U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

82–834 PDF 2013

THE CHEMICAL FACILITY ANTI–TERRORISM 

STANDARDS PROGRAM: A PROGRESS REPORT 

HEARING 

BEFORE THE

SUBCOMMITTEE ON ENVIRONMENT AND THE 

ECONOMY 

OF THE

COMMITTEE ON ENERGY AND 

COMMERCE 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED TWELFTH CONGRESS 

SECOND SESSION 

SEPTEMBER 11, 2012 

Serial No. 112–172 

( 

Printed for the use of the Committee on Energy and Commerce 

energycommerce.house.gov 

COMMITTEE ON ENERGY AND COMMERCE 

FRED UPTON, Michigan 

Chairman 

JOE BARTON, Texas 

Chairman Emeritus 

CLIFF STEARNS, Florida 

ED WHITFIELD, Kentucky 

JOHN SHIMKUS, Illinois 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

GREG WALDEN, Oregon 

LEE TERRY, Nebraska 

MIKE ROGERS, Michigan 

SUE WILKINS MYRICK, North Carolina 

Vice Chairman 

JOHN SULLIVAN, Oklahoma 

TIM MURPHY, Pennsylvania 

MICHAEL C. BURGESS, Texas 

MARSHA BLACKBURN, Tennessee 

BRIAN P. BILBRAY, California 

CHARLES F. BASS, New Hampshire 

PHIL GINGREY, Georgia 

STEVE SCALISE, Louisiana 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

LEONARD LANCE, New Jersey 

BILL CASSIDY, Louisiana 

BRETT GUTHRIE, Kentucky 

PETE OLSON, Texas 

DAVID B. MCKINLEY, West Virginia 

CORY GARDNER, Colorado 

MIKE POMPEO, Kansas 

ADAM KINZINGER, Illinois 

H. MORGAN GRIFFITH, Virginia 

HENRY A. WAXMAN, California 

Ranking Member 

JOHN D. DINGELL, Michigan 

Chairman Emeritus 

EDWARD J. MARKEY, Massachusetts 

EDOLPHUS TOWNS, New York 

FRANK PALLONE, JR., New Jersey 

BOBBY L. RUSH, Illinois 

ANNA G. ESHOO, California 

ELIOT L. ENGEL, New York 

GENE GREEN, Texas 

DIANA DEGETTE, Colorado 

LOIS CAPPS, California 

MICHAEL F. DOYLE, Pennsylvania 

JANICE D. SCHAKOWSKY, Illinois 

CHARLES A. GONZALEZ, Texas 

TAMMY BALDWIN, Wisconsin 

MIKE ROSS, Arkansas 

JIM MATHESON, Utah 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

DONNA M. CHRISTENSEN, Virgin Islands 

KATHY CASTOR, Florida 

JOHN P. SARBANES, Maryland 

SUBCOMMITTEE ON ENVIRONMENT AND THE ECONOMY

JOHN SHIMKUS, Illinois 

Chairman 

TIM MURPHY, Pennsylvania 

Vice Chairman 

ED WHITFIELD, Kentucky 

JOSEPH R. PITTS, Pennsylvania 

MARY BONO MACK, California 

JOHN SULLIVAN, Oklahoma 

CHARLES F. BASS, New Hampshire 

ROBERT E. LATTA, Ohio 

CATHY MCMORRIS RODGERS, Washington 

GREGG HARPER, Mississippi 

BILL CASSIDY, Louisiana 

CORY GARDNER, Colorado 

JOE BARTON, Texas 

FRED UPTON, Michigan (ex officio) 

GENE GREEN, Texas 

Ranking Member 

TAMMY BALDWIN, Wisconsin 

G.K. BUTTERFIELD, North Carolina 

JOHN BARROW, Georgia 

DORIS O. MATSUI, California 

FRANK PALLONE, JR., New Jersey 

DIANA DEGETTE, Colorado 

LOIS CAPPS, California 

JOHN D. DINGELL, Michigan (ex officio) 

HENRY A. WAXMAN, California (ex officio) 

(II) 

(III) 

C O N T E N T S 

Page 

Hon. John Shimkus, a Representative in Congress from the State of Illinois, 

opening statement ................................................................................................ 1 

Prepared statement .......................................................................................... 3 

Hon. Gene Green, a Representative in Congress from the State of Texas, 

opening statement ................................................................................................ 7 

Hon. Fred Upton, a Representative in Congress from the State of Michigan, 

opening statement ................................................................................................ 8 

Prepared statement .......................................................................................... 9 

Hon. Henry A. Waxman, a Representative in Congress from the State of 

California, prepared statement ........................................................................... 102 

WITNESSES

Rand Beers, Under Secretary, National Protection and Programs Directorate, 

Department of Homeland Security 1

Prepared statement 2 ........................................................................................ 12 

Answers to submitted questions ...................................................................... 104 

David Wulf, Director, Infrastructure Security Compliance Division, Office of 

Infrastructure Protection, National Protection and Programs Directorate, 

Department of Homeland Security 1

Prepared statement 2 ........................................................................................ 12 

Cathleen A. Berrick, Managing Director, Homeland Security and Justice, 

Government Accountability Office 1

Prepared statement .......................................................................................... 20 

Answers to submitted questions ...................................................................... 139 

Timothy J. Scott, Chief Security Officer and Corporate Director, Emergency 

Services and Security, The Dow Chemical Company ........................................ 57 

Prepared statement .......................................................................................... 59 

Matthew J. Leary, Corporate EHS&S Manager, Pilot Chemical Company ....... 65 

Prepared statement .......................................................................................... 67 

Anna Fendley, Health, Safety, and Environment Department, United Steelworkers .................................................................................................................. 75 

Prepared statement .......................................................................................... 77 

Paul Orum, Blue Green Chemical Security Coalition, Independent Counsel 

to the Center for American Progress .................................................................. 80 

Prepared statement .......................................................................................... 82 

SUBMITTED MATERIAL

Letter, dated September 10, 2012, from Charles T. Drevna, President, American Fuel & Petrochemical Manufacturers, to Mr. Shimkus and Mr. Green, 

submitted by Mr. Green ...................................................................................... 97 

1Mr. Beers, Mr. Wulf, and Ms. Berrick did not present oral statements. 

2Mr. Beers and Mr. Wulf submitted a joint prepared statement. 

(1) 

THE CHEMICAL FACILITY ANTI–TERRORISM 

STANDARDS PROGRAM: A PROGRESS REPORT 

TUESDAY, SEPTEMBER 11, 2012 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON ENVIRONMENT AND THE ECONOMY, COMMITTEE ON ENERGY AND COMMERCE, Washington, DC. 

The subcommittee met, pursuant to call, at 10:00 a.m., in room 

2322, Rayburn House Office Building, Hon. John Shimkus (chairman of the subcommittee) presiding. 

Members present: Representatives Shimkus, Murphy, Latta, 

Cassidy, Gardner, Barton, Upton (ex officio), Green, Butterfield, 

and Barrow. 

Also present: Representative Pompeo. 

Staff present: Nick Abraham, Legislative Clerk; Charlotte Baker, 

Press Secretary; Sean Bonyun, Communications Director; Matt 

Bravo, Professional Staff Member; Jerry Couri, Senior Environmental Policy Advisor; David McCarthy, Chief Counsel, Environment and the Economy; Andrew Powaleny, Deputy Press Secretary; 

Chris Sarley, Policy Coordinator, Environment and the Economy; 

Brett Scott, Staff Assistant; Jacqueline Cohen, Democratic Counsel; 

Greg Dotson, Democratic Staff Director, Environment and the 

Economy; Elizabeth Letter, Democratic Assistant Press Secretary; 

Karen Lightfoot, Democratic Communications Director and Senior 

Policy Advisor; and Stephen Salsbury, Democratic Staff Assistant. 

Mr. SHIMKUS. The subcommittee will come to order. And we 

would ask our guests to come on in and sit down and close the 

doors, and we will welcome our first panel. 

I have an opening statement which I will read in part and hopefully then get unanimous consent to submit for the record. 

OPENING STATEMENT OF HON. JOHN SHIMKUS, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF ILLINOIS 

I have been thinking about CFATS for a long time, since the last 

hearing, and how long it has taken and the past problems, et 

cetera, et cetera, et cetera. We all know the story. 

You know, the Illinois State flag has a banner underneath it that 

says ‘‘State sovereignty, national unity.’’ And I think part of our debate is, here at the national level, are States still sovereign? And 

how do we address national unity issues like homeland security 

and the like? And I think this is a perfect program that, if done 

properly, we can move in a good direction. 

What do we need on security? As many of you know, I have a 

military background. I served in West Germany during the old 

2 

days. I understand security, I understand perimeters, I understand 

threats, not as well as those who are involved more deeply today. 

But we want folks to have perimeter security. We would like the 

national government to provide assistance in identifying insecure 

facilities or placement of chemicals and operations and stuff. As I 

said, assistance, not the threats, not the mandates. 

And then we do need to address the personal assurance issues 

about who is involved in working around what type of materials. 

I think that really encompasses my view of CFATS. How can we 

work together so that we are all better off? I think we still have 

a ways to go. I know we are making progress since the last hearing, but I think there are still issues to address. 

And I know that there are some issues about why today, and was 

this planned, and was there politics behind today. At least that is 

what the rumors were from staff. And, first of all, no, this is the 

last full week here. We have to get through this. 

But the second point I would say, how do you best honor those 

on a day like today than to address the threats of today? I think 

we do more, if we are really concerned about the threats posed, to 

continue to address our issues of safety and security on today. I 

think that is how you better honor folks, by moving forward. 

So whatever debates and statements on that are, I don’t really 

have a dog in that fight, and I could really care less what people 

think on that. 

After the last hearing on this issue, I know testimony is going 

to be that we have implemented—or DHS has implemented 59 of 

its 95 corrective actions. We will want to ask, where we are at on 

the other 36? 

I will address questions on the permanent branch chiefs. I do 

think having people in positions for a period of time is probably an 

important thing for continuity and for process. I have a national 

forest in my congressional district. My relationships with the manager and the forest and all the stakeholders are much better when 

the same person is there over a couple years versus swapping them 

out every 6 months or every year. And I think that is true probably 

at any Federal agency. My staffers who deal with constituent service are much better having continued to do that work over years 

versus having them doing different things. 

We need to also address how do we move forward in a more 

transparent and open system and process. I think that is an issue, 

also, of the last hearing. 

So I look forward to the hearing. I think it is very, very important. 

Just for my colleagues who have shown up, Mr. Beers has agreed 

to waive his opening statement so that we can move questions after 

we get through ours because of the time constraints with the ceremony and your early departure. And we appreciate that. 

So, with that, I am going to yield back the balance of my time 

and yield to the ranking member, Mr. Green, for 5 minutes. 

[The prepared statement of Mr. Shimkus follows:] 

3 


82834.001

Opening Statement Chairman John Shimkus 

The CF A TS Program - A Progress Report 

September 11, 2012 

The Subcommittee will now come to order. We have a very full 

hearing today and the House and the Committee have an ambitious 

schedule. We appreciate everyone's indulgence as we try to navigate 

all the considerations we face today. 

The Chair now recognizes himself for the purpose of delivering 

an opening statement. 

Many folks have commented about our hearing being scheduled 

for 9-11 - the 11 th anniversary of the horrific attacks against our 

nation. Although today's hearing falling on the anniversary is a 

coincidence, the attacks were the driving force behind the creation of 

the Chemical Facility Anti-Terrorism Standards program, and we 

remain steadfast in our work to protect the American people from 

future attacks. I can guarantee that we will continue closely following 

the progress the Department of Homeland Security is making in fully 

implementing the CFATS program. 

1 
4 


82834.002

What I can guarantee everyone is it is no accident we are having 

another hearing on the progress the Department of Homeland 

Security is making in fully implementing the Chemical Facility AntiTerrorism Standards program (CF A TS). 

This past February, the Subcommittee held a hearing which 

discussed enormous challenges confronting the CFATS program's 

execution. Sadly, this was a story contradicting most every ounce of 

previous testimony Congress had been provided by DHS and the 

regulated community about the soundness of DHS's implementation 

efforts. While I am glad the two brave employees penned the internal 

memo outlining the true state of play for CF A TS, Congress shares 

some culpability in having allowed it to get this bad without greater 

oversight. 

I support the CF A TS statute and I think the regulations 

implementing the law are reasonable. I want it to succeed because I 

think it presents the best solution for dealing with terrorism at 

facilities with chemicals of interest. However, I do not support 

waste, fraud, and abuse -- and it seemed we had a bipartisan 

consensus on this point at the last CF A TS hearing. 

2 
5 


82834.003

Seven months after our panel first heard sworn testimony from 

Under Secretary Beers about the state of CF ATS and its plan forward 

today is our checkup on how things are going at DHS. 

For all the support Congress has given over the years, CF A TS 

should have more to show than repelling ropes, hazmat suits, and 

delayed implementation. 

I understand DHS intends to tell us it has completed or 

implemented 59 or its 95 corrective "action" items. While I 

congratulate them for making progress, I want to know about how we 

are moving forward on the 36 remaining items, including the use of 

alternate security programs and the personnel surety program. 

I also believe DHS is working on an alignment plan and finally 

making efforts to hire permanent branch chiefs. What I want to hear 

is whether DHS leadership has scoped out the job descriptions for 

these managers or if DHS intends to have their employees write the 

boss's job description. In addition, I want to know what DHS is 

doing to assure management continuity and reverse the constant 

turnover of CF A TS leadership career employees. 

3 
6 


82834.004

Finally, Under Secretary Beers made several attempts in our 

February hearing to describe how he intends to create a more open, 

transparent and collaborative National Protection and Programs 

Directorate and thaw the chill from fear of retaliation employees felt 

if they delivered bad news. I want to know how that is going as well 

as examine concrete examples of his efforts. 

I want to sincerely welcome all of our witnesses, we appreciate 

your being here and the perspective you provide. I will warn you: 

Weare going to ask tough questions, and not for any reason other 

than because we are serious about protecting the American people 

from terrorism in the most appropriate way. We expect candor and 

the whole truth in response to our inquiries. 

I now yield 5 minutes to my friend, the Ranking Member and 

distinguished gentleman from Houston, Texas, Mr. Green, for the 

purposes of delivering an opening statement. 

4 
7 

OPENING STATEMENT OF HON. GENE GREEN, A 

REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. GREEN. Thank you, Mr. Chairman, for holding this hearing 

today. And I don’t know if it is special timing, but I think the reason we have chemical security is because of 9/11 and the concern 

we have about our major industrial facilities. 

I want to welcome both of our panels. 

This important issue—I am glad to see our subcommittee continue oversight of this critical program. I represent the Houston 

Ship Channel area, which is the largest petrochemical complex in 

the country. I cannot stress how important the success of the 

CFATS program is to my constituents who are the employees and 

live in the communities that surround the facilities. They deserve 

the best security standards possible to prevent acts of terrorism on 

U.S. Soil. 

Secretary Beers, you did not testify under the best circumstances 

last February, but I hear that you have some positive things to report this time around. And I appreciate that things are starting to 

move, but we cannot ignore that it has been 6 years since this program was enacted and we are still not close to being there yet. It 

is time to get these plants inspected and approved, and I hope that 

you have a deadline for doing so to report to us this morning. 

That said, it is Congress’ job to make sure you have the resources to do this. I understand that the House appropriators significantly cut your budget. With movement finally happening in the 

last few months, now is not the time to limit resources. And I encourage my colleagues not to set us back now. 

I want to end by talking about a subject that is of prime importance to me, and that is personnel surety. Developing and implementing a personnel surety program that relies on existing government credential systems, like the TWIC, would reduce a burden on 

DHS and the workers at these facilities and the industry. 

Secretary Beers, last year I asked if the Department intended to 

integrate TWIC in the personnel security program. You gave me a 

positive response, and yet the proposal you sent to the OMB did 

not make it clear that TWIC is an acceptable background check. I 

am pleased that you rescinded the proposal in July, but understand 

that you will resubmit a revised personnel security program in the 

coming months. I hope today that you will definitely commit to allowing the Transport Worker Identification Card, or TWIC, to be 

used without caveats for workers or industries. 

We will soon be reissuing thousands and thousands of TWIC 

cards because they are expiring, including mine expires in June of 

next year. I have spent so much time on plant sites in my district. 

At the Port of Houston, we have over 250,000 employees who use 

a TWIC card every day to get to work—250,000. Multiply that 

across the country. There is no reason to reinvent the wheel. We 

need to fix TWIC and use it as the standard card. 

I regret Congress has still not passed a CFATS authorization. I 

still believe that a lot of problems with the CFATS program stems 

directly from not having a permanent authorization with direction 

from Congress. Chemical facilities security is extremely important 

to the protection of public health and safety throughout the U.S., 

8 

particularly in our congressional district. There is no reason we 

should not act on this issue. 

And I look forward to the testimony of our witnesses. And thank 

you, Mr. Chairman. I yield back my time. 

Mr. SHIMKUS. The gentleman yields back his time. 

The chair recognizes the chairman of the full committee, Mr. 

Upton, for 5 minutes. 

OPENING STATEMENT OF HON. FRED UPTON, A REPRESENTATIVE IN CONGRESS FROM THE STATE OF MICHIGAN 

Mr. UPTON. Well, thank you, Mr. Chairman. I am going to ask 

that my full statement be made part of the record. 

Mr. SHIMKUS. Without objection. 

Mr. UPTON. I just want to say, 6 months ago we authorized 

CFATS. We were very conscious that the next terrorism incursion 

could come from within a chemical plant instead of on board an airplane. 

And those of us who were here in DC. 11 years ago remember 

well every single minute of that day. And I, for one, made a promise that we should do everything that we can to make sure that 

that moment doesn’t occur again in this Nation. We have to honor 

the victims and their loved ones by working together to ensure that 

such an attack can never happen again. And I support Chairman 

Shimkus and all that he is doing to make sure that, in fact, we are 

better safeguarded as a nation. 

And I yield back my time. 

[The prepared statement of Mr. Upton follows:] 

9 


82834.005

Environment and the Economy Subcommittee Hearing on The Chemical 

Facilities Anti-Terrorism Standards Program - A Progress Report 

September 11, 2012 

Opening Statement of Chairman Fred Upton 

Thank you, Mr. Chairman. In a few minutes this hearing will recess so that 

Members of both parties and both bodies of Congress can gather at the Capitol for 

a solemn observance of to day's anniversary. 

For eleven years now, we in this room, Members of Congress and Executive 

Branch officials, have been called to exhibit the courage and teamwork to protect 

America from terrorism. We have reassessed our daily lives and the systems we 

rely on to limit vulnerability without limiting the American way of life. 

Six years ago this month we authorized the CF ATS program, conscious that 

the next terrorist incursion could come from within a chemical plant instead of 

onboard an airplane. It is one of many facets of our complex economy that we 

look at differently in the shadow of9111, even as we recognize its important role in 

our nation's system of commerce. 

Today we're examining key questions on the progress of this program: 

• Where are we on preventing personal infiltration of chemical plants? 

• Of the thousands offacilities that DHS says need CFATS, how many can 

confirm for their workers, their neighbors, their investors, and their insurers 

that they have achieved security against terrorism as defined by the U.S. 

Department of Homeland Security? 
10 


82834.006

• Does the culture of the Department reinforce candor and teamwork in 

exchanging perspectives with each other, with stakeholders, and with the 

American people and their Representatives in Congress? 

When we play team sports we know that "hide the ball" means hiding it 

from the opposition, not from members of our own team. Secretary Beers, this 

Committee is not your opponent; the terrorists are our common opponent. We are 

your teammates. 

The horrific attacks against our nation that fateful morning eleven years ago 

continue driving all of our vigilance to protect the homeland. We must honor all of 

the victims and their loved ones by working together to ensure such an attack never 

happens again. 

Mr. Chairman, I welcome all of our witnesses and look forward to their 

candid testimony and complete answers. 
11 

Mr. SHIMKUS. The gentleman yields back his time. 

With that, seeing no other Members here authorized for an opening statement, the chair now recognizes himself. 

First of all, as stated earlier, both Mr. Beers and Ms. Berrick, 

both have agreed to waive their opening statements so we can go 

right to questions. We appreciate that. 

[The prepared statement of Mr. Beers and Mr. Wulf and the prepared statement of Ms. Berrick follow:] 

12 


82834.007

Statement for the Record 

Undersecretary Rand Beers 

National Protection and Programs Directorate 

Department of Homeland Security 

Director David Wulf 

National Protection and Programs Directorate 

Department of Homeland Security 

Before the 

House Committee on Energy and Commerce 

Subcommittee on Environment and the Economy 

United States House of Representatives 

September 11,2012 

Thank you, Chairman Shimkus, Ranking Member Green, and distinguished Members of the 

Committee. It is a pleasure to appear before you today to discuss the Department of Homeland 

Security's (DHS) regulation of high-risk chemical facilities under the Chemical Facility AntiTerrorism Standards (CFATS). My testimony today focuses on improvements to the program, 

the current status of the program, examples of the program's successes to date, some of the 

current challenges facing the National Protection and Programs Directorate (NPPD) in 

implementing CF A TS, and the actions we are taking to address these challenges through the 

Infrastructure Security Compliance Division (IS CD) Action Plan. 

The CF A TS program has made our Nation more secure and we welcome the opportunity to 

continue to work with Congress, all levels of government, and the private sector to further 

improve this vital national security program. As you are aware, the Department's current 

statutory authority to implement CF A TS - Section 550 of the Fiscal Year (FY) 2007 Department 

of Homeland Security Appropriations Act, as amended --currently extends through October 4, 

2012. 

Since the inception of CF ATS, more than 2,700 chemical facilities have eliminated, reduced, or 

otherwise made modifications to their holdings of potentially dangerous chemicals and are now 

no longer considered high-risk. In addition, NPPD's Chemical Security Inspectors have been 

actively working with facilities and governmental agencies across the country to facilitate the 

development of measures by high-risk chemical facilities that reduce security risks and enhance 

nationwide preparedness. Collectively, they have participated in more than 3,800 meetings with 

federal, state, and local officials; held more than 4,160 introductory meetings with owners and 

operators of CF ATS-regulated or potentially regulated facilities; and conducted more than 1,050 

Compliance Assistance Visits at chemical facilities to assist those facilities in the preparation of 

the necessary security-related documentation required by CFATS. In addition, NPPD has 

reviewed the Site Security Plans (SSPs) of the highest risk (Tier 1) facilities and is currently 

reviewing the SSPs for Tier 2 facilities. We have resumed authorization inspections [and begun 

approving SSPs for Tier 1 facilities]. 

1 
13 


82834.008

At my direction, the program's leadership outlined its priorities, the challenges it believes the 

program faces, and a proposed path forward to address those challenges and accomplish program 

objectives. As the Directorate with oversight responsibility for the CF A TS program, NPPD is 

continually evaluating the program to identify areas for improvement and correcting course when 

necessary to ensure proper implementation. I am pleased to inform you that NPPD has made 

progress on all 95 of the action items now included in the ISCD Action Plan and as of September 

4,2012 has completed 59 of them. 

Chemical Facility Security Regulations 

Section 550 of the FY 2007 Department of Homeland Security Appropriations Act directed the 

Department to develop and adopt within six months a regulatory framework to address the 

security of chemical facilities that the Department determines pose high levels of risk. 

Specifically, Section 550(a) of the Act authorized the Department to adopt regulatory 

requirements for high-risk chemical facilities to complete Security Vulnerability Assessments 

(SV As), develop SSPs, and implement protective measures necessary to meet risk-based 

performance standards established by the Department. Consequently, the Department published 

final regulations, known as CFATS, on April 9, 2007. Section 550, however, expressly exempts 

from the regulation certain facilities that are regulated under other federal statutes, specifically 

those regulated by the United States Coast Guard (USCG) pursuant to the Maritime 

Transportation Security Act, drinking water and wastewater treatment facilities as defined by 

Section 1401 of the Safe Water Drinking Act and Section 212 of the Federal Water Pollution 

Control Act, and facilities owned or operated by the Department of Defense or Department of 

Energy, as well as certain facilities subject to regulation by the Nuclear Regulatory Commission 

(NRC). 

The following core principles guided the development of the CF A TS regulatory structure: 

1. Securing high-risk chemical facilities is a comprehensive undertaking that involves a 

national effort, including all levels of government and the private sector. Integrated and 

effective participation by all stakeholders-Federal, state, local, and territorial 

government partners as well as the private sector-is essential to securing our critical 

infrastructure, including high-risk chemical facilities; 

2. Risk-based tiering is used to guide resource allocations. Not all facilities present the 

same level of risk. The greatest level of scrutiny should be focused on those facilities 

that present the highest risk-those that, if targeted, would endanger the greatest number 

of lives; 

3. Reasonable. clear, and calibrated performance standards will lead to enhanced security. 

The CFATS rule establishes enforceable risk-based performance standards (RBPS) for 

the security of our nation's high-risk chcmical facilities. High-risk facilities have the 

flexibility to develop appropriate site-specific security measures that will effectively 

address risk by meeting these standards. ISCD will analyze all final high-risk facility 

SSPs to ensure they meet the applicable RBPS and will approve those that do. If 

necessary, ISCD will work with a facility to revise and resubmit an acceptable plan and 

can disapprove security plans if an acceptable plan is not submitted; and 

2 
14 


82834.009

4. Recognition of the progress many companies have already made in improvingfacility 

security leverages those advancements. Many companies made significant capital 

investments in security following 9111, and even more have done so since the passage of 

the legislation establishing this program. 

Rule Implementation 

Within a few months after the final regulations were developed, on November 20,2007, the 

Department published CF ATS Appendix A, which identifies 322 chemicals of interestincluding common industrial chemicals such as chlorine, propane, and anhydrous ammonia-as 

well as specialty chemicals, such as arsine and phosphorus trichloride. These chemicals were 

included after analyzing the potential consequences associated with one or more of the following 

three security issues: 

I. Release - Toxic, flammable, or explosive chemicals that have the potential to create 

significant adverse consequences for human life or health if intentionally released or 

detonated; 

2. TheftlDiversion - Chemicals that have the potential, if stolen or diverted, to be used as or 

converted into weapons that could cause significant adverse consequences for human life 

or health; and 

3. Sabotage/Contamination - Chemicals that are shipped and that, ifmixed with other 

readily available materials, have the potential to create significant adverse consequences 

for human life or health. 

NPPD also established a Screening Threshold Quantity for each chemical of interest based on its 

potential to create significant adverse consequences to human life or health in one or more of 

these ways. Any chemical facility that possesses any chemical of interest at, or above the 

applicable Screening Threshold Quantity must submit an initial consequence-based screening 

tool, the "Top-Screen," to NPPD. 

This Top-Screen process developed by NPPD allows the government, for the first time, to gather 

data that can identify potential high-risk facilities, which NPPD then assigns to one OffOUT 

preliminary risk-based tiers, with Tier I representing the highest level of potential risk. 

To support this activity, ISCD developed the Chemical Security Assessment Tool (CSAT) to 

help NPPD identify potentially high-risk facilities and to provide methodologies those facilities 

can use to conduct SV As and to develop security plans. CSAT is a suite of online applications 

designed to facilitate compliance with the program; it includes user registration, the Top-Screen, 

an SV A tool, and an SSP template. To protect this sensitive information, NPPD developed an 

information management regime, Chemical-terrorism Vulnerability Information (CVI), which 

limits access to trained and authorized users. 

In May 2009, NPPD issued Risk-Based Performance Standards Guidance to assist final highrisk chemical facilities in determining appropriate protective measures and practices to satisfy 

the RBPS. It is designed to help facilities comply with CF ATS by providing detailed 

3 
15 


82834.010

descriptions of the 18 RBPS as well as examples of various security measures and practices that 

could enable facilities to achieve the appropriate level of performance for the RBPS at each tier 

level. The Guidance was informed by the experience of the Transportation Security 

Administration, United States Coast Guard, and the Environmental Protection Agency, and also 

reflects public and private sector dialogue on the RBPS and industrial security, including public 

comments on the draft guidance document. High-risk facilities are free to make use of 

whichever security programs or processes they choose-whether or not in the Guidanceprovided that NPPD determines through approval of the facilities' SSPs that they achieve the 

requisite level of performance under the CF A TS RBPS. 

Implementation Status 

To date, rSCD has data from more than 41,000 Top-Screens submitted by chemical facilities, 

providing important information about their chemical holdings. Since June 2008, rSCD 

identified more than 8,000 facilities that it has initially designated as high-risk. These facilities 

have used the CSAT tool to compile and submit SVAs. In May 2009, following reviews of 

facilities' SV A submissions, ISCD began notifying facilities of their final high-risk 

determinations, risk-based tiering assignments, and the requirement to complete and submit an 

SSP or an Alternative Security Program (ASP) in lieu of an SSP. 

As of September 4, 2012, CFA TS covers 4,433 high-risk facilities nationwide; of these 4,433 

facilities, 3,660 are currently subject to final high-risk determinations and have developed 

security plans for NPPD review. The remaining facilities are awaiting final tier determinations 

based on their SV A submissions. ISCD continues to issue final tier notifications to facilities 

across all four risk tiers. I 

Highlights and Successes ofCFATS Program 

As we have previously discussed with this Subcommittee, the ISCD Action Plan currently 

contains 95 items, each of which has been assigned to a member of IS CD's senior leadership 

team for implementation. For accountability, planning, and tracking purposes, the members of 

that leadership team have established milestones and projected timeframes for the completion of 

each task assigned to them. In addition, IS CD leadership meets with the Deputy Under Secretary 

ofNPPD at least once pcr week to provide status updates on the action items and discuss ways 

that NPPD leadership can help. As of September 4, 2012, 59 of the 95 action items contained in 

the Action Plan have been completed. 

I would like to share with the Subcommittee some of the highlights and successes that are a 

direct result of the implementation of the Action Plan and other recent initiatives performed by 

ISCD. These include: improving the SSP review process and increasing the pace of SSP 

review~; refining inspector tools and training; reinvigorating industry engagement on their 

1 Tiering determinations are dynamic; for example, a tiering determination can change when a facility voluntarily alters its operations in a 

materia! way that reduces its risk profile. "Final tiering" refers to a tiering assignment following a Secunty Vulnerability Assessment; it does not 

imply that this is the final tiering assignment a facility may receive 

4 
16 


82834.011

development of ASP templates; improving internal communications and organizational culture; 

and preparing for an external peer review of the CF A TS risk assessment methodology. 

SSP Review Process. ISCD is currently utilizing a refined approach for reviewing SSPs in order 

to move forward in a more efficient and timely fashion. At this time, IS CD has completed its 

review of all Tier 1 SSPs and has begun reviewing Tier 2 SSPs. As of September 9, 2012, of the 

Tier I SSPs reviewed, we have authorized or conditionally authorized SSPs for 73 facilities and 

approved 1. Of the remaining Tier 1 SSPs reviewed by NPPD, we are either validating results or 

reaching out to these facilities to obtain additional information or action in the hope of resolving 

the outstanding issues affecting their SSPs. Going forward, ISCD will continue to work to 

improve its SSP review process to make it as efficient and effective as possible. 

Inspections. Last Fall, ISCD established an Inspector Tools Working Group to ensure the 

Chemical Security Inspectors have up-to-date and, where appropriate, improved inspections 

procedures, policies, equipment, and guidance. In late spring 2012, ISCD finished updating and 

revising its internal inspections policy and guidance materials for conducting inspections. Over 

the course of the summer, ISCD conducted five inspector training sessions, which focused on the 

updated policy, procedures and related materials to prepare Chemical Security Inspectors to 

resume authorization inspections at facilities with authorized or conditionally authorized SSPs. 

As of July 16,2012, ISCD has resumed authorization inspections at Tier I facilities. This is a 

vital step for moving the CF A TS program toward a regular cycle of approving SSPs and 

conducting compliance inspections for facilities with approved SSPs. 

Alternative Security Programs (ASPs). Many members of the regulated community and their 

representative industry associations have expressed interest in exploring ways to use the ASP 

provisions of the CFA TS regulation to streamline the security plan submission and review 

process. In support of this, ISCD has been holding vigorous discussions with industry 

stakeholders in regard to their development and submission of ASPs. One particularly promising 

effort has been ISCD's engagement with the American Chemistry Council (ACC) in support of 

its efforts to develop an ASP template for use by interested members of its organization. The 

ACC has developed a template that was piloted at a facility in early August and is expected to be 

available for use by ACC members later this year. In addition, DHS has been in discussion with 

other industry stakeholders, including the Agricultural Retailers Association, about developing 

templates specific to their members. ASPs submitted by facilities using a template will be 

reviewed under the same standards that ISCD currently reviews SSPs. Additionally, DHS 

continues to review existing industry programs, such as ACC Responsible Care® and SOCMA 

ChemStewards®, to identify potential areas of engagement and further discussion. 

Internal Communications and Employee Morale. The Action Plan contains a number of items 

designed to improve internal communications and morale within ISCD. ISCD has implemented 

many of these action items and has made significant progress on many others. For instance, 

ISCD employees now contribute to and receive a monthly ISCD newsletter, which covers a wide 

variety of both field and headquarters activities. ISCD leadership has promoted staff 

engagement and a dialogue about issues and concerns through monthly town halls and a senior 

leadership open-door policy. ISCD staff has a standing invitation to participate in group opendoor sessions or to schedule one-on-one discussions with Division leadership. 

5 
17 


82834.012

ISCD is also moving forward with issuing vacancy announcements to hire a permanent 

leadership team; several announcements have already been posted and several others are nearing 

posting. Supervisors have been provided with additional supervisory training and guidance on 

performance monitoring. The Division has developed a mission statement, vision statement, and 

core values. As a result of these and other efforts, I believe that Division-wide morale is 

improving, which ultimately will pay dividends not only in improved staff retention, but also in 

improved staff performance and program execution. 

Risk Assessment Methodology Review. In light of prior revisions to the SV A risk assessment 

computer program for chemical facilities, NPPD has committed to doing a thorough review of 

the risk assessment process and keeping the Subcommittee apprised of any significant issues 

related to that review. In support of this, NPPD developed a three-phased approach, which is 

captured in the ISCD Action Plan and includes: documenting all processes and procedures 

relating to the risk assessment methodology; conducting an internal NPPD review of the risk 

assessment process; and initiating an external peer review of the risk assessment methodology. 

The Division has made significant progress on this action item by completing the first two steps. 

ISCD is also approaching completion of procurement actions for the external peer review, which 

is expected to begin before the end ofFY 2012. 

NPPD remains committed to both developing appropriate responses to any risk assessment issues 

that it identifies and keeping Congress and stakeholders apprised of any significant issues related 

to that review. 

Personnel Surety. Under CFATS Risk-Based Performance Standard 12 (RBPS 12), final highrisk chemical facilities are required to perform background checks on certain individuals with 

access to restricted areas or critical assets. NPPD has been seeking to implement a CF ATS 

Personnel Surety Program to enable facilities to comply with the requirement to identify 

individuals who may pose a risk to chemical security by enabling facilities to submit 

biographical information to NPPD. NPPD would compare this biographical information against 

information about known or suspected terrorists listed in the Terrorist Screening Database 

(TSDB). 

Although NPPD has the authority under CF A TS to implement the Personnel Surety Program, 

under the Paperwork Reduction Act (PRA) the Office of Management and Budget (OMB) must 

still approve how the NPPD proposes to collect the necessary information to conduct vetting 

against the TSDB. In June of2009, DHS began the process to obtain OMB approval by 

publishing in the Federal Register a notice soliciting public comments for 60 days. 

Following the public comment, DHS submitted the Information Collection Request (ICR) to 

OMB in June of2011. Since that time, the Department's position on how facilities can comply 

with RBPS 12 has evolved, thanks in large part to information the chemical industry has 

provided to us as part of the PRA process. As a result, in July of2012, the Department withdrew 

the ICR from OMB review. This has enabled the Department to engage in direct dialogue with 

security partners and with stakeholders in the regulated community about the CFA TS Personnel 

Surety Program. Additionally, the Department has learned a great deal about various facilities 

through visits to chemical facilities it has conducted. This on-the-ground knowledge of the 

facilities will help to inform the Department of any impacts that the Personnel Surety Program 

6 
18 


82834.013

will may have. The Department plans to re-initiate the PRA process by publishing a 60-day 

notice to solicit comment in the Federal Register in the near future. After that, the Department 

will concurrently publish a 30-day notice to solicit additional comments, and submit a new ICR 

for the CF ATS Personnel Surety Program to OMB for review. 

Outreach Efforts 

Since the establishment of CFATS in April 2007, NPPD and IS CD have taken significant steps 

to publicize the rule and ensure that the regulated community and other interested or affected 

entities are aware of and meeting its requirements. NPPD and IS CD management and staff have 

presented at hundreds of security and chemical industry conferences and participated in a variety 

of other meetings. As part of this outreach program, NPPD and ISCD have regularly updated 

impacted sectors through their Sector Coordinating Councils and the Government Coordinating 

Councils-including the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. 

NPPD and ISCD continue to collaborate within DHS and with other federal agencies in the area 

of chemical security, including routine engagement with: the USCG; the Transportation Security 

Administration; the Department of Justice's Federal Bureau of Investigation and Bureau of 

Alcohol, Tobacco, Firearms and Explosives; the NRC; and the Environmental Protection 

Agency. In addition, IS CD continues to focus on fostering solid working relationships with state 

and local officials including first responders. 

To promote information sharing, ISCD has developed several communication tools for 

stakeholder use, including: the Chemical Security website (www.DHS.gov/chemicalsecurity); a 

Help Desk for CFATS-related questions; a CF A TS tip-line for anonymous chemical security 

reporting; and CF ATS-Share, a web-based information-sharing portal that provides certain 

Federal, state, and local agencies access to key details on CFATS facility information as needed. 

ISCD Budget Priorities for FY 2013 

The President's Budget for FY 2013 requested $74.544 million for the Infrastructure Security 

Compliance Program, including funds for 253 full-time positions/242 full-time equivalents 

(FTE). The primary initiatives under Infrastructure Security Compliance are the implementation 

of the CFATS Program and the development and implementation of the proposed Ammonium 

Nitrate Security Program. In helping to develop the President's Budget, DHS considered as a 

priority the retention of basic CFA TS functionality. Accordingly, DHS prioritized its funding 

request to enable DHS to thoroughly and expediently review SSPs of CF A TS-covered facilities 

that pose the highest level of risk to ensure that such facilities' security measures meet applicable 

risk-based performance standards and to expedite the performance of inspections at those 

facilities. 

Conclusion 

ISCD, NPPD, and the Department are moving forward quickly and strategically to address the 

challenges before us. CFATS is reducing the risks associated with our nation's chemical 

infrastructure. We believe that CF A TS is making the nation safer and are dedicated to its 

success. As we implement CFA TS, we will continue to work with stakeholders to get the job 

7 
19 


82834.014

done, meet the challenges identified in the lSeD report, and execute a program to help prevent 

terrorists from exploiting chemicals or chemical facilities. 

Thank you for holding this important hearing. I would be happy to respond to any questions you 

may have. 

8 
20 


82834.015

GAO 

For Release on Delivery 

Expected at 10:00 a.m. EDT Tuesday, September 11, 2012 

GAO·12-567T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on the 

Environment and the Economy, 

Committee on Energy and Commerce, 

House of Representatives 

CRITICAL 

INFRASTRUCTURE 

PROTECTION 

DHS Is Taking Action to 

. Better Manage Its Chemical 

Security Program, but It Is 

Too Early to Assess Results 

Statement of Cathleen A. Berrick, Managing Director 

Homeland Security and Justice 

GAO 

Accountablllty * Integrity * Reliability 
21 


82834.016
22 


82834.017

Highlights of GAO~12-567T, a testimony 

before the Subcommittee on the Environment 

and the Economy, Committee on Energy and 

Commerce, House of Representatives. 

Why GAO Did This Study 

The events of September 11, 2001, 

triggered a national re-examination of 

the securijy of facilities that use or 

store hazardous chemicals in 

quantities that, in the event of a 

terrorist attack, could put large 

numbers of Americans at risk of 

serious injury or death. As required by 

statute, DHS issued regulations that 

establish standards for the security of 

high-risk chemical facilities. DHS 

established the CF A TS program to 

assess the risk posed by these 

facilities and inspect them to ensure 

compliance with DHS standards. ISCD, 

a division of IP, manages the program. 

A November 2011 internallSCD 

memorandum, prepared by ISCD 

senior managers, expressed concerns 

about the management of the program. 

This statement addresses (1) how the 

memorandum was developed and any 

challenges identified, (2) what actions 

are being taken in response to any 

challenges identified, and (3) the 

extent to which ISCD's proposed 

solutions require collaboration with 

NPPD or IP. GAO's comments are 

based on recently completed work 

analyzing the memorandum and 

related actions. GAO reviewed laws, 

regulations, DHS's internal 

memorandum and action plans, and 

related documents, and interviewed 

DHS officials. 

In a July 2012 report, GAO 

recommended that ISCD explore 

opportunities to develop measures, 

where practical, to determine where 

actual performance deviates. from 

expected results. ISCD concurred and 

has taken action to address the 

recommendation. 

View GAO-12-567T. For more information, 

contact Cathleen A. Berrick, (202) 512-8777, 

BerrickC@gao.gov. 

CRITICAL INFRASTRUCTURE PROTECTION 

DHS Is Taking Action to Better Manage Its Chemical 

Security Program, but It Is Too Early to Assess 

Results 

What GAO Found 

The November 2011 memorandum that discussed the management of the 

Chemical Facility Anti-Terrorism Standards (CFATS) program was prepared 

based primarily on the observations of the former Director of the Department of 

Homeland Security's (DHS) Infrastructure Security Compliance Division (ISCD), 

a division of the Office of Infrastructure Protection (IP) within the National 

Protection and Programs Directorate (NPPD). The memorandum was intended to 

highlight various challenges that have hindered ISCD efforts to implement the 

CFATS program. According to the former Director, the challenges facing ISCD 

included not having a fully developed direction and plan for implementing the 

program, hiring staff without establishing need, and inconsistent ISCD 

leadership-factors that the Director believed place the CFATS program at risk. 

These challenges centered on three main areas: (1) human capital issues, 

including problems hiring, training, and managing ISCD staff; (2) mission issues, 

including problems reviewing facility plans to mitigate security vulnerabilities; and 

(3) administrative issues, including concerns about NPPD and IP not supporting 

ISCD's management and administrative functions. 

ISCD has begun to take various actions intended to address the issues identified 

in the ISCD memorandum and has developed a 94-item action plan to track its 

progress. According to ISCD managers, the plan appears to be a catalyst for 

addressing some of the long-standing issues the memorandum identified. As of 

June 2012, ISCD reported that 40 percent (38 of 94) of the items in the plan had 

been completed. These include directing ISCD managers to meet with staff to 

involve them in addressing challenges, clarifying priorities, and changing ISCD's 

culture; and developing a proposal to establish a quality control function over 

compliance activities. The remaining 60 percent (56 of 94) that were in progress 

include those requiring longer-term efforts-Le., streamlining the process for 

reviewing facility security plans and developing facility inspection processes; 

those requiring completion of other items in the plan; or those awaiting action by 

others, such as approvals by ISCD leadership. ISCD appears to be heading in 

the right direction, but it is too early to tell if corrective actions are having their 

desired effect because ISCD is in the early stages of implementing them and has 

not yet established performance measures to assess results. 

According to ISCD officials, almost half of the action items included in the June 

2012 action plan require ISCD collaboration with or action by NPPD and IP. The 

ISCD memorandum stated that IP and NPPD did not provide the support needed 

to manage the CFATS program when the program was first under development. 

ISCD, IP, and NPPD officials confirmed that IP and NPPD are now providing 

needed support and stated that the action plan prompted them to work together 

to address the various human capital and administrative issues identified. 

_____________ United States Government Accountability Office 
23 


82834.018

Chairman Shimkus, Ranking Member Green, and Members of the 

Subcommittee: 

I am pleased to be here today to discuss the Department of Homeland 

Security's (DHS) efforts to address the various challenges in 

implementing and managing the Chemical Facility Anti·Terrorism 

Standards (CFATS) program. My statement today summarizes the 

testimony we delivered on July 26, 2012 before the House Committee on 

Appropriations, Subcommittee on Homeland Security.' The events of 

September 11, 2001, triggered a national re·examination of the security of 

facilities that use or store hazardous chemicals in quantities that, in the 

event of a terrorist attack, could put large numbers of Americans at risk of 

serious injury or death. Chemicals held at these facilities can be used to 

cause harm to surrounding populations during terrorist attacks; can be 

stolen and used as chemical weapons or as precursors (the ingredients 

for making chemical weapons); or stolen and used to build an improvised 

explosive device. To mitigate this risk, the DHS appropriations act for 

fiscal year 20072 required DHS to issue regulations to establish risk· 

based performance standards for securing high·risk chemical facilities, 

among other things. 3 DHS established the CFATS program to assess the 

risk, if any, posed by chemical facilITies; place high'risk facilities in one of 

four risk·based tiers; require high·risk facilities to develop security plans; 

review these plans; and inspect the facilities to ensure compliance with 

the regulatory requirements. DHS's National Protection and Programs 

Directorate (NPPD) is responsible for the CFATS program. Within NPPD, 

the Infrastructure Security Compliance Division (ISCD), a division of the 

Office of Infrastructure Protection (IP), manages the program. 

A November 2011, internallSCD mernorandum, prepared by ISCD's 

former Director in consultation with the former Deputy Director' and 

1GAO, Critical Infrastructure Protection; DHS Is Taking Action to Better Manage Its 

Chemical Security Program, but It Is too Early to Assess Results, GAO~12~515T 

(Washington, D.C.: July 2012). 

2Pub. L No. 109-295, § 550,120 Stat. 1355, 1388 (2006). 

3According to DHS, a high~risk chemical facility is one that. in the discretion of the 

Secretary of Homeland Security, presents a high risk of Significant adverse consequences 

for human life or health, national security, or critical economic assets if subjected to a 

terrorist attack, compromise, infiltration, or exploitation. 6 C.F.R. § 27.105, 

4The ISeD director who prepared the internal memorandum is no longer in that position, 

and the deputy director who assisted with the internal memorandum is now the director. 

Page 1 GAO·12·567T 
24 


82834.019

designated by DHS as "for official use only" (FOUO), expressed concerns 

about the management of the CFATS program. The ISCD memorandum, 

which was leaked to the media in December 2011, cited an array of 

challenges that, according to these officials, hindered ISCD's ability to 

implement and manage the CFATS program. 5 My statement today 

discusses: (1) how the memorandum was developed and what 

challenges were identified; (2) what actions are being taken to address 

the challenges identified: and (3) the extent to which ISCD's planned 

actions and proposed solutions require action to be taken by or in 

collaboration with NPPD or IP. 

This statement is based on work we recently completed for this 

subcommittee on the ISCD memorandum and related actions. To conduct 

this work, we reviewed applicable laws and regulations, as well as NPPD, 

IP, and ISCD policies and procedures for administering the CFATS 

program, analyzed the ISCD memorandum prepared by the former ISCD 

Director in consultation with the former Deputy Director, compared it with 

the proposed action plan ISCD officials prepared to address the 

challenges identified, and compared subsequent action plans to monitor 

ISCD's progress· Our results are based on the ISCD's action plan as of 

June 2012 so these results reflect the status of ISCD's progress up to that 

point in time. The details of our scope and methodology can be found in 

our July 2012 statement. In August 2012, ISCD provided us with an 

updated action plan which we used to document the additional action 

items completed between June 2012 and August 2012. We did not verify 

the status of these action items. 

We conducted this performance audit from February 2012 to July 2012 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

suffiCient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our analysis based 

on our audit objectives. 

DHS officials, the ISeD memorandum was never intended to be publicaUy 

6We initially reviewed an ISCD action plan developed in January 2012. ISeD periodically 

updated the plan to monitor progress on the action items and we reviewed 8 versions of 

the action plan up to and including one developed in June 2012. 

Page 2 GAO·12·567T 
25 


82834.020

Background Section 550 of the DHS appropriations act for fiscal year 20077 requires 

DHS to issue regulations establishing risk-based performance standards' 

for the security of facilities that the Secretary determines to present high 

levels of security risk, among other things. The CFATS rule was 

published in April 2007' and Appendix A to the rule, published in 

November 2007, listed 322 chemicals of interest and the screening 

threshold quantities for each.'° ISCD has direct responsibility for 

implementing DHS's CFATS rule, including assessing potential risks and 

identifying high-risk chemical facilities, promoting effective security 

planning, and ensuring that final high-risk facilities meet the applicable 

risk-based performance standards though site security plans approved by 

DHS. ISCD is managed by a Director and a Deputy Director and operates 

five branches that are, among other things, responsible for information 

technology operations, policy and planning, and providing compliance 

and technical support. From fiscal years 2007 through 2012, DHS 

dedicated about $442 million to the CFATS program. During fiscal year 

2012, ISCD was authorized 242 full-time-equivalent positions. For fiscal 

year 2013, DHS's budget request for the CFATS program was $75 million 

and 242 positions. 

L No. 109-295, § 550,120 stat 1355, 1388 (2006). 

8The CFATS rule establishes 18 risk-based performance standards that identify the areas 

for which a facility's security posture are to be examined, such as perimeter security, 

access control, and cyber security. To meet these standards, facilities are free to choose 

whatever security programs or processes they deem appropriate so long as DHS 

determines that the facWties achieve the requisite level of performance in each applicable 

standard 

'72 Fed. Reg. 17,688 (Apr. 9, 2007) (codified at 6 C.F.R. pt 27). 

1072 Fed. Reg. 65,396 (Nov. 20, 2007). According to DHS, CFATS nat only covers 

faciHties that manufacture chemicals but also covers facilities that store or use certain 

chemicals as part of their daily operations, This can include food~manufacturing facilities 

that use chemicals of interest in the manufacturing process, farms that use certain 

quantities of ammonium nitrate or urea fertilizers, or universities that use chemicals to do experiments, 

Page 3 GAO·12·567T 
26 


82834.021

Senior ISCD Leaders 

Developed the ISCD 

Memorandum to 

Highlight Various 

Challenges Hindering 

CFATS 

Implementation 

ISCD's Memorandum 

Based Largely on 

Observations of Senior 

ISCD Managers 

Our review of the ISCD memorandum and discussions with ISCD officials 

showed that the memorandum was developed during the latter part of 

2011 and was developed primarily based on discussions with ISCD staff 

and the observations of the ISCD former Director in consultation with the 

former Deputy Director. In November 2011 , the former Director and 

Deputy Director provided the Under Secretary with the ISCD 

memorandum entitled "Challenges Facing ISCD, and the Path Forward," 

These officials stated that the memorandum was developed to inform 

leadership about the status of ISCD, the challenges it was facing, and the 

proposed solutions identified to date, In transmitting a copy of the 

memorandum to congressional stakeholders following the leak in 

December 2011, the NPPD Under Secretary discussed caveats about the 

memorandum, including that it had not undergone the normal review 

process by DHS's Executive Secretariat and contained opinions and 

conclusions that did not reflect the position of DHS, 

The former ISCD Director stated that the memo was intended to begin a 

dialog about the program and challenges it faced, The former Director 

confirmed that she developed the memorandum by (1) surveying division 

staff to obtain their opinions on program strengths, challenges, and 

recommendations for improvement; (2) observing CFATS program 

operations, including the security plan review process; and (3) analyzing 

an internal DHS report on CFATS operations, 11 which, according to the 

former Director served as a basis for identifying some administrative 

challenges and corrective action, The senior ISCD and NPPD officials we 

contacted said that they generally agreed with the material that they saw, 

110HS Office of Compliance and Security, National Protection and Programs Directorate, 

Infrastructure Security Compliance Division (ISCD) Program Inspection, AprH-September, 

2011. 

Page 4 GAO-12-567T 
27 


82834.022

ISCD Management Was 

Concerned That 

Challenges Place the 

CFATS Program at Risk 

ISCD Has Begun to 

Take Various Actions 

Intended to Address 

Challenges Identified 

Action Plan 

Included Time Frames and 

Appears to be Helping 

Address Some Legacy 

Issues 

but noted that they believed the memorandum was missing context and 

balance. For example, one NPPD official stated that that the tone of the 

memorandum was too negative and the problems it discussed were not 

supported by sound evaluation. However, the official expressed the view 

that the CFA TS program is now on the right track. 

The ISCD memorandum discussed numerous challenges that, according 

to the former Director, pose a risk to the program. The former Director 

pointed out that, among other things, ISCD had not approved any site 

security plans or carried out any compliance inspections on regulated 

facilities. The former Director attributed this to various management 

challenges, including a lack of planning, poor internal controls, and a 

workforce whose skills were inadequate to fulfill the program's mission, 

and highlighted several challenges that have had an impact on the 

progress of the program. In addition, the memorandum provided a 

detailed discussion of the issues or problems facing ISCD, grouped into 

three categories: (1) human capital management, such as poor staffing 

decisions; (2) mission issues, such as the lack of an established 

inspection process; and (3) administrative issues, such as a lack of 

infrastructure and support, both within ISCD and on the part of NPPD and 

IP. 

ISCD is using an action plan to track its progress addressing the 

challenges identified in the memorandum, and, according to senior 

division officials, the plan may be helping them address some legacy 

issues that staff were attempting to deal with before the memorandum 

was developed. The January 2012 version of the proposed action plan 

listed 91 actions to be taken categorized by issue-human capital 

management issues, misSion issues, or administrative issues-that, 

according to the former ISCD Director, were developed to be consistent 

with the ISCD memorandum. However, the January 2012 version of the 

action plan did not provide information on when the action was started or 

to be finished. Eleven of the 12 ISCD managers (other than the former 

Director and Deputy Director) assigned to work as the coordinators of the 

Page 5 
28 


82834.023

!sCD's June 2012 Plan 

Update Showed 38 Action 

Items Completed 

individual action items told us that even though they were not given the 

opportunity to view the final version of the ISeD memorandum, the former 

Director provided them the sections of the action plan for which they were 

responsible to help them develop and implement any corrective actions. 

They said that they agreed that actions being taken in the plan were 

needed to resolve challenges facing ISeD. Our discussions with these 

officials also showed that about 39 percent (37 of 94) of the items in the 

March and June 2012 action plans addressed some legacy issues that 

were previously identified and, according to these officials, corrective 

actions were already underway for all 37 of these items. 

Our analysis of the June 2012 version of the ISeD action plan showed 

that 40 percent of the items in the plan (38 of 94) had been completed. 

The remaining 60 percent (56 of 94) were in progress. Of the 38 

completed items, we determined that 32 were associated with human 

capital management and administrative issues, including those involving 

culture and human resources, contracting, and documentation. The 

remaining 6 of 38 action items categorized by ISeD as completed were 

associated with mission issues. Figure 1 shows the status of action items 

by each of the three categories as of June 2012. 

Figure 1: Status of ISeD Action Plan by Category. as of June 2012 

Human capital issue challenges 

f\" 

57% ) 

Mission issue challenges 

L-------------16 

Number of action items complete 

Number of action items in progress 

Source, GAO analysis of !SeD data 

Page 6 

Administrative issue challenges 

15 

L-------------27 

GAO-12-567T 
29 


82834.024

Almost Half of ISCD's 

Action Item Completion 

Dates Had Been Extended 

since April 2012 

For the remaining 56 items that were in progress as of June 2012, 40 

involved human capital management and administrative issues. 

According to ISCD officials, these 40 issues generally involved longerterm efforts-such as organizational realignment-or those that require 

approval or additional action on the part of IP or NPPD. Sixteen of 56 

remaining actions items in progress covered mission issues that will likely 

also require long-term efforts to address. 

As of August 2012, ISCD reported that it had completed another 21 action 

items, of which 8 were to address mission-related issues. We did not 

verify ISCD's efforts to complete actions since June 2012. However, we 

have recently begun a follow-up review of CFATS at the request of this 

and other committees, which will focus on DHS's efforts to address 

mission-related issues. We expect to report the results of these efforts 

early in 2013. 

Our analysis of the April and June versions of the plan shows that the 

division had extended the estimated completion dates for nearly half of 

the action items. Estimated completion dates for 52 percent (48 of 93 

items) 12 either did not change (37 items) or the date displayed in the June 

2012 plan was earlier than the date in the April 2012 version of the plan 

(11 items). Conversely, 48 percent (45 of 93) of the items in the June 

2012 version of the plan had estimated completion dates that had been 

extended beyond the date in the April 2012 plan. Figure 2 shows the 

extent to which action plan items were completed earlier than planned, 

did not change, or were extended, from April 2012 through June 2012, for 

the human capital management, mission, and administrative issues 

identified in the plan. 

121SCO data showed that 93 of 94 action items were consistent between the April 2012 

and June 2012 action plans; therefore, computation of the estimated completion dates 

was based on 93 total items. One action item in the April 2012 plan dealing with strategies 

for managing lSCD funding levels was removed from the June 2012 plan because after 

the analysis was prepared and submitted to NPPD, the decision was made to delete the 

item from the plan. The funding action item was replaced in the June 2012 action plan with 

an action item to conduct a peer review of the faciUty tiering process and formula. For 

purposes of this analysis, we used the 93 action ltems (instead of 94 action items) that 

were consistent between the April and June 2012 action plans. 

Page 7 GAO·12·567T 
30 


82834.025

Figure 2: Change in CFATS Action Plans Estimated Completion Oates from April 2012 to June 2012 

Issue 

Action Plan Perfonnance 

Measures Could Help 

Gauge Progress 

Number of action items" 

n Completed early 

~ No.::haflge 

IIIi Extended 1 to 3Q days 

_ E:w:tended31 to 60 days 

_ Ex\ended611oSOdays 

_ Extended over 90 days 

S1)urca GAO analysis of ISCO data 

4S 

alSCD data showed that 93 of 94 action items were consistent between the April 2012 and June 2012 

action plans, therefore, computation of the estimated completion dates was based on 93 total items. 

One action item in the April 2012 plan deallng with strategies for managing ISeD funding levels was 

removed from the June 2012 plan because after the analysis was prepared and submitted to NPPD, 

the decision was made to delete the item from the plan. The funding action item was replaced in the 

June 2012 with an action item to conduct a peer review of the facility tiering process and formula. For 

purposes of this analysis, we used the 93 action items that were consistent between the April and 

June 2012 action plans. 

IseD officials told us that estimated completion dates had been extended 

for various reasons, For example, one reason for moving these dates was 

that the work required to address some items was not fully defined when 

the plan was first developed and as the requirements were better defined, 

the estimated completion dates were revised and updated, In addition, 

ISeD officials also stated that timelines had been adversely affected for 

some action items because staff had been reassigned to work on higher 

priority responsibilities, such as reducing the backlog of security plans 

under review, 

IseD, through its action plan, appears to be heading in the right direction 

towards addressing the challenges identified, but it is too early to tell if the 

action plan is having the desired effect because (1) the division had only 

recently completed some action items and continues to work on 

completing more than half of the others, some of which entail long-term 

PageS GAO·12-567T 
31 


82834.026

ISCD Officials Stated 

That Almost Half of 

the Action Items 

Required 

Collaboration with or 

Action by NPPD or IP 

changes, and (2) ISCD had not yet developed an approach for measuring 

the results of its efforts. ISCD officials told us that they had not yet begun 

to plan or develop any measures, metrics, or other documentation 

focused on measuring the impact of the action plan on overall CFATS 

implementation because they plan to wait until corrective action on all 

items has been completed before they can determine the impact of the 

plan on the CFATS program. For the near term, ISCD officials stated that 

they plan to assess at a high level the impact of the action plan on 

CFATS program implementation by comparing ISCD's performance rates 

and metrics pre-action plan implementation and post-action plan 

implementation. 13 However, because ISCD will not be completing some 

action items until 2014, it will be difficult for ISCD officials to obtain a 

complete understanding of the impact of the plan on the program using 

this comparison only. 

In our July 2012 statement, we recommended that ISCD look for 

opportunities, where practical, to measure results of their efforts to 

implement particular action items, and where performance measures can 

be developed, periodically monitor these measures and indicators to 

identify where corrective actions, if any, are needed. The agency 

concurred with our recommendation and developed a new action item 

(number 95) intended to develop metrics for measuring, where practical, 

results of efforts to implement action plan items, including processes for 

periodic monitoring and indicators for corrective actions. This action item 

is in progress. 

According to ISCD officials, almost half of the action items included in the 

June 2012 action plan either require ISCD to collaborate with NPPD and 

IP or require NPPD and IP to take action to address the challenges 

identified in the ISCD memorandum. NPPD, IP, and ISCD officials have 

been working together to identify solutions to the challenges the 

memorandum identified and to close pertinent action items. According to 

division officials, 46 of the 94 action items included in the June 2012 

action plan required action either by NPPD and IP or collaboration with 

NPPD and IP. This includes collaborating with NPPD officials 

13According to ISeD officials, ISeD uses a performance measure to track the 

performance of the CFATS program overall, but as of June 2012 did not have 

performance measures in place to track the progress of the action plan, or particular 

action items. 

Page 9 GAO·12·567T 
32 


82834.027

GAO Contact and 

Staff 

Acknowledgements 

(441022) 

representing the NPPD human capital, facilities, and employee and labor 

relations offices, among others, and with IP's Directorate of Management 

Office. 14 As of June 2012, 13 of the 46 items that require action by or 

collaboration with NPPD or IP were complete; 33 of 46 were in progress. 

As of August 2012, ISCD reported that it had completed 8 more of these 

action items, such that 21 of the 46 were complete and 25 were in 

progress. We did not verify ISCD's efforts to close these additional action 

items. 

Chairman Shimkus, Ranking Member Green, and members of the 

subcommittee, this completes my prepared statement. I would be happy 

to respond to any questions you may have at this time. 

For information about this statement please contact Cathleen A. Berrick, 

Managing Director, Homeland Security and Justice, at (202) 512-8777 or 

BerrickC@gao.gov. Contact points for our Offices of Congressional 

Relations and Public Affairs may be found on the last page of this 

statement. Other individuals making key contributions include Stephen L. 

Caldwell, Director; John F. Mortin, Assistant Director; Ellen Wolfe, 

Analyst-in-Charge; Charles Bausell; Jose Cardenas; Andrew M. Curry; 

Michele Fejfar; Tracey King; Marvin McGill; Mona E. Nichols-Blake; and 

Jessica Orr. 

IP Directorate of Management Office is responsible for providing IP divisions with 

program management support such as training and facilities management. 

Page 10 
33 


82834.028

This is a work of the U.S, government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 
34 


82834.029

GAO.s Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO's commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO's website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select .. E-mail Updates." 

The price of each GAO publication reflects GAO's actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO's website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact: 

Website: http://www.gao.gov/fraudnetifraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548 

Chuck Young, Managing Director, youngcl@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

..... 

-~ 

Please Print on Recycled Paper. 
35 

QUESTIONING OF RAND BEERS, UNDER SECRETARY, NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, DEPARTMENT OF HOMELAND SECURITY, ACCOMPANIED BY 

DAVID WULF, DIRECTOR, INFRASTRUCTURE SECURITY COMPLIANCE DIVISION, OFFICE OF INFRASTRUCTURE PROTECTION, NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, DEPARTMENT OF HOMELAND SECURITY; AND 

CATHLEEN A. BERRICK, MANAGING DIRECTOR, HOMELAND 

SECURITY AND JUSTICE, GOVERNMENT ACCOUNTABILITY 

OFFICE 

Mr. SHIMKUS. And so I will start. 

Mr. Beers, it is my understanding from your Web site that you 

have one facility that is approved under the program. And of that 

one, what is its plan on personnel assurance? 

Mr. BEERS. Sir, we have now two plans that have been approved. 

Those approvals are conditional pending the completion of the response to Risk-Based Performance Standard 12, which is the personnel surety standard. So we are working actively now to reintroduce the request to OMB for the collection program that we need 

to move forward. 

But let me say three things about that. 

Mr. SHIMKUS. Quickly. 

Mr. BEERS. First, Ranking Member Green, TWIC will be included in that. 

We will also have the opportunity for entire companies and service providers to be able to submit for their entire companies. And 

they will be authorized to go to any plant that they go to that is 

covered by this program. 

And, thirdly, we are going to work this program heavily with industry to make sure that we move as quickly as possible, but recognizing their needs, as well. 

Mr. SHIMKUS. You understand my concern. If we have two that 

are approved and we still don’t have the personnel assurance issue, 

it is hard for me to understand how we say it is conditionally approved without the whole ball game—a standard being reached 

across the board. I know we want to send positive signals, but we 

don’t want to send false signals, either, that we are better off and 

we have a full program. 

Do you want to respond, Mr. Beers? 

Mr. BEERS. Sir, I totally agree with you that we don’t want to 

leave any security requirement not fulfilled. But it was our view 

that the conditional authorization process, because of the slowness 

with which we were getting the necessary personnel surety questions answered, meant that we believe that we ought to move forward with the conditional authorization and catch up as quickly as 

possible with the personnel assurance. 

Mr. SHIMKUS. OK. 

Let me move to the—the last hearing, we also had an issue because all facilities were placed into the same tier. So we had a big 

debate about, how do we get risk tiering, and what is the methodology, and let’s make sure we have the proper people doing that. 

And my understanding is, risk tiering is a formula; is that correct? 

Mr. BEERS. Yes, sir. 

36 

Mr. SHIMKUS. We have a formula to do that. And what comprises 

the formula? 

Mr. BEERS. Sir, there are a series of factors that are involved in 

that formula. First of all, we—— 

Mr. SHIMKUS. We have to go quickly. 

Mr. BEERS. The—— 

Mr. SHIMKUS. How about if I just help out here? Threat times 

vulnerability times consequence is the risk factor, correct? 

Mr. BEERS. That is the essential equation, and then each of those 

elements has sub-elements within it. 

Mr. SHIMKUS. So let me ask about, how do you—I don’t claim to 

be a great mathematician,but I understand formulas and I understand constants and I understand variables. One of our concerns is 

that vulnerability you have as a constant versus a variable, and 

that concerns us in the formula. 

In fact, I would like to go to the GAO. Did you know that, in this 

formula, that for that issue of vulnerability, that vulnerability is 

listed as a constant and not a variable? 

Ms. BERRICK. We do know that, Chairman, and we are looking 

at that right now. 

I think the specifics of this are for official use only. But to talk 

about this at an unclassified level, we found a similar—we look at 

how DHS calculates risk scores across the Department as a part 

of a number of our reviews. We found a similar problem in how 

they calculate risk for a major grant program and, in fact, recommended that they not hold vulnerability constant. DHS implemented that recommendation in the last grant cycle and varied it. 

So we have cited that as a concern in past work. 

Mr. SHIMKUS. And the point being, two similar facilities—one in 

downtown Manhattan; one outside Olney, Illinois—two very different risk portfolios. And so that is why we would argue that there 

should be a variable aspect on that formula. 

And from last time, how do you move a facility through the site 

security process, approve SSPs, inspect, et cetera, when there is no 

personnel surety plan that assures a facility manager that no one 

in the plant is on the terrorist watch list? It is kind of going back 

to the previous question. 

Mr. BEERS. Sir, there is more to the site security plan than simply the individuals involved, which is not to say that that is not 

a very significant and important part. So the question is, what are 

the other security provisions within the plan that we and they can 

record and review and inspect? 

Mr. SHIMKUS. Thank you. My time is expired, but I want to keep 

this going, and I appreciate that response. 

I would just say that, in chemical facilities, probably the biggest 

threat would be someone internally being able to get inside the facility and know the facility. So of all of the threats, that is probably 

the biggest one, I would venture to guess. 

So, with that, I would yield to the ranking member, Mr. Green, 

for 5 minutes. 

Mr. GREEN. Thank you, Mr. Chairman. 

Secretary Beers, as of 2 days ago, the Tier 1 site plans reviewed 

or authorized were 73, and 2 that were approved. 

37 

What does ‘‘conditionally authorized’’ mean? Does that mean that 

they can continue to operate? Or is there—— 

Mr. BEERS. That means that they can move forward with implementation of the site security plan elements that were approved, 

and that we come back when we have a personnel surety program 

that we have agreed on and implement those. 

But let me just make one point with respect to personnel surety. 

It is not that this government has been quiet or inattentive to looking at insider threats within this area. FBI, which we work in partnership with, has a very robust program of looking for threats 

within the country and ensuring that they are being inspected. 

This program would be an additional program to the excellent work 

that the FBI is doing on a daily basis. 

Mr. GREEN. How long does it take to get a plan from conditionally approved to approved? 

Mr. BEERS. That is going to depend, sir, on when the personnel 

surety risk-based performance standards—excuse me—when we 

agree on what the standards are that they are supposed to meet. 

So, right now, we are looking at publishing the request for information in the next 30 days and collecting that information over a 

60-day period, and then going forward with our proposal to OMB. 

Mr. GREEN. You mentioned that as of July the 16th, in your 

statement, ISCD has resumed authorization inspections on Tier 1 

facilities. How many inspections, on the average, are you conducting a month? 

Mr. BEERS. David, do you want to answer that question? 

Mr. WULF. We have a total of about 10 inspections scheduled 

during the month of September. We anticipate continuing to increase the pace of inspections going forward. So I think, you know, 

you will see hundreds of inspections occurring over the course of 

the next year. 

Mr. GREEN. OK. At that rate, how long do you think it will take 

to get to all those sites that are awaiting inspection? A year? 

Mr. WULF. Well, the sites that are awaiting inspection are those 

that have received their authorization, and right now those are 73 

sites. Several of those have already been inspected. We have conducted a total of 19 authorization inspections to this point. The remainder of those 73 and additional ones that we anticipate authorizing over the next months will certainly be inspected in the next 

year. 

Mr. GREEN. And I would hope folks are moving into the conditional authorization, so that group will be expanding, I assume. 

Mr. WULF. Yes, the numbers of finally approved SSPs will certainly be, you know, continuing to grow. 

Mr. GREEN. Given the current status of the SSP tool, has DHS 

explored how to better use the authority, use alternative security 

plans to help expedite the CFATS approval process? 

Mr. BEERS. Yes, sir. That is an important element of our efforts. 

We have been working with the American Chemistry Council. We 

have run a pilot program with an alternative security plan with 

them and are hoping to issue some guidance for the members of 

that council to be able to use the alternative security plan. We are 

also working with agricultural industries, looking at the same possibility. 

38 

Mr. GREEN. OK. Well, I appreciate you being willing to use similar credential programs like TWIC. The Federal Government really 

doesn’t need to reinvent the wheel. TWIC is not perfect, believe me, 

as I learned when it was rolled out and we will see as we do the 

reissuing of them. But we need to learn from that and have one 

ID, whether you are on water side or on land side, your facility. 

The internal DHS memo leaked to the press last year articulated 

programmatic breakdowns, serious deficiencies. What is the 

timeline for the full implementation of the 91 recommendations for 

improving the CFATS program? 

Mr. BEERS. Sir, with respect to all 95 now of those, some of them 

are going to go on over a longer period of time, but we are moving 

as quickly as possible. We have, since we submitted the testimony, 

the written testimony with the September 4 deadline, increased the 

number of items that have been completed. 

And, David, I don’t want to speak to the precise number, but 

when would you say we would be up in the 80s? 

Mr. WULF. I would say we will be in the 80s by the end of the 

calendar year, most likely. 

Mr. GREEN. OK. 

Mr. Chairman, I am out of time, and I have one question on the 

site security plan I would like to submit and hear the answer. And 

I appreciate you all for getting back to us. 

Mr. SHIMKUS. Thank you. Without objection. 

The chair recognizes the vice chair of the subcommittee, Mr. 

Murphy, for 5 minutes. 

Mr. MURPHY. Thank you, Mr. Chairman. 

And thank you to our witnesses today. 

I just want to verify. So the number of site security plans that 

have been approved is two? 

Mr. WULF. Two, sir. 

Mr. MURPHY. You got the funding in 2006 to go forward on this; 

am I correct? 

Mr. BEERS. Excuse me? 

Mr. MURPHY. The funding came forth to start these inspections 

in 2006; is that correct? 2007? It was a few years ago? 

Mr. BEERS. I don’t know whether it came forward in—the authorization occurred then. 

Mr. MURPHY. Authorization, OK. 

Mr. BEERS. But we have not been in a position to actually finally 

approve them, really, until this summer, in part because of the 

management problems that have been revealed and in part because 

as we have gone forward with the program we have learned a 

whole lot. And the whole lot that we have learned has also created 

the appreciation that it was more complicated than it was originally thought to be at the beginning of the program. 

Mr. MURPHY. So how long have you been getting the money, and 

how much money is it you have been receiving to do this, then? 

Mr. BEERS. I believe the total amount of money that we have received is slightly under $500 million. 

David? 

Mr. WULF. Yes, I think on the order of $400 million, $450 million. 

39 

Mr. MURPHY. Wow. And we still have, what, over 4,000 plans to 

review? 

Mr. BEERS. We have about 4,400 plans to review. We have 4,433 

facilities that have been designated or have preliminary designations as being in the high-risk category. 

Mr. MURPHY. So we hope this goes better because, otherwise, you 

are at the rate of approving them all within a few centuries, and 

we wanted to help you speed that up. 

You have said that the inspectors weren’t well-trained and there 

was a number of problems. How many inspectors are trained now? 

Mr. BEERS. All the inspectors that we have. The number is over 

100. A hundred and fourteen, I believe, is the actual number. And 

that training about doing the inspections was completed during the 

month of July. 

Mr. MURPHY. And they are all qualified to do the inspections? 

Mr. BEERS. Yes, sir. 

Mr. MURPHY. How many inspectors are needed to do each plan? 

Mr. BEERS. We have a planned workforce that is in—David, 

about 120-something overall? 

Mr. WULF. Yes, yes, we do. And that will encompass ammonium 

nitrate inspections when that program comes on line. 

Mr. MURPHY. But, I mean, how many people do you need for 

doing each one? 

Mr. WULF. It varies depending on the size and scope of the facility, but, you know, I would say anywhere from two to three, four, 

five. 

Mr. MURPHY. So I am still looking here at—you have about $2 

million per person there to do this, and you need two or three to 

do each one. Using those kinds of numbers and those figures, when 

do you anticipate you will even reach the halfway point with these 

inspections? 

Mr. WULF. We anticipate within the next year that we will have, 

you know, authorized, conducted inspections. And if all goes well 

with the site security plans, we will have approved close to 300 

plans. 

Mr. MURPHY. That still leaves us 3,500 or so to do. I know you 

are concerned, and we are too. I am trying to find ways we can 

help you. 

Mr. SHIMKUS. Would the gentleman yield for 1 second? 

Mr. MURPHY. Yes. 

Mr. SHIMKUS. What I would weigh in is, that is why we need to 

properly tier the facilities. And that is why this debate that is 

going on about alternative security plans is very, very important, 

so that we use the plans that are already established out there in 

industry which are trying to do the same thing, for the most part, 

and work together versus against each other. 

Mr. MURPHY. Precisely. No, no, I want to work together. I am 

just trying to find out if there are specific recommendations of 

things you need from us to facilitate that in moving forward. Because we know you want to be accurate, and we know you want 

to do this in a way that protects public safety and works with the 

things that industry has found. 

And so I am wondering, in the process of going through, are you 

finding ways in this that, in addition to the people that you have 

40 

approved for the inspections, which the chairman was mentioning, 

within the industry, can facilitate that and actually speed up this 

process in a way that helps too? Is there something that we can 

learn from that? 

Mr. BEERS. Sir, that is in large measure what we are about right 

now, which is to ensure that the people are trained, to ensure that 

the review process to get the plans to the authorization stage so 

that we can send out the inspectors to do that moves more quickly 

and more efficiently than it has in the past. 

And I think that the record since the review process to make the 

internal reviews go faster has shown an increase. I think that the 

inspection plan training has increased the number of inspections. 

So I think we are moving at a rate that is going to be increasing. 

But I have to say here, sir, it will not help us if the House Appropriations Committee appropriation level for this program, which 

cut $40 million—— 

Mr. MURPHY. If I might add, I know oftentimes when I am visiting businesses, they are very concerned that government seems to 

come in, work against them, doesn’t ask them for their assistance. 

And I would like to echo what the chairman said, that, I mean, 

these are people who also care about their communities, their families, their workers. And I hope that you do talk with them and see 

what you can learn from so many of these companies because they 

do want to facilitate and move this forward. 

And I yield back. Thank you. 

Mr. SHIMKUS. The gentleman yields back his time. 

It is tough to argue dollars and cents when we have a track 

record of millions of dollars per individual. So I wouldn’t go down 

that route, Mr. Beers. 

The chair would now recognize my colleague from North Carolina, Mr. Butterfield, for 5 minutes. 

Mr. BUTTERFIELD. Let me thank you very much, Mr. Chairman, 

and certainly thank the three witnesses for coming forward today 

with your testimony. 

I am going to not take up the entire 5 minutes, but I do want 

to ask Secretary Beers and possibly Mr. Wulf a very short question. 

I am told that the Department has a hotline for whistleblowers. 

That is what my staff tells me, that there is now in place a hotline 

for whistleblowers and that anyone can call that hotline with security concerns. 

Department employees have whistleblower protections, but what 

protections, if any, cover facility employees and even the general 

public? Mr. Beers, can you help me with that? 

Mr. BEERS. I am going to turn to David to answer the question 

about the hotline. 

But it is certainly our view that we solicit both from within the 

Department of Homeland Security and from the private sector and 

from citizens any indication of issues that we ought to pay attention to. 

The protection involved there will be that we will provide anonymity if anonymity is requested. That is a basic policy of hotlines, 

if that is what the person wants. So if it is from an employee of 

the company, we will keep that—— 

Mr. BUTTERFIELD. What about downstream at the facilities? 

41 

Mr. BEERS. Yes. 

Mr. BUTTERFIELD. The same thing with the facilities? 

Mr. BEERS. Yes. I mean, insofar as they tell us. We are not going 

to reveal the names of the individuals who gave us that information if they want their identity protected. 

Mr. BUTTERFIELD. And the same with the general public? 

Mr. BEERS. And the same for the general public, yes, sir. 

Mr. BUTTERFIELD. All right. 

Mr. WULF. And we do maintain, as the Under Secretary noted, 

a tip line, a CFATS-focused tip line, so members of the public, facility personnel can call in and report concerns, can report information about facilities that may, you know, benefit from being part of 

the CFATS program. 

Mr. BUTTERFIELD. All right. 

More than 2,700 facilities have eliminated or reduced holdings of 

dangerouschemicals, so they are no longer considered high-risk facilities. How does DHS ensure those facilities do not increase the 

amount of those chemicals in their inventory at a later date? 

Mr. BEERS. David? 

Mr. WULF. Well, those facilities—and, you know, if I can mention, you know, that is one of the many successes that we view in 

the CFATS program to this point. And there is a pretty significant 

list of things that America has received for its investment in 

CFATS. 

But with regard to those facilities, having been part of the program, having gone through the initial Top-Screen, they are made 

aware of their obligation when they bring into the facility chemicals above the screening threshold quantity that are on the list of 

322 chemicals of interest, their obligation to report that to us. So 

they are fully aware of that and, you know, meet those obligations. 

So facilities come back into the program, as well. 

Mr. BUTTERFIELD. OK. 

And now to the managing director: The Department of Homeland 

Security Infrastructure Security Compliance Division completed 21 

of 94 items from its action plan between June and September of 

this year. And prior to that, the Department had only completed 

38 items. 

Is DHS now completing the 94-item action plan at a faster rate 

than the GAO anticipated? 

Ms. BERRICK. I think they are making good process on the action 

plan. They demonstrated their commitment. They are actively 

tracking it. We had some suggestions to provide some additional 

details on the plan, which they have incorporated. 

The one thing I would mention about the action plan, I think it 

is a very good first step. However, you know, to address these 

issues that were highlighted in the management memo is going to 

take leadership, sustained leadership, support over the long term. 

Some of these action plans are designed to develop plans to, you 

know, implement a program—for example, a framework to create 

a quality division. While that is very important, the actual execution of this quality division, how they oversee this process, is really 

what is going to be critical. 

So we think it is a very good first step, but it is going to require 

long-term and sustained leadership support to refine these actions, 

42 

update them as needed, and make sure that they execute on the 

plans that they have put in place. 

Mr. BUTTERFIELD. All right. 

And I will end where I began, with Mr. Beers or Mr. Wulf. You 

mentioned that 73 facilities have authorized or have conditionally 

authorized Tier 1 security plans. Are there any additional steps 

those facilities must complete before inspection and approval? 

Mr. BEERS. No, sir. That means that they are ready for inspection. The ones that haven’t been authorized or conditionally authorized either need to provide more data or we need to have a better 

understanding of the data that they did provide. 

Mr. BUTTERFIELD. Do the steps vary across facilities? 

Mr. BEERS. Excuse me? 

Mr. BUTTERFIELD. Do the final steps vary across the different facilities? 

Mr. BEERS. Well, no facility is necessarily the same, so what they 

need to do in order to meet the Risk-Based Performance Standards 

may be different for each facility, which means that there is no 

automatic template, when you look at a response, that either it is 

‘‘yes’’ or ‘‘no.’’ You have to look at what they actually said with respect to that particular performance standard and make sure that 

it matches what the performance standard lays out. 

Mr. SHIMKUS. The gentleman’s time has expired. 

Mr. BUTTERFIELD. Thank you, Mr. Chairman. 

Mr. SHIMKUS. The chair now recognizes the gentleman from Colorado, Mr. Gardner, for 5 minutes. 

Mr. GARDNER. Thank you, Mr. Chairman. 

And thank you to the witnesses for joining us today. 

Mr. Beers, I want to ask a couple of questions to follow up on 

a committee hearing we had February 3rd, 2012. I want to read the 

transcript from about 30 seconds’ worth of our conversation. 

I started the conversation by asking about the Anderson Wulf 

memorandum and said, ‘‘So the inspector general has looked into 

this?’’ 

And your response was, ‘‘The inspector general has access to 

these reports, yes, sir, but this was not done by—′′ 

And I stated, ‘‘Have you had conversations with the inspector 

general?’’ 

Mr. Beers: ‘‘With respect to this report?’’ 

‘‘Yes.’’ 

Mr. Beers: ‘‘I can’t speak to that. I have not personally had that 

conversation.’’ 

And I followed up with, ‘‘But he has this memorandum?’’ 

Your response to that was, ‘‘As with all these kinds of reports, 

yes, they are available.’’ 

‘‘They are available, or he has them? I mean, you have sent it 

to him?’’ 

Your response was, ‘‘I will have to confirm that, sir.’’ 

And so, Mr. Beers, to follow up with that, you never did get back 

to me or to the committee to confirm that you had given the Anderson memo to the inspector general, did you? 

Mr. BEERS. Yes, sir. 

Mr. GARDNER. You got back to us? 

43 

Mr. BEERS. I am sorry, I am not certain that we got back to you. 

But, yes, they have it. 

Mr. GARDNER. OK. But I don’t think you got back to me. I certainly never received the information. You didn’t get back to this 

committee. 

But it was after this committee hearing, it was after the February 3rd committee hearing, when the inspector general had 

watched the broadcast of our interaction, and it was more than a 

month after it was all over the national news and 2 months after 

you received the memorandum that the IG called you to obtain the 

memorandum.Is that correct? 

Mr. BEERS. We had a conversation immediately after this hearing, yes, sir. 

Mr. GARDNER. And when did he get the report then? 

Mr. BEERS. I can’t say the specific day on which he got it. 

Mr. GARDNER. It was 2 month after the conversation. 

And, again, you didn’t give it to him right away after the committee hearing. After that conversation, did you give it to him right 

away? Surely you remember that. 

Mr. BEERS. I did not personally give it to him. I asked my staff 

that it be given to him immediately, per the conversation that he 

and I had. 

Mr. GARDNER. And staff was directed to immediately give it to 

him? 

Mr. BEERS. Yes, sir. 

Mr. GARDNER. And the memorandum, though, didn’t go out until 

May. Is that correct? 

Mr. BEERS. Sir, I don’t have that information. 

Mr. GARDNER. Do you have staff here that could answer that? 

Mr. BEERS. David? 

Mr. WULF. I don’t believe I can answer that, sir. 

Mr. GARDNER. And so, here is the problem that I have. And that 

is why I would ask you for the full story here. 

How many times have you ever communicated with either Richard Skinner or Charles Edwards, in their respective positions as inspector general at DHS or the acting inspector general, or anyone 

else from the DHS Inspector General Office about the CFATS program? 

Mr. BEERS. I have talked to Mr. Edwards on at least, I want to 

say—I am positive that I have spoken to him on at least three occasions. And I could have had other conversations with him beyond 

that, but I don’t recall. 

Mr. GARDNER. And were those conversations started by you, or 

were they initiated by—who initiated those conversations? 

Mr. BEERS. In one case, it was him. In the other cases, it was 

me. 

Mr. GARDNER. And so, you know, have you discussed the conduct 

of an audit inspection or investigation of the CFATS program? Was 

that the purpose of the conversation? 

Mr. BEERS. We had a conversation about that, yes. 

Mr. GARDNER. And that was a conversation that you started or 

that they started? 

Mr. BEERS. I believe that was one that I started. 

44 

Mr. GARDNER. And have you or anyone in NPPD, IP, or ISCD 

ever suggested that the Homeland Security inspector general come 

in and look at the problems being encountered by CFATS? 

Mr. BEERS. Sir, as a result of that round of hearings, a Member 

of Congress requested the IG to come in and look at it. When—— 

Mr. GARDNER. But you never? 

Mr. BEERS. When he and I had the conversation about the management report, I did not request that he come in and look at it, 

but I certainly said we are open to anything that you believe is appropriate to looking at this program. 

Mr. GARDNER. And so the recommendations by—so nobody, 

again, nobody in NPPD, IP, or ISCD ever suggested that? 

Mr. BEERS. To? 

Mr. GARDNER. To come in and look at the problems being encountered by CFATS. That was all a Member of Congress that suggested that. 

Mr. BEERS. There was a discussion in the fall of 2010 as to 

whether or not the inspector general should be invited to conduct 

a management review, which would have required us to pay them 

to hire an outside consultant to conduct that review. When we 

looked at—— 

Mr. GARDNER. And that was a suggestion that they had made? 

Mr. BEERS. Excuse me? 

Mr. GARDNER. That was a suggestion that somebody in one of 

the—— 

Mr. BEERS. That was a suggestion that Assistant Secretary Todd 

Keil made in a memo—— 

Mr. GARDNER. And so what did you do with that recommendation? 

Mr. BEERS. Excuse me? 

Mr. GARDNER. What did you do with that recommendation? 

Mr. BEERS. We sat down in senior leadership, including Assistant Secretary Keil, and decided that we could perform that particular review within Office of Compliance and Security, which exists within NPPD but not within IP, and that we could do it more 

quickly and we could do it without an additional cost to the program. 

And that report was done and delivered in September of 2011 

and became part of the management review that Penny Anderson 

and David Wulf undertook. The results are in that effort. 

Mr. GARDNER. So just to follow up, with this most recent February 3rd hearing, the revelations in the Anderson-Wulf memo, did 

anyone—I will follow up again—did anyone in NPPD, IP, or ISCD 

ever suggest to you that DHS IG come in and look at the problems 

being encountered? 

Mr. BEERS. After that hearing, no. 

Mr. SHIMKUS. The gentleman’s time has expired. 

Mr. Barrow, do you seek recognition? 

The chair now recognizes the gentleman from Ohio, Mr. Latta, 

for 5 minutes. 

Mr. LATTA. Thank you, Mr. Chairman. 

And thank you very much for coming in today to testify again before the committee. 

45 

Mr. Beers, let me ask, could you inform us of the misuse of government-owned vehicles by the Washington-based headquarters 

personnel? 

Mr. BEERS. I am sorry, sir? Could you repeat—— 

Mr. LATTA. Could you inform us about any misuse of government-owned vehicles by Washington-based headquarters personnel? 

Mr. BEERS. Sir, I do not have an indication of that kind of misuse. We did look at that issue. 

David, do you want to add to that? 

Mr. WULF. There were, before Ms. Anderson and I came into the 

division, vehicles that were housed at our headquarters location. 

Before we arrived, those vehicles had been removed. So I don’t 

have—we don’t have—we didn’t have any indication that the vehicles had been misused. But, you know, we believed their presence 

at headquarters was not necessary for the—— 

Mr. LATTA. OK. When you say ‘‘removed,’’ could you explain? 

When you say ‘‘removed,’’ were they removed to another government agency? What happened to them? 

Mr. WULF. I believe—and I wasn’t there at the time—that they 

were pushed out to our field force. 

Mr. LATTA. OK. But were the records kept on those vehicles prior 

to that time as to where they were going, like mileage records, 

odometer statements, gas records, et cetera? 

Mr. WULF. I don’t know that. 

Mr. LATTA. Is there a way to get those records? 

Mr. BEERS. Sir, I want to acknowledge, that is one of the management problems that we discovered, that there was inadequate 

recordkeeping. And that is one of the deficiencies that we have corrected. 

Mr. LATTA. OK. But I think what we need to have in the committee, though, is we should have the—if we could request that information. And if you have to go back and find those records—because, again, it would seem to me that if it is a government vehicle, 

and when you have those government vehicles out there, that you 

have the odometer statements. And, also, there would be gas 

records and things like that. They would have to be filled up; they 

would have to have some service. There would have to be different 

records out there. 

So I think it is very important for the committee to get that information from you all so we can start with that point, as to know 

exactly where those vehicles were and if they were misused. So 

that is one of the things we would like to do. 

And let me ask, just to follow up again—maybe you just mentioned it—when did you all become aware of that problem with 

those vehicles? When you said you came in and those vehicles were 

removed, when were you all aware of it? 

Mr. BEERS. David, fill in if I am not precise on this. 

But my understanding is that that came out in the management 

review that was done by our Office of Compliance and Security. So 

the detail about the lack of records and oversight was finally reported in September of 2011, made available to David and Penny 

Anderson for incorporation in their report. 

46 

Mr. LATTA. Let me ask, was any of this turned over to the IG 

for investigation? 

Mr. BEERS. No, sir, that was not turned over to the IG. The report itself said that there was a lack of recordkeeping but that 

there was not an indication of waste, fraud, and abuse associated 

with that. ‘‘Not an indication’’—not saying that it wasn’t, but it was 

not indicated. 

Mr. LATTA. OK. And, again, how many vehicles are we talking 

about in total? 

Mr. WULF. I would have to get that back to you. 

Mr. LATTA. Could we get that back from you, then? We would appreciate that information. 

Mr. WULF. A relatively small number, I believe. 

Four to six vehicles? 

Mr. BEERS. That is what my staff is telling me, four to six vehicles. 

Mr. LATTA. OK. 

And, Under Secretary, you were aware of the unsatisfactory condition of the SSP process before you testified back in March of last 

year and in 2012. Is that correct, that you were aware of that? 

Mr. BEERS. I was aware that we were not moving at a pace that 

we had previously told you we should be moving at, yes, sir. And 

I indicated that I was disappointed in that and that I had hoped 

that we would move more rapidly on that. 

Mr. LATTA. OK. And I am sorry, did you say that you brought 

those problems and that information to the committee at that time? 

Mr. BEERS. Sir, which hearing are we talking about now? 

Mr. LATTA. The March 2011 or the February 2012 hearing? 

Mr. BEERS. So, at the March 2011 hearing, I believe I acknowledged that we had not achieved the objectives of getting the site 

security plans authorized at the rate that I had previously been 

told we would complete those plans, and that I had hoped—and I 

am now talking 2011—that we would be in a position to move forward on that. That was, unfortunately, not an accurate statement 

at that time either. 

Mr. SHIMKUS. The gentleman’s time has expired. 

Mr. LATTA. My time has expired, and I yield back. 

Mr. SHIMKUS. I would encourage my colleagues who want to go 

to the memorial service to head on down to the rotunda. We are 

going to finish with Butch Cassidy for 5 minutes, and then we will 

tell how we are going to operate after that. 

So the gentleman from Louisiana is recognized for 5 minutes. 

Mr. CASSIDY. Hello, gentlemen. 

I have a lot of petrochemical plants in my State, and my workers 

and my communities are at risk. And I have to say that when I 

speak of dysfunction in Washington, you all are case number one. 

I say that not to be mean but just to kind of observe. 

In the report that was the internal report that kind of broke this 

open, there are statements such as, ‘‘Legacy employees are doing 

a tremendous amount of work, while I see others sitting at their 

desk not contributing.’’ 

Those folks who are not contributing, are they still with the 

agency or have they been released? 

Mr. BEERS. David, would you answer that? 

47 

Mr. WULF. Yes, we have made a concerted effort to ensure that 

all members of our team are contributing to the program. And part 

of what we have done, as we have moved forward, kind of, toward 

a realignment of the organization, is to ensure that we can achieve 

a greater fit between the individual employees and the position in 

which—— 

Mr. CASSIDY. Has anybody been released? Because the document 

suggested that some that were hired were totally inappropriately— 

had skill sets and attitudes that were totally inappropriate to their 

job description, making it sound more as not something that required some adjustment, but required, frankly, rehiring. 

Has anybody been released? 

Mr. WULF. No one has been released, but, you know—— 

Mr. CASSIDY. Can I just keep on going then? 

They also, in that same report, said that not only had you not 

done any inspections, you had not developed a process to inspect. 

An incredible indictment. 

Are we to believe that you now have a process to inspect? 

Mr. BEERS. Yes, sir. We have retrained all of the inspectors that 

are currently on board. We completed that process in July—— 

Mr. CASSIDY. Now—I am sorry, just because we have limited 

time. I apologize to interrupt. 

It also said that because of your union contracts and your necessity to bargain even on minutia, even on things to bring into compliance with government policy, that it was anticipated that this 

could take weeks, months, it implied years, in order to actually implement the policy changes necessary to do an effective inspection. 

What has happened with that? 

Mr. BEERS. Sir, we have worked with the union, and I think we 

have a productive and expedited process to have those items that 

are required to be reviewed by the union so that they move swiftly. 

But I want to turn to David, who has been managing this on a 

day-to-day. 

Mr. WULF. And if I can just add, sir, that the point that we are 

trying to make in the ‘‘challenges’’ memo was that, at the early 

stage in which this program found itself, the presence of a union 

added an additional layer of complexity. But, you know, I am glad 

to report that we have developed a very strong relationship with 

our bargaining unit and that—— 

Mr. CASSIDY. But no one has been released, and it is so clear 

throughout here that there was a problem with—it was a problem 

not just of form but also of who was hired. That tells me, you guys, 

your credibility, frankly, is a little weak. I apologize. 

But here, for example—again, I am reading from your internal 

document—a large number of inspectors, quote, ‘‘were hired who 

have unrealistic expectations and the wrong skill set or mindset to 

do the work of a regulatory inspector; who are located in geographic areas that do not make sense or aligned to the mission; 

who, for example, seek law enforcement authority as opposed to 

work, using the uniform as a symbol of identity and authority rather than a tool to be used.’’ 

I mean, that suggests to me that it wasn’t just a tweaking, a little improvement of the bonding with the union, but there were people hired who were inappropriate to the position to which they 

48 

were hired. I can give further examples of that. The fact that you 

tell me that, no, we haven’t really released anybody, we have just 

reassigned them, tells me you haven’t been serious about what you 

are doing. 

Mr. WULF. I think we have come a long way in building the culture of the organization and building the regulatory compliance organization. And we have, you know, some very professional, extraordinarily talented folks throughout our team. They come from 

a variety of backgrounds—— 

Mr. CASSIDY. OK. So, ‘‘some’’—this is plural—‘‘some are simply 

unsuited for supervision, treating employees in an unfair, unprofessional, or disrespectful manner. Others are uninformed about 

their responsibilities as a supervisor to manage employee issues.’’ 

This is your internal document. And yet what I am hearing from 

you is, no, we haven’t really released anybody, but we are working 

on it. Frankly, that doesn’t help your credibility. 

Mr. BEERS. Sir, some of the thoughts behind that statement were 

that individuals were hired into positions that they weren’t adequately trained and, from a baseline resume review, didn’t have 

the background for. 

Mr. CASSIDY. I am out of time—— 

Mr. BEERS. What we have done is go through the process of 

training, go through the process of moving those individuals to 

more appropriate positions that are cast against their qualifications. 

Mr. CASSIDY. Has anybody had a reduction in pay? Because another thing was, ‘‘An excess number of highly graded personnel are 

serving in positions that do not contribute to the mission at a level 

commensurate with their pay grades.’’ Has anybody taken a decrease in pay? 

Mr. BEERS. That is where I say we are moving people to more 

appropriate positions. 

But let me ask David to clarify. 

Mr. WULF. And we have made a lot of process over the past year. 

I mean, that report was put together about a year ago, and we 

have put into place a variety of things, including training for supervisors. We have—— 

Mr. CASSIDY. If I am a taxpayer and if I see something that 

smacks of cronyism, per your report, the obvious question is, am 

I getting more bang for my taxpayer buck? 

Has anybody taken a cut in pay? 

Mr. WULF. We have people in positions for which they are more 

suited. And we have put into place, you know, an open and transparent process. 

Mr. CASSIDY. I will take that as a ‘‘no.’’ We are out of time. I 

apologize. 

Mr. SHIMKUS. The gentleman is yielding back his time. 

I guess the big point is, if you can’t do the small things, how can 

the country, the localities, the taxpayers, the public interest 

groups, expect us to do the big things? And that line of questioning, 

I think, just highlights that. 

The chair wants to announce that he wishes to recess this hearing so Members and interested persons can go to the 9/11 service 

at the Capitol. 

49 

With no objection, Mr. Beers is excused from the first panel. 

Mr. Beers, will you commit to provide full and accurate responses 

to written questions within 10 days of their submission? 

Mr. BEERS. Yes, sir. 

Mr. SHIMKUS. And that is a request from both sides. 

When we return, we will have Mr. Wulf and Ms. Berrick continue answering some questions, if that is OK with you all. 

The committee stands in recess until 11:45. 

[Recess.] 

Mr. SHIMKUS. I would like to call the hearing back to order. 

Again, we want to thank you for your patience and for giving us 

an opportunity to join our colleagues out on the east steps of the 

Capitol. It is always a memorable time and usually very short because on September 11th, that it was a short event in which we 

gathered. So I think those of us who were here remember that with 

a lot of emotions, as Americans do. And that is why I think what 

we are doing here today is still important and relevant. 

So, with that, I would like to recognize myself, which would be 

a second round of questions, for 5 minutes. 

Ms. Berrick, CBS originally reported on problems with the 

CFATS program. The report showed a video clip of the Under Secretary of the National Protection and Programs Directorate, during 

which he called the CFATS program a ‘‘tremendous success to 

date.’’ 

Would GAO characterize the program the same way? 

Ms. BERRICK. No, Mr. Chairman, not based on the work we have 

done to date. 

And I think what is going to dictate whether or not it is successful is whether it is able to execute its mission. And I think they 

are still in the early phases of positioning themselves to be able to 

do that. 

Mr. SHIMKUS. And, following up on your response, should they 

still be in the early stages? 

Ms. BERRICK. You know, comparing them to other regulatory programs across DHS, I think it is certainly taking them longer to get 

CFATS up and running. For example, comparing them to the Coast 

Guard, who also had to set up a regulatory regime at the ports 

when the Maritime and Transportation Security Act was passed, 

the Coast Guard got it up and running probably in a year and a 

half, although the Coast Guard did have personnel in place and an 

infrastructure, so they were better equipped to get up to speed earlier. 

TSA may be a better comparison since that was a new organization and they were setting up a new regulatory regime. It took 

TSA, I think, several years, looking across both their regulatory 

and voluntary programs, and they also had some challenges but 

not to the degree that CFATS has had. 

I think part of this could also be contributed to the standards 

that inspectors are assessing against. And CFATS is performancebased, which are broader, whereas at TSA the standards tended to 

be more specific, and that could be, in some respects, easier to establish a framework to assess against those specific standards. 

So some differences, but looking across the Department, it has 

taken CFATS longer to get up and running. 

50 

Mr. SHIMKUS. Well, I think it was last year when I had an inspector just come visit and kind of do an open-office-hour type of 

thing. And he was well-intentioned, wanted to do the right thing, 

but really was really lacking any guidance. So I think they were 

going around visiting facilities but really having no idea what they 

were checking for and why they were checking for it. And it kind 

of saddened me just because he really wanted to do the right thing 

but there was really a lack of guidance. And this was last year, last 

August, so not this past August. 

I understand that GAO has placed DHS on its high-risk list due 

to management challenges facing the Department. And we are 

talking about the whole Department of Homeland Security. To 

what extent have these management challenges had an impact on 

the NPPD’s ability to manage the CFATS program? 

Ms. BERRICK. You know, I think CFATS is an example of those 

management challenges that we talk about in the high-risk area. 

We placed DHS on the high-risk list in 2003 after it was created 

because we found that they didn’t have the rigor and procedures 

and oversight over their core management functions, and this is acquisition management, financial management, information technology, and human capital management. 

And what we were finding is, because of not having the discipline 

in these management areas, it was having a negative effect on 

DHS’s ability to implement its mission. So there were a number of 

programs that weren’t meeting performance expectations, cost 

more than what they were supposed to cost, were taking longer to 

field, because of these management challenges. 

I think CFATS is an example of this. For example, in the human 

capital area, we have talked throughout the Department about 

DHS’s challenges and bringing people with the needed skills and 

abilities on board to fill critical positions. They have had challenges 

in doing that. 

In the information technology area, you know, CFATS has an information technology tool to solicit input from the facilities to look 

at their site security plans and vulnerability assessments. The tool 

has some challenges, which were identified in the internal memo, 

mainly that it provides a lot of data but not in a real user-friendly 

format to read. So that is an example of an IT challenge. 

I think the Department as a whole has recognized these management problems. They have some good strategies in place to address 

them, but they are in the relatively early stages of doing that. 

Mr. SHIMKUS. So DHS is in the high-risk; CFATS is probably 

their number-one problem of concern. I think it goes back to the 

issue of, if you can’t get the small things right, how do people trust 

you to do the big things in this issue? So we appreciate your analysis. 

And my final question: Given the seriousness and multitude of 

problems CFATS is facing, particularly with respect to conducting 

its mission, would it be viable to consider, quote/unquote, ‘‘standing 

down’’ the program for some period of time so that these issues can 

be addressed before attempting to move forward with this regulatory mission? 

And to put it in another way, it is like trying to build a car while 

you are racing the car. 

51 

Ms. BERRICK. Right. 

Mr. SHIMKUS. Could we get a better return on investment and 

a more timely process getting it right before it deployed? Do you 

understand the question? 

Ms. BERRICK. Yes, I do. Thank you Mr. Chairman. 

You know, I think that is something DHS would have to consider, weighing that against the need to field a program to address 

existing security vulnerabilities. 

You know, there is an example in DHS’s history where they did 

just that. They were working to field a program called Secure 

Flight, which was a high-priority program within the Department 

that compared the matching of passenger information against terrorist watch lists for airline passengers. Air carriers used to have 

that function. The 9/11 Commission recommended that DHS take 

over that function from carriers. 

Well, DHS tried to field this program for several years. Five 

years into it, they weren’t able to field a successful program, and 

so they did just what you mentioned. They actually stood down the 

program. They went back and instilled some rigor in the acquisition that wasn’t there before. They were making sure that they 

were preparing appropriate documentation. And they did that for 

a year. And then when they turned the switch on and moved forward, they ended up fielding a successful program. 

So even though there was a delay when they did stand down the 

program, ultimately they probably saved time, in that they were 

able to address those problems they had, finish that, and then 

focus on implementing the program. So I think it is something 

worth thinking about. 

Mr. SHIMKUS. Time, effort, energy, frustration, all of the above. 

And I would agree, I think I am going through the secure TSA 

thing now. It just popped up; I wasn’t given much warning. And 

all of a sudden, I can go in a different lane. So it is pretty nice. 

The chair now recognizes the ranking member, Mr. Green, for 5 

minutes. 

Mr. GREEN. Thank you, Mr. Chairman. 

In June of this year, the House passed an appropriations bill for 

the Department of Homeland Security that cut funding for CFATS 

in half. 

Mr. Wulf, what impact would cutting your budget in half, on the 

CFATS program, what impact would it have? 

Mr. WULF. That proposed cut would have a pretty major impact 

on our ability to move the program forward at, you know, what is 

really a critical time for the program. 

You know, we have made a great deal of progress in our action 

plan. You know, we have, in essence, taken a bit of an operational 

pause over the past several months. We are now at the point where 

we have conducted the training. We have developed a streamlined 

site security plan review process. We have our inspectors out, having recommenced authorization inspections. We have turned an important corner in the program. And a cut, as the House Appropriations Committee has proposed, would force some very, very difficult 

choices. 

We would have a limited ability to pursue needed improvements 

to the site security plan tool and the Top-Screen and SVA tool, 

52 

something we are moving forward with in partnership with our industry stakeholders. We would have limited ability to continue implementing the action plan. We have made a considerable amount 

of progress in that implementation process, having completed 67 of 

the 95 action items. 

It would essentially cut the legs out from under us when we have 

turned an important corner, when we do expect and anticipate and 

have already begun to see a heightened pace of site security plan 

authorizations, approvals, and facility inspections. 

Mr. GREEN. Well, and I am sure you understand the frustration 

after 6 years and funding and funding and that frustration. But we 

are seeing some improvement now, and to cut the funding and still 

expect results is just not going to happen. And so I don’t know 

what the continuing resolution we will vote on this week has for 

the 6 months, but I would hope it would be something that would 

give you the resources to do your job. 

Mr. Wulf, the site security plan process is a key link to your ability to effectively review and approve plans. Have you made 

progress with improving this vital tool so that the covered facilities 

have clear instruction on information DHS needs? 

Mr. WULF. Yes, we have, in fact. We, over the past several 

months, having learned many lessons ourselves as we went 

through the site security plan reviews at our headquarters, have 

been out kind of piggybacking on events that industry associations 

have been holding across the country, to get the word out to facilities about how they can provide the detail that will enable us to 

get more efficiently and effectively through the review of the site 

security plans and get to authorization and approval in a more 

streamlined fashion. 

You know, at the same time, we are kicking off the SSP tool 

focus groups, working groups, with industry to continue to try to 

improve that tool to make it more user-friendly, both to the facilities and to our reviewers, and also continuing to work with industry on the alternative security program templates. 

Mr. GREEN. Well, I am glad you are bringing in the regulated 

community because, again, I have huge numbers of those in our 

district. And we have a particular group that I work with a lot, the 

East Harris County Manufacturers, made up of oil refiners, chemical plants, service companies. And that is one of the issues, when 

I talk to them, that they want to be part of the solution instead 

of just being told what to do. And sometimes the Federal Government is known for giving instructions that don’t work on the 

ground. 

Mr. WULF. Yes. 

Mr. GREEN. And so I am glad you are bringing them in. 

Ms. Berrick, the GAO has done extensive work on the need for 

strong security at chemical facilities going back as far as 2003. Can 

you describe the risk posed by these facilities? 

Ms. BERRICK. There is a risk posed by these facilities, the details 

of which are classified. We will be happy to come up and brief you 

and your staff separately on that. But there is a risk, according to 

DHS’s threat assessment. 

Mr. GREEN. I have no doubt that there is a risk. In fact, I have 

companies that produce ammonia, that we ship ammonia, all sorts 

53 

of volatile chemicals. That is just the nature of our district. It is 

important to have an effective government program, though, that 

ensures chemical facilities are protected from a terrorist attack. Is 

that correct? 

Ms. BERRICK. According to DHS’s threat assessments, they have 

identified a need for such a program. 

Mr. GREEN. And, you know, there are things that are happening 

in the last 6 years, even though the oversight may not be there, 

or what we need. Because I know, both through the FBI working 

with local law enforcement and our plant security, I have seen 

them there, our local special agent in charge has told me they have 

been on every plant site, in fact, probably, by now, a number of 

times, to be able to work with the folks who actually work there 

and produce these products that our country needs. 

Mr. Chairman, I know I am over time, so thank you. 

Mr. SHIMKUS. The gentleman yields back his time. 

The chair now recognizes the gentleman from Louisiana, Mr. 

Cassidy, 5 minutes. 

Mr. CASSIDY. Mr. Wulf, again, I am a physician. I know if you 

continue to have the same inputs, you should expect the same output. So all my questions go back to that initial report as to the inputs of your process, which obviously have been lacking. 

And, by the way, when you haven’t laid off anybody and yet we 

have an internal report showing that some of the people are sitting 

at their desk are doing nothing, but you continue to maintain you 

need the same amount of money, I am wondering why we are giving you any because, frankly, the public trust is not being met by 

your actions. That is just my perspective and as a counterpoint to 

what Mr. Green said. 

Ms. Berrick, in the internal report, it said that the database 

CHEMS was the wrong database. ‘‘It does appear the database can 

be modified to meet needs but requires a substantial amount of redefining requirements, reworking protocols, codes, et cetera, calling 

into question the funding spent to date,’’ going back to funding. 

Is the database now adequate? 

Ms. BERRICK. It is not, according to the office and based on the 

work we have done to date. 

It does provide some value because it is a tool to collect the needed information for CFATS to assess. However, it is not very userfriendly. Outputs are oftentimes data dumps that are difficult to 

sift through, especially when you are looking at something as complex as what CFATS is looking at. 

So there are identified challenges that CFATS has identified 

themselves and are working to try to address, but it is going to 

take time and money to, I think, make those revisions to the system. 

Mr. CASSIDY. OK. Time and money to make that revision, and 

yet somehow we are going to be back on track certifying plants. 

And I don’t want this to be mean, but I am supposed to be providing oversight for the American taxpayer, who, if she knew what 

was going on, would just be furious. 

Ms. Berrick, it said in the internal report that ISCD does not 

have an established records management system to document, development, and maintenance of necessary historical documentation 

54 

related to programs owned by the division. Has that now been corrected? 

Ms. BERRICK. I don’t know if that has been a closed action item 

or not. I believe it is in progress. Maybe Mr. Wulf has the current 

status. 

Mr. WULF. Yes, it is in progress. And we are keeping records 

very, very extensively and thoroughly. It is a high priority and 

something we take very seriously, as the remainder of the action 

items, as well, on which we have made a significant amount of 

progress on. 

Mr. CASSIDY. So, yes or no, do you have an established records 

management system now? 

Mr. WULF. We do. 

Ms. BERRICK. If I could mention, Mr. Cassidy, GAO has ongoing 

work looking in more detail at CFATS’ ability to meet its mission. 

We will be reporting on those results early next year, including 

looking at the records retention issue. 

Mr. CASSIDY. OK. That would be great. 

Budget: Our lack of focus and vision has resulted in problems, 

how we spend our money, how we are managing these funds—for 

example, buying first responder equipment such as hazmat suits 

when, as a regulatory entity, we do not have a first-responder role. 

Ms. Berrick, has that been corrected? 

Ms. BERRICK. I do not know, Mr. Cassidy. 

Mr. CASSIDY. Mr. Wulf? 

Mr. WULF. Yes, it absolutely has. In the early days of the program, there were course corrections. There was some thought—and 

this was before my time—that the chemical security inspectors 

would have a response role. As the program evolved and as it became clear that they would not, that equipment was repurposed 

within the Department. 

Mr. CASSIDY. Are we still paying more than $20,000 per year for 

professional memberships in ASIS that are unnecessary, et cetera? 

Mr. WULF. We are not paying for those memberships anymore. 

Mr. CASSIDY. And now, it says, ISCD lacks—again, internal document—lacks a system for tracking the usage of consumable supplies, which creates an environment for fraud, waste, and abuse to 

exist. 

Has that, Ms. Berrick, now been established? 

Ms. BERRICK. I am sorry, I don’t know the current status of that 

item. 

Mr. CASSIDY. Mr. Wulf? 

Mr. WULF. Yes, we are track tracking those supplies. 

Mr. CASSIDY. OK. 

Now, I could go on, but I think we are making the point. There 

seems to be substantial amounts of really critical things which 

have to be addressed. And in an ongoing basis, we are keeping people employed who, again, your internal documentation suggests are 

the inappropriate person for their roles. 

Build a case why we should give you more money. 

Mr. WULF. Well, as I have said, we have made a significance 

amount of progress. I think with regard to—— 

Mr. CASSIDY. Now, I am a physician, and I teach. So when a 

medical student—and I say this not to be abusive, and I apologize 

55 

if I come across this way. But if somebody tells me ‘‘significant’’— 

‘‘significant’’ is one of those loosey-goosey words that may or may 

not have significance. 

It certainly would move the ball from here to there, but if this 

is threshold at which you can actually accomplish a mission— 

where are you relative to getting to the threshold where you can 

actually accomplish your mission? Sure, you may have made significant progress, but you may have this incredible gap between 

where you are now and the threshold at which you can actually accomplish your mission. 

Actually, Ms. Berrick, where would you guess they are? 

Ms. BERRICK. I think they are in their early stages. They are still 

setting up a framework to position themselves—— 

Mr. CASSIDY. Are we 10 percent of the way there? A hundred 

percent? Fifty percent? Sixty percent? 

Ms. BERRICK. If I had to put a guess, an educated guess percentage, you know, maybe 25 percent. 

Mr. CASSIDY. Can you give us a timeframe in terms of years at 

which they will reach the threshold of being able to accomplish 

their mission? 

Ms. BERRICK. You know, all the actions under way have different 

timelines. We have been told that it—CFATS is estimating it could 

up take up to 3 years to complete compliance inspections once they 

review the site security plans. 

Mr. CASSIDY. But we don’t even have a database yet which can 

be easily used in order to support that initial site—so the 3 years 

was after the threshold is met? 

Ms. BERRICK. Three years from today is the estimate that they 

provided us. And, again, we are going to continue to review this as 

a part of our ongoing work. And I think early next year we will be 

positioned to provide you details on where we think they are in 

terms of this continuum of progress. 

Mr. CASSIDY. OK. Thank you. 

I yield back. 

Mr. SHIMKUS. Mr. Wulf, do you want to respond? 

Mr. WULF. Yes, I mean, I would love to. 

We are, I believe, accomplishing our mission. The CFATS program has accomplished a great deal over the course of its existence. 

You know, the 2,700 facilities that have removed or reduced their 

chemicals of interest; you know, the 7,800 security vulnerability assessments that have been completed and reviewed by our staff; the 

more than 3,000 compliance assistance visits and other outreach 

visits that our inspectors have conducted have laid important 

groundwork. 

We are at the point where we are seeing a heightened pace of 

reviews of site security plans. Within the last week, we have authorized, myself along with Assistant Secretary Durkovich, have 

authorized 10 additional plans and approved our first 2 site security plans. 

We are going to be moving this program forward. And, you know, 

I am very pleased to say that, you know, I have had, as have the 

rest of our team in ISCD, a tremendous amount of support within 

the organization. There is a tremendous amount of commitment for 

getting this job done. 

56 

We are accomplishing the mission. In terms of percentages, we 

put into place that corrective action plan last fall; we are 70 percent done with that. You know, not that we are ever going to be 

completely done. We are going to continue forward—I am sorry, sir. 

Mr. SHIMKUS. I appreciate your passion in defending the program. You can understand why my colleague, his frustration. 

Mr. WULF. Sure. 

Mr. SHIMKUS. And we all want to move this together. 

In talking with my ranking member, two things: He wants to 

make sure we put on record that, obviously, our oversight is not 

going to end, so we will just keep monitoring this. And I think for 

both of us, for the defense of the program, and for the giving due 

preference and diligence to our taxpayers, I think it is the right 

course of action, to make sure that we finish this and we have a 

program that we can defend publicly. 

Also, without objection, I would like to pose one other question, 

just because we were talking about budgets. The President is supposed to lay out, hopefully, sequestration issues Friday. Sequestration, 50 percent of that comes out of defense and homeland security, national defense issues. 

Have you all heard—and I know that you have a small program 

within Homeland Security. But I would venture to say that whatever budget that the House has proposed that might address funding, sequestration might do even more. 

Have you guys even talked about what effect sequestration might 

have to the CFATS program? 

Mr. WULF. I have not been part of those discussions. 

Mr. SHIMKUS. And we await the President’s disclosing what he 

may or may not do. 

Seeing no other Members asking for time, we would like to thank 

you for coming back, making sure that we could get the second 

round. It was very important for all of us. And we would like to 

dismiss you and empanel the second panel. So, with that, thank 

you very much. 

Mr. WULF. Thank you. 

Mr. SHIMKUS. We also want to thank you all for coming. 

The way I operate is I am going to introduce you all, like, right 

off the bat, and then we will go for 5-minute opening statements. 

We also ask unanimous consent that all members of the subcommittee have 5 days to forward questions to you all, too. And, 

without objection, so ordered. 

On the second panel, we have Mr. Timothy Scott, chief security 

officer of Dow Chemical Company. We also have Mr. Matthew 

Leary, corporate EHS&S manager, Pilot Chemical Company. We 

have Ms. Anna Fendley, United Steelworkers, Health, Safety, and 

Environment Department; and Mr. Paul Orum on his own behalf. 

So, with that, we appreciate you attending. You all have 5 minutes for an opening statement. Your full statement will be submitted for the record. I did review them, scanned them, all last 

night. And so I appreciate the efforts you made on that behalf. 

And, with that, we will begin with Mr. Scott for 5 minutes. 

57 

STATEMENTS OF TIMOTHY J. SCOTT, CHIEF SECURITY OFFICER AND CORPORATE DIRECTOR, EMERGENCY SERVICES 

AND SECURITY, THE DOW CHEMICAL COMPANY; MATTHEW 

J. LEARY, CORPORATE EHS&S MANAGER, PILOT CHEMICAL 

COMPANY; ANNA FENDLEY, HEALTH, SAFETY, AND ENVIRONMENT DEPARTMENT, UNITED STEELWORKERS; AND 

PAUL ORUM, BLUE GREEN CHEMICAL SECURITY COALITION, INDEPENDENT CONSULTANT TO THE CENTER FOR 

AMERICAN PROGRESS 

STATEMENT OF TIMOTHY J. SCOTT 

Mr. SCOTT. Chairman Shimkus, Ranking Member Green, and 

members of the subcommittee, my name is Tim Scott, and I am the 

chief security officer for The Dow Chemical Company. I am speaking today on behalf of Dow and the American Chemical Council, 

and I will focus on four points. 

First, the chemical industry and DHS have a common goal of improving the security profile of the chemical sector, reducing the risk 

of attack or the use of chemicals as a weapon, and minimizing the 

impact of the potential threats on our country. 

Second, the chemical industry and DHS have made some 

progress using both voluntary industry initiatives and collaborative 

efforts to clarify and meet performance standards. 

Third, the concerns associated with the implementation of the 

Chemical Facilities Anti-Terrorism Standards and internal DHS 

management issues are real. It is promising to hear that improvements are being made in both areas. In spite of these distractions, 

industry has made progress. 

And, lastly, we need to build on this progress to achieve an efficient, integrated, and sustainable security plan for the chemical industry and our country. It is time to move on and, in fact, accelerate our efforts. 

The CFATS concept is fundamentally sound. DHS established 

Risk-Based Performance Standards, flexibility for the regulated 

companies to apply customized security solutions for each unique 

site and situation, and DHS final approval and review for compliance. That is the goal: to set expectations, meet those standards, 

and, by doing so, reduce the vulnerability and risk of our chemical 

sector. 

Too often, we fixate on the methods used to achieve the goal instead of the goal itself. No one method addresses every site or 

every situation, but we are making progress. 

The concept of alternative security plans offer an excellent opportunity for a thorough but expeditious review and approval process 

of the site security plans at many CFATS-regulated facilities, especially those in the lower-tiered sites and companies that have multiple regulated sites. 

DHS recently completed a pilot test of an ACC-developed alternative security plan, and it proved to be a worthwhile exercise for 

both industry and DHS—an excellent example of an open and collaborative effort to improve and expedite the process. Members of 

the ACC implemented the Responsible Care Security Code in 2002. 

And over the past decade, ACC members have spent nearly $10 billion on security enhancements. 

58 

The code is a requirement for membership and is included in 

independent, third-party audits of the Responsible Care Management System. Recognition of the value of such voluntary industry 

initiatives is being considered as another possible means of fasttracking reviews of site security plans. 

The next generation of the DHS site security plan tool is being 

developed and will be both easier and more efficient for industry 

and a more valuable and usable source of information for DHS. 

Progress has been made, but there are still some hurdles to overcome. 

Personnel surety is critical to any security program, and most 

companies had background checks and programs in place well before the creation of DHS. Screening against the terrorist database 

is a welcome addition to the performance standards and is, as it 

should be, a government responsibility. 

CFATS is closing this gap, but this is an area where we can use 

your help. By design, CFATS allows the flexibility to address each 

performance standard using the method best suited to each particular site and situation. The personnel surety program and performance standards should be no exception. 

There are many readily available government-approved options 

that would fully comply with this standard, and there is no valid 

reason to limit the options. In the case of the personnel surety 

standard, however, DHS management has not demonstrated the 

flexibility that is integral to and authorized by CFATS. 

Also in the area of the terrorist database screening, there is one 

concept in which all security managers agree: We should know that 

a person can pass this screening before we issue an entry card and 

let a potential threat in the gate. And we should keep any potential 

threat out of the site. That is a pretty basic security concept, but 

it is not clear that DHS management is in agreement with this important point, and that is a cause for significant concern. 

There is definitely room for improvement in the implementation 

of the Chemical Facilities Anti-Terrorism Standards, but the necessary corrections can be made and success can be achieved. Success demands constancy of purpose, commitment, and collaboration. 

ACC member companies are committed. We should not return to 

square one with DHS or change course in midstream. We should 

strengthen collaboration and increase the pace to build an efficient, 

integrated, and sustainable chemical security process for our country. 

Thank you. 

Mr. SHIMKUS. Thank you, sir. 

[The prepared statement of Mr. Scott follows:] 

59 


82834.030

Before the 

SUBCOMMITTEE ON ENVIRONMENT AND THE ECONOMY 

OFTHE 

COMMITTEE ON ENERGY AND COMMERCE 

UNITED STATES HOUSE OF REPRESENTATIVES 

Statement of 

Timothy J. Scott 

Chief Security Officer and Corporate Director 

Emergency Services and Security 

The Dow Chemical Company 

Representing 

The American Chemistry Council 

And 

The Dow Chemical Company 

On 

The Chemical Facilities Anti-Terrorism Standards Program: 

A Progress Report 

Tuesday, September 11, 2012 
60 


82834.031

Chairman Shimkus, Ranking Member Green and members of the subcommittee, my name is 

Tim Scott and I'm the Chief Security Officer of The Dow Chemical Company. 

I'm speaking today on behalf of Dow and the American Chemistry Council, the nation's largest 

chemical industry trade representative. 

Ours is a robust and diverse industry -- our nation's largest exporting sector, employing over 

three-quarters of a million people in the United States, and investing billions of dollars in the 

safety and security of our facilities. 

I'll focus on four pOints today: 

The chemical industry and Department of Homeland Security have a common goal of improving 

the security profile of the chemical sector, reducing the risk of attack against the industry or the 

use of chemicals as a weapon, and minimizing the impact of potential threats to our country. 

The chemical industry and DHS have made progress using both voluntary industry initiatives 

and collaborative efforts with DHS to clarify and meet performance standards. 

The concerns associated with the implementation of the Chemical Facilities Anti-Terrorism 

Standards and internal DHS management issues are real. It's promising to hear that progress is 

being made in both areas. In spite of these distractions the sector has made progress. 

2 
61 


82834.032

And lastly, we need to build on this progress - as respectful partners with a common goal - to 

achieve an efficient, integrated and sustainable security plan for the chemical industry and our 

country. 

It's time to move on - and in fact accelerate our efforts. 

The CFATS concept is fundamentally sound - risk-based and focused on the right prioritiesallowing the regulated companies to apply customized security solutions to each unique site 

and situation for DHS review and approval for compliance with the DHS-established risk-based 

performance standards. 

THAT is the goal- to meet the standards and by doing so reduce the vulnerability and risk of 

our chemical sector. Too often we fixate on the methods used to achieve the goal instead of 

the goal itself. No one method, no single silver bullet addresses every site or every situation. 

The path to success can -- and usually does -- vary with every site or situation. 

We are making progress: 

The concept of alternative security plans that would expedite the review and approval process 

- especially for lower tiered sites and companies that have multiple regulated sites - is being 

tested. DHS recently completed a pilot test of an ACC-developed alternative security plan, and 

3 
62 


82834.033

it proved to be a worthwhile exercise for both industry and DHS -- an excellent example of an 

open and collaborative effort to improve and expedite the process. 

Members of the American Chemistry Council implemented the Responsible Care Security Code 

in 2002 and over the past decade ACC members have spent nearly 10 billion dollars on security 

enhancements. The Code is a requirement for membership and is included in independent 

third party audits of the Responsible Care Management System. Recognition of the value of 

industry initiatives is being considered as another possible means of fast tracking reviews of site 

security plans. 

Both examples offer an excellent opportunity for a thorough but expeditious review and 

approval process of the site security plans at CFATS-regulated facilities. 

The next generation of the site security plan tool is close to launch, and is both easier and more 

efficient for the industry and a more valuable and useable source of information for DHS. 

Progress has been made, but there are still some hurdles to overcome. 

Personnel Surety is critical to any security management program. Most companies had robust 

background check programs in place well before the creation of the DHS. Screening against the 

Terrorist Database is a welcome addition to the performance standards, and is - as it should be 

4 
63 


82834.034

- a government responsibility. CFATS is closing this gap but this is an area where we can use 

your help. 

By design CFATS allows the flexibility to address each performance standard using the method 

best suited to each particular site and situation. The personnel surety performance standard is 

no exception. As with all the risk-based performance standards there are many ways to comply 

with this requirement. There is no valid reason to limit the options when many readilyavailable options would meet the performance standard. In the case of the personnel surety 

program DHS has not demonstrated the flexibility that is integral to and authorized by CFATS. 

In the discussion of TDB screening there is one area in which all security managers agree -- we 

should know that a person can pass the TDB screening BEFORE we issue an entry card and let a 

potential threat in the gate -- and we should keep any potential threat out of the site. It is not 

clear that DHS management is in agreement with this important point, and that is a cause for 

concern. 

Industry and DHS -- have made progress in improving the security of the chemical sector. There 

have been missteps, but we can make the necessary corrections and achieve successful results. 

It takes commitment and collaboration. ACC member companies are committed. 

We should not return to square one with DHS or change course in mid-stream. Instead we 

should strengthen the collaboration between DHS and industry with the unified goal of 

5 
64 


82834.035

increasing the pace to build an efficient, integrated and sustainable chemical security process 

for our country. 

Thank you. 

6 
65 

Mr. SHIMKUS. I would now like to recognize Mr. Leary for 5 minutes. 

STATEMENT OF MATTHEW J. LEARY 

Mr. LEARY. Good afternoon, Chairman Shimkus, Ranking Member Green, and members of the subcommittee. My name is Matt 

Leary, and I am both corporate security officer as well as the environment, health, and safety manager for Pilot Chemical Company 

in Cincinnati, Ohio. 

I am pleased to provide this testimony on behalf of the Society 

of Chemical Manufacturers and Affiliates regarding how the Department of Homeland Security has been implementing the Chemical Facility Anti-Terrorism Standards and what that has meant 

for Pilot’s two covered facilities. 

Pilot Chemical is a small, privately held company celebrating its 

60th anniversary on the 19th of this month. We specialize in 

alkylation, sulfonation, and sulfation, which are used to manufacture detergents. We have only 200 employees. We have four facilities, two of which are subject to CFATS. 

Maintaining the security of our facilities has always been a priority for SOCMA members like Pilot. After the tragic events of 9/ 

11, which occurred 11 years ago today, SOCMA members did not 

wait for new government regulations before researching, investing 

in, and implementing additional and far-reaching facilities security 

measures to address these new threats. However, there were no 

uniform Federal standards for measuring and implementing these 

security improvements across industry. CFATS standardized that 

process. 

Definitively, DHS’s Chemical Facility Anti-Terrorism Standards 

work. DHS listened to the private sector in developing a regulatory 

framework that is risk-based and preserves the ability for security 

professionals to make investments in measures that suit their specific facilities but that also provides robust performance standards 

and imposes strict penalties for noncompliance. 

But that does not mean that the CFATS experience has been 

easy for regulated companies, especially small ones like Pilot. 

In several respects, the manner in which DHS has implemented 

the regulations has imposed substantial uncertainties and costs on 

companies. I recognize that DHS has been building out the program at the very same time it has been implementing it. Nonetheless, I am confident that DHS could have substantially reduced 

these uncertainties and costs if they had implemented the program 

more quickly and confidently. They still could. 

An ongoing challenge for Pilot has been the unwillingness of 

DHS to give us useful guidance on how to comply with the riskbased performance standards that are at the heart of CFATS. DHS 

staff said they cannot give us clear guidance because the CFATS 

statute prohibits DHS from requiring facilities to implement specific security measures. 

That is ridiculous, however. The statute’s prohibition on requiring particular security measures doesn’t prevent DHS staff from 

saying security measure X is one way to meet RBPS Y at tier level 

Z. It is not the only way, and we are certainly open to discussing 

other ways. 

66 

If DHS staff were willing to offer nonexclusive safe harbors to 

those seeking feedback, companies like Pilot that are looking for 

clear compliance guidelines would be able to obtain it. 

The other reason we believe DHS has been unwilling to give 

clear guidance is described on page 10 of the Anderson-Wulf memo, 

which says, ‘‘There exists within the cadre of SSP reviewers a reluctance to recommend good enough SSPs for authorization or conditional authorization out of fear that the leadership has a zero-tolerance philosophy toward mistakes and out of a lack of clarity regarding expectations.’’ 

DHS needs to make clear to staff that they are expected to use 

their judgment to make decisions and that management will not 

punish them for doing so. 

Another issue of concern to Pilot has been DHS’s misguided personnel surety proposal. Last year, DHS announced its intent to establish a Web-based application that would require facility owners 

and operators to submit personally identifying information about 

current and prospective employees, as well as contractor and visitor personnel seeking access to a plant. 

Our industry has expressed serious reservations about the 

logistical nightmares that this proposal could lead to, given the 

heavy presence of contractors at chemical sites, especially during 

plant-wide maintenance turnarounds. DHS has been open to discussing alternative approaches, and the industry has proposed both 

interim and long-term alternatives that could involve reliance on 

existing Federal vetting programs, mechanisms by which contractor and visitor employees could submit information regarding 

their own employees, and ultimately a universal Federal security 

credential that would supersede all others. 

Many smaller companies like Pilot would benefit from leveraging 

existing processes for vetting individuals that we feel meet the intent of the standards. DHS’s prior proposal would unnecessarily 

limit the number of options open to regulated facilities for complying with RBPS 12. Resolving this challenge expeditiously would 

free up ISCD resources to focus on the more pressing task of approving SSPs and initiating compliance inspections. 

As I have testified today, the CFATS framework is sound, but 

DHS’s implementation has been flawed. We have seen progress 

made by the Department under the recent management of Deputy 

Under Secretary Suzanne Spaulding and ISCD Director David 

Wulf. To help ensure further progress is made, however, DHS must 

not drift away from the spirit of the public-private partnership on 

chemical security that it has so often hailed as the keystone of the 

CFATS program. 

I appreciate this opportunity to testify before you today and look 

forward to your questions. 

Mr. SHIMKUS. Thank you, sir. 

[The prepared statement of Mr. Leary follows:] 

67 


82834.036

SOCMA 

& 

Testimony of 

Matthew J. Leary 

Corporate EHS&S Manager 

Pilot Chemical Company 

On Behalf of the 

Society of Chemical Manufacturers and Affiliates 

before the 

House Committee on Energy and Commerce 

Subcommittee on Environment and the Economy 

on 

The Chemical Facility Anti-Terrorism Standards 

Program - A Progress Report 

September 11,2012 

1 
68 


82834.037

Good morning Chainnan Shimkus, Ranking Member Green, and members of the Subcommittee. 

My name is Matt Leary and T am both Corporate Security Officer as well as the Environment, 

Health, and Safety Manager for Pilot Chemical Company in Cincinnati, Ohio. I am pleased to 

provide this testimony on behalf of the Society of Chemical Manufacturers and Affiliates 

(SOCMA) regarding how the Department of Homeland Security (DHS) has been implementing 

the Chemical Facility Anti-Terrorism Standards (CFATS) and what that has meant for Pilot 

Chemical's two covered facilities. 

Pilot Chemical is a small privately-held company, celebrating its 60th anniversary on the 19th of 

this month. We specialize in alkylation, sulfonation and sulfation, which are used to 

manufacture detergents. We have only 200 employees. We have 4 facilities, two of which are 

subject to CFA TS. 

Pilot Chemical is in many ways typical of the members of the Society of Chemical 

Manufacturers and Affiliates, to which we are proud to belong. For 91 years, SOCMA has been 

and continues to be the leading trade association representing the batch, custom, and specialty 

chemical industry. SOCMA's nearly 230 member companies employ more than 100,000 

workers across the country and produce some 50,000 products - valued at $60 billion annuallythat make our standard ofliving possible. From phannaceuticals to cosmetics, soaps to plastics 

and all manner of industrial and construction products, SOCMA members make materials that 

save lives, make our food supply safe and abundant, and enable the manufacture of literally 

thousands of other products. Over 80% of SOCMA's active members are small businesses like 

Pilot Chemical. 

Maintaining the security of our facilities has always been a priority for SOCMA members, and 

was so before September II. After the tragic events of 9/11, which occurred 11 years ago today, 

SOCMA members did not wait for new government regulations before researching, investing in 

and implementing additional and far-reaching facility security measures to address these new 

threats. Under SOCMA's ChemStewards® initiative, SOCMA members were required to 

conduct security vulnerability assessments (SVAs) and to implement security measures. 

However, there were no unifonn federal standards for measuring and implementing these 

security improvements across industry. CFATS standardized that security process. 

Many SOCMA member company facilities, just like Pilot Chemical's, are encompassed within 

the CFATS program. They have submitted their Site Security Plans (SSPs) and - we assumewill eventually be inspected by DHS to verify the adequacy of those plans and their conformance 

to them. SOCMA members have spent billions of dollars and have devoted countless man-hours 

to secure their facilities and operations. Thcse investments will naturally continue for the 

foreseeable future. SOCMA has tried to actively engage with DHS to accelerate and 

continuously improve the implementation of the CFATS program, exploring new approaches to 

personnel surety and Alternative Security Programs. 

Definitively, DHS's Chemical Facility Anti-Terrorism Standards work. DHS listened to the 

private sector in developing a regulatory framework that is perfonnance-based and preserves the 

ability for security professionals to make investments in measures that suit their specific 

2 
69 


82834.038

facilities, but that also provides robust perfonnance standards and imposes strict penalties for 

non-compliance. 

But that does not mean that the CF A TS experience has been easy for regulated companies, 

especially small ones like Pilot Chemical. In several respects, the way that DHS has 

implemented the CFATS regulations has imposed substantial uncertainties and costs on 

companies. I recognize that DHS has been building out the program at the very same time it has 

been implementing it. Nonetheless, I believe that DHS could have substantially reduced these 

uncertainties and costs if they had implemented the program more quickly and confidently. 

They still could. 

At the same time, Pilot Chemical along with SOCMA wants to recognize the marked 

improvement in CF A TS implementation under the leadership of National Programs and 

Protection Directorate (NPPD) Deputy Undersecretary Suzanne Spaulding and Infrastructure 

Security Compliance Division (IS CD) Director David Wulf, both of whom joined the 

Department last year. We are confident that this program with continue to move forward with 

the both of them at the helm. 

Below I will (i) explain what is good about CF A TS; (ii) describe the problems with its 

implementation and the impacts on smaller companies like Pilot Chemical; and (iii) describe 

some needed improvements. 

I. Despite Departmental Mismanagement, CF ATS is Reducing Risk 

To be clear, SOCMA's membership regards the program thus far as a success, even if its 

implementation has moved much more slowly and cautiously than we all would prefer. The 

CFA TS statute was wisely drafted to be comprehensive and flexibly structured to impose 

security perfonnance standards that are relatively more demanding of higher-risk facilities and 

less demanding of lower-risk plants. To a great extent, DHS's rules implement the statutory 

mandate issued by Congress in 2006. 

Both the law and the rules are fundamentally sound and do not require replacement. Since the 

program was launched in 2007, more than 2,000 facilities have changed processes or inventories 

in ways that have enabled them to screen out of the program. Thus, as predicted, CFATS is 

driving facilities to reduce inherent hazards, where in their expert judgment doing so is in fact 

safer, does not transfer risk to some other point in the supply chain, and makes economic sense. 

Hundreds of other regulated facilities that had not already done so have already made significant 

proactive investments in security measures in anticipation of compliance with the full 

implementation of CF A TS. As a result of CFATS, our nation is more secure from terrorist 

chemical attacks and other threats than it was before the program's inception. And this risk 

reduction has taken place through a market-based approach that has certainly cost society less 

than if all the initially covered facilities were still subject to regulation. 

Furthennore, due to the outstanding cooperation of the chemical sector, there has been 100% 

compliance with the requirements to submit Top-Screens, SV As and SSPs - DHS has not yet 

had to institute a single administrative penalty action to enforce compliance. 

3 
70 


82834.039

SOCMA also supports the CF A TS program because our members have invested significant 

amounts of financial and human capital in it over the past several years. Overall, covered 

facilities have invested billions of dollars in security upgrades to meet CFATS's requirementsPilot Chemical itself has invested hundreds of thousands of dollars. SOCMA's members alone, a 

majority of which are small manufacturers with under $40 million in annual sales, have invested 

an estimated $515 million in security measures to date. CF ATS has provided significant 

additional security to a critical segment of our nation's infrastructure, as well as the general 

public. 

No one should dispute that, despite the challenges to its implementation, the two main 

alternatives to CFA TS would both be far worse. Having no chemical security regulation at all 

would create a risky and tilted playing field in which most companies secured their facilities 

voluntarily, at significant cost, while a minority created risks for us all, and gained an unfair 

economic advantage, by not doing so. Our nation would also not be well-served by a 

prescriptive program that mandated incorporation of inherently safer technology (1ST). Such an 

approach would threaten to drive chemical operations overseas where security standards are 

weaker. 

II. Small Businesses Suffer Disproportionately from DHS's Problems Implementing 

CFATS 

A. The Impact of Delay on Bndgeting, Investment and Staff Credibility 

As Corporate Security Officer for Pilot Chemical, I can tell you that the most frustrating aspect 

of CF ATS implementation has been not knowing, for years now, how much to budget for 

compliance. In this tough economy, every penny counts. Finance directors want to know when 

and how much our company will be spending on security measures to meet the requirements of 

CFA TS compliance. Unfortunately, there is no way for me to answer either question. 

While security budgeting is an issue for any company whose site falls under CF A TS, the 

challenges are especially great for small businesses like Pilot Chemical. We have limited capital 

to invest. Obviously, we would like to invest that money in plants and equipment so that we can 

take advantage of profitable business opportunities as they present themselves. We also have 

limited cash flow from operations, which we would like to be able spend buying raw materials 

and creating jobs. We recognize that we have to comply with CFATS, and we are prepared to do 

so, but we need to know how much it will cost and when those costs will be incurred. Instead, 

we have been forced to guess, and to hold the amount of projected early outlays in suspense, 

unavailable for productive purposes, in case DHS suddenly approves our SSP and we need to 

start incurring expenses to comply. You can, I hope, imagine our frustration as this situation 

persists, year after year, and we still have no idea when DHS will ever get to authorization 

inspections for our facilities' tiers. That frustration is compounded as we relive the annual drama 

of whether Congress will extend the perennially expiring regulations for yet another year. 

We believe that our facilities are appropriately secure. But we have no real idea what DHS will 

conclude is required based on our submitted SSP, and companies the size of Pilot Chemical 

4 
71 


82834.040

cannot afford to guess. The biggest catastrophe for a small business is to hear something like: 

"The $250,000 you just shelled out for [fill in the blank] did not really help your profile and was 

in fact not needed." As a result, we cannot spend dollars on security in advance unless we are 

clear that what is spent will directly lead to compliance with the standard. 

Besides tying up assets and preventing productive investments, the extended delays in 

implementation of CF A TS also lead companies to question whether their government is really 

serious about the security of chemical facilities. While DHS expects regulated facilities to 

submit their SV As and SSPs on time, commitments made about approving SSPs and completing 

pre-authorizing inspections by date X are repeatedly broken. Rarely are such exceptions made 

for industry. Such failures cause security professionals to lose credibility with their superiors 

who authorize compliance costs, as these managers conclude that their security staff are simply 

"crying wolf' about their regulatory obligations. DHS mismanagement has, in some cases, 

stopped the momentum that security managers had with their own senior management in 

convincing them of the need for certain cost decisions, placing forward progress in a holding 

pattern. 

B. The Inability to Get Meaningful Guidance from DHS 

An ongoing challenge for Pilot Chemical, and for many other companies that have yet to see 

their SSP reviewed by DHS or that have had their submission rejected, has been the 

unwillingness ofDHS to give us useful guidance on how to comply with the Risk-Based 

Performance Standards (RBPS) that are the heart of CF A TS. When facilities ask headquarters or 

regional DHS staff whether particular security measures would satisfy a given standard for a 

given tier level, the staff routinely decline to give us a clear answer. We are only able to get nonspecific comments that security professionals cannot translate into particular actions. 

DHS staff say they cannot give us clear guidance because the CF ATS statute prohibits DHS 

from requiring facilities to implement specific security measures. That is ridiculous, however. 

The statute's prohibition on requiring particular security measures doesn't prevent DHS staff 

from saying "Security measure X is one way to meet RBPS Y at tier level Z. It is not the only 

way, and we are certainly open to discussing other ways." The implementation of CFA TS would 

be vastly improved if DHS staff were willing to offer non-exclusive safe harbors in this fashion. 

Then smaller companies like Pilot Chemical that are looking for clear compliance guidance 

would be able to obtain it, and larger companies would be free to design and propose their own 

solutions. 

I agree it would be a problem ifDHS regularly disapproved SSPs that included anything besides 

the example or safe harbor guidance. But the possibility that this might occur somewhere, 

sometime, is not a good reason to prohibit DHS staff across the board from offering safe harbors. 

The other reason we believe DHS has been unwilling to give clear guidance is described on page 

10 of the Anderson/Wulfmemo, which says "there exists within the cadre of SSP reviewers a 

reluctance to recommend 'good enough' SSPs for authorization or conditional authorization out 

of fear that the leadership has a zero tolerance philosophy towards mistakes and out of a lack of 

clarity regarding expectations." As DHS has testified today, only one SSP has been 

5 
72 


82834.041

conditionally approved to-date. DHS has obviously been letting the perfect be the enemy of the 

good. While SOCMA does not support a rushed process that accepts inadequate or incomplete 

SSPs, DHS needs to make clear to staff that they are expected to use their judgment and to make 

decisions - and that their management will not punish them for doing so. 

That said, despite the bad picture the Anderson/W ulf memorandum has painted of inspectors, 

they have always been available to SOCMA and its members, either providing compliance 

assistance on-site upon request or attending SOCMA events, and have been very engaging with 

our membership. 

C. Small Business Concerns with DHS's Personnel Surety Program 

REPS #12 requires facilities to implement security measures designed to: (i) verify and validate 

identity; (ii) check criminal history; (iii) verify and validate legal authorization to work; and (iv) 

identify people with terrorist ties. The facility is responsible for the first three tasks and for 

determining what criminal background findings would be disqualifying. Evaluating terrorist ties 

requires federal government involvement, however, in the form of evaluating names against the 

national Terrorist Screening Database (TSDB) maintained by the FBI. 

Last year, DHS announced its intent to establish a web-based application that would require 

facility owners and operators to submit personally-identifying information about current and 

prospective employees, as well as contractor and visitor personnel seeking access to a plant. 

Contrary to the flexible spirit of the CF ATS program, this proposal would not grant companies 

the ability to decide how to vet personnel, such as accepting any of the half-dozen or so other 

federally-issued credentials that involve a TSDB check unless facilities gather additional 

information from persons presenting them. 

Our industry has expressed serious reservations about the logistical nightmares that this proposal 

could lead to, given the heavy presence of contractors at chemical sites, especially during plantwide maintenance "turnarounds." We have strongly urged DHS to accept other federally-issued 

credentials that involve a TSDB check without further collection of information. Unions have 

also expressed concern about DHS's proposal. 

DHS has been open to discussing alternative approaches, and the industry has proposed both 

interim and long-term alternatives that could involve reliance on existing federal vetting 

programs, mechanisms by which contractor and visitor employers could submit information 

regarding their own employees, and ultimately a universal federal security credential that would 

supersede all others. 

Many smaller companies like Pilot Chemical would benefit from leveraging existing processes 

for vetting individuals that we feel meet the intent of the standards. DHS's prior proposal would 

unnecessarily limit the number of options open to regulated facilities for complying with REPS 

#12. 

We have had productive discussions with the Office of Infrastructure Protection on our 

proposals, and DHS has accepted some of them (and backed offfrom some of its other 

6 
73 


82834.042

problematic proposals). DHS has also shown a good faith effort to engage industry since it 

withdrew its initial proposal in July from the Office of Management and Budget, which was 

reviewing it under the Paperwork Reduction Act. However, further progress has had to struggle 

against the desires of some within DHS to make CF ATS a system for tracking which persons 

have ever had access to which chemical facility. 

Moving forward, I would emphasize that smaller companies have a seat at the table on personnel 

surety. 

Resolving this challenge expeditiously would free up ISCD resources to focus on the more 

pressing tasks of approving SSPs and initiating compliance inspections. 

D. Stalled Progress in Developing a Viable ASP 

The Alternative Security Program (ASP) originated under the Coast Guard's Maritime 

Transportation Security Act (MTSA) program. The concept was to be a standardized plan 

designed for particular classes of facilities that would be more tailored to their circumstances and 

more flexible and open-ended option. 

DHS's first mistake in this regard was in its Interim Final Rule, when DHS abandoned its 

original proposal and limited ASPs to individual facilities - so that DHS could not approve a 

single ASP for more than one facility.! This is one of the few areas where DHS could and 

should revise its CFATS regulations to make them better. 

As a result ofDHS's change, the option for facilities to submit an ASP has all but disappeared. 

Again, DHS has said that it wants to engage regulated facilities in developing more useful ASPs, 

but these discussions have not yet borne fruit. Many companies, including SOCMA members, 

have said that in order to produce an ASP template that satisfies DHS, they essentially need to 

replicate the SSP. For this reason, Pilot Chemical has chosen not to even attempt crafting an 

ASP. Until it revises its rules, DHS needs to be more open to models that are more like the 

security plans that companies actually use, and to approve generic or model ASPs that individual 

facilities could adopt for their own submissions. 

E. Delays in CSAT Tool Improvement 

The SSP tool was developed without sufficient input from industry. As a result, it is really a data 

collection tool, not a plan. A site security plan is an actionable document that tells managers 

what to do in a given circumstance. The CSAT SSP does not do this - you cannot manage with 

it. 

DHS has been working, on and off, for over a year on a HGen II" SSP. DHS should accelerate 

that work. They should actively engage the industry in that process and work closely together to 

produce a product that makes sense and meets the needs of both DHS and facilities. 

1 Compare current 6 C.F.R. § 27.235 with the proposal (located at 71 Fed. Reg. 78298, Dec. 28,2006). 

7 
74 


82834.043

III. DHS Must Improve Communication with the Regulated Community and Embrace 

Industry to Achieve Real Progress in Implementation 

As I have testified today, and as SOCMA has repeatedly testified before, the CFATS framework 

is sound, but DHS's implementation has been flawed. This is largely because DHS has drifted 

away from the spirit of the public-private partnership on chemical security that it has so often 

hailed as a keystone of the CFATS program. Congress should encourage ISCD to work 

collaboratively with the regulated community to solve the technical, training and tool-related 

issues currently presenting challenges to the implementation of CF A TS. Additionally, DHS 

must provide better guidance to the regulated community - particularly smaller companies 

without the benefit of a team of in-house experts or a budget that can accommodate outside 

consultants - on how to produce a SSP or ASP that meets the requirements of the RBPS. 

Industry can provide much assistance moving forward, including ways for DHS to minimize the 

future cost and complexity of the CF A TS program. SOCMA believes that CF A TS can 

successfully be implemented without the need for additional legislation. Success will require 

DHS to (i) give CF A TS facilities regulatory certainty; (ii) make demonstrable progress 

reviewing and approving SSPs and inspecting facilities; and (iii) suitably engage industry in 

improving the CF A TS program, especially as regards SSPs, ASPs and personnel surety. 

Congress can increase the chances of success by (i) conducting regular oversight, (ii) 

reauthorizing the statute for an extended period of time; and (iii) adequately funding the CF ATS 

program. 

I appreciate this opportunity to testify before you today and look forward to your questions. 

8 
75 

Mr. SHIMKUS. The chair now recognizes Ms. Fendley for 5 minutes. 

STATEMENT OF ANNA FENDLEY 

Ms. FENDLEY. Thank you. Chairman Shimkus, Ranking Member 

Green, and members of the committee, thank you for the opportunity to be here today. 

I represent the Health, Safety, and Environment Department for 

the United Steel, Paper and Forestry, Rubber, Manufacturing, Energy, Allied Industrial, and Service Workers International Union— 

‘‘USW’’ for short. We represent 850,000 workers in the sectors I 

just mentioned and many others, including the majority of unionized workers in the chemical industry and hundreds of thousands 

of men and women whose workplaces use and store large quantities of industrial chemicals. 

I am here today on the 11th anniversary of the September 11th 

attacks to talk about the critical and unfulfilled need for comprehensive chemical security protections for workers and citizens. 

There were promises and hopes that CFATS would protect American citizens when it was enacted as a temporary measure before 

a more comprehensive program could be passed. And some security 

measures have been implemented under CFATS. But CFATS is not 

and never will be the comprehensive program that we need to protect against an unforeseen terrorist attack. 

Most notable for our members are several gaps in CFATS jurisdiction that leave millions of Americans and American infrastructure at risk. CFATS exempts thousands of water-treatment facilities containing poisonous chlorine gas and other chemicals. It also 

exempts port facilities on navigable waters which are covered by 

the Maritime Transportation Security Act. 

Many of those port facilities are oil refineries, where our USW 

members work in the vicinity of small towns and major U.S. cities 

like Houston, Philadelphia, Los Angeles, and San Francisco. Other 

facilities that fall outside of CFATS are those under the jurisdiction 

of the U.S. Coast Guard, the Department of Energy, the Department of Defense, and the Nuclear Regulatory Commission. 

CFATS also does not cover chemicals shipped or stored outside 

the fence line in nearby rail yards or elsewhere that may have little or no security measures. It does not prohibit the shifting of 

these risks from one location to another. I have seen pictures and 

gotten accounts from our members of railcars full of hazardous 

chemicals parked for days outside the fence line, within yards of 

a busy road, near homes and other businesses. 

Employers may engage in this form of risk-shifting to be taken 

off the list of high-risk facilities, or risk-shifting could be an established practice, occurring for years, because workers and management simply do not recognize the hazard and the potential for a 

criminal act. Under CFATS, there is no way of knowing if and how 

these risks are being shifted. 

Additionally, CFATS explicitly prohibits the requirement of any 

particular security measures, such as safer chemical processes. My 

colleagues and I work with employers every day. Many take safety 

measures that go above and beyond, but there are always some 

76 

that will only do the minimum required by law and, as we all 

know, some who won’t even do that. 

Some companies have shifted to safer processes or reduced their 

inventory of hazardous chemicals. These facilities include where 

our USW members make paper, aluminum, glass, and other products. But many companies will never even look at innovating without a legal requirement to do so. 

Another important deficiency of CFATS is the lack of a meaningful role for workers in chemical security. Workers who operate and 

maintain facilities know the most about what needs to be done to 

reduce vulnerability and protect against a terrorist attack. However, under CFATS, background checks done by employers or third 

parties may be used against workers or be full of inaccuracies due 

to errors in reporting. CFATS also is lacking in its provisions for 

an appropriate appeal process when errors made in background 

checks improperly exclude workers. 

Employer background checks allow for a risk of releasing personal information and may also result in duplication of effort when 

many workers at high-risk sites already must acquire a Transportation Worker Identification Credential, a TWIC, issued by the 

TSA, which is part of DHS but separate from the CFATS office. 

TWIC requires background checks, and TSA safeguards personal 

information. 

Workers across this country, those who would be hurt first and 

worst during an attack, need stronger comprehensive chemical security legislation that is effectively implemented. Congress can no 

longer simply oversee implementation of a measure that was intended as temporary. Action is needed to legislate a comprehensive 

chemical security program that addresses the gaps in CFATS that 

leave millions of American workers and their families at risk. You, 

Mr. Chairman, and your committee could take action to make these 

improvements. 

Thank you again for the opportunity to testify today. 

Mr. SHIMKUS. Thank you very much. 

[The prepared statement of Ms. Fendley follows:] 

77 


82834.044

Testimony of 

Anna Fendley, MPH 

Health, Safety and Environment Department 

United Steelworkers 

before the 

House Subcommittee on Environment and the Economy 

on 

The Chemical Facility Anti-Terrorism Standards Program - A Progress 

Report 

September 11,2012 

Washington, DC 

Chairman Shimkus, Ranking Member Green and members of the 

Committee, thank you for the opportunity to testify today on the important 

issue of chemical safety and security. My name is Anna Fendley. I represent 

the Health, Safety and Environment Department for the United Steel, Paper 

and Forestry, Rubber, Manufacturing, Energy, Allied Industrial and Service 

Workers International Union - USW for short. We represent 850,000 

workers in the sectors Ijust mentioned and many others, including the 

majority of unionized workers in the chemical industry and hundreds of 

thousands of men and women whose workplaces use and store large 

quantities industrial chemicals. 

I am here today, on the eleventh anniversary of the September 11 th 

attacks, to talk about the critical and unfulfilled need for comprehensive 

chemical security protections for workers and citizens who are put at risk by 

working in or living near the nation's chemical facilities. 

There were promises and hopes that the Chemical Facility AntiTerrorism Standards Program (CF ATS) would protect American citizens 

when it was enacted as a temporary measure before a more comprehensive 

program could be passed. And some security measures have been 

implemented under CFATS. But CFATS is not and never will be the 

comprehensive program that we need to protect against an unforeseen 

terrorist attack or an accidental release that could be equally devastating. 

Most notable for our members are several gaps in CFATS's 

jurisdiction that leave millions of Americans and American infrastructure at 

risk. CFATS exempts thousands of water treatment facilities containing 

poisonous chlorine gas and other chemicals because those facilities are 

covered by the Public Health Security and Bio-terrorism Preparedness and 

Response Act of 2002. It also exempts port facilities on navigable waters 
78 


82834.045

which are covered by the Maritime Transportation Security Act (MTSA) of 

2002. Many of those port facilities are oil refineries where our USW 

members work in the vicinity of small towns and major US cities like 

Houston, Philadelphia, Los Angeles and San Francisco. Other facilities that 

fall outside of CF A Ts are those under the jurisdiction of the US Coast 

Guard, the Department of Energy, the Department of Defense and the 

Nuclear Regulatory Commission. 

CF ATS also does not cover chemicals shipped or stored outside the 

fence line in nearby rail yards or elsewhere that may have little or no 

security measures. It does not prohibit the shifting of these risks from one 

location to another. I have seen pictures and gotten accounts from our union 

members of rail cars full of hazardous chemicals parked for days outside the 

fence line within yards of a busy road near homes and other businesses. 

Employers may engage in this form of risk shifting to be taken off the list of 

high-risk facilities, or risk shifting could be an established practice occurring 

for years because workers and management simply do not recognize the 

hazard and the potential for a criminal act. Under CF ATS there is no way of 

knowing if and how these risks are being shifted, leaving large numbers of 

Americans in danger. 

Additionally CF ATS explicitly prohibits the requirement of any 

"particular security measure," such as safer chemical processes. My 

colleagues and I work with employers every day. Many take safety measures 

that go above and beyond, but there are always some that will only do the 

minimum required by law and as we all know some who refuse to even do 

the minimum required. Some companies have shifted to safer processes or 

reduced their inventory of hazardous chemicals so they are no longer listed 

as high risk. These include high profile companies like Clorox, which 

switched from chlorine gas to the safer liquid bleach. It also includes smaller 

facilities where our USW members make paper, aluminum, glass, and other 

products. But many companies will never even look into innovating with 

safer chemical processes without a legal requirement to do so. Those are the 

facilities that put American workers and their families at risk during a 

terrorist attack. 

Another important deficiency of CF ATS is the lack of a meaningful 

role for workers in chemical security. Workers who operate and maintain 

facilities know the most about what needs to be done to reduce vulnerability 

and protect against a terrorist attack. However, under CFATS background 

checks done by employers or third parties mayobe used against workers or be 

full of inaccuracies due to errors in reporting. CF A TS also is lacking in its 

provisions for an appropriate appeal process when errors made in 

2 
79 


82834.046

background checks improperly exclude workers. Employer background 

checks allow for a risk of releasing personal information and may also result 

in duplication of effort when many workers at high-risk sites already must 

acquire a Transportation Worker Identification Credential (TWIC) issued by 

the Transportation Security Administration, which is part of the Department 

of Homeland Security but separate from the office that oversees CFATS. 

TWIC requires background checks, and TSA safeguards personal 

information. 

Workers across this country, those who would be hurt first and 

worst during an attack, need stronger comprehensive chemical security 

legislation that is effectively implemented. Congress can no longer simply 

oversee implementation of a measure that was intended as temporary. Action 

is needed to legislate a comprehensive chemical security program that 

addresses the gaps in CFATS that leave millions of American workers and 

their families at risk. You, Mr. Chairman, and your committee could take 

action to make these improvements. 

Thank you again for the opportunity to testify today as we remember 

those who were killed in the terrorist attacks on September 11 th and stand 

ready to work with you to improve chemical plant safety and security. 

3 
80 

Mr. SHIMKUS. And, Mr. Orum, you are recognized for 5 minutes. 

Thanks for joining us. 

STATEMENT OF PAUL ORUM 

Mr. ORUM. Good afternoon. I am Paul Orum. I am pleased to 

represent the views today important to the Blue Green Chemical 

Security Coalition, as well as findings from research conducted for 

the Center for American Progress and others. 

I plan to make three main points: one, the chemical security 

problem is well-known; two, the current program, CFATS, won’t, in 

my view, fix the problem; and, three, Congress should pass comprehensive chemical security legislation. 

The chemical security problem is well-known. More than two 

dozen government agencies and others have warned that industrial 

chemicals could be intentionally or inadvertently released to cause 

harm. Many of these resources are listed in my testimony, and for 

brevity I won’t repeat them. 

Two, the current temporary Chemical Facility Anti-Terrorism 

Standards won’t fix the problem. The standards lack basic elements of an effective program. CFATS exempts drinking-water facilities, exempts wastewater facilities, exempts many major refineries and terminals and chemical manufacturers that happen to be 

on navigable waters. 

It excludes knowledgeable employees and their representatives 

from security planning. It doesn’t allow DHS to require companies 

to fix specific security problems on the ground. It lacks clear deadlines for completion and approval of assessments and plans. It 

lacks basic government accountability measures, such as regular 

progress reports. 

It doesn’t secure chemical supply chains. In my view, it perpetuates uncertainty. And, very importantly, it neglects technological 

changes that can make chemical facilities less attractive targets. 

These flaws are in the law. They are all found in the appropriations rider that created CFATS as a temporary program. 

Congress should authorize a comprehensive chemical security 

program. The last Congress, about 3 years ago, did so after—the 

House passed after a lengthy consultation with stakeholders in 

four congressional committees. This bill would have closed the 

greatest loopholes while seamlessly incorporating CFATS. It is the 

responsibility of Congress to authorize a comprehensive program. 

In addition, Congress should support, not hinder, existing authority of the U.S. EPA to promote safer technologies under the 

general duty clause of the Clear Air Act and, likewise, the authority of DHS to promote intrinsically more secure technologies as a 

security measure under CFATS. 

While Congress should close all the chemical security loopholes, 

I would like to elaborate on two current deficiencies. 

First, government accountability. If we spent $500 million on 

chemical security, it is important for the public to know what the 

effort is producing. 

The comprehensive program passed in 2009 included government 

accountability provisions, namely, regular public progress reports 

to Congress. The reports were to summarize how facilities were 

complying and lay out the basic scope of the program—how many 

81 

facilities, how many plants, how many approved, and so forth. Had 

these provisions been included in CFATS, the first report to Congress would have been due some 5 years ago, and many challenges 

would have come to light systematically rather than as a result of 

leaked internal memoranda. 

In my opinion, the program will inevitably lack public credibility 

if it doesn’t require a complete public accounting of facilities and 

scope and progress. 

An effective program should also help companies identify and remove avoidable chemical hazards. Under CFATS, DHS has not developed the removal of unnecessary chemical targets as a security 

measure. 

We know that some 1,600 or more facilities have reportedly removed chemicals of concern and others have dropped below reporting thresholds. While we lack basic public information about these 

changes, the numbers do suggest that much more than this could 

be done with a structured program. 

Each facility that tiers out of the program is a facility that DHS 

does not have to oversee. Removing unnecessary targets should be 

one of the tools in the chemical security toolbox. 

Thank you again for the opportunity to testify. Please let me 

know of any questions or ways that I or my colleagues can be helpful to the committee. 

Mr. SHIMKUS. Thank you very much. 

[The prepared statement of Mr. Orum follows:] 

82 


82834.047

Testimony of Paul Orum 

Blue Green Chemical Security Coalition! 

Independent Consultant to Center for American Progress 

before the 

Energy and Commerce Committee 

Subcommittee on Environment and the Economy 

U.S. House of Representatives 

on 

The Chemical Facility Anti-Terrorism Standards Program -

A Progress Report 

September 11,2012 

My name is Paul Orum, and I have worked more than 20 years for 

effective chemical safety and security policies, most recently as a 

consultant to public interest organizations. My primary expertise is 

government information policy regarding hazardous chemicals. 

Thank you for the opportunity to testifY on the nation's chemical 

security program. 

The Blue Green Chemical Security Coalition of labor, community, 

and public health organizations supports chemical security policies 

that include safer and more secure technologies, employee 

participation, and government accountability. Two relevant letters 

from this coalition are attached to my testimony. 

I will make three main points: 

I) The problem is well known; 

2) The current program won't fix the problem; 

3) Congress should pass comprehensive chemical security 

standards. 
83 


82834.048

1. The chemical security problem is well known. 

Many government agencies and others have documented the 

problem. Large quantities of industrial chemicals can cause serious 

harm if suddenly released, particularly in populated areas, and 

cannot be secured by conventional security alone. 

• More than two-dozen government agencies, industry 

associations, labor unions, insurers, think tanks, public 

interest groups, and others have warned that industrial 

chemicals could be intentionally or inadvertently released to 

cause harm in workplaces, businesses, and communities. i 

• Some 480 industrial facilities across the country pose worstcase chemical release hazards to any of 100,000 or more 

nearby residents. ii 

• Local emergency response capacities are not typically 

sufficient or designed to handle a worst-case release. 

• A worst-case release is a low probability, high consequence 

event that is difficult for market forces to account for without 

government standards. 

The problem is well known. Effective action is overdue. 

2. Current temporary Chemical Facility Anti-Terrorism 

Standards (CFATS) won't fix the problem. 

The current temporary standards lack basic elements of an 

effective program. The CF ATS program: 

• Exempts drinking water facilities; 

• Exempts wastewater facilities; 

• Exempts many major refineries, terminals, and chemical 

manufacturers that happen to be on navigable waters;iii 
84 


82834.049

• Excludes knowledgeable employees and their representatives 

from security planning; 

• Does not allow the Department of Homeland Security (DHS) 

to require companies to fix specific security problems on the 

ground; 

• Lacks clear deadlines for the completion and approval or 

disapproval of facility security assessments and plans; 

• Lacks basic government accountability measures such as 

regular progress reports to Congress; 

• Does not provide citizen enforcement suits or petitions of the 

government to ensure implementation; 

• Does not secure chemical supply chains, relying instead on 

conventional security and continuing current indirect 

subsidies that encourage pervasive shifting of chemical 

hazards among locations; 

• Perpetuates uncertainty by sinking time and resources into 

conventional security measures that may inevitably fall short; 

• Neglects technological changes that can make chemical 

facilities less attractive targets-the most foolproof 

solution-while modernizing operations. 

The flaw is in the law. These deficiencies are all in the 

appropriations rider that created CF A TS as a temporary program. 

3. Congress should authorize a comprehensive chemical 

security program. 

The last House of Representatives passed a credible compromise 

bill (H.R. 2868, 111 th Congress) after lengthy consultation with 

stakeholders and four Congressional Committees. This bill would 

have closed the greatest security loopholes while seamlessly 

incorporating CF ATS, but the Senate failed to act. It is the 

responsibility of Congress to authorize a comprehensive program. 
85 


82834.050

In addition, Congress should support, not hinder, the existing 

authority of the Environmental Protection Agency to promote safer 

technologies under the general duty clause of the Clean Air Act. iv 

Congress should likewise support the authority of the Department 

of Homeland Security to promote intrinsically more secure 

technologies as a security measure under CF ATS. 

While Congress should close all the chemical security loopholes, I 

would like to elaborate on two current deficiencies: 

Government Accountability 

If Congress directs millions of dollars to chemical security, it is 

important for the public to know what the effort is producing. The 

comprehensive program passed in 2009 (H.R. 2868, 111 th 

Congress) included government accountability provisions that are 

much more structured than the leaked documents by which 

Congress is now belatedly reviewing the program-namely regular 

public progress reports to Congress. 

The reports were to summarize how facilities were complying with 

performance standards and to enumerate the basic scope of the 

program, such as the number of facilities that: 

• possess chemicals of concern; 

• are assigned a risk tier by DHS; 

• submit vulnerability assessments and site security plans; 

• have assessments and plans approved or disapproved; 

• have received compliance orders, civil penalties, or 

administrative penalties, 

• exit the program and the methods used; 

• and other relevant measures of program activity.v 

Had these oversight provisions been included in CF A TS, the first 

report to Congress would have been due some five years ago, with 

subsequent reports due regularly thereafter. Many implementation 

challenges would have come to light systematically years ago 
86 


82834.051

rather than as the result of an internal memorandum leaked to the 

news media. Oversight by leaked memoranda is not as effective as 

regular public progress reports. 

The program will inevitably lack public credibility if it doesn't 

require a complete public accounting of facilities, scope, and 

progress. Periodic progress reports provide a basis to monitor and 

improve implementation. 

Intrinsically More Secure Facilities 

An effective chemical security program should help companies 

identifY and remove avoidable chemical hazards. Such provisions 

were included in the comprehensive bill of 2009. In comparison, 

under CF ATS the DHS has not developed the removal of 

unnecessary chemical targets as a security measure. 

Under CFATS more than 1,600 facilities have reportedly 

completely removed their chemicals of concern, and more than 700 

additional facilities have reduced chemicals below high-risk 

thresholds. While we lack basic public information about these 

changes, the numbers do suggest that much more could be done 

with a structured program that requires companies to do their 

homework. Each facility that tiers-out of the program is a facility 

that DHS does not have to oversee. Removing unnecessary targets 

should be one of the tools in the chemical security toolbox. 

Policy makers need better information from covered facilities 

about methods to remove avoidable chemical hazards. The 2009 

House-passed bill required high hazard chemical facilities to report 

to DHS "the technical feasibility, costs, avoided costs (including 

liabilities), personnel implications, savings, and applicability of 

implementing each method to reduce the consequences of a 

terrorist attack. "vi 
87 


82834.052

Such reporting would help generate solutions. It should produce 

information on the substances, industry sectors, and processes 

involved at facilities that tier-out of the program, and the most 

common methods used such as: substituting a less hazardous 

chemical; using a chemical in a less hazardous form; using an 

alternate process; producing and using a chemical as needed in 

process without storage; or reducing inventory. 

Survey reports I produced through the Center for American 

Progress identified alternatives that are already in use at hundreds 

of facilities across more than 20 industry sectors.vii But even in 

industry sectors that show gradual improvement, such as water and 

wastewater treatment, it would take more than half a century to 

remove high-hazard processes. A structured program can 

accelerate progress. 

Thank you for the opportunity to testifY. Please let me know any 

questions and ways that I, or my colleagues, can be helpful to the 

Committee. 

Attachments: 

Blue-Green Coalition letter to House of Representatives, June 21, 2011. 

Blue-Green Coalition letter to President Obama, May 16,2012. 

, Sample reports and statements warning about chemical terrorism include: 

• The Chemical Threat to America, by Christine Todd Whitman in the New York Times, August 29, 

2012. 

• Preventing Toxic Terrorism: How Some Chemical Facilities are Removing Danger to American 

Communities, Center for American Progress, 2006. 

• Toxic Trains and the Terrorist Threat: How Water Utilities Can Get Chlorine Gas off the Rails and Out 

of American Communities, Center for American Progress, 2007. 

Chemical Security 101: What You Don't Have Can't leak, or Be Blown Up by Terrorists, Center for 

American Progress, 2008. 

• Safer Chemicals Create a More Secure America: We Can Diminish the Security Threat from Chemical 

Plants, Center for American Progress, 20 I O. 

• Wastewater Facilities: Experts' Views on How Federal Funds Should Be Spent to Improve Security, 

Government Accountability Office, GAO-05-165, January 2005. 

• Chemical Terrorism: US Policies to Reduce the Chemical Terror Threat, Partnership for a Secure 

America, September 2008. 

• National Planning Scenario 8: Chemical Attack-Chlorine Tank Explosion, Homeland Security 

Council in partnership with the Department of Homeland Security, 2005. 
88 


82834.053

• Statement before the U.S. House of Representatives Committee on Transportation and Infrastructure, 

Subcommittee on Railroads, Association of American Railroads, June 13,2006. 

• Homeland Security Committee Urged to Consider Safer Chemicals; Chemical Companies Should Stop 

Manufacturing Extremely Dangerous Chemicals, Association of American Railroads, 2008. 

• Catastrophe, Injury, and Insurance: The Impact of Catastrophes on Workers Compensation, Life, and 

Health Insurance, Risk Management Solutions, Inc., 2004. 

• Assessing Terrorist Motivations for Attacking Critical "Chemical" Infrastructure, Laurence Livermore 

National Laboratory, December 20, 2004. 

• Testimony of Dr. Jay Boris before the City Council of the District of Columbia, U.S. Naval Research 

Laboratory, October 6,2003. 

• A Method to Assess the Vulnerability of U.S. Chemical Facilities, National Institute of Justice, U.S. 

Department of Justice, November 2002. 

Strategic Plan for Homeland Security, U.S. Environmental Protection Agency, September 2002. 

Homeland Security: Voluntary Initiatives Are Under Way at Chemical Facilities, but the Extent of 

Security Preparedness is Unknown, U.S. General Accounting Office, GAO·03·439, March 14,2003. 

Homeland Security and the Private Sector, Congressional Budget Office, December 2004. 

• Statement by the Department of Homeland Security on Continued AI-Qaeda Threats, Department of 

Homeland Security, November 21, 2003. 

Industrial Chemicals and Terrorism: Human Health Threat Analysis, Mitigation and Prevention, 

Agency for Toxic Substances and Disease Registry, 1999; and, Terrorist Use of Expedient Chemical 

Agents: Health Risk Assessment and Las Vegas Case Study, Agency for Toxic Substances and Disease 

Registry, undated. 

• Study Assesses Risk of Attack on Chemical Plant, Army Surgeon General reported in Washington 

Post, March 12,2002. 

The Terrorist Threat in America, Chemical Manufacturers Association (American Chemistry Council), 

April 1998. 

• PACE International Union Survey: Workplace Incident Prevention and Response Since 9111, Paper, 

Allied-Industrial, Chemical and Energy Workers International Union (PACE), October 27, 2004. 

America the Vulnerable: How Our Government Is Failing to Protect Us From Terrorism, Stephen 

Flynn, 2004. 

Protecting the American Homeland, Brookings Institution, March 2002. 

Toxic Warfare, RAND Corporation, 2002. 

• News Release: Chemical Facilities Vulnerable, Center for Strategic and International Studies, 

December 23, 2003. 

• Eliminating Hometown Hazards: Cutting Chemical Risks at Wastewater Treatment Facilities, 

Environmental Defense, December 2003. 

• The Safe Hometowns Guide, The Safe Hometowns Initiative, 2002. 

• Needless Risk: Oil Refineries and Hazard Reduction, U.S. PlRG Education Fund, August 2005. 

Unnecessary Dangers: Emergency Chemical Release Hazards at Power Plants, Working Group on 

Community Right-to-Know, July 21, 2004. 

• Chemical Plants Remain Vulnerable to Terrorists: A Call to Action. United Steelworkers of America, 

undated. 

High Alert: Workers Warn of Security Gaps on Nation's Railroads, International Brotherhood of 

Teamsters, 2005. 

Making the Nation Safer: The Role of Science and Technology in Countering Terrorism, National 

Research Council, National Academy of Sciences, 2002. 

Terrorism and the Chemical Infrastructure: Protecting people and Reducing Vulnerabilities, National 

Research Council, National Academy of Sciences, 2006. 

• The Use and Storage of Methyl Isocyanate (MIC) at Bayer Crop Science, National Research Council, 

National Academy of Sciences, 2012. 

i, Congressional Research Service, Memorandum to Senator Frank Lautenberg, April 12, 20 II. 

'" Sample Maritime Transportation Security Act regulated facilities that are reportedly exempt from CFATS 

include: Kuehne Chemical, South Kearny, N.J.; Citgo Refinery, Corpus Christi, Texas; Valero Refinery, 
89 


82834.054

Port Arthur, Texas; Marathon Refinery, Texas City, Texas; Bayer CropScience, Institute, W.V.; Dow 

Chemical, Freeport, Texas. 

>V See the National Environmental Justice Advisory Council letter to EPA Administrator Lisa Jackson, 

March 14, 2012. https:lls3 .amazonaws.com/s3.documentcloud.orgidocuments/332041 /nejac-Ietter.pdf 

, H.R. 2868, III th Congress, Section 2119. 

" H.R. 2868, III th Congress, Section 2111. 

VB Center for American Progress: Leading Water Utilities Secure Their Chemicals (2010); Chemical 

Security 101: What You Don't Have Can't Leak, OrBe Blown Up by Terrorists (2008); Toxic Trains and 

the Terrorist Threat: How Water Utilities Can Get Chlorine Gas Off the Rails and Out of American 

Communities (2007); Preventing Toxic Terrorism: How Some Chemical Facilities Are Removing Danger 

to American Communities (2006). 
90 

Mr. SHIMKUS. I am going to ask unanimous consent that Mr. 

Pompeo can sit in. I know there may be another from your side 

joining us. And then, as per tradition, if members of the subcommittee are done asking their questions, then we will go to other 

members from the full committee who are joining us. 

So, with that, I recognize myself for 5 minutes, and my questions 

will start with Mr. Scott. 

It is my view that CFATS officials are trying to operate a regulatory program like a police program. This brings me to concerns 

with the personnel surety program, which has been addressed a 

couple times today already. 

As I understand it, the terrorist screening database is operated 

by the Federal Bureau of Investigation, not DHS. Under another 

DHS program, the Maritime Transportation Security Act—we do a 

lot of acronyms, so I like to read these out—if someone with a 

TWIC card gets a hit on the terrorist screening database, the 

TWIC is automatically deactivated and the facility notified. Minimum DHS interference in that process. 

Under CFATS, the program seems to insist that all information 

be passed through them to the FBI but that the Infrastructure Security Compliance Division cannot let a facility know if a terrorist 

is working in their plant. 

Do you agree with me that DHS is not trying to operate CFATS 

like it was intended by Congress but more like a policing and response program? 

Mr. SCOTT. Yes, sir. They seem to be gathering information and 

holding information within DHS instead of sharing in a partnership, as we started out. 

So the TWIC program and the background check program, personnel surety is one example of that, where we would be required 

to submit information to DHS and really never get an answer back. 

Especially concerning is we don’t get an answer back if they do 

have somebody that is a hit in the terrorist database. We are going 

to have them—if they don’t tell us, we still have a potential terrorist working in our plant, and that is absolutely crazy. 

Mr. SHIMKUS. And the first panel, as I was talking to Under Secretary Beers and I—how can you give approval or the wink and 

nod that a facility has been approved when they really haven’t established the personnel surety program in an operation? I would 

think that would be the number-one concern. 

If DHS has no response function, is there a reason why the facility cannot communicate directly with the FBI? 

Mr. SCOTT. No, there is absolutely no reason. In fact, most facilities are going to communicate with their local Joint Terrorism Task 

Force and the FBI and the local law enforcement. I mean, that is 

the response agencies for a situation that does occur at your site. 

Mr. SHIMKUS. Has your experience under the MTSA, which is the 

Maritime Transportation Security Act, led you to believe that it is 

doable to prevent known terrorists from wandering around a landbased plant? 

Mr. SCOTT. Several of our larger sites are covered under the Maritime Transportation Security Act. And we have a very good relationship, and the Coast Guard is a very strong organization, both 

on the response side and the enforcement side, and have worked 

91 

with us very closely because our MTSA sites have the same security upgrades and same security programs as all of our CFATS-covered sites. 

Mr. SHIMKUS. Why do you believe strongly, as some of the panelists do not, that EPA should not be the chemical security agency 

for the Federal Government? 

Mr. SCOTT. Well, the general duty clause was—it came to us 

under the Clean Air Act. It is specifically designed for environmental protection and does a very good job—EPA does a very good 

job in that respect. They do not have a lot of expertise in site-security types of programs, and we don’t really need to start over with 

a new agency, to go back to square one and try to do this again. 

Mr. SHIMKUS. Thank you. 

Let me turn to Mr. Leary now, because Dow—monstrous, big; 

Mr. Leary—small, hopefully profitable. 

You testified that you have limited capital to invest in needs 

across your plants, not just CFATS-related ones. So what percentage of your capital is being tied up by the poor implementation of 

the CFATS program? 

Mr. LEARY. Chairman, I can’t really speak to the corporation, but 

I can, as an example, talk to you about my department’s budgetary 

concerns. And at least in what I have just submitted—our fiscal 

year runs September—and I think security accounted for over 100 

percent of the budget, as compared to everything else that we are 

tasked to do. 

Mr. SHIMKUS. How do we assure that the real financial needs of 

your security professionals are taken seriously within the context 

of CFATS implementation? 

Mr. LEARY. Chairman, I can only speak for Pilot in this respect. 

And I am very proud to report to the subcommittee that I have 

been given more than enough support to do so. And at least from 

a Pilot perspective, there have been no issues whatsoever in terms 

of getting support to go ahead and do what we have to do under 

the standard. 

Mr. SHIMKUS. Thank you. 

I have 13 seconds left. I will yield back my time and turn to my 

ranking member, Mr. Green, for 5 minutes. 

Mr. GREEN. Again, thank you for being here and patient today. 

Were you here during the first panel? 

Mr. LEARY. Uh-huh. 

Mr. GREEN. The question for all of you, including the U.S. Steelworkers, is that the CFATS personnel surety program proposal was 

recently rescinded and received much criticism from industry and 

unions. Can you explain what the criticism was? And how did DHS 

respond to your concerns? 

Mr. SCOTT. I will be glad to address that a little bit. 

The concern is the burden on industry. You have many sites 

that, mentioned earlier, have a contractor base that travels along 

the gulf coast, for example, during all the shutdowns, and you may 

have thousands of new employees coming in on a daily basis for a 

shutdown. And they may show up at The Dow Chemical Company 

today, and we would have to submit a thousand names. And they 

may show up tomorrow at one of our neighboring companies, and 

they will have to submit the same thousand names. 

92 

It is a very burdensome process. And they don’t recognize any 

easy solutions that are out there, like a TWIC card from MTSA. 

Mr. GREEN. And I have a Dow facility in my district, not your 

largest, obviously, not Freeport, but I assume the contractors have 

their TWIC cards. 

Mr. SCOTT. Most contractors on the gulf coast have a TWIC card 

and they travel between sites. 

Mr. GREEN. Yes. OK. 

Any other response to that? 

Were the steelworkers brought in? I am glad, you know, the industry—was the small chemical—I have to admit, I don’t have 

many small plants in our area; we have big plants. But were the 

small plant owners also brought in, along with steelworkers? 

Mr. LEARY. Yes, I will—at the recent security summit, put on by 

SOCMA and I believe cosponsored by DHS, actually Pilot had an 

opportunity to sit in on a roundtable with DHS regarding just this 

topic. And I was surprisingly pleased that we were actually asked 

our opinion. And so I do believe at least they are concerned about 

our opinions. 

Mr. GREEN. Ms. Fendley? 

Ms. FENDLEY. To my knowledge, we were not brought in. But we 

are very concerned about the deference to industry, as well, and 

the lack of an appeals process if there is an error. 

Mr. GREEN. You know, it seems like the testimony from our previous panel said that they were working with the employee groups. 

Did I mishear that from the earlier panel? That is what I am concerned about. And believe me, we want everybody at the table, you 

know, about whether it be the industry, small or large, but also the 

employees involved there. 

Maybe that opening went because they announced that they 

were going to deal with using the TWIC-type application, which I 

know—I have lots of steelworkers, I have four of my five refineries 

and a number of my chemical plants are organized by the steelworkers. And a few years ago, we had problem-solving, because 

some of my constituents were denied their TWIC card, but then we 

would find out it was a mistake, and we would work with them on 

that. And I know, with our renewal coming up now, it is going to 

be a problem. 

But we understand the problem we have. We don’t want to reinvent it with another type of surety. And that is what worries me. 

They ought to base it on whether you are—and Dow has, at least 

in my area, they are all waterside, both Freeport and the one on 

the Houston Ship Channel. But I know you have plants that are 

not. 

And is Pilot covered by it in Cincinnati—— 

Mr. LEARY. No, sir. 

Mr. SHIMKUS [continuing]. The TWIC card? 

Mr. LEARY. No, sir. It is not. Actually, our knowledge of the 

TWIC beyond these proceedings and our involvement with SOCMA 

is somewhat minimal. 

Mr. GREEN. OK. All right. Well, we will continue to encourage 

them to bring everybody at the table. 

93 

And a question for anyone else on the panel: What would you 

like to see DHS do to help achieve a more smooth implementation 

of the CFATS program? 

One of the things we have all recognized, there has to be some 

continuity and real reauthorization. And we haven’t seen that, and 

I don’t think we will see that this Congress. But the year-to-year 

is an issue. 

But we also need to make sure—because my complaint is that 

the year-to-year, a lot of industries don’t want to spend—they want 

to make sure what they are doing is going to be compliant with 

whatever DHS comes out with. 

Is that an issue that you all dealt with within your companies? 

Mr. LEARY. From a Pilot perspective, that is one of the biggest 

issues, actually. I could easily recount, for much longer than allowed, discussions with our finance director regarding the difficulties in budgeting for securing our facilities. We are very much 

afraid that we will be looking at an SSP approval and immediately 

have to expend thousands of dollars. 

Mr. GREEN. Mr. Scott, one of the concerns I have, because, literally, Dow’s facility is back-to-back in my area, along with a lot 

of other ones, in the testimony that I have read shows that, is 

there an issue with industry taking chemicals that are produced in 

our plants and leaving it at unsecured facilities off-plant-site? 

You know, that bothers me because, again, I would see, in our 

district—and I haven’t had any complaints, but I know that is what 

Ms. Fendley’s testimony that is submitted included. And that is a 

security issue, whether it is made at ABC or Dow or ExxonMobil 

or anybody else, that some volatile chemicals are not in a secure 

facility, including a rail yard that has protections off-site. 

Mr. SCOTT. Sir, we have put the same restrictions, the same requirements on our shippers and on the people that—and I am talking about Dow Chemical now—but, in general, the ACC member 

companies. As part of the Responsible Care Code, security is from 

the production site to the delivery to the customer. So we have a 

strong security program in place. 

And Dow, in particular, we have submitted our site security 

plans to the DHS Safety Act Office and had the site security plans 

approved. And our transportation distribution security plans also 

have certification under the DHS Safety Act Office, which is kind 

of the Good Housekeeping seal of approval. 

So that whole chain of events takes a significant amount of security. So I think ACC member companies certainly take that into 

consideration under the Responsible Care Code. 

Mr. GREEN. OK. 

Thank you, Mr. Chairman. 

Mr. SHIMKUS. The gentleman’s time has expired. 

The chair now recognizes the gentleman from the State of Kansas, Mr. Pompeo, for 5 minutes. Welcome to the subcommittee. 

Mr. POMPEO. Thank you, Mr. Chairman, thank you, Mr. Green, 

for allowing me to participate today. I appreciate it. 

Look, Mr. Scott, I have two questions for you that I wanted to 

come here today and speak about. The first is, in your written testimony, you talked about some of the problems in DHS’s program, 

but you were very clear that the program is fundamentally sound, 

94 

it is risk-based, it is focused on the right set of priorities, so DHS, 

in large measure, has it right. And there are things that we can 

improve on and tweak, but it has largely got it right. 

There are some folks who disagree with that. Former EPA Administrator Christie Whitman said that EPA should be the primary 

agency in charge of chemical security. Greenpeace has said that 

EPA already has the power under the general duty clause, in their 

view. There have been folks at EPA who have suggested that, as 

well. 

As someone who has watched EPA in other places do real harm 

to potentially tens and tens of thousands of jobs across America, 

that causes great concern to me. 

I have introduced legislation that clarifies what I think is already pretty clear regarding the general duty clause. It would require EPA to complete a rulemaking process before finding any facilities in violation of the general duty clause. And it would clarify 

EPA’s jurisdiction by prohibiting it from regulating chemical security through section 112(r)(1), the general duty clause. 

What is your view, Mr. Scott, on the recent calls by the environmental community to try and use the Clean Air Act to regulate 

chemical security when we already have this enormous apparatus 

in place? 

Mr. SCOTT. Well, first, we think your legislation is a step in the 

right direction to clarify roles and responsibilities. 

As I mentioned earlier, EPA and the general duty clause came 

under the Clean Air Act, and EPA is very strong on environmental 

protection and not as strong in site security, physical security, 

transportation security—all the things that come into the supply 

chain around the chemical industry. So that is not their area of expertise, and that is exactly the reason why chemical security was 

put under the Department of Homeland Security, the focus on security and all things in addition to chemical security. 

So the expertise and the foundation for the CFATS program lies 

with DHS, not with EPA. So I don’t think we should muddy the 

waters, change in midstream, or even take one step back. We need 

to move forward with DHS. 

Mr. POMPEO. Right. Do you think there is also some risk that, 

when you have two agencies in, it is contradictory, they present 

competing demands on entities, and all of a sudden we are in a 

worse place than we are even today with the challenges DHS is 

facing? Do you think there is some risk of that, as well? 

Mr. SCOTT. I think if we are going to put an effort in to combine 

some things, it certainly shouldn’t be with DHS and EPA. I would 

look to continue the harmonization with MTSA and CFATS, Coast 

Guard and DHS. A lot of the facilities are very similar. A lot of the 

facilities are already covered by one or the other or sometimes 

both, and I think they can be harmonized extremely well. 

Dow has built our security programs—whether it is a CFATS site 

or an MTSA site, we put security in place at the same level. And 

I think that is the direction we should go if we are going to harmonize. 

Mr. POMPEO. Well, thank you. I appreciate that. 

Your testimony also strongly supported the use of alternative security programs in CFATS by DHS. How broadly do you think the 

95 

ASBs should be applied under CFATS? Is it by facility? Or by sector? Do you have a view, does Dow have a view on that? 

Mr. SCOTT. Well, again, it depends on the site. But you could certainly expand an alternative security plan to companies that puts 

similar security programs in place throughout all of their regulated 

sites. 

So the alternative security plan, the only intent is to give DHS 

all the information they need to make a decision, improve the security of the site, and make it easier on the submission of the information to DHS. That is the goal of an alternative security plan. 

Mr. POMPEO. I appreciate that. 

Last question: Do you think that the ASP provides any less protection for a facility than if the facility were to go through the entire CFATS compliance regime? Or do you think it achieves the 

same objective? 

Mr. SCOTT. It is the same objective. It is just a different way to 

submit the site’s plan, and it is a more expeditious way to submit 

the site’s plan. So there is no difference in the end result. It is either approved or it is not approved, and the security upgrades are 

the same. 

Mr. POMPEO. Great. Thank you. 

Thank you, gentlemen. 

I yield back the balance of my time. 

Mr. SHIMKUS. The gentleman yields back his time. 

The ranking member has asked unanimous consent to ask one 

additional question. Mr. Pompeo, you may want to stay around and 

listen to the answer. 

And, without objection, the gentleman is recognized. 

Mr. GREEN. I would just like the panel, if you would give us an 

opinion. We are having a hearing on Mr. Pompeo’s bill. I have some 

concern, but would you all have any opinion on it? I know it is not 

on the list. 

Mr. ORUM. Yes, I do. 

Mr. GREEN. We will go right to left this time. 

Mr. ORUM. Recall that EPA is the lead agency for security at 

water and wastewater facilities, which are CFATS-exempt. But 

also, more generally, for chemical facilities, people in communities 

don’t necessarily make much of a distinction whether it was inadvertent or deliberate if a gas cloud comes to where they are. 

When EPA acts to reduce catastrophic hazard potentials under 

its authorities, it has the secondary benefit of removing terrorist 

targets. So it is not necessarily so that EPA is acting as a security 

agency, but it may yet have security benefits. 

Mr. GREEN. Ms. Fendley? 

Ms. FENDLEY. I would agree with Mr. Orum. For workers at 

these sites, the potential for a terrorist attack and the potential for 

an accidental release, you know, they would have the same effect. 

And if EPA can also work to reduce the presence and the quantities of hazardous chemicals on these sites, we are incredibly supportive of that. 

Mr. LEARY. SOCMA most certainly supports the bill as intended. 

And I really can’t—I think Mr. Scott said it all in regards to our 

feelings, as well. 

96 

Mr. SCOTT. I have no disagreement as far as the routine operation of the plant. We don’t want an accidental release. We don’t 

want an attack that causes a release. 

EPA takes care of the first part. And we do run our plants safely 

and securely and within EPA guidelines for routine operations. I 

think we need the focus on security to really improve the overall 

security of the sector coming from DHS. 

Mr. GREEN. I have to admit, I have some concern about two Federal agencies dealings with it because we have enough trouble now 

with DHS doing their job. But, you know, EPA does have statutory 

authority already on certain things. But I would hope our Federal 

agencies would work together, instead of you having to jump 

through two hoops. You at least know that these agencies are on 

the same page. 

Mr. SHIMKUS. With that—and I would just weigh in in saying, 

obviously I don’t think the general duty clause has relevance in 

plant security issues. 

So, with that, we appreciate the testimony and the second panel 

coming. 

All members of the subcommittee have 5 days to submit opening 

statements, have 10 days to submit written questions. 

One letter from the American Fuels and Petrochemical Manufacturers is inserted into the record. Without objection, so ordered. 

[The information follows:] 

97 


82834.055

September 10, 2012 

The Honorable John Shimkus 

Chairman 

U.S. House Subcommittee on 

Environment and the Economy 

2125 Rayburn House Office Building 

Washington, D.C. 20515 

Charles T. Drevna 

President 

American 

Fuel & Petrochemical 

Manufacturers 

1667 K Stroot, NW 

Suite 700 

Washington, DC 

20006 

202.457,0480 office 

202,552,8457 direct 

202,457.0486 fax 

Cdrevna@afpm,org 

The Honorable Gene Green 

Ranking Member 

U.S. House Subcommittee on 

Environment and the Economy 

2125 Rayburn House Office Building 

Washington, D.C. 20515 

RE: Subcommittee Hearing on Chemical Facility Anti-Terrorism Standards 

Dear Chairman Shimkus and Ranking Member Green: 

AFPM, the American Fuel & Petrochemical Manufacturers, appreciates the opportunity to submit 

this written statement for the record for the House Energy and Commerce Subcommittee on 

Environment and the Economy hearing on the "Chemical Facility Anti-Terrorism Standards 

(CFATS) program - A Progress Report." 

AFPM is a 110-year old trade association formerly known as NPRA, the National Petrochemical & 

Refiners Association, until earlier this year. AFPM represents high-tech American manufacturers 

that use oil and natural gas liquids as raw materials to make virtually the entire U.S. supply of 

gasoline, diesel, jet fuel, other fuels and home heating oil, as well as the petrochemicals used as 

building blocks for thousands of vital products in daily life. AFPM members make modem life 

possible while keeping America moving and growing as we meet the needs of our nation and local 

communities, strengthen economic and national security, and support 2 million American jobs. 

America's refining and petrochemical companies playa pivotal role in ensuring and maintaining the 

security of America's energy and petrochemical infrastructure. Nothing is more important to 

AFPM's member companies than the safety and security of our employees, facilities and 

communities. Our members have worked extensively with DHS - and have invested millions of 

dollars - toward strengthening facility security. Our industry recognizes that protection of critical 

infrastructure against potential threats or terrorist attacks should be a shared responsibility between 

government and stakeholders. 

AFPM appreciates that DHS conducted an internal review to identify administrative problems that 

need fixing immediately and that the agency developed an action plan for improving CFATS 

implementation. It is important to recognize that the structure of the CF A TS framework itself is 

sound. Since the beginning of the CFATS program, DHS and industry, including some AFPM 

members, worked together and developed robust, risk-based performance standards (RBPS) that 

avoid bcing too prescriptive for an industry as diverse in size and function as the chemical sector, 
98 


82834.056

but that also include strict enforcement penalties for noncompliance. For example, each site 

develops a unique and appropriate Site Security Plan to address the specific risk issues of the 

facility, while meeting DHS-established performance standards. Since the inception of CFATS, 

hundreds of regulated facilities have proactively invested in security to comply with, and indeed 

exceed, requirements of the regulations. 

Since the development of the CFATS program AFPM's members have also partnered with DHS on 

many important security initiatives and programs, including the Risk Assessment Methodology for 

Critical Asset Protection (RAMCAP), Site Vulnerability Assessments (SVAs), Site Security Plans 

(SSPs), and by our participation in the Chemical Sector Coordinating Council (CSCC) and the Oil 

and Natural Gas Sector Coordinating Council (ONGSCC). 

America's critical infrastructure facilities are secure and there have been no terrorist attacks on 

chemical facilities since the development of the CFA TS program. Despite some implementation 

challenges, Congress should continue to provide sufficient funding for the CF A TS program. 

Inadequate funding for the CFA TS program would create a major setback to the implementation of 

the program. In particular, resources that government and industry have invested in CF A TS 

implementation would effectively be stranded. Nonetheless, it is clear that DHS needs to better 

manage its resources and set priorities to make progress in areas that need immediate attention, 

including approving site security plans and conducting inspections. Such measures would work to 

strengthen the program and our national security. They would also ensure more efficient, effective 

use of taxpayer dollars. 

To assist DHS in addressing these CFATS implementation challenges, additional stakeholder input 

is needed. Areas that industry and DHS should focus on include technical, training and tool-related 

issues that were identified in the DHS internal review. Greater transparency from DHS is critical to 

an effective collaboration moving forward. 

To be clear, AFPM recognizes that there are internal personnel and financial issues within DHS that 

must be addressed administratively where industry has no role. However, DHS could address the 

following issues quickly, with the help of industry, in order to enhance tbe effectiveness of CFA TS 

implementation in the short-term. 

• Personnel Surety Program - Congress intended that the Risk-Based Performance Standard 

12 on Personnel Surety, which governs access to high-risk facilities, be written as a 

performance standard allowing facilities the flexibility to determine the most efficient 

manner to meet the standard. Instead, DHS initially proposed a personnel surety program 

that fails to recognize, and actually duplicates, established federal vetting programs. Such a 

program would be burdensome to both DHS and industry and would be a wasteful and 

ineffective use of agency and industry resources. In July, DHS withdrew its proposal on the 

Personnel Surety Program from the Office of Management and Budget (OMB). However, 
99 


82834.057

as DHS works to resubmit a proposal, it is important that any proposal follow Congressional 

intent and be written as a performance standard. Facilities should have the option to use 

established federally secure vetting programs, such as the Transportation Worker 

Identification Credential (TWIC), to satisfy CF A TS without submitting additional personnel 

information to DHS. DHS should remain focused on fixing the current problems and not 

expand beyond the scope of the core program. 

AFPM is encouraged and applauds DHS for taking another look at this issue. Moreover, 

AFPM is pleased that DHS has decided to hold a series of meetings with industry, and hopes 

that collaboration will yield a less burdensome, yet still protective PSP for CFATS sites. 

• Site Security Plans - DHS should focus on Tier I Site Security Plan (SSP) approvals. 

Moreover, to reduce confusion about DHS' expectations for SSPs, AFPM recommends that 

DHS conduct a series of outreach meetings to educate industry about their expectations for 

necessary components of SSPs. These outreach meetings would allow DHS to discuss, with 

the actual owners and operators ofCFATS sites that have completed an SSP, the flaws in 

the site's SSP and work collaboratively on solutions. 

DHS should also consider approving alternative security plans (ASPs) for a variety of 

CFATS sites. DHS should work with all sectors governed by CFATS to develop ASPs. For 

sites that are smaller or contain fewer chemicals of interest (COIs) an ASP makes sense and 

review and approval time for ASPs should not take as long as for a regular SSP. 

• Inspections - Inspections are a key part of the SSP approval process. Like SSPs, DHS 

should focus on Tier 1 sites. DHS recently started up CFA TS inspector training courses and 

developed new inspection guidelines for inspectors. AFPM has offered multiple times for 

DHS to have our members speak at the inspector training classes to provide an overview of 

the chemical and oil and natural gas industry and the CF ATS applicability issues at those 

sites. To date, DHS has yet to take us up on this offer. AFPM believes this would be an 

invaluable opportunity for new inspectors to learn about security practices at CF A TS sites 

prior to going to a site. AFPM hopes that DHS will consider this offer. 

• Risk Modeling - AFPM is concerned that the DHS risk modeling used for setting risk tier 

levels for facilities in CFATS is seriously flawed. More specifically, and troubling, is that 

the release modeling for both flammables and toxins is incorrect. The risk modeling of the 

CFATS sites is the foundation of the CFATS program and AFPM urges DHS to 

expeditiously establish a stakeholder workgroup to resolve the modeling issues. 

• Stakeholder Input - Stakeholder input is important for security awareness and creating the 

best plans to secure our critical infrastructure. The framework of the CFA TS program is 

sound and was developed with industry'S input. Securing the nation's critical infrastructure 
100 


82834.058

must be done with industry at the table or the unfortunate implementation issues the 

program has experienced to date will be repeated. Many of the implementation delays have 

resulted from the lack of knowledge and experience within ISCD. A simple example 

involves the Top Screen process, which did not work for many companies because in the 

beginning of the program. In this instance, ISCD did not know that the ONG sector stores 

millions of pounds of materials, not thousands. The data field in the web page simply did 

not include enough digits to record actual volumes and required several weeks to correct It 

is worth noting, however, that the level of stakeholder outreach has improved in the past 

year. AFPM encourages DHS to continue this positive trend. 

• Transparency - Informed discussions with stakeholders will lead to less confusion and 

quicken implementation for all parties. In particular, in the National Academies of Science's 

"Review of the Department of Homeland Security's Approach to Risk Analysis," the 

Academy comments multiple times on the significance of stakeholder involvement and 

transparency in effective risk modeling. While the National Academies is commenting on 

risk assessment practices within DHS, the comment is directly applicable to CFATS 

implementation. The National Academies recommendations for transparency and 

stakeholder input would provide benefit not only the risk assessment practices within the 

Infrastructure Security Compliance Division (ISCD), but also provide substantial 

improvement on rule implementation. 

AFPM looks forward to working with you as Congress oversees the progress of CF A TS 

implementation. 

Sincerely, 

Charles T. Drevna 

President 
101 

Mr. SHIMKUS. The hearing is now adjourned. 

[Whereupon, at 12:53 p.m., the subcommittee was adjourned.] 

[Material submitted for inclusion in the record follows:] 

102 


82834.059

FRED UPTON, MICHIGAN 

CHAIRMAN 

ONE HUNDRED TWELFTH CONGRESS 

HENRY A. WAXMAN, CALIFORNIA 

RANKING MEMBER 

(lCongrcss of tbc Ilnttcb ~tatts 

lL,otlse of l\cprescntatibrs 

COMMITTEE ON ENERGY AND COMMERCE 

2125 RAYBURN HOUSE OFFICE BUILllING 

WASHINGTON, DC 20515-6115 

Mdj(}titl' {Z(J2\22S··2927 

Mmor'IV 1202) 225.-..3641 

Opening Statement or Rep, Henry A. Waxman 

Ranking Member, Committee on Energy and Commerce 

Hearing on "The Chemical Facility Antiterrorism Standards Program -

A Progress Report" 

Subcommittee on Environment aud the Economy 

September 11, 2012 

The 911 I attacks took nearly 3.000 lives. It was the worst attack against the United States 

since Pearl Harbor, and a higher death toll was inflicted on 9111 than even on the date President 

Roosevelt said would "live in infamy." 

The 9111 attacks were directed at our freedoms, our way of life, and modem civilization 

itself. It was an assault against American leadership in the world and against the ideals that have 

guided us since the founding of the Republic. 

Our resolve from that terrible day was clear: to pursue and defeat those who perpetrated 

this evil and to make sure they can never again threaten the United States of America and those 

who live here. 

Last May, President Obama and brave Navy SEALs eliminated the threat of Osama bin 

Laden. 

Today, as members of the Energy and Commerce Committee, we also have a 

responsibility. We must ask ourselves if we've done our part to protect the nation from terrorist 

attack. 

Nearly three years ago, this Subcommittee held a legislative hearing on legislation to 

establish security programs for chemical and drinking water facilities. Our goal was to develop 

comprehensive legislation that would close security gaps, strengthen enforcement authority, 

clarify the criteria for approving or disapproving site security plans, and set enforceable 

deadlines. 

I called that legislation unfinished business from 9111 - critical to homeland security, the 

safety of workers at those facilities, and the public at large. Regrettably, that business remains 

unfinished. 
103 


82834.060

This Congress is nearly over and we are no closer to action. 

However, I thank the Chairman for calling this hearing. Conducting oversight of agency 

efforts to implement the existing chemical facility anti-terrorism standards, called CFATS, is 

important, even if the existing standards have too many loopholes. 

As this Congress comes to a close, I hope this hearing will serve to renew our 

commitment to improving the safety of chemical plants. This should not be a partisan issue. We 

need to be able to work together to solve our nation's problems, as we have many times in the 

past. 

There is little time left to work on CFATS this year, but I hope next year we can return 

and develop legislation that best serves the American people. 

2 
104 


82834.061

FRED UPTON. MICHIGAN 

CHAIRMAN 

ONE HUNDRED 1WELFTH CONGRESS 

HENRY A. WAXMAN. CALIFORNIA 

RANKING MEMBER 

(:ongregg of tbe 'Qi{niteb :i>tateg 

~oUflt of l\rpuflrntatibtfl 

COMMITIEE ON ENERGY AND COMMERCE 

2125 RAYBURN HOUSE OFFICE BUILDING 

WASHINGTON, DC 20515-6115 

The Honorable Rand Beers 

Undersecretary 

Majority (202) 22S-2927 

Minority (202) 225-3641 

October 1,2012 

National Protection and Programs Directorate 

Department of Homeland Security 

Washington, D.C. 20528 

Dear Undersecretary Beers: 

Thank you for appearing before the Subcommittee on Environment and the Economy on 

September II, 2012, to testifY at the hearing entitled "The Chemical Facility Antiterrorism Standards 

Program - A Progress Report." 

Pursuant to the Rules of the Committee on Energy and Commerce, the hearing record remains 

open for 10 business days to permit Members to submit additional questions to witnesses, which are 

attached. The format of your responses to these questions should be as follows: (I) the name ofthe 

Member whose question you are addressing, (2) the complete text of the question you are addressing in 

bold, and then (3) your answer to that question in plain text. 

To facilitate the printing of the hearing record, please e-mail your responses, in Word or PDF 

format, to Nick.Abraham@mailhollse goy by the close of business on Monday, October 15,2012. 

Thank you again for your time and effort preparing and delivering testimony before the 

Subcommittee. 

:t~ ij;;'n Shimkus 

Chairman 

Subcommittee on Environment and the Economy 

cc: The Honorable Gene Green, Ranking Member, 

Subcommittee on Environment and the Economy 

Attachment 
105 


82834.062

Question#: 1 

Topic: V Factor 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Despite the statutory requirement that the Chemical Facility Anti-Terrorism 

Standards (CFATS) program be "risk-based," this Committee recently learned that the 

Department of Homeland Security (DHS) methodology of assessing risk for tiering 

purposes does not vary the vulnerability factor from facility to facility, leaving the 

program more consequence-based than risk-based. 

Has DHS done anything to ensure that each site's risk profile is evaluated based on that 

site's distinct vulnerability profile? If so, what specific actions have been undertaken? 

Response: While CF A TS facilities were treated as being equally vulnerable during the 

risk assessment process, each facility's distinct vulnerability profile is taken into 

consideration during the CF A TS process. Specifically, when a facility completes its Site 

Security Plan (SSP), or Alternative Security Program (ASP) in lieu of an SSP, the facility 

is asked to identify vulnerability issues related to the security of its chemical(s) of 

interest. Each facility that receives a final tiering letter is infonned that it must address 

certain security/vulnerability issues (i.e., theft, release, sabotage) in its SSP or ASP 

related to that facility's specific chemicals of interest. The Department's physical, 

chemical, and cyber analysts examine the security measures outlined in the SSP/ASP for 

their potential to mitigate the specific vulnerabilities of the facility. Additionally, during 

Authorization Inspections, CF ATS Chemical Security Inspectors review existing and 

planned security measures to ensure that all identified vulnerabilities are being 

adequately addressed. 

Question: When were you first briefed on the "V -Factor" and "vulnerability" being set at 

the same number for all facilities? 

Response: To the best of our knowledge, Under Secretary Beers was originally briefed 

on the "V-factor" and "vulnerability" subject in the summer of2011 as part of the review 

of the F I factor issue. 

Question: Why weren't this Committee, the regulated community, and other interested 

parties briefed on the "V-Factor" and its legal and policy implications for the CFATS 

program? 

Response: Throughout the history of the CF A TS program, the Department has briefed 

numerous entities, including Congressional staff members, members of the regulated 

community, and other interested parties, on their overall approach to tiering facilities. 
106 


82834.063

Question#: I 

Topic: V Factor 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

During these briefings, it has routinely been noted that the overall tiering methodology is 

risk-based but that potential consequences are the primary driver of the facility's risk 

profile for purposes of CF A TS risk tiering. 
107 


82834.064

Question#: 2 

Topic: Personnel Surety 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Questiou: DHS first issued a public notice on the Personnel Surety Program (PSP) in 

June 2009, but recently withdrew its proposal from the Office of Management and 

Budget. Now DHS says it will be issuing another 60 day notice for public comment 

before the end of this year and then resubmit a revised final proposal to OMB for its 

review and approval, perhaps by March 2013. 

Given the time already spent to develop a PSP why is DHS proposing such a protracted 

follow-up process to address issues that have clearly been articulated by the regulated 

community and others? 

Response: Tn July 2012, the National Protection and Programs Directorate (NPPD) 

withdrew the Chemical Facility Anti-Terrorism Standards (CFATS) Personnel Surety 

Program Information Collection Request (ICR) because our thinking about the CF A TS 

Personnel Surety Program had evolved since the ICR was initially submitted to the Office 

of Management and Budget (OMB) in June of2011. 

In order to implement the information collection aspects of a CFATS Personnel Surety 

Program, DHS must comply with the Paperwork Reduction Act requirements, which 

includes the publication of a Federal Register notice that solicits comments for 60 days 

on proposed information collection requests. 

Question: Will DHS provide options for PSP compliance based on the unique 

circumstances of a covered facility? Please elaborate. 

Response: Yes. The Department has designed CF A TS and the CF A TS Personnel Surety 

Program to allow each facility in its Site Security Plan or Alternative Security Program to 

account for its unique circumstances when considering how to comply with RBPS-12(iv), 

which requires that final high-risk chemical facilities implement "measures designed to 

identify people with terrorist ties." The ability to identify individuals with terrorist ties 

requires the use of information held in Federal government databases that are unavailable 

to high-risk chemical facilities. When implemented, the CF A TS Personnel Surety 

Program will provide facilities multiple options to comply with this regulatory 

requirement. 

High-risk chemical facilities will have, through their Site Security Plans or Alternative 

Security Programs, the ability to address RBPS 12(iv). High-risk chemical facilities may 

restrict the numbers and types of persons whom they allow to access their restricted areas 
108 


82834.065

Question#: 2 

Topic: Personnel Surety 

Hearing: The Chemical Facility Antiterrorism Standards Program A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

and critical assets, thus limiting the number of persons who will need to be vetted for 

terrorist ties. High-risk chemical facilities also have wide latitude in how they define 

their restricted areas and critical assets in their SSPs or ASPs, thus potentially limiting or 

controlling the number of persons who will need to be vetted for terrorist ties. High-risk 

chemical facilities also may choose to escort visitors to restricted areas and critical assets 

in lieu of performing the background checks required by RBPS 12. 

In addition, high.risk chemical facilities will be able to (1) choose one or more options 

for terrorist-ties vetting or vetting verification that the Department has described to date 

or may make available in the future, or (2) propose a different alternative altogether that 

works best for their circumstances. 

Question: Will DHS continue to insist on duplicative reporting of personally identifiable 

information (PH) for those who carry a current and valid Transportation Worker 

Identification Credential (TWIC)? 

Response: The Department supports the sharing and reuse of vetting results among 

different screening programs and is actively considering, and discussing with 

stakeholders, options for effectively leveraging vetting already done on individuals with 

current and valid TWICs. 
109 


82834.066

Question#: 3 

Topic: TSDB 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Recent media reports indicate DHS will accept the use of certain government 

issued ID cards as complying with the PSP requirement for terrorist database screening 

(TSDB), but will continue to require regulated sites to submit personnel information on 

those entering the site to DHS. Why would DHS require this redundant information? 

Response: The Department of Homeland Security (DHS) supports the sharing and reuse 

of vetting results among different screening programs and is actively considering, and 

discussing with stakeholders, options for effectively leveraging vetting already done on 

individuals who hold current and valid credentials. 
110 


82834.067

Questiou#: 4 

Topic: electronic card readers 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Is DHS or the Administration contemplating requiring electronic card readers 

at CF A TS facilities as part of its new evolved thinking on the PSP? How does DHS 

square this proposal with Sec. 550 ofP.L. 109-295 which explicitly prohibits DHS from 

prescribing specific security measures? 

Response: No, the Department of Homeland Security is not contemplating requiring 

electronic card readers at Chemical Facility Anti-Terrorism Standards (CFATS) facilities 

as part of the CF ATS Personnel Surety Program. Facilities will have a variety of options 

for complying with RBPS 12(iv) as part of their Site Security Plans or Alternative 

Security Programs. 
111 


82834.068

Question#: 5 

Topic: potential hits 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Does DRS believe it has an investigative role when it comes to potential hits 

on the TSDB? If so, please cite that legal authority. 

Response: No; however, the Department of Rome land Security will coordinate with 

Federal law enforcement entities to effectively address situations in which known or 

suspected terrorists seek access to high-risk chemical facilities. 
112 


82834.069

Question#: 6 

Topic: SSP 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: DHS previously announced that it planned to conclude inspections and issue 

Site Security Plan (SSP) authorizations for Tier 1 facilities before the end of the calendar 

year with the hope of beginning compliance activities at Tier 2s shortly thereafter. Does 

DHS have a more specific implementation plan that includes specific milestones for each 

phase of the approval process and for each CF A TS Tier Level? Please provide your 

implementation time line and plan to this Committee. 

Response: Prior to approving a Site Security Plan (SSP), or an Alternative Security 

Program (ASP) in lieu of an SSP, the Infrastructure Security Compliance Division 

(ISCD) must first review and then authorize the SSP or ASP. The review process is 

initiated when ISCD receives the SSP or ASP from a covered facility. ISCD then 

reviews the SSP/ASP to preliminarily determine ifit satisfies the applicable Risk Based 

Performance Standards (RBPS) under the Chemical Facility Anti-Terrorism Standards 

regulation, 6 C.F.R. Part 27. This process typically involves discussions between ISCD 

staff and the facility and often requires additional information from the facility and 

revision of the SSP/ASP before ISCD can complete its initial review and issue the facility 

a Letter of Authorization for its SSP/ASP. After issuing a Letter of Authorization, ISCD 

conducts a comprehensive and detailed authorization inspection. The inspection results, 

as well as any further revisions that the facility may make to the SSP/ASP, are reviewed 

to make a final determination as to whether the facility's SSP/ASP satisfies the applicable 

RBPSs and whether to issue a Letter of Approval. Upon approval, the facility must 

implement the applicable provisions of the SSP/ASP. If ISCD determines that an 

SSP/ASP does not satisfy the applicable RBPS, ISCD may issue a Notice of Deficiency 

and require the facility to resubmit a sufficient SSP/ASP. If the facility fails to do so, 

ISCD may disapprove the SSP/ASP. 

ISCD is scheduled to complete Authorization Inspections by the fourth quarter of Fiscal 

Year (FY) 2013 for Tier 1 facilities and by the second quarter FY 14 for Tier 2 facilities. 

Following the Authorization Inspection, facilities are generally granted an additional 45 

days to make any necessary modifications to their SSP/ASPs. IS CD will then review the 

re-submitted SSP/ASP and make a final determination on whether the SSP/ASP warrants 

the issuance of a Letter of Approval. In some cases, the facility may require a Technical 

Consultation and another opportunity to revise its SSP/ASP. Therefore, the schedule to 

issue Letters of Approval to facilities is projected to be the first quarter of FY 2014 for 

Tier I, and by the third quarter FY 2014 for Tier 2 facilities. 
113 


82834.070

Question#: 6 

Topic: SSP 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

The popUlation of Tier 3 and Tier 4 facilities, which pose relatively lower risks than Tier 

I and Tier 2 facilities, is much larger and DHS is developing options to effectively 

evaluate their SSPs/ASPs. 
114 


82834.071

Question#: 7 

Topic: SVA 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: The current CFATS requirements mandate that facilities resubmit a Site 

Vulnerability Assessment (SVA) to DHS every two years. Given DHS's lack of progress 

in conducting authorization activities and the likelihood that it will not finish approving 

all Tier I sites before the end of this year as initially hoped, will DHS consider 

suspending this SV A resubmission requirement until it completes authorizations for these 

tiers? 

Response: The Chemical Facility Anti-Terrorism Standards (CFATS) regulations do not 

mandate that chemical facilities resubmit a Security Vulnerability Assessment (SV A) to 

the Department of Homeland Security (DHS) every two years. 

Under 6 C.F .R. § 27.21 O(b)(1), CF A TS Tier 1 and Tier 2 high-risk facilities must submit 

new Top-Screens to DHS no less than two years, and no more than two years and 60 

calendar days, from the date ofDHS's approval of the respective facilities' Site Security 

Plans (SSPs). Under the same provision, CFATS Tier 3 and Tier 4 high-risk facilities 

must submit new Top-Screens to DHS no less than three years, and no more than three 

years and 60 calendar days, from the date ofDHS's approval of the respective facilities' 

SSPs. Under 6 C.F.R. § 27.21 0(b)(2), following the resubmission of a Top-Screen 

pursuant to 6 C.F.R. § 27.210(b)(1), the Department may require a covered facility to 

complete and submit a new SVA within 90 calendar days of written notification from 

DHS. Thus, under these provisions, a high-risk facility would not be required to resubmit 

an SVA unless DHS's review of the facility's resubmitted Top-Screen resulted in a 

determination that an SVA resubmission is warranted. 
115 


82834.072

Questiou#: 8 

Topic: ISCD 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: ISCD has announced that it is currently developing a new, more user-friendly 

SSP tool as part of its CSAT revamp (which includes top screens and SV As as well). 

Can you detail for us what this redevelopment entails? 

How do you plan to engage industry in developing the SSP tool and reexamining the 

CSAT suite of tools as a whole? 

What is the projected time frame for putting in place a usable tool for regulated facilities? 

Response: Over the past few years, while implementing the Chemical Facility AntiTerrorism Standards (CFATS), the Department of Homeland Security (DHS) has 

received significant feedback on and suggestions for improving its Chemical Security 

Assessment Tool (CSAT) and the various applications that comprise CSAT. 

Concurrently, the Department internally has identified a variety of ways it believes it can 

refine its three primary CSA T applications-the Top-Screen, the Security Vulnerability 

Assessment (SVA), and the Site Security Plan (SSP)-to make the overall CFATS 

process more user-friendly for industry, while simultaneously making it more efficient 

and effective. 

In order to ensure we are incorporating industry feedback to the extent practicable in the 

refinement of the CSA T applications, the Department intends to hold multiple 

roundtables with members of the regulated community in various locations throughout 

the country to solicit additional feedback on the CSA T tools. In addition, the Department 

intends to highlight this effort during its routine outreach and engagement activities and 

use those venues to seck and encourage additional input on potential ways to improve 

CSAT. At the appropriate times during the CSAT improvement effort, the Department 

intends to pilot or 'beta test' planned CSAT refinements with members of industry. 

Finally, the public will have an opportunity to comment on revisions to CSAT during the 

PRA process. 

The Department is seeking to release the improved version of the CSAT tool in the third 

quarter of Fiscal Year 2014. 
116 


82834.073

Question#: 9 

Topic: PSP 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: You testified that DHS is currently not able to fully approve or authorize SSPs 

until the PSP has been finalized, and that DHS will only be issuing "conditional" 

authorizations and approvals until the PSP program is in place. If so, does this mean that 

DHS may disapprove an SSP that was previously conditionally approved, once the PSP is 

in place? 

Response: The Infrastructure Security Compliance Division (IS CD) reviews and 

approves facility Site Security Plans (SSPs) based on established Risk Based 

Performance Standards (RBPS). RBPS-12 (Personnel Surety) requires covered facilities 

to implement security measures to identify individuals with terrorist ties. The 

Department of Homeland Security (DHS) is developing a Personnel Surety Program that 

would provide facilities with options to implement such measures. Once finalized, an 

Information Collection Request (ICR) will be submitted to the Office of Management and 

Budget (OMB). DHS cannot fully implement the program until OMB approves the ICR. 

DHS is currently reserving judgment on the approval of Site Security Plans (SSPs) with 

regard to that aspect ofRBPS-12. ISCD will work with covered facilities to ensure that 

their SSPs adequately address all applicable aspects ofRBPS-12 as the implementation of 

the Personnel Surety Program progresses. In the meantime, ISCD is moving forward 

with approvals so that facilities can implement the other security measures described in 

their plans. 
117 


82834.074

Question#: 10 

Topic: security 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Congress gave DHS authority to engage with various industry groups on 

development of Alternative Security Program (ASP) templates. DHS has said it continues 

to review existing industry programs, such as ACC Responsible Care® and SOCMA 

ChemStewards®, to identify potential areas of engagement and further discussion. Will 

DHS leverage these and/or other existing programs to help improve chemical security 

and advance CFATS implementation? Please explain your progress in this area. 

Response: Many members of the regulated community and their representative industry 

associations have expressed interest in exploring ways to use the Alternative Security 

Program (ASP) provisions of the Chemical Facility Anti-Terrorism Standards (CFATS) 

regulation to streamline the security plan submission and review process. The 

Infrastructure Security Compliance Division (IS CD) shares this goal and has been 

holding discussions with industry stakeholders in regard to their development of ASP 

templates on behalf of their members. One example has been ISCD's engagement with 

the American Chemistry Council (ACC) in support of its efforts to develop an ASP 

template for use by interested members of its organization. The ACC developed a 

template which was piloted at facilities in August and October. ACC has indicated that it 

expects its ASP template to be available for wider use later this year. In addition, the 

Department of Homeland Security (DHS) has been in discussions with other industry 

stakeholders and associations about developing templates specific to their members and 

sub-sectors. ASPs submitted by facilities using industry-established models, such as the 

ACC template, will be reviewed under the same standards that ISCD currently reviews 

Site Security Plans, but the use of ASP templates may streamline both the plan 

development and plan review processes. Additionally, DHS continues to review existing 

industry, and sector specific programs, such as ACC Responsible Care® and SOCMA 

ChemStewards®, to identify potential areas of engagement that may contribute to 

CF ATS implementation. 

As of October 23,2012,426 ASPs have been submitted in lieu ofSSPs and 13 ASPs 

have been submitted by Tier 4 facilities in lieu of SV As. 
118 


82834.075

Question#: II 

Topic: facilities 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: While DRS is focusing on the highest risk facilities first, the bulk of the 

facilities in the CF ATS program are in the lower risk tiers. At the current pace, it will be 

many years before DRS will even begin approving lower risk facilities. What steps is 

DRS taking to address the lower tiered facilities faster? Ras DRS considered using its 

ASP authority for review and approval oflower risk facilities in a way that will 

streamline the implementation process? 

Response: Over the past few months, the Department of Romeland Security (DRS) has 

taken numerous steps to make its procedures more efficient and to increase the pace at 

which facilities' Site Security Plans (SSPs) are evaluated. These include streamlining the 

SSP review process itself, working on improvements to both the data collection and plan 

review tools, and getting the Department's field staff involved earlier in the process to 

help identify and work with facilities whose SSPs require additional information before 

they can be fully evaluated. Additionally, the Department is currently exploring various 

approaches to address lower tiered facilities in an even more efficient manner. This 

includes working with industry on Alternative Security Programs (ASPs) and identifying 

ways to make ASPs a more effective option that could be used to a greater extent by 

lower tier high-risk facilities. 
119 


82834.076

Question#: 12 

Topic: examples/models 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Has DHS looked at other examples/models such as the Coast Guard's 

Alternative Security Program as a best practice to help improve the pace of SSP 

approvals? 

Response: Since 2009, the Department of Homeland Security's (DHS) National 

Protection and Programs Directorate (NPPD) has met routinely with the U.S. Coast 

Guard (USCG) under the auspices of a Chemical Facility Anti-Terrorism Standards 

(CFATS) / Maritime Transportation Security Act (MTSA) Harmonization Working 

Group to exchange ideas and best practices for potentially improving both CF ATS and 

MTSA. As part of this engagement, NPPD and the USCG previously discussed their 

respective approaches to Alternative Security Programs (ASPs) to identify best practices 

and lessons learned regarding the use of ASPs. NPPD is currently exploring ways to 

leverage ASPs to improve the pace of Site Security Plan reviews and is committed to 

reengaging the USCG on its approach to ASPs to see if there are additional best practices 

or lessons learned that could be incorporated by NPPD in the implementation of CFATS. 
120 


82834.077

Question#: 13 

Topic: mis-tiering 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Has a facility ever suggested to DHS that it has been placed in a tier lower 

than it should be? If so, when were you or your staff told? 

Response: According to our records, no facility has ever indicated to the Department of 

Homeland Security in writing that it has been tiered lower than it should be. 
121 


82834.078

Question#: 14 

Topic: Appendix A 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Is DHS reviewing the Appendix A list of chemicals? If so, when do you plan 

to conclude your review? Do you expect significant amendments to the current list? Will 

this revision slow down or otherwise impact your progress with CF A TS implementation? 

Response: The Department of Homeland Security (DHS) is in the process of reviewing 

the Chemical Facility Anti-Terrorism Standards (CFATS) Appendix A list of Chemicals 

of Interest (CO Is). Additionally, in support of that effort, the Department's National 

Protection and Programs Directorate (NPPD) recently entered into a 24-month agreement 

with the Science and Technology Directorate's Chemical Security Analysis Center 

(CSAC) to conduct applied research on issues related to Appendix A. The CSAC 

recommendations will then be evaluated by DHS and, as previously stated, any potential 

changes to Appendix A will be made through the rulemaking process in coordination 

withOMB. 

The effort to review Appendix A during fiscal years 2013 and 2014 should not have any 

significant impact on the progress of CF A TS implementation during this period. 
122 


82834.079

Question#: 15 

Topic: outreach 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Have any changes been made to CFATS based upon the recommendations of 

regulated stakeholders? If yes, please detail all of them. 

Has NPPD/IP/ISCD specifically sat down to talk with regulated stakeholders about ways 

to better understand the diverse nature of the chemical industry? What changes, if any, to 

CF A TS have been-made based upon those discussions? 

Response: Throughout the development and implementation of the Chemical Facility 

Anti-Terrorism Standards (CF A TS), the Department of Homeland Security (DHS) has 

routinely sought the input of the regulated community and other stakeholders. This input 

has been sought and provided in a variety offorums, including requests for public 

comment on the proposed CF A TS regulations and Appendix A as well as the Risk-Based 

Performance Standards (RBPS) Guidance. Many of industry's suggestions in their 

public comments were reflected in the final CF A TS regulation, including Appendix A, 

and in the RBPS Guidance. 

In addition, DHS sought input from industry prior to seeking public comments on the 

RBPS Guidance and in the piloting or 'beta-testing' of various tools used by the regulated 

community or other CFATS stakeholders. Moreover, the Department has participated in 

thousands of outreach and engagement activities, ranging from major conferences such as 

the annual Chemical Security Summit, to meetings with the Chemical Sector 

Coordinating Council and various industry groups, to one-on-one meetings with facility 

owners and operators. 

This ongoing engagement has resulted in numerous improvements in CF ATS 

implementation, including the functionality ofthc various Chemical Security Assessment 

Tool applications, such as thc Top-Screen, the Security Vulnerability Assessment, and 

thc Site Security Plan tool. In addition, DHS has sought industry and other stakeholder 

input in thc development of the Department's proposed approach to the CF A TS 

Personnel Surety Program. The Department will continue to engage with our industry 

stakeholders as we further develop and make improvements to the CF A TS program. 
123 


82834.080

Question#: 16 

Topic: funding 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Please provide the amounts appropriated and the amounts obligated for ISCD 

for fiscal years 2007 through 2012. How much of the appropriated money remains 

available to be expended? 

Response: The Infrastructure Security Compliance (ISC) Project has two primary 

initiatives-the development and implementation of the Chemical Facility AntiTerrorism Standards (CFATS) program and the development and implementation of the 

Ammonium Nitrate Security Program. Since its inception, the ISC Project has received 

$442.6641 million in appropriated funds and has completed a full accounting of these 

funds. Below is a high-level overview ofISC funding from Fiscal Year (FY) 2007 to FY 

2012. 

* Includes a one-time supplemental appropriation to the Infrastructure Security 

Compliance Division in FY 2007. 

**Includes $5 million for the Ammonium Nitrate Security Program (ANSP). ANSP 

funding has been included in the base ISCD request from 2010 to present. 

t Between FY 2007 and FY 2011, NPPD tracked salary and benefit funding at a higher 

level than Infrastructure Security Compliance. The figures for those years reflect the 

enacted amount of and benefits 

Question: How much of the appropriated money remains available to be expended? 

Response: Of the funds appropriated from FY 2007 to FY 2012, $4,603,655 remains 

available to be obligated as of September 30,2012. 
124 


82834.081

Question#: 17 

Topic: realignment and continuity 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: In the fall of2011, ISCD leadership began actively engaging the workforce in 

the realignment of the organization by soliciting feedback and inputs and engaging the 

ISCD leadership team, including making efforts to hire permanent branch chiefs. 

What has been done to scope out the job descriptions for these managers? Has the union 

provided any formal or informal input in these job descriptions? 

Response: Job descriptions for the Deputy Director, Chief of Staff, and Branch Chiefs 

have been completed. The Deputy Director, Chief of Staff, and Branch Chief positions 

are ali considered supervisory/leadership positions that are not covered by the current 

Collective Bargaining Agreement. Any additional job description scoping efforts that 

affect the TSCD inspector workforce will be coordinated with the union leadership. 

Although not required, we have been continually updating AFGE Local 918 on progress 

made on our realignment efforts. 

Question: What is DHS doing to improve management continuity and reverse turnover 

of CF A TS leadership, including the ISCD director and personnel in the office of the 

NPPD Undersecretary who work with ISCD? 

Response: The Department of Homeland Security (DHS) continues to recruit career 

oriented personnel who are committed to the success of ICSD's mission. Going forward, 

it is the goal of ISCD to use "detailed" or "acting" personnel on a very limited and short 

term basis to fill gaps due to vacancies. As part of the realignment, many of these details 

and acting positions will end. ISCD has already begun the process of announcing and 

hiring for many of the positions that are currently held by detailees or personnel operating 

in an acting capacity. NPPD will also continue to use a balanced approach in its hiring 

practices that allows for internal career growth within the organization as wcll as external 

recruitment practices to bring in qualified personnel and improve the organizational 

culture. 
125 


82834.082

Question#: 18 

Topic: staff 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: The AndersonlWulfMemo expressed concerns that ISCD staff have been 

detailed to NPPD and that calls to return these personnel to ISCD have gone unfulfilled. 

Have these ISCD staff been returned from NPPD to ISCD? Ifnot, why not? 

Response: Leadership in the Infrastructure Security Compliance Division (ISCD), 

National Protection and Programs Directorate (NPPD), and Office ofInfrastructure 

Protection (IP) are determining the "right-sizing" of each of these organizations and the 

benefits and shortfalls of both long and short term details. While several ISCD 

employees have been detailed outside the organization, many of these employees are 

receiving experience and training on elements that will benefit IS CD when they return at 

the end of their details. Additionally, ISCD benefits from individuals from within NPPD 

being detailed to fill critical positions within ISCD until permanent staff selections are 

made. ISCD is approaching the final stages of hiring individuals to permanently fill these 

positions. 
126 


82834.083

Question#: 19 

Topic: OCS 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: What is OCS and when was it established? 

Response: The National Protection and Programs Directorate (NPPD) established the 

Office of Compliance and Security (OCS) in October 2010, to independently review and 

evaluate NPPD operations, programs and activities. OCS also investigates alleged 

misconduct by NPPD employees on behalf ofNPPD management. 

Question: In 2011, did you task the Office of Compliance and Security (OCS) with a 

fact-finding mission for issues within ISCD? 

Response: Under Secretary Beers tasked OCS to coordinate an inspection ofISCD in 

January 2011. An inspection is an internal evaluation process that enables NPPD 

management to objectively evaluate the strengths and weaknesses ofNPPD programs. 

OCS conducted its inspection between April and September 20 II, completing its report 

in September 20 II and providing it to NPPD management in October 2011. 

Question: In response to Mr. Latta's question about vehicles provided to Washingtonarea personnel you referred to an OCS-prepared report of September 2011. Did you 

share a copy of that report with any Congressional Committee? lfso when? Please 

provide this Committee with that OCS report, and with any other OCS findings or 

recommcndations with regard to CF ATS. 

Response: The OCS report was completed in September 2011 and provided to NPPD 

management in October 201 I. Copies of the OCS report were provided to the 

Government Accountability Office in March 2012 and to the Department of Homeland 

Security's (DHS) Office of the Inspector General (OIG) in May 2012, but it was not 

provided to any Congressional Committee. OCS inspections are internal reviews 

designed to assist management with ensuring that NPPD programs are operating 

efficiently and effectively. Accordingly, inspection reports are provided to appropriate 

NPPD management officials and appropriate Subcomponent leadership. 

Question: Was any OCS review ever used a substitute for any other investigatory effort? 

Response: The OCS program reviews do not function as a substitute for other inquiry 

efforts by DHS or other entities. OCS occasionally undertakes investigations referred or 

declined by the Office of the Inspector General (OIG). In addition, as noted above, OCS 

conducted a program review of CF ATS in early 2011. The then-Assistant Secretary for 
127 


82834.084

Question#: 19 

Topic: OCS 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Infrastructure Protection (AS/IP) had initially proposed a management review be done by 

contractors, paid for by IP, under the auspices of the orG. NPPD leadership, including 

the then-AS/IP, concluded that a review by OCS would be more appropriate, effective, 

timely, and cost-efficient. 

Question: Are OCS findings ever made public? 

Response: These reports are not made public, but requests from the public can be 

processed through the Freedom of Information Act or the Privacy Act. All, or portions 

of, reports could be released to the public through such requests, but appropriate 

exemptions would apply to the requested documents. 

Question: Who receives OCS findings and reports? 

Response: OCS inspections are intcmal reviews designed to assist management with 

ensuring that NPPD programs are operating efficiently and effectively. Accordingly, 

inspection reports are provided to appropriate NPPD management officials and 

appropriate Subcomponent leadership. OCS reports of investigations that result from 

allegations of misconduct are provided to appropriate management levels of the 

Subcomponent where the subject employee works, as well as to the NPPD Office of 

Employee and Labor Relations and the Office of the General Counsel, if necessary. Ifan 

inspection uncovers waste, fraud, or abuse, the Inspector General would be notified. 

Question: Did you task OCS to investigate and report on the methodology issues facing 

CF A TS? If so, what is the status of that? 

Response: Under Secretary Beers did not task OCS to investigate the Chemical Facility 

Anti-Terrorism Standards (CFATS) program's methodology. Risk methodology is a 

technically complex issue and is appropriately being reviewed by subject matter experts 

as part of our approach to ensuring that the tiering methodology is sound and facilities are 

properly classified. 
128 


82834.085

Questiou#: 20 

Topic: action items 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable John M. Shimkus 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: You indicate that DHS has completed more than two-thirds of its self-assigned 

corrective "action" items. What is the status of the remaining items? 

Response: As of November 8, 2012, ISCD has completed 78 of95 action items. Good 

progress has been made on all of the remaining Action Items and a number of them are 

expected to be completed within the next few weeks. Some action items, however, such 

as Action Item 47 which calls for the revision of the Chemical Security Assessment Tool 

(CSAT), are long term activities and require more time to complete. The revision of the 

CSAT tool is the final milestone on the Action Plan and we project it to be completed in 

the third quarter of Fiscal Year 2014. 
129 


82834.086

Question#: 21 

Topic: document 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: The internal document stated that some employees felt that a certain person 

within the agency was filling subordinate positions based on cronyism. Who was this 

person? Is this individual still employed by the agency and in the same position? Are 

these cronies, if you will, still employed there as well? What about contracts? Were any 

contracts awarded or not awarded because of cronyism? 

The memo indicated there were pay grades for employees that were not justified. Since 

you say that unqualified workers have simply bcen retrained, have their pay grades been 

adjusted? If not, how do you train someone for a position they were not qualified to fill 

in the first place? 

Response: The internal memorandum cited a perceived lack of transparency with regard 

to personnel actions, including a perception of cronyism and favoritism. However, no 

evidence of cronyism has been identified within the Infrastructure Security Compliance 

Division (ISCD). The Department is not aware of any personnel selections made or 

contracts awarded based upon favoritism or preexisting relationships. 

With regard to the pay grade structure within the division, ISCD is working to ensure that 

all employees are in positions that are appropriate to their grade levels and best suited to 

their skills and expertise. 
130 


82834.087

Question#: 22 

Topic: non-productive workers 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: It has been indicated that there were a number of non-productive workers in 

the program. Yet, your testimony on March 31, 20 II, indicated that the overall workload 

was being accomplished. Clearly these workers were not needed to accomplish the work, 

or alternatively you were misleading Congress. If it is the former, why have these 

unproductive workers not been released? If it is the latter, how do you justify the 

impression you gave in March of 20 II suggesting that the workload was being 

accomplished? Also, if these employees were let go, how much money would be saved 

by the agency? 

To go one step further, in the recent report you stated that the agency has taken numerous 

steps to improve the work environment and encourage a system of accountability. What 

has been done about these unproductive workers? 

Response: The internal memorandum observed that, in some instances within 

Infrastructure Security Compliance Division (ISCD) programs, there were discrepancies 

between personnel and their positions. As part of its organizational realignment efforts, 

ISCD is working to ensure that all employees are in positions where they can perform 

most effectively and are best suited to their skills and expertise. Additionally, we have 

been working diligently to ensure that all supervisors in the organization have the 

appropriate training to ensure that there are appropriate chains of accountability. 
131 


82834.088

Question#: 23 

Topic: gas cards 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Questiou: The memo stated there were instances of workers who abused their gas cards. 

It is my understanding that this is fraud, or even theft of some kind. Why were these 

individuals simply reassigned and not dismissed from the agency? Was there a similar 

move for their supervisors? What accountability has been put in place for situations such 

as this? 

Response: The internal memorandum stated that the absence of effective policies and 

procedures in certain areas could have created an environment where fraud, waste, and 

abuse could have occurred; however, the memorandum did not identify any specific 

instances of fraud, waste, or abuse. 

The Infrastructure Security Compliance Division (IS CD) has instituted several processes 

to ensure accountability to make sure that any misuse would be systematically identified 

and corrective actions taken. For example, ISCD tracks vehicle mileage through both the 

Chemical-Security Management System (CHEMS) and the monthly General Services 

Administration (GSA) invoice. Workers have been instructed to enter their mileage into 

the CHEMS system for every trip that they make in a Government vehicle. ISCD 

compares the GSA mileage to what is recorded in CHEMS. 

ISCD has focused on training its personnel on the proper use of government travel cards 

and purchase cards. lSCD is also providing supervisory training in order to better equip 

its managers to lead their teams and to better foster chains of accountability. 

Additionally, ISCD has outlined, documented, and implemented appropriate procedures 

for using and reporting the use of travel cards. These procedures have been disseminated 

throughout the Division. 
132 


82834.089

Question#: 24 

Topic: computer program 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: The Government Accountability Office stated in their recent report that the 

computer program being used was poorly suited for the CF A TS program and it would 

take significant time and money to fix this problem. What has been done on this front? 

How much money has been spent on improvements and how much more will be spent? 

Is there independent analysis of the program, and if so, is it now suitable to meet the 

required function? On a scale of 1 - 100, where are we on making this program suitable 

for use? 

Response: The Chemical Facility Anti-Terrorism Standards (CF ATS) information 

technology (IT) tool suite is suitable now; however, it is not optimal. The Infrastructure 

Security Compliance Division (IS CD) has spent approximately $80 million beginning in 

the fourth quarter of fiscal year (FY) 2006 through FY 2012 (Project Life Cycle) on its IT 

investments. ISCD estimates that it will cost approximately $6 million to make 

enhancements to its IT systems in FY 2013. These funds are included in the FY 2013 

request. The planned improvements were identified internally by {SCD through 

integrated project teams and other requirement elicitation techniques. ISCD anticipates 

that improvements to the CFATS tools suite will bc released in the third quarter of 

FY14. 

ISCD will continually evaluate its IT capabilities and identify areas of improvement, 

making enhancements and modifications as necessary. 
133 


82834.090

Question#: 25 

Topic: union contracts 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Initially, union contracts were blamed for struggles to accomplish even minor 

changes to the program. Has the union renegotiated and accepted changes in the contract 

governing how work rules can be changed and implemented? If not, why are we to 

believe that great strides are being made when the internal report indicated that contracts 

would limit ability to makes these changes? What large scale changes have been made? 

Specifically list and share what processes took place to approve these changes. 

Response: The internal memorandum described the potential complexities the presence 

of a union could have presented during the relatively early stages of the program's 

development. That being said, we believe that the American Federation of Government 

Employees, Local 918 (AFGE Local 918) has been supportive of the Chemical Facility 

Anti-Terrorism Standards (CF ATS) program. The union shares with NPPD an interest in 

moving the program forward and has provided valuable perspectives in the 

implementation process. AFGE Local 918 and NPPD enjoy a productive relationship 

that has grown through close coordination, communication, and regular meetings. The 

union has expedited its review of key policies and procedures that have enabled the 

Infrastructure Security Compliance Division to turn the corner in implementing the 

CF A TS program. We will continue to build upon this working relationship to ensurc that 

AFGE Local 918 continues to be a key stakeholder in helping to move the CF ATS 

program forward. 
134 


82834.091

Question#: 26 

Topic: investigation 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: During the original investigation, it was found that a number of employees had 

a law enforcement mindsct, as opposed to a regulator mindset envisioned within the 

original statute. Have these individuals been given the pistols, badges, and uniforms they 

requested; have they been replaced by others with a proper mindset; or have they simply 

not been replaced? 

Response: The Infrastructure Security Compliance Division (IS CD) staff brings a wealth 

of experience from careers in industry, law enforcement, military service, and a host of 

other disciplines. This breadth of experience has contributed to the progress IS CD has 

made as a regulatory compliance organization. During the initial stages of the Chemical 

Facility Anti-Terrorism Standards (CFATS) program, a number of individuals with law 

enforcement backgrounds were detailed from the Federal Protective Service (FPS) to 

help establish the initial corps of CFATS inspectors. As the CFATS program matured, 

the roles and responsibilities of the inspectors were clarified. 

When the FPS details expired, a number of the original detailees applied for permanent 

positions with ISCD with the knowledge that CF A TS inspectors are not law enforcement 

officers. The remaining FPS personnel who were detailed to IS CD returned to FPS. 

ISCD has also worked to ensure that the inspectors who were subsequently hired also 

understand that their positions do not involve acting as law enforcement officers. 

ISCD inspectors have been issued Department of Homeland Security (DHS) credentials 

and often wear standardized rough duty outerwear to accommodate field activity and 

more readily identify the inspectors to the regulated community and other Federal, state, 

and local agencies. At no time, however, has the Department provided firearms or 

badges to inspectors under CF A TS. 
135 


82834.092

Question#: 27 

Topic: feedback 

Hearing: The Chemical Facility Antiterrorism Standards Program A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: Is there a method in place for your industry partners to give feedback on 

inspectors without fear of reprisal? 

Response: Extensive outreach activities provide numerous opportunities for industry to 

give feedback on inspectors and other aspects of the program. The National Protection 

and Programs Directorate (NPPD) and Infrastructure Security Compliance Division 

(IS CD) management and staff have presented at hundreds of security and chemical 

industry conferences and participated in a variety of other meetings. As part of this 

outreach program, NPPD and ISCD have regularly communicated with impacted sectors 

through numerous trade associations and through the Sector Coordinating Councilsincluding the Chemical, Oil and Natural Gas, and Food and Agriculture Sectors. 

Additionally, this past summer marked the sixth iteration of the Chemical Sector Security 

Summit, an annual event co-sponsored by DRS and the Chemical Sector Coordinating 

Council (SCC). The Summit is essential to the Department's continuous outreach with 

the chemical industry and provides another opportunity for dialogue with our 

infrastructure stakeholders. 

It is our hope that by building these relationships industry stakeholders do not feel 

inhibited or fear reprisal in providing candid feedback on the performance of CF ATS 

inspectors or other members of ISCD staff. 
136 


82834.093

Question#: 28 

Topic: internal report 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: The internal report stated employees demanded overtime to answer their 

phones on official business during the lunch hour. Do they receive ovcrtime now? If not, 

do they take official calls? Is this subject to union negotiation and agreement to the work 

rules? 

Response: There are no employees within the Infrastructure Security Compliance 

Division (ISCD) demanding overtime to answer phone calls during allotted lunch times. 

The Division's employees are professionals who recognize that securing America's highrisk chemical facilities cannot always be accomplished on a "9 to 5" work schedule. In 

light of this reality, ISCD continues to work closely with National Protection and 

Programs Directorate (NPPD) and Office ofInfrastructure Protection (IP) human capital 

staffs to ensure all matters related to approved premium pay and overtime work are 

implemented in accordance with 5 U.S.C. Chapter 55, Subchapter 5 and applicable Office 

of Personnel Management guidance. 
137 


82834.094

Question#: 29 

Topic: CF A TS program 

Hearing: The Chemical Facility Antiterrorism Standards Program A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: In your testimony on March 31, 2011, you gave no indication of problems in 

the program, yet you were simultaneously requesting that an informal internal 

investigation be carried out. How can we trust that you are currently being honest as to 

how the CF A TS program is progressing? 

Response: The National Protection and Programs Directorate's (NPPD) Office of 

Compliance and Security (OCS) completed its report in October 2011. At the time of the 

hearing, I did not have reason to believe that any of concerns that prompted the review 

would prevent the Chemical Facility Anti-Terrorism Standards (CF A TS) program from 

making progress. The Infrastructure Security Compliance Division's (ISCD) proactive 

approach to identifying, mitigating, and resolving programmatic and management issues 

has led to substantial progress. We remain committed to working with you and the 

Committee to keep you informed about the progress of the program, and as part of that 

commitment, we will also keep you apprised of significant issues that arise. 

Question: On another note, you claim that since January of2012, two sites have been 

approved by the CF A TS standards. How can this be true given that the personnel surety 

issue has not been resolved? 

Response: For the Site Security Plans (SSPs) that ISCD has approved thus far, the 

Letters of Approval specifically state that the Department of Homeland Security (DHS) 

has reserved judgment with respect to Risk Based Performance Standard (RBPS) 12: 

Personnel Surety. The Department will continue to work with the facilities to ensure that 

their SSPs fully address all applicable aspects ofRBPS-12, and will assist the facilities in 

understanding the Personnel Surety Program when it is finalized. 
138 


82834.095

Question#: 30 

Topic: personnel surety program 

Hearing: The Chemical Facility Antiterrorism Standards Program - A Progress Report 

Primary: The Honorable Bill Cassidy 

Committee: ENERGY & COMMERCE (HOUSE) 

Question: NPPD's approach to the personnel surety program seems more in line with a 

police force culture than that of a regulatory program. For example, NPPDIISCD has 

proposed that regulated entities submit detailed personnel data to ISCD, but has not 

proposed helping those same entities by informing them whether personnel with chemical 

facility access are or are not on the terrorist watch list. By contrast TSA, by issuing a 

TWIC card, reassures the Coast Guard's regulated chemical facilities that a person is not 

on the watch list. Why do two agencies within the same Department take such different 

approaches? How is a chemical facility to assure its workers, neighbors, insurers, and 

investors that it meets minimum standards for anti-terrorism security if it is not pennitted 

to know whether its employees are or are not on the terrorist watch list? 

Response: The design of both the Chemical Facility Anti-Terrorism Standards (CFA TS) 

Personnel Surety Program and the Transportation Worker Identification Credential 

(TWIC) program include a recurrcnt check for ties to terrorism. The Department of 

Homeland Security follows Government-wide procedures already in place regarding 

notification of terrorist watchlist matches as a result of security chccks we conduct. 

Under the CF ATS Personnel Surety Program, as with all other Department programs 

such as TWIC, the Department will continue to coordinate our efforts and responses with 

appropriate law enforcement and the intelligence community on a case-by-case basis. 
139 


82834.096

United States Government Accountability Office 

Washington, DC 20548 

October 15, 2012 

The Honorable John Shimkus 

Chairman 

Subcommittee on Environment and the Economy 

Committee on Energy and Commerce 

House of Representatives 

Subject: Critica//nfrastructure Protection: GAO Response to Posthearing Questions 

for the Record 

Dear Mr. Chairman: 

On September 11, 2012, we testified before your committee on the Department of 

Homeland Security's (DHS) actions underway to better manage its chemical security 

program. 1 The Chairman of the committee requested that we provide additional 

comments to a number of post hearing questions. The questions and our answers 

are provided in the Enclosure. The responses are based on work associated with 

previously issued GAO products. If you have any questions about this letter or need 

additional information, please contact me at (202) 512-3404 or berrickc@gao.gov. 

Sincerely yours, 

Cathleen A. Berrick 

Managing Director 

Homeland Security and Justice 

Enclosure 

1 GAO, Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its Chemical Security Program, 

but/tis Too Early to Assess Results, GAO-12-567T (Washington, D.C.: Sept 11,2012). 
140 


82834.097

Enclosure 

The Honorable John Shimkus 

1. We are told that DHS has historically scored towards the bottom of all 

departments and agencies surveyed by OPM on employee morale. 

Given that the former ISeD Director characterized employee morale as 

"a significant issue," do these survey results for NPPD specifically offer 

any insight into this issue? 

Data on the National Protection and Programs Directorate's (NPPD) scores 

provide insights into morale problems facing NPPD overall. Specifically, data 

from the survey showed that, in 2011, NPPD scored slightly lower than the 

Department of Homeland Security (DHS) average in three of four 

categories-leadership and knowledge management; talent management, 

and job satisfaction-and slightly higher than the DHS average for the fourth 

category-results-oriented performance culture. NPPD also scored lower in 

all four categories relative to government-wide averages for those categories. 

Table 1 compares OPM survey results for NPPD, DHS, and Governmentwide for the four categories. 

Table 1: Percent of NPPD Employees Who Responded Positively to 2011 Federal Employee 

Viewpoint Survey Questions about Leadership and Knowledge Management, Results-Oriented 

Performance Culture, Talent Management, and Job Satisfaction Compared to Responses by 

Employees DHS and Government-wi d e 

Organization Leadership and Results-Oriented Talent Job Satisfaction 

Knowledge Performance Management Index· 

Management Culture Index' Index' 

Index' 

NPPD 51% 51% 50% 

DHS 55% 48% 53% 

Government-wide 62% 54% 60% 

Source· OPM s 2011 Federal Employee Viewpoint Survey. 

'The Leadership and Knowledge Management Index shows the percent of employees who responded 

positively to survey questions about the extent to which employees hold leadership in high regard. both 

overall and on specific facets of leadership. 

'The Results-Oriented Performance Culture Index shows the percent of employees who responded 

positively to survey questions about the extent to which employees believe their organizational culture 

promotes improvements in processes, products and services, and organization outcomes. 

'The Talent Management Index shows the percent of employees who responded positively to survey 

questions about the extent to which employees within the organization have the talent necessary to 

achieve organization goals. 

dThe Job Satisfaction Index shows the percent of employees who responded positively to survey 

questions about the extent to which employees are satisfied with their jobs. 

DHS has taken steps to identify where it has the most significant employee 

satisfaction problems and developed plans to address those problems, but 

has not yet improved DHS employee satisfaction survey results. We have 

previously reported that concerns about pay and a lack of trust in leadership 

can lead to morale problems. 2 We stated that, given the critical nature of 

2 GAO, Department of Homeland Security: Preliminary Observations on DHS's Efforts to Improve Employee 

Morale, GAO-12-509T (Washington, D.C,: Mar. 22, 2012). 

Page 1 

62% 

64% 

68% 
141 


82834.098

DHS's mission to protect the security and economy of the United States, it is 

important that DHS employees are satisfied with their jobs so that DHS can 

attract and retain the talent required to complete its work. We plan to issue a 

report on the final results of our work related to employee morale issues at 

DHS later this month. 

2. Has leadership turnover in the CFATS program contributed to many of 

the problems the program has encountered? What can DHS do to 

reduce this problem? 

The numerous changes in Chemical Facility Anti-Terrorism Standards 

(CFATS) program leadership, and the fact that many of the Infrastructure 

Security Compliance Division (ISCD) leaders have served in "acting" roles 

and have since left the position, could have impacted ISCD's ability to 

implement and transform the CFATS program. For example, a senior NPPD 

official told us that changes in ISCD management have made it difficult to 

have ongoing budget discussions with ISCD. However, we have not 

specifically reviewed the extent to which turnover in the program has 

contributed to existing problems. When a program is attempting to transform 

itself, however, leadership is critical. Our work on organizational 

transformation found that top organizational leadership must set the direction, 

pace, and tone, and provide a clear, consistent rationale that brings everyone 

together behind a single mission. Appointing Mr. Wulf as the new director 

should benefit the program because he knows the challenges the program 

has experienced and has been involved in managing some of the more recent 

efforts to address those challenges. 

3. It appears that many of the dates for completing items in the action plan 

have slipped by as many as 90 days, some because the work required to 

complete items was not fully understood, others because the action had 

not yet been approved by either NPPD or IP. What do these date 

slippages say about management leadership? 

ISCD, the Office of Infrastructure Protection (IP), and NPPD appear to be 

making a concerted effort to address and resolve the human capital, mission, 

and administrative challenges identified in the November 2011 internal 

memorandum, but it's too early to tell what the ultimate impact of these efforts 

will be on the CFATS program. While the efforts outlined in the action plan 

are a good beginning to addressing identified issues, it is important to note 

that successfully implementing the action plan won't in itself ensure success 

for the program; rather, sustained commitment to and leadership by NPPD, 

IP, and ISCD, as well as continual monitoring and adjustment, as needed, will 

be critical. Further, where progress or performance deviates from expected 

results, it will be important for NPPD, IP, and ISCD managers to identify 

causes and take corrective actions, as needed. 

4. One of the most important aspects of CFATS implementation centers on 

developing viable partnerships between government and facilities 

Page 2 
142 


82834.099

covered by the rule. Where does DHS currently stand with regard to 

building and forming partnerships with the CFATS community? 

A senior ISCD official told us that ISCD has recently reinvigorated its outreach 

to industry as part of the action plan that accompanied the internal 

memorandum. This could be important to the success of the program. We 

intend to examine ISCD's process for gathering and reviewing facility 

information, as well as ISCD's efforts to work with industry, during the second 

phase of our work on mission-related issues. We expect to report on the 

results of this work in the spring of 2013. 

5. Many of the issues discussed in the action plan cut across IP 

components. These issues include the management of Administratively 

Uncontrollable Overtime, the location of field offices, the use of vehicles 

and purchase cards, and the management of travel among IP field staff. 

Page 3 

a. To what extent is NPPD looking to consolidate the management 

of these issues to avoid inconsistencies? 

NPPD is in the process of consolidating management for some 

administrative activities at the NPPD-Ievel. For example, NPPD 

officials told us that they were developing a guidance document that is 

intended to make the use of administratively uncontrollable overtime 

more consistent throughout NPPD. Also, NPPD is in the process of 

finalizing a NPPD-wide fleet management standard operating 

procedure that is intended to standardize vehicle use across NPPD. 

Furthermore, NPPD officials stated that NPPD is developing a field 

structure that is to consider the needs of all NPPD components, 

including ISCD and the Protective Security Coordination Division. 

However, these efforts are in various stages of implementation, and it's 

too early to tell whether they will result in improved management of 

these administrative functions or avoid inconsistencies. 

b. What challenges does NPPD face developing a consistent way to 

manage these functions across components and what can NPPD 

do to overcome any challenges? 

NPPD faces challenges overseeing a diverse group of components, 

including IP, the Office of Cybersecurity and Communications, and the 

Federal Protective Service. Furthermore, some organizations within 

these components have diverse missions and responsibilities. For 

example, IP houses ISCD which has regulatory responsibility with 

regard to the security of high-risk chemical facilities and also houses 

the Protective Security Coordination Division, which manages DHS's 

voluntary critical infrastructure protection programs. Efforts to 

consolidate some administrative activities across components could 

help NPPD better manage these activities but it remains to be seen the 

extent to which NPPD is successful in doing so. It will be important for 
143 


82834.100

NPPD to monitor the results of its consolidation initiatives once 

implemented to help ensure intended outcomes are achieved. 

c. Based on your work, does it appear that NPPD and IP are taking 

adequate steps to provide the support ISeD needs to address 

management and administrative issues? 

NPPD, IP, and ISeD officials are meeting regularly to discuss the 

challenges highlighted in the ISeD internal memorandum and are 

working together to develop solutions. In addition, according to 

officials, IP plans to co-locate one of its staff with ISeD to facilitate 

hiring of ISeD staff; accelerate the hiring process; and help keep ISeD 

hiring on track. 

6. You have recommended that DHS explore opportunities to develop 

performance measures associated with the action plan, where practical. 

Page 4 

a. Why are performance measures important? 

By developing performance measures, managers in departments and 

agencies and their components, like ISeD, can be better positioned to 

identify any gaps in their efforts to enhance performance and have the 

tools available to measure and monitor performance in the future. 

Performance measures also provide a framework for providing 

continuity of operations when new managers or staff are hired, 

managers move from position to position, or as the program 

changes-a key factor in some of the challenges facing ISeD. 

Furthermore, having performance measures better equips 

organizations, like ISeD, to inform stakeholders of their progress as 

their organization moves toward addressing problems or issues, and 

managing for results. Moreover, measuring results associated with 

particular action items would be consistent with Standards for Internal 

Control in the Federal Government, which calls for the establishment 

and review of performance measures and indicators to monitor 

activities and compare actual performance with planned or expected 

results throughout the organization and analyze significant differences. 

b. What is the value of developing performance measures now, as 

opposed to after the action plan is complete, as suggested by 

DHS? 

Having performance measures in place as the action plan is being 

implemented would help provide DHS with information on how well the 

processes it is putting in place as part of the action plan are working, 

and whether corrective actions or adjustments are needed to keep the 

organization on track with achieving its goals. As such, it would serve 

DHS well to develop performance measures as elements of the action 

plan are completed, rather than waiting until the entire action plan is 

complete, which may be some time away. 
144 

Æ 


82834.101

Page 5 

c. What types of things do you think that DHS should measure? 

ISCD performance measures would allow ISCD to link an action from 

the action plan to longer term programmatic improvements. For 

example, one action item calls for ISCD to identify and develop an 

appropriate IT platform in support of inspection activities. As ISCD 

begins to develop the platform, it could build in ways to measure its 

progress developing the platform as well as the platform's functionality 

in meeting user's needs. Another action item calls for ISCD to "revise 

the Chemical Security Assessment Tool (CSAT) to create a more 

efficient and effective tool for both industry and ISCD based on 

industry engagement." As the revision to the CSAT begins, ISCD 

could develop measures to compare the old tool to the new tool 

including actions it has taken to make the tool more efficient and 

effective. For example, ISCD could develop measures to determine if 

the length of time to complete each part of the tool is reduced from 

both the perspective of the facility (when completing the tool) and ISCD 

(when reviewing the information the facility provides via the tool).