Source: https://chemical-facility-security-news.blogspot.com/2013/
Timestamp: 2019-04-24 08:16:58+00:00

Document:
2013 as the Committee plans on meeting the week of January 8th to formulate a rule for the floor consideration of that bill. While this bill mainly concerns administrative amendments to the RCRA and CERCLA rules an amendment was made during the approval of this bill by the House Energy and Commerce Committee that would add specific State reporting requirements to some facilities covered by the CFATS regulations.
Actually the terminology used in §6 is not quite accurate; it should read “… listed as having a Release Flammable, or Release Explosive, Security Issue in Appendix A…..”. It is clear from the language in §6 that the Theft EXP/IEDP Security Issue materials are not included in the language ‘or explosive’ since they are not themselves explosive, just precursors to making explosives or improvised explosives.
Since Waxman’s comments in the Dissenting Views section of the Committee Report (pgs 20-21) specifically refer to the ammonium nitrate explosion at the West Fertilizer facility in Texas, one would might assume that the ammonium nitrate stored at the facility would have been covered by this Section, but since that was fertilizer grade material it was not covered under the Release Explosive category [Defined as: Ammonium nitrate, (with more than 0.2 percent combustible substances, including any organic substance calculated as carbon, to the exclusion of any other added substance)] in Appendix A.
It would have been covered under the Theft EXP/IEDP as it is a precursor chemical to making explosive grade ammonium nitrate [Defined as Ammonium nitrate, solid (nitrogen concentration of 23% nitrogen or greater)]. So, under the requirement proposed here the West Fertilizer facility would not have had any obligation to report their ammonium nitrate to the Texas emergency response commission.
It is also not clear why Waxman failed to include chemicals with a Release Toxic Security Issue in this notification requirement; the possible effected area/population may be quite a bit larger for some of the toxic chemicals than for the flammable or explosive release chemicals.
The wording of this section would apply to many more facilities than just those covered by the CFATS program. Many facilities with more than a screening amount of the chemicals listed in Appendix A (DHS chemicals of interest, COI) are not covered by CFATS because the DHS Infrastructure Security Compliance Division (ISCD) determines, after reviewing their Top Screen data submission, that they are not at high-risk of terrorist attack and thus not covered by CFATS.
The requirement of §6 would also apply to facilities specifically exempted by Congress from coverage under the CFATS regulation. This would include water and waste water treatment plants, MTSA covered facilities, nuclear facilities regulated by NRC and DOD facilities.
There is an even more basic problem with this reporting requirement; it is added to a bill that most facilities would never hear about. This largest portion of this bill is addressed to actions to be taken by the EPA in establishing regulations. This is the only portion of the bill that applies directly to the private sector. Thus, a very large proportion of the facilities that would be required to take actions based upon this bill would never know of the requirement.
Moreover, there is no way that anyone in the Federal government would know if a covered facility made the required reports as the reports are to be made to unnamed State agencies with no feed back to the regulatory agencies at the Federal level who might (or might not) be aware of the existence of the covered chemicals.
This is one of those congressional requirements that are made without thought as a knee jerk reaction to a real problem. In this case it does not even come close to addressing the issue it was made in response to as the chemical in question does not meet the definition of the chemical hazard referred to in the bill.
Congressman Waxman almost certainly realizes that this section was added in contravention of House rules prohibiting unrelated information being included in a bill. He should also be aware of the problems with the ammonium nitrate definition as he has been involved with the CFATS business almost since its inception well before the 2006 addition of the §550 authorization to the Homeland Security spending bill.
The only thing that I can conclude is that Waxman is taking the easy way out and pushing a completely ineffective requirement because it is easy to get passed rather than trying to do something effective and complex in dealing with the way that the EPA and OSHA deal with explosive chemicals. And that is one of the reasons that we are in the chemical dilemma that we are currently facing, no one in Congress is willing to do the hard work to get real chemical safety legislation passed.
NOTE: The actual bill that the House Rules Committee will be considering is a mash up of three separate bills reported by the House Energy and Commerce Committee; HR 2279, HR 2226 and HR 2318. The §6 language discussed above will actually be in §106 of the new version of HR 2279.
Here on the last day of 2013 it is appropriate to look back at the cybersecurity accomplishments of the 113th Congress. The table below shows all of the cybersecurity bills that were introduced this year. The links to the bills and dates refer to my blog posts. While the House has passed a number of bills the Senate has only passed two; both were spending related bills that contained some cybersecurity measures.
Late this afternoon a grain train passing a crude oil train apparently derailed with some of the cars hitting the some of the passing crude cars. News reports (here, here and here) note that the resulting fire and explosions occurred outside of the town of Casselton, ND. There are no reports of injuries or other structures being involved in the fire.
The accident occurred about two miles west of a large ethanol production facility, Tharaldson Ethanol, that includes a massive rail loading facility that reportedly handles 153 million gallons of ethanol annually. The rail facility handles both grain trains delivering corn for the distillation process and ethanol heading to fuel blending facilities.
The combination of the North Dakota oil fields and ethanol production facilities like Tharaldson ensure that a large number of trains carrying hazardous materials transit towns like Casselton on an almost daily basis.
This is the last in a series of posts about public comments submitted in response to the publication of the NIST Preliminary Cybersecurity Framework (PCSF). The earlier posts are listed below.
There were no new comments posted to the PCSF comment web site this week. I suspect that this means that all of the comments that were received in time (or even reasonably close to ‘in time’) have been posted. With the short time frame that NIST has in publishing the CSF I would not blame them for refusing to accept any additional comments.
I am still surprised by the relative lack of comments from the standard corporate commenters, especially from the chemical community. The ACC (part 1 and part 2) and Merc (part 1 and part 2) were the only two chemical commenters. This is kind of surprising because the chemical industry (under CFATS) and the pharmaceutical industry have some of the highest potential of seeing the CSF merged into current regulatory frameworks under EO 13636 §8(b).
The DOD Defense Advanced Research Projects Agency (DARPA) published a notice in Monday’s Federal Register (78 FR 79411-79412; available on-line Saturday) announcing a competition under the America Competes Act (15 USC 3719). The purpose of the DARPA Cyber Grand Challenge (CGE) competition is to develop autonomous cyber-defense systems that will automate the detection of novel program flaws in networked systems and to then automatically formulate and deploy effective defenses for those flaws.
There would be two tracks in the competition; a Proposal Track and an Open Entry Track. Organizations may submit a research proposal based upon a Broad Agency Announcement issued last month. Or teams may compete under a less structured and unfunded open entry track.
Competitors from the open track will eligible for prizes for winning CGE Qualifying Events (CQE; $750,00) and teams from either track in the CGE Final Event (CFE) will be eligible for prizes ($2 Million, $1 Million and $750,000 for 1st, 2nd and 3rd place respectively).
• Autonomous Analysis: The automated comprehension of computer software (e.g., CBs) provided through a Competition Framework.
• Autonomous Patching: The automatic patching of security flaws in CBs provided through a Competition Framework.
• Autonomous Vulnerability Scanning: The ability to construct input which when transmitted over a network provides proof of the existence of flaws in CBs operated by competitors. These inputs shall be regarded as Proofs of Vulnerability.
• Autonomous Service Resiliency: The ability to maintain the availability and intended function of CBs provided through a Competition Framework.
The CQE are currently scheduled to be held on June 3, 2015. This will be preceded by two scored events that will not be counted in the CQE evaluations. Those practice events will be held on December 2nd, 2014 and April 6th, 2015.
The final CFE will include evaluations of the same AoE and a combined Autonomous Network Defense; the ability to discover and mitigate security flaws in CBs from the vantage point of a network security device. The CFE will be held on July 17th, 2016.
More information on registration and the competition is available on the CGE web site.
Today the Chemical Safety and Hazard Investigation Board published two public meeting notices in the Federal Register for meetings to review and approve the reports on two separate refinery accident investigations; a January 15th meeting (78 FR 78811-78812) on the 2012 Chevron refinery fire in Richmond, CA, and a January 30th meeting (78 FR 78810-78811) on the 2010 Tesoro refinery fire in Anacortes, WA.
I briefly mentioned in an earlier blog post that copy of the staff draft ‘Regulatory Report’ [Download Link] has been published for public comments. California is one of the States that has been cleared to enforce OSHA standards so this regulatory change, if adopted, would in effect be the OSHA refinery standard for the most populous State in the country. This means that this report will attract a great deal of attention as this could become a test bed for higher safety standards for the chemical process industry across the whole country.
The proposed safety case regulations would differ from the current PSM standards in two significant ways. First they would require the preparation of “a written ‘safety case report’—how major hazards are to be controlled and risks reduced to ‘as low as reasonably practicable,’ or ALARP”. On the enforcement side the report is “rigorously reviewed, audited, and enforced by highly trained regulatory inspectors, whose technical training and experience are on par with the personnel employed by the companies they oversee”.
As I noted in my earlier post the CSB is soliciting public input on the draft report. In addition, there will be an opportunity for public comments at the January 15th meeting before the Board votes on the acceptance of the staff recommendations.
The Anacortes meeting will review the staff draft of the final report and recommendations based upon the investigation of the fatal accident that killed seven employees at the refinery. An advance copy of the staff recommendations has not yet been made available. A 2011 CSB safety message (see Press Release and Video) on the need for preventive maintenance was based upon the investigation of this incident.
Again, the CSB is soliciting public comments at this meeting and will also accept written comments.
The DOT’s Intelligent Transportation System Joint Program Office (ITS JPO) published a meeting notice in today’s Federal Register (78 FR 78467) concerning a public meeting on January 16th, 2014, to address the needs for guidelines, tools, resources, and policies that will support the successful implementation and operations of connected vehicle technologies.
The meeting is open to the public and DOT will web cast this meeting. Participants are encouraged to register in advance for participation at this meeting (either in person or via the webinar) at the following web site: http://www.itsa.org/policy2014. More information can be found at the meeting web site.
There is no specific mention of cybersecurity measures to be addressed at this meeting, but that is certainly one of the areas that this program will have to address.
The Pipeline and Hazardous Material Safety Administration (PHMSA) published a notice in today’s Federal Register (78 FR 78506) announcing a public meeting of the Research and Development Forum on January 17th, 2014. The meeting will address recently completed, in process and possible future research programs related to hazardous material transportation safety issues.
This is a public meeting and people wishing to attend are encouraged to pre-register via email (tanika.dyson.ctr@dot.gov). There is no indication that this meeting will be webcast.
PHMSA is soliciting public input on the topics listed above. There is no mention in the notice about the possibility of making oral presentations at the meeting. Written comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # PHMSA-2013-0261; NOTE: That docket was not active as of 8:30 am on 12-26-13). There is no comment closing date provided in the notice.
As the sixth year of the Obama Administration quickly approaches, the White House has issued two high-level homeland security policy document that are designed to shape future of programs of the Federal Government. These two documents (in order of release) are the National Strategy for Information Sharing and Safeguarding (NSISS) and the National Infrastructure Protection Plan (NIPP). Neither of these documents has any specific regulatory force, yet they are both intended to help shape the direction of a wide range of regulatory programs within the Federal government.
This strategy is designed to address the conflicts in the twin nature of information. First information must be shared to have any effect on the real world and second information shared is likely to be released to someone who should not get the information. Finding the proper balance between these two aspects of information policy is never easy.
• Drive Collective Action through Collaboration and Accountability.
• Improve Information Discovery and Access through Common Standards.
• Optimize Mission Effectiveness through Shared Services and Interoperability.
• Strengthen Information Safeguarding through Structural Reform, Policy, and Technical Solutions.
• Protect Privacy, Civil Rights, and Civil Liberties through Consistency and Compliance.
• Align information sharing and safeguarding governance to foster better decisionmaking, performance, accountability, and implementation of the Strategy’s goals.
across Federal networks and security domains.
• Implement removable media policies, processes and controls; provide timely audit capabilities of assets, vulnerabilities, and threats; establish programs, processes and techniques to deter, detect and disrupt insider threats; and share the management of risks, to enhance unclassified and classified information safeguarding efforts.
The 2013 NIPP is an update of the 2009 document that I found negatively stimulating. The newer document reads better, but it still doesn’t really say much.
Vision Statement - A Nation in which physical and cyber critical infrastructure remain secure and resilient, with vulnerabilities reduced, consequences minimized, threats identified and disrupted, and response and recovery hastened.
Mission Statement – Strengthen the security and resilience of the Nation’s critical infrastructure by managing physical and cyber risks through the collaborative and integrated efforts of the critical infrastructure community.
• Promote learning and adaptation during and after exercises and incidents.
Interestingly there is a wide degree of overlap between the middle three categories that is not mentioned in the NIPP discussion. There is, however, one interesting risk that is tossed off at the end of this discussion that is then promptly ignored in the rest of the document; “vulnerabilities may exist as a result of a retiring workforce or lack of skilled labor”. Add in ‘reductions in force’ and you have an interesting topic for a whole series of discussions.
• Risk should be identified and managed in a coordinated and comprehensive way across the critical infrastructure community to enable the effective allocation of security and resilience resources.
• Understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience.
• Gaining knowledge of infrastructure risk and interdependencies requires information sharing across the critical infrastructure community.
• The partnership approach to critical infrastructure security and resilience recognizes the unique perspectives and comparative advantages of the diverse critical infrastructure community.
• Regional and SLTT partnerships are crucial to developing shared perspectives on gaps and actions to improve critical infrastructure security and resilience.
• Infrastructure critical to the United States transcends national boundaries, requiring cross-border collaboration, mutual assistance, and other cooperative agreements.
• Security and resilience should be considered during the design of assets, systems, and networks.
There is nothing really new or earthshaking here, as one would expect from policy documents issued at the end of the fifth year of an Administration. How much effect this will have on future actions by the Federal government will depend more on who wins control of the Senate next November than how well the Administration writes regulations reflecting these goals in the next two years.
Just some more things that I did not get a chance to address during the week.
While the actual accident came on the 13th early this week brought the announcement that BNSF railroad was offering a reward of $100 Thousand for information about the apparent vandals that released the breaks on a parked train car in Tulsa, OK. The released cars (not a whole train) rolled back onto a mainline track and into an on coming train.
No chemicals (other than 100-gal of diesel fuel) were spilled in this accident and there was no fire. If someone were, however, interested in making a nasty chemical mess, this looks like it might be a way to accomplish the task with the proper selection of either the parked cars or the passing train. The rail community needs to take a close look at this incident and come up with a better way of dealing with parked train security.
TSA recently published two interesting solicitations for security proposals; one for ID authentication and one for monitoring high-risk rail car movements.
In the first the TSA is looking for the development of a “Credential Authentication Technology (CAT) system” that would allow them to verify a wide variety of identity cards. Once TSA vets such technology, it would only be smart to move it security checkpoints at other critical infrastructure locations that have a wide variety of visitors.
In the second TSA is looking for a more timely method of tracking rail security sensitive materials than the current reporting method directed by 49 CFR 1580.103. A technology solution is being looked for instead the current phone reporting method.
The GAO published a report this week on efforts to improve employee morale at DHS. It updates earlier reports from February and September 2012. They note that DHS has put some improvement programs into place, but as we’ve come to expect from these GAO reports, complains that DHS has not included methods to measure and track changes in morale brought about by these efforts.
An interesting, but brief article over at NextGov.com about a provision in NDA passed this week that requires the government to “suppress the trade in cyber tools and infrastructure that are or can be used for criminal, terrorist, or military activities while preserving the ability of governments and the private sector to use such tools for legitimate purposes of self-defense”. An interesting point is made about who will determine if something is a cyber weapon or a legitimate cyber tool. Another point made is if we cannot control physical arms trade which is easier to physically detect and track, how are we going to be able to track software trade?
An interesting article over at Automation.com compares the current ICS cybersecurity situation to the early efforts to legislate chemical safety. While the author tries to make the case that early legislation led to a much improved safety culture, the current chemical safety program problems being addressed by the President’s EO points to problems with trying to legislate safety/security without putting a strong enforcement effort in place to ensure compliance.
The use of such malware against control systems or even just segments of control systems could have devastating effects, particularly if employed against chemical process systems. Even if catastrophic releases were not bad enough, the re-startup of these complex systems would be very difficult.
“There was quite a huge fireball and a river of burning gasoline running down the street."
As I have mentioned a number of times in this blog, a hijacked gasoline tanker placed in the proper place and equipped with an appropriate charge could be quite an effective weapon.
The Chemical Safety Board released a draft ‘Regulatory Report’ [Download Link] as part of its ongoing investigation of the 2012 Cheveron refinery fire in Contra Costa, CA. The Board is recommending that California change the way it regulates chemical safety at refineries (and presumably other high-risk chemical facilities). They are suggesting a change to the European Safety Case Model instead of the current compliance model used by OSHA. The draft was released to solicit public comments on the suggestion. This report is particularly important because of the OSHA RFI concerning potential changes to the Process Safety Management (PSM) program.
It has been over a month now since I wrote anything on President Obama’s Chemical Safety and Security Executive Order (EO 13650) and that has mainly been because, beyond some listening sessions and the OSHA RFI, there does not seem to be much movement on the EO. Then Friday the beneficent information sharing gods showered me with three separate emails providing updated information on the topic; one from the American Chemistry Council, and two from the Executive Order 13650 Working Group.
Scott Jenson, the Issues Communications Director from the ACC, sent me a link to their recent blog post on the EO. It provides a very nice summary of the events leading to the EO and the actions that apparently have been taken since. There is a great deal of support for the EO by the ACC (and most folks in the chemical industry) and that is reiterated in this blog post.
The only negative comments here are saved for the suggestions that the EO should serve as a vehicle for instituting federal requirements for implementing inherently safer technology mandates. This is a long standing ACC position, shared by most chemical companies. The post does provide a brief summary of the arguments against an IST mandate.
To date I have seen nothing that indicates that the Working Group is considering such a requirement, but it has certainly been something that has been discussed in the listening sessions as if the WG had such a proposal in the drafting phase.
The second email I received Friday was from the Working Group (via their eo.chemical@hq.dhs.gov email address) and it concerned the listening sessions scheduled for next month. These sessions are all in-person public meetings with a listen-only telepresence capability. The dates/times and locations are listed in the table below.
All advance registrations are being handled by GovEvents.com; links are provided in the table. The linked in-person registration pages provide good details about the venue location along with a link to a Google Map to the location. There is also information about how to go about registering to provide a 5 minute presentation.
As always, written comments may be submitted to the working group, either via the Federal eRulemaking Portal (www.Regulations.gov; Docket # DHS-2013-0075) or by email to the Working Group.
A brief note about the use of the GovEvents.com site. It does require registration and it was set up as a service for government employees. There is one point in the registration process that you have to select your affiliation. The default for most people will be ‘government employee/military’ even if you are not affiliated with the government. The owner of the site has assured me that there will be no repercussions for using that designation.
• Establishment of a Working Group web page on the OSHA site (link in the update does not work, they forgot to include “https://”). NOTE: There are also web pages on the EPA site and DHS site; the one on the OSHA site has the most information and the DHS web site is worthless.
• Exploring information sharing initiatives between Federal agencies and ‘vetted members of the SERCs’. Mentions include ATF and CFATS exploring these possibilities. The EPA pilot program ‘Effective Chemical Risk Management Project, Federal Region Two’, that I’ve mentioned before; still no web site for this initiative.
• Continued conversations between OSHS/EPA/ATF and the Chemical Safety Boardto improve coordination and exchange of information during investigations of chemical incidents.
• Sharing of chemical safety/security database information between EPA, OSHA and DHS to aid in compliance checking for the three programs (RMP, PSM, and CFATS). I’ve heard the EPA-DHS database sharing was relatively easy, but they were having problems with the OSHA PSM database; database communications can be tricky.
• Publication of the interim advisory (NOTE: the link in the Update takes you to an EPA page listing a number of chemical safety publications, my link takes you to the document) on storage of ammonium nitrate.
• Publication of the OSHA RFI for updating their chemical safety regulations and guidance that I have already covered.
One small nit-picking point; all of the links in the Update take you away from the Update page without options for opening documents in separate tabs or pages. This seems to be a standard coding practice with many Federal documents and it is unnecessary and annoying.
• The Secretary of Homeland Security, the Secretary of Labor, and the Secretary of Agriculture shall develop a list of potential regulatory and legislative proposals to improve the safe and secure storage, handling, and sale of ammonium nitrate.
• The Administrator of EPA and the Secretary of Labor shall review the chemical hazards covered by the Risk Management Program (RMP) and the Process Safety Management Standard (PSM) and determine if the RMP or PSM can and should be expanded to address additional regulated substances and types of hazards.
• The EPA and the Department of Labor shall develop a plan, including a timeline and resource requirements, to expand, implement, and enforce the RMP and PSM in a manner that addresses the additional regulated substances and types of hazards.
• The Secretary of Homeland Security shall identify a list of chemicals, including poisons and reactive substances, that should be considered for addition to the CFATS Chemicals of Interest list.
• The Secretary of Labor shall identify any changes that need to be made in the retail and commercial grade exemptions in the PSM Standard.
I always maintained that the schedule called for in the EO was more than a little tight. Most of this stuff is complex and deals with coordination between government agencies at multiple levels. There is no way that the initial schedule was going to be met.

References: §6
 §6
 §6
 §550
 §6
 §106
 §8