Enactment of the Department of Homeland Security Appropriations Act of 2007 provided the federal government with comprehensive authority to assure the security of our nation’s chemical facilities. See Pub. L. No. 109-295, sec. 550. Section 550 grants the Secretary of the Department of Homeland Security (“Department”) the authority to issue an Interim Final Rule, for those chemical facilities that present high levels of security risk, establishing risk-based performance standards that seek to secure the perimeters of the plants and any potential targets inside; control access to the facility; deter theft; and prevent sabotage. Id. The Department published the rule April 9, 2007 (72 FR 17688), and the provisions of the rule can be found in Part 27 of Title 6 of the Code of Federal Regulations.
In a post-9/11 United States, it is not surprising that Congress has acted to ensure that sufficient security measures are enacted at chemical facilities across the country to protect against the threat of terrorism. Some critics voiced concerns that the rule does not go far enough, while other critics contend that the rule goes too far and sweeps in facilities that pose little or no security risk. Other critics contend that the rule conflicts with state and local government initiatives. Proponents of the rule maintain that the required measures will make the nation safer. This article summarizes the rule’s major provisions and requirements.
A “chemical facility” is any establishment that possesses or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by the Department to be potentially dangerous or that meets other risk-related criteria. Based on information provided by chemical facilities, the government will determine if a facility presents a high level of risk. If so, that facility will be placed in one of four risk-based tiers, with Tier 1 representing facilities with the highest security risk. The higher a risk the facility potentially presents, the more stringent the security measures that are required of the facility.
Through the Chemical Security Assessment Tool (“CSAT”), available on the Department of Homeland Security’s website, facility managers or owners can submit the documentation needed by the Department to determine whether a facility presents a high level of security risk, and if so, to then determine that facility’s placement on the 4-Tier risk structure and whether its vulnerability assessment and security plan meet the federal government’s standards. The CSAT consists of three web-based tools (http://www.dhs.gov/xprevprot/programs/ gc_1169501486197.shtm):
- Consequence screening questionnaire (“Top Screen”)
- Security Vulnerability Assessment (“SVA”)
- Site Security Plan (“SSP”)
Any facility that manufactures, uses, stores, or distributes a chemical listed in proposed Appendix A: Chemicals of Interest at or above the screening threshold quantity (“STQ”) listed must complete the CSAT Top Screen. The Top-Screen asks a series of questions regarding the chemical(s) manufactured, processed, used, stored, or distributed by the facility, in order to determine whether the facility meets the Department’s definition of a “high risk” facility. Facilities that meet this definition will be preliminary placed in one of the four tiers.
Security Vulnerability Assessment Following completion of the Top- Screen, facilities placed in any of Tiers 1-3 will be required to complete a Security Vulnerability Assessment (“SVA”), which identifies facility security vulnerabilities based on specific security concerns, including off-site release, theft or diversion, and sabotage or contamination, and which aids in “the identification of existing countermeasures and their level of effectiveness in both reducing identified vulnerabilities and in meeting the applicable Risk-Based Performance Standards (RBPS).” 6 CFR 27.215(a)(3). Facilities placed in Tier 4 must either complete an SVA or submit an Alternate Security Program (“ASP”) that meets regulatory requirements and provides for an equivalent level of security, as determined by the Department. See 6 CFR 27.235(a).
Site Security Plan
Finally, facilities in any of Tiers 1-4 must develop a Site Security Plan (“SSP”) that will describe security measures (both physical and procedural) in place, as well as the measures a facility plans to implement in order to fulfill the RBPS that apply to them. The Department must review and approve of the SSP to ensure that the plan will satisfy the RBPS. Alternatively, facilities in any of the four tiers may submit an ASP in place of an SSP. As noted above, an ASP must meet all applicable regulatory requirements and provide for an equivalent level of security. Notably, the statute gives the Department the authority to protect from inappropriate public disclosure any information developed pursuant to Section 550, “including vulnerability assessments, site security plans, and other security related information, records, and documents.” See Pub. L. No. 109-295, sec. 550.
Departmental Review of SVAs and SSPs
The Department will review both the SVAs and the SSPs in accordance with sections 27.240 and 27.245, respectively. The Department will either approve the SVA in writing or provide the facility with written notification that highlights the deficiencies in the SVA. If the facility then resubmits an SVA that fails to meet regulatory requirements, the Department will disapprove of the SVA via written notice. The review of the SSP is a two-step process. After reviewing a site’s SSP, the Department will make a preliminary determination as to whether the SSP satisfies regulatory requirements. If the SSP does so, the Department will issue a Letter of Authorization to the facility. The Department will then inspect the facility and issue a Letter of Approval if the Department approves the SSP. If the Department finds that an SSP does not satisfy regulatory requirements either before or after inspection, the Department will provide written notification that explains the deficiencies in the SSP. If the facility then resubmits an SSP that fails to meet regulatory requirements, the Department will disapprove of the SSP via written notice.
Federal Preemption and the Rule’s Risk-Based Performance Standards After entertaining many comments on the subject of preemption, the Department has adopted a conflict preemption approach, thereby committing itself to making case-by-case determinations as to whether a given state’s security requirements are preempted by federal law. With respect to existing state security requirements, the Department states that currently there is no reason to conclude that those requirements are being applied in a way that would conflict with the rule. With respect to state requirements that are developed in the future, the Department has offered to entertain requests for an opinion as to whether a given state’s requirements are preempted.
The rule identifies up to 19 Risk-Based Performance Standards that chemical facilities must satisfy and address in their Site Security Plan. The Department will issue guidance on the application of the standards to risk-based tiers of covered facilities. The performance standards can be categorized into five different broader categories:
- Restricting and Securing
- Deter, Detect and Delay Attacks
- Monitor Storage, Receipt, and Shipping of Chemicals
- Training and Response
- Specific Threats and Vulnerabilities
The first category, Restricting and Securing, addresses physical access to the facility and monitoring the perimeter and grounds of the building. These standards also require facilities to control access through stringent screening of personnel and elevated identification system standards. The Deter, Detect and Delay Attacks category requires facilities to maintain standards that would actively prevent terrorist attacks through visible security measures and systems, including the positioning of professional security personnel, monitoring systems, barriers and barricades, and hardened or reduced-value targets, thus detecting and delaying an attack in order for response measures to take effect.
The third category, Monitor Storage, Receipt, and Shipping of Chemicals, addresses the need for facilities to maintain adequate records and monitor the receipt and storage of hazardous chemicals. Adequate measures must be in place to prevent any loss or theft of such chemicals while simultaneously guarding against insider sabotage, which also leads to the next category of performance standards. The fourth category, Training and Response, requires facilities to create a response plan and organizational team that is in charge of security and also for compliance with the standards. This includes a plan intended to ensure coordination with local law enforcement officials and first responders in case of security incidents and the reporting of such incidents to the Department of Homeland Security.
The final category, Specific Threats and Vulnerabilities, addresses specific threats and vulnerabilities unique to any chemical facility, and the need for the facility to include a solution to them in its SSP.
Orders and Adjudications
“When the Assistant Secretary determines that a facility is in violation of any of the requirements of this Part, the Assistant Secretary may take appropriate action including the issuance of an appropriate Order,” either an Order Assessing Civil Penalty, an Order to Cease Operations, or both. 6 CFR 27.300. At a minimum, Orders must be signed by the Assistant Secretary and include:
- a listing of the provision(s) that the facility is alleged to have violated;
- a statement of facts upon which the alleged instances of noncompliance are based;
- a clear explanation of deficiencies in the facility’s chemical security program, including, if applicable, any deficiencies in the facility’s Security Vulnerability Assessment, Site Security Plan, or both;
- a statement indicating what action(s) the chemical must take to remedy the instance(s) of noncompliance; and
- the date by which the facility must comply with the terms of the Order.
The Civil Penalty may be up to $25,000 for each day during which the violation continues, or, if an Order to Cease Operations is given, the facility would remain shut down until it is found to be in compliance with Part 27.
“Any facility or other person who has received a Finding pursuant to § 27.230(a)(12)(iv), a Determination pursuant to § 27.245(b), or an Order pursuant to § 27.300 is entitled to an adjudication, by a neutral adjudications officer, of any issue of material fact relevant to any administrative action which deprives that person of a cognizable interest in liberty or property.” 6 CFR 27.305. The facility must file a Notice of Application for Review within seven calendar days of notification by the Assistant Secretary if it would like to contest the Assistant Secretary’s Finding, Determination, or Order. An Order is stayed until the Presiding Officer issues an Initial Decision, and the facility must file an Application for Review within 14 calendar days of notification by the Assistant Secretary. A Response from the Assistant Secretary, who bears the initial burden of proof, follows this step, and the proceedings are underway for contesting the issue at hand.
The Presiding Officer reviews the issues of the case and prepares any hearings, in consultation with the parties, if necessary, and finally closes the record upon completion of any testimony, oral arguments, briefs, or summary judgment proceedings. Based on that record, the Officer issues an Initial Decision, and the facility has up to seven calendar days to first issue a Notice of Appeal and up to 28 days to submit supporting documentation if the Initial Decision is not in its favor. The Under Secretary shall then issue a Final Decision, after which the Order, Determination, or Finding is considered final and effective.
Chemical-terrorism Vulnerability Information (“CVI”)
The regulations reserve a section (6 CFR 27.400) for detailing the definitions and procedures for the protection of Chemical-terrorism Vulnerability Information (“CVI”), highlighting the importance of maintaining this information in the strictest confidence within the facility. The section lists the items and information considered as CVI, addresses the issue of what persons have access to CVI (only those with a need to know), and the consequences for disclosure of CVI.
Broad Applicability, Uncertain Effects The inclusion of certain chemicals in proposed Appendix A to the regulation, at the STQs proposed, can be expected to draw in a wide range of facilities from many sectors of the economy. For example, the inclusion of anhydrous ammonia (used as a refrigerant), if present at an STQ of 7,500 lbs.; ammonium nitrate (used as a fertilizer), if present at an STQ of 2,000 lbs.; and propane (used in the poultry industry), if present at an STQ of 7,500 lbs.; will require many facilities at many points in the food manufacturing and distribution system to comply with the regulation. In the absence of exemptions other than those provided by statute, the diversity of facilities in the food industry illustrates the need for judicious use of screening, and for thoughtful implementation of a tiered approach. It is clear that a wide range of food and agricultural facilities will, at a minimum, have to complete a Top Screen. How many of those facilities are required to proceed further is an open question, although, according to the rule, the Department “anticipates that the vast majority of screened facilities will be found not to have a level of potential consequences that would result in a ‘high risk’ designation” (72 FR at 17700). As noted by some stakeholders, a contrary result could threaten to divert scarce resources away from food safety measures of demonstrated value.
The regulations became effective June 8, 2007, but proposed Appendix A had not been finalized at the time of this writing. The Department recently stated via its website that “initial CSAT Top-Screens are due within 60 calendar days of the effective date of a final ‘Appendix A: DHS Chemicals of Interest’ or within 60 calendar days of coming into possession of any such Chemical of Interest at or above the STQ” (see http://www.dhs.gov/xprevprot/programs/ gc_1169501486197.shtm). The Department also has made available on its website the Top Screen questions and a Top Screen user manual. Given the evolving nature of this rulemaking, stakeholders would be well advised to monitor the Department’s website and Federal Register notices for further developments. In all likelihood, the lasting effects of these new regulations will not be seen for months to come.