# List of Commenters That Submitted Comments to OMB & DHS About The CFATS PS Program Information Collection Request

Comment # Submitter Where to Find A Copy of The Comment File Names

1 Multi-Association Letter Sent to OMB Docket # DHS-2012-0061  Comment #1 - Multi-Association Letter To OMB

2 Institute of Makers of Explosives Docket # DHS-2012-0061  Comment #2 - Institute of Makers of Explosives Letter to OMB

 Comment #2 - Attachment to IME Comment 3 American Chemistry Council Docket # DHS-2012-0061  Comment #3 - American Chemistry Council Letter to OMB

 Comment #3 - Attachment to ACC Comment (Cost Burden Estimate - July 2011)

 Comment #3 - Attachment to ACC Comment (Revised Cost Burden Estimate - October 2011) 4 U.S. Chamber of Commerce Docket # DHS-2012-0061  Comment #4 - US Chamber of Commerce Letter to NPPD

5 Shell Oil Company Docket # DHS-2011-0033 (CFATS PS SORN) http://www.regulations.gov/#!documentDe tail;D=DHS-2011-0032-0003

6 Ioannis Constantinides Docket # DHS-2011-0032 (CFATS PS Privacy

Act Exemption) http://www.regulations.gov/#!documentDe tail;D=DHS-2011-0033-0004

### July 11 , 2011

Kim Nelson DHS Desk Officer Office of Information and Regulatory Affairs Office of Management and Budget, New Executive Office Building, Room 10236 725 17th Street, NW. Washington, DC 20503

Re: DHS NPPD; Chemical Facility Anti

- Terrorism Standards Personnel Surety Program

-- ICR Reference No. 201105

- 1670

- 002

Dear Ms. Nelson:

Th e undersigned organizations represent a broad spectrum of the chemical and
pe trochemica l industries. We th ank you for meeting with representatives of several of

our organi zations on June 2 regarding this important DHS collection proposal . Now that DHS has officially submitted the collection to OIRA, 1 

### we are writin g to describe our very serious concerns with it. W e urge OIRA to disapprove this collection for four reasons: (1) the proposed PSP is unnecessary for the proper performance of DHS’s functions ; (2) the proposed PSP is unnecessarily d uplicative; ( 3 ) DHS has not complied with the procedural requirements of the Paperwork Reduction Act ( PRA) and OMB’s PRA regulations; and ( 4 ) DHS has failed to include within the ICR key facts without which it is impossible to assess the burden of DHS’s proposed collection

. 2



### By way of background, t he proposed collection would implement the “Personnel Surety Program” (PSP) that DHS has developed under its “Chemical Facility Anti

- Terro rism Standards” (CFATS) regulations, issued in relevant part in 2007. 3 

### The CFATS rules establish various risk

- based performance standards (RBPS) that regulated chemical facilities are required to meet, which include RBPS #12: “P erform[ing] appropriate bac kground checks on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets, including . . . [m]easures designed to identify people with terrorist ties.” 4 

### The PSP is DHS’s proposed mechanism by which facilities must meet the RBPS #12 standard. The PSP would require facilities to submit to DHS personally

- identifying information

1 

### 76 Fed. Reg. 34720 (June 14, 2011).
2 

### The development of these comments was supported by the Society of Chemical Manufacturers and Affiliates.
3 

### See 72 Fed. Reg. 17688, 17733 (Apr. 9, 2007).
4 

### 6 C.F.R. § 27.230(a)(12).

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 2

regarding individuals seeking access to restricted areas and critical assets at th e facility. DHS would then arrange for these individuals to be checked against the FBI’s classified Terrorist Screening Database (TSDB). 5



### Our associations, and their member companies, have collaborated closely and cooperatively with DHS to stand up the CFATS program quickly and effectively

. We have also actively supported legislation to reauthorize that program for years to come. We will continue to work with DHS toward our shared goal s , including p ersonnel surety

. The currently proposed PSP is improve d in some respects from what DHS previously described. On balance, however, and a s explained below, c ompliance with the proposal will draw critical facility resources away from the task of implementing o the r aspects of the CFATS program and from securing facilities more generally.

I. The Proposed PSP Is Unnecessary for the Proper Performance of DHS’s Functions

The statutory authority under which DHS has issued the CFATS rules is a rider to an appropriations statute and is quite general

– it provides mere ly that DHS “ shall issue interim final regulations establishing risk

- based performance standards for security of chemical facilities. ” 6 

### Importantly, however, it left the choice of security measures to the facility, so long as they satisfied the relevant standard:

[S]uch regulations shall permit each such facility, in developing and implementing site security plans, to select layered security measures that, in combination, appropriately address the vulnerability assessment and the risk

based performance standards for security for the facility[; and] the Secretary may not disapprove a site security plan submitted under this section based on the presence or absence of a particular security measure, but the Secretary may disapprove a site security plan if th e plan fails to satisfy the risk

- based performance standards established by this section. 7



### Thus, DHS has statutory authority only to require attainment of the performance standard that it sets, not to prescribe how a facility achieves attainment. Put ano ther way, DHS must accept any security measure that meets the applicable performance standard.

As noted above, the performance standard driving the PSP

– RBPS #12

– is that regulated facilities “[p] erform appropriate background checks on and ensure approp riate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted

5 

### 76 Fed. Reg. 34 721.
6 

### Pub. L. No. 109

- 295, § 550(a), 6 U.S.C. § 121 note.
7 

### Id

.

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 3

areas or critical assets, including . . . [m]easures designed to identify people with terrorist ties.” 8



### This regulatory text does not itself me ntion the TSDB, or require facilities to submit any information to DHS. It certainly does not require facilities to give DHS information so that DHS can develop and maintain databases on which individuals have been to which regulated facilities. The rule text only requires that facilities perform “appropriate” background checks and ensure “appropriate” credentials “to identify people with terrorist ties.”

DHS currently issues roughly a half

- dozen credentials that require, as a condition of issuance, th at DHS check the applicant against the TSDB

– most notably including the Transportation Worker Identification Credential (TWIC) and the Hazardous Materials Endorsement (HME) to a commercial drivers license. Moreover, DHS perpetually “vets” these credentia ls against the TSDB so that it will discover if a holder subsequently is added to the TSDB

– it describes this as “a DHS best practice.” 9



### A great many of the contractors and visitors that may require access to a CFATS

regulated facility possess one of the se credentials. In our considered view, a facility has satisfied its obligation under RBPS #12 if it determines that an individual possesses one of them. We believe that any additional requirement for facilities to submit information regarding these indi viduals to DHS is beyond DHS’s ability to compel, especially since DHS already has the ability to vet these persons’ credentials on a continuing basis and, if it gets a hit against the TSDB, to revoke the credential, alert the FBI so that it can place the person under surveillance, etc. We do not believe DHS has the authority to enlist regulated facilities as part of its scheme to track the comings and goings of people who have had access to regulated facilities, in the highly unlikely event that one of th em will turn out, after having obtained a TWIC or similar credential, to have some terrorist tie. In short, we not believe RBPS #12 currently empowers DHS to compel our members to facilitate “a DHS best practice.” DHS noted these arguments in its third I CR notice, but its responses are utterly non

- responsive. 10



### Thus

– at least with respect to individuals who possess credentials like the TWIC or HME

– the PSP is not “necessary for the proper performance of the functions of the agency,” and cannot be approv ed under the PRA. 11 

### If DHS believes it has the statutory

8 

### 6 C.F.R. § 27.230(a)(12).
9 

### 76 Fed. Reg. 34723

- 24.
10 

### See id . at 34730.
11 

### See 44 U.S.C. § 3508 (“Before approving a proposed collection of information, the Director shall determine whether the collection of information by the agency is necessary for the proper performance of the functions of the agency . . . .”). Cf. OMB, T HE 

### P APERWORK 

### R EDUCTION 

### A CT OF 

### 1995: I MPLEMENTING 

### G UIDANCE 

### 38 (Preliminary draft

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 4

authority to mandate a s specific a performance measure as the PSP, it needs to go through rulemaking to seek to amend its CFATS performance standards to specifically require that action

.

II. The Proposed PSP Is Unnecessarily Duplicative

As just explained, many of the individuals who will require access to CFATS

- regulated facilities possess DHS

- issued credentials that are perpetually vetted by DHS against the TSDB. With respect to these individua ls, the PSP’s requirement that such facilities collect and submit to DHS information about their credential serial numbers, expiration dates, and (in the case of HMEs) issuing state is “unnecessarily duplicative of information otherwise reasonably accessib le to the agency.” 12 

### For this reason as well, OMB should disapprove the ICR.

III. DHS Has Not Followed the PRA and OMB’s Implementing Rules

The PRA generally requires federal agencies proposing a new collection of information to provide the public 60

- d ays notice of the proposed collection, with comments to be submitted to the agency, 13 

### and upon submission of the proposed collection to OMB, to give the public an additional 30

- day opportunity to provide comments to the agency “and the Director,” i.e., OMB. 14



### OMB’s implementing regulations reiterate these obligations: an agency must publish a 60

- day notice as part of its own review, 15 

### and then must publish a 30

- day notice indicating that comments can be sent to the agency and “ submitted to OMB .” 16 

### The

reas on for submission of comments to OMB is because OMB’s own rules require it to

“ provide at least 30 days for public comment after receipt of the proposed collection of information before making its decision. . . .” 17



### Feb. 3, 1997) (“The term ‘need’ means that some programmatic or policy requirement (as opposed to a desire for information . . .) exists.”).
12 

### Id. at § 3506(c)(3)(B); cf. P APERWORK 

### R EDUCTION 

### A CT 

### G UIDANCE 

### , supra at 40 (“The term ‘unnecessary duplication’ means that information similar to or cor responding to information that could serve the agency’s purpose and need is already accessible to the agency.”).
13 

### 44 U.S.C. § 3506(c)(2)(A).
14 

### Id. § 3507(a)(1)(D)(ii)(VI).
15 

### 5 C.F.R. § 1320.5(a)(1)(i), § 1320.8(d).
16 

### Id. § 1320.5(a)(1)(iv)(B)( 6 ).
17 

### Id. § 1320.12(d). The only exception to this rule is in the case of emergency collections, not relevant here. Id.; see also § 1320.13. We cite Section 1320.12 of OMB’s PRA rules because it governs collections associated with a current regulation, as in the ca se of the PSP, but even if the PSP were considered a free

- standing collection, the relevant requirements would be the same. See id . § 1320.10(a) (“ The notice shall direct

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 5

DHS has published three Federal Regist er notices regarding the PSP, but it has never requested that comments be sent to OMB:

• The first, published on June 10, 2009, was a PRA

- compliant 60

- day notice. 18



### • The second, published on April 13, 2010, looked like the first notice. It repeated the firs t notice’s statement that DHS “will be submitting the following information collection request” to OMB. 19 

### It gave the public 30 days to file comments, but it directed them to be submitted exclusively to DHS, 20 

### which made sense at the time

– what point would there be commenting to OMB on an ICR that had not yet been submitted to it? The second notice also cited only Section 1320.8 of OMB’s PRA rules, which governs how agencies “ shall review each collection of information before submission to OMB. . . .” 21 

### Th e notice spent a great deal of time addressing comments that were filed on the first notice. 22 

### The general understanding of the regulated community at the time was that DHS was conducting an additional round of notice and comment, since (i) the first notic e had been so short (only three pages) and (ii) DHS was now supplying so much new information in its response to comments.

• The third notice, published on June 14 of this year, is merely a response to comments filed in response to the second notice

– indee d, that is how it is styled. 23 

### While it announces that DHS “has submitted” the ICR to OMB, 24 

### it does not invite the public to submit comments to anyone. And if one checks the docket for this ICR in Regulations.gov, where prior comments had been directed, o ne sees that t he docket is no longer open for comment. 25



### We appreciate your statement at our June 2 meeting that OMB would consider comments on this ICR filed within 30 days of the publication date. Other potentially interested

comments to the Office of Information and Regulatory Affairs of OMB, Attention: Desk Officer for [name of agency]



## . ”).

18 

### See 74 Fed. Reg. 27555 (citing 5 C.F.R. § 1320.8 and giving the public 60 days to submit comments to DHS).
19 

### See 75 Fed. Reg. 18850.
20 

### Id.
21 

### Id

. ; s ee 5 C.F.R. § 1320.8.
22 

### See 75 Fed. Reg. 18852

- 18856.
23 

### See 76 Fed. Reg . 34720 (“Action: Response to comments received during 30

- day comment period: New information collection request 1670

- NEW”).
24 

### Id . at 34721.
25 

### Go to http ://www.regulations.gov/#!docketDetail;dct=FR+PR+N+O+SR;rpp=10;po=0;D=DHS

- 2009

- 0026

.

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 6

members of the public are n ot necessarily aware of that possibility, however. And OMB’s generous willingness to consider comments filed in response to the third notice cannot excuse DHS’s failure to do as it was required: to invite the public to submit comments to OMB on the ICR a fter its submission.

I V

. The ICR Omits Information Essential to Estimating Burden

A fundamental part of an agency’s responsibility under the PRA is to invite public comments on “ the accuracy of the agency's estimate of the burden of the proposed colle ction of information, including the validity of the methodology and assumptions used.” 26 

### Obviously, in order for the public to be able to do that, it must be provided with information from which it can conduct its own estimates of burden. But DHS has omit ted crucially important information.

The core function of the PSP is to provide a web

- based mechanism by which regulated facilities can submit personally

- identifying information regarding individuals seeking access to restricted areas and critical assets at the facility. 27 

### How burdensome this requirement will be will depend in substantial part on two questions left unanswered by DHS:

1. Whether this information has to be collected and submitted (and potentially confirmation of receipt received) before the person can be granted access. Chemical facilities frequently have important contractors and visitors arriving upon short or no notice. They may require such people to come on site suddenly

– for example, if a production unit goes down or otherwise requi res emergency maintenance. Our sectors have proposed to DHS that it allow facilities to meet their “terrorist ties” screening requirement by accepting Federal credential that require such screening to be issued (e.g., the TWIC ), but DHS has steadfastly rejected this proposal and insisted on the submission of additional information regarding such individuals. 28



### A requirement that the facility know the identity of the particular individuals who will or may be arriving at the plant in advance would impose a substantial burden. In order to maintain maximum flexibility, facilities would need to clear all such individuals as it anticipates might conceivably need to come on site

– likely many more than might actually show up. For example, all technicians working for an electrical contractor, or all truck drivers working for a delivery truck company, might need to be identified, in coordination with those employers, and then their information submitted. This analysis does not even begin to take into account the collateral or indirect effects on a plant of not being able to clear someone as quickly as they are needed. Conceivably, a production

26 

### 5 C.F.R. § 1320.8(d)(1)(ii).
27 

### 76 Fed. Reg. 34721.
28 

### Id . at 34723

- 24.

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 7

unit might have to be shut down because the requisite minimum prio r notice period had not expired.

DHS had not previously alluded to a prior notification requirement in connection with the PSP until the third notice was published last month. In that document, however, DHS announced that it was going to require the subm ission of information on “new affected individuals prior to access . . . .” 29 

### It added that it was “considering whether to establish that high

- risk chemical facilities be required to submit the information at least 48 hours prior to access. . . .” 30 

### Whethe r DHS will actually implement this

– or some other

– prior notice requirement has a potentially enormous effect on the burden that the PSP will impose. But we do not know what DHS will do.

2. If information can be submitted after the fact, how often? The burden of managing information collected under the PSP and submitting it to DHS will also vary greatly depending on how often it has to be submitted: In real time? Daily? Weekly? Monthly? Obviously, the more immediately the information must be sub mitted, the greater the burden. This would particularly be true if submissions were due in real time or daily, as the job would of necessity fall to the guards and other individuals collecting the information. The more infrequent the submissions, the mor e likely the task could be made the part

- time responsibility of one or more IT staff.

But DHS has not provided this schedule. Its first notice was completely silent on the topic. The second notice provided a “proposed schedule” that set out of 30

- 90 d ay deadlines, depending on the risk

- based tier of the facility. 31 

### However, the third notice implicitly rescinded this schedule, stating instead that, “[b]ased in part on commenters’ concerns, DHS will revise the proposed information submission schedule pre viously published in the 30

- day notice.” 32 

### Given that one of the changes made “based in part on commenters’ concerns” was to impose a prior notice requirement, we are not sanguine that the revised schedule will not contain shorter deadlines. But we (and D HS) cannot accurately estimate burden without knowing that schedule.

29 

### Id . at 34724.
30 

### Id.
31 

### See 75 Fed. Reg. 18852

- 53.
32 

### 76 Fed. Reg. 34724.

### ICR Reference No. 201105

- 1670

- 002 July 11 , 2011 Page 8

* * *

For the reasons explained above, OMB should disapprove this ICR and instruct DHS to resubmit it (i) following the procedural requirements of the PRA and OMB’s rules and (ii) suitably narrowed to meet the subst antive requirements of the PRA.

Sincerely,

Agricultural Retailers Association American Coatings Association Chemical Producers and Distributors Association Compressed Gas Association CropLife America Institute of Makers of Explosives International Instit ute of Ammonia Refrigeration International Liquid Terminals Association National Association of Chemical Distributors National Petrochemical and Refiners Association Society of Chemical Manufacturers and Affiliates The Chlorine Institute The Fertilizer Ins titute_____________________________________________________________________________________ The safety and security institute of the commercial explosives industry since 1913

July 13, 2011

The Honorable Cass R. Sunstein Administrator Office of Information and Regulatory Affairs 1650 Pennsylvania Ave., NW Washington, DC 20503

RE: ICR Reference No: 2011105

- 1670

- 002 Chemical Facility Anti

- Terrorism Standards Personnel Surety Program (DHS

- 2009

- 0026) 1

Dear Ms. Sunstein:

On behalf of the Institute of Makers o f Explosives (IME), I am submitting comments on the above referenced information collection request (ICR) submitted by the US Department of Homeland Security (DHS) Infrastructure Security Compliance Division (ISCD) to the Office of Management and Budget (O MB) that deals with personnel surety requirements under the Chemical Facility Anti

- Terrorism Standards (CFATS)

. These comments support and supplement comments submitted by a coalition of 13 associations representing industries directly affected by the proposed personnel surety program (PSP). 2

Interest of the IME

The IME is a non

- profit association founded to provide accurate information and comprehensive recommendations concerning the saf ety and security of commercial explosive materials. The IME represents U.S. manufacturers and distributors of commercial explosive materials and oxidizers as well as companies providing related services. These products are used in every state of the Unio n, and they are literally the workhorse of our industrial society for which there is currently no alternative. Explosives are essential to energy production, metals and minerals mining, construction activities and supplies, and consumer products. IME mem bers that are participating in the CFATS program will be impacted by the ISCD personnel surety requirements.

Background

Since 1970, the safety and security of explosives has been closely regulated by the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) under Federal Explosives Law (FEL). In recognition of this close

1 76 FR 34720 (June 14, 2011).

2 Comment to OMB from Agricultural Retailers Association

, American Coatings Association
, Chemical Producers and Distributors Association

, Compressed Gas Association

, CropLife America

, Institute of Makers of Explosives

, International Institute of Ammonia Refrigeration

, International Liquid Terminals Association

, National Association of Chemic al Distributors

, National Petrochemical and Refiners Association

, Society of Chemical Manufacturers and Affiliates

, The Chlorine Institute , and The Fertilizer Institute , dated July 11, 2011.

________________________________________________________________ __________________ 1120 Nineteenth Street, NW, Suite 310, Washington, DC 20036, USA, (202) 429

- 9280, FAX (202) 293

- 24202

regulation by ATF, the CFATS program applies to only a few named explosives. Nevertheless, explosives manufacturing involves chemical precursors that are covered by the CFATS program. As a result, some explosives manufacturing sites are subject to both programs.

FEL requires persons who import, manuf acture, store, or distribute explosives to obtain a license, and those who receive or use explosives and do not have a license, to obtain a permit. Among the many requirements that these business entities must meet in order to obtain a license or a permit is a requirement to submit to ATF for a threat assessment the names of all employees who are authorized to
possess 3 explosives or those empowered to make management decisions or policies. 4 The FEL standards for the threat assessment s conducted by ATF are the forerunner of the threat assessment standards that were subsequently adopted by DHS for the plethora of programs it administers for transportation workers. 5 Each is these DHS programs has adopted the core standards and disqualifications used by the
A TF
, includ ing a check against the terrorist screening database (TSDB).

The majority of IME member companies own and/or operate motor vehicles. These vehicles are engaged in the transport of hazardous materials that require drivers to obtain hazardous materials endorsements (HME). In order to possess an HME, these drivers must submit to DHS for a threat
assessment . The standards for the HME threat assessment , as noted above, are virtually the same as those required to obtain other DHS’ credential

- based threat assessment programs. D rivers transporting commercial explosives often find themselves subject to redundant equiv alent threat assessment s through ATF and DHS.

CFATS requires regulated facilities to comply with a number of risk

- based performance standards (RBPS). RBPS 12 requires that covered facilities provide for the personnel surety of certain employees and vis itors with unescorted assess to restricted areas containing chemicals of interest. IME has timely fil ed comments to each of ISCD’s Federal Register notices to establish such a PSP under CFATS

. 6 Yet, the agency has failed to implement our recommendations to leverage existing government threat
assessment programs to lessen burdens on the regulated community and the agency. This failure imposes unacceptable and unnecessary burdens on the regulated community. In ad d ition, ISCD has made procedural errors th at warrant immediate attention

.
With this perspective, IME offers the following comments.

Paperwork Reduction Act Procedures

ISCD has published three notices, including the present notice, of its intention to collect information about individual s with access to CFAT

- regulated restricted areas or critical assets for the purpose vetting the information against the TSDB

. 7 In comments IME submitted to ISCD’s first two notices, we expressed disappointment that the agency would cho o se to implement this regul atory requirement

3 “Possession” is interpreted as both actual and constructive.

4 “Threat assessment” is used interchangeably with “background check”. This comment uses the term “threat assessment.” The PSP is a threat assessment.

5 Hazardous M aterials Endorsement Threat Assessment (HME), T ransportation W orker I de ntification Credential (TWIC), F ree and S ecure T rade C redential (FAST) , NEXUS, etc.

6 C omments to DHS

- 2009

- 0026 from IME dated May 11, 2010 and August 6, 2009. W e invite OMB to review all comments in the DHS docket.

7 DHS

- 2009

- 0026: 74 FR 27555 ( June 10, 2009 ), 75 FR 18850 (April 13, 2010 ), and 76 FR 34720 (June 14, 2011).3

through an ICR process under the Paperwork Reduction Act (PRA), rather than full notice and comment under the Administrative Procedure Act

, given the complexities and intrusive nature of any threat
assessment

. While ISCD dismiss ed these concerns, OMB should note that ISCD has not complied with the procedural requirements of the PRA to obtain an ICR

. Under the PRA

, agencies are generally required to publish a 60

- day notice in the Federal Register soliciting public comment to be submitted to the proposing agency . After conclusion of the 60

- day comment period and the agency’s internal consideration of the public’s comments, the agency is supposed to submit its ICR to OMB and publish a second Federal Register notice announc ing a 30

- day comm ent period and the start of the OMB review

. The notice would inform the public about how to submit comments to OMB and advise that OMB may act on the agency’s request only after the 30

- day comment period has closed. In this instant case, ISCD’s initial 2 009 notice property informed the public that t he purpose of the notice was to solicit comments during a 60

- day public comment period prior to the submission of this collection to OMB. While ISCD’s second notice , published in 2010, provided for a 30

- day comment period, the public was directed to submit comments to DHS, not to OMB. The third just

- published notice was a “response to comments” and an announcement that the agency’s personnel surety ICR had been submitted to OMB. This notice does not invite additional comment to be filed with the agency or elsewhere . At no time has ISCD provided requisite notice to the public of an opportunity to provide comments directly to OMB or the process of how to provide those comments. This pr ocedural error cannot be overlooked. On this basis alone, OMB should return ISCD’s ICR package and direct that the agency re

- announce its intent to submit the package to OMB and provide the public with clear instructions about how to submit
comments to OM B within the stipulated 30

- day comment window.

Avoiding Regulatory Overlaps

IME applauds the goals espoused by the President in Executive Order 13563. As noted in the preamble, it builds on former President Clinton’s Executive Order 12866 “requiring Fed eral agencies to design cost

effective, evidence

- based regulations that are compatible with economic growth, job creation, and competitiveness.” 8 The principles laid down in section 3 are of particular relevance here. In part, section 3 states that, Some sectors and industries face a significant number of regulatory requirements, some of which may be redundant, inconsistent, or overlapping. Greater coordination across agencies could reduce these requirements, thus reducing costs and simplifying and h armonizing rules. In developing regulatory actions and identifying appropriate approaches, each agency shall attempt to promote such coordination, simplification, and harmonization.

If there was ever a government function that could be the poster child for redundancy, inconsistency and overlap, it would be mandated security

- based threat assessment programs. IME has worked hard

, mainly through the H ighway

- Motor Carrier Sector Coordinating Council, to address the redundancies and overlaps that currentl y exist between a number of equivalent threat assessment programs administrated by DHS, such as the Transportation Worker Identification Credential (TWIC) and commercial driver’s licenses with hazardous materials endorsements (CDL

- HME). 9 Regrettably, ISC D has

8 76 FR 8940 (February 16, 2011).

9 These efforts included the White House driven Surface Transportation Security Priority Assessment (STSPA) issued in 2010. T he STSP A made 20 recommendations to close policy gaps and address program overlaps

. Two of these reco mmendations deal specifically with the threat assessment issue. Recommendation 16 calls for the creation of a more efficient Federal credentialing system by reducing credentialing redundancy, leveraging existing investments, and implementing the principle of “enroll once, use many” to reuse the information of4

inexplicably refused to grant reciprocity to its own well

- established vetting and credentialing programs. Instead of granting reciprocity to h olders of these credentials that have already been vetted by the federal government to each of the required threat assessment screens

– identity, criminal history, citizenship, and terrorist ties

– required by CFATS, DHS is establishing yet one more redundant threat
assessment program thr ough the PSP

. Although ISCD is prepared to add nothing to the rigor of the government’s threat assessment standards, the agency will only accept DHS’ own security credentials as satisfying the requirements of the PSP if covered facilities subm it more data elements for each credential holder than will be required to be submitted for individuals who do not choose to use one of these credentials. This perverse incentive results because ISCD insists that it (and only it) must and can “verify” that the credent ial i s valid. In short, ISCD does not have confidence that those administrating DHS’ other security vetting programs are capable of acting on information they receive about hits against the TSDB, and ISCD has put itself forward as the arbiter of whether t hose other DHS vetting and credentialing schemes are sufficient ly robust

. 10 This is not a role envisioned by Congress for ISCD or the CFATS program. ISCD’s role is to offer facilities a service to check against the TSDB for those employees and unescorted visitors who have not been vetted against the TSDB by another equivalent federal threat
assessment program. By law, ISCD cannot dictate how a covered facility accomplishes these threat
assessment s, including vetting against the TSDB.

Likewise, as explained above, the ATF performs a security threat assessment on all employees. 11 Yet, ISCD f lat ly refuses to accept ATF clearances because it alleges that ATF “does not conduct recurrent vetting against the TSDB.” 12 By “recurrent,” ISCD means that ATF do es not run the employee data it receives from its licensees and permittees against the TSDB on a perpetual 24/7 basis. 13 While ATF does
not re

- process names against the TSDB outside of its normal licensing/permit t ing schedule, there is nothing to preclude ATF from sharing data with DHS about workers at co

- located CFATS sites. In fact, ATF states that it is actively working with DHS to share information and results from TSDB “hits.” 14 It should be unacceptable to OMB that ISCD will not recognize the vetting results that the ATF is willing to provide about individuals employed at those facilities now regulated by both agencies

, given that ATF has historically regulated these facilities since the 1970s and has successfully vetted employees to equiv alent DHS standards since 2003

. Without this accommodation, the regulatory overlaps between the two agencies will impose unreasonable burdens on this segment of the regulated community without any corollary enhancement to security. In fact, it will be mo re onerous to vet our employees for access to precursor chemicals than for access to finished high explosive products. ISCD’s accommodation of this data interchange with ATF should be prerequisite to OMB’s approval of this ICR.

individuals applying for multiple access privileges. Recommendation 17 directs DHS to collaborate with the SCCs to develop a proposal for security threat assessment (STA) standards.

10 It is worth no ting that tens of thousands of times a day holders of DHS’ security credentials engage in security

- sensitive activity. The current standard of verification is a visual inspection of the credential.

11 As required by the FEL, t he ATF conducts the same threat assessment

– identity, criminal history, and citizenship

– that ISCD tasks to employers , as well as the TSDB screen for terrorist ties

. The FEL standard also screens for and precludes mental defectives and individuals with dishonorable discharges f rom the armed forces.

12 75 FR 18854 (April 13, 2010).

13 It should be noted that, for four plus years, DHS has “recurrently” vetted the names of TWIC, HME and other security threat assessments credential holders against the TSDB. During this time, less t han a handful of the millions of names that have been screened on a daily basis have been shown to be a bona fide person of security interest.

14 Currently, a TSDB “hit” is not, in and of itself, a disqualifying offense that would preclude an individual fr om working for an ATF licensee or permittee. However, “hits” are not ignored. The FBI manages the TSDB and immediately follows up on all “hits”.5

OMB should insist that ISCD grant reciprocity for purposes of RBPS 12 to all equivalent federal security vetting program s

. Leveraging other equivalent federal threat assessment s will reduce the cost burden of RBPS 12 for both the government and industry without compromising sec urity , and is consistent with the objectives of Executive Order 13563

.

PSP Overreach

Section 4 of Executive Order 13563 states in part that, Where relevant, feasible, and consistent with regulatory objectives, and to the extent permitted by law, each agency shall identify and consider regulatory approaches that reduce burdens and maintain flexibility and freedom of choice for the public.

Thr ough the Chemical Security Coordinating Council, IME and other affected industry associations developed alternative app roaches to satisfy the personnel surety requirements of RBSP 12. 15 (See attached.) This proposal leverages existing DHS security threat assessment programs. In simplest terms, ISCD should allow covered sites to recognize existing DHS’ security credentials as satisfying the terms of RBSP 12, and the department should allow those currently without credentials to apply for a
TWIC. 16 As exp lained above, many individuals

, who would otherwise be subject to the PSP

, are holders of DHS threat assessment credentials. ISCD has challenged th e second prong of the proposal stating that such an accommodation to issu e TWICs to non

- maritime employees is prohibited by law. ISCD is misinformed on this point. While t he law requires DHS’ to issue TWICs to those needing unescorted access to restricted areas at maritime facilities, the law does not preclude DHS from issuing TWICs to others. In fact, prec edent has already been established. DHS currently issues TWICs to citizens of Canada or Mexico so that they may qualify to transport hazardous materials into the United States irrespective of whether the shipments are destined for a port. The TWIC is mor e and more seen as the security credential of choice by those in Congress who are working to eliminate program redundancy. 17

At the same time, ISCD does not have the legal authority to compel covered facilities to use its PSP to meet the standard to vet against the TSDB or to verify those results

. CFATS authorizing statute provides that, the Secretary may not disapprove a site security plan submitted under this section based on the presence or absence of a particular security measure, but the Secretary may disapprove a site security plan if the plan fails to satisfy the risk

- based performance standards established by this section. 18

The regulatory standard establishing RBPS 12 r equires covered facilities to

,

15 Proposal for the Implementation of a Personnel Surety Program, December 2010. The proposal is marked “draf t” to indicate our willingness to work with DHS for reasonable solutions to meet RBPS 12.

16 Some have attempted to discredit the TWIC program based on the recently

- released GAO report, Transportation Worker Identification Credential: Internal Control Weak nesses Need to Be Corrected to Help Achieve Security Objectives, amid claims that covert investigators were able to go onto port property with TWICs acquired by fraudulent means. (GAO

- 11

- 657, May 10, 2011.) However, these weaknesses could have been found in any federal credentialing program. As it currently stands

, the TWIC is the most robust credential ava ilable to the private sector.

17 See Shimkus amendment to HR 908, and HR 1690, section 5.

18 Public Law 109

- 295 , Sec. 550.6

Perform appropriate threat assessment s on and ensure appropriate credentials for facility personnel, and as appropriate, for unescorted visitors with access to restricted areas or critical assets, including, (i) Measures designed to verify and validate identity; (ii) Measures designed to check cr iminal history; (iii) Measures designed to verify and validate legal authorization to work; and (iv) Measures designed to identify people with terrorist ties. 19

Bottom line, covered facilities may choose to meet the TSBC standard though another federal pro gram. ISCD ’ s PSP must provide for that option. Otherwise, ISCD overreaches its authority.

Unknown Burden

In its latest iteration of the PSP described in the June 14, 2011 notice, ISCD states that i t i s “considering “ whether to require 48

- hour prior submission of person a l data from affected individuals as opposed to the agency’s original 30

- day pos t

- access notice. The difference in these performa n ce standards would be magnitudes of burden. While a 48

- hour prior submission of data on employees may be a possibility, it would be an unimaginable burden on covered facilities to provide advance data on “visitors,” which would include those delivering chemicals of interes t; private emergency response personnel ; and personnel from contractors such as grounds maintenance , cleaning, HVAC, and the like. It may not be known on any given day who from such companies would be on site , and these same individuals in the course of their business will likely provide serv ices to any number of covered facilities

. In add ition, covered facilities would have to provide notice to ISCD when these individuals no longer have access. How often this type of notice is required (e.g., real time, daily, monthly ) is unknown

.

In its attempt to quell concerns about the PSP compliance burden, ISCD has stated that covered facilities have “wide latitude” to determine the boundaries of restricted areas thereby limiting those needing clearance

, and that facilities are free to determine what is meant by “escorted.” These accommod ations are baseless. Covered facilities do not have unfettered discretion. ISCD through its approval of site

se curity plans will ultimately dictate the adequacy of restricted areas and

, as part of this approval

, likely will not allow “escort” protocols t hat the agency considers inadequate. It is absurd to think that ISCD would allow a covered facility to weaken performance of other CFATS standards in order to avoid compliance with personnel surety requirements.

In an attempt to better understand and a ccount for the burden of the PSP program, IME and other affected industry associations suggested that ISCD conduct a pilot of the program to test its proposals and ours. Initially, ISCD said that it would run a pilot. However, ISCD has now withdrawn that offer because a “ pilot ” would require, in their view, submission of a new , separate ICR to OMB. ISCD is not willing to do this. Rather, the agency has stated that

, after it obtains approval for this ICR
, it will “phase in” implementation of the PSP. This phased implementation will then allow the agency to tweak the program as necessary. Given the magnitude of the flaws we see with the agency’s current approach, we do not trust that the agency will have the ability or resolve to make the fundamental changes necessary to make this program viable.

19 6 CFR 27.230(a)(12). Please note that the directive to “verify” is absent from measure (iv).7

Conclusion

IME supports the vetting of individuals engaged in security

- sensitive activities. However, t he proposed
PSP pending OMB review was drafted without accommodation of alternative approaches that would reduce regulatory burden

. DHS ’ justification for mandating that its current PSP proposal be the only option to satisfy a covered facility’s need to vet covered individuals against the TSBD is not supporte d by law or regulation. DHS’ actions will increase costs with no corresponding security benefit. The agency’s actions violate the spirit and intent of Executive Order 13563

, and the procedural requirements of the
PRA. We urge OMB to direct ISCD to implement RBPS 12 i n a way that leverage s existing government vetting programs , and that maximize s the use of partnerships with other government agencies and the private sector to optimize public safety, facilitate commerce and strengthen the resiliency of the nation’s chemical sector

.
Respectfully, 

# Cynthia Hilton

Cynthia Hilton Executive Vice President chilton@ime.org

Attachment

cc: Alex Hunt, Chief , Information Policy Branch, OMB Kim Nelson, DHS Desk Officer

, Information Policy Branch, OMBJuly 1 4 , 2011

Ms. Kim Nelson DHS Desk Officer Office of Information and Regulatory Affairs Office of Management and Budget, New Executive Office Building, Room 10236 725 17th Street, NW. Washington, DC 20503

Re: Docket No. DHS

- 2009

- 0026 ( Chemical Facility Anti

- Terrorism Standards Personnel Surety Program ) ; Federal Register / Vol. 76, No. 114/Tuesday, June 14, 2011

Dear Ms. Nelson :

The American Chemistry Council (ACC) offers the following comments related to the DHS Submission for Chemical Facility Anti

- Terrorism Standards (CFATS) Personnel Surety Program Information Collection Request (ICR)

. Although ACC believes the ICR is necessary in order to support a robust CFATS prog ram, we believe some of the approaches proposed by the DHS to collect, manage and report personal information of affected individuals could have negative unintended consequence s and will create significant burden without additional benefit to enhance secur ity.

Many ACC members are subject to the CFATS personal surety requirements and have a significant interest in how this program is developed and implemented. Ensuring that well qualified and trustworthy personnel are employed by and work for chemical facilities continues to be a priority for ACC members. Under the Responsible Care ® Security Code, ACC m ember companies are required to conduct background checks of employees and confirm that checks have been completed for contractors and who have unescort ed access to restricted areas and critical assets. Periodic reassessments are also required as well. We believe that the core elements of the CFATS program for personnel surety as outlined in R isk B ased P erformance S tandard 12 are consistent with the bac kground checks already utilized by ACC members and generally within the chemical industry. We support a robust, comprehensive and effective approach to screening employees and contractors that have unescorted access to restricted areas and critical assets at high risk facilities.

Based on the information provided in the ICR notice

, the burden has been significantly underestimated. The ICR cost estimate is based on the estimated population of employees and resident contractors at CFATS facilities. This population does not include the large numbers of transportation workers, vendors, corporate auditors, and other personnel who may need to be on site once or more during the course of a year

. DHS also does not consider the high rate of turnover in visitors to facilities which typically far exceeds turnover rates in the employee/resident contractor population.

In addition the burden estimate ignores the cost of developing and maintaining a sys tem to manage the relevant information (i.e., IT resources, training, etc.)

. It also ignores any capital costs that might be incurred to change the layout of facilities to reduce access to restricted areas. These burdens areACC Letter to OMB

– July 14, 2011



### 2

significant, and ACC believe s that existing unduly burdensome methods can be de ployed in a manner that
meet s DHS’s goal s for personnel suret y, overall goals that ACC fully shares and supports

.

ACC beli e ves that complete reciprocity with existing federal security credential and vetting programs such as the Transportation Worker Identification Credential ( TWIC ) and the Hazardous Materials Endorsement ( HME ) would reduce the significant reporting burden on indus try associated with RBPS 12 compliance. While ACC understands that DHS does not necessarily intend to re

- vet affected individuals who possess a valid federal credential

, CFATS facilities would still be required to collect, submit and manage personal inform ation on these individuals

. This requirement potentially imposes a significant information collection and reporting burden. Indeed, the requirement may create a d isincentive to leverage other existing federal credential s , since more information is required for these individuals than routinely required for other affected individuals that have not already been screened . In their response to comments in the subject ICR , DHS states that information required for TWIC holders includes : (1) Name; (2) Date of Birth; (3) TWIC Serial Number; and (4) Expiration Date

, w hereas, information required for affected individuals who have not been screened and do not possess a valid TWIC include: (1) Name; (2) Date of Birth; and (3) Gender or Citizenship.

The Chemical Sector Coordinating Council (CSCC) , of which ACC is a long

- time member

, established a Personnel Surety Workgroup during the fall of 2010 to help DHS identify some alternative approaches that would provide assurance to DHS and cov ered facilities that chemical workers are properly vetted prior to being granted access to restricted areas and critical assets. ACC participated in several meetings with DHS leadership on this issue held during the latter part of 2010 and early in 2011

. ACC supports the alternative approach offer ed by the CSCC and believes it would effectively accomplish the objective s outlined in RBPS 12. The essential aspects of the CSCC proposal included the following elements:

For chemical w orkers who have already b een vetted and possess a valid federal credential, DHS should r ecognize existing government vetting programs that in clude all 4 elements outlined in RBPS 12:

(1) Verify and Validate Identity (2) Check Criminal History (3) Verify and Validate Legal Authorization to Wo rk (4) Identify People with Terrorist Ties

Covered facilities should be responsible for ensuring the validity of the federal credential to ensure it is legitimate , current and belongs to the holder requesting to gain access. This would eliminate the need for covered facilities to collect and submit duplicative information on a large population of affected individuals and would provide reasonable assurance that such individuals comply with the requirements of RBPS 12.

For c hemical w orkers who are employees of a covered facility and have NOT previously been vetted could fall into one or both of two options:

(1) A T ransitional Vetting Program whereby owner/o perators of covered facilities conduct checks for items 1

- 3 above and provide DHS with personal identifying in formation (PII) for check of item 4 (terrorist screening) , or (2) Expan sion of the TWIC Program to CFATS covered facilities

.

ACC recommends that o wner/operators of covered facilities not be expected to vet contractors or visitors exclusively, but could rely on c ontracting/visiting companies to vet their own employees to the standards in RBPS 12 items 1

- 3

. For item 4 (TSDB)

, DHS should set up a network of “Trusted Agents”ACC Letter to OMB

– July 14, 2011



### 3

including TWIC enrollment centers

, l ocal safety c ouncils and c hannelers (e.g. Axiom, Cogent)

. These

“ Trusted Agents ” would v erify identity and collect Personal Identifying Information ( PII ) , s ubmit to DHS for Terrorist Screening , r eceive confirmation from DHS and provide confirmation to c ontractor

. Owner s and operators of covered faciliti es could include the above requirements in their contract ual agreement and make compliance a condition of visitors gaining facility access

. In conclusion, ACC supports establishing a pilot program to test some of these concepts and incorporate changes to the existing DHS proposal that could a significant effect on minimizing burden while ensuring security at CFATS facilities. The pilot group should include a mix of owner/operators of CFATS covered facilities , potential trusted agents including local safet y councils

, contractors, DHS and other stakeholders.

ACC also support s the comments submitted jointly by other members of the Chemical Infrastru cture Sector and the Oil and Natural Gas Sector

. While ACC does not in these comments discuss issues related to compliance with the procedural requirements of the Paper Work Reduction Act, ACC agrees that OMB should disapprove this ICR , as the economic burden associated with the program has been significantly underestimated

.

T hank you for this opportunity to pr ovide input on this important issue. ACC would appreciate the opportunity to meet with OMB pursuant to EO 12866, so that we can provide greater detail on the matters of concern. Please contact me if you have any questions or require further information.

Sincerely, William J. Erny Senior Director, Security American Chemistry CouncilJu ly 2011 © American Chemistry Council, Inc. BACKGROUND In April 2007, the Department of Homeland Security (DHS) finalized the Chemical Facility Anti

- Terrorism Standards (CFATS) which aimed to increase security at the nation’s chemical facilities. O ne of the program elements includes a requirement “to submit information about facility personnel and, as appropriate unescorted visitors with access to restricted areas or critical assets.” The information collected will be submitted to DHS to be screened against known and suspected terrorists in the Terrorist Screening Database (TSDB). To screen individuals against the TSDB, DHS requires facilities to collect and submit personal information to the Department and to manage this info rmation and provide upda tes when individuals no longer have access to restricted areas or critical assets 1

.
While the American Chemistry Council (ACC) supports the goal of increasing security at high

- risk chemical facilities, the Council believes that, in contrast to the proposal currently set forth by DHS, there are less burdensome ways to collect and submit personal information for individuals with access to restricted areas and critical assets, especially those who have already been vetted by anothe r Federal credentiali ng program. High risk chemical facilities that participate in Responsible Care ® already conduct background checks on their employees that have access to r estricted areas or critical assets. Unescorted visitors and resident contractors are also vetted. Simi larly, many une scorted transportation workers that with access to restricted areas or critical assets possess transportation worker identification credential (TWIC) or hazardous materials endorsement (HME) credentials. Imposing a requirement that facilitie s report personal information about each individual at each facility will be costly and is unnecessary. The costs associated with this information collection request (ICR) far exceed the simplistic estimate that DHS pr epared in April 2010 and subsequently updated in June 2011. ACC is concerned that t he updated estimate continues to omit the substantial burden and cost s associated with submitting information on visitors , update notifications, and resubmissions

.

CHANGES IN THE DHS ESTIMATE OF THE COST BURDEN FOR THE PERSONNEL SURETY PROGRAM ICR In its initial estimate of the cost burden (Federal Register, 4/13/2010, page 18857), DHS estimates the burden to be $17.7 million annualized over three years. In its updat e estimate of the cost of the burden on industry (Federal Register, 6/14/2011, page 34732), DHS makes several changes to its initial estimate, including:

 Allowing t urnover of employees/resident contractors in subsequent years

 Significantly increasing the number of Group A (large open) facilities by an “ order of magnitude ”

.

 Reducing by 3 minutes, the time to submit information for each respondent

 Reducing by half the hourly wage from $84 .00 to $42 .00

. Apparently, DHS now assumes that a n admini strative worker, rather than the Site Security Officer (SSO) will be conducting the submissions.

As a result of these changes , DHS estimates the total cost burden to be $29.7 million , up from $17.7 million in its April 2010 estimate

.

DHS SIGNIFICANTLY UNDERE STIMATES COST BURDEN Despite the changes in the DHS estimate, ACC continues to believe that DHS has significantly underestimated the cost burden of the PSP. Below are several omissions in the DHS analysis:

1 Based on recent comments made by DHS at the Chemical Security Conference, (6

- 7 July 2011, Baltimore, MD), ACC assumes that update notifications to DHS will occur only when individuals (whether employees or visitors that are employees of other firms (i.e., delivery companies /vendors ) ) move out of positions that require them to be at the facility. 

# Updated Cost Burden Estimate for

DHS Personnel Surety Program

American Chemistry Council

July 20112

 Submission of information about visitors

 Updates to DHS when individuals no longer have access to restricted areas and/or critical assets

 Resubmissions/clarifications of data submitted to DHS for errors and/or insufficient/conflicting data.

Omission of Visitors ACC continues to challenge the Department’s implicit assumption that the number of affected individuals is limited to the number of employees and resident contractors 2 . This oversight has significant ramifications. First, it widely expands the number of affected individu als that would b e required to provide information to facilities and then submitted to DHS

. Based on information provided by member companies, there are two basic types of visitors:

 Infrequent visitors include individuals that may only visit each chemical facility once or twice over the course of a typical year. These include corporate managers/auditors, turnaround crews, salespeople, ad hoc repair workers , trainers, etc.

 Regular visitors include delivery personnel, transportation workers, maintenance contractors, certain vendors, etc. that are on

- site on a regular basis.

Omission of Update N otifications
B ecause DHS requires both a submission prior to an individual having access to restricted areas or critical assets and also a notification when that person no longer has access, the number of submissions expands when the nu mber of update notifications. At a minimum, it is reasonable to assume that facilities will be required to provide u pdate submissions when employees and resid ent contractors turnover. In addition, turnover of visitors should also be included. When visitors are no longer employed or no longer needed to be at the facility, DHS should be not ified that they no longer have access.

Omission of Resubmissions and Clarifications It is not unreasonable to anticipate that a certain number of data submissions to DHS will result in the Department requesting clarifying information when errors or incomplete information are submitted to DHS. Facilities must then resubmit data, or when the error is not one of transcription , contact the individual to get the correc t information or clarification and then resubmit the data. The time associated with this activity is not trivial.

ALTERNATIVE COST ESTIMATE OF THE PAPERWORK BURD EN Using information provided by ACC members and basic cost assumptions implicit in DHS’s updated analysis, we have constructed a more realistic assessment of the cost burden associated with DHS’s Personnel Surety Program which is presented in Table 1 . This estimate uses the same assumptions as the DHS ICR cost burden estimate, such as time per submission (0.54 hours) and hourly wage rate ($42.00) , but reflects the e xpanded n umber of data

s ubmissions to DHS to include visitors, update notifications, an d resubmissions. Details on the assumptions are presented in the appendix tables.

Employees/Resident Contractors
Because not all employees/resident contractors at chemical facilities has access to restricted areas or critical a ssets, ACC estimates that th e number of initial submissions for its employees and resident contractors will be 2.3 million during the first year, assuming that 80 % of employees/ resident contractors at high

- risk facilities (15% for theft/diversion facilities) have access to restricted areas and/or critical assets and are thus screened against the TSDB. This includes an estimate of 20 % employee/ resident contractor turnover that was used in the CFATS Regul atory Assessment

. In subsequent years, 0.4 million submiss ions will be required based on turnover.

2 As the base for the affected population, DHS starts with the estimated number of employees/resident contra ctors from the CFATS Regulatory Assessment (1 April 200 7) Table 15. This population includes only personnel (whether direct employees or resident contractors) on site on a daily basis. It does not include visitors, such as transportation workers, vendors, corporate auditors, and other personnel that may n eed t o be on site on e or more times during the course of a year who have already been vetted

.3

Visitors Based on information provided by ACC members, the average number of visitors at each chemical facility during the course of a year ranges from 25 per year at theft/diversion only facilities (Group D) to 1,200 per year for large open manufacturing (Group A) facilities. ACC assumes that ha lf of the visitors are infrequent visitors and half are regular visitors. ACC assumes that infrequent visitors turnover at a 20% rate, the same for employees and resident contractors. ACC members report much higher turnover of regular visitors, however. As a result, v isitor turnover is estimated to be 5% per month which, via compounding, yields a 71% turnover rate annually. ACC estimates that
7.2 million submissions will be required in the first year for all visitors , including turnover , and 2.3 million submi ssions in subsequent years to reflect turnover

.
Update Notifications Based on the turnover of employees/resident contractors and visitors, an additional 2 .6 million update submi ssions (due to turnover) will be required each year to notify DHS when these individuals no longer have access to restricted areas or critical assets.

Resubmissions and Clarifications
I t is reasonable to assume that 5% of submissions will re sult in the need to go back to correct an entry and/or gather additional information or resubmission because of an error in transmission. This yields an additional 0. 6 million submissions during the first year and 0. 3 million in subsequent years

.
Thus, the burden of submitting personal information to DHS totals 12.8 million submissions in the first year and 5. 5 million in subsequent years

.

COST OF THE PSP PAPERWORK BURDEN DHS implies that the “total time, effort, or financial resources expended by persons to generate, maintain, retain, disclose, or provide information to or for a Federal agency” amounts to 0.54 hours (32.4 minutes) per submission. Though the details of DHS’s estimate of the time to conduct a submission are not presented, ACC assumes the e stimate represents the average time for a n administrative worker to collect, retain , and transmit data to DHS

. Based on comments, DHS has halved the loaded average hourly wage rate to $42.00 to reflect an hourly wage of $30 .00 plus 40% for ben efits. Using the Department’s updated wage rate, the cost of data submissions totals $ 28 9 .4 mi llion in the first year and $ 125.8 million in subsequent years. On a discounted annualized basis, the program will cost $ 1 71.5 million annually over 3 years using a 7% discount rate.

Table 1

– Cost of DHS Personnel Surety Program (PSP) over 3 Years

Year 1 Year 2 Year 3 Employees/ Resident Contractors 2,289,220 381,537 381,537 Visitors 7,223,762 2,258,977 2,258,977 Updates 2,640,514 2,640,514 2,640,514 Resubmissions (5%) 607,675 264,051 264,051 Total submissions to DHS 12,761,171 5,545,079 5,545,079

Hours per submission (DHS) 0.54 0.54 0.54

Total hours for PSP 6,891,032 2,994,343 2,994,343

Hourly loaded wage $42.00 $42.00 $42.00

Cost of PSP $289,423,353 $125,762,392 $125,762,392 Discount Factor (7%) 0.97 0.94 0.92 Discounted Cost of PSP (at 7%) $280,993,547 $118,543,116 $115,090,404

Total cost over 3 years $514,627,068 Discounted annual cost $171,542,3564

SIGNIFICANT ADDITIONAL COSTS NOT INCLUDED Because the cost estimate of this ICR relates to the paperwork costs, neither DHS nor ACC has estimated significant additional costs to develop and maintain the PSP at chemical facilities . These costs include:

 Capital costs for computer , telecommunications equipment
, software and/or secure paper file storage that would be necessary to securely manage the data collection, submission, and tracking required.

 Ongoing costs such as, internet connectivity, supplies, signs, etc.

 T ime of IT personnel and others to design and deploy such a system or to maintain this system over the
years.

 Training of facility personnel tasked with implementing the PSP

 SSO time to manage the PSP at his/her facility (based on the wage rate used in the DHS analysis)

Opportunity Costs for Multiple Submissions An additional cost area not considered is the opportunity cost for visitors, many of whom will visit multiple facility sites during a given year, to submit their personal information at each CFATS facility they visit. While DHS respon ded that each individu al would be screened only once, a significant burden remains. Each visitor would still be r equired submit their personal information (or proof of active TSDB screening) to facilities for transmission to DHS. This is especially the case for transportation w orkers (who may have already been run through the TSDB if they have a TWIC or HME credential). But also, corporate managers, vendors

, maintenance crews, etc. will be required to submit information multiple times.

SUMMARY After accounting for visitors, tu rnover, update submissions, and resubmissions when errors occur , the paperwork burden of DHS’s Personnel Surety Program goes well beyond the Department’s initial estimate

. This does not even
in clud e the significant additional costs such as building a system to store and track data, providing training for submitters, m anaging the PSP . Nor does DHS consider the opportunity cost of visitors to provide information at multiple facilities . ACC’s alternative estimate uses broad and relatively conservative assumptions on the number of visitors provided by member companies. Further research from a pilot program may yield additional information about the number of submissions required to comply with DHS’s personnel surety program.

ACC Economics & Statistics Department

July 20115

APPENDIX TABLES

Appendix Table 1

- Number of Employees/Contractors Initially Screened

Base Employees/ Resident Contractors (excl. turnover) Percentage

with Access Employees/ Resident

Contractors Screened Annual Turnover of Screened Individuals (20%) Total Employees/

Resident Contractors

(Year 1) Large Open Manufacturing 1,948,653 80% 1,558,922 311,784 1,870,706 Small Open Manufacturing 145,777 80% 116,621 23,324 139,946 Enclosed Manufacturing 276,347 80% 221,077 44,215 265,293 Theft/Diversion only 73,752 15% 11,063 2,213 13,275 Total 2,444,528 n/a 1,907,683 381,537 2,289,220

Appendix Table 2

- Number of Unescorted Visitors with Access to Restricted Areas or Critical Assets Initially Screened

Infrequent Visitors Regular Visitors All Visitors

Number of Facilities Average

number per facility 20% Turnover

(Years 2

- 3) Total Submi tted (incl. turnover) (Year 1) Average

number
per facility 71% turn over of reg ular visitors (Years 2

- 3) Total Su bmitted (incl. turnover) (Year 1) Total Submi tted (incl. turnover) (Year 1) Total Su bmitted (Years 2

- 3) Large Open Manufacturing 3,481 600 417,673 2,506,041 600 1,482,741 3,571,108 6,077,149 1,900,414 Small Open Manufacturing 1,281 150 38,430 230,580 150 136,427 328,577 559,157 174,857 Enclosed Manufacturing 1,032 150 30,960 185,760 150 109,908 264,708 450,468 140,868 Theft/Diversion only 1,883 25 9,415 56,490 25 33,423 80,498 136,988 42,838 Total 7,677 n/a 496,478 2,978,871 n/a 1,762,499 4,244,891 7,223,762 2,258,9776

Appendix Table 3

- Number of Update Submissions to Notify DHS When Individuals No Longer Have Access to Restricted Areas/Critical Assets

Number of Facilities Employee/

Contractor Turnover Infrequent

Vi si tor Turnover Regular

V isi tor Turnover Total Update

Submissions Large Open Manufacturing 3,481 311,784 417,673 1,482,741 2,212,199 Small Open Manufacturing 1,281 23,324 38,430 136,427 198,181 Enclosed Manufacturing 1,032 44,215 30,960 109,908 185,083 Theft/Diversion only 1,883 2,213 9,415 33,423 45,051 Total 7,677 381,537 496,478 1,762,499 2,640,514

Appendix Table 4

– Increase in Group A Facilities and Employees/Resident Contractors The table below shows how ACC estimated the increase in the number of Group A facilities and employees/resident contractors b ased on information provided in the Federal Regi ster notice (FR 6/14/11, p. 34726) in response to comments that the department had underestimated the burden. DHS made two changes to the number of affected ind ividuals: the first was to include turnover of the population in years 2 and 3. The second was an “order of magnitude” increase in the number of Group A facilities. DHS provided the annual ave rage respondents for each of the changes allowing us to back

- calculate the increase in Group A employees/resi dent contractors. Using the average number of employees/resident contractors per facil ity, the number of additional facilities was calculated.

Original Incl. turnover in

subsequent years Incl. turnover and new

Group A facilities Base number of employees/resident contra ctors 885,910 885,910 2,444,438
20% turnover in Year 1 177,290 177,290 488,888
Total Year 1 1,063,200 1,063,200 2,933,325

Turnover Y ea r 2 177,290 488,888

Turnover Y ea r 3 177,290 488,888
Total Y ea rs 1

- 3 1,417,780 3,911,100
Annual (presented in Federal Register) 354,400 472,593 1,303,700

Increase in Group A employees/ res. contractors 1,558,528 Ave. per Group A facility 582 Increase in Group A facilities 2
, 677

### July 14, 2011

The Honorable Rand Beers Under Secretary for National Protection and Programs U.S. Department of Homeland Security Washington, DC 20528

Re: CFATS Personnel Surety Program, Docket No. DHS-2009-0026

Dear Secretary Beers:

The U.S. Chamber of Commerce, the world’s largest business federation representing the interests of more than three million businesses and organizations of every size, sector, and region, writes to thank the Department of Homeland Security (DHS) for collecting public comments on the proposed Chemical Facilities Anti-Terrorism Standards (CFATS) Personnel Surety Program. 1 

### The Chamber’s ongoing concerns relating to the Personnel Surety Program follow below.

A. Minimizing Redundant Background Checks

The Chamber recognizes that an appropriate and effective personnel surety program is essential for employees and contractors at our nation’s high-risk chemical facilities. We vigorously support partnering with government officials to identify individuals with ties to terrorism who may seek to do our communities harm. However, the Chamber is concerned that the Personnel Surety Program is more prescriptive than the CFATS interim final rule intended.

Under the CFATS Personnel Surety Program, “affected individuals” — i.e., facility personnel and unescorted visitors — who have or are seeking access to restricted areas or critical assets of a facility must be vetted against the Terrorist Screening Database (TSDB). In a letter submitted to DHS in May 2010, the Chamber stated that performing a battery of background checks on affected individuals will be unnecessarily burdensome and costly for businesses. The Chamber has argued that there are already several federal screening programs in place — TWIC is often cited as a prime example — that satisfy any personnel surety program requiring a TSDB check. DHS suggests in its June 14, 2011 Information Collection Request that the Personnel Surety Program “will require only the minimum information necessary to verify affected

1 http://www.gpo.gov/fdsys/pkg/FR-2011-06-14/pdf/2011-14382.pdf

### 2

individuals’ enrollments in the TWIC, HME, NEXUS, SENTRI, and FAST programs” (FR 34724).

However, a dominant impression of industry is that the Personnel Surety Program is quickly becoming overly prescriptive and that facilities in practice will have to provide background-check information exceeding “minimal” requirements. While DHS intent to solicit as little information as necessary to verify enrollment in a DHS screening program is good, recent efforts have diminished the principle of reciprocity. The Chamber believes the Department should weave greater reciprocity between or among credentials to reduce redundancy and leverage existing investments in personnel screening.

B. Notifying Facilities of TSDB Matches

DHS states that it “will not routinely notify high-risk chemical facilities of CFATS Personnel Surety Program vetting results.” Instead, the Department will “coordinate with federal law enforcement entities” to monitor and/or prevent situations in which known or suspected terrorists have access to high-risk chemical facilities. This position is consistent with DHS’s April 13, 2010, notice in the Federal Register (FR). However, the Chamber continues to believe that a process must be created so that owners and operators can be voluntarily notified when there is a positive match to an identity in the TSDB.

C. Reducing the Burdens of Information Collection and Submission

The potential burdens placed on facilities to collect an array of individuals’ personal information and submit it to DHS make compliance with the Personnel Surety Program possibly unworkable. For example —

 The Department is considering whether to establish that facilities be required to submit information to DHS at least 48 hours prior to access to restricted areas or critical assets. The Department may, on a case-by-case basis, allow for variances from the reporting schedule (FR 34724). The yardsticks by which each case may be judged are unclear.

 DHS will allow facilities to designate third-party individuals to submit TSDB screening information (FR 34727). However, it is unlikely that many owners and operators will be willing to contract out this responsibility, with internal security being just one of several considerations.

 The Department indicates that if a networked computer system is listed as a restricted area or critical asset in an approved Site Security Plan, then individuals with access to that networked computer system would be considered affected individuals (FR 34728- 29). This interpretation by DHS could quite possibly usher in a significant reporting requirement for a facility’s cyber personnel who may be located in the United States and in other countries.

 DHS should consider eliminating the requirement that facilities notify Department officials when affected individuals no longer have access to a facility’s vital areas and

### 3

assets. This “final” reporting burden comes on top of already recurrent vetting and reporting when an affected person’s information has changed (FR 34728-30).

 DHS will require facilities to inform affected individuals of their rights under the Privacy Act of 1974 before their information is submitted to DHS (FR 34730). Such a move will require a new administrative procedure to notify and collect the signatures of affected individuals and a new system for record retention.

DHS should conduct a rigorous pilot of the Personnel Surety Program to assess the policies it intends for facilities to implement — paying close attention to the views and concerns of owners and operators along the way — before rolling it out more broadly. One of the main reasons that the CFATS program has been so successful is that it balances DHS’s security priorities and the business and economic realities faced by owners and operators throughout the industry. CFATS allows for appropriate security measures in a business-conscious environment. However, as currently outlined, the Department’s Personnel Surety Program disrupts this balance and places undue burdens and redundancies on private industry that, if left unchanged, may undermine or stress the successful partnership we have established through the Department’s public-private partnership model.

The Chamber appreciates the opportunity to present its view on the CFATS Personnel Surety Program. While the Chamber has serious concerns with a number of the program’s components, the Chamber applauds your efforts to address the nation’s chemical security, and we look forward to working with you and your DHS colleagues on this important issue. Please let me know if you have any questions. Thank you.

Sincerely,

Ann Beauchesne1 | Page

July 1 4 , 2011

National Protection and Programs Directorate
Office of Infrastructure Protection Infrastructure Compliance Division Department of Homeland Security

Re: Shell Oil Comments on Docket No. DHS

- 2009

- 0026 / ICR Reference No. 201105

- 1670

- 002

Shell Oil Company appreciates the opportunity to provide its position on the “Submission of Chemical Facility Anti

- Terrorism Standards Personnel Surety Program Information Collection” Notice (75 FR 18850, April 13, 2010).

As the owner a nd operator of critical infrastructure facilities in the United States, Shell Oil Company has

a substantial interest in the development and implementation of a Personnel Surety Program (PSP) that is effective in screening personnel granted access to our si tes. Like DHS, we believe in a common goal of protecting the public, our personnel, our operations and national security from harm. T o that end we fully support a well

- designed and administ ered PSP and applaud DHS for taking the lead in attempting to
dev elop such.

However, after several years of meetings and discussions we remain highly concerned that a number of

measures proposed by DHS do not facilitate the implementation of an effective PSP. R ather, some

measure s will impose unnecessary manpower an d economic burdens on both industry and DHS, as well as the duplication of efforts without a commensurate enhancement of security

.

Shell Oil, through its relationship with the American Petroleum Institute (API), National Petrochemical
and Refiners Assoc iation (NPRA) and the American Chemistry Council (ACC), has been and remains a member of the Chemical and Oil and Natural Gas Sector Coordinating Councils. As such we have
reviewed and fully support the comments previously submitted on behalf of API, NPRA
, and ACC regarding the proposed PSP. W e encourage DHS to carefully re

- consider those comments as they continue to have applicability to the PSP process.

A s a n owner an d operator of critical infrastructure facilities we feel compelled to again bring to DHS’ attention the potentially burdensome and ineffective aspects of the propos e d measures

. These include:2 | Page

1. Issue: Submission of Personal Identifying Data on US Government credential holders. For
those affected persons who have already completed a successful government background check
and hold an approved US Government credential ( such as a TWIC, HME, NEXUS, SENTRI and FAST) the Full Name, Date of Birth, Credential Number and Credential Expiration Date must be

s ubmitted. F or those who possess a commercial driver’s license with the Hazardous Materials Endorsement ( HME ) the State of Issue must also be submitted

.

Comment: The credentials identified above require a check against the Terrorist Screening
Database (TSBD). While we appreciate the fact that DHS will “accept” these credentials, t h e

re quirement to submit PII on credential holders who are already in the system is unnecessary duplication that adds additional manpower, paperwork, and cost to the program wi th no added
value. DHS justifies this measure by stating that the submission of additional data on credential
holders is necessary to “verify” that the credential is valid. W e find it ironic that DHS would

trust regulated sites to submit PII, but would not trust sites to verify the authenticity of such credential; something our sites are well capable of doing.

We strongly recommend that DHS refrain from r equir ing the submission of additional PII on those persons already holding an approved US Government credential

. R equiring such wil l substantially slow work operations, delay authorized access to sites, require greater staff

resources, add unnecessary costs and strain federal resources; a ll with no discernible improvement in security

.

2. Issue: 48 Hour Advance Notice of Entry. DHS is “considering” whether to require submission of PII at least 48 hours prior to access to restricted areas or critical assets.

Comment: The requirement to provide 48

- hour advance notice for persons entering a

r egulated site is simply not workable. W e know of no other industry or business that imposes,

or can even operate under, a requirement that mail and courier workers, delivery personnel,
commercial truck drivers, vendors, contractors, customers and visitors give 48

- hours notice of
their arrival . Such advance notice is not even required by the airlines, an industry well

- known to
be a much higher risk than chemical or oil and natural gas

. E ven today one can simply walk

- up
to an airline counter, purchase a ti cket, and board a plane shortly thereafter for virtually any destination desired.

Advance notice in our facilities will cause significant and unnecessary delays in both routine and

emergency work requirements

. I t will also greatly increase the manpow er and paperwork requirements to ensure compliance; an estimate of cost which has not been considered by DHS. Frankly, we see no value what

- so

- ever in requiring advance notice ; particularly when all persons requesting access to our sites
, even those tha t show

- up unannounced

, are now properly vetted prior to entry and their movements closely controlled and monitored while on site

. DHS should not impose a 48

- hour advance notice requirement on regulated sites.3 | Page

3. Issue: Third

- Party Submission of PII perm itted. DHS states that e ach facility may identify third

party “individuals” to submit PII data in their behalf. H owever, this is a hollow concessi on to previous industry concerns on this issue since a facility is limited to designat ing only one (1)
submi tter in the CSAT (Chemical Security Assessment Tool)

. T his l imitation of one submitter requires that:

 a company employee be designated to submit data for all e mployees, contractors, visitors, etc., or

 a third

- party be designated to submit data on all the above

, including company employees

.

Comment: With either above option, t he fact that a facility is limited to o ne submitter makes
this an all or nothing proposition. In consideration of our employee’s privacy, we find the idea
of releasing our employee’s PII to a third party for submission to DHS unacceptable. W e strongly recommend that DHS allow facilities to designate multiple submitters who have been screened and designated as “trusted agents.”

We also request that DHS clarify what t hey mean by third

- party “individuals.” Does this mean a single individual must be designated as a submitter, or may a “company” or entity be designated? W e would hope that a third

- party submitter is not limited to a single individual within an organizat ion.

4. Issue : E mergency Responders as Affected Individuals. DHS states “emergency responders at the state or local level that gain unescorted access to restricted areas or critical assets during emergency situations are not affected individuals.”

Comm ent: W hile we agree that exemption of state and local emergency responders is warranted, we are highly concerned that the proposed rule does not exempt responders who

are members of mutual aid organizations and oil spill response organizations (OSROs). The use of mutual aid groups and OSR Os in our industry is essential to the safety of the public as well as our facilities and personnel as they are often the first and primary responders, even before local

or state agencies. W e strongly recommend that DH S identify responders from these organizations as not affected individuals and exempt them from these requirements.

5. Issue: Lack of Notification to Facilities on TSBD matches. DHS states that it “will not routinely notify high

- risk chemical facilities of CFATS Personnel Surety Program vetting results.” R ather, DHS intends to “coordinate with federal law enforcement entities” to investigate and follow

- up.

Comment: While we fully understand and appreciate the confidentiality required in a law
enforcem ent investigation, w e find it incomprehensible that the owner and/or operator of a high

- risk site would not be notified by DHS of a potential threat at the earliest possible moment.
The facility owner and/or operator is the ONLY entity positioned to take immediate and appropriate security measures in response to a TSD B match. W e simply do not understand why4 | Page

DHS would exacerbate a risk by permit ting an individual on the TSD B to remain in a regulated
site for an indeterminate period once DHS has identified them

. It is strongly recommended DHS reconsider this policy and develop a process that provides for the timely notification of both law
enforcement AND a designated facility owner / operator representative if a person to whom a facility has granted access is identified on the TSBD.

6. Issue: Submission of PII Changes Required

. DHS proposes to require regulated sites to re

submit PII when an affe cted individual’s PII changes.

Comment: W e do not believe that DHS has considered the burden this requiremen t will place

on regulated sites and we certainly feel they provided an inadequate response in explaining
their justification for such a measure. R e

- submitting PII on company employees w ill be
burdensome but likely could be managed. H owever, tracking PII changes for contractor employees, customers, visitors, etc. is completely unworkable. At present t here are no
processes in place to accomplish this and we do not feel DHS has done an assessment of the manpower or economic burden this would impose.

We also must raise the question as to how DHS proposes to manage the reporting of PII changes

on those individuals whose jobs require them to access multiple regulated sites over short periods of time (such a courier or commercial delivery driver )

. J ust how many times must changes in PII be reported to DHS, and by how many different sites? W e recommend DHS
eliminate this overly burdensome requirement that adds little value to the facility security

program.

7. Issue: Tracking of Individuals. DHS states “DHS has no intention to and will not track the

movement of affected individuals between and among high

- risk chemical facilities,“ but “the Department will associate an affected individual with the high

- risk chemical facility (or facil i ties)
for which the hig h

- risk chemical facility submitter providing that affected individual’s information into CSAT is responsible.”

Comment: I ndustry has long

- objected to DHS’ earlier statements in industry meetings that the
PSP program might be used to facilitate the track ing of individuals from site to site and DHS, in

response to industry concerns, has stated they no longer intend to use the PSP in this manner. However, in the recent Chemical Security Summit held in Baltimore, MD during the week of July 5, a DHS official was overheard by several industry representatives stating that DHS does now intend to track individuals via the PSP. This comment, along with the ambiguous statement that
DHS “will associate an affected individual with the high

- risk chemical facility (or facilities)” suggests that DHS may be less than transparent with industry in its intended use of the PSP.

Consequently, while DHS states in this notice that tracking of individuals is not in scope for the PSP, we wish to go on record that we have stro ng objection to the use of the PSP in this manner5 | Page

and believe doing so far exceeds the DHS ’ authority and their stated goal of identifying persons on the TSDB.

8. Issue: E stimate of Burden. Based on the information provided in the notice, DHS has signifi cantly underestimated the cost burden on industry.

Comment: T he estimate of the cost burden provided in the ICR ($17.7 million annualized over three years) is based only on the estimated population of employees and contractors that will
be impacted. T hi s estimate does not include a number of relevant factors including, but not limited to, the large numbers of vendors, visitors, delivery/service personnel, or corporate support staff who will be required to access the sites repeatedly during a given year. Additionally the estimate does not consider turnover of affected personnel or the administrative costs associated with developing and maintaining the systems necessary to manage a PSP.

We refer DHS to the American Chemistry Council’s (ACC’s) “Updated Cost Burden Estimate for
DHS Personnel Surety Program ”

, dated July 2011, and submitted with their comments regarding
this notice. We fully support ACC’s estimate that the burden is closer to $29.7 million dollars,

up $12 million dollars from DHS’ April 2 010 estimate.

As a final and over

- arching comment we would like to express our concern that DHS is attempting to implement a PSP by issuing these requirements in the form of an Information Collection Request (I CR )

. We believe i mplementing regulatory re quirements via the use of an ICR is improper as it does not guarantee all of the process protections available under notice and comment rulemaking pursuant to the Administrative Procedures Act (APA). Additionally, it sets a disturbing precedent and goes to the heart of transparency , or lack thereof, with industry.

We are also concerned that in the three (3) previous Federal Register notices DHS has failed to invite
affected parties submit comments directly to the Office of Management and Budget (OMB) thereby by

passing the important review normally performed by OMB

.

Shell Oil Company would like to reiterate that we fully support DHS’s efforts to implement a PSP. However, like DHS our in dustry has limited resources. I t is essential for both of us to allocate our

resources wisely based on the risks we face, and to ensure the security programs we implement are done so in the most effective manner possible.

In closing, w e implore DHS to reevaluate this proposal in light of the comments we have made herein , as well as the comm ents provided by the many other stakeholders who have a vested interest in making
the PSP program work right the first time.

We also request DHS’ honor its previous commitment to conduct a pilot program that would allow the testing of these requirements before the program is rolled out. I t will be far easier to make program changes in a pilot program conducted before the final rules are set, than to change requirements after.6 | Page

Thank you for your consideration and the opportunity to comment.

Sincerely, 

# Robert F. Ream

Robert F. Ream Regional Security Manager , AmericasJUL-21-2011 11:51



### loannis Constantinides

177 Wyoming Woods Lane, Wyoming, Ohio 45215

July 

### 9, 2011

Mary Ellen Callahan, Chief Privacy Officer
Department of Homeland Security Washington, DC 20528

Dear Ms. Callahan,

Ref: Comments on Docket No DHS-2011- 0033 Related to Chemical Facility Anti-T\2rrorism Standards Personnel Surety Program

I am glad to provide comments on the proposed rule by the Department of Homeland Security on ·Chemical Facility Anti-Terrorism Standards Personnel Surety Program, Docket No DHS-2011-0033"1,2 and I greatly appreciate the opportunity hoping that my comments will improve the proposed rule further. P.002



### I strongly support the 

### efforts of DHS to improve security of high-risk chemical facilities against terrorist acts. Creation and maintenance of reduced risk environments via a proactive mindset should be one of our most important goals and a critical element 

## to the continuing success of the chemical industry. 3 

### I agree that an effective and efficient system must be established in order to

_ . __ ,, ____ , __ pe,rformte.n:orist ba,*ground chE\CksOofacility:.personnel as wen.unescorted visitors with access to restricted areas or critical assets of each facility. It would be disastrous to allow individuals with known terrorist ties to approach high.risk chemical facilities and restricted areas of critical assets. However, I have a few

concerns about the proposed rule, which focus on three areas:

'. 76 FR §114 (2011).

2, Authorized by Department of Homeland Security Appropriation Act, Pub. I.. No. 1()9..295, §550 (2007).

" J.S. Arendt, "Quantitative Risk ASsessment in the Chemical Pro<::e$$lndu$lty", Reliability Engineering & System Safety 1990. 29(1), 133-149.

1JUL-21-2011 11:52 P.003

""""''''-,-,**-'''~.'''' -~-**  .. :",
.,. 

### (a) The cumbersome and potentially time-consuming proposed procedure in obtaining personnel clearance.
(b) The wide scope of 

### the information required for continuous updates.
(c) The duplication that will result from the rule and previous administrative rules having similar objectives.

I will separately discuss these three areas below.

a. Process of l!litiation of Backgroynd Checks and Personnel Clearance

·····One-of

## th~~Ostcritic;at'~lem~n-;:that-e;abi~ the US chemical industry to survive international competition and thrive in the global market is its 

### ability to deliver products of superior quality and performance with the lowest possible environmental risk and maximum efficiency.4 Maximum utilization of capital equipment and Just·in- Time inventories are indispensible for the industry. 5 

### The management systems that are used for the supply chains, manufacturing and product delivery are sophisticated and complex and they are based on long experience, continuous improvement and expertise. Even modest delays in the personnel security clearing system may cause severe inefficiencies of the operations and may jeopardize the global viability of the industry. My concern is that the DHS proposed procedure of obtaining personnel and visitor clearance, consisting of multiple steps 1 

### (outlined below) and involving multiple government agencies, will be unrealistically time consuming. In addition, it will cause undesirable loss of effiCiency and well-needed flexibility to chemical production facilities.



## 1. Submission of information by chemical facilities to Department of Homeland Security (DHS)/National Protection and Program Directorate (NPPD) via the "Chemical Security Assessment Tool" (CSAT), an online data collection

..**·--··-----"PortaI:'Theinformation-isrelated10facititrp'ersdnn~r(** 

### or'unesccirted Visifors),-'

- -.-- _. . who have or are seeking access to restricted areas of critical assets. A new submission is required for additional, updated, or corrected information about the affected individual and also for individuals whose information was submitted earlier, but no longer seek access to the facility's restricted area or critical assets.

'. A.J Hoffman. "ln$tiMlonal Evolution and Change: EnVironmentalism and the US Chemical Industry" • Academy of Management J. 1999,42(4),351-371.

o. A.F. Ab\l-AI, 

## e. Ghorashl, • Applications of Just-In-11me Principles to the Chemical Industry'. Technology lind InnOlllltion Conference PICMET. 1999. p. 371-372.

2JUL-21-2011 11:52



### 2. DHS will send a verification of receipt to the submitter (for each case mentioned above).



### 3. A copy of the submission will be sent by DHS/NPPD to DHSrrSA (Transportation Security Administration), which owns the Terrorist Screening Database (TSDB). P.004



### 4. DHSrrSA will compare the information submitted to information existing in TSDB and forward potential matches to Department 

### of Justice (DOJ) I 

### Federal Bureau of Investigation 

### (FBI) 

### I Terrorist Screening Center (TSC) for final determination and communicates back to the appropriate parties

. 

### .5_,

... --.DI:mJs

.. 

### authotized'.to,CO.Mu.ct.tarnion:u::lataaccuracy reviews and 

### audits

as part of this program.

I am not particularly concerned with potential violations of privacy protection issues related to this program. This is because the 

### information exchanges either comply with the Privacy Act or follow the corresponding lawful and reasonable exemptions provided in this case by the corresponding Department of Homeland Security Appropriation Act of 2007. 2 

### However, I believe that the process to be established by the proposed rule is very cumbersome and time consuming for the parties. It can be easily and significantly simplified without compromising its effectiveness for identifying individuals who represent risks for the critical areas of chemical facilities.

Most probably there will be thousands of requests for personnel clearance every month including new facility personnel and visitors that will perform aU kind of 

### functions in the critical areas of chemical facilities such as operators, truck drivers, maintenance workers, engineers, etc. From the thousands of requests for personnel clearance, only a few, if any, will require particular attention by the administrative authorities. For the great majority of the cases, a simplified routine

... _ __,, ___**!I>.[P.Q!!.s.sJ;;f:!JJb.e._establi$be(l._w.bl!r.eJhe~Clearaoce,** 

### cao.be,achie.veci,aJroost ". ..-,-
.. ----
.. , •. 

### instantaneous. Provided that the information supplied by the chemical facilities to the government is dependable, because its quality is assured by the establishment of random audits, and also assuming the accuracy of the Terrorist Screening Database, there is no need 

### to have multiple contacts agencies handling the clearance. The chemical facility can submit personnel data directly to the DHSlTSA, which maintains the TSDB. It would be most efficient if the appropriate chemical facilities had limited but direct secure internet access to the database itself in order to receive instant and automatic response of positive or negative match of personnel information with the contents of the database. This will eliminate all the steps described by the proposed rule and the corresponding costs associated with the process, including the productivity losses of the chemical facility by waiting for clearance, Only in the case of positive risk

3JUL-21-2011 11:53



### identification will the request then be elevated to government personnel from TSA, FBI, or other organization within DHS or DOJ. P.005



### Appropriate rules 

### of access and routine monitoring of the use of the Terrorist Screening Database by govemment personnel can assure that the system is 

### not abused by the private organizations in order to extract confidential information. 

### If the only database access that the chemical facilities have is the occasional checking of new personnel, the integrity and confidentiality of the database is assured. 

### If, for any unlawful reason, a person attempts to collect more extensive unneeded information that is present in the database by unusually numerous requests, the TSA monitoring personnel will be able to identify this activity and the person who violated the access rules.

., .. ,_ ..• "'_""" A!te(l)l'Itiv:#y,lhe .chemicalJaciljty:. 

### can.seod. the. 

### relevant personnel i 

### information for clearance not to DHSINPPD but directly to TSA who handles the Terrorist Screening Database. The government employee who handles TD8 can then respond within minutes to the request providing clearance or, on rare occasions, elevate the inquiry to FBI personnel. Although less efficient than the process that allows database access to chemical facilities (see above), this procedure dramatically reduces cost and investigation time,important elements for the efficient function of government agencies and chemical facilities alike. More importantly, the personnel clearance process is as effective as the one proposed 

### by the DHS rule and the security 

### of critical facilities is not compromised.

b. SCOM of Reg,uested Information b,y!he Government Ag.encies The Objective of the program, the details of which are proposed by thiS rule is to conduct background checks against the corresponding Terrorist Screening Database for personnel that will access the regulated facilities. However, the process for each clearance is not completed after the government agenCies provide the clearance. The process also includes updating of the information for each person even after the clearance is obtained. In addition, the chemical facilities are required to 

### notify to DHS the individuals that no longer need access to the facility's restricted areas or critical assets

.

. ',--.....-,

.... _',-"'",........,



### .... "

......... 

# -,,----'

.. ., ....... ,.... 

### .. ,,_ 

## ..**'.~"** ,,,.,,".-

............ 

# --_

............... '

.......... '"

.......**~~.-.,., ~**  .. ,.,,',',

.....**,.~".'''.--** ....... , .. 

# _ .... ,

.. , 

# ---

... -,---.,-,,"


### I believe that the objective of the proposed rule and the corresponding statute is achieved by the initial investigation process in cases where the government assessed that the individual represents no security risk. Continuous update of the information as described above does not provide any value towards the expressed objectives of the program. Thus, updating 

### of the information by the chemical facilities and sending of Verification letters by DHS does not serve any significant purpose. Given the expected high volume of request for clearance that 

### will burden both the chemical facilities and the government agencies, such low value updating requirements can be eliminated without compromising facility and national security.

4JUL-21-2011 11:53 P.006



### The above argument is further supported by the fact that the typical visitors of a chemical facility are truck drivers and other outside contractors, who are not part of the permanent personnel of the facility and who also visit multiple chemical sites frequently. It is not easy or even realistic for the management of any facility to continuously follow the information 

### of these individuals, especially the ones who no longer have access to the facility. The rule as proposed by the agency will require multiple additions and removals of the same individuals from multiple sites each month, creating significant extra reporting work for the chemical facilities and duplicative screening and recording work for the agencies without the addition of much value in extra security against terrorism.

Based on the above, I suggest limiting the reporting and screening work only to initial request for authorization and eliminating requirements for updates of "''':_''**~.""' .persp~l)pformation**  

### aru:i.J:emo.vsls. '."_'

c. EliminatiQn 

### 2f DUBlicalive Credentials

The proposed rule establishes a process for performing background checks for individuals who have or seek access to high-risk chemical facilities and critical assets. Only the individuals who receive clearance by the Department of Homeland Security can get access to these facilities. One of my concerns is the potential for duplicate of requests by the facilities as well as background checks by the Department of Homeland Security and other government agencies required by various administrative rules. More specifically, there are numerous regulations that require screening of various individuals against the terroristwatch list. My investigation indicated that it is possible to eliminate a great deal of duplicate work with a simple coordination effort between the different agencies and also between regulatory rules.

Various existing regulations require background checks for various individuals which 

## are equivalent 

## to the background checks proposed by the ct:lrrent rule:**·--·----""-·~TransportatlcinWorkers1crei1tifica'trorrC-redeiitralsFWIC)'~involVes'fr'iJCk** 

### "'. -.,."-,

..**-~.--,­** 

### drivers and maritime and port workers with access to vessels and maritime facilities. 6



### 2. Hazardous Materials Endorsement (HME) • involves individuals who transport hazardous materials. 7

". 72 FR 3492 (2007).

7. 89 F'R 68720 (2004)



### 5JUL-21-2011 11:64



### 3. Explosive License

- involves individuals who seek to obtain explosives license. P.OO?



### These categories involve hundreds of thousands of individuals who have already obtained credentials, many of them by the TSA of DHS. It is also highly probable that the same individuals, such as tl'1Jck drivers, who already possess TWIC and/or 

### HME credentials, 

### will be required to be 

### cleared against the terrorist watch list by the same agency (TSA) in order to have access 

## to high-risk chemical facilities (as part 

### of the current proposed regulation). This is a duplication of a lot of work by chemical facilities and agencies incurring extra costs and burden without providing any additional value to national security. I suggest that TWIC, HME, explOSive and Firearm credential can be used as substitutes 

### for a new

___'._ •• -.h

,_ ........**··baCk9~ound** 

### check-requireme.nt- fOr,the 

### proposed -rule, -preserving-cost 

### and

resources.
Again, t appreciate the opportunity to provide comments on your Department about the proposed rule. Please free to 

### contact me if 

### you would like to discuss any relevant details.

Sinperely

### ~ours,.. 

## I, •

# I,,~s. 

# C-.f

..........**11'-~** toannis Constantinides, Ph.D. Chemist

. ",



### ..**~',-,** 

## .-,

..**,,,--.~----" ,~-,.,,,,,.,,.,,**  

### .. , 

### .. ,'

... '

. , .• "**-"~'-""** .... ,,-,
.................**~** 

### . ...:

... 

# ---

8. 27 CFR 555 (2003)

6

TOTAL P.007