO has ongoing work assessing these efforts and 

will report later this summer on the extent to which they fully address prior 

recommendations. 

Reviewing and approving facilities' site security plans. DHS is to review 

security plans and vls!t facilities to ensure their security measures meet DHS 

standards. In April 2013, GAO reported a 7 to 9 year backlog for these reviews 

and visits. In July 2015, GAO reported that DHS had made substantial progress 

in addressing the backlog-estimating that it could take between 9 and 12 

months for DHS to review and approve security plans for the approximately 900 

remaining facilities. DHS has since taken additional action to expedite these 

activities and has eliminated this backlog 

Inspecting facilities and ensuring compliance. In July 2015, GAO reported 

that DHS conducted compliance inspections at 83 of the 1, 727 facilities with 

approved security plans. GAO found that nearly half of the inspected facilities 

were not fully compliant with their approved security plans and that DHS did not 

have documented procedures for managing facilities' compliance. GAO 

recommended that DHS document procedures for managing compliance. As a 

result, DHS has developed an enforcement procedure and a draft compliance 

inspection procedure and expects to finalize the compliance inspection 

procedure by the end of fiscal year 2018. 

-------------United States Government Accountability Office 
54 


34591.015

Chairman Shimkus, Ranking Member Tonko, and Members of the 

Subcommittee: 

Thank you for the opportunity to discuss our past work on the Department 

of Homeland Security's (DHS) efforts to manage its Chemical Facility 

Anti-Terrorism Standards (CFATS) program. Thousands of facilities that 

produce, use, or store hazardous chemicals could be of particular interest 

to terrorists who are intent on using toxic chemicals to inflict mass 

casualties in the United States. These chemicals could be released from 

a facility to cause harm to surrounding populations; they could be stolen 

and used as chemical weapons or as their precursors (the ingredients for 

making chemical weapons); or they could be stolen and used to build an 

improvised explosive device. Past incidents remind us of the danger that 

these chemicals pose, including the 2013 ammonium nitrate explosion at 

a fertilizer storage and distribution facility in West, Texas, which killed at 

least 14 people and damaged or destroyed at least 200 homes, and the 

1995 domestic terrorist attack on the federal building in Oklahoma City, 

Oklahoma, where 168 people were killed using ammonium nitrate 

fertilizer mixed with fuel oiL 

Page 1 GA0~18~613T Critieallnfrastructure Protection 
55 


34591.016

Figure 1: Photographs of Damage from the Explosion in West, Texas in April2013 

Source· Che!l)lca! Safety Board l GA0-18..013T 

Page 2 GA0·18~613T Critical Infrastructure Protection 
56 


34591.017

The Department of Homeland Security Appropriations Act, 2007, required 

DHS to issue regulations to establish risk-based performance standards 

(performance standards) for securing high-risk chemical facilities.' DHS 

subsequently established the CFA TS program in 2007 to, among other 

things, identify high-risk chemical facilities and assess the risk posed by 

them; place facilities considered to be high risk into one of four risk-based 

tiers (with tier 1 being the highest risk tier and 4 being the lowest); assess 

facility security; approve security plans prepared by facilities; and inspect 

facilities to ensure compliance with regulatory requirements. 2 DHS's 

CFATS rule established 18 performance standards that identify the areas 

for which a facility's security posture are to be examined, such as 

perimeter security, access control, and cyber security. 3 To meet these 

standards, facilities are free to choose whatever security programs or 

processes they deem appropriate so long as DHS determines that the 

facilities achieve the requisite level of performance in each of the 

applicable areas. The Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of 2014 (CFATS Act of 2014) enacted in December 

2014, in effect, reauthorized the CFATS program for an additional4 

years, while also imposing additional implementation requirements on 

DHS for the program. 4 DHS's National Protection and Programs 

Directorate's Infrastructure Security Compliance Division manages the 

CFATS program. According to DHS, the Department received 

approximately $911 million for the CFATS program for the period 

beginning fiscal year 2007 through fiscal year 2018. 

My testimony today summarizes our past work examining DHS's 

management of the CFATS program, and provides updates on actions 

DHS has taken to address our prior recommendations. 5 This testimony is 

1Pub L. No. 109-295, § 550, 120 Stat.1335, 1388-89 (2006). 

2

See 72 Fed. Reg. 17,792 (Apr. 9, 2007) (codified as amended at 6 C.F.R. pt. 27). 

3DHS has enumerated 18 risl<~based performance standards that covered chemical 

facilities must meet to comply with CFATS. See 6 C.F.R § 27.230. 

4See Pub. L. No. 113-254, 128 Stat. 2898 (2014); 6 U.S.C. §§ 621-629. The Act amended 

the Homeland Security Act of 2002, Pub. L. No. 107-296, 116 Stat. 2135 (2002), as 

amended, by adding Title XXI-Chemicat Facility Anti-Terrorism Standards-and 

expressly repealing the program's authority under the fiscal year 2007 DHS appropriations 

act 

5We are currently reviewing the CFATS program at the request of the Chairmen and 

Ranking Members of the Senate Committee on Homeland Security and Governmental 

Affairs and the House Committee on Homeland Security. We intend to issue a report 

based on that work later this summer 

Page 3 GA0·18-613T Critical Infrastructure Protection 
57 


34591.018

based on our reports issued from July 2012 through June 20176 For 

these reports, we reviewed applicable laws and regulations, DHS policies 

and procedures, DHS data on tiered facilities, information on the 

approach DHS used to determine a facility's risk and process for 

reviewing security plans. We also interviewed DHS officials about facility 

tiering, how DHS assesses risk, and how it processes security plans. 

Additional details on the scope and methodology are available in our 

published reports. In addition, this statement contains updates as of June 

2018 from DHS on actions it has taken to address the recommendations 

made in our prior reports. The work upon which this statement is based 

was conducted in accordance with generally accepted government 

auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We 

believe that the evidence obtained provides a reasonable basis for our 

findings and conclusions based on our audit objectives. 

6GAO, Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its 

Chemical Security Program, but It Is Too Early to Assess Results, GAO~ 12~515T 

(Washington, D.C.: July 26, 2012); Critical Infrastructure Protection: DHS Efforts to 

Assess Chemical Security Risk and Gather Feedback on Facility Outreach Can Be 

Strengthened, GA0~13~353 {Washington, D.C.: Apr. 5, 2013); Critical Infrastructure 

Protection: OHS Efforts to Identify, Prioritize, Assess, and Inspect Chemical Facilities, 

GA0~14~365T (Washington, D.C.; Feb. 27, 2014); Critical Infrastructure Protection: 

Obse~vations on DHS Efforls to Implement and Manage Its Chemical Security Program, 

GA0-14-608T (Washington, D.C.: May 14, 2014); Cn"ticallnfrastructure Protection: DHS 

Action Needed to Venly Some Chemical Facility Information and Manage Compliance 

Process, GA0-15-614 (\'Vashington, D.C., July 22, 2015); Critical Infrastructure Protection: 

Improvements Needed for DHS's Chemical Facility Whistleblower Report Process, 

GA0-16-572, (Washington, D.C.: Jut 12, 2016); and cn·ticaf Infrastructure Protection: DHS 

Has Implemented Its Chemical Security Expedited Approval Program and Participation To 

Date Has Been Limited, GA0-17-502 (Washington. D.C.: June 29, 2017) 

Page 4 GA0-18-613T Critical Infrastructure Protection 
58 


34591.019

DHS Has Made 

Progress Addressing 

Past Challenges, But 

Some Actions are Still 

In Progress 

Identifying High-Risk 

Chemical Facilities 

Our past work has identified progress and challenges in a number of 

areas related to DHS's management of the CFATS program including (1) 

the process for identifying high risk chemical facilities; (2) how it assesses 

risk and prioritizes facilities; (3) reviewing and approving facility security 

plans; (4) how it conducts facility compliance inspections; and (5) efforts 

to conduct stakeholder outreach and gather feedback. DHS has made a 

number of programmatic changes to CFATS in recent years that may also 

impact its progress in addressing our open recommendations; these 

changes are included as part of our ongoing review of the program. 

In May 2014, we found that more than 1,300 facilities had reported having 

ammonium nitrate to DHS. However, based on our review of state data 

and records, there were more facilities with ammonium nitrate holdings 

than those that had reported to DHS under the CFATS program-' Thus, 

we concluded that some facilities that were required to report may have 

failed to do so. 8 We recommended that DHS work with other agencies, 

including the Environmental Protection Agency (EPA), to develop and 

implement methods of improving data sharing among agencies and with 

states as members of a Chemical Facility Safety and Security Working 

Chemical Safety: Actions Needed to Improve Federal Oversight of Facilities with 

Ammonium Nitrate, GA0~14~274 (Washington, D.C .. May 19, 2014). We reviewed 

Emergency Planning and Community Right-to-Know Act of 1986 data from Texas and 

Alabama, which have different reporting criteria than CFATS. Under section 312 of the Act 

and Environmental Protection Agency's regulations, facilities with 10,000 pounds or more 

of ammonium nitrate generally must submit an annual chemica! inventory report to their 

designated state and local authorities. 42 U.S.C. § 11022, 40 C.FR § 370.10(a)(2)(i). 

8Consistent with law and regulation, certain facilities-including, in general, facilities 

regulated under the Maritime Transportation Security Act of 2002 (Public Law 1 07~295, 

116 Stat. 2064), public water systems or wastewater treatment facilities, facilities owned 

and operated by the Department of Defense or the Department of Energy, and facilities 

subject to regulation by the Nuclear Regulatory Commission or in accordance with the 

Atomic Energy Act of 1954-are not subject to regulation under CFATS and are referred 

to as excluded facilities. See 6 U.S.C. § 621{4); 6 C.F.R. § 27.110(b). In addition, pursuant 

to its authority under 6 C.F.R. § 27.210(c), DHS has extended the dead!lne for submitting 

CFATS reports until further notice for certain agricultural production facilities, such as 

farms, ranches, turigrass growers. golf courses, nurseries, and public and private parks. 

See Notice to Agricultural Facilities About Requirement To Complete DHS' Chemical 

Security Assessment Tool, 73 Fed. Reg. 1640 (Jan. 9, 2008). 

Page 5 GA0~18-S13T Critical Infrastructure Protection 
59 


34591.020

Group. 9 DHS agreed with our recommendation and has since addressed 

it. Specifically, DHS compared DHS data with data from other federal 

agencies, such as EPA, as well as member states from the Chemical 

Facility Safety and Security Working Group to identify potentially 

noncompliant facilities. As a result of this effort, in July 2015, DHS 

officials reported that they had identified about 1,000 additional facilities 

that should have reported information to comply with CFATS and 

subsequently contacted these facilities to ensure compliance. DHS 

officials told us that they continue to engage with states to identify 

potentially non-compliant facilities. For example, as of June 2018, DHS 

officials stated they have received 43 lists of potentially noncompliant 

facilities from 34 state governments, which are in various stages of review 

by DHS. DHS officials also told us that they recently hired an individual to 

serve as the lead staff member responsible for overseeing this effort. 

DHS has also taken action to strengthen the accuracy of data it uses to 

identify high risk facilities. In July 2015, we found that DHS used selfreported and unverified data to determine the risk categorization for 

facilities that held toxic chemicals that could threaten surrounding 

communities if released. 10 At the time, DHS required that facilities selfreport the Distance of Concern-an area in which exposure to a toxic 

chemical cloud could cause serious injury or fatalities from short-term 

exposure-as part of its Top-Screen." We estimated that more than 

2,700 facilities with a toxic release threat had misreported the Distance of 

Concern and therefore recommended that DHS (1) develop a plan to 

implement a new Top-Screen to address errors in the Distance of 

Concern submitted by facilities, and (2) identify potentially miscategorized 

9Executive Order 13650-fmproving Chemical Facility Safety and Security established a 

Chemical Facility Safety and Security Working Group, composed of representatives from 

DHS; EPA; and the Departments of Justice, Agriculture, Labor, and Transportation, and 

directed the working group to identify ways to improve coordination with state and local 

partners; enhance federal agency coordination and information sharing: modernize 

policies, regulations and standards; and work with stakeholders to identify best practices. 

See Exec. Order No. 13,650 (Aug. 1, 2013), 78 Fed. Reg. 48,029 (Aug. 7, 2013). 

10GA0-15-614. 

11 Any chemica! facility that possesses any of the 322 chemicals in the quantities that meet 

or exceed the threshold quanttty or concentration outlined in Appendix A to the DHS 

CFATS rule is required to complete the Chemical Security Assessment Tool (CSAT) Top 

Screen-which !S the initial screening tool or document whereby the facility is to provide 

DHS various data, including the name and location of the facility and the chemicals and 

their quantities at the site. See 6 C.F.R. § 27.200(b); see also 72 Fed. Reg. 65,396 (Nov. 

20, 2007) (codified at 6 C.F.R. pt. 27, App. A) 

Page 6 GA0·18-613T Critical Infrastructure Protection 
60 


34591.021

Assessing Risk and 

Prioritizing Facilities 

facilities that could cause the greatest harm and verify that the Distance 

of Concern of these facilities report is accurate." DHS has fully 

addressed both of these recommendations. Specifically, DHS 

implemented an updated Top-Screen in October 2016 and now collects 

data from facilities and calculates the Distance of Concern itself, rather 

than relying on the facilities' calculation. In response to our second 

recommendation, in November 2016, DHS officials stated they completed 

an assessment of all Top-Screens that reported threshold quantities of 

toxic release chemicals of interest and identified 158 facilities with the 

potential to cause the greatest harm. As of May 2017, according to ISCD 

officials, 156 of the 158 facilities submitted updated Top-Screens and 145 

of the 156 Top-Screens had undergone a quality assurance review 

process. 

DHS has also taken actions to better assess regulated facilities' risks in 

order to place the facilities into the appropriate risk tier. In April 2013, we 

reported that DHS's risk assessment approach did not consider all of the 

elements of threat, vulnerability, and consequence associated with a 

terrorist attack involving certain chemicals. Our work showed that DHS's 

risk assessment was based primarily on consequences from human 

casualties, but did not consider economic consequences, as called for by 

the National Infrastructure Protection Plan (NIPP) and the CFATS 

regulation. We also found that (1) DHS's approach was not consistent 

with the NIPP because it treated every facility as equally vulnerable to a 

terrorist attack regardless of location or on-site security and (2) DHS was 

not using threat data for 90 percent of the tiered facilities-those tiered for 

the risk of theft or diversion-and using 5-year-old threat data for the 

remaining 1 0 percent of those facilities that were tiered for the risks of 

release or sabotage. 13 We recommended that DHS enhance its risk 

assessment approach to incorporate all elements of risk and conduct a 

12We recalculated the Distance of Concern for a generalizable sample of facilities-a 

simple random sample of 475 facilities from the population of 36,811 facilities that 

submitted Top-Screens since the inception of the CFATS program in 2007 through 

January 2, 2015-and compared these results to what faci!lties reported in their TopScreen submission. Based upon this sample, we estimated that 4,173 facilities with a toxic 

release chemical misreported the Distance of Concern, with an associated 95 percent 

confidence interval of 2,798 to 5,822 facilities. 

13For theft or diversion, DHS's model assumes that a terrorist will steal or have the 

chemical of interest diverted to him or herself and then estimates the risk of a terrorist 

attack using the chemical of interest in a way that causes the most harm at an unspeclfied 

off-site location 

Page 7 GAQ.18-613T Critical infrastructure Protection 
61 


34591.022

Reviewing and Approving 

Facility Site Security Plans 

peer review after doing so. DHS agreed with our recommendations and 

has made progress towards addressing them. 

Specifically, with regard to our recommendation that DHS enhance its risk 

assessment approach to incorporate all elements of risk, DHS worked 

with Sandia National Laboratories to develop a model to estimate the 

economic consequences of a chemical attack. In addition, DHS worked 

with Oak Ridge National Laboratory to devise a new tiering methodology, 

called the Second Generation Risk Engine. In so doing, DHS revised the 

CFATS threat, vulnerability, and consequence scoring methods to better 

cover the range of CFATS security issues. Additionally, with regard to our 

recommendation that DHS conduct a peer review after enhancing its risk 

assessment approach, DHS conducted peer reviews and technical 

reviews with government organizations and facility owners and operators, 

and worked with Sandia National Laboratories to verify and validate the 

new tiering approach. We are currently reviewing the reports and data 

that DHS has provided about its new tiering methodology as part of our 

ongoing work and will report on the results of this work later this summer. 

To further enhance its risk assessment approach, in fall 2016, DHS also 

revised its Chemical Security Assessment Tool (CSAT), which supports 

DHS efforts to gather information from facilities to assess their risk. 

According to DHS officials, the new tool-called CSAT 2.0-is intended to 

eliminate duplication and confusion associated with DHS's original CSAT. 

DHS officials told us that they have improved the tool by revising some 

questions in the original CSAT to make them easier to understand; 

eliminating some questions; and pre-populating data from one part of the 

tool to another so that users do not have to retype the same information 

multiple times. DHS officials also told us that the facilities that have used 

the CSAT 2.0 have provided favorable feedback that the new tool is more 

efficient and less burdensome than the original CSAT. Finally, DHS 

officials told us that as of June 2018, DHS has completed all notifications 

and has processed tiering results for all but 226 facilities. DHS officials 

stated they are currently working to identify correct points of contact to 

update registration information for these remaining facilities. We are 

currently assessing DHS's efforts to assess risk and prioritize facilities as 

part of our ongoing work and will report on the results of this work in our 

report later this summer. 

DHS has also made progress reviewing and approving facility site 

security plans by reducing the time it takes to review these plans and 

eliminating the backlog of plans awaiting review. In Apri12013, we 

Page 8 GA0-18-S13T Critical Infrastructure Protection 
62 


34591.023

reported that DHS revised its procedures for reviewing facilities' security 

plans to address DHS managers' concerns that the original process was 

slow, overly complicated, and caused bottlenecks in approving plans. 14 

We estimated that it could take DHS another 7 to 9 years to review the 

approximately 3,120 plans in its queue at that time. We also estimated 

that, given the additional time needed to do compliance inspections, the 

CFATS program would likely be implemented in 8 to 10 years. We did not 

make any recommendations for DHS to improve its procedures for 

reviewing facilities' security plans because DHS officials reported that 

they were exploring ways to expedite the process, such as reprioritizing 

resources and streamlining inspection requirements. In July 2015, we 

reported that DHS had made substantial progress in addressing the 

backlog-estimating that it could take between 9 and 12 months for DHS 

to review and approve security plans for the approximately 900 remaining 

facilities. 15 DHS officials attributed the increased approval rate to 

efficiencies in DHS's review process, updated guidance, and a new case 

management system. Subsequently, DHS reported in its December 2016 

semi-annual report to Congress that it had eliminated its approval 

backlog.'' 

Finally, we found in our 2017review that DHS also took action to 

implement an Expedited Approval Program (EAP). 17 The CFATS Act of 

2014 required that DHS create the EAP as another option that tier 3 and 

tier 4 chemical facilities may use to develop and submit security plans to 

14See GA0~13-353. A November 2011, internal ISCD memorandum, prepared by !SCD's 

former Director in consultation with the former Deputy Director and designated by OHS as 

"for official use only" (FOUO), expressed concerns about the management of the CFATS 

program. The IS CD memorandum, which was leaked to the media in December 2011, 

cited an array of challenges that, according to these officials, hindered JSCD's ability to 

implement and manage the CFATS program 

15GA0-15-614. 

16Department of Homeland Security, National Protection and Programs Directorate, 

Implementation Status of the Chem1cal Facility Anti~ Terrorism Standards: Second 

Semiannual, Fiscal Year 2016 Report to Congress (Washington, D.C.: December 9, 

2016). 

17GA0-17-502. 

Page 9 GA0-18-613T Critical infrastructure Protection 
63 


34591.024

DHS. 18 Under the program, facilities may develop a security plan based 

on specific standards published by DHS (as opposed to the more flexible 

performance standards using the standard, non-expedited process). DHS 

issued guidance intended to help facilities prepare and submit their EAP 

security plans to DHS, which includes an example that identifies 

prescriptive security measures that facilities are to have in place. 

According to committee report language, the EAP was expected to 

reduce the regulatory burden on smaller chemical companies, which may 

lack the compliance infrastructure and the resources of large chemical 

facilities, and help DHS to process security plans more quickly." If a tier 3 

or 4 facility chooses to use the expedited option, DHS is to review the 

plan to determine if it is facially deficient, pursuant to the reporting 

requirements of the CFATS Act of 2014. 20 If DHS approves the EAP site 

security plan, it is to subsequently conduct a compliance inspection. 

In 2017, we found that DHS had implemented the EAP and had reported 

to Congress on the program, as required by the CFATS Act of 2014. 21 In 

addition, as of June 2018 according to DHS officials, only 18 of the 3,152 

facilities eligible to use the EAP opted to use it. DHS officials we 

interviewed attributed the low participation to several possible factors 

including: 

18See 6 U.S.C. § 622(c)(4). Under the CFATS rule, once a facility is assigned a final tier, it 

is to submit a site security plan or participate in an alternative security program in lieu of a 

site security plan. An alternative security program is a third-party or industry organization 

program, a local authority, state, or federal government program, or any element or aspect 

thereof that DHS determines meets the requirements of the regulation and provides an 

equivalent level of security to that established by the regulation. See 6 C.F.R. § 27.105. 

19S. Rep. No. 113-263, at 9-10 (Sept. 18. 2014). 

20A facially deficient site security plan is defined as a security plan that does not support a 

certification that the security measures in the plan address the security vulnerability 

assessment and risk-based performance standards, based on a review of the facility's site 

security plan, the facility's Top-Screen, the facility's security vu!nerabllity assessment, or 

any other information that the facility submits to ISCD or !SCD obtains from a public 

source or other source. 6 U s_c. § 621 {7). SpecJficaUy, !SCD determines that an EAP site 

security plan is deficient if it does not include existing or planned measures which satisfy 

applicable Risk Based Pertormance Standard; materially deviates from at least one EAP 

security measure without adequately explaining that the facility has a comparable security 

measure: and/or contains a misrepresentation, omission, or inaccurate description of at 

least one EAP security measure. A facility is to implement any planned security measures 

within 12 months of the EAP site security plan's approval because ISCD has determined 

that it is unlikely that all required security measures will be in place when a facility submits 

its p!an to !SCD. 

21 GA0-17-502. 

Page 10 GA0-18-613T Critical Infrastructure Protection 
64 


34591.025

Inspecting Facilities and 

Ensuring Consistent 

Compliance 

DHS had implemented the expedited program after most eligible 

facilities already submitted standard (non-expedited) security plans to 

DHS; 

facilities may consider the expedited program's security measures to 

be too strict and prescriptive, not providing facilities the flexibility of 

the standard process; and 

the lack of an authorization inspection may discourage some facilities 

from using the expedited program because this inspection provides 

useful information about a facility's security. 22 

We also found in 2017 that recent changes made to the CFATS program 

could affect the future use of the expedited program. 23 As discussed 

previously, DHS has revised its methodology for determining the level of 

each facility's security risk, which could affect a facility's eligibility to 

participate in the EAP. DHS continues to apply the revised methodology 

to facilities regulated under the CFATS program and but it is too early to 

assess the impact on participation in the EAP. 

In our July 2015 report, we found that DHS began conducting compliance 

inspections in September 2013, and by April 2015, had conducted 

inspections of 83 of the 1, 727 facilities that had approved security plans. 24 

Our analysis showed that nearly half of the facilities were not fully 

compliant with their approved site security plans and that DHS had not 

used its authority to issue penalties because DHS officials found it more 

productive to work with facilities to bring them in compliance. We also 

found that DHS did not have documented processes and procedures for 

managing the compliance of facilities that had not implemented planned 

measures by the deadlines outlined in the plans. We recommended that 

DHS document processes and procedures for managing compliance to 

provide more reasonable assurance that facilities implement planned 

measures and address security gaps. DHS agreed and has taken steps 

toward implementing this recommendation. DHS updated its CFATS 

Enforcement Standard Operating Procedure (SOP) and has made 

progress on the new CFATS Inspections SOP. Once completed these 

22An authorization inspection consists of an initial, physical review of the facility to 

determine if the Top-Screen, security vulnerability assessment, and site security plan 

accurately represent and address the risks for the facility 

23GA0-17-502. 

24GA0-15-614. 

Page 11 GA0~18-613T Critical Infrastructure Protection 
65 


34591.026

Stakeholder Outreach and 

Feedback 

GAO Contact and 

Staff 

Acknowledgements 

(102837) 

two documents collectively are expected to formally document the 

processes and procedures currently being used to track noncompliant 

facilities and ensure they implement planned measures as outlined in 

their approved site security plans, according to ISCD officials. DHS 

officials stated they expect to finalize these procedures by the end of 

fiscal year 2018. We are examining compliance inspections as part of our 

ongoing work and will report on the results of our work in our report later 

this summer. 

In April 2013, we reported that DHS took various actions to work with 

facility owners and operators, including increasing the number of visits to 

facilities to discuss enhancing security plans, but that some trade 

associations had mixed views on the effectiveness of DHS's outreach. 25 

We found that DHS solicited informal feedback from facility owners and 

operators in its efforts to communicate and work with them, but did not 

have an approach for obtaining systematic feedback on its outreach 

activities. We recommended that DHS take action to solicit and document 

feedback on facility outreach consistent with DHS efforts to develop a 

strategic communication plan. DHS agreed and implemented this 

recommendation by developing a questionnaire to solicit feedback on 

outreach with industry stakeholders and began using the questionnaire in 

October 2016. 

Chairman Shimkus, Ranking Member Tonka, and Members of the 

Subcommittee, this completes my prepared statement. I would be 

pleased to respond to any questions that you may have at this time. 

If you or your staff members have any questions about this testimony, 

please contact me at (404) 679-1875 or curriec@gao.gov. Contact points 

for our Offices of Congressional Relations and Public Affairs may be 

found on the last page of this statement. Other individuals making key 

contributions to this work include John Martin, Assistant Director; and 

Brandon Jones, Analyst-in-Charge; Michael Lennington, Ben Emmel, and 

Hugh Paquette. 

25GA0-13-353. 

Page 12 GA0·18·613T Critical Infrastructure Protection 
66 


34591.027

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material. permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 
67 


34591.028

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Strategic Planning and 

External Liaison 

The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO's commitment to good government 

is reflected in its core values of accountabllity, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO's website (https:llwww.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https:llwww.gao.gov 

and select "E-mail Updates." 

The price of each GAO publication reflects GAO's actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO's website, https:llwww.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates Listen to our Podcasts. 

Visit GAO on the web at https:llwww.gao.gov 

Contact: 

Website: https:llwww.gao.gov/fraudneUfraudnet.htm 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

US. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

James-Chnst1an Blackwood, Managing Director, spel@gao.gov, (202) 512-4707 

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548 

1.} Please Print on Recycled Paper 
68 

Mr. MCKINLEY. Thank you, Mr. Currie. 

And now the chair recognizes Mr. Brown for his 5 minutes. 

STATEMENT OF DOUG BROWN 

Mr. BROWN. Good morning, Vice Chairman McKinley, and Ranking Member Tonko, and members of the subcommittee. 

My name is Doug Brown and I am President and CEO of Brown 

Chemical, a chemical distributor based in Oakland, New Jersey. I 

am also the current chairman of the National Association of Chemical Distributors—NACD. 

I thank you for holding this important hearing today on the 

Chemical Facility Anti-Terrorism Standards program and I am 

pleased to provide testimony. 

Brown Chemical was founded in 1936. It is a fourth generation 

family-owned and operated business with 14 employees. We operate facilities in Oakland and Patterson, New Jersey. 

Brown Chemical direct sells, distributes, or packages over 350 

products to approximately 400 customers in 41 states. We’ve been 

practising NACD’s responsible distribution since its inception in 

1991 when it became mandatory for all association members. 

This comprehensive program addresses environmental, health, 

safety, and security risks. Members companies are third-party 

verified to ensure the highest quality of performance in these 

areas. 

While security has always been an inherent element of responsible distribution, after the September 11 terrorist attacks NACD 

specifically added security elements to the program and the association continues to enhance these requirements. 

In 2013, NACD added a specific security code to responsible distribution and consolidated many prior requirements and improved 

others. 

Brown Chemical supports a long-term reauthorization of CFATS. 

I believe the CFATS program has made the chemical industry in 

our nation more secure. 

Since the program’s establishment in 2007, the industry has invested significant capital and training resources for its enhanced 

security measures at our facilities. 

While these investments did not help grow my business, they 

nonetheless ensured the security of my company, our employees, 

and the community. 

It is undeniable there were growing pains in the first few years 

of CFATS. The Department of Homeland Security has worked hard 

to address these issues and has made substantial improvements to 

run the program more efficiently. 

One reason for the success of the CFATS program is the fact that 

DHS has taken the time to truly learn about the diversity of the 

chemical industry and work with companies on security measures 

that meet the CFATS risk-based performance standards. 

DHS has taken a collaborative common sense approach in implementing the program while providing flexibility to each unique 

chemical facility in doing so. 

The clear objective of the CFATS program is to help facilities be 

more secure while not taking a punitive approach. DHS has excelled in outreach to the industry in three key ways: by publishing 

69 

numerous fact sheets and lessons learned documents, by interacting with facility owners and operators during the chemical sector security summits and other industry meetings, and always 

making inspectors and headquarters personnel available to talk 

through issues and answer questions. 

The 2014 reauthorization of the CFATS program, which, for the 

first time provided CFATS a multi-year authorization, further enhanced security efforts by providing regulatory certainty to both industry and DHS. 

This stability allowed DHS to increase efficiencies in the program 

while streamlining the information submission process for regulated facilities. 

I believe the CFATS program is strong and needs minimal 

change. One priority I can recommend is to require that any 

changes to the Appendix A chemicals of interest list remain subject 

to notice and comment rulemaking. 

Changes to the COI list could have major impacts on my business operations and security investments. Changes may be needed 

upon discovery of new threat information. But it is important for 

regulated companies like mine to be able to provide information to 

DHS and explain the impacts of any proposed changes. 

I also support the creation of a program under which DHS would 

recognize companies that meet certain criteria such as participation and an environmental health, safety, and security program 

like responsible distribution. 

By acknowledging responsible distributors through measures like 

less frequent inspections, DHS would then be able to prioritize resources on the noncompliant outliers that may pose a greater security risk. 

Brown Chemical supports the CFATS program and looks forward 

to working with the subcommittee on legislation to reauthorize this 

important regulation. A multi-year reauthorization of CFATS will 

provide the certainty needed to enhance the security of my chemical facilities and our nation. 

On behalf of Brown Chemical, I appreciate this opportunity to 

present our views on this important issue and I look forward to 

your questions. 

[The prepared statement of Mr. Brown follows:] 

70 


34591.029

PO Box 440 

Oakland, NJ 07436 

Testimony of Douglas A. Brown 

President and Chief Executive Officer 

Brown Chemical Company, Inc. 

before the 

U.S. House of Representatives 

Committee on Energy and Commerce 

Subcommittee on Environment 

on 

The Chemical Facility Anti-Terrorism Standards 

T: 201-337-0900 

naca· 

National Assodatlon of 

Chemkel Di•Uibutws 

June 14, 2018 

Toll Free: 800-888-9822 

www.brownchem.com 

Fax: 201-337-9026 

cdn:• 

Chemical Distribution Network 
71 


34591.030

Good Morning, Chairman Shimkus, Ranking Member Tonko, and members of the 

subcommittee. My name is Doug Brown, and I am president and CEO of Brown Chemical 

Company, Inc., a chemical distribution company based in Oakland, New Jersey. I am also the 

current chairman of the National Association of Chemical Distributors (NACO). I am pleased to 

provide testimony today on the Chemical Facility Anti-Terrorism Standards (CFATS) program. 

About Brown Chemical 

Brown Chemical was founded in 1936 in Paterson, New Jersey, and is a fourth-generation 

family-owned and operated chemical distribution company. Brown Chemical is a regional 

distributor, with 14 employees. Our corporate headquarters is in Oakland, New Jersey and 

includes general warehouse space of 46,000 square feet. We also operate a facility in 

Paterson, New Jersey, which houses bulk storage tanks of approximately 80,000 gallons and 

multiple packaging lines. Brown direct-sells, distributes or packages over 350 products to 

approximately 400 customers in 41 states. 

Brown Chemical is a member of NACO, an international association of nearly 440 chemical 

distributors and their supply-chain partners. While chemical distribution is big business, NACO 

members are predominantly small regional companies, many of which are multi-generational, 

and family owned like Brown Chemical. 

NACO Responsible Distribution" 

As background, all NACO members, including Brown Chemical, must implement policies and 

procedures to meet the highest standards in safety and performance through mandatory 

participation in NACO Responsible Distribution®, the association's third-party-verified 

environmental, health, safety, and security program. Through Responsible Distribution, NACD 

members demonstrate their commitment to continuous performance improvement in every 

phase of chemical storage, handling, transportation, and disposal operations. 

While security has always been an inherent element of Responsible Distribution, following the 

terrorist attacks of September 11, 2001, distributors were the first sector of the chemical 

industry to mandate security measures for its members. NACO continues to assess Responsible 

Distribution's security measures against current threats. In 2013, NACO added a specific 

Security Code to Responsible Distribution that consolidated many prior requirements and 

enhanced others. These requirements apply to all NACO members, including those who do not 

Page 2 
72 


34591.031

have facilities subject to the CFATS regulations. Over the past 16 years, NACO members 

both CFATS·regulated and non-CFATS·regulated companies have made substantial 

investments to make their facilities more secure. 

Brown Chemical Supports Long-Term Reauthorization of CFATS 

Brown Chemical supports a long-term reauthorization of CFATS. I believe the CFATS program 

has made the chemical industry and our nation much more secure. Since the program's 

establishment in 2007, the industry has invested significant capital and training resources 

towards enhanced or augmented security measures at our facilities. While these resources did 

not necessarily assist in growing business, they were nonetheless important to ensure the 

security of my company, employees, and community. 

A Collaborative Approach Has Led to Success 

From the beginning, the Department of Homeland Security (DHS) has taken a collaborative, 

commonsense approach in implementing the CFATS regulations. Despite being dependent on 

temporary appropriations measures during the first seven years of the program, the agency 

did a commendable job in writing the regulations and setting up the internal infrastructure to 

be able to implement and enforce the new standards. It is undeniable there were growing 

pains in the first few years of CFATS. By listening to and learning about industry, DHS was 

able to use this information to make improvements to run the program more efficiently. 

One reason for the success of the CFATS program is the fact that DHS has taken the time to 

truly learn about the diversity of the chemical industry and work with companies on security 

measures that meet the CFATS Risk Based Performance Standards while providing flexibility to 

each unique chemical facility in doing so. DHS has excelled in outreach to the industry by 

publishing numerous fact sheets and "lessons learned" documents; interacting with facility 

owners and operators during the Chemical Sector Security Summits and other industry 

meetings; and always making inspectors and headquarters personnel available to talk through 

issues and answer questions. 

In addition, DHS worked with NACO and the American Chemistry Council (ACC) to develop a 

CFATS Alternative Security Program (ASP) Guidance Document and Template to enhance the 

process for submitting site security plans. The ASP provides DHS with an alternate format to 

gain clarity about regulated facilities' security measures and how they meet or exceed CFATS 

Page 3 
73 


34591.032

requirements, while simplifying the compliance process and giving facility owners and 

operators a comprehensive security document to follow. Our firm has not utilized the ASP 

format, but I am aware of several firms in our trade association that have and have had good 

experiences in doing so. 

The Diverse World of Chemical Facilities- Ensuring Different Industries Are Aware of CFATS 

Obligations 

Following the tragic 2013 West Fertilizer fire and explosion, DHS doubled down on efforts to 

reach "outliers," those facilities that may not be aware of their obligations to inform the 

agency about their possession of chemicals of interest (COl) by filing Top Screens. Because 

chemical distributors sell COl to so many diverse industries, NACD agreed to assist DHS with 

this effort by sharing CFATS information with these customers through distribution of a 

special flyer to voluntarily inform members' customers about CFATS. 

Regulatory Certainty Needed for Efficiency 

The "Protecting and Securing Chemical Facilities from Terrorist Attacks Act" of 2014 (P.L. 113· 

254), which for the first time provided CFATS a multi-year authorization, further enhanced 

security efforts by providing regulatory certainty to both industry and DHS. This stability 

allowed DHS to increase efficiencies in the program while streamlining the information 

submission process for regulated facilities. 

For example, in 2016, DHS rolled out an enhanced risk tiering methodology to identify more 

accurately high-risk facilities and assign them to appropriate risk tiers. DHS notified all 

facilities with threshold quantities of CFATS chemicals of interest that they must submit new 

Top Screen surveys to the agency. At the same time, the agency launched version 2.0 of the 

Chemical Security Assessment Tool (CSAT 2.0), the online portal facilities use to submit Top 

Screens, Security Vulnerability Assessments, and Site Security Plans/ ASPs. My experience has 

been that CSAT 2.0, which allows facilities to submit their information and DHS to analyze the 

material more easily, is much more streamlined and user friendly than the prior version. DHS 

completed the re-tiering process in a timely and efficient manner and is now conducting 

authorization inspections and compliance inspections of facilities assigned to different tiers as 

well as newly regulated facilities. 

Page4 
74 


34591.033

CFATS Going Forward 

I believe the CFATS program is strong and needs minimal change other than a multi-year 

reauthorization. One priority I can recommend is to make sure any changes to the Appendix A 

list of chemicals remain subject to notice and comment rulemaking. Changes to the COl list 

could have major impacts on many companies' businesses and security investments. While 

changes may be needed upon discovery of new threat information, it remains important to 

give the regulated community the opportunity to provide information to the DHS and explain 

the impacts of any proposed changes. 

I would also support the creation of a program under which DHS would recognize companies 

that meet certain criteria such as participation in an environmental, health, safety, and 

security program such as Responsible Distribution. NACD members have made a strong 

commitment to operate their facilities safely and securely. Recognizing such responsible 

companies through measures such as less frequent inspections would allow DHS to prioritize 

resources to concentrate on the "outliers" or bad actors that may pose a greater security risk 

to themselves or the population at large. 

Conclusion 

Brown Chemical supports the CFATS program and looks forward to working with the 

subcommittee on legislation to reauthorize this important security regulation in the coming 

weeks and months. A multi-year reauthorization of CFATS would provide needed certainty and 

enhance the security of chemical facilities and our nation. 

On behalf of Brown Chemical, I appreciate this opportunity to present our views on this 

important issue. I look forward to your questions. 

Page 5 
75 

Mr. MCKINLEY. Thank you, Mr. Brown. 

And then next on the panel, Mr. Wilson with BlueGreen Alliance—your opening statement, please. 

STATEMENT OF MIKE WILSON 

Mr. WILSON. Thank you, Mr. Chairman, Ranking Member Tonko, 

and distinguished members. 

My name is Michael Wilson. I am the National Director for Occupational and Environmental Health at the BlueGreen Alliance. 

On behalf of our organization, our national labor and environmental partners, and the millions of members and supporters they 

represent, I want to thank you for convening the hearing today and 

for your interest in chemical safety and security. 

I am familiar with the risks of industrial hazards because I had 

the privilege of working for 13 years as a professional firefighter, 

paramedic, and EMT, during which time I responded to about 

10,000 emergency calls. 

I worked in a city with heavy industry centered around agriculture, so there were many facilities that used chlorine and ammonia and other agricultural chemicals. Responding to an incident at 

one of these facilities meant grappling with a lot of uncertainty because the facilities weren’t required to invite us in and involve us 

in planning or training for an emergency. 

In general, I would say they relied on us if they had an emergency but they were reluctant to help us improve the safety and 

effectiveness of our response. Without a doubt, emergency response 

is a necessary aspect of chemical safety and security. But it’s an 

indicator of a failure. It’s a measure of last resort where thoughtful 

planning and prevention have broken down. 

EPA reported this year that most serious chemical accidents are 

preventable if the necessary precautions and actions are taken and 

yet serious industrial chemical accidents continue to occur every 

2 1⁄2 days across our nation. 

Last year, EPA estimated that about 177 million Americans live 

close enough to an industrial facility to be affected by a chemical 

accident and that these risks fall disproportionately on low-income 

and minority communities. 

CFATS responds to this problem by requiring companies to surround dangerous chemicals with security measures and yet, as 

many experts have noted, these measures require continual updating to thwart the efforts of a motivated actor. Perhaps it is in response to this challenge with security measures that thousands of 

facilities seem to be shifting to prevention strategies. 

DHS noted last year that companies reported taking action to 

prevent risks on about 250 dangerous chemicals by replacing those 

chemicals with safer ones, reducing the quantities held on site, or 

switching to less concentrated formulations. 

If DHS is confident in the veracity of these claims, these actions 

do more than manage risks. They actually reduce the risk footprint, and in this way they provide protection not only from an intentional attack but also from an extreme weather event, earthquake, power outage, or mechanical failure risks that we’ve heard 

from several members today. 

76 

On the other hand, there are about 3,400 facilities that have remained in the CFATS high-risk tier and which pose a substantial 

risk to workers and communities. 

Changes to the CFATS program are needed to reward the leaders and move the laggards up. CFATS could be strengthened with 

updated requirements in four areas: one, risk management; two, 

risk prevention; three, meaningful participation by rank and file 

worker representatives; and four, emergency response. 

The State of California, the third largest refining state in the 

country, adopted these approaches last year in a sweeping new refinery safety regulation, which was motivated by a large flammable 

vapor explosion at the Richmond Chevron refinery. That incident 

created a 100 square meter vapor cloud that ignited and endangered the lives of 19 workers and caused some 15,000 people downwind of the plant to seek medical attention. 

California’s comprehensive new regulation is informed by the industry’s own best engineering and management practices developed 

over the last 20 years and largely shifts from a risk management 

to risk prevention framework. While California is improving the 

safety of refineries in communities, however, U.S. EPA is proposing 

to substantially weaken the Federal chemical disaster rule by rolling back most of its key provisions, including all 10 of its prevention requirements. 

These changes will endanger the lives of my former co-workers 

in the U.S. Fire Service. They will endanger workers and millions 

of community members and their families who live around our nation’s chemical facilities. The chemical disaster rule should be retained in its original form, not weakened or delayed, as the administration has proposed. 

We can and must prevent chemical accidents. I urge you to use 

the reauthorization of CFATS as an opportunity to strengthen the 

program. The results would be fewer explosions, fewer injuries and 

deaths, and a far more resilient industrial infrastructure. 

In closing, I would like to thank you again for this hearing and 

for granting me the opportunity to appear, and I will be happy to 

answer any questions. 

Thank you. 

[The prepared statement of Mr. Wilson follows:] 

77 


34591.034

BLUEGREEN 

TESTIMONY 

Michael P. Wilson, Ph.D., MPH 

National Director for Occupational and Environmental Health 

BlueGreen Alliance 

Before the 115th United States Congress, House Committee on Energy and Commerce, 

Subcommittee on Environment 

The Chemical Facilities Anti-Terrorism Standards Program (CFA TS): 

A Progress Report 

Rayburn House Office Building, Room 2123 

Thursday, june 14, 2018 

Thank you Chairman Shimkus, Ranking Member Tonka, and distinguished members for 

inviting me here today. My name is Michael Wilson, and I am the national director for 

occupational and environmental health at the BlueGreen Alliance. On behalf of my 

organization, our national labor and environmental partners, and the millions of members 

and supporters they represent, I want to thank you for convening the hearing today and for 

your interest in chemical safety and security. 

When you take action to protect against the risk of chemical releases, fires, and explosions 

in industrial facilities, you are making your districts safer and protecting the health of every 

person in your district The BlueGreen Alliance's partners represent thousands of workers 

in these facilities, as well as teachers, health care workers, construction workers, scientists, 

and citizens in communities across the country. Each one of our coalition's members wants 

to come home at the end of the day and live in a safe community. 
78 


34591.035

I'm familiar with hazardous industrial facilities because I worked for 13 years as a 

professional firefighter, paramedic, and EMT, during which time I responded to about 

10,000 emergency calls. 

When my engine company was dispatched for a fire or chemical release at an industrial 

facility, we typically had very little information about the chemicals inside the building. 

There was a lot of uncertainty. At one industrial fire, we were preparing to enter when an 

explosion occurred inside the building and a 55-gallon drum burst through the roof, 

landing in a nearby parking lot. Another call came in as "a worker experiencing chest pain," 

so we entered the facility without putting on our self-contained breathing apparatus 

(SCBA), only to find when we got inside that there were several very anxious workers 

experiencing shortness of breath and nausea from exposure to chlorine gas. 

So I understand why the firefighters who responded to the April17, 2013, report of a 

structure fire at the West Fertilizer Co. in West, Texas, were standing in the blast zone 

when a stockpile of 50 tons of fertilizer grade ammonium nitrate detonated: They didn't 

know it was there. There was no law that required the transmission of that information 

from the company managers who knew about it, to the first responders who needed to 

know about it. As a result, 12 first responders and 3 local residents died and 260 other 

people were injured.' 

Unfortunately, this situation was exceptional, but not unique. Data from the U.S 

Environmental Protection Agency (EPA) show that serious industrial chemical accidents 

2 oflO 
79 


34591.036

occur every two-and-a-half days in communities across the nation." In the 10 years leading 

up to the West, Texas, explosion, there were 1,500 major industrial chemical fires, 

explosions, or chemical releases at U.S. companies, causing more than 17,000 injuries and 

58 deaths, along with $2 billion in property damage.'" 

Millions of Americans live in the vulnerability zone of an industrial chemical release, and 

one in three school children attend school in such an area.'v African Americans, Latinos, and 

lower-income communities continue to be at greatest riskY The U.S. Chemical Safety and 

Hazard Investigation Board (CSB), EPA, and the Occupational Safety and Health 

Administration (OSHA) have all pointed out that these are risks that we know how to 

reduce; they are preventable through modern engineering and management practices that 

the industry itself has developed and recommended. This Committee and this Congress 

could take action to ensure that these practices are deployed throughout our nation's 

chemical facilities. 

The Chemical Facility Anti-Terrorism Standards (CFJ\TS) program is one of the federal 

programs designed to lower industrial chemicals risks by requiring a range of chemical 

security measures. And there is some evidence that CFATS is working. The Department of 

Homeland Security (DHS) reports that thousands of high-risk facilities have chosen to meet 

their chemical security obligations not only through traditional security measures, but also 

by implementing risk reduction strategies. These have included (1) consolidating chemicals 

from multiple sites into one or two sites; (2) replacing a hazardous chemical with a less 

hazardous one; (3) reducing the total quantity of a chemical held onsite; or ( 4) switching to 

3 of10 
80 


34591.037

a less concentrated form of the chemicaL Each of these actions, done right, does more than 

manage the risk-it actually lowers the risk of a deadly explosion or fire or release of a 

poisonous substance in the event not only of a terrorist attack, but also of an extreme 

weather event or earthquake, power outage, or mechanical failure. Assuming DHS is 

confident in the veracity of these claims, and is taking steps to validate them, I would 

submit to you that they represent a sound approach to meeting the industrial safety and 

security goals we are discussing today, and they demonstrate these types of approaches are 

feasible in existing industrial chemical processes. 

On the other hand, there are about 3,500 other facilities that have remained in the high-risk 

tier and that pose a substantive risk to the safety of workers and nearby communities.'' 

Changes to the CFATS program are needed to reward and reinforce the leaders, and to 

require the laggards to come up to the mark. 

A reauthorized and strengthened CFATS can do this in at least four ways: (1) by expanding 

the requirements pertaining to information, training, planning, and resource sharing with 

emergency responders; (2) by ensuring the rights of workers and their representatives to 

participate meaningfully in chemical safety and security decision making; (3) by 

strengthening certain risk management provisions, such as those related to emerging 

threats; and (4) by adding new provisions that aim to move facilities from risk 

management to risk reduction. The Center for Chemical Process Safety describes risk 

reduction strategies as those that minimize the use of hazardous chemicals, or substitute 

them with safer chemicals, or that simplifY or modify chemical processes to make them less 

4 oflO 
81 


34591.038

vulnerable to failure. Using cars as an analogy, risk reduction provisions require the driver 

to follow the vehicle's preventive maintenance schedule, rather than driving the car until 

the wheels fall off or the engine blows up. 

This brings me to our experiences in California. In August 2012, Chevron's oil refinery in 

Richmond was the scene of an industrial disaster. An 8-inch-diameter pipe carrying hot fuel 

oil failed catastrophically, releasing a torrent of fiammable vapors that quickly expanded 

100 meters in all directions, and engulfed 19 refinery workers who managed to escape just 

moments before the vapor cloud i'gnited into a massive fireball. Some 15,000 people in the 

communities downwind of the plant sought medical attention for symptoms of exposure to 

the plume of smoke and toxic gases that spread over the northeastern Bay Area.vH 

The CSB's investigation later found that the incident could have been prevented if 

Chevron's managers had followed the recommendations of their own engineers, who had 

issued at least six reports over a period of several years calling attention to the problem of 

sulfidation corrosion and recommending a more aggressive pipe inspection and 

replacement program.vlii The engineers made these recommendations against a backdrop 

of catastrophic sulfidation corrosion fires, some of which caused worker fatalities, at 

Chevron's El Paso, Texas refinery (1988), Chevron's Pascagoula, Mississippi refinery (1988 

and 1993), Chevron's Salt Lake City, Utah refinery (2002), the Richmond, Chevron refinery 

itself (2007), the Silver Eagle refinery in Woods Cross, Utah (2009), the Regina 

Saskatchewan, Canada refinery (2011), and the BP Cherry Point, Washington refinery 

(2012). By 2009, Chevron's engineers warned of the potential for a catastrophic failure, 

5 oflO 
82 


34591.039

and still management chose not to act The pipe finally failed in 2012 exactly as the 

engineers predicted it would, and 19 people nearly lost their lives.'' 

I began serving as chief scientist in California's Department of Industrial Relations around 

this time, and we recognized that if worker representatives had been in management's pipe 

corrosion meetings, and if they had been given the engineer's reports to read, they would 

almost certainly have demanded corrective action, then and there. Workers need strong 

regulatory language to gain a seat at the decision-making table. Once there, they provide 

experience and expertise, as well as accountability and transparency-they can play a key 

role in mitigating poor decisions and lopsided priorities that can result behind closed 

doors. Provisions that allow for this in CFATS would improve its effectiveness, and the 

ability of facility engineers to have their views heard, and even adopted into practice. 

What does the 2012 Chevron fire teach us about the need for stronger first responder 

provisions in CFATS? Firefighters responding from Richmond and nearby cities discovered 

they were not able to communicate with the refinery incident commander because the 

plant operated on a different radio frequency from municipal fire departments. The result 

was a fairly high degree of chaos and uncertainty on the scene, and it was dangerous for 

everyone involved. If there had been a requirement for more frequent communication and 

training between the Chevron refinery and local first responders, this problem would have 

been discovered and corrected. 

6 of10 
83 


34591.040

Largely in response to the Chevron fire, the State of California adopted a sweeping revision 

to its Process Safety Management (PSM) regulations for the state's 14 oil refineries.' 

California is the third largest refining state after Texas and Louisiana.'' A task force 

convened by the governor's office concluded that a new regulatory framework could 

improve refinery safety in the four areas I've noted for CFATS: emergency response, 

workers' rights, risk management, and risk reduction. The resulting 10,000-word 

regulation took five years and much consultation with industry and labor to develop, and it 

is now in force. We are now finding that when the best practices of an inherently hazardous 

industry are translated into regulation, it levels the playing field between leaders and 

laggards. 

The principles embodied in the new California rule-and the approach we took in 

manifesting those principles into regulatory language-are worth investigating as a model 

for CFATS, especially those that pertain to risk reduction. With regard to today's hearing, 

California's new PSM regulation explicitly shifts the focus of chemical safety from a risk 

management to a risk prevention framework It includes essential new rights of workers 

and their representatives to participate throughout all phases of PSM decision-making, and 

it includes many of the industry's own recommended best practices in the areas of human 

factors, the hierarchy of controls, safety culture, managing organizational change, and 

learning from near misses. 

While California is in its first year of improving the safety of refineries and surrounding 

communities, the U.S. EPA is at the same time proposing to substantially weaken the 

7 of10 
84 


34591.041

federal Chemical Disaster Rule, by rolling back some of its most life-protecting and 

disaster-preventing provisions. On May 17, 2018, the EPA proposed to: 

Roll back language on training and planning coordination between emergency 

responders and at-risk facilities; 

Eliminate a requirement for facilities to learn from their mistakes by looking back at 

accidents or near-misses to assess how to prevent them in the future; 

End information sharing with local communities around hazards at the facility and 

emergency preparedness and evacuation procedures; 

Eliminate requirements to assure incident investigation reports are completed 

effectively, within twelve months; 

Eliminate requirements for worker training at certain facilities, so that supervisors 

and workers involved in operating processes need not have basic safety training; 

Eliminate a requirement for independent audits for serious chemical accidents; and 

Eliminate a requirement for the most dangerous suhset of facilities to assess the 

applicability of safer technologies and practices so that if a problem occurs 

(whatever the cause), fewer people will be killed or injured. 

The May EPA rollback proposal explicitly states that it would put low-income communities 

and communities of color at increased risk of chemical disasters.'" EPA's proposal reflects a 

disregard for the safety of American workers, who are hurt "first and worst" when a 

refinery or chemical facility owner fails to invest in modern engineering practices to 

prevent a fire, explosion or release, or to respond to workers' concerns about the need for 

maintenance or corrective action. This Congress can do the right thing and direct EPA to do 

8 oflO 
85 


34591.042

its job. The Chemical Disaster Rule will genuinely improve public safety and national 

security and should be pushed forward in its original form, not weakened or delayed as the 

administration has proposed. 

Clearly, we need to prevent chemical accidents. We need to ensure that workers, first 

responders, and communities have the information and resources they need to protect 

themselves and everyone else. We need rules based on best practices that don't allow the 

laggards to hold back the leaders. These are our workers, our communities, our first 

responders. When we know what to do to protect them, as we do in the case of chemical 

accidents, it is our duty to act. 

Whether unintentional or due to terrorism, we have learned that a chemical fire, explosion, 

or release can devastate the Jives of workers, families, and entire communities. Rather than 

follow EPA's path with the Chemical Disaster Rule, which will undoubtedly weaken our 

nation's protections against chemical disasters, I urge you to use the reauthorization of 

CFATS as an opportunity to strengthen the program and promote risk reduction. The result 

would be fewer explosions, fewer deaths and hospitalizations. and a far more resilient 

industrial infrastructure. 

In closing, Chairman Shimkus, Ranking Member Tonka, and members of the subcommittee, 

thank you again for your important work and for granting me the opportunity to appear at 

today's hearing. 

******** 

9 oflO 
86 


34591.043

1 U.S. Chemical Safety Board (CSB), "West Fertilizer Explosion and Fire." January 2016. Available: 

https: 1 jwww.csb.gov /west· fertilizer-explosion-and-fire-f. 11 U.S. Environmental Protection Agency (EPA}, "Accidental Reteasc Prevention Requirements: Risk 

Management Programs Under the Clean Air Act," January 2017. Available: 

https://www.gpo.gov /fdsys/pkg/FR-2017 -01-13/pdf/2016-31426.pdf. 

•u EPA, "40 CFR Part 68 Accidental Release Prevention Requirements: Risk Management Programs Under the 

Clean Air Act; Proposed Rule," March 2016. Available: https:(/www.gpo.gov/fdsys/pkg/FR-2016-03-

14/pdf/2016-05191.pdf. 

1

v Center for Effective Government, "Kids in Danger Zones: One in Three U.S. Schoolchildren at Risk From 

Chemical Exposures," September 2014. Available: https:/ fwww.foreffectivegov.org/kids-in-danger-zones. 

v Earthjustice, Another Year Of Preventable Chemical Disasters, April 2018. Available: 

https· I /earthiustice.org /news /press /2018 /another-year-of-preventable-chemical-disasters. 

vi Coalition to Prevent Chemical Disasters, "Testimony of Paul Orurn, Chemical Safety Advocate," February 

2018. Available: https://home!and house gov /wp-content/up\oads/2018 /02/Testimony-Orum.pdf 

vu CSB, "Chevron Retlnery Fire Final Report," January 2015. Available: https://www.csb.gov/chevronrefinery-fire/. 

""'Ibid. 

IX CSB, "Interim Investigation Report Chevron Richmond Refinery Fire," August 2012. Available: 

https://www.csb.gov/assets/1/17/draft report for public comment.pdf?14934. 

x California Department of Industrial Relations, "Landmark Workplace Safety and Health Regulation 

Approved to Reduce Risk of Major Incidents at Oil Refineries in California," May 2017. Available: 

httns://www.dir.ca.gov/DIRNews/2017 /2017-37.pdf. 

xt U.S. Energy Information Agency, "California State Profile and Energy Estimates." Available: 

https: //\NWw.eia.gov /state /?sid-CA 

xi 1 EPA, "Regulatory Impact Analysis, Reconsideration of the 2017 Amendments to the Accidental Release 

Prevention Requirements: Risk Management Programs Under the Clean Air Act, Section 112(r)(7)." May 

201 R https: I IWW\v .re!f!ulations.gov /document?D-EPA-H 0-0 EM-2015-072 5-0907 

10 of 10 
87 


34591.044

TESTIMONY- SUMMARY OF MAIN POINTS 

Michael P. Wilson, Ph.D., MPH 

National Director for Occupational and Environmental Health 

BlueGreen Alliance 

Before the 115'h United States Congress, House Committee on Energy and Commerce, 

Subcommittee on Environment 

The Chemical Facilities Anti-Terrorism Standards Program (CFATS): 

A Progress Report 

Rayburn House Office Building, Room 2123 

Thursday, June 14, 2018 

Serious industrial chemical accidents occur every two-and-a-half days. Millions of Americans live 

in the vulnerability zone of an industrial chemical release, and one in three school children attend 

school in such an area. African Americans, Latinos, and lower-income communities continue to be 

at greatest risk. 

CFATS applies security measures to manage the risks of dangerous chemicals. But there is 

evidence that CFATS is also motivating thousands of facilities to reduce these risks by taking action 

on about 250 chemicals of interest by replacing them with safer ones; reducing their total quantity 

held onsite; or switching to less concentrated forms. 

• There are at least 3,500 facilities that have remained in the high-risk tier and pose a substantive 

risk to workers and communities. Improvements to the CFATS program are needed in four areas: 

(1) emergency response; (2) workers rights: (3} management of emerging threats; and (4] risk 

reduction practices. 

U.S. EPA is simultaneously proposing to substantially weaken the federal Chemical Disaster Rule, 

by rolling back some of its most important provisions. The Chemical Disaster Rule should be 

retained in its original form, not weakened or delayed as the administration has proposed. 

• We can and must prevent chemical accidents. We urge you to use the reauthorization of CFATS as 

an opportunity to strengthen the program. The result would be fewer explosions, fewer deaths 

and hospitalizations, and a far more resilient industrial infrastructure. 
88 

Mr. HARPER [presiding]. Thank you, Dr. Wilson. 

The chair will now recognize Mr. Roberts for the purposes of an 

opening statement. You’re recognized for 5 minutes. 

STATEMENT OF STEVE ROBERTS 

Mr. ROBERTS. Thank you. Good afternoon, Mr. Chairman, Ranking Member Tonko, and other distinguished members of the subcommittee. 

As a security consultant and lawyer, I’ve been fortunate to participate and work in the CFATS program from the very beginning 

since 2007, more than 11 years ago now, and have seen during that 

time and have participated in dozens of refineries, chemical plants, 

paint and coating manufacturers, agricultural facilities, aerospace 

and defense—a range of CFATS facilities that Mr. Wulf spoke 

about earlier in this testimony. 

Against this backdrop, I am pleased to offer the following comments for the committee’s consideration: first, reauthorize CFATS 

for multiple years; second, further enhance the transparency of the 

risk tiering process; third, update the CFATS rulemaking process; 

and fourth, ensure that there is greater consistency among inspectors and the inspection process. 

First, reauthorize CFATS. When the first standalone CFATS legislation was introduced 4 years ago, we find ourselves back now at 

the same time, as that legislation nears the end of its life. I can 

certainly say that industry needs the certainty of CFATS and reauthorization of CFATS to continue to make its investments in the 

program and continue to implement the program. I think DHS also 

needs the certainty of CFATS to ensure its long-term viability of 

programmatic changes. 

Second, with respect to transparency and risk determination 

process, which we’ve heard about quite a bit today, ISCD has certainly improved the transparency of its risk process. They have 

done many things to help the regulated community understand 

why they may be tiered or not tiered, and includes things like 

webinars, fact sheets, and the like. 

Most significantly—and the agency should get a lot of credit— 

you are willing to call up the agency and have a so-called technical 

consultation, essentially asking why am I tiered, is there something that I could do, is there something I need to know, is there 

something that’s correct or perhaps incorrect in this process. And 

while often that doesn’t change the needle, unless there was some 

kind of error omission, the mere process of being able to have that 

conversation with the agency is very helpful and welcome. 

That sort of dialogue was not welcome many years ago at the beginning of the CFATS program and I think the current leadership 

has a lot to do with that and should be recognized. 

That’s not to suggest that I or the facilities for which I work always agree with the process. In fact, many times, especially with 

respect to the most recent CSAT 2.0 resteering process, companies 

have said to me, why am I tiered—can I appeal that tiering decision—and the answer is no. The regulation does not provide for any 

kind of appeal mechanism. 

In fact, allowing a straight appeal would probably swallow the 

regulation. DHS would spend all of its time on appeals and not 

89 

being able to articulate and move forward with the program. So I 

don’t think a straight appeal would be appropriate. 

But something more formal than a technical consultation but 

something less than a formal appeal would certainly help facilities 

to understand is there something they can do, especially on the 

consequence side of the house, for sites that have release flammable or toxic inhalation hazard materials—to bring that risk 

down, re-file a top-screen, and perhaps get a different result. Right 

now, we are not able to effectively do that beyond the technical consultation. 

Third, the rulemaking process—as we’ve noted today, CFATS has 

been around for now 11 years. The regulations have not changed 

one word in that 11-year period, and whether it be Appendix A or 

other key aspects of the rule, in order to change that rule, to update it, to align it to certain things, that process would need to go 

through the rulemaking process. 

DHS started that process in the summer of 2014 through an advanced notice of proposed rulemaking. But that process has now 

stalled. If we take a look at the current rulemaking agenda for the 

Department of Homeland Security just published recently, we now 

see CFATS has been moved to the list of long-term actions. 

I would urge the committee to require that rulemaking occur so 

we can update the program necessarily in very material ways that 

need to occur for both, in my view, industry and for DHS. 

Fourth, as we’ve heard a little bit and including from Mr. Currie, 

ISCD should opt to make authorization inspections—compliance inspections more consistent, more uniform—ensure that the same 

level of knowledge, of rigor, of completeness of those processes. 

ISCD has done a lot toward that and I certainly think—and have 

worked with many of these inspectors—they are professional, they 

are courteous, they are very easy going many times and friendly. 

However, that does not always translate into the same process 

from site to site, from region to region, even within the same region. That inconsistency sometimes and lack of—differences in 

knowledge, understanding the actual tools that DHS uses, the 

CSAT process, the different approaches to how an inspection actually occurs—the level of detail or lack thereof—is an ongoing source 

of frustration for many businesses, many companies, especially 

those that operate facilities from region to region and very clearly 

see and question why we see so many differences boots on the 

ground among the inspection team. 

DHS has recognized that. We hear from them that they are going 

to take steps and are taking steps, as the GAO has also recognized, 

to improve and enhance that process, going forward. 

But I think more is needed. I think further training is needed— 

minimum standards and better consistency horizontally between 

the regions and vertically between headquarters and the regions 

themselves. 

So with that, I appreciate the opportunity to testify, holding this 

important hearing, and be pleased to answer any questions you 

may have. 

[The prepared statement of Mr. Roberts follows:] 

90 


34591.045

STATEMENT OF STEVE ROBERTS 

CHEMICAL SECURITY GROUP, LLC 

BEFORE THE 

UNITED STATES HOUSE OF REPRESENTATIVES 

COMMITTEE ON ENERGY AND COMMERCE 

SUBCOMMITTEE ON ENVIRONMENT 

*** 

THE CHEMICAL FACILITY ANTI-TERRORISM STANDARDS 

(CF ATS) PROGRAM- A PROGRESS REPORT 

STEVE ROBERTS 

CHEMICAL SEC\JRITY GROUP, Ll,C 

2234 RICHMOND A YEN\JE 

HOVSTON, TEXAS 77098 

WWW.CHEMICALSEC!JRITY.COM 

JUNE 14,2018 
91 


34591.046

Statement of Steve Roberts 

Page 2 of 10 

Chairman Shimkus, Ranking Member Tonko, and distinguished members of the 

Subcommittee, thank you for convening today's hearing on the Chemical facility Anti-Terrorism 

Standards (CI' ATS). I appreciate participating as a witness on this important topic. 

As a security consultant and lawyer, I have been fortunate to assist and visit many CF A TSregulated facilities since the very beginning of the program in 2007. Together with my colleagues, 

I have seen the development and practical application of Cl' ATS at dozens of chemical plants, oil 

refineries, chemical and petroleum terminals, paint and coatings facilities, food and agriculture 

operations, aerospace and defense locations, and chemical distributors in the last eleven years. 

Most of these facilities are owned and operated by larger corporations, but my experience has also 

included smaller businesses. Against this backdrop, I am pleased to offer the following comments, 

observations, and suggestions: 

I. REAUTHORIZE CF A TS FOR MUL TJPLE YEARS 

The Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 201./ (P.L. 

113-254) was the first standalone CFATS legislation, but will end by its own terms in the coming 

months. It is imperative that Congress reauthorize the program for multiple years and not allow 

CF A TS to lapse. Industry requires the certainty of multi-year CF A TS reauthorization to ensure the 

continuity of CFATS-driven security measures and to make investments in new ones. Multi-year 

reauthorization will also give the Department of Homeland Security (DHS), and, specifically, the 

Infrastructure Security Compliance Division (ISCD), the sustainability it needs for programmatic 

development. 

Continuity is particularly important now - since ISCD initiated the Chemical Security 

Assessment Tool (CSA T) 2.0 process in September 2016, the number ofCFATS-affected facilities 

has increased from approximately 2,962 as of September 2016 to approximately 3,389 as of May 

2018. Of these 427 facilities, many have recently implemented (or are in the process of 
92 


34591.047

Statement of Steve Roberts 

Page 3 of 10 

implementing) CF A TS site security plans that require additional measures to protect one or more 

Chemicals oflnterest (CO Is). From direct and recent experience, the ability of facilities to commit 

capital (which often must be allocated and budgeted over one or more fiscal years) for CFATS 

security measures, such as fencing, cages, cameras, access control systems, or alarms, would be 

impeded if the underlying CFA TS program lapsed, expired, or otherwise had an uncertain future. 

Because the CSA T 2.0 risk tiering process has resulted in an increase in the number of 

facilities regulated for a Release COl (and, specifically, for Toxic Inhalation Hazard chemicals 

such as Chlorine, Ammonia, and Hydrogen Fluoride), the nature of the security enhancements 

necessary to meet the applicable Risk-Based Performance Standards (RBPSs) may be larger or 

more complex. For example, a facility regulated only for a Theft and Diversion COl (such as 

cylinders of Chlorine) could meet certain physical security RBPSs metrics simply by locking the 

cylinders in a metal cage and implementing robust access control. The same facility, now also 

regulated for Chlorine stored in large aboveground tanks as a Release COl, may require enhanced 

security measures at the facility's perimeter. These security projects are more complex, costly, and 

often can take one year or more to complete. 

The increase in the number of CF A TS-regulated facilities, and the changes in tier rankings 

and COl Security Issues experienced by many tacilitics, result directly from lSCD's execution of 

what Congress directed. The CSAT 2.0 process implements the requirement for ISCD to 

" ... develop a security risk assessment approach and corresponding tiering methodology for 

covered chemical facilities that incorporates the relevant elements of risk, including threat, 

vulnerability, and consequence" that was imposed by the Protecting and Securing Chemical 

Facilities from Terrorist A/tack Act of2014. It would be unreasonable to require these facilities, 

many of which have recently developed new or updated CFATS-compliant security plans and have 
93 


34591.048

Statement of Steve Roberts 

Page 4 of 10 

committed to security enhancements just in the last 18 months, to operate under a cloud of 

legislative uncertainty. 

II. FURTHER ENHANCE TRANSPARENCY IN RISK TIER DETERMINATIONS 

The launch of CF A TS in 2007 and the ensuing several years were replete with 

programmatic challenges, a poor software interface, and often long periods of silence between the 

time a facility submitted CFATS materials to ISCD and when it received a response. In contrast, 

CSAT 2.0 represents significant progress. It is easier to use, facilitates program management for 

companies with multiple CF A TS-regulated facilities, and is more efficient (e.g., user role changes 

are completely electronic; previously, facilities had to print, sign, and fax certain information to 

ISCD). 

Through CSAT 2.0, ISCD has also improved the transparency of its risk determination 

process to help the regulated community better understand why a facility may be tiered. In addition 

to a CFATS Tiering Results Update webinar and a Tiering Methodology Fact Sheet, ISCD is 

willing to provide a "teclmical consultation" to discuss, at a high-level, the factors used to make 

tiering decisions. While this does not change the outcome (i.e., the facility still must develop a 

CFATS security plan unless there was a mistake in the data submission or analysis), the mere fact 

that JSCD is willing to engage in dialogue is constructive and helpful. Dialogue and engagement 

were not readily possible or welcomed by ISCD in the initial years of the program. 

This is not to suggest that I, or the facilities for which I work, always agree with ISCD's 

perception of risk, especially in the context of Release CO!s that are Toxic Inhalation Hazards. I 

have had many discussions with facilities now deemed high-risk for a Release-Toxic COl (e.g., 

Ammonia) as a result of!SCD's new CSAT 2.0 process. Under CSAT 1.0, ISCD did not consider 

these facilities high-risk or, if they were high-risk, ISCD assigned them to a more favorable risk-
94 


34591.049

Statement of Steve Roberts 

Page 5 of 10 

tier. When facility management asks whether it can challenge a facility's risk tier assignment, I 

must advise that the CF A TS regulation does not permit a facility to appeal a tiering decision. 

Additional transparency regarding how CSA T 2.0 calculates risk "scores" in a particular 

instance, however, might result in fewer regulated facilities and a more focused application of 

resources and lower overall risk. By way of example, if a facility knew that the presence of 

secondary containment would revert a facility to its prior (non-CFA TS) status, then management 

could make an informed business decision: does the cost of constructing secondary containment 

to mitigate the consequence of a Toxic Inhalation Hazard release to the facility and the surrounding 

area justify the benefit of less regulation? 

Toward this end, a tiering review process that is more formal than a technical consultation, 

but less than an outright appeal (which could possibly swallow ISCD's ability to implement the 

program), would be beneficial for facilities with good cause and would complement the other 

CSAT 2.0 improvements. Currently, the statute says that "[t]he Secretary shall share with the 

owner or operator of a covered chemical facility any information that the owner or operator needs 

to comply with this section." Congress might expand this language to create a clear obligation for 

ISCD to share with a facility a more precise reason for its tier assignment. 

Ill. A CFATS RULEMAKING IS REQUIRED TO UPDATE THE REGULATION 

The CFATS regulation has not changed since it was first published in April 2007. Despite 

this, the practical and operational application of CF ATS has changed in the ensuing eleven years. 

While ISCD issued a CFATS Advance Notice of Proposed Rulemaking in August 2014, a Notice 

of Proposed Rule making has still not been issued. According to the Spring 2018 Unified Agenda 

of Regulatory and Deregulatory Actions, this rulemaking has been relegated to DHS's list of LongTerm Actions. Congress can and should accelerate this process by directing DHS to publish 
95 


34591.050

Statement of Steve Roberts 

Page 6 of 10 

proposed and final CFA TS rules - or a determination that no changes are necessary - by dates 

certain. Otherwise, the prospect of regulatory updates before 2020 (at the earliest) is unlikely. 

Because a rulemaking has not occurred, lSCD and industry are both disadvantaged. ISCD 

must rely on instructions, guidance, a handful of advisory opinions, and awareness materials to 

implement its evolving policy priorities, while certain regulatory questions important to industry 

remain unresolved. For example, RBPS 9 of the CF ATS regulation requires a facility to "[ d ]evelop 

and exercise an emergency plan to respond to security incidents internally and with assistance of 

local law enforcement and first responders." Because CFA TS is a performance-based regulatory 

scheme, DHS cannot be prescriptive in interpreting the meaning of the phrase, "with the assistance 

of local law enforcement and first responders." 

For the last several years, however, ISCD has made Jaw enforcement outreach and 

engagement between a regulated facility and the law enforcement agency with primary response 

jurisdiction a policy priority. As recently as May 2018, ISCD released a new Fact Sheet on 

Resources for Law Enforcement and First Responders. Whether and to what extent a CF ATSregulated facility has engaged its local police department or sheriffs office is a recurring 

inspection question. This is done for good reason and with near universal support of CFATSregulated facilities- but ISCD cannot direct that a facility do so in a specific manner or at a specific 

frequency. It is certainly reasonable to assume that many within the regulated community would 

support ISCD including, in a future rulemaking, a more direct (and prescriptive) requirement for 

a CF A TS-regulatcd facility to engage local law enforcement on a recurring basis. 

As another example, the CF ATS regulation states that, "[i]f a covered facility makes 

material modifications to its operations or site, the covered facility must complete and submit a 

revised Top-Screen to the Department within 60 days of the material modification." Since the 

inception of the CF A TS program, industry has sought clarification of what constitutes a "material 
96 


34591.051

Statement of Steve Roberts 

Page 7 of 10 

modification." It is clear that the reduction of a CO! below its Appendix A reporting trigger (or 

the complete removal of a COl) is a "material modification." When to file a Top-Screen- and 

when not to file a Top-Screen- at other times remains opaque. 

For example, CFA TS requires a facility to file a Top-Screen if it has 400 pounds or more 

of Hydrogen Peroxide at or above 35% concentration in a transportation package (e.g., a drum). 

Consider a facility that needs 500 pounds of 50% Hydrogen Peroxide for a short-term pilot project, 

thereby triggering a Top-Screen filing. Assume that the facility acquires the chemical on June I. 

By June 8, all of the Hydrogen Peroxide has been consumed. By regulation, a facility must file a 

Top-Screen to report a new COl within 60 days, or by August I in this example, even though the 

Hydrogen Peroxide has not been onsite for weeks. The facility must then file a superseding TopScreen indicating that the COl is gone. This example has been perplexing for years and is one, 

among many, that highlights the need to update the regulation to clarify key operational aspects of 

the rule. 

Similarly, the list of CO!s, contained in Appendix A to the rules, has not changed since its 

publication in November 2007. A new rulemaking would enable ISCD to make adjustments to the 

CO!s, including amounts and concentrations, based on updated risk profiles and objective 

standards. Certain oxidizers, such as Hydrogen Peroxide, may be adjusted downward iflSCD has 

a reason to justify that they may be used as an effective Improvised Explosive Device precursor at 

an amount or in a concentration less than what was identified in 2007. 

Alternatively, industry would expect some CO!s to drop from the Appendix A list entirely 

or experience other changes in their reportable amounts. ISCD set the reporting trigger for all but 

one Release-Flammable COl at 10,000 pounds. Yet, under CSAT 2.0, l have yet to see ISCD tier 

a facility for a Release-Flammable CO! unless the facility possesses many times that amount. 
97 


34591.052

Statement of Steve Roberts 

Page 8 of I 0 

Whether adding, modifying, or removing CO!s, it is critical that Appendix A changes occur 

through the rulemaking process. Such changes also must be transparent in application, evenly 

applied, and objectively considered. Though not directly tied to CFA TS, the recently published 

study on Reducing the Threat of Improvised Explosive Device Attacks by Restricting Access to 

Explosive Precursor Chemicals by the National Academies of Sciences, Engineering, and 

Medicine applied strict ranking principles to determine what chemicals posed the greatest risk -

but also showed a degree of arbitrariness. Despite acknowledging that Urea Ammonium Nitrate 

(UAN) "has not been used historically to produce explosives," the National Academies departed 

from "a strict application of the committee's [chemical] ranking principles" and included UAN in 

its highest risk category without objective justification. ISCD must be careful not to act in such 

an arbitrary fashion. 

IV. ISCD SHOULD CONTINUE TO ENHANCE THE CONSISTENCY OF 

AUTHORIZATION INSPECTIONS AND COMPLIANCE INSPECTIONS 

AMONG ITS INSPECTION PERSONNEL 

Together with my colleagues, I have directly participated in or have knowledge of hundreds 

of Authorization Inspections (Ais) and Compliance Inspections (Cis). These activities span all I 0 

ISCD inspector regions, across all CFA TS risk tiers (i.e., Tier 1 - Tier 4), and at all types of 

regulated facilities, from the very large to the very small, over many years. 

While a diverse Chemical Security Inspector (CSI) cadre is an asset, the manner and detail 

of how CSis conduct their work varies from region-to-region, and even within the same region. 

This inconsistency continues to stymie the program and is a source of ongoing frustration for many 

facilities and businesses (especially those that operate CFATS facilities across multiple regions 

and receive uneven information and divergent direction from region-to-region). With very rare and 

limited exception, all CSis are very friendly and courteous. Many have prior law enforcement or 

military experience and arrive at ISCD from other branches of the federal government. 
98 


34591.053

Statement of Steve Roberts 

Page 9 of 10 

Some CS!s are very knowledgeable regarding the CF ATS program and the application of 

a performance-based regulation, but others are not Some CS!s spend considerable time reviewing 

the accuracy and completeness of a facility's CFATS program during their time at a facility, but 

others do not Some CS!s understand and apply ISCD's "corporate approach program" (whereby 

security measures that apply to all of a company's CFA TS-regulated facilities are reviewed and 

approved once at a corporate level but applied broadly at the facility level), but other CS!s have 

little knowledge or awareness of those (already institutionalized) measures when arriving onsite. 

ISCD leadership has acknowledged this and has taken steps to drive standardization and 

increase technical knowledge. Specifically, ISCD now has a Chief of Regulatory Compliance 

(CRC) in each of the I 0 CFA TS regions. The CRCs help manage and oversee CFA TS compliance 

activities in their respective regions. All new CS!s must attend training at ISCD headquarters and 

participate in a specific number of Ais and/or Cis with an experienced CSI before leading either. 

Next year, ISCD is developing a new internal audit process that will enhance AI and CI uniformity. 

These are steps in the right direction, but more is needed. Considering that CF A TS is a 

perfonnance-bascd regulatory program, ISCD should ensure that all personnel possess baseline 

CF ATS knowledge, understand the interplay between regulation and guidance, and conduct Als 

and Cis to the same level of completeness, precision, and rigor. There should be a mechanism by 

which horizontal consistency is ensured between and within regions and vertical consistency is 

ensured between headquarters and the regions. 

ISCD's use of contractors to review CFA TS security plan submissions has resulted in 

unnecessary administrative burdens and confusion. For example, on several occasions, contract 

analysts have interpreted guidance documents as regulatory requirements, insisted that all 

questions addressed in the Site Security Plan questionnaire be applied to facilities using an 

Alternative Security Program, and inserted novel criteria into plan reviews (e.g., asking a facility 
99 


34591.054

Statement of Steve Roberts 

Page 10 of 10 

to list protective measures that the facility expressly decided to remove when submitting its 

updated security plan). If!SCD must continue to use contractors, then it should provide additional 

training to these personnel and institute more (or stronger) internal controls. 

V. CONCLUSION 

CFA TS has made great strides and has improved significantly from its rocky start more 

than a decade ago. Many facilities are in a regular cycle of compliance and have institutionalized 

CF A TS as part of their operating tempo. CSA T 2.0 has brought new facilities into the program, 

which will benefit from lessons learned. Like any complex regulatory program, the opportunities 

for improvement and further refinement always exist. Congress should proceed with a multi-year 

reauthorization and use this time to consider what further legislative changes are needed to ensure 

continued success and sustainability. 

*** 

Thank you for holding this important hearing. I would be happy to answer any questions 

you may have. 
100 

Mr. HARPER. Thank you, Mr. Roberts. We appreciate that. 

And Mr. Conrad, we’ll now recognize you for 5 minutes for the 

purposes of an opening statement. 

Thank you. 

Mr. Conrad, could you pull that microphone around in front of 

you a little bit? Thank you. 

STATEMENT OF JAMES CONRAD 

Mr. CONRAD. The button. There we go. 

For over a decade, I have been counsel to the Society for Chemical Manufacturers and Affiliates, the only U.S.-based trade association dedicated solely to the specialty and fine chemical industry. 

For the previous 14 years, I was an in-house lawyer at the American Chemistry Council and so I’ve been working on chemical facility security since before 9/11 and I’ve been continuously involved 

in the CFATS process since it was first enacted in 2006. 

I’ve also chaired the ABA’s administrative law and regulatory 

practice section. I am pleased to be able to provide today with 

SOCMA’s perspective on CFATS. CFATS protects high-risk chemical facilities and their surrounding communities by ensuring that 

security measures are in place to reduce the risk of successful terrorist acts. 

More than half of SOCMA’s 115 manufacturing members are regulated under the program. We strongly supported and we urge 

Congress to reauthorize the program now before its authorization 

expires this coming January. 

A 1-year reauthorization, however, is not desirable because regulatory certainty is crucial to business planning. Complying with 

CFATS is expensive and time consuming, especially for small businesses. SOCMA’s members want the program to be consistent and 

predictable, and a multi-year reauthorization would give them that 

assurance. 

Through the years, the CFATS program has undergone dramatic 

changes. The early years were a significant challenge for everyone, 

but the program has vastly improved under the direction of Deputy 

Assistant Secretary Wulf, whose earlier accomplishments gave 

Congress the confidence to reauthorize CFATS for 4 years in 2014. 

SOCMA believes that the program’s continued progress is directly attributable to Mr. Wulf’s leadership and justifies another reauthorization for a comparable period of years. 

The most significant recent improvement in CFATS is Version 

2.0 of the Chemical Security Assessment Tool, or CSAT. The original CSAT process was clunky and difficult to use, took significant 

amounts of time and resources to complete. 

The number-one recommendation of SOCMA’s CFATS comments 

in 2014 was that DHS fix it, and DHS has now done that dramatically, and our members uniformly report that it’s much easier to 

use and far less resource intensive while still giving DHS the information it needs. 

This improvement is extremely important for SOCMA members, 

70 percent of which are small businesses. Most of these businesses 

cannot afford to have dedicated regulatory compliance staff nor can 

they afford to hire consultants to do the job for them. 

101 

While I’ve thus far applauded DHS’s efforts, SOCMA does have 

some concerns. It first relates to how DHS tiers or assigns risk levels to facilities based on their CSAT submissions. 

When Congress reauthorized CFATS, it instructed DHS to ‘‘share 

with the owner or operator of a covered chemical facility any information that the owner or operator needs to comply with this section.’’ 

Congress could revise this language to create a clearer obligation 

for DHS to share with the facility the exact reason for its tier assignment. That would help them understand how they could lower 

their risk tiers. 

The second concern is the personnel surety program. Currently, 

PSP only applies to tier one and two facilities, but DHS is considering applying it to tiers three and four. 

SOCMA believes this is premature. These facilities, by definition, 

pose lower risks and the PSP program continues to impose burdens 

in terms of time and delay. 

SOCMA believes DHS should work with the Department of Justice and the FBI to rigorously assess both what risks are avoided 

and what costs are imposed by the process, and we think such a 

multi-agency review is necessary before we expand it further. 

We also believe CFATS should recognize voluntary industry programs that enhance the safety and security of hazardous chemicals 

and thus complement what the CFATS program does. 

The leading chemical industry trade associations have organized 

and implementing demanding stewardship initiatives such as 

SOCMA’s ChemStewards to manage and improve environmental 

health, safety, and security performance—a public-private partnership that leveraged these industry stewardship programs like 

ChemStewards to benefit both chemical facilities and the public. 

And then last, I will emphasize a point that’s been made before 

about the continuing importance to use rulemaking in amending 

Appendix A, and I will agree with Director Wulf. 

Currently, the Administrative Procedure Act requires Appendix 

A to be changed through rulemaking because it’s already part of 

the rule, and so that will continue to be the case, unless that were 

to be changed by new legislation, which we would not support because it’s important for facilities to be able to get the information 

to the DHS that it needs to understand them. The bottom line is 

that CFATS is working and working far more successfully and efficiently than a lot of other regulatory programs. 

CFATS inspectors generally interact well with facilities and the 

agency has an effective compliance assistance program. Facilities 

are more secure and the public is safer today because of this program. 

Congress should reauthorize it to maintain that progress. 

Thank you. 

[The prepared statement of Mr. Conrad follows:] 

102 


34591.055

Testimony of 

James W. Conrad, Jr. 

Principal 

Conrad law & Policy Counsel 

on behalf of 

Society of Chemical Manufacturers and Affiliates 

before the 

House Committee on Energy and Commerce 

Subcommittee on Environment 

on 

The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress Report 

June 14, 2018 
103 


34591.056

Good morning Chairman Shimkus, Ranking Member Tonka, and members of the Subcommittee. 

My name is Jamie Conrad. For over a decade, I have been policy counsel to the Society of Chemical 

Manufacturers and Affiliates, or SOCMA, which is the only U.S.-based trade association dedicated solely 

to the specialty and fine chemical industry. For the previous 14 years, I was an in-house counsel at the 

American Chemistry Council. I have worked on chemical facility security issues since before 9/11, and I 

have been continuously involved in the CFATS program since the law was first enacted in 2006. I have 

also chaired the ABA's Section of Administrative Law & Regulatory Practice. I'm pleased to be here 

today to provide SOCMA's perspective on CFATS. 

SOCMA strongly supports the CFATS program, and we urge Congress to develop and pass 

legislation to reauthorize it before its authorization expires next January. CFATS protects high-risk 

chemical facilities and their surrounding communities by ensuring that security measures are in place to 

reduce the risk of successful terrorist attacks. More than half of SOCMA's 115 manufacturing members 

are regulated under the CFATS program. 

SOCMA urges you to reauthorize CFATS for some period of years, because regulatory certainty is 

integral to our operations. CFATS is an expensive and time-consuming program with which to comply, 

especially for small businesses. Responsible companies like those in our membership want the CFATS 

program- but they need it to be consistent and predictable to be able to plan their business futures. A 

multi-year reauthorization would give SOCMA members that assurance. 

The CFATS program has gone through dramatic changes through the years. Without dwelling on 

the past, the early years of the CFATS program were a significant challenge for everyone. The program 

has vastly improved under the direction of the Deputy Assistant Secretary for Infrastructure Protection, 

David Wulf. His early accomplishments were what gave Congress the confidence to reauthorize the 

program in 2014 for four years. SOCMA believes the program's continued progress is directly 

2 
104 


34591.057

attributable to Mr. Wulf's leadership and justifies another reauthorization for some additional period of 

years. 

The most significant recent improvement in the CFATS program is version 2.0 of the Chemical 

Security Assessment Tool, or CSAT, which was released in September 2016. CSAT is an integrated online 

portal that enables facilities to submit information for the initial Top-Screen, the Security Vulnerability 

Assessment and the Site Security Plan. 

The original CSAT process was clunky and difficult to use, and took a significant amount of time 

and energy to complete. The number one recommendation in SOCMA's CFATS comments in 2014 was 

that DHS fix it. DHS has now improved the tool dramatically, and our members uniformly report that it 

is much easier to use and far less resource intensive- while still providing DHS the information it needs. 

This improvement is extremely important for SOCMA members, 70% of which are small 

businesses. These businesses cannot afford to have dedicated staff for these kinds of processes, nor can 

they afford to hire consultants to do it for them. Oftentimes, a single individual is responsible for all 

regulatory compliance- environmental, security, FDA, etc. These kinds of improvements are thus highly 

valuable. 

While I have thus far applauded DHS's efforts, SOCMA does have some concerns. The first is 

related to how DHS "tiers," or assigns risk levels to, facilities based on their CSAT submissions. When 

Congress reauthorized CFATS, it instructed DHS to "share with the owner or operator of a covered 

chemical facility any information that the owner or operator needs to comply with this section." 6 

U.S.C. § 622(d)(3). Congress might expand this language to create a clearer obligation for DHS to share 

with a facility the exact reason for its tier assignment. That would better enable facilities to understand 

what they might do to lower their risk tier. 

A second concern is the Personnel Surety Program, or PSP. PSP requires that facility personnel 

and visitors be vetted in specific ways. Currently this program only applies to Tier 1 and 2 facilities, but 

3 
105 


34591.058

DHS is considering expanding the program to Tier 3 and 4 facilities. SOCMA believes that it is premature 

to expand PSP to Tier 3 and 4 facilities. These facilities are by definition lower risk facilities, and PSP 

imposes real burdens in terms of personnel time and delay. SOCMA believes that DHS should complete a 

rigorous assessment, in conjunction with the Department of Justice and the FBI, of the risks avoided and 

costs imposed by the PSP process. A multi-agency review of the effectiveness of PSP is necessary to 

really understand these costs and benefits before expanding this program to Tiers 3 and 4. 

SOCMA also believes there is a place within CFATS for a program that would recognize voluntary 

industry programs to enhance security and, as a result, the CFATS program. The leading chemical 

industry trade and technical organizations have developed and implemented demanding industry 

stewardship programs, such as SOCMA's ChemStewards, an environmental, health, safety and security 

(EHS&S) management program designed to help facilities optimize performance, save money and 

enhance their role as a good corporate citizen. A public/private sector partnership that leverages 

industry stewardship programs like ChemStewards to further enhance the safety and security of 

hazardous chemicals could benefit both chemical facilities and the public. 

Last, I should emphasize the importance of using the rule making process to amend Appendix A, 

the list of chemicals of interest that triggers the applicability of the CFATS program. Chemicals on and 

off Appendix A are central to our members' businesses and to our economy. Prior public notice and 

opportunity to comment have been, and should remain, a prerequisite to amending Appendix A. 

Facilities impacted by changes to Appendix A must have ample opportunity to supply DHS all of the 

pertinent information it needs to decide whether to list a chemical and at what quantities and 

concentrations. 

The bottom line is that the CFATS program is working, and working far more successfully and 

efficiently than many other regulatory programs. CFATS inspectors do a good job of working with 

facilities. The agency has an aggressive compliance assistance program, and that program has largely 

4 
106 


34591.059

enabled it to resolve potential non-compliance issues without having to resort to fines and enforcement 

actions. And DHS has worked with industry to improve the program, recognizing that such a regulatory 

system cannot be developed in a bubble, but must incorporate information that only regulated facilities 

possess. Facilities are more secure, and the public safer, today because of this program. Congress 

should reauthorize it to maintain that progress. 

Thank you for the opportunity to testify, and I look forward to your questions. 

5 
107 

Mr. HARPER. Thank you, Mr. Conrad. 

The chair will now recognize Ms. Arellano for 5 minutes for the 

purposes of an opening statement. 

Welcome. 

STATEMENT OF YVETTE ARELLANO 

Ms. ARELLANO. Thank you, Chairs and Ranking Members, of the 

Energy and Commerce Committee and Subcommittee on the Environment. 

Thank you for this opportunity to speak on the proposed rule to 

roll back and eliminate critical protections for my community in 

Houston Texas that are part of EPA’s 2017 chemical disaster rule. 

I am disappointed that the EPA and its rulemaking has chosen 

to only hold one hearing in Washington, D.C., making it difficult 

for voices like those in my community to be heard. 

But I am relieved that I can bring my experience to this hearing. 

My name is Yvette Arellano. I am here on behalf of Texas Environmental Justice Advocacy Services. 

We are a nonprofit working to educate and mobilize our community in southeast Houston, including Manchester and the surrounding neighborhoods, which have high concentrations of chemical facilities. 

The EPA is required to regulate effectively under the risk management plan and CFATS. This exposes our communities which include significant communities of color and low-income families to 

more toxic air, pollution, and disproportionate harm from chemical 

disasters. 

As illustrated too well from Hurricane Harvey, too often we experience a toxic flood on top of the threats we already face from hurricanes and heavy rains. That comes on top of disparate health and 

safety impacts we already face around the year because EPA refuses to do its job to protect us from the frequent toxic releases and 

pollution these facilities send across the fence line into our communities. 

At Hartman Park, which is right across the street from the 

Valero refinery, communities painted a mural reflecting that nearly 

every child that plays in the park is in the shadow of a nearby 

chemical facility—a far cry from what people at this hearing see 

out of their window in Capitol Hill and D.C. 

Communities in Manchester never know which incident requires 

evacuation or sheltering in place. We hear the sirens go off. I heard 

the sirens go off, or alarms go off, for a vote and that sent my 

stress levels high. 

People live in constant fear of releases or incidences while their 

children are playing outside. In hurricane seasons, it’s bad enough 

that families have to prepare for their lights to go out and ensuring 

that they have enough food and water. 

No one should have to shelter in place due to a hurricane as toxic 

chemicals flood their homes, wondering what to do if facilities down 

the street will have a catastrophic explosion, chemical fire, chemical release, as what happened in our community and neighborhoods during Harvey. People deserve the right to know the information necessary to make informed decisions for them and their 

families. 

108 

The chemical disaster rule contains important safeguards that 

would help communities like mine and across the country with 

common sense provisions, most importantly, for our already over 

exposed communities. 

We need this fully effective right now and we need to require facilities to take action to prevent fires, explosions, and disasters including by ensuring they actually look for safer ways to operate before a disaster starts. It also would have increased the availability 

of basic information we need to know, like chemical safety data 

sheets and emergency response contacts so communities can try to 

find ways to protect ourselves if a serious incident happens. 

Community members should get the information from each incident they’re exposed to without delay and it’s essential for facilities 

to do real incident investigation reports that they cannot ignore in 

planning to prevent future problems. 

I want to highlight that the rule finalized in early 2019 and came 

afterward by the EPA and after over a hundred groups working 

with TEJAS called for action, starting in 2011, as disasters were 

happening across the country and people in Washington, D.C. 

didn’t seem to pay attention. 

It also provided for a better coordination through sharing information first responders need and assuring practice notification and 

exercises happen to prepare without delay. 

EPA cannot justify repealing all of the prevention and weakening 

other important requirements and it has refused to face the fact 

that it’s taking away protections meant to save lives and prevent 

harm, especially to communities like ours, right across the fence 

line from chemical facilities. 

These rollbacks don’t come without community costs as fires, 

toxic releases across the country on this administration’s watch, especially the Arkema explosion in Crosby after Hurricane Harvey, 

demonstrated. 

A lack of information puts the surrounding community and first 

responders in jeopardy. First responders on the scene had to be 

evacuated and received medical treatment for inhaling dangerous 

chemicals from the blast. 

Community members are still dealing with the aftermath of 

chemical debris which is visible on their lawns and cars. The 

Valero refinery and other nearby facilities released a spike of benzene and other toxic chemicals. But most of these were missed because EPA and states turned off or moved most of the air monitors. 

I urge this committee to consider the impacts on your neighbors, 

on our neighbors, our families, without critical protections like 

those in the chemical disaster rule and ask you to call on President 

Trump and the administration and Administrator Pruitt to drop 

the hazardous plan that the EPA is considering which would revoke lifesaving protections for communities across the country, preventing children and vulnerable communities from chemical disasters. 

The way EPA originally found was necessary should not be a 

partisan issue and we call on Congress and EPA to protect communities, not chemical companies. 

109 

Communities across the country remain in harm’s way and this 

is especially scary as we drive around Houston with billboards saying hurricane season has begun—be prepared. 

[The prepared statement of Ms. Arellano follows:] 

110 


34591.060

Thank you for this opportunity to speak on the proposed rule to rollback and eliminate critical 

protections for my community in Houston, TX that are part of EPA's 2017 Chemical Disaster Rule. I am 

disappointed that the EPA has chosen to only hold one hearing in Washington, DC making it difficult for 

voices like those in my community to be heard. 

My name is Yvette Arellano. I am here on behalf of the Texas Environmental Advocacy Services (TEJAS). 

We are a non-profit organization working to educate and mobilize our community in southeast Houston, 

TX, Manchester and surrounding neighborhoods, which have a high concentration of chemical facilities 

that EPA is required to regulate effectively under the Risk Management Program. This exposes our 

communities, which include significant communities of color and low-income families, to more toxic air 

pollution and disproportionate harm from chemical disasters. As illustrated too well from Hurricane 

Harvey, too often, we experience a toxic flood on top of the threats we already face from hurricanes and 

heavy rains. That comes on top of the disparate health and safety impacts we already face around the 

year, because of EPA's refusal to do its job to protect us from the frequent toxic releases and pollution 

these facilities send across the fenceline into our communities. At Hartman Park which is right across the 

street from the Valero Refinery, communities painted a mural reflecting that nearly every day children 

play in the shadow of these nearby chemical facilities, a far cry from what people at this hearing see out 

of our window here in Capitol Hill in Washington, D.C. 

Communities in Manchester never know which incident requires evacuation or sheltering in place when 

we hear the sirens go off. People live in constant fear of releases or incidents while their children are 

playing outside. In hurricane season, it's bad enough that families have to prepare for their lights to go 

out and ensuring they have enough food and water. No one should have to shelter in place due to a 

hurricane, as toxic chemicals flood their homes, wondering what to do if the facility down the street will 

have a catastrophic explosion, chemical release, or fire, as happened in our community and neighboring 

parts ofTexas during Hurricane Harvey. People deserve the right to know the information necessary to 

make informed decisions for them and their family. 

The Chemical Disaster Rule contains important safeguards that would help communities like mine and 

across the country with common sense provisions- most importantly for our already over-exposed 

community, we need this in full effect now to require facilities to take action to prevent fires, 

explosions, and other disasters, including by ensuring they actually look for safer ways to operate before 

a disaster starts. It also would have increased the availability of basic information we need to know, like 

chemical safety data sheets and emergency response contacts so communities can try to find ways to 

protect ourselves if a serious incident happens. Community members should get information from each 

incident they are exposed to, without delay, and it's essential for facilities to do real incident 

investigation reports that they cannot ignore in planning to prevent future problems. I want to highlight 

that the rule finalized in early 2017 came after years of work by EPA and after over 100 groups working 

with TEJAS called for action starting in 2011, as disasters were happening around the country and 

people in Washington, D.C. did not seem to be paying attention.' It also provided for better 

coordination through sharing information first-responders need, and ensuring practice notification and 

exercises happen to prepare without delay. EPA cannot justify repealing all of the prevention or 

weakening other important requirements and it has refused to face the fact that it is taking away 

protections meant to save lives and prevent harm especially to communities like ours right across the 

fenceline from chemical facilities. 
111 


34591.061

These rollbacks don't come without a community cost. As the fires, toxic releases around the country on 

this Administration's watch, and especially the Arkema explosion in neighboring Crosby, TX after 

Hurricane Harvey demonstrated, lack of information puts the surrounding community and first 

responders in jeopardy. First-responders on the scene had to be evacuated and receive medical 

treatment for inhaling dangerous chemicals from the blast.'' Community members are still dealing with 

the aftermath of chemical debris which is visible on their lawns and cars. The Valero refinery and other 

nearby facilities released spikes in benzene and other toxic chemicals but most of these were missed 

because EPA and states turned off or moved most of the air monitors.''' 

I urge this committee to consider the impacts on your neighbors and family without critical protections 

like those in the Chemical Disaster Rule and ask you to call on President Trump and Administrator Pruitt 

to drop the hazardous plan that EPA is considering which would revoke life-saving protections for 

communities across the country. Preventing children and vulnerable communities from chemical 

disasters, the way EPA originally found was necessary should not be a partisan issue, and we call on 

Congress and EPA to protect communities, not chemical companies. Communities around the country 

remain in harm's way and it's especially scary as we drive around Houston with billboards saying 

Hurricane season has begun. Be prepared. But how can we prepare when EPA is refusing to keep basic 

safeguards in place- safeguards it found were necessary to reduce deaths, injuries, and the need for 

communities like Manchester to have to shelter in place or evacuate? I urge you to also consider 

increasing community trust in chemical facility regulatory programs by adding dual languages to 

information sharing, requiring the implementation of safer technologies in facilities to mitigate a future 

disaster, and to consider the cumulative impacts of exposures to multiple chemical facility sources. Our 

communities feel powerless in the event of a chemical disaster and I hope this committee works to 

restore power and protection to the people of these communities. 

' https :/ /www. d ocu mentcl oud .o rg/ docu ments/332037 -blue-green-coalition-letter -to-obama-june-21-2011. htm I 

li https:/lwww.reuters.com/artic!e/us-storm-harvey-arkema-!awsuit/po!ice-and-emts-sue-arkema-over-chemlcalplant -fire-after -ha rvey-id USKCN 1 Bl2 PO 

"' https://www.houstonchronicle.com/news/houston-texas/houston/article/After-Harvey-a-second-storm-of-air12795260.php 
112 

Mr. HARPER. Your time has expired. I apologize. 

We’ll give you opportunity during the questioning. Thank you 

very much. 

It’s now time for the members to ask questions. I want to thank 

each of you for your appearance here and for your insight and the 

experience that you bring. 

And Mr. Roberts, I would like to ask you a question first. We’ve 

from GAO that one of the challenges faced by DHS with the implementation of CFATS is compliance enforcement. 

Your written testimony points out that there’s inconsistency with 

inspections and enforcement from region to region. Can you elaborate some on that and perhaps give us some suggestions on how 

to correct that? 

Mr. ROBERTS. Certainly. Let me emphasize again the inspectors 

are, almost without fail, are extremely helpful. 

They’re friendly, professional, but there continues to be a lack of, 

it seems, consistent knowledge in various areas of the program, including the specific way the regulation itself may work—the confusion oftentimes between what regulation is and implementing guidance. 

As we know, CFATS is a risk-based performance standard. That 

means that DHS can’t prescribe the particularly security measure 

a facility must implement or may not—or does not need to implement for plan approval, and we’ve had many instances over the 

years, especially as DHS has upticked, obviously, it’s compliance 

inspections in the last few years where the specific manner and nature of those inspections simply is not the same region to region 

and even within the same region. 

Some of that may go back to training. Some of it may go back 

to the prior biases or lack thereof of the inspector who may come 

from a prior Federal background. 

Some of that goes to, on a positive side, with familiarity of an 

inspector with the site so they may not feel the need to continue 

to go very deeply sometimes. 

But the way a particular inspector assesses things seems to lack 

any real consistency from site to site, region to region. 

Mr. HARPER. And I appreciate the way you have elaborated on 

that. So is this a training issue that we are talking about or is it 

just something that, because of the different experiences, we can’t 

correct? 

Mr. ROBERTS. No, I think it absolutely is a couple of things. One 

is training around the actual rule—training around the CSAT portal—how it works. 

We’ve had instances where inspectors would ask a facility to do 

something in their top-screen that is not possible because the topscreen doesn’t allow that type of data to be inputted. So that just 

shows me that that particular inspector may not understand how 

the top-screen itself works. 

Certainly, training of the regulation—the top-screen tool, the 

CSAT suite of tools that Mr. Wulf mentioned—certainly, the guidance—difference between guidance and regulation, and I think, as 

DHS has indicated, as GAO has indicated, as DHS has said in 

other occasions, they are putting together some more specific directives, some more specific guidance material for their inspectors. 

113 

I think this is one area where actually a checklist would be helpful in terms of understanding what an inspection should do, what 

we should look for, the level and detail an inspection should occur, 

site to site, region to region, regardless of the particular nuances 

of the facility. There are some basic things that should occur every 

time. 

Mr. HARPER. Thanks, Mr. Roberts. 

Mr. Conrad, if I may ask you—I know we’ve had some that 

would argue that information from CFATS-regulated facilities is 

not available to people who should know it. What would be your 

response to that? 

Mr. CONRAD. I would say that if that’s true it’s because the systems we have in place to make that happen aren’t working. There 

is a statute, the EPCRA—the Environmental—the Emergency 

Planning and Community Right to Know Act—that originated in 

this committee whose sole focus is to make sure that state and 

local emergency planning bodies and fire departments are provided 

with all the information that they need to plan for emergencies of 

whatever sort—natural as well as security related—and to be able 

to respond to them, and the statute couldn’t be clearer that, for example, those facilities shall promptly provide information necessary 

for developing and implementing the emergency plan. 

So it’s not qualified, and it requires submission of lists of safety 

data sheets or the safety data sheets themselves, inventories of 

chemicals, or, upon request, the maximum and average amounts of 

a chemical on the site, where it’s stored, how it’s stored, and that 

information, in turn, can be made available to the public. 

And specifically with respect to fire departments, it says that the 

owner or operator with the facility shall allow the fire department 

to conduct an on-site inspection of the facility and shall provide to 

the fire department specific location information on hazardous 

chemicals at the facility. 

So we think the statute is sound. It may well be appropriate for 

this committee to conduct oversight on why it is the LEPAS perform more or less well in certain areas. But the CFATS program 

doesn’t restrict any of that. 

To the contrary, the statute that you all passed 4 years ago expressly preserves all those sorts of information disclosure statutes 

from any effect by a result of the CFATS program. 

In fact, this is the CVI guidance from DHS from the Bush administration, no less, state—note, state, local, and tribal officials including first responders must have access to any information that 

is necessary to plan for and respond to an emergency event at a 

chemical facility. 

It’s equally important that this information is available in a form 

that is readily accessible and easily disseminated. In most cases, a 

facility can provide this information that contains all necessary 

operational and facility-specific information and excludes CVI. 

But then, as Mr. Wulf said, there’s a way for sharing CVI, too. 

So the systems that—the legal system, I think, is sound. It’s just 

a question of whether it’s really working well. 

Mr. HARPER. Thank you very much, Mr. Conrad. 

The chair will now recognize the gentleman from New York, Mr. 

Tonko, the ranking member of the subcommittee. 

114 

Mr. Tonko. 

Mr. TONKO. Thank you, Mr. Chair. 

I believe we must acknowledge that the CFATS program is not 

comprehensive and that security gaps do indeed exist. 

Director Currie, can you give us a sense of the quality of information given to first responders near CFATS facilities? 

Mr. CURRIE. Yes, sir. 

So actually in our ongoing review that we’ll issue a report on 

next month we are looking at that very issue and it relates to what 

Mr. Conrad is saying. 

He’s right that there’s never been an assessment of the process 

itself under CFATS for how well they’re coordinating with the local 

emergency planning committees and what they’re providing. 

That’s exactly what we are looking at. We are digging into that 

process to figure out how they’re coordinating with those committees and what information specifically those committees and first 

responders are actually getting. 

And so, we’ll report on that next month. 

Mr. TONKO. You will share that with this committee? 

Mr. CURRIE. Yes, sir. 

Mr. TONKO. The subcommittee, please. 

Have they always had all the information in preparation necessary to respond to incidents at these facilities? 

Mr. CURRIE. Well, I think one of the things we are looking at, 

as we’ve talked about today, the CFATS program has only been 

around 10 years and some of these other programs have been 

around much longer. 

So, in the early stages of the program that was not the focus. 

The focus was getting facilities enrolled and things like that. 

So, this is something that’s evolved over time. Nobody’s really 

looked at it, and so that’s why we are taking a look at it. 

It’s an extremely important issue. These are life and death situations and it’s important they have the information they need to respond. 

Mr. TONKO. Thank you. If first responders do not have all the 

necessary information, it makes those security gaps even worse. 

Dr. Wilson, what is your sense on some of the security gaps in 

the CFATS program? Do you have any thoughts on the exemptions 

that exist in the program? 

Mr. WILSON. Sure. I think with regard to exemptions, we heard 

earlier around waste treatment nuclear and maritime, and I think 

it’s worth assessing whether and to what extent security is an element of the safety programs in those sectors. 

And the reason I say that is that in practice, I think there’s a 

cultural and operational divide between safety engineering and security provisions and yet security and engineering are interrelated. 

So good engineering design drives down both safety and security 

risks but security is often missing from engineering practice. 

So last month, the American Institute of Chemical Engineers had 

its conference with a keynote address by the FBI, and the reason 

for that appearance by FBI was to encourage engineers to include 

security in their scope of practice rather than relegating it, in a 

way, to traditional barriers, monitoring, and response approaches. 

115 

And so I think it would be worth evaluating if these exempted 

sectors are meeting the CFATS 18 performance standards and if 

they’re effectively integrating security into engineering practice. 

Mr. TONKO. So, from that, I can assume that first responders 

often—that they may not know exactly what is at a facility before 

having to respond to the incident? 

Mr. WILSON. I would say it’s a perennial problem. Despite the requirements of the Emergency Planning Community Right to Know 

Act, there are gaps in information, in particular in transmitting information to first responders. 

One of the problems with the local emergency planning committee structure is that the members of those committees are serving voluntarily and yet there is a lot asked of those members. 

I served as the state’s representative—the state Department of 

Industrial Relations representative—to our state emergency response committee in California and saw firsthand the difficulty 

that those members of the local committees—the challenges that 

they carried in trying to implement the requirements of a EPCRA 

and transmitting information effectively and so forth. 

Mr. TONKO. I have concerns with EPA’s recent decisions around 

the RMP rule. Can you discuss some of the provisions that were 

delayed and what would be rolled back from the latest RMP proposal? 

Mr. WILSON. There are 10 provisions having to do with incident 

prevention that are being proposed for removal from the program, 

and we could go through and catalog each of those. 

They are, I think, the most fundamental and most sort of protective aspects of the RMP that have been proposed. 

And as I said earlier, one of the reasons I am very concerned 

about that is because of the fact that prevention elements provide 

protection against multiple threats, and we’ve heard from many 

members today about not only the threat of an intentional attack 

against a facility but the very real threat of a natural disaster, of 

an earthquake—as we are in California—of a mechanical failure, 

and we heard of power outage and so forth. 

And so prevention elements or prevention requirements drive 

down that risk footprint in the face of all of those threats. Those 

are proposed to be thoroughly removed under the RMP proposal 

that we are hearing from the administration. 

Mr. TONKO. Thank you, Dr. Wilson. 

With that, I yield back. 

Mr. HARPER. The gentleman yields back. 

The chair will now recognize the gentleman from Texas, Mr. 

Green, for 5 minutes. 

Mr. GREEN. Thank you, Mr. Chairman. I want to thank our 

panel for being here today. 

As I said earlier in our first witness, CFATS was created because 

of what happened in West Texas. But as we found out that—and 

I think the last thing I heard that that was arson and still being 

investigated—but our real challenge is from natural disasters, like 

you just said—earthquakes in California, hurricanes and tropical 

storms in the Gulf of Mexico. That’s what I would like to focus 

more on and see how we can correct it. 

116 

I have a district in East Harris County, and Ms. Arellano is very 

correct—Manchester has a chemical plant on the west side, a 

thank farm on the north side before the Houston ship channel, and 

a refinery to the east side, and on the south they’re covered by railroad tracks. 

And that’s where Houston literally started back in the 1830s and 

1840s. The Manchester area was actually called Harrisburg before 

there was a city of Houston. 

And so we see a lot of these challenges in urban areas where industry is literally right next door to people who have lived there 

and it’s in Manchester for 50 years. I know two generations at least 

in that community. 

One of the concerns I had was that during our Hurricane Harvey—and I guess I should understand that when it was coming in, 

our air monitors were shut down. 

I’ve been told that I have probably the most air monitored district in the country because we have EPA. We have the city of 

Houston there they have jurisdiction. We have the county of Harris 

with a pollution control agency and, of course, the State of Texas, 

and it’s not just the air monitors but the other issue is that most 

of the rising water was literally on the bottom of those plants and 

refineries and chemical plants because of the 55 inches of rain in 

four days—how can you do it? 

The other problem, though—and I hope the industry is listening 

because we’ve talked about it—is that we have huge tanks that 

hold product, either crude oil or refined product, and the way 

they’re filled up is that they have floating roofs. 

The problem is when you get that much water on that roof, those 

rooves actually turn and you end up—whatever the emissions come 

from that, but it also can overflow because of the heavy rain. 

So we’ve got a lot of challenges in our area and to keep working 

with it, but we used to have community groups, and I hardly hear 

about them anymore—Manchester, Pasadena, Bay Town—the community groups, and I would go to those meetings sometimes and 

the industry would come in and sit down with their neighbors 

along the fence line, and I am not so sure those are still going. Is 

that still active in other parts of the country and maybe not in our 

area? 

Mr. WILSON. Is that question to me? 

Mr. GREEN. Yes. 

Mr. WILSON. I am not aware of those kinds of meetings taking 

place but I absolutely agree with your characterization of the problem. 

One of the things that California has done in its refinery safety 

regulations has required companies to look at inherently safer technologies wherever feasible and it has also required, and I think in 

the example that you have just given, risk management strategies 

that require redundancy and independence of safeguards to prevent 

a cascade of failures so, for example, in the event of a power failure, losing safeguards, one after the other. 

And of course, California is the third largest refining state and 

is, you know, producing jet fuel and gasoline. It’s inherently hazardous, and so we felt it was important to be very clear about the 

117 

importance of introducing and requiring, actually, independence 

and—— 

Mr. GREEN. I only have 26 seconds. 

Mr. WILSON. Sorry. 

Mr. GREEN. And I agree, because even with the Arkema problem—wasn’t in our district but the redundancies weren’t there. In 

fact, our Harris County district attorney has launched an investigation into that plant and see why it didn’t. 

Ms. Arellano, in your testimony, you talked a lot about how communities like ours in Houston face additional challenges during 

natural disasters due to their proximity to these plants. 

What recommendations would you do for industry to improve 

their relationship with community groups and civic clubs, because 

I visit Manchester civic club as often as I can and, typically, one 

of our refinery staff is there to answer questions. 

What are some of the suggestions TEJAS would tell us that we 

could do and inform people in the neighborhood but also, just how 

we can do this better? Because those refineries and chemical plants 

are probably not going to move because they’ve been there for 50 

years. 

Ms. ARELLANO. These industry partners, they do come out to the 

civic associations. But they talk about scholarships. They talk 

about fire, indoor air pollutants. They’ll hand out fire detectors. 

But they won’t talk about the latest expansion. They won’t talk 

about a permit notice they had out—like the one they have out that 

would increase hydrogen cyanide from 52 tons to 512 tons. 

They’ll go ahead and they’ll speak about a backpack giveaway 

event but not give any real information. So I would say having true 

and real information going between industry partners and neighboring communities is vital to this process. 

The other thing that I would like people to consider is a cumulative analysis of the TCQ is supposed to have some sort of cumulative analysis program. 

It’s important for us to know exactly the impacts of all the neighbors. Just like you said, there is Contanda Chemical, it’s 87 CO 

carbon storage tanks with a capacity of a thousand to 74,000 barrels of chemical product. At Valero Refining, it has 164,000 barrels 

per calendar day of refining, and then the sulfuric acid plant that’s 

Eco Services, original Rhodia. 

So it’s important for us to know the impacts of all of these aggregated together. RMP facilities have these radiuses. 

But we are not accounting for the toxic impacts on the communities, and adding all that information, to not say that four facilities are exposing the community to 10 cancer-causing substances 

but instead saying this community is exposed to 40, and taking 

into account that all of them have safety hazards and all of them 

have chemical releases, they all are exposed to fires and incidences 

whether it is—people keep talking about these terrorist attacks but 

the communities are exposed to daily toxics. 

They’re more frequently exposed to fires from chemical releases 

and fugitive emissions than they are a terror attack. 

So I would hope that this committee considers these everyday 

problems with community members in the decision to keep going 

118 

forward and give people the opportunity to make their own decisions—safe ones for them and their families. 

Mr. HARPER. The gentleman’s time has expired. 

Seeing that there are no further members wishing to ask questions, I want to thank each of you for being here today and for the 

knowledge and information that you have shared with us. It’s very, 

very helpful. 

Before we conclude, I would like to ask for unanimous consent 

to submit the following document for the record—a letter from the 

Chemical Facility Anti-Terrorism Standards Coalition. 

Without objection, so ordered. 

[The information appears at the conclusion of the hearing] 

Mr. HARPER. And pursuant to committee rules, I remind members that they have 10 business days to submit additional questions for the record, and should you get any of those questions I 

would ask that you submit your responses within 10 business days 

from the receipt of such questions. 

Without objection, the subcommittee is adjourned. 

[Whereupon, at 12:44 p.m., the committee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

119 


34591.062

June 14, 2018 

The Honorable John Shimkus 

Chairman 

House Subcommittee on Environment 

2125 Rayburn House Office Building 

Washington, D.C. 20515 

The Honorable Paul Tonko 

Ranking Member 

House Subcommittee on Environment 

2125 Rayburn House Office Building 

Washington, D.C. 20515 

Dear Chairman Shimkus and Ranking Member Tonko: 

The Chemical Facility Anti-Terrorism Standards (CFATS) Coalition comprises a diverse group of 

trade associations and companies impacted by the CFATS regulations. Coalition members 

represent major sectors of the American economy, including chemical production, chemical 

distribution and storage, manufacturing, oil and gas refining, utilities, mining, and 

agricultural goods and services. The businesses we represent are vital to the American 

economy. A multi-year reauthorization would provide our industries with the regulatory 

certainty we need to efficiently meet compliance requirements and enable the Department of 

Homeland Security (DHS) to effectively run the CFATS program. 

The CFATS Coalition requests that you make multi-year reauthorization of CFATS an 

immediate priority in your committee. The current CFATS authorization will sunset in January 

2019. With a full congressional calendar in 2018, it is critical for your committee to take up 

CFATS reauthorization legislation as soon as possible so it can proceed to the full U.S. Senate 

and U.S. House of Representatives for consideration and approval. 

The CFATS program has focused our industries on security, helping to make our nation more 

secure. Since its establishment in 2007, our industries have invested millions of dollars and 

instituted thousands of new security measures at our facilities. The "Protecting and Securing 

Chemical Facilities from Terrorist Attacks Act" of 2014 (P.L. 113-254), which for the first time 

provided CFATS a multi-year authorization, further enhanced these efforts by providing 

regulatory certainty to both industry and DHS. This stability allowed DHS to increase 

efficiencies in the program while streamlining the information submission process for 

regulated facilities. 

A multi-year reauthorization of CFATS in the next few months would allow for the 

continuation of this positive momentum. We urge you to move CFATS reauthorization through 

the legislative process as soon as possible. Doing so will enhance the security of our products, 

our people, and our nation. 

Sincerely, 

Agricultural Retailers Association 

American Chemistry Council 

American Fuel & Petrochemical Manufacturers 

American Gas Association 

American Petroleum Institute 

Institute of Makers of Explosives 

International Liquid Terminals Association 

Interstate Natural Gas Association of America 
120 


34591.063

National Association of Chemical Distributors 

National Association of Manufacturers 

National Mining Association 

Society of Chemical Manufacturers ft Affiliates 

The Fertilizer Institute 

cc: The Honorable Greg Walden, Chairman, House Committee on Energy and Commerce 

The Honorable Frank Pallone, Ranking Member, House Committee on Energy and 

Commerce 
121 


34591.064

GREG WAlDEN, Of\FGON 

CHt\lRMAN 

Mr. Dave Wulf 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

Qtongre5'5' of tiJC Wnttcb $tatc5' 

f!.>on»r of l\eprct~entatii.Jeu 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFICE BuiLDING 

WASHINGTON, DC 20515-6115 

M,*'"'Y <?D2i2?0• 

M>nw.ty t?.O,'i225-3G41 

July 16,2018 

Acting Deputy Assistant Secretary, Infrastructure Protection 

U.S. Department of Homeland Security 

245 Murray Lane, S.W. 

Washington, DC 20528 

Dear Mr. Wulf: 

Thank you for appearing before the Subcommittee on Environment on June 14, 2018, to 

testify at the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

- A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. Also attached are Member requests made during the hearing. To facilitate the 

printing of the hearing record, please respond to these questions and requests with a transmittal 

letter by the close of business on Monday, July 30, 2018. Your responses should be mailed to Kelly 

Collins, Legislative Clerk, Committee on Energy and Commerce, 2125 Rayburn House Office 

Building, Washington, DC 20515 and e-mailed in Word format to h_cllv.<;_Qllinst/.'lmil.b!l\!-"~-

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

~~ John Shimkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonka, Ranking Member, Subcommittee on Environment 

Attachments 
122 


34591.065

Question#: I 

Topic: Drinking Water Facility Attack 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CF ATS) -A Progress 

Report 

Primary: The Honorable Janice D. Schakowsky 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: In 1998, pursuant to Presidential Decision Directive 63 on Critical 

Infrastructure Protection, the Environmental Protection Agency (EPA) has served as the 

designated agency for the water supply sector. 

In 2000, EPA established a partnership with the Association of Metropolitan Water 

Agencies (AMWA) and American Water Works Association (A WWA) to jointly 

undertake measures to safeguard water supplies from terrorist acts. A WW A's Research 

Foundation contracted with the Department of Energy's Sandia National Laboratory to 

develop a vulnerability assessment tool for water systems (as an extension of 

methodology for assessing federal dams). EPA supported a project with the Sandia Lab to 

pilot test the physical vulnerability assessment tool and develop a cyber vulnerability 

assessment tool. This effort took on added importance after September 11, 2001. 

On June 12,2002, President George W. Bush signed into Public Law 107-188, the Public 

Health Security and Bioterrorism Prevention and Preparedness Act. Title IV of this Act 

established requirements on drinking water systems to conduct vulnerability assessments 

and create emergency response plans to prevent intentional acts to introduce biological, 

chemical, or radiological contamination into public water supplies. An Information 

Sharing and Analysis Center supported by an EPA grant became operational under 

AMW A's leadership in December 2002, allowing for dissemination of alerts to drinking 

water utilities about potential threats or vulnerabilities to the integrity of their operations 

that have been detected and viable resolutions to problems. 

On December 17, 2003, President George W. Bush issued Homeland Security 

Presidential Directive 7. This directive. issued II months after the creation of the 

Department of Homeland Security (DHS) and 22 months after DHS's predecessor, the 

Office of Homeland Security, established EPA as the Sector Specific Agency for 

drinking water systems because this sector possessed "unique characteristics and 

operating models." Subsequent presidential directives have affirmed this designation and 

responsibility for the security of the sector, including the latest one, Presidential Policy 

Directive 21 from February 12,2013, relating to Critical Infrastructure and Resilience. 

When Congress, in 2006, established the Chemical Facility Anti-Terrorism Standards 

(CFATS) program in section 550 of Public Law I 09-295, Congress recognized this 

would be the first regulatory authority DHS would be given on its own -rather than 

inherit from legacy agencies - and that CF ATS should not cover security at facilities 

already subject to another regime. In the case of drinking water, Congress not only 
123 


34591.066

Question#: I 

Topic: Drinking Water Facility Attack 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CF ATS) - A Progress 

Report 

Primary: The Honorable Janice D. Schakowsky 

Committee: ENERGY & COMMERCE (HOUSE) 

understood that facilities were subject to Title IV of Public Law 107-188, but that 

chemicals were an integral part of disinfecting pathogens and the public health dimension 

of drinking water made a chemical control program - focused on only the security 

dimension of the plant-- an ill-suited replacement for the needs of this sector. For this 

reason, Congress has routinely rejected calls to make drinking water systems subject to 

CF ATS or substitute DHS for EPA as the sector specific lead. 

Has there been a successful terrorist attack at a drinking water facility with EPA as the 

lead agency for this sector? 

Is EPA incapable of carrying out congressional or executive branch requirements? 

Response: The EPA has consistently demonstrated a robust capability to carry out 

congressional and executive branch requirements. To date, no successful physical 

terrorist attacks have been executed on drinking water facilities in the United States. 

However, EPA and DHS have established that water and wastewater systems in the 

United States are vulnerable to terrorist attacks, and the methods, means, and capabilities 

to carry out such attacks are readily available. Further, terrorist attacks on drinking water 

systems in foreign countries have been reported, including the use of techniques that 

could be applicable to drinking water systems in the United States. DHS and the EPA 

would be glad to provide additional information in response to this question in a 

classified briefing. 
124 


34591.067

Question#: 2 

Topic: CF A TS Expansion 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Past Subcommittee hearings have demonstrated how DHS has struggled with 

getting CF ATS up and running since its inception in 2006. Currently, DHS regulates 

3,556 facilities under CFATS. Adding just those drinking water utilities serving more 

than 10,000 persons would more than double CF A TS's coverage universe by more than 

4,100. 

Please state how DHS would manage a CFATS program of nearly double its size that has 

public health and engineering questions that must be managed daily? 

Response: The Department recommends a joint DHS-EPA gap analysis study to examine 

this issue and to inform any future congressional consideration of the prospect of 

changing the statute to remove the current exclusion of public water systems and 

treatment works. See 33 USC 1292 and 42 USC 300f. If, upon conclusion of the study, 

Congress amends the statute and no longer exempts water systems and treatment work 

facilities from CF A TS requirements, then the number of facilities that must report their 

holdings of chemicals of interest would increase; however, the size of the population 

required to report their chemical holdings would depend on any parameters set in the 

statute. 

DHS and EPA would work together to implement CF A TS requirements for water and 

wastewater systems recognizing the critical role of these systems for public health 

protection. 

Question: How long would DHS need to ramp up to be in technically proficient enough 

to competently execute security reviews and inspections at these unique facilities under 

CFATS? 

Response: As stated above, the Department and EPA recommend a joint gap analysis 

study to examine this issue and to inform any future congressional consideration on the 

prospect of changing the statute to remove the current exclusion of public water systems 

and treatment works. CF ATS is a highly flexible, non-prescriptive regulation that is being 

effectively applied to a wide variety of facilities possessing chemicals of interest. The 

Risk-Based Performance Standards allow for security plans to be tailored to a facility's 

unique circumstances, and chemical security inspectors are trained to provide compliance 

assistance to facilities as they develop those security plans. 
125 


34591.068

Question#: 2 

i------ Topic: CFA TS Expansion 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFA TS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

DHS and EPA would work together to determine the best way to implement CF ATS 

requirements for water and wastewater systems while minimizing start-up time. 

Question: Recognizing that- due to practical and policy considerations previous 

presidential directives and congressional enactments have consistently placed the lead for 

drinking water system security with EPA and DHS providing support to EPA, please 

state why that was the wrong position for those administrations and congresses to take? 

Response: The Department has no reason to question previous presidential directives or 

Congressional enactments. As stated above, the Department and EPA recommend a joint 

gap analysis study to examine this issue and to inform any future congressional exclusion 

of public water systems and treatment works. If CF A TS were extended to water and 

wastewater systems, DHS and EPA would work together to implement CFATS 

requirements for those systems recognizing their critical role for public health protection. 
126 


34591.069

Question#: 3 

Topic: CF A TS Tiering 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CF A TS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Is CFATS tiering objective if DHS personnel ean override it? 

Response: DHS has invested significant time and expertise in developing a scientificallysupported approach to calculating facilities' risk as a function of terrorist threat, inherent 

vulnerabilities, and the potential consequences of a terrorist attack. The approach was the 

result of three years of work by DHS risk experts, developed in coordination with 

industry and government partners. A panel of external experts reviewed the 

methodology, and it was independently verified and validated by Sandia National 

Laboratories. 

DHS is committed to ensuring that the data used in the methodology is accurate and 

complete in order to form the best possible assessment of risk. Experts review the data 

entered by a facility on its Top-Screen, which is used in the tiering determination, for 

quality assurance. Additionally, if there are inconsistencies or questions about the data 

used in the tiering methodology, DHS works with facilities to ensure that all data is 

accurate and complete. 
127 


34591.070

Question#: 4 

Topic: New 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFA TS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Mr. Wulf, your written testimony notes that all facilities with holdings of 

chemicals of interest have been asked to resubmit information to inform a riskassessment using the new methodology. Has the tiering for any of these facilities changed 

because of the new methodology? 

Response: The improved risk methodology considers a facility's consequence, 

vulnerability, and threat in its high-risk determination. The methodology has several new 

components within each of the elements of risk which resulted in some facilities seeing a 

change in their tiering results. Changes at previously high-risk facilities are set forth 

below: 

• Approximately 36% of the previous high-risk population remained at the same 

tier. For example, a tier 2 facility that remained a tier 2. 

• Approximately 48% of the previous high-risk population moved from one highrisk tier to another high-risk tier. For example, a tier 2 facility that became a tier 

3. 

• Approximately 15% of the previous high-risk population has been determined not 

to be high-risk. For example, a tier 4 facility that is no longer tiered. 

Finally, approximately 4% ofthc previous not-high-risk population (approximately 

24,000) have been determined to be high-risk (e.g. a previously-unticred facility that is 

now a tier 4).1 

These percentages are very similar to the projections DHS briefed to industry in April 

2017. 

Question: What has been the reaction by the regulated stakeholders to the new 

methodology? 

Response: The response from industry has been overwhelmingly positive. Industry 

representatives have expressed appreciation for the more-streamlined and user-friendly 

tools and for the transparency in the new tiering methodology. When questions have 

1 Note: The first three numbers- 36%, 48%, and 15%- add up to 99% due to rounding. This represents the 

entirety of the high-risk population prior to the enhanced methodology. The fourth number- 4%- should 

not be added to this calculation, as it represents 4% of a separate population--facilities that were previously 

not high-risk. 
128 


34591.071

Question#: 4 

Topic: New Methodology 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS) -A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

been raised by industry, DHS has offered teehnical eonsultations or in-person eompliance 

assistance visits to resolve any concerns. 
129 


34591.072

Question#: 5 

Topic: Appendix A Chemical Security 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Over the last ll years, how has CFATS impacted the security of Appendix A 

chemicals at facilities containing them above threshold levels? 

Response: In order to comply with CFATS and the Risk-Based Performance Standards 

(RBPS), high-risk facilities have implemented tens of thousands of security measures to 

enhance the security surrounding their chemicals of interest. DHS has determined that 

75% of facilities have implemented, at a minimum, one enhancement to their security in 

order to satisfy the RBPS. These enhancements include measures such as: 

o Detection measures- Facilities have added intrusion detection systems, cameras 

or personnel-based monitoring to their perimeter and/or storage locations for the 

chemicals of interest. 

o Delay measures- Facilities have added layers of delay measures through locked 

cages, buildings, or rooms in order to create additional barriers of protection and 

reduce the number of individuals which have access to the chemicals of interest. 

o Personnel Surety Facilities are conducting background investigations on all 

individuals with access to the chemicals of interest and, as applicable, are 

implementing escort procedures for visitors. 

o Training Facilities have developed and are conducting security awareness 

training, drills, and/or exercises related to potential threats and attack scenarios. 

o Response- Facilities have developed and are implementing security response 

plans and coordinate regular/recurring outreach with local law enforcement and 

first responders. 
130 


34591.073

Question#: 6 

Topic: Personnel Surety 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFA TS) -A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: As you know, personnel surety is an issue that never seems to go away. Your 

testimony mentioned that DHS is preparing to address personnel surety for Tier 3 and 4 

sites. Recognizing that Tier 3 and 4 sites do not pose as high a risk as Tier 1 and 2 sites -

suggesting they need a littler touch how is DHS applying this principle in thinking 

about PSP regulations at Tier 3 and 4 sites? 

Response: Tier 3 and 4 facilities are still considered high-risk, and an attack on them or 

using their chemicals of interest could cause significant loss of life. DHS believes that 

due to these facilities' risk levels they should be required to implement all applicable 

Risk-Based Performance Standards, including RBPS 12(iv) screening for terrorist ties. 

All high-risk facilities with approved site security plans are currently implementing2 the 

other portions of RBPS 12-checks on identity, legal authorization to work, and criminal 

history. RBPS-12(iv), however, known as the CF ATS Personnel Surety Program, has 

been implemented only at Tier 1 and Tier 2 facilities. Since December 2015, Dl-!S has 

been collecting best practices and lessons learned from deploying the Personnel Surety 

Program to Tier 1 and 2 facilities and is ready to implement the program at all high-risk 

chemical facilities. 

The Department is in the process of requesting approval, through the Paperwork 

Reduction Act (PRA) process, to collect information about individuals with/or seeking 

access to high-risk chemical facilities for all four Tiers by August 2018. In anticipation of 

this request, the Department published a 60-day notice in December of2017 and a 30-day 

notice in June 2018. 

Consistent with other performance standards, the Department places a priority on 

atiording facilities flexibility in how they tailor their security plans to comply with RBPS 

12(iv). While other RBPS-such as those focused on delaying and detecting terrorist 

attacks-are scalable based on a facility's tier, there is no comparable way to scale the 

conduct of terrorist-ties checks that are designed to address insider threat. Nonetheless, 

Dl-!S affords facilities four options from which a facility may choose to satisfy the 

personnel surety requirement. 

o Option 1: Direct vetting, via the Chemical Security Assessment Tool (CSAT) 

Personnel Surety Program application 

' IN this case implementing could also include having a planned measure in place. 
131 


34591.074

Question#: 6 

Topic: Personnel Surety 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CF A TS) - A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (J lOUSE) 

o Option 2: Leveraging vetting conducted under other credential programs, which 

allows for submission of other credential information via the CSA T Personnel 

Surety Program application; 

o Option 3: Electronic Verification of a Transportation Worker Identification 

Credential (TWIC), using a TWIC reader 

o Option 4: Visual verification of credentials. 

Facilities also are invited to propose other options to ensure screening of terrorist ties for 

facility personnel and unescorted visitors. It also bears noting that facilities can decide to 

restrict access to critical assets completely for some facility personnel or require escorts 

for visitors in order to reduce the number of individuals required to be vetted. The 

Department plans to provide additional resources and assistance to Tier 3 and 4 facilities 

based on the lessons learned to date and plans also to continue allowing facilities to avail 

themselves of multiple options. Accordingly, and in view of the continuing threat of 

chemical terrorism, we believe it is appropriate to extend the Personnel Surety Program 

to high-risk facilities in Tiers 3 and 4. 
132 


34591.075

Question#: 7 

Topic: Precursor Chemical Gaps 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CF A TS) -A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: You were asked, due to existing regulations but the Bureau of Alcohol 

Tobacco and Firearms and the Department of Transportation, about whether a statutory 

exemption from CFATS was warranted for facilities manufacturing explosives. You 

stated that there was a great deal of overlap between A TF and CF A TS, but that you 

would be concerned that gaps would exist for precursor chemicals if such a statutory 

exemption was granted by Congress. 

Under Section 3(d) of Executive Order 13777, DHS was required to identify regulations 

that could be modified to reduce unnecessary regulatory burden, including instances of 

duplication. In addition, CFATS gives DHS the ability to permit compliance with 

approved alternate security programs to satisfy some or all CF A TS requirements. 

Has DHS taken action pursuant to Executive Order 13777 or under Alternate Security 

Program provisions in the Homeland Security Act to eliminate the duplication between 

CF A TS and ATF while at the same time permit CF A TS to cover articulated gaps in law 

for precursor chemicals? If not, why not? 

Response: While I did state that there is some overlap between A TF's requirements and 

CF A TS, it would be an overstatement to say that there is a great deal of overlap. Both 

ATF and DHS have the authority to regulate facilities that possess explosive materials, 

but there are notable differences between the programs. The CF A TS reporting 

requirements apply to facilities with holdings of screening threshold quantities of 

Chemicals of Interest as set forth in the CF A TS regulation; however, only those facilities 

that arc subsequently assessed as high-risk are required to implement security plans 

addressing the 18 CFA TS risk-based performance standards. ATF regulations require 

both safety and security measures, to include requirements related to the conduct of 

inventories, the reporting of thefts/losses, and magazine-locking standards. CFATS 

facilities are encouraged to include the applicable security and safety measures they have 

in place, such as those implemented due to ATF regulation, in their CFATS site security 

plan or alternative security program. Because coverage under the CF ATS regulation 

applies only to the highest-risk chemical facilities, DHS feels it is appropriate that the 

monitoring and detection standards required of high-risk facilities are more robust than 

those required under the A TF regulations that apply to all persons who store these 

materials. 
133 


34591.076

Question#: 7 

Topic: Precursor Chemical G; 

·-··---·---·-"-" 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (BOUSE) 

DI IS is concerned that a wholesale exclusion from CF A TS for facilities that are regulated 

by ATF would leave a security gap with regard to precursor chemicals that exist at those 

sites. ATF regulations apply to materials whose primary or common purpose is to 

function by explosion. ATF does not regulate Improvised Explosive Device (lED) 

precursor chemicals, such as ammonium nitrate. CF A TS does apply to these !ED 

precursor chemicals. They arc often stored on the same site, but have no security or safestorage requirements under ATF regulations. 

There are very few high-risk CF ATS facilities that are covered only for explosive 

materials regulated by ATF; the majority that have been determined to be high risk for 

explosives are considered high-risk in part because of their holdings of other chemicals of 

interest that are not regulated by A TF. 

Appendix A to the CF A TS regulation is the list of chemicals, concentrations, and 

quantities that must be reported to DHS. In order to add, remove, or modify a chemical of 

interest on Appendix A, DHS would be required to go through rulemaking 
134 


34591.077

Question#: 8 

Topic: Appendix A List Modifications 

Hearing: Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

ort 

Primary: The Honorable Paul Tonko 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: What is the current process to add, remove, or modify a chemical of interest 

on the Appendix A list? 

Response: In order to add, remove, or modify a chemical of interest (COl) on Appendix 

A, DHS is required to go through notice-and-comment rulemaking. This process would 

provide industry and the public with the ability to comment on any proposed changes to 

Appendix A prior to additions, removals or modifications becoming final. 

Question: How many chemicals of interest have been added, removed, and modified on 

the Appendix A list in each year since the program's creation? 

Response: To date, DHS has not revised Appendix A since its publication on November 

20, 2007. See 72 FR 65396. 
135 


34591.078

Question#: 9 

Topic: Drinking and Waste Water facility Security 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

Report 

Primary: The Honorable Paul Tonka 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: There are very different security and regulatory regimes at nuclear facilities, 

federal facilities, and other sites that received exemptions. But in the past, DHS has 

expressed concerns over the gaps created by these exemptions. A number of years ago, 

DHS testified that the administration's position to support closing security gap at drinking 

water facilities, is that still the administration's position? 

Response: As noted above, the Department and EPA recommend a joint gap analysis 

study to examine this issue and to inform any future congressional decision-making with 

regard to the prospect of changing or removing the current exclusion of public water 

systems and treatment works. 

Question: Does the administration still support maintaining EPA as the lead agency for 

drinking water and waste water facility security with the DHS supporting EPA's efforts? 

Response: As stated above, the Department and EPA recommend a joint gap analysis 

study to examine this issue and to inform any future congressional decision-making with 

regard to the prospect of changing or removing the current exclusion of public water 

systems and treatment works. 

Should Congress revoke the exclusion, DHS and EPA would work together to determine 

the best way to implement the CF A TS program for water and wastewater systems 

recognizing the critical role of these systems for public health protection. 
136 


34591.079

Question#: 10 

Topic: Secure Supply 

Hearing: The Chemical Facilities Anti-Terrorism Standards Program (CFATS)- A Progress 

Report 

Primary: The Honorable Diana DeGette 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Does DHS have specific recommendations for providing a secure power 

supply under CFATS? 

Response: Because CFATS is a non-prescriptive program and based on risk-based 

performance standards (RBPS), DHS does not provide specific recommendations. 

However, under RBPS 10 (Monitoring) facilities arc required to implement security 

measures to: 

1. Ensure that security systems and equipment are in good working order and 

inspected, tested, calibrated and otherwise maintained; 

ii. Regularly test security systems, note deficiencies, correct detected deficiencies 

and record results; and 

iii. Promptly identify and respond to security system and equipment failures or 

malfunctions. 

Therefore under this RBPS, DHS ensures facilities have appropriate temporary or 

compensatory measures for system outages and failures-for instance measures that may 

include a secure power supply or backup power supply. 
137 


34591.080

GREG WALDEN, OREGON 

CHAIRMAN 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

<Congress of tbe itntteb $tates 

,f!)ouse of i'eprcscntnti!Jcs 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OF-FICE Bua.otNG 

WI\SHIN(iTON, DC 20515-6115 

Mr. ChrisP. Currie 

Mo<JW\V ()07)}2~. 282! 

Mmm<ty 12;}71/25 3ll·ll 

July 16, 2018 

Director, Emergency Management; National Preparedness; 

and Critical Infrastructure Protection 

Homeland Security and Justice Team 

U.S. Government Accountability Office 

441 G Street, N.W. 

Washington, DC 20226 

Dear Mr. Currie: 

Thank you for appearing before the Subcommittee on Environment on June 14, 2018, to 

testify at the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

- A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. To facilitate the printing of the hearing record, please respond to these 

questions with a transmittal letter by the close of business on Monday, July 30, 2018. Your 

responses should be mailed to Kelly Collins, Legislative Clerk, Committee on Energy and 

Commerce, 2125 Rayburn House Office Building, Washington, DC 20515 ande-mailed in Word 

format to b.dl.L<C~Ilins d!lliilllw.use.go,·. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

'7t_/\_/ 

'ff;!;himkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonko, Ranking Member, Subcommittee on Environment 

Attachment 
138 


34591.081

GAO u.s. GOVERNMENT ACCOUNTABILITY OFFICE 

441 G St. N.W. 

Washington, DC 20548 

July 30, 2018 

The Honorable John Shimkus 

Chairman 

Subcommittee on Environment 

Committee on Energy and Commerce 

House of Representatives 

Chemical Facility Anti-Terrorism Standards Program: Responses to Posthearing Questions for 

the Record 

Dear Mr. Chairman: 

On June 14, 2018, I testified before the Committee on Energy and Commerce's Subcommittee 

on Environment on progress and challenges in the Department of Homeland Security's (DHS) 

management of its Chemical Facility Anti-Terrorism Standards (CFATS) program. Subsequent 

to the hearing, you provided us a letter dated July 16, 2018, requesting a response to additional 

questions to be submitted for the record. This letter responds to the questions for the record that 

you posed. 

If you have any questions about this letter or need additional information, please contact me at 

(404) 679-1875 or curriec@gao.gov. 

Sincerely yours. 

Chris P. Currie 

Director, Homeland Security and Justice 

Enclosure 

Page 1 
139 


34591.082

Questions for the Record 

June 14, 2018 Hearing on "The Chemical Facilities Anti-Terrorism 

Standards (CFATS) Program-A Progress Report" before 

The Subcommittee on Environment, 

House Committee on Energy and Commerce 

1. Mr. Currie, your testimony overall seems pretty positive about the changes that DHS 

has made to the CFATS program. What would you say are the most notable 

improvements DHS has made to date regarding the implementation of the program? 

As noted in my statement, some of the most notable improvements DHS has made, to date, 

regarding implementation of the program are strengthening of the accuracy of the data used 

to identify high-risk facilities; eliminating the backlog of site security plans needing approval; 

implementing the Expedited Approval Program (EAP); and developing and using a 

questionnaire to solicit feedback on outreach with industry stakeholders. 

a. What are the most notable areas where DHS still needs to improve its 

implementation of the program? 

In April2013, we reported that DHS's risk assessment approach did not consider all of 

the elements of threat, vulnerability, and consequence associated with a terrorist attack 

involving certain chemicals. 1 At that time, DHS's risk assessment was based primarily on 

consequences from human casualties, but did not consider economic consequences, as 

called for by the National Infrastructure Protection Plan and the CFATS regulation. We 

also found that (1) DHS's approach was not consistent with the NIPP because it treated 

every facility as equally vulnerable to a terrorist attack regardless of location or on-site 

security and (2) DHS was not using threat data for 90 percent of the tiered facilitiesthose tiered for the risk of theft or diversion-and using 5-year-old threat data for the 

remaining 10 percent of those facilities that were tiered for the risks of release or 

sabotage. We recommended that DHS enhance its risk assessment approach to 

incorporate all elements of risk and conduct a peer review after doing so. 

As noted in my statement, DHS has taken actions to better assess regulated facilities' 

risks in order to place the facilities into the appropriate risk tier. We are currently 

reviewing relevant technical reports, plans, and assessments describing changes made 

to revise DHS's risk assessment methodology as part of our ongoing work and will report 

on the results of this work later this summer. 

2. Mr. Currie, your written testimony highlights the fact that DHS has eliminated the 

backlog for the Agency's reviews of site security plans and visits to facilities to 

ensure that security measures meet DHS standards. Based on its analysis, is it 

GAO's understanding that DHS appropriately completed all of the reviews and site 

visits? 

We have not reviewed whether DHS appropriately completed all of the reviews of site 

security plans and site visits to facilities to ensure that security measures meet DHS 

standards. However DHS data shows that DHS has eliminated the backlog of reviews and 

1GAO, Critical infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and Gather Feedback on 

Facility Outreach Can Be Strengthened, GA0-13-353 (Washington, D.C.: Apr 5, 2013). 

Page 2 
140 


34591.083

visits to facilities. Regarding the latter, DHS is currently updating its guidance for the 

conduct of facility site visits. 

a. Does GAO have any recommendations regarding DHS's handling of site security 

plans? 

In 2015, we found that DHS had made improvements to its processes for reviewing and 

approving site security plans and have no outstanding recommendations related to these 

plans2 For example, these improvements included (1) distributing updated internal 

guidance and lessons learned on plan approvals to inspectors and plan reviewers; (2) 

distributing updated guidance to facilities to help them improve their site security plans; 

and (3) implementing changes to inspection processes, such as employing smaller 

inspection teams, conducting pre inspection phone calls with facilities to help them 

prepare for inspections, and enabling inspectors to help facility personnel edit their site 

security plans during inspections. 

3. Mr. Currie, one of the issues raised in your testimony where DHS may have room for 

improvements is regarding compliance inspections. Your written testimony notes 

that as of July 2015 DHS had conducted compliance inspections at only 83 of the 

1, 727 facilities with approved security plans. Do you know what the current number 

of facilities for which DHS has conducted compliance inspections? 

We are currently examining compliance inspections as part of our ongoing work with a focus 

on, among other things, the extent to which the CFATS program has taken action to conduct 

chemical facility inspections since we first examined this area in 2015. In addition to 

examining changes made to the program's compliance inspection process and related 

procedures and guidance, we also obtained data on the numbers of completed compliance 

inspections per year and will report on the results of our work in our report later this summer. 

a. Your written testimony also noted that of the small number of facilities for which 

DHS had conducted compliance inspections, nearly half of the facilities were not 

compliant with their approved security plans and that DHS did not have 

documented procedures for managing compliance. Based on GAO's analysis of 

the current situation, has DHS improved in this area? 

As noted in my statement, DHS updated its CFATS Enforcement Standard Operating 

Procedure (SOP) and has made progress on the new CFATS Inspections SOP. Once 

completed these two documents collectively are expected to formally document the 

processes and procedures currently being used to track noncompliant facilities and 

ensure they implement planned measures as outlined in. their approved site security 

plans, according to ISCD officials. DHS officials stated they expect to finalize these 

procedures by the end of fiscal year 2018. 

4. Mr. Currie, your written testimony discusses the need for DHS to better coordinate 

and share data with states and other federal agencies, such as EPA, to better identify 

facilities that had failed to report information to comply with CFATS. Based on GAO's 

2GAO, Critical Infrastructure Protection: DHS Action Needed to Verify Some Chemical Facility Information and 

Manage Compliance Process, GA0-15-614 (Washington, D.C., July 22, 2015). 

Page 3 
141 


34591.084

recent analysis of the CFATS program, is DHS doing a better job of working with state 

and other federal agencies? 

As noted in my statement, DHS has taken action to better identify facilities that had failed to 

report information to comply with CFATS. Specifically, DHS compared DHS data with data 

from other federal agencies, such as EPA, as well as member states from the Chemical 

Facility Safety and Security Working Group to identify potentially noncompliant facilities. As 

a result of this effort, in July 2015, DHS officials reported that they had identified about 1,000 

additional facilities that should have reported information to comply with CFATS and 

subsequently contacted these facilities to ensure compliance. DHS officials told us that they 

continue to engage with states to identify potentially non-compliant facilities. 

5. Mr. Currie, you noted that DHS has made progress better assessing the risks at 

regulated facilities in order to place facilities in the appropriate risk tier. Would you 

please elaborate? 

a. GAO previously recommended that DHS incorporate all elements of risk in its risk 

assessment approach. Based on GAO's most recent analysis, does GAO believe 

that DHS is incorporating all elements of risk? 

b. Does GAO have any initial feedback it can share regarding the model DHS 

developed with Sandia National Laboratories regarding the elimination of the 

economic consequences of a chemical attack? 

c. What about the model that DHS developed with Oak Ridge National Laboratory to 

devise a new tiering methodology? 

As noted in my statement, DHS has made progress towards addressing our 

recommendations that it enhance its risk assessment approach to incorporate all elements 

of risk and conduct a peer review after doing so, and we are currently assessing these 

actions as part of our ongoing work. For example, DHS worked with Sandia National 

Laboratories to develop a model to estimate the economic consequences of a chemical 

attack. In addition, DHS worked with Oak Ridge National Laboratory to devise a new tiering 

methodology, called the Second Generation Risk Engine. In so doing, DHS revised the 

CFATS threat, vulnerability, and consequence scoring methods to better cover the range of 

CFATS security issues. Additionally, DHS conducted peer reviews and technical reviews 

with government organizations and facility owners and operators, and worked with Sandia 

National Laboratories to verify and validate the new tiering approach. We are currently 

reviewing relevant technical reports, plans, and assessments describing changes made to 

revise DHS's risk assessment methodology as part of our ongoing work and will report on 

the results of this work later this summer. 

6. Mr. Currie, your written testimony discusses the Expedited Approval Program that 

Congress in the CFATS Act of 2014 directed DHS to create as another option that tier 

3 and tier 4 chemical facilities scan use to develop and submit security plans. Your 

written testimony notes that only 8 of the 3,152 facilities eligible to use the Expedited 

Approval Program opted to use it. Could you walk through why GAO thinks that is? 

As noted in my statement, DHS officials we interviewed attributed the low participation to 

several possible factors including: 

Page4 
142 


34591.085

DHS had implemented the expedited program after most eligible facilities already 

submitted standard (non-expedited) security plans to DHS; 

facilities may consider the expedited program's security measures to be too strict and 

prescriptive, not providing facilities the flexibility of the standard process; and 

the lack of an authorization inspection may discourage some facilities from using the 

expedited program because this inspection provides useful information about a facility's 

security. 3 

We also found in 2017 that recent changes made to the CFATS program could affect the 

future use of the expedited program. 4 As discussed previously, DHS has revised its 

methodology for determining the level of each facility's security risk, which could affect a 

facility's eligibility to participate in the EAP. DHS continues to apply the revised methodology 

to facilities regulated under the CFATS program and but it is too early to assess the impact 

on participation in the EAP. 

7. Mr. Currie, based on GAO's analysis of DHS's handling of compliance inspections 

and enforcement-Does GAO have any recommendations for DHS? 

As noted in my statement, in our July 2015 report, we found that DHS began conducting 

compliance inspections in September 2013, and by April 2015, had conducted inspections 

of 83 of the 1,727 facilities that had approved security plans. 5 We found, among other 

things, that DHS did not have documented processes and procedures for managing the 

compliance of facilities that had not implemented planned measures by the deadlines 

outlined in their plans. We recommended that DHS document processes and procedures for 

managing compliance to provide more reasonable assurance that facilities implement 

planned measures and address security gaps. DHS agreed and has taken steps toward 

implementing this recommendation. Specifically, DHS has updated its CFATS Enforcement 

Standard Operating Procedure (SOP). Also, DHS has made progress on the new CFATS 

Inspections SOP. DHS officials stated they expect to finalize these procedures by the end of 

fiscal year 2018. Once completed these two documents collectively are expected to formally 

document the processes and procedures currently being used to track noncompliant 

facilities and ensure they implement planned measures as outlined in their approved site 

security plans, according to ISCD officials. We are examining compliance inspections, 

including progress on the new inspection process, as part of our ongoing work and will 

report on the results of our work in our report later this summer. 

a. What about the issuance of penalties as a method of ensuring compliance, has 

GAO recommended to DHS that they issue penalties? 

With regard to penalties, our July 2015 report showed that nearly half of the 83 facilities 

that had undergone a compliance inspection at that time were not fully compliant with 

their approved site security plans and that DHS had not used its authority to issue 

penalties because DHS officials found it more productive to work with facilities to bring 

3An authorization inspection consists of an initial, physical review of the facility to determine if the Top-Screen, 

security vulnerability assessment. and site security plan accurately represent and address the risks for the facility. 

4GAO. Critical Infrastructure Protection: DHS Has Implemented Its Chemical Security Expedited Approval Program, 

and Pat1icipation To Date Has Been Limited, GA0-17-502 (Washington, D.C.: June 29, 2017). 

5GA0-15-614. 

Page 5 
143 


34591.086

them in compliance. a We are examining compliance inspections and the use of 

penalties as part of our ongoing work and will report on the results of our work in our 

report later this summer. 

8. Mr. Currie, in past oversight hearings regarding CFATS, we discussed that a 

systematic approach to soliciting feedback on DHS's outreach efforts would improve 

the CFATS program. Are you familiar with whether DHS has improved its approach to 

obtaining systematic feedback on its outreach activities to facility owners and 

operators? 

In our 2013 report, we recommended that DHS take action to solicit and document feedback 

on facility outreach consistent with DHS efforts to develop a strategic communication plan. 

DHS agreed and implemented this recommendation by developing a questionnaire to solicit 

feedback on outreach with industry stakeholders and began using the questionnaire in 

October 20167 

a. Your written testimony notes that DHS agreed to take action to solicit and 

document feedback from the regulated community-to your knowledge has DHS 

done this? 

As discussed above, DHS implemented this recommendation by developing a 

questionnaire to solicit feedback from the regulated community. According to ISCD 

officials, they intended to implement the questionnaire during various outreach 

engagements with stakeholders, including meetings and conferences. contact with 

ISCD's Knowledge Center, and during compliance assistance visits by ISCD inspectors. 

b. Your written testimony mentions a questionnaire to solicit feedback on outreach 

with industry stakeholders and notes that DHS began using the questionnaire in 

October 2016. Does GAO have any information regarding the effectiveness of the 

questionnaire? 

In early 2017, ISCD officials reported that they had begun to compile and analyze the 

data provided by stakeholders when using the questionnaire. However, we have not 

examined DHS's efforts to implement the questionnaire or the results associated with 

the data provided by stakeholders. 

9. One of the questions I have is how does Congress objectively know whether the 

CFATS program has over time been increasing security at regulated facilities. 

a. Can you tell me, from an objective standpoint, whether the CFATS program has 

increased security at regulated facilities? 

In our July 2015 report, we found that DHS's performance measure for the Chemical 

Facility Anti-Terrorism Standards (CFATS) program, which was intended to reflect the 

overall impact of the CFATS regulation on facility security, did not solely capture security 

6GA0-15-614. 

7 GA0-13-353. 

Page 6 
144 


34591.087

measures that were implemented by facilities and verified by ISCD8 Instead, the 

performance measure reflected both existing security measures and planned security 

measures that facilities intended to implement within the fiscal year. We recommended 

that the Director of ISCD improve the measurement and reporting of the CFATS 

program performance by developing a performance measure that includes only planned 

measures that have been implemented and verified. In December 2015, ISCD finalized 

its fiscal year 2016 annual operating plan that included verification requirements for the 

performance measure. Specifically, the new requirement requires that ISCD officials 

verify that planned measures have been implemented in accordance with the approved 

site security plan (or alternative security program) by compliance inspection other means 

before inclusion in the performance measure calculation. ISCD's actions to improve the 

performance measure verification are consistent with our recommendation. We are 

examining DHS effort to measure program performance as part of our ongoing work and 

will report on the results of our work in our report later this summer. 

b. Can you give me some practical examples, including incidents prevented or 

security risks avoided? 

We have not specifically examined examples of incidents prevented or security risks 

avoided, if any. However, we are examining DHS effort to measure program 

performance as part of our ongoing work and will report on the results of our work in our 

report later this summer. 

c. What types of security metrics are critical to this objective evaluation? 

In our July 2015 report, we stated that the National Infrastructure Protection Plan calls 

for evaluating the effectiveness of risk management efforts by collecting performance 

data to assess progress in achieving identified outputs and outcomes. In addition, the 

purpose of CFATS, as stated in its regulation, is to enhance national security by 

furthering DHS's mission and lowering the risk posed by certain chemical facilities. 

Measuring the effectiveness of the CFATS program requires that facilities implement 

planned security measures identified as necessary to address vulnerabilities and that 

DHS evaluate implementation of these measures against CFATS performance 

standards. 

However, we further reported that. because ISCD's performance measure at that time 

reflected both existing security measures that had not necessarily been implemented in 

response to CFATS and planned security measures that had not yet been verified as 

implemented, ISCD's performance measure did not reflect the value of the CFATS 

program and its impact on reducing risk at facilities, as stated in performance reports. 9 

We stated that, as the CFATS program matures and ISCD conducts compliance 

inspections in greater numbers, revising current performance measures or adding new 

ones to accurately reflect only security measures that have been implemented and 

verified would help provide a more accurate picture of ISCD's progress and help ISCD 

ensure that the program is meeting its goals. 

aGA0-15-614. 

9GA0-15-614. 

Page 7 
145 


34591.088

We are examining DHS effort to measure program performance as part of our ongoing 

work and will report on the results of our work in our report later this summer. 

10. Not every member of a Local Emergency Planning Committee (LEPC) is a first 

responder or local elected official. In fact, Section 301(c) of the Emergency Planning 

and Community Right to Know Act (EPCRA) mandates other parties, including the 

media constitute minimum composition of the LEPC. Section 2103 of the Homeland 

Security Act provides first responders and local elected officials' access to relevant 

chemical vulnerability information to respond to incidents. 

a. Do you think non-first responders and non-elected officials should be entitled 

access to CVI? If so, who and why? 

We have not examined who should and who should not be provided access to CVI. 

b. Do you think CVI training should be a pre-requisite to anyone seeking CVI? If so, 

why? 

We have not examined the training requirements associated with gaining CVI access. 

(102837) 

Page 8 
146 


34591.089

GREG WALDl N, OREGON 

CHAif'lM/\N 

Mr. Doug Brown 

President and COO 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

<!CongreS'S' of tbr ~ntteb ~tateS' 

1!)ou!3c of l\cprr!lrntatibc!l 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OmcE BuiLDING 

WASHINGTON, DC 20515-6115 Maj<><•~V 12021 ~2~ ~!l2/ 

Mmurty :l("ll 

July 16,2018 

Brown Chemical Company 

302 West Oakland Avenue 

Oakland, NJ 07436 

Dear Mr. Brown: 

Thank you for appearing before the Subcommittee on Environment on June 14,2018, to 

testify at the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

-A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. To facilitate the printing of the hearing record, please respond to these 

questions with a transmittal letter by the close of business on Monday, July 30, 2018. Your 

responses should be mailed to Kelly Collins, Legislative Clerk, Committee on Energy and 

Commerce, 2125 Rayburn House Office Building, Washington, DC 20515 and e-mailed in Word 

format to ~<'IJ.J_.cuHiiJS ,; mill).hou~l.(Q-'· 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

Sincerely, 

~ John Shimkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonko, Ranking Member, Subcommittee on Environment 

Attachment 
147 


34591.090

Ltm:zt 

PO Box 440 

Oakland, NJ 07436 

Responses to Additional Questions for the Record 

of 

Douglas A. Brown 

President and Chief Executive Officer 

Brown Chemical Company, Inc. 

to the 

U.S. House of Representatives 

Committee on Energy and Commerce 

Subcommittee on Environment 

on 

The Chemical Facility Anti-Terrorism Standards 

T: 201-337-0900 

naca· 

NaOOnal Association of 

Chemkol Dlstributont 

July 30, 2018 

www.brownchem.com 

Fax: 201-337-9026 

cdn:• 

Chemical Oistn"bution Network 
148 


34591.091

1. Your testimony acknowledges the existing CFATS Alternate Security Program or ASP 

and that firms in your trade association have had good experience using it. Yet, 

you also testify that you want DHS to give credit for using your trade association's 

safety and security code. 

a. If DHS has already issued an ASP that is being successfully deployed in your 

industry, what extra element are you seeking that the ASP does not give 

you? 

Answer: 

The CFATS Alternative Security Program for Chemical Distribution Facilities that 

NACO developed along with the American Chemistry Council is more of a 

template a facility can use as an alternative to the DHS Site Security Plan 

(SSP). It provides a way for facilities to describe their security measures in a 

narrative format and minimizes the duplication that was a problem with the 

original DHS SSP. Another advantage of the ASP over the DHS SSP is that it 

provides an actual plan for personnel reference and training. DHS treats facility 

ASPs just as they do SSPs. They review each ASP individually and inspect on the 

same schedule as facilities that use the DHS SSP. 

Our objective for an industry recognition program is to create a way to 

leverage programs such as NACD Responsible Distribution® by giving credit to 

facilities that participate in these programs. 

b. How would this work? 

Answer: 

Under such a recognition program, DHS would create an application and review 

process to determine eligibility of industry stewardship programs that meet 

certain performance criteria and provide incentives for participation. DHS 

would establish specific eligibility criteria and facility performance 

requirements and would determine program credit incentives. CFATS facilities 

could then request individually or collectively by their sponsoring organization 

to participate in the recognition program. 

2. Your testimony applauds DHS's operation of the CFATS program and makes oblique 

references to problems the program had, including a risk assessment and tiering 

process that was not based on threat or vulnerability levels. 
149 


34591.092

a. Was this methodology ever a concern for you in the past? 

Answer: 

Yes. The initial CSAT process was cumbersome and had many duplicative 

elements. 

b. If yes, how had changes in CSAT 2.0 made a difference for your firm? 

Answer: 

My experience has been that CSAT 2.0, which allows facilities to submit their 

information and DHS to analyze the material more easily, is much more 

streamlined and user friendly than the prior version. 

3. Where would you say CFATS has made the most improvements over the last four 

years? 

Answer: 

Following the 2014 four-year reauthorization, DHS was afforded the stability to 

increase efficiencies in the program while streamlining the information 

submission process for regulated facilities. In 2016, DHS developed an 

enhanced risk tiering methodology to identify more accurately high-risk 

facilities and assign them to appropriate risk tiers. In doing so, DHS notified all 

facilities with threshold quantities of CFATS chemicals of interest that they 

must submit new Top Screen surveys to the agency. At the same time, the 

agency launched CSAT 2.0. DHS implemented the re-tiering process in a timely 

and efficient manner and is now conducting authorization inspections and 

compliance inspections of facilities assigned to different tiers as well as newly 

regulated facilities. CSAT 2.0 is much more user friendly and minimizes the 

duplication that was a concern in the old DHS Security Vulnerability Assessment 

and SSP. 

4. Recently, there was discussion about removing Tier 4 facilities from the CFATS 

program. 

a. Would you be concerned that taking such a step would encourage DHS to 

expand the universe for what constitutes a Tier 3 facility, thereby moving 

former Tier 4 sites in a more heavily regulated category? 

Answer: 
150 


34591.093

Yes, I would be concerned with taking that step. 

b. Why or why not. 

Answer: 

The largest percentage of CFATS-covered facilities are assigned at the Tier 4 

level. My concern is that DHS would be hesitant to eliminate such a large 

percentage of facilities out of the CFATS program and, therefore, DHS would 

develop new methodology to bring many of those facilities into the CFATS 

program at the Tier 3 level. This action would likely increase the program 

requirements for facilities previously at the Tier 4 level. 

5. Do you support allowing non-first responders and local elected officials to have 

access to Chemical Vulnerability Information for their official duties? If not, is it 

because you believe it is a bad idea to broadly share this information among the 

public? 

Answer: 

I do not support allowing non-first responders and local elected officials to 

have access to Chemical-terrorism Vulnerability Information (CVI) unless they 

have a need to know or obtain and maintain the required security clearances to 

possess such information. Facilities must protect sensitive information from 

individuals who might pose a threat to employees, property, or surrounding 

communities. Sensitive information - such as SSPs/ ASPs, worst case scenario 

discharge data, Chemicals of Interest records, CVI, and tactical response 

information for emergency personnel - could threaten security if it falls into 

the wrong hands. The membership roles of local community first responder 

organizations very often comprise volunteers and change over quite frequently. 

This would, in my opinion, present an unreasonable risk to the secure 

information. 

6. Is your Local Emergency Planning Commission only comprised of first-responders or 

the mayor? 

Answer: 

No. The NJ Civilian Defense and Disaster Control Act (N.J.S.A. App. A:9_33) and 

NJ Executive Order 161 signed in 1987, require New Jersey LEPCs to include 

representation from elected and local officials, local media representatives, 
151 


34591.094

local environmental and transportation agencies, and community groups, 

among others. 

7. Some people would like to see workers Federally-required to be part of the 

creation of a facility's security vulnerability assessment and site security plan. 

a. Do you think this should be mandated or do you think this interaction is 

better left to the collect bargaining process between workers and their 

employer? Why? 

Answer: 

Under the current statute, at least one facility employee and one union 

representative are required (to the greatest extent practicable) to be involved 

in the development of an SSP or ASP - so long as these individuals have 

appropriate training and experience. Due to the sensitive nature of an SSP or 

ASP, the language in the current statute should not be amended to expand the 

scope or intent of this provision. The inclusion of additional employees and/or 

union members in the development of an SSP or ASP should be left to the 

discretion of facility owners/ operators. 
152 


34591.095

GREG WALDlN, OHEGON 

CH1\!HMAN 

Dr. Mike Wilson 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR., NEW JERSEY 

HANK!NG MEMBER 

q[ongrcss of tbe mtntteb $tates 

;!)oul.le of i\eprel.lcntatll.Jel.l 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFicE BuiLDING 

WASHING roN, DC 20515-6115 Md)ilHtV i-;!07)2?'> ~':J')f 

Mtnonty (?02\nr,Jf!41 

July 16,2018 

National Director, Occupational and Environmental Health 

BlueGreen Alliance 

369 Pine Street; Suite 700 

San Francisco, CA 94104 

Dear Dr. Wilson: 

Thank you for appearing before the Subcommittee on Environment on June 14,2018, to 

testify at the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

-A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. To facilitate the printing of the hearing record, please respond to these 

questions with a transmittal letter by the close of business on Monday, July 30,2018. Your 

responses should be mailed to Kelly Collins, Legislative Clerk, Committee on Energy and 

Commerce, 2125 Rayburn House Office Building, Washington, DC 20515 and e-mailed in Word 

format to hcJ!S<;;'Hill'L!UmillJm!Jse.gm. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

~ John Shimkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonko, Ranking Member, Subcommittee on Environment 

Attachment 
153 


34591.096

~=- BLUEGREEN 

-/$ 

-\ cu 

FOLLOW-UP RESPONSES 

July 30, 2018 

Michael P. Wilson, Ph.D., MPH 

National Director for Occupational and Environmental Health 

BlueGreen Alliance 

Before the !15th United States Congress, House Committee on Energy and 

Commerce, Subcommittee on Environment 

The Chemical Facilities Anti-Terrorism Standards Program (CFATS): 

A Progress Report 

Rayburn House Office Building, Room 2123 

Thursday, June 14, 2018 

1) In your written testimony, you discussed your previous experience 

as Chief Scientist in California's Department of Industrial 

Relations, including the important lessons you learned about 

including workers in risk management and response. You wrote 

that industrial employees bring experience, expertise, 

accountability, and transparency, and added that "workers need 

strong regulatory language to gain a seat at the decision-making 

table." 

a) Do you believe that the CFATS program, in its current form, is wellsuited to give workers a seat at the table? 

~~Jiu111mary respoJ1"!' 

The requirements pertaining to employee input in CFATS represent an 

important step forward, but much more is needed. To be effective, CFATS needs 

to include the following additional requirements of employers, each of which is 

contained in California's 2017 process safety management (PSM) regulations for 

petroleum refineries: 

(1) the right of employees to participate throughout all phases of CFATS 

decision-making, from design to implementation, training, evaluation and 

maintenance; 
154 


34591.097

2) the right of employees to select their representatives who participate in 

management's CFATS decision-making processes; 

(3) access by employees to documents or information relevant to CFATS 

decision-making, including information that might be subject to protection as a 

trade secret; 

(4) the right of employees to anonymously report site security weaknesses; and, 

(5) the obligation of employers to maintain a record of all employee reports of 

site security weaknesses. 

CFATS section 2102(b)(2) on Employee Input requires that, "to the greatest 

extent practicable, a facility's security vulnerability assessment and site security 

plan shall include input from at least 1 facility employee and, where applicable, 

1 employee representative from the bargaining agent at that facility, each of 

whom possesses, in the determination of the facility's security officer, relevant 

knowledge, experience, training, or education as pertains to matters of site 

security." 

IndustryJCfQ!17li;;~s th~atf!TJ1!2lQY~~f:2irru!'iL l}cw~<L£ T'flf'<l!'ingfyl de<;:i§Jg'l:~rrt<lJ<:i'NIQlf! 

iTJ,_p_I_Qf(j!§§ -'icifeJYc 

In its Guidelines for Risk Based Process Safety, the chemical process industry's 

Center for Chemical Process Safety (CCPS) lists workforce involvement as one of 

20 management systems necessary to reduce process safety risks and prevent 

chemical accidents, pointing out that:l'l 

" ... workers are potentially the most knowledgeable people with 

respect to the day-to~day details of operating the process and 

maintaining the equipment and facilities, and 1nay be the sole 

source for some types of knowledge gained through their 

unique experiences. Workforce involvement provides 

management a formalized mechanism for tapping into this 

valuable expertise." 

The CCPS defines "workforce involvement" as a "system for enabling the active 

participation of company and contractor workers in the design, development, 

implementation, and continuous improvement of the Risk Based Process Safety 

1 Center for Chemical Process Safety (CCPS) American Institute of Chemical Engineers 

(2007). Guidelines for Risk Based Process Safety. Wiley and Sons. (p. 124). 

2 of26 
155 


34591.098

management system." 121 This same definition could be applied to the role of 

employees in facility security systems. 

The CCPS Guidelines were developed and reviewed by experts from many of the 

nation's leading chemical process companies, including Dow, DuPont, 

ExxonMobil, Chevron Energy Technology Company, 3M, Air Product and 

Chemicals Inc, Shell Chemical, BP, Olin Corporation, Bayer Material Science 

and others.l31 

'[he evidert~e_§I,<gg_~st_s_t}tp1Jfl.e_2012 EJchmond Chevron re[inei]J_.fir§__rn_ig/1.t have 

beenJ!C§JJ_f_nJ"SJ.if.rn_gr12fl"'§_i]g<i12§"-.n_u,Slliired t() iniJQ}yj?_"!']Ql"Jd.C£ 

r_C[2r_esentativefiir7JJLoces_s sa[ety_sis.cision-making, 

Evidence identified by the CSB points to a lack of employee participation in 

process safety decision-making as a key factor leading up to the 2102 

Richmond, Chevron refinery fire, which endangered the lives of 19 worker and 

caused some 15,000 are residents to seek medical attention for symptoms 

related to smoke and fire gas exposure. 

The CSB's interim report of that incident shows that it would have been 

prevented if Chevron's managers had followed the recommendations of their 

own engineers. The fact that they did not resulted in part because Chevron 

employee representatives were excluded from management's decision-making 

process. 

Over a period of several years leading up to the catastrophic pipe failure and 

fire, Chevron's engineers issued at least six reports calling attention to the 

problem of sulfidation corrosion in the crude unit and recommending a more 

aggressive pipe inspection and monitoring program. As the CSB's report pointed 

out, Chevron's engineers made these recommendations against a backdrop of 

serious sulfidation corrosion incidents in the U.S. refinery sector that occurred 

at Chevron's El Paso, Texas refinery (1988), Chevron's Pascagoula, Mississippi 

refinery (1988 and 1993), Chevron's Salt Lake City, Utah refinery (2002), the 

Richmond, California refinery itself (2007), the Silver Eagle refinery in Woods 

Cross, Utah (2009), the Regina Saskatchewan, Canada refinery (2011), and the 

BP Cherry Point, Washington refinery (2012).14 1 

'CCPS, op cit. (p. 124). 

3 CCPS, op cit. (Preface). 

4 U.S. Chemical Safety and Hazard Investigation Board (CSB) (April2013). Interim 

Investigation Report. Chevron Richmond Refinery Fire of August 6, 2012. (pp. 24-27) 

(Available: h!~www.csb.gov/chevron-refinery-fire/). Accessed June 27,2018. 

3 of26 
156 


34591.099

By 2009, Chevron's engineers warned of the potential for a catastrophic pipe 

failure, and still management chose not to act. The pipe finally failed in 2012 as 

the engineers predicted it would, and 19 workers nearly lost their lives. 

Had Chevron been required to involve employee representatives in 

management's pipe corrosion assessments, those representatives would likely 

have been aware of the engineers' reports, and they would almost certainly have 

requested that the engineers' recommendations be implemented. In taking those 

actions, the serious state of corrosion in the crude unit would have become 

apparent. This would likely have resulted in a shut-down of the unit to replace 

damaged sections of pipe, thereby preventing the catastrophic failure that 

ultimately occurred in August 2012. 

b) In your opinion, how could the employee input requirements of 

CFATS be strengthened to guarantee that employee voices are 

heard? 

Employees and their representatives will not normally be invited to participate 

with any real authority in management's decision-making committees, including 

those focused on plant safety and security. At a minimum--including with a 

unionized workforce-employees need regulatory authority to obtain a seat at 

the table. For employee participation to be meaningful, however, that authority 

must provide much more than the basic right to participate; it must provide for 

at least seven key elements described below. 

Thf!_pCJ[;pecli!J(!S_!Jl rpJ1_kca_nt:lfile_e_m_[Jl_OJJ~f3§Jlre _ir}y_aJll!ll2i&i11_§j1?_5_(3CL1rjiJ1 

de~i~JQf!:_Tf!(l_ki11JL./:JL<f_()n_ly__iftf;€Y gr,; g_i!J,;nth<I.riE!-rt__to _ _rnea_ni~llJ1_p_artic;ip_(l1?, 

The requirement for employee input is critical to the success of CFATS and 

should be expanded. Experienced employees often have a deep understanding of 

the practical workings of a plant, and they can apply this experience in helping 

to set priorities and determine if a proposed security measure will function as 

intended. Employees have a direct stake in protecting the safely of the facility. 

As the CSB identified in the Chevron, Richmond incident, effective employee 

participation can improve the transparency and accountability of management 

4of26 
157 


34591.100

decision-making, which can otherwise be skewed by production and financial 

pressures. 

To be effective, employee input into site security must be underpinned by clear 

regulatory requirements of owners or operators to: 

(1) allow employees to select their representatives, either through their 

collective bargaining agent, where present, or by a transparent process 

established by the employer; 

(2) ensure and document employee participation, to the greatest extent 

practicable, throughout all phases of site security decision-making, not 

simply as a final "rubber stamp" to management's proposals; 

(3) provide for ongoing participation in the implementation and 

maintenance of security measures, not simply during the final decisionmaking phase; 

(4) provide for participation in the training and evaluation of site security 

measures; 

(5) provide a means for anonymous reporting of site security problems, 

and an obligation of owners or operators to maintain a record of such 

reports; 

(6) provide a means for confidential input by employees to regulators 

during CFATS audits and inspections; and, 

(7) provide a means to certify that employee input has been received and 

integrated to the greatest extent practicable into plant security measures. 

Qglijomia's 2017 J'§ti!I!'IJL'i!lftt]LJ:equlations include 1]§1JLdg}1i§__Qf_fLmployee§ anq 

J!Jeir. r.~P!*.~~ent,gtjl!~s J9.12.9:rJf.-fipg~~?,._ i!L.P.t:C!<;;?§l? ~Q.ff!fY .. 4?..CA§.{QJ!:-.-:t!?.c;t.~f~g · 

Employees and their representatives will not normally be invited to participate 

with any real authority in management's decision-making committees, including 

committees that work on plant safety and security problems. At a minimumincluding with a unionized workforce-employees need regulatory authority to 

obtain a seat at the table. For employee participation to be meaningful, however, 

that authority must provide much more than the basic right to participate; it 

must provide for the seven elements listed above. 

ln recognition of this fact, the 2017 California Process Safety Management (PSM) 

and Accidental Release Program (Cal/ ARP) regulations include employee 

participation rights that require the first five of the elements noted above, while 

also providing for the right of employees to refuse unsafe work; request that a 

5 of26 
158 


34591.101

process be shut down; and-for operators-actually shut down a refinery 

process. 

Each of these elements could be included in CFATS to improve the effectiveness 

of its employee input provisions. 

2) It was mentioned during the hearing that the communication and 

emergency response requirements ofCFATS are adequate, and any 

deficiencies could be attributed to the Emergency Planning and 

Community Right to Know Act (EPCRA) 

a) Please describe the areas, if any, where the emergency planning 

and response elements of EPCRA overlap with CFATS. 

The statement noted in this question was made by the representative from the 

Society of Chemical Manufacturers and Affiliates (SOCMA) and is misleading. 

While it is true that the intended emergency response outcomes of EPCRA have 

not materialized, it is also true that the emergency response provisions of 

CFATS are even less robust than those of EPCRA; in fact, they are woefully 

inadequate. CFATS needs to do much more to enable effective emergency 

planning, preparedness and response.rs) 

Congress passed EPCRA in 1986 in response to the Bhopal disaster and other 

U.S. industrial chemical accidents. It consists of three major elements: the 

Taxies Release Inventory (TRI); an emergency planning provision; and a citizen 

suit provision. 

Under its emergency planning provisions, EPCRA requires industry to provide 

chemical information to responders through Local Emergency Planning 

s In addition to the references cited, the author's responses also take into account his 

experiences from 13 years in the emergency services as a firefighter, paramedic and 

EMT; seven years with the U.S. Coast Guard Reserve; five years as a hazardous 

materials specialist with FEMA USAR Task Force 4; and service as the representative of 

the California Department of Industrial Relations to the State Emergency Response 

Commission. 

6 of26 
159 


34591.102

Committees (LEPC) and State Emergency Response Commissions (SERC), and 

to local fire departments, either by submitting copies of Materia.! Safety Data 

Sheets (MSDS) or by providing a list of chemicals that are used and stored on 

site. EPCRA requires the LEPCs to update this information annually, and it 

requires them to develop annual emergency response plans to be used during a 

major chemical accident. It requires facilities (under section 311) to submit an 

annual Emergency and Hazardous Chemical Inventory Form with information 

on how and where chemicals are stored on site. 

EPCRA certainly improved industry transparency with regard to the production 

and release of hazardous chemicals, and it represents an important step 

forward for emergency planning and response. Its contributions to improving 

actual emergency operations, however, have been constrained by a lack of 

resources; limited capacity among fire departments to assimilate and act on 

industry information; an outdated informational architecture; and uneven 

enforcement. 

EPCRA's reliance on LEPCs is particularly problematic because the LEPCs are 

voluntary entities that do not possess the capacity to receive and organize 

complex industrial chemical information and update and distribute emergency 

planning documents. Chemical information from facilities must be curated and 

formatted to be useful to fire departments and other emergency responders. Fire 

departments are not well suited-due to insufficient training and capacity-to 

organize, assimilate and act on chemical hazard information provided by 

companies. There is limited evidence that U.S. EPA is enforcing violations of 

EPCRA's information and planning requirements.l61 

[~_a!§.e CEf\J§..§r>J§T9E!_I")I]Jj. r~spgi1_§§]JT()_~isiOI1..§ d_Q_ noffOr>Jpf!_nsqtefqr tf1e_ 

YJ.!'...a..k:rt."§§.E!§.f!i I<;P.(:li'Ji. 

CFATS sections 2103(b) and (c) pertain to the sharing of information by the 

secretary with first responders, in order to improve their "situational awareness" 

in responding to a chemical release.(?) While this requirement is useful, it is far 

6 Purifoy DM (Summer 2013), EPCRA: A Retrospective on the Environmental Right-toKnow Act. Yale J. Health Policy Law Ethics 2013 13(2):375-417 (Available: 

h.ttJJ.s.1L~'Y~!1fbL!11ITU'lil1_.gg_v)p_\.lbmed I 21::1_4082). Accessed June 27, 2018. 

' Public Law 113-254 (Dee 18, 2014). Protecting and Securing Chemical Facilities from 

Terrorist Attacks Act of2014. itle XXI-Chemical Facility Anti-Terrorism Standards. 6 

USC 621, Section 2103, Protection and Sharing of1nformation, at (b) Sharing of 

Information with States and Local Governments, and at (c) Sharing of Information with 

First Responders. 

7 of26 
160 


34591.103

from sufficient to meet the staled objective. It will almost certainly have the 

same limited outcome as similar requirements under EPCRA; that is, even when 

the information is provided by facilities to the secretary and transmitted to fire 

departments, it will be difficult for departments to apply the information in 

actual response planning. The information in and of itself will be of limited value 

without additional site-specific information, coordination and training. For fire 

departments, chemical information about a facility is essential, but it is not 

enough to execute an effective emergency response. 

Curated in[ormaJjgr},_ qgrrl}J_i!l~ci _t<Jith app_I]Jp.Jj(JJ& T§'§.O].'rg!.§..Sl.'lcl_Q!l9..oi71Jl 

coordination, planniTJB....!dnd Y:_qi_'li!lgL_gr"-__l<;E]JJQ_gn Hf?ccfivg_ .~ms_rg_e-'lf.Y_!§.§IJ.()!l'i"-'. 

To be useful to responders, information needs to be facility-specific and 

continuously updated, and it needs to be part of a broader coordination, 

planning and training effort between the facility and responders. All of this 

requires financial and human resources. 

In responding to a chemical release at an industrial facility, responders need to 

have trained sufficiently with the facility in order to quickly answer several 

questions, including the following: 

(1) the identity of the chemical substance(s) involved in the release; 

(2) the scale of the release; 

(3) physical-chemical properties of the substance(s); 

(4) the health hazards of exposure to the substance(s); 

(5) the anticipated plume size and direction; 

(6) safe operating and evacuation distances; 

(7) appropriate suppression, containment and extinguishing practices; 

(8) the potential for escalation to nearby vessels or piping; 

(9) appropriate personal protective equipment; and, 

(lO)on-scene conditions, including actions taken by the facility to contain 

and mitigate the release, numbers of persons injured or trapped, and any 

associated hazards. 

These types of questions can only be answered by knowledge and experience 

gained through: (1) curated, facility-specific chemical information, as well as site 

lay-out and structure; (2) planning and training with the facility; (3) appropriate 

technical skills, personnel and equipment; (4) effective mutual aid systems; and 

(5) technical training on plume modeling, evacuation perimeters, hazardous 

materials operations, and so forth. 

8 of26 
161 


34591.104

b) In your opinion, how could the emergency response requirements of 

CFATS be strengthened? 

CFATS could improve emergency planning and response by requiring facilities 

to: 

(1) generate and transmit useful, facility-specific chemical hazard 

information directly to fire departments and other public agencies; 

(2) coordinate, plan and train for a major incident with those agencies; and, 

(3) correct any weaknesses identified in an assessment of the capacity of 

those agencies to respond to a major chemical incident. 

t::h~l!lic_alJacjlitie,'iJlfJ(?cl_to_ C()IJl.l!lHJ1iqgtt?,J2lgrt__and trai11 1vit_h_ r§,;pcm_ci<?r§_tQ_il!l/2rove 

the_lik,elih()od ofg rrt()c~ e_ffeqtiv~ rf?SP()n':'~to. g_rngjQ!rt?l~q_sL 

The U.S. Chemical Safety and Hazard Investigation Board (CSB) has identified 

emergency response deficiencies as a contributor to at least 14 major industrial 

chemical incidents. Most of the deficiencies occurred in the following areas: 

(1) Training for emergency responders, including hazardous materials 

training; 

(2) Emergency planning and community response plans and teams; 

(3) Use of community notification systems; 

(4) Use of an incident command system and the National Incident 

Management System; 

(5) Conducting emergency response exercises; 

(6) Sharing of information among facilities, emergency responders and the 

community; and 

(7) Communicating during emergencies.ISJ 

,4. UC _B.§.[k,ele_y_[e_12Qrt identifi~. k.!?.Y._de.{jfi§n_cie_§_i!LC,()()rciiJ1gtiq_n_,_plgJ1ni119_(1J1.cl 

traJrtin.fJ._b_(Jttu_e.§_n ti}e. figy A(eg :s_industri_al facilities gncljirecieparlrn€J11I'L 

8 U.S. Chemical Safety and Hazard Investigation Board. Drivers of Critical Chemical 

Safety Change: Emergency Planning and Response {Preparedness). (Available: 

h~~w_~~~£omm~Qdatio!!§}_eiQ.~~!! ... C51::S~flonscl) Accessed June 27, 

2018. 

9 of26 
162 


34591.105

A June 2013 evaluation by UC Berkeley of some aspects of the emergency 

response to the 2012 vapor cloud explosion and fire at the Richmond, Chevron 

oil refinery found that fire departments responding to that incident were unable 

to communicate with the Chevron fire department because they operated on 

different radio frequencies. This communication failure affected the incident 

command system and endangered the safety of responders and the public.l91 

More generally, the UC Berkeley report found that: (!)fire department personnel 

were not always provided access to an industrial facility when they arrived at 

the plant gate to investigate an incident reported by the public; (2) some fire 

departments had difficulty gaining access to industrial facilities for planning 

and training; and (3) there was a pervasive lack of communication between 

industrial facilities and fire departments with regard to response planning and 

training. 

The UC Berkeley report also identified problems with the response capacity of 

other entities outside of fire departments. The Bay Air Quality Management 

District (BAAQMD), for example, did not have "sufficient capacity to monitor 

atmospheric conditions, plume travel, and real-time emissions" during the 

Chevron fire, nor was BAAQMD able to communicate air quality information to 

the public.ilOl As a result, community air quality concerns were addressed in the 

media not by a BAAQMD official but by a Chevron spokesperson. 

While the CSB later reported that some 15,000 people downwind of the fire had 

sought medical attention for symptoms related to smoke exposure, the UC 

Berkeley report found that there was no surveillance system in place to identify 

these individuals or track their health over time.lllJ Moreover, the report found 

that Richmond's emergency public warning system failed to function effectively 

during the Chevron fire, and that there was no public agency prepared to 

provide regular updates to the public. This left thousands of residents in the 

dark about steps they should take to protect themselves and their families 

during the fire. 

9 Wilson MP. Refinery Safety in California: Labor, Community and Fire Agency Views. 

Summary Report (June 4, 2013). Prepared for the Office of Governor Jerry Brown, 

Interagency Task Force on Refinery Safety. University of California, Berkeley (p. 9) 

(Available: httl2J_Ll()hp.orgL!<;>!:!R::L~f!!l"'J':cs~'!fek~22TJ:ll Accessed June 27, 2018. 

IO Wilson MP. Op cit. (pp. 11~12). 

ll U.S. Chemical Safety and Hazard Investigation Board (CSB) (April 2013). Interim 

Investigation Report. Chevron Richmond Refinery Fire of August 6, 2012. (p. 6) 

(Available: h..tJ~Q~J-~~~~§...Q.gQ.Y./£h.~Y.f.9_12:-X~firl.~-IT:1Jt.:e)J. Accessed June 27, 2018. 

10 of 26 
163 


34591.106

The Chevron pipe failure occurred not as an intentional act but as a result of 

inattention by managers to the effects of sulfidation corrosion; the outcome, 

however, would likely have been the same. A refinery pipe failure that creates a 

large flammable vapor explosion and smoke plume will take its course 

regardless of its cause. 

Problems with the emergency response to the Chevron fire would likely have 

been avoided if Chevron had been required to: (1) generate and transmit useful, 

facility-specific chemical information to fire departments and other public 

agencies; (2) plan and train for a major incident with those agencies; and (3) 

correct any weaknesses identified in an assessment of the Bay Area's regional 

response capacity. 

Several mf!asures could be inc{udefi_fu_QE_ATS to s~!§!19tlJ:!i1J_j:J_§__emfl!11§JlCJY 

If!_§J2_QJ]_se el§!!!.ent~_: 

The emergency response elements of CFATS could be improved by requiring 

facilities to: 

( 1) transmit specific types of chemical and facility information to fire 

departments and other public response agencies; 

(2) conduct regular planning meetings and training exercises with fire 

departments and other agencies; 

(3) conduct an assessment to understand the capacity of fire departments 

and other agencies to respond effectively to a major chemical incident; 

and, 

(4) implement corrective actions to address gaps identified in the 

assessment. 

·These requirements would provide a foundation for improving the capacity of 

local fire departments and other agencies to respond effectively to a major 

chemical incident, whether it occurs as the result of an intentional act, an 

extreme weather event, a mechanical or structural failure, or a power outage. 

Alongside these improvements in CFATS, there is a need for a comprehensive, 

national emergency planning assessment to identify at-risk communities and 

develop realistic response plans. Many communities-particularly those served 

by volunteer fire departments-have very limited capacity to respond to a major 

industrial chemical release. 

11 of 26 
164 


34591.107

3) While I certainly support chemical facilities developing plans to increase 

security, I believe we should also be prioritizing ways to lessen the need 

for these security measures by minimizing the risk at chemical facilities. 

This can be accomplished by eliminating targets and reducing the amount 

of chemicals stored on site, or using "inherently safer technologies," such 

as shifting to a safer chemical or process. 

a) Do you believe the CFATS program currently incentivizes facilities 

to reduce their risk instead of simply securing the facility to protect 

an existing risk? 

CFATS is a risk management-rather than risk prevention-framework; that is, 

it assumes that industrial chemical hazards cannot be reduced or eliminated, 

and that those hazards therefore need to be "surrounded" by layers of security. 

CFATS could do more to motivate and require facilities to reduce chemical 

hazards by requiring that they investigate-and implement to the greatest 

extent feasible-safer chemicals and processes. The industry's Center for 

Chemical Process Safety (CCPS) recognizes that inherently safer systems are the 

most effective and enduring means of improving facility safety. 

California's 2017 Process Safety Management (PSM) regulations for petroleum 

refineries can serve as a model for such an approach in CFATS.Il21 

Millions of Americans live in the vulnerability zone of an industrial chemical 

release, and one in three school children attend school in such an area.(13l 

J:?. California Occupational Safety and Health Standards Board, Department of 

Industrial Relations (May 2017). General Industry Safety Order §5189.1. Process Safety 

Management for Petroleum Refineries. (pp. 18-20) (Available: 

https: //www .dir.Cfh&OV I OSH§!U_g_Q.~:!:ll:!l~t§JJ?lJ?_f~§§ .. ~§.Jetv-Mg!lf!gtm}~_t.-for:: . 

. e_~!!:_Q.l~J1m-Refineries-txtbrdconsider.pd!) Accessed June 27, 2018. 

13 Center for Effective Government, "Kids in Danger Zones: One in Three U.S. 

Schoolchildren at Risk From Chemical Exposures," September 2014. Available: 

https:j/v..'WW.foreffectivegov.orgjkids-in-danger-zones. 

12 of 26 
165 


34591.108

African Americans, Latinos, and lower-income communities continue to be at 

greatest risk.(l4J 

The CSB, EPA and OSHA have all pointed out that these risks are preventable 

through modern engineering and management practices that the industry itself 

has developed and recommended. 

There is some evidence that the risk management measures required under 

CFATS are causing some companies to implement risk reduction strategies. 

DHS reports that thousands of high-risk facilities have chosen to meet their 

chemical security obligations not only through traditional security measures, 

but also by (1) consolidating chemicals from multiple sites into one or two sites; 

(2) replacing a hazardous chemical with a less hazardous one; (3) reducing the 

total quantity of a chemical held onsite; or (4) switching to a less concentrated 

form of the chemical.{lSJ 

Each of these actions does more than manage risk-it reduces risk not only 

from an intentional attack, but also of an extreme weather event or earthquake, 

a power outage, or mechanical failure. 

Assuming DHS is confident in the veracity of these claims (and is taking steps 

to validate them) these approaches represent progress toward reducing 

industrial chemical risks at existing facilities. 

On the other hand, there are about 3,500 other facilities that have remained in 

the CFATS high-risk tier and that pose a substantive risk to the safety of 

workers and nearby communities.fl6J These facilities are presumably continuing 

to rely on active and procedural safeguards. Changes to the CFATS program are 

needed to drive down risks at these facilities. 

CFATS could do this with new risk prevention-or risk reductionrequirements. The Center for Chemical Process Safety (CCPS) describes risk 

14 Earthjustice, Another Year Of Preventable Chemical Disasters, April 2018. Available: 

~earthjusti~~~Q!"&r:!~~§IPLe:g~L~i)_lS L?or!.9!_h_~:I:.Y~?:X:.QJ:P!:~Y~P_t§.J~~~:-~h~!!l:i£g.!::_ 

disast~_§.. 

15 Suzanne E. Spaulding, DHS Under Secretary (January 11, 2017). Correspondence to 

the Honorable Bennie G. Thompson, ranking member, Committee on Homeland 

Security. See Addendum at page 6, item 12. 

16 Coalition to Prevent Chemical Disasters, "Testimony of Paul Orum, Chemical Safety 

Advocate," February 2018. Available: ht!P"-'LlJ:wmelat;!i,hQ];)§e.gov/wp: 

content/uploads /20 18/02/Testimogy-Orumc£<if. 

13 of 26 
166 


34591.109

reduction strategies as those that minimize the use of hazardous chemicals, or 

substitute them with safer chemicals, or that simplify or modify chemical 

processes to make them less vulnerable to failure. 

{.:glj{Qrnia ~s :{Q lZJ2rQCf?~'i 'iaJetgTI}(ll]aJlf!rn!''ll (f'§MLrsgulcit~ol]~l]ifl_pi.DC:!'S.'i 

SJ1Jet!Lfr_orrt_g_l(lc9_e]!LI§Sl_ci:{v_e_,_/jfik ma7]age1Jle]lt fta!flf!W()rk t()_a_ rnDC£? [Jroqctipf?, 

risk __12I~J.!_entiq_n (rameL!:!_QL_"i5._:_ 

California's 2017 PSM regulations include a suite of new risk prevention 

elements, including a mandatory decision-making process based on the 

"hierarchy of controls." This approach integrates the concept of inherent safety 

into regulatory language in manner that is enforceable, practical and 

meaningful. 

Following the August 2012 Richmond, Chevron fire, a February 2014 report of 

the Governor's Interagency Working Group on Refinery Safety, Improving Public 

and Worker Safety at Oil Refineries, found that "regulatory changes were needed 

to: (171 

(1) implement inherently safer systems to the greatest extent feasible; 

(2) perform periodic safety culture assessments; 

(3) adequately incorporate damage mechanism hazard reviews into process 

hazard analyses; 

(4) complete root cause analyses after significant accidents or releases; 

(5) explicitly account for human factors and organizational changes; and 

(6) use structured methods such as layer of protection analysis to ensure 

adequate safeguards in process hazard analysis." 

In response to the report's finding regarding the need for "inherently safer 

systems," the Department of Industrial Relations (DIR) and California EPA 

included a provision in the Process Safety Management (PSM) and California 

Accidental Release Program 4 (Cal/ ARP) regulations, respectively, that requires 

refiners to conduct a "hierarchy of hazard controls analysis" for serious process 

safety hazards.P8l 

17 Governor's Interagency Working Group on Refinery Safety (February 2014). Improving 

Public and Worker Safety at Oil Refineries. (Available: 

h!tp~ww.c§.loes.~ggv/FireRescueSite/Documents/Refinery%20Rpt%20Feb%20201 

±Jo_Qf). Accessed June 27, 2018. 

18 California Occupational Safety and Health Standards Board, Department of 

Industrial Relations (May 20 17). General Industry Safety Order §5189.!. Process Safety 

Management for Petroleum Refineries. (pp. 18-20) (Available: 

14 of 26 
167 


34591.110

(;St]iJQDBQ~§_Lti.,r:<]T_CfJJL()fC9Y!trols. OpJ2roac_h iY!CO!I2Qrg:t~s,int!?Ie n_t_sg[eJJL rn~Cl,§_UJfi:S, 

f!.!iJ2ct_rLQ{i;!_lQgicg/§equ.er!(:e_of safetydeqi§_iQY!-rnCJ.king, 

This mandatory sequence consists of the following five elements, which are 

described in more detail below (Figure 1): 

(1) First-order inherent safety measures; 

(2) Second-order inherent safety measures; 

(3) Passive safeguards; 

(4) Active safeguards; and, 

(5) Procedural safeguards. 

Figure 1. Framework of the California PSM and Cal/ ARP Hierarchy of Hazard 

Controls Analysis {HCA). 

Effective October 1, 2017, California refiners are required to ensure the safety of 

refinery processes by applying corrective actions that follow this sequence and 

priority order.(19) 

h ttps: I I www .dir. ca.goyfOSHS]:llQ&c.}l_rne.llt§i.Proc.e""-o::@fety-Management-forPetrole}dm-Rt~H_ll.~t~-~-=!~JJxL4£Q!!§.!4~_r:.ps;tf) Accessed June 27, 2018. 

19 California Occupational Safety and Health Standards Board, op cit. (pp. 18-20). 

(Available: h!\Rs~lL!'-."'Cwc<:iiLc§kgqyJ.Q_i'l!i'i~L<lgcurnci1tsJJ'J:Q<Ol3s.§:§.''Ictr-Malli'll".!I!entfur-Pe_tL_9leum~~-fiD_erj_~~-g: _ _tP_rc!~Qit~iQ._~r,_p_Q_f) Accessed June 27, 2018. 

15 of26 
168 


34591.111

eliminates a hazard. Changes in the chemistry of a process that 

eliminate the hazards of a chemical are usually considered 

first-order inherent safety measures-for example~ by 

substituting a toxic chemical with an alternative chemical that 

can serve the same function but is nontoxic, or less toxic. 

Second-Order Inherent Safety Measure. This is a measure that 

effectively reduces a risk by reducing the severity of a hazard or 

the likelihood of a release, without the use of add-on safety 

devices. Changes in process variables to minimize, moderate, or 

simplify a process are usually considered second-order inherent 

safety measures-for example, by redesigning a high-pressure, 

high-temperature system to operate at ambient temperatures 

and pressures. 

Passive Safeguard. This is a process or equipment design 

feature that minimizes a hazard by reducing either its 

frequency or its consequence, without the active functioning of 

any device-for example, by constructing a diked wall around a 

storage tank of flammable liquids that is intended to contain a 

release of the liquid, rather than allowing the spill to extend 

into other areas of the plant or surrounding areas. 

Safeguard. This is a control, alarm, instrument, or other 

mitigation system that is used to detect and respond to 

from normal process operations-such as a pump 

is shut-off by a high-level switch. 

Pn1rP·ri1Jrnl Safeguard. This is a policy, operating procedure, 

program, administrative check, employee response} or 

management approach that is used to prevent incidents 

Examples include hot 

These requirements appear in subsection (1) of the PSM regulation, known as 

the Hierarchy of Hazard Controls Analysis, or HCA.I20i The HCA requires refiners 

to prioritize first- and second-order inherent safety measures over passive or 

active safeguards, which must be prioritized over procedural safeguards. This 

2o California Occupational Safety and Health Standards Board, op cit, (pp, 18-20), 

(Available: 1:>1\Pl':J.Ly.>y~w .(jir. ca.g(J'!) OSHSB I documents I Proce_~-~1lf!'JY:M.aJ!,.KC!!l!'!lt: 

for-Petroleum-Refineries-txtbrdconside_r_:JL<i-0 Accessed June 27, 2018 

16 of26 
169 


34591.112

ensures that refiners evaluate and implement the rnost effective approaches to 

protecting against a major process accident. 

For example, to address pipe corrosion and thinning caused by high 

temperatures and sulfidation, a refiner would be required to assess a range of 

solutions in priority order, such as in the following example: 

(1) reduce the sulfur content of the chemical feedstock materials to reduce 

their corrosiveness-a first-order inherent safety measure; 

(2) change the process conditions, such as temperature and pressure, to 

reduce corrosiveness, or replace the pipe with more corrosive-resistant 

piping-a second-order inherent safety measure; 

(3) apply welded patches over thinning sections of pipe to prevent a leak 

from occurring-a passive safeguard; 

(4) install automated corrosion probes that continuously monitor thinning 

in vulnerable areas-an active safeguard; or, 

(5) conduct routine inspections of the thickness of the pipe-a procedural 

action. 

California's approach favors inherent safety measures by requiring that HCA 

teams recommend inherent safety approaches "to the greatest extent feasible;" it 

does not, however, attempt to "mandate" inherent safety measures. 

b) Based on your previous experience in California, how could the 

CFATS program be strengthened to include both risk management 

and risk prevention, and encourage continuous improvement at 

covered facilities? 

The 2017 California PSM regulation offers a possible model for CFATS, in that it 

contains both risk management and risk prevention requirements in regulatory 

language that is practical, meaningful and legally enforceable. 

Q!Ji[§s:..ould_clrClll.J..fr.Qill.lc_ey_flf!rrle!>J;;_oJ..tb§.SSJ.Jifgrnia Process ScifBJJ. 

MSJ._n.r:l!l§'!lentjPSM) regulation. 

17 of 26 
170 


34591.113

Drafting the California PSM regulation required nearly five years of effort and 

hundreds of hours of meetings with refinery managers, process safety experts, 

and leaders of the union representing refinery workers. The resulting regulation 

reflects the industry's own best engineering and management practices, 

developed over the last 20 years. 

The regulation expands the focus of refinery safety from a largely reactive, risk 

management framework to a more proactive, risk prevention framework. The 

risk management elements have been modernized and clarified. The California 

PSM offers a possible model for CFATS, in that it contains both risk 

management and risk prevention requirements in regulatory language that is 

practical, meaningful and legally enforceable. 

Many of the PSM requirements could be applied to CFATS, including the 

following: 

J?islc .. Mangge171e_nt _E)(aiJ1pLe,c; 

§>lfefeuard __ ~[{)t<O,cli<mAn_a,ly,s.i§.l~J\1 

Under the Process Hazard Analysis (PHA) requirements, refiners are required to 

conduct an SPA to ensure redundancy and independence of safeguards. This is 

intended to protect against a cascade of failures in a plant's safeguards after an 

initiating event, such as a power outage or small fire. 

M_al}flg<eltlertLof Cha,~OC) 

The MOC procedures are intended to prevent refiners from introducing new 

process hazards when they make a change to a process or replace a piece of 

equipment. 

lVIa.f1Elgem_ent_ Q[ Qrg,ni;,:"'tionaL Cha_llg<e_l.tv! OOC) 

The MOOC procedures require refiners to assess the effects on safety of staffing 

changes and other personnel stressors, such as fatigue and shift rotations. 

Human Factors 

Human factors analyses are required throughout the PSM regulation and are 

intended to integrate the limitations of human performance into safety 

engineering systems. 

18 of26 
171 


34591.114

In consultation with employee representatives, refiners are required to develop 

worst-case scenarios associated with chemicals and processes, and then 

implement corrective actions to prevent those scenarios from occurring. 

Mes:l1.a11i~aJ lJ1!~grity 

All processes and equipment must be Refiners are required to continually 

inspect and certify that processes and equipment meet or exceed Recognized 

and Generally Accepted Good Engineering Practices (RAGAGEP) and are fit for 

service. 

f(is/<:.Pre.v.ention F;x;gmples 

f{i".r:grchy: ()LI:fgzgrd C<JD!rol~Anglysjs_ {ff(_:A) 

As described above, this element requires the implementation of a hierarchical 

decision-making framework in selecting corrective actions to address process 

hazards identified in the PHA. 

In.ficJ".nL!!1V!'8_ti!@J:i()I1-~Q! Cause Analysis 

Following a major incident or ncar miss, refiners are required to conduct a root 

cause analysis and implement corrective actions. 

Damag!'_Me<jlanism Jkviews lQMRl 

This is similar to a security vulnerability assessment but focused on physical 

damage mechanisms (such as corrosion, high temperature hydrogen attack, 

embrittlement etc) and on the corrective actions neccssa1y to mitigate those 

mechanisms. 

Pr:Qr:es_s_.S~afe.ty~C:ulture.Ass!'s_.,;rn.enJ.s ... fP"C:Al Refiners arc required to conduct a PSCA every five years, with interim 

corrections at the three-year mark. This could be used to assess the security 

culture at a facility. 

ErnJ?loy<"!' Pgr.ti~ipjotti()g 

Collective bargaining agents have the authority to select their representatives 

who participate "throughout all phases" of PSM decision·making. Operators 

have the authority to shut·down a process in response to a process safety 

hazard. All employees have the right to recommend that a process be shut 

down; to refuse unsafe work; and to anonymously report process safety 

hazards. Refiners are required to promptly correct hazards that could cause 

death or serious physical harm to an employee, or that could lead to a major 

incident. 

19 of26 
172 


34591.115

~!PJ?~.~}-g~pt~~iq~ 

With certain exception, refiners are required to implement the process safety 

recommendations of labor-management process safety teams. 

~onJ@gQ!'§ 

All contractors and their employees are required to be trained in, and to 

understand, the hazards of the facility and the ways in which their work could 

jeopardize plant safety. 

These and other elements of California's new PSM regulation could be reshaped 

for a security context and adopted by CFATS. 

92'li(11_L!~'!&irrJP!.()!J§.rrt§Jlt_i§g_fltY!!ckitio n_oifl!!.'iff<icJiV.e.S<liety .C1T1.ci...§e_culjJ:Jd 

JE()JJ!.CLrrt t:_h[llt1J1Qlie!3_!o. nf!_oJJ!L€1J£!rY. ()"f2f!..C/.()[I'lo'l().JJf!.rrt§lll..fl11.fL€Tl9ineeri~ 

Continuous improvement is essential in the security setting to ensure that a 

plant's security protections remain current and able to effectively thwart the 

evolving threats of motivated actors. Under the HCA element of the California 

PSM regulation, refiners are required to continually improve their process safety 

systems by analyzing and documenting "publicly available information" on 

inherent safety measures and safeguards that have been "achieved in practice" 

by the petroleum refining industry and related industrial sectors, and that have 

been "required or recommended for the petroleum refining industry and related 

industrial sectors by a federal or state agency, or a local California agency, in a 

regulation or report." The PSM regulation requires refiners to report the results 

of this investigation as part of the rationale for their selection of corrective 

actions. 

This requirement helps ensure that-as refiners contemplate corrective actions 

to prevent or mitigate process hazards-they learn from the experience of other 

refiners and industry sectors. This learning includes both engineering 

advancements and ''lessons learned~' from major incidents or near misses across 

industry. Documentation requirements improve the body of evidence in the 

event of a major incident. 

California's requirement that refiners investigate and document industry best 

practices provides an impetus for refiners to continuously assess and improve 

the safety of their operations. 

E'flc:iliti<;'S_c(lll. ~()lltinL!QU§]Y. ir7]p_rque_thefr.safetyprg~tice§ Qy. "lg()ki1]ILOlltl!'C1rsJ':JQ 

20 of 26 
173 


34591.116

The California PSM regulation requires refiners to apply Recognized and 

Generally Accepted Good Engineering Practices (RAGAGEP) in maintaining the 

mechanical integrity of refinery processes and equipment. The Statement of 

Reasons for the PSM regulation describes RAGAGEP as an "engineering, 

operation, or maintenance activity that has been accepted and established in a 

code, standard, technical report, or recommended practice and is published by 

a recognized and generally accepted organization. RAGAGEP is recognized by 

subject matter experts as the best way to perform certain engineering, 

inspection, or mechanical integrity activities, such as fabricating, inspecting, or 

maintaining a vesse1."(2lJ 

Compliance with RAGAGEP ensures that processes and process equipment are 

designed, constructed, installed, maintained, inspected, tested, and operated in 

a safe manner. 

The California PSM regulation requires refiners to "document that process 

equipment complies with RAGAGEP, where RAGAGEP has been established for 

that process equipment, or with more protective internal practices that ensure 

safe operation," and it requires the refiner's mechanical integrity program (for all 

processes and equipment) to be consistent with, or to exceed, standards set 

forth by RAGAGEP. 1221 

In an approach that differs from the interpretation of RAGAGEP by federal 

OSHA, the California PSM regulation does not allow a refiner to develop its own 

internal process safety practices and then claim that those practices constitute 

RAGAGEP. That is, while each refiner is required to demonstrate that their 

inspection and testing program for process equipment meets or exceeds the 

standards set forth by the industry through RAGAGEPs, they are not allowed 

under the regulation to claim that their internal inspection and testing program 

itself is a RAGAGEP. 

21 California Occupational Safety and Health Standards Board, Department of 

Industrial Relations. Process Safety Management for Petroleum Refineries. Initial 

Statement of Reasons. p. 8). Available: 

https: I lwww .dir.ca.gov I oshsb I documents I Process-Safety-Management-for-PetroleumRefineriess-lSOR.pdD Accessed June 27, 2018. 

22 California Occupational Safety and Health Standards Board, op cit. (p. 7 and pp. 15-

1 7). (Available: h,t!P§:lf_\_VWW .<Jir.ca.@\'{_OSHSB I documents I Process-Safety-

~anag~!P~.!:!.t:-fQ!:E~!r21~"~ITI.:R~fj_!}_~J:i.t?§:J:~t.h@s~"Q.Q_~jQ_eJ:.:.I?.9.0 Accessed June 2 7, 20 18 

21of26 
174 


34591.117

The PSM Statement of Reasons explains that this requirement is "necessary to 

ensure that employers meet or exceed recognized standards and implement 

changes in response to new or updated codes and standards that may be 

amended in response to process incidents in the industry. This is necessary to 

promote safe operation and ensure that process equipment complies with 

current standards."{23) 

By requiring refiners to apply RAGAGEP in these ways, the California PSM 

regulation is intended to set a high performance standard for process safety that 

is continuously informed by the industry's evolving best engineering practices. 

California's hierarchy of controls (HCA) requirements and its application of 

RAGAGEP could be applied to security measures under CFATS. 

Please provide any additional information on the ways in which CFATS 

could adopt the risk management and risk prevention strategies of the 

California PSM regulation. 

California's PSM regulation requires oil refiners to apply a sequential, 

hierarchical decision-making process to eliminate, reduce, or control process 

hazards, based on the recommendations of labor-management PSM teams. The 

regulation requires refiners to implement the most effective approaches (rather 

than to defaulting to the most expedient, least expensive, or most familiar 

approaches) but it does not mandate any particular approach. 

One year after the October 1, 2017 implementation date, it appears that this 

approach is working reasonably well among the state's 14 refiners. A similar 

approach could be considered under CFATS to drive down chemical security 

risks. 

23 California Occupational Safety and Health Standards Board, Department of 

Industrial Relations. Process Safety Management for Petroleum Refineries. Initial 

Statement of Reasons. Mechanical Integrity, J(4} (p. 24). Available: 

b!JP-"'.li=sJl!:£'!,@\'LQ_sh'llJLdp_<::l,l]!l"-DJ&Ll'!:'2£~S-Safety-Management-for-PetroleumRefineriess-l80~,pQ!) Accessed June 27, 2018. 

22 of 26 
175 


34591.118

!!,Detailed response 

_9alif.9Irda 's hierarchy_Qf_9Q_!L_~r_g.!§_fqy.o~. jn!J.§[~tlt§_af§J]j__meaS!_YJ~S DJl~!. QCl:§_sLr.:?, 

_fH~Jil!!L qr.-f!.J2!0.f!l.c!:U.ti!1.J:?.gf~Jll!::f3Ids b_tf!.=!:!!.i!hLl}_ C:.?rt:«fYJ-_ ~q!1_~!;_~g_ints:::--it leg_l,!_f!~_ the 

!.cifi/lf!_ry __ ti}it/]Ji/l<Il. gf!t::_if;i()Yl;J!J(lkinQ(l_Utho~ritY.c_ 

Inherent safety measures provide protection in the face of multiple threats. An 

inherently safer industrial system-one that is operated with safer chemicals, or 

under lower temperatures, pressures and volumes-is generally less vulnerable 

to an intentional attack, but it is also less vulnerable to an extreme weather 

event, a mechanical failure or a power outage. 

Inherent safety is integrated into the California PSM regulation through the 

following provisions of subsection (1), the Hierarchy of Hazard Control (HCA) 

element: i24J 

HCA subsection {l)(l) 

Within five years of October 1, 2017 the employer must conduct an initial HCA 

as a standalone analysis for all existing processes; 50% of these HCAs must be 

conducted within three years. All HCAs must be revalidated every five years. The 

regulation integrates the HCA schedule with the process hazard analysis (PHA) 

schedule. 

HCA subsection (1}(2) 

Refiners must conduct an HCA in the following cases: (1) for all 

recommendations made by a PHA team for each scenario that identifies the 

potential for a major incident; (2) for all recommendations that result from the 

investigation of a major incident; (3) as part of a "management of change" (MOC) 

review, whenever a major change is proposed; and {4) during the design and 

review of new processes, process units, and facilities, and their related process 

equipment. Each of these analyses represents an opportunity to reevaluate 

process safety problems and consider new approaches to solving them. 

HCA subsection (1)(3) 

The regulation requires that HCAs be documented, performed, updated, and 

24 California Occupational Safety and Health Standards Board, op cit. (pp. 18-20). 

(Available: hnPtilY(..F_~·sl_tr..:~~~yLQ_$J!QJ?LQQ~]:lg_l_~~t.§l.frocess-~afety-Management-. 

[9.r::P.~!!"Qk_\d.!l}:E.~n~-!i~.§~_9i!!>Lf!<:;9nsider.pdf) Accessed June 27, 2018 

23 of26 
176 


34591.119

revalidated by a labor-management team with specific types of expertise. The 

team must include one member with expertise in the HCA method being used 

and one operating employee who currently works on the process and has 

experience and knowledge specific to the process being evaluated. The 

regulation requires the employer to provide for employee participation on all 

HCA teams and for employees to select their team representatives. 

HCA subsection (l)(4) 

The labor-management HCA team is required to: (1) compile or develop all riskrelevant data for each process or recommendation; (2) identify, characterize, and 

prioritize risks posed by each process safety hazard; and (3) identify, analyze, 

and document all inherent safety measures and safeguards for each process 

safety hazard in the proper sequence and priority order. 

For each process safety hazard that the HCA team has identified, the team is 

required to develop written recommendations for the refinery management in a 

manner consistent with the hierarchy of controls noted above. 

The HCA team is then required to develop recommendations to "eliminate 

hazards to the greatest extent feasible" using first-order and second-order 

inherent safety measures, followed by recommendations to mitigate any residual 

risks by applying passive, active and procedural safeguards. This approach 

ensures that inherent safety measures are prioritized over other approaches 

that rely on safeguards. 

HCA subsection (1)(5) 

The HCA team is required to prepare a report within 90 days of developing the 

recomtnendations that describes the inherent safety measures and safeguards 

recommended by the team for each hazard. This document helps ensure 

accountability in the HCA decision-making process and, in the event of a major 

incident, could be used by regulators to determine the extent to which refinery 

employers accepted, altered or rejected safety recommendations made by an 

HCA team. 

HCA subsection (l)(6) 

The employer is required to implement all HCA team recommendations in 

accordance with requirements stipulated in subsection (x) of the regulation. 

24 of26 
177 


34591.120

HCA subsection {1}(7) 

The employer is required to retain HCA reports for the life of each process. This 

enables regulators to investigate the refiner's decision-making process over time 

in the event of a major release. 

The hierarchy of hazard controls approach used in California could be applied 

to security measures under CFATS. 

Final considerations for the Committee. 

Railroad tank cars are not designed for storage of hazardous chemicals and are 

uniquely vulnerable to a terrorist attack. CFATS should include provisions to 

ensure the safety of rail cars and their appropriate use by facilities. 

A 2007 report by the Center for American Progress points out that railroad tank 

cars containing chlorine gas could be potential targets of opportunity for a 

terrorist attack.1251There is anecdotal evidence that some facilities may be 

relying on tank cars for temporary storage of hazardous chemicals. 

When companies use safer chemicals or less hazardous chemical formulations, 

they are less likely to require transportation of large volumes of hazardous 

chemicals. Wherever appropriate, DHS should consider transportation risks 

under CFATS by encouraging and requiring facilities to adopt inherent safety 

measures, as noted above. In addition, DHS should take steps to ensure: (1) 

that railroad companies have equipped their tank cars with safeguards to 

prevent a catastrophic release in the event of a roll-over, collision, or equipment 

failure, such as valve or line failure; and (2) that facilities are not relying on rail 

cars for storage of hazardous chemicals, on or off-site. 

Orum P. Toxic trains and the terrorist threat: how water utilities can get chlorine gas 

off the rails and out of American communities. (April 2, 2007). Center for American 

Progress. (Available; 

https: I /www.americanprogress.org/issue~curil:y.LJ:<~pjirJ§j2007 /04/02/2901 /toxic-. 

gains-and-tJ.!~.::!ITrori~:tb.~~tL). Accessed July 25, 2018 

25 of 26 
178 


34591.121

()REG WALDEN, CJFIEGON 

CHAIRMAN 

Mr. Steve Roberts 

Principal 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR., NEW JERSEY 

RANKING MEMBER 

<!Congres-S' of tbe Wniteb ~tateS' 

jl)ounc of ~cpnnrntatibes 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFicE BuiLDING 

WASHINGTON, DC 20515-6115 M,lfWHy !207\?2'5 29?7 

MmOr•l\' l?.02!22b 36<11 

July 16,2018 

Chemical Security Group, LLC 

2234 Richmond Avenue 

Houston, TX 77098 

Dear Mr. Roberts: 

Thank you for appearing before the Subcommittee on Environment on June 14, 2018, to 

testify at the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

- A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. To facilitate the printing of the hearing record, please respond to these 

questions with a transmittal letter by the close of business on Monday, July 30,2018. Your 

responses should be mailed to Kelly Collins, Legislative Clerk, Committee on Energy and 

Commerce, 2125 Rayburn House Office Building, Washington, DC 20515 and e-mailed in Word 

format to h.t?JJY-.f.r:.1!.!~!1L!L!IlillLlli.UJ~~Jilll. 

Thank you again for your time and eftort preparing and delivering testimony before the 

Subcommittee. 

~ John Shimkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonko, Ranking Member, Subcommittee on Environment 

Attachment 
179 


34591.122

ADDITIONAL QUESTIONS FOR THE RECORD 

STEVE ROBERTS 

CHEMICAL SECURITY GROUP, LLC 

BEFORE THE 

UNITED STATES HOUSE OF REPRESENTATIVES 

COMMITTEE ON ENERGY AND COMMERCE 

SUBCOMMITTEE ON ENVIRONMENT 

*** 

THE CHEMICAL FACILITY ANTI-TERRORISM STANDARDS 

(CFATS) PROGRAM- A PROGRESS REPORT 

STEVE ROBERTS 

CHEMICAL SECURITY GROt:P, LLC 

2234 RICIIMO~D AVE~UE 

HOUSTON, TEXAS 77098 

WWW.CfiEMICALSECl!RlTY.COM 

JULY 30,2018 
180 


34591.123

CF A TS- A Progress Report: Additional Questions for the Rcwrd Page 2 of8 

Following the hearing entitled "The Chemical Facilities Anti-Terrorism Standards Program (CFATS) - A 

Progress Report," which was held on June 14, 2018, the Subcommittee asked additional questions, and I am pleased 

to provide the following responses for the record: 

1. Mr. Roberts, your written testimony notes that since DHS initiated the Chemical Security Assessment 

Tool (CSAT) 2.0 process in September 2016, the number ofCFATS-affected facilities has increased from 

approximately 2,962 as of September 2016 to approximately 3,389 as of May 2018. Can you walk us 

through why that is? 

The general growth trend in the number ofCFATS-regulated facilities from the inception ofCSAT 2.0 in 

September 2016 to present is attributable, at least in part, to the Department of Homeland Security's (DHS's) 

improved tiering methodology and modeling. This has led to increases for facilities regulated for Release and 

Theft/Diversion Chemicals of Interest (COis). I (as well as others) have observed that, as a result of their CSAT 

2.0 Top-Screen submissions, some facilities with Release-Toxic COis (i.e., Chlorine, Sulfur Trioxide, Bromine, 

Oleum, and Hydrogen Chloride, among others) that DHS did not previously consider high-risk have now been 

deemed high-risk (i.e., have been assigned a risk tier). The same can be said for some Theft/Diversion COls as 

a result of improved tiering. 

2. Mr. Roberts, your written testimony states that the Chemical Security Assessment Tool 2.0 risk-tiering 

process has resulted in an increase in the number of facilities regulated for a release of a chemical of 

interest and that the nature of the security enhancements necessary to meet the applicable Risk-Based 

Performance Standards (RBI'Ss) may be larger or more complex, Would you help us understand why 

that is? 

a. Your testimony specifically points out that under the new process security projects are more 

complex, costly, and often can take one year or more to complete. Why is that? 

b. Is this a good thing for security at these facilities? 

Where possible, many CFATS-regulated facilities attempt to designate the location(s) where their CO Is are 

stored or used as discrete "Restricted Areas." By shrinking their "Restricted Area" footprint to the COl use and 

storage location(s), when possible, facilities can limit the compliance burden of, among other things, CFA TS 

background checks under RBPS 12. In order to designate a discrete "Restricted Area," DHS generally requires 

that the facility control access to and/or monitor the location. For facilities regulated for Release CO Is (which 

are generally stored inside large vessels, tanks, railcars, or process equipment), creating a "Restricted Area" 

within the facility's boundaries can be more complex. If it is possible to control access to these COl locations 

in the first instance, then facilities must often initiate projects that are more technical given that they may involve 

fencing off and/or monitoring large operations areas (e.g., tank farms, etc.). 
181 


34591.124

CFATS -I\ Progress Report: Additional Questions for the Record Page3of8 

In other instances, the Release COl is stored and/or used in multiple locations throughout the facility making 

it operationally impossible to designate discrete "Restricted Areas." In these cases, the facility must consider 

all areas within its perimeter fence-line as the "Restricted Area'' and implement security measures 

commensurate with its risk tier along its entire perimeter, including ensuring that more personnel have been 

subject to CFA TS background checks. While increasing security at chemical facilities is often value-added, 

some facilities find the increased background check requirements difficult to manage, at least initially. 

However, it is worth nothing that DHS is willing to discuss, in a collaborative nature, the measures that may be 

most appropriate in advance of a facility initiating such projects as well as permitting and encouraging facilities 

to take taking credit for measures that are already in place (such as process safeguards, to help address Rl3PSs 

for Release CO!s in particular). 

3. Mr. Roberts, Congress directed DHS to develop a risk assessment approach and corresponding tiering 

methodology that incorporates all of the elements of risk, including threat, vulnerability, and 

consequence. In your experience, what challenges has that posed both for DHS and for regulated entities? 

While DHS's revised vulnerability, consequence, and threat considerations include more detailed metrics 

that help account for differences among facilities (see no.S below), and is significantly improved relative to the 

prior model, the revised tiering methodology sometimes yields unexpected results. With that said, DHS has 

been (and continues to be) willing to discuss individual tiering results with a facility and, to the extent that an 

error has occurred (e.g., a facility reporting incorrect data), will permit the facility to refile a Top-Screen torerun the tiering engine. 

4. Mr. Roberts, why is it important that Congress reauthorize CFATS? 

It is important that Congress reauthorize CFATS to demonstrate a continued commitment to the security of 

the nation's highest-risk chemical facilities. Since 2007, CFA TS has driven security measures across regulated 

facilities, and industry requires the certainty and stability of multi-year CFA TS reauthorization to ensure 

continuity and security planning. Multi-year reauthorization will also give DHS, and, specifically, the 

Infrastructure Security Compliance Division (!SCD), the sustainability it needs for programmatic development 

- to include the hiring and training of new Chemical Security Inspectors, which will help drive program 

consistency throughout the ISCD inspector regions. 
182 


34591.125

CFATS --A Progress Report: Additional Questions for the Record Page 4 of8 

5. Mr. Roberts, your written testimony points out that the new methodology implemented by DHS has also 

improved tbe transparency of its risk determination process to help the regulated community better 

understand why a facility may be tiered. Why is that? 

ln its September 2016 Chemical Facility Anti-Terrorism Standards: Tiering Methodology Fact Sheet, DI IS 

provided additional context for its revised tiering methodology as it relates to its vulnerability, consequence, 

and threat considerations. 

DHS 's vulnerability consideration now accounts for inherent characteristics of the facility and/or asset and 

provides a Jist of factors which, depending on the COl's applicable Security Issue, can be used to reduce 

vulnerability to a terrorist attack. For example, in such instances where the applicable Security Issue is 

Theft/Diversion, DHS suggests that a facility's usc of larger, Jess ponable COl containers may reduce its 

vulnerability. Dl!S's consequence consideration now uses dispersion and blast modeling to more accurately 

account for onsite and offsite impacts of COl exploitation and misuse. 

In much the same way as for the vulnerability variable, DHS also provides a list of factors which, depending 

upon the applicable Security Issue, are used to inform the consequences of a terrorist attack. For example, where 

the applicable Security Issue is Theft/Diversion, DHS indicates that the following may affect the consequence 

score: COl toxicity, COl explosive energy, COl quantity and concentration, COl storage (i.e., type of 

packaging), and COl precursor characteristics. Where the applicable Security Issue is Release, DHS indicates 

that the following may affect the consequence score: surrounding topography, exposure of surrounding 

population to the COl, COl toxicity, COl flammability, COl explosive energy, COl quantity and concentration, 

and CO! storage (i.e., container location, temperature, pressure rating, and secondary containment (if any)). 

And, finally, Dl!S's threat consideration uses factors, depending upon the applicable Security Issue, 

informed by the intelligence community to determine the level of threat of a terrorist attack or exploitation. 

Where the applicable Security Issue is Theft/Diversion, DHS indicates that the specific COl and mode of 

shipment are examined in determining the threat. Where the applicable Security Issue is Release, DHS indicates 

that the specific COl, facility type (whether chemical production facility or user/distributor), and the type of 

area where the CO! is located (whether process unit, storage area, or transfer point) are examined in determining 

the threat. 

DHS's additional explanation of the vulnerability, consequence, and threat considerations increases 

transparency from a compliance perspective. This also allows facilities to preemptively mitigate certain risks 
183 


34591.126

CFATS - A Progress Report: Additional Questions for the Record Page5of8 

(whether with an eye toward safety orto possibly avoid a high-risk designation altogether) and better understand 

why DHS may have tiered a facility differently than another facility that, at least superficially, appears to be 

similarly situated. 

6, Mr. Roberts, your written testimony points out that the CFATS regulation does not permit a facility to 

appeal a tiering decision. Why is it important that regulated facilities be able to appeal this decision by 

DHS'! 

For the reasons described in my testimony, a tiering review process that is more formal than a technical 

consultation, but less formal than an outright appeal (which could possibly swallow !SCD's ability to implement 

the program), would be beneficial for facilities that have good cause. 

7. Your written testimony directs Congress to accelerate the rulemaking process by directing DHS to 

publish proposed and final CFATS rules- or a determination that no changes are necessary -by dates 

certain. Why is this necessary? 

While the CFATS regulation has not changed since it was first published in 2007, the practical and 

operational application of CFA TS has changed in the ensuing II years- both in terms of !SCD's focus and 

industry's approach to compliance. This, alone, justifies a rulemaking to update the regulation. Because the 

CFATS Notice of Proposed Rulcmaking has been relegated to DHS 's list of Long-Term Actions, without 

direction from Congress, the prospect of regulatory updates is unlikely before 2020 (at the earliest). 

8. Mr. Roberts, your testimony raises the issue that the CFATS regulation states that, "[i]f a covered facility 

makes material modifications to its operations or site, the covered facility must complete and submit a 

revised Top-Screen to tbe Department within 60 days of the material modification." What constitutes a 

~•material modification?" 

Dl IS has not provided official direction on what constitutes a "material modification." While some 

"material modifications" are obvious (e.g .. the removal or reduction of a COl below its Appendix A Screening 

Threshold Quantity (STQ)), when a material modification has occurred is not always clear. Toward this end, 

for example, many facilities struggle to determine whether a significant increase in the quantity of a COl 

constitutes a "material modification." For example, if a facility possesses 1,500,000 pounds of a ReleaseFlammable COl, and then subsequently increases the quantity of that COl to 2,000,000 pounds, docs the 

500,000-pound increase trigger a "material modification" that requires a new Top-Screen? This is one of the 

areas that DIIS could address in a new rulemaking or even through technical guidance to industry. 
184 


34591.127

CFA TS- A Progress Report: Additional Questions for the Record Page 6 of& 

9. Your testimony points out that the ability of facilities to commit capital for CFATS security measures 

would be impeded if the underlying CFATS program lapsed, expired, or otherwise had an uncertain 

future. 

a. Since, the majority of facilities have already gone through the initial round of CFA TS compliance, 

why is that? 

b. Do you have specific examples? 

While the majority of facilities have already gone through the initial round of CFATS compliance, many 

have not. For these facilities, who are new to CFATS since lSCD initiated the CSA T 2.0 process in September 

20 !6, certainty in the future of the program is important. Among other reasons, a facility or company that is 

new to CFATS may be hesitant to commit capital to implement new and additional security measures for a 

regulatory program that has lapsed, expired, or otherwise has an uncertain future. 

For those facilities that have already gone through the initial round of CFATS compliance, a similar line of 

reasoning is applicable. Many CFA TS security measures require maintenance, upkeep, and change management 

practices. These include access control systems, fencing, monitoring systems, cameras, COl-specific protection 

measures, CFATS-specific training programs, CFATS policies and procedures, and the CFATS personnel 

surety program. Like a facility or company that is new to CFATS, a facility or company that has already gone 

through the initial round ofCFATS compliance may be hesitant to continue to commit capital and resources to 

maintain security measures for a regulatory program that has lapsed, expired, or otherwise has an uncertain 

future. 

Two specific examples include: (I) a large facility that moved from untiered to tiered and is in the process 

of implementing a CF ATS security plan as an initial matter; and (2) a large facility that was previously tiered 

for Theft/Diversion CO Is only, but is now tiered for both Theft/Diversion and Release CO!s. This facility is 

now in the process of implementing an updated C!·'ATS security plan and making changes to how the security 

plan is implemented from a Release COl perspective. 

10. Your testimony mentions inconsistency across the program and DHS regions with regard to the CF A TS 

inspector cadre. Could you please provide some examples for me? 

a. Would additional training help and what areas would you recommend that DHS focus on? 

As I noted in my testimony, CFA TS experience and knowledge, and the approach to conducting an 

inspection, may differ among inspectors. For example: 
185 


34591.128

CFATS ~A Progress Report: Additional Questions for the Record Page 7 of8 

Some inspectors tell facilities that they have to continuously monitor their COl storage locations 

whereas others tell similarly-tiered facilities that the locations must be monitored or checked at least 

every 12 hours, while still others indicate that the locations need only be monitored or checked once 

per week. Some inspectors suggest that camera monitoring is suflicicnt while others suggest the 

monitoring I checking must be conducted in-person. 

Some Inspectors may ask facilities to provide them with a current COl inventory report so that they can 

compare the COl quantity on-site to the COl quantity previously reported to DHS. If the facility's 

current COl inventory differs from the amount reported, some inspectors tell the facility it is a "material 

modification" and that a new Top-Screen must be submitted- even if the difference in quantity is only 

a few percent. Other inspectors may tell facilities to simply report to DHS the highest possible quantity 

the facility could ever possess, even if the facility has no intention of ever possessing that quantity. 

With regard to background checks, some inspectors have asked to review completed background checks 

of all "affected individuals" at the facility, some only ask for a random sampling, and still others are 

satisfied with a single letter from a Human Resource representative stating that the background checks 

have been completed. 

With regard to law enforcement outreach, some inspectors tell facilities that they must meet with the 

local law enforcement agencies in their jurisdictions at least annually while other inspectors state that 

facilities need only attempt to meet with local law enforcement agencies one time. Some inspectors 

require documentation evidencing the outreach while others do not require such documentation. 

Some inspectors have suggested that facilities arc required to implement certain security measures that 

are less relevant to the Security lssuc(s) for which the facility is tiered (e.g., an inspector suggesting a 

facility must conduct inbound vehicle inspections when the facility is only tiered for a single 

Theft/Diversion COl). 

Additional training to ensure a consistent level of baseline knowledge and understanding of how the RBPSs 

are applied would be helpful. I suggest that the training is focused in the following areas: 

The performance-based nature of the RBPSs, the expectations and generally acceptable security 

measures to meet the RBPSs for specific tier levels, the different CFATS Security Issues (i.e., 
186 


34591.129

CF ATS ~A Progress Report: Additional Questions for the Record Pagc8of8 

Theft/Diversion, Release, and Sabotage), and the overall regulation (including the COl calculation 

rules). 

The CSAT, which is the online portal that the regulated facilities usc to submit documents and exchange 

con·espondence with DI!S. Some inspectors appear to be unfamiliar with the CSA T's functionality. 

It is worth noting that DHS has indicated that it is developing additional training materials and continues 

to work with field inspectors to drive consistency and knowledge. 

11. Recently, it was suggested that CFATS is not robustly addressing a cyber security component at these 

facilities. 

a. Do you agree that the CFA TS program is insufficiently addressing cyber issues'? 

b. Do inspectors need additional training to address cyber security issues at CFATS regulated 

facilities? 

DHS has previously stated that its goal with regard to cyber security " .. is to reduce the risk of attackers 

conducting malicious attacks on critical systems, which could result in theft, diversion, release, or sabotage of 

CO!s." I do not believe that DHS is insufficiently addressing cyber issues. Additional cyber security training 

would help inspectors better communicate with the facility's cyber /IT personnel and, in that regard, would be 

helpful. 

12. Do you think DHS is doing a good job of promoting security without presenting risk vs. risk trade-offs 

for companies with chemicals of interest? 

Accepting risk requires inherent trade-offs, and I respectfully ask the Committee to seek further clarification 

on this specific question from DIIS. 

13. You mentioned that there is no appeal to tiering under CFA TS. Please explain the tratle-offs of an appeal 

process and the proposal you suggested? 

As noted above in question six and further to my written testimony, it would be helpful if DHS were to 

formalize and publicize its existing practice of how tiering is reviewed and how, if presented with hypothetical 

changes to a facility's chemical holdings or business practices, such changes may affect a tiering decision. 
187 


34591.130

GHEG WALD[N, OHEGON 

CHAIRMM\1 

Mr. James Conrad 

Principal 

ONE HUNDRED FIFTEENTH CONGRESS 

FRANK PALLONE, JR .. NEW JERSEY 

RANKING MEMBER 

<!ongre~~ of tbe ~ntteb ~tate~ 

j!)ouse of i~cprrsmtnti\Jrs 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HousE OFFICE BuiLDING 

WASHINGTON, DC 20515-6115 

July 16,2018 

Conrad Law and Policy Counsel 

910 17th Street, N.W.; Suite 800 

Washington, DC 20006 

Dear Mr. Conrad: 

Thank you for appearing before the Subcommittee on Environment on June 14, 2018, to 

testify at the hearing entitled '"The Chemical Facilities Anti-Terrorism Standards Program (CFATS) 

-A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record 

remains open for ten business days to permit Members to submit additional questions for the record, 

which are attached. To facilitate the printing of the hearing record, please respond to these 

questions with a transmittal letter by the close of business on Monday, July 30, 2018. Your 

responses should be mailed to Kelly Collins, Legislative Clerk, Committee on Energy and 

Commerce, 2125 Rayburn House Office Building, Washington, DC 20515 and e-mailed in Word 

format to k~ll\~D.!JUJ?.1Lrn.!!U .. JJ.~~l!~~-

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

~~ John Shimkus 

Chairman 

Subcommittee on Environment 

cc: The Honorable Paul Tonko, Ranking Member, Subcommittee on Environment 

Attachment 
188 


34591.131

1. The CFATS program was intentionally designed to promote inherent safety. The basic structure 

of having multiple tiers of facilities, based on risk, with increasingly demanding performance 

standards for each tier, was consciously developed to create incentives for facilities to reduce 

the risks that facilities pose, and thus move down to less-demanding tiers of regulation- or 

even to exit the system altogether.' And this design has paid off- the majority of plants that 

were ever tiered for CFATs purposes have managed to modify their inventories or 

manufacturing processes in ways that enabled them to tier out of the system. Thus, the CFATS 

program has been an active driver of inherent safety. Moreover, it has done so following a 

market-based approach- one in which individual facilities have been the ones to decide 

whether they want to make process changes to reduce risk, and if so, which changes to 

implement. The system has thus succeeded greatly while avoiding the need for DHS personnel 

to make decisions about inherent safety. 

Congress should not move toward a system that would impose those kinds of decision 

responsibilities upon government personnel, for two reasons. 

First, 1ST is inherently subjective and arbitrary. For example, if a proposed technology would 

reduce explosion hazards but pose water pollution risks, would it be inherently safer?' DHS's 

July 2010 report entitled "Definition for Inherently Safer Technology in Production, 

Transportation, Storage, and Use,"3 which is the Federal government's most definitive 

statement on the topic of 1ST, explains that that what is "inherently safer" for some hazards 

might simultaneously be inherently less safe for others. Similarly, the 2012 National Academy of 

Sciences (NAS) report on "The Use and Storage of Methyl Isocyanate (MIC) at Bayer 

CropScience" observed that, "[ajlthough one process alternative may be inherently safer with 

respect to one hazard ... the process may present other hazards."' As a result, consistent 

enforcement of 1ST is impossible because different companies and different inspectors will 

inevitably have differing views on specific technologies that cannot be objectively resolved. 

Second, the DHS report also notes that "there is currently no consensus on either a 

quantification method for 1ST or a scientific assessment method for evaluation of 1ST options." 5 

The NAS concurred that there is no "set of practice protocols for identifying safer processes.''6 

Currently, DHS inspectors work closely with facilities to reduce risks and enhance security 

measures. DHS will be most successful in promoting security at regulated facilities through 

these partnerships, as opposed to a regulatory construct that would be difficult for both 

1 See, e.g., Testimony of Richard A. Falkenrath before the Senate Homeland Security & Governmental 

Affairs Committee (April 27, 2005), at 16-17, available at 

htt ps:/ jwww. hsga c.sen ate .gov /i mo I media/ do c/SHSGACTestimonyon Hazm a\042705 .pdf. 2 See National Academy of Sciences, "The Use and Storage of Methyl Isocyanate (MIC) at Bayer 

CropScience" (NAS Report) at 107; available at http://dels.nas.edu/ReportjStorageMethyl/13385?_ga=2.133359881.606789487.1533571699-861784906.1476455634. 

3 Available at https:/ /www.aiche.org/sites/default/files/docs/embeddedpdf/ist_final_definition_report.pdf. 

4 See NAS Report at 4. 5 79 Fed. Reg. 44620. 6 NAS Report at 6. 
189 


34591.132

facilities and regulators to understand and comply with. Mandating 1ST would erode the 

partnership that exists between DHS and regulated facilities and harm the excellent 

relationships that have been established in recent years between DHS and the chemical 

industry. 

2. SOCMA believes an assessment ofthe PSP program is necessary before expanding the program 

to include Tier 3 and 4 facilities. PSP information is just beginning to process through the 

Terrorist Screen database (TSDB) for most Tier 1 and 2 facilities. Effectively, PSP is still in its very 

early stages, similar to those of the pilot stage of a program. DHS should not expand the 

program until it can evaluate the costs and benefits of the program at Tier 1 and 2 facilities 

including whether any of the individuals run through PSP actually have terrorist ties. Tier 1 and 

2 facilities represent less than 10% of all CFATS facilities, and so the burden of compliance for 

Tier 3 and 4 facilities would, in the aggregate, be much greater than what Tier 1 and 2 facilities 

currently experience- while the risks posed by Tier 3 and 4 facilities are by definition lower. 

The best way to conduct this evaluation would be for DHS to collaborate with the Department of 

Justice (DOJ) and its Federal Bureau of Investigation (FBI) on a formal assessment of the benefits 

and positive outcomes of running PSP-gained information through TSDB. There is precedent for 

just this sort of multi-agency partnership in the evaluation of a regulatory program that 

implicates the interests of multiple agencies. In the late 1990s, EPA was proposing to post on its 

Web site the "off-site consequence analyses" (i.e., worst-case release scenarios) submitted to it 

by facilities regulated under the Risk Management Program rule. Even before 9/11, industry 

and the FBI recognized that this sort of disclosure could pose security risks. Congress responded 

by passing the Chemical Safety Information, Site Security and Fuels Regulatory Relief Act 

(CSISSFRRA), which required the President to study the benefits and risks of such disclosure.' 

The President in turn instructed EPA to assess the benefits of this disclosure and DOJ to study 

the risks. Based on that analysis, EPA and DOJ jointly published a regulation that provides 

limited public access to specific worst-case scenario data but keeps that information off the 

Internet.• 

A similar DHS/DOJ review of PSP and its application to lower-risk tier facilities would deliver a 

better idea of the effectiveness of PSP and may uncover new and better ways for PSP to 

operate. Additionally, the greater number of facilities and people that can be considered in the 

review the better. Hence, it may be premature even at this point to complete this analysis. 

3. CSAT 2.0 has vastly improved the CFATS tiering process, especially the Top-Screen process. The 

process is still not completely transparent, but SOCMA members now have a much clearer 

picture of why they are tiered the way they are. Collaboration with DHS is again the key. SOCMA 

members have been able to work closely with inspectors and the DHS staff completing the 

tiering and retiering assessments, which has given our members greater insight into the CFATS 

tiering process generally and into their specific cases. DHS has also been much more willing to 

evaluate alternative operating scenarios and to advise facilities about how those would affect 

the facility's tier assignment. 

7 42 U.S.C. § 7412(r)(7)(H). 

8 See 40 C.F.R. Part 1400. 

2 
190 

Æ 


34591.133

While the system and program are not perfect, and greater clarity is always appreciated, CSAT 

2.0 has greatly improved the CFATS tiering process.