News & Information:
Current Issues

Top-Screen Submissions for DHS CFATS Rule Due January 2008

The Department of Homeland Security published an Interim Final Rule on Chemical Facility Anti-Terrorism Standards (CFATS) on April 9, 2007 (72 Fed. Reg. 17688). This Rule became effective June 8, 2007. DHS also published a list of "chemicals of interest" along with their screening threshold quantities (found in Appendix A to the rule) and solicited comments on those chemicals.

DHS has now published its final Appendix A, issuing it on November 20, 2007 (72 Fed. Reg. 65396). This Appendix lists the chemicals and quantities that will require affected facilities to complete the DHS "top screen" no later than 60 days from the date of publication, which means that those having in excess of one or more screening threshold quantities (STQ) will have to complete Top-Screen submission by January 22, 2008. Additionally, a facility that comes into possession of a COI above an applicable STQ on some subsequent date must complete and submit a Top-Screen within 60 calendar days of that date.

The Top-Screen Tool

DHS is using a web-based screening tool called "Top-Screen" to determine if a chemical facility is high-risk. DHS has developed an algorithm (not available to the public) that will determine whether a chemical facility having one or more Appendix A chemicals in amounts above the screening thresholds is a "covered facility" that might be subject to other requirements of the IFR.

Top-Screen is part of a secure web-based DHS portal called the "Chemical Security Assessment Tool" or "CSAT." The public CSAT web page, including registration functionality and the Top-Screen Questions and User Manual can be found at: http://www.dhs.gov/xprevprot/programs/gc_1169501486197.shtm. (Note that the Top-Screen documents that were revised in September have not, as of this date, been updated to conform to the final Appendix A.)

The Interim Final Rule applies to chemical facilities that "present high levels of security risk," and DHS has defined "chemical facility" extremely broadly as "any establishment that possesses, or plans to possess, at any relevant point in time, a quantity of a chemical substance determined by [DHS] to be potentially dangerous or that meets other risk-related criteria identified by [DHS]."

The fact that a facility is subject to Top-Screen does not mean that DHS will conclude that it is high-risk. DHS previously estimated that as many as 50,000 facilities will complete Top-Screen, but that only 5,000-8,000 will be deemed covered facilities.

A potentially covered facility can be required to complete Top-Screen in either of two ways. It can notify a facility directly in writing, or through a Federal Register notice, that it is a covered facility. Some chemical facilities have received written notifications since June of this year as part of DHS’s accelerated "Phase 1" program. Most facilities will determine whether they are required to complete Top-Screen through review of the recently-published Appendix A table, which lists some 335 "chemicals of interest" (COI) and sets a "screening threshold quantity" (STQ) for each chemical for each applicable type of hazard scenario or "security issue." In general, if a facility possesses, or expects to possess, an Appendix A chemical at or above one of the STQs, it must complete and submit a Top-Screen.

DHS indicated that it based the "Chemicals of interest" list and their associated quantities on hazards associated with release, theft/diversion, and sabotage/contamination. DHS is considering adding two additional security issues (a critical relationship to a government mission and a critical relationship to national economy), but at this time has not listed any chemicals on this basis alone.

Application of Rule

Security Issues. There are seven security issues, each with one or more STQs. As a result, a given chemical at a facility could be subject to more than one STQ. Each of the various security issues have rules regarding minimum concentrations and mixtures. Following are the basic rules for each issue, although these are subject to several special chemical, use, and location-specific rules and exceptions discussed further below.

Release chemicals. Within this category, there are three kinds of release security issues:

• Release - toxic. These are RMP toxic chemicals that have the potential to create a toxic cloud that would affect populations within and outside the facility if intentionally released. The STQ for these chemicals is the same as the RMP threshold quantity, and range from 500 – 20,000 lbs. DHS also follows the RMP toxics mixture rule: if a mixture contains 1 percent or more of a listed chemical, the facility should count the amount of the chemical present in the mixture toward the STQ.

• Release - flammables. These are RMP flammable chemicals that, if intentionally released, have the potential to create a vapor cloud explosion that would affect populations within and outside the facility. The STQ for these chemicals is the same as the RMP threshold quantity (10,000 lbs). DHS also follows the RMP flammables mixture rule: if a mixture contains one (1) percent or more of a listed chemical and the mixture has an NFPA flammability hazard rating of 4, the facility should count the entire mixture toward the STQ. Mixtures that have NFPA flammability hazard ratings of 1, 2 or 3 do not need to be counted except for gasoline, jet fuel and diesel stored in aboveground tank farms.)

• Release - explosives. These are chemicals that, if intentionally detonated, have the potential to affect populations within and outside the facility. These are Class 1, Division 1.1 explosives listed in the DOT Hazmat regulations, except that DHS did not include (i) chemicals listed in the DOT rules as "NOS" ("not otherwise specified") or (ii) articles or devices listed in the Hazmat rules (e.g., charges, detonators, fuses, motors). The STQ for release-explosive chemicals is 5,000 lbs. As for mixtures, the entire amount of any commercial grade of the substance must be counted.

There are a number of special rules for release chemicals. For example, release chemicals are covered whenever they are contained in a "vessel" (as defined in the RMP rule). This includes reactors, tanks, drums, barrels, cylinders, vats, kettles, pipes, hoses, and other containers. However, a container of a release chemical does not count for Top-Screen purposes while it is "in transportation," including "storage incident to transportation," as those terms are used by EPA under its RMP rule. Transportation status ends when the container is no longer attached to the motive power that delivered it to a facility. Transportation status also does not include containers (including tank trucks) when they are attached to process equipment. Release chemicals are also covered whenever they are contained in explosives storage "magazines," as defined in ATF regulations, or underground storage facilities, both man-made and natural.

Coverage of process intermediates, byproducts and incidentally-produced materials. DHS rejected requests that it explicitly exclude transitory, non-isolated process intermediates. Facilities thus must attempt to quantify release chemicals in such circumstances for Top-Screen purposes. byproducts and incidentally-produced materials are also covered by the rule. However, DHS followed EPA’s RMP rule by excluding quantities of release chemicals that a facility manufactures, processes or uses in a laboratory under the supervision of a "technically qualified individual." This exclusion does not encompass specialty chemical manufacture, pilot-scale operations, or activities (even R&D) conducted outside the laboratory.

Theft/diversion chemicals. There are three theft/diversion security issues. Notably, these chemicals are only covered when contained in a transportation packaging as defined in the DOT Hazmat rules (e.g., cylinders, bulk bags, drums, bottles, cargo tanks, tank cars).

• Theft/diversion - chemical weapons/chemical weapons precursors (CW/CWP) chemicals. Chemicals that are subject to being stolen or diverted and used as or easily converted into chemical weapons. The STQ for these chemicals had been proposed as "any amount," but in the final rule DHS established STQs that are more relevant to the amounts needed to make a weapon. These chemicals, and their associated STQs, include Schedule 1-3 chemicals under the Chemical Weapons Convention (CWC) regulations, which have STQs of 100 grams, 2.2 lbs, and 220 lbs respectively, as well as Triethanolamine hydrochloride.

• Theft/diversion - weapon of mass effect (WME) chemicals. Chemicals that could be stolen or diverted and used directly as a weapon of mass effect. These are the Class 2, Division 2.3, Hazard Zones A-C poison inhalation hazard (PIH) chemicals in the DOT Hazmat regulations, plus germanium tetrafluoride, and minus methyl bromide and "N.O.S." chemicals. The STQs for these chemicals are 15 lbs (Hazard Zone A), 45 lbs (Hazard Zone B, plus hydrogen fluoride), and 500 lbs (Hazard Zone C). DHS has dropped carbon monoxide and other Hazard Zone D PIHs.

• Theft/diversion - explosive/improvised explosive device precursor (EXP/IEDP) chemicals. Chemicals that could be stolen or diverted and used as, or to produce, improvised explosive devices. These are a variety of DOT Class 1 explosives, chemicals listed in a recent National Research Council report, and other chemicals recommended for inclusion by the FBI. Although these include hydrogen peroxide (35 percent or greater conc.), DHS did drop acetone and urea from the final Appendix A. The STQ for these chemicals is 400 lbs. Mixtures are covered by the concentration specified in Appendix A for a chemical (if any), or otherwise if they are a commercial grade of the substance.

Sabotage/Contamination. This category includes chemicals that, if mixed with other readily-available materials, have the potential to create significant adverse consequences for life or health. These are basically chemicals capable of producing a poisonous gas when exposed to water, as derived from the 2004 Emergency Response Guidebook published by the transportation departments of the United States, Canada, and Mexico. The STQ is the amount required to be placarded under DOT’s Hazmat rules, and mixtures are covered by the specified concentration (if any) or otherwise if they are a commercial grade of the substance.

Chemicals receiving special treatment. DHS created special rules for several very common and economically important chemicals:

• Propane. The STQ for propane (a release—flammable chemical) is 60,000 lbs. Tanks containing 10,000 lbs or less do not count toward the threshold.

• Chlorine. Chlorine is subject to two STQs. When it is contained in transportation packaging (i.e., when it is a theft/diversion-WME chemical), the STQ is 500 lbs (with a minimum concentration level of 9.77 percent). In all other cases (i.e., when it is a release-toxic chemical), the STQ is 2,500 lbs, subject to the one (1) percent RMP toxic mixture rule outlined above.

• Ammonium nitrate. In cases where AN meets the definition of a Div. 1.1 explosive, it has two STQs: 400 lbs when in transportation packaging (i.e., when it is a theft/diversion-EXP/IEDP chemical), and 5,000 lbs otherwise (when it is a release—explosive chemical). AN that does not meet the Div. 1.1 definition, but which is at least 23 percent or greater nitrogen, is subject to an STQ of 2,000 lbs (because it is regarded as a theft/diversion-EXP/IEDP chemical). Mixtures of AN are covered at 33 percent or greater AN.

• Hydrogen fluoride/hydrofluoric acid. HF is a covered chemical when in transportation packaging in quantities of 15 lbs or more (45.53 percent min. conc.), and otherwise at 1,000 lbs (min. conc. 1 percent). The STQ for hydrofluoric acid is 1,000 lbs (50 percent min. conc.).

Generic exclusions. DHS has excluded from consideration chemicals of interest that are used as structural components or as products for routine janitorial maintenance, contained in food, drugs, cosmetics or other personal items used by employees, contained in process or non-contact cooling water or compressed or combustion air, or that are contained in articles, as defined in the RMP rule. It also excludes those chemicals in solid wastes, including hazardous wastes, which are regulated under RCRA. However, notwithstanding the RCRA exclusion, facilities must count chemicals of interest that meet the 40 C.F.R. § 261.33. definition of discarded commercial chemical products, off-specification species, and container and spill residues.

Security Vulnerability Assessments

Facilities whose Top-Screen results meet certain DHS criteria for "high-risk" will be provisionally assigned to one of four risk-based tiers, with Tier 1 being the highest risk. DHS expects that it will make high-risk determinations within 60 days. The criteria for making high-risk determinations and tier assignments are considered to be "sensitive anti-terrorism information" and will be protected from disclosure. DHS says it will not use RMP analysis to determine casualty estimates and consequence ranking, so a facility’s inclusion in that program will not determine whether they fall into one of the "high risk" categories or not. Facilities that question their "high-risk" status or tier assignment can seek a "consultation" with a DHS "coordinating official."

Facilities in Tiers 1-3 will have 90 days after notification by DHS of high-risk status to complete and submit a site vulnerability assessment (SVA) using the electronic CSAT tool.

Tier 4 sites must also complete an SVA, but may use another DHS-approved vulnerability assessment methodology.

In this regard, although DHS had indicated that it expected 40,000 Top-Screen respondents in the first year, its preliminary estimate of the number of high-risk facilities ranges from 1,500 to 6,500. Accordingly, so members should not assume that merely because they are required to submit these documents, or because they exceed one or more thresholds, that they will be considered "high risk." Again, DHS’s screening criteria are essentially classified, so it is impossible to know at this time whether a company will "screen in" or not.

Site Security Plans

As noted, DHS expects to act on SVA submissions within 60 days. Facilities will have 120 days after notification by DHS of SVA approval to develop a site security plan (SSP) and submit it through CSAT. SSPs must describe how a facility’s security measures address potential modes of terrorist attack, but these modes are not intended to be "design basis threats."

DHS will issue a Letter of Authorization upon its preliminary approval of a plan. After DHS inspectors have visited the facility and found it to be in compliance, DHS will issue the facility a Letter of Approval. If a facility believes it will not be able to fully implement its plan by the inspection date, it can discuss the matter with DHS.

Tiers 1 and 2 must update the Top-Screen, SVA, and SSP every two years. Tiers 3 and 4 are on a three-year review schedule. However, facilities that make modifications that they believe reduce their risk profile have informal and formal opportunities to seek DHS’s agreement. On the other hand, facilities that materially increase their risk profile must resubmit their Top-Screen within 60 days.

Risk-Based Performance Standards

The rule established 19 categories of security performance standards. The standards will be increasingly demanding as a facility moves from Tier 4 to Tier 1. Because these are performance-based standards, facilities will have flexibility to select security measures that satisfy the applicable performance standards and that address the vulnerabilities identified in the SVA. Facilities will identify these in their SSPs. DHS will issue a protected, non-binding guidance document that translates the security performance standards for various tiers into example suites of security measures.

Among other things, the rule will require a facility to implement security measures that will delay an attack "for a sufficient period of time so as to allow appropriate response through on-site security response, barriers and barricades; hardened targets; and well-coordinated response planning."

Although a number of environmental groups and some politicians have been advocating "Inherently Safer Technology" as a primary way to reduce risk, DHS, in making this a "performance standard," had decided against requiring IST (or any other specific measure). However, facilities are free to consider IST options (such as changing formulations or processes) to reduce risk and thus meet a performance standard, move to a lower tier, or stop being "high-risk." However, DHS is precluded from categorizing a facility as no longer being "high-risk," or move it to a lower tier based on IST, if the proposal merely shifts risk off-site or otherwise does not actually reduce risk, or compromises security in some other manner.

DHS headquarters will evaluate whether the security measures contained in an SSP meet the applicable performance standards. DHS field inspectors will then assess whether facilities are implementing the security measures contained in the plan.

Alternative Security Programs

DHS may approve Alternative Security Programs that provide an equivalent level of security as the rule. Tier 1-3 facilities may submit an approved ASP in lieu of an SSP. A Tier 4 facility may submit an approved ASP in lieu of an SVA and SSP. Since DHS has decided not to preempt state programs unless they actively impede the DHS rule, a required state program (such as one in place because of New Jersey requirements) could be approved as an Alternative Security Program. Additionally, since the rule is generally not preemptive, states can choose to regulate facilities even if they screen out of the DHS rule.

Background Check/Personnel Issues

Background checks and identification will be required for all facility employees, as well as for contractors and other visitors who have unescorted access to restricted areas and critical assets at a facility. The facility will be responsible for checking criminal background and immigration status. DHS will check individuals against the Terrorist Screening Database. However, nothing in the rule prohibits a person that has been convicted of a misdemeanor offense from being employed at a high-risk chemical facility.

DHS intends to establish a telephone line through which employees and other individuals can submit security concerns.

Inspections/Enforcement

DHS may choose to notify local emergency responders or other agencies about upcoming inspections on a case by case basis, but does not believe it needs to do so in every case.

DHS may issue a future rulemaking concerning third-party auditors. Until then, DHS will use its own inspectors for conducting inspections.

Information Protection

CFATS provides that information developed pursuant to it must be "given protections from public disclosure consistent with similar information" developed by facilities under the MTSA. What this means in practice is that it must be protected consistent with DHS’s "sensitive security information" (SSI) rules, and, with limited exceptions, information is to be treated as if classified. The CFATS rule establishes a new category of information protection: "chemical-terrorism vulnerability information" ("CVI"). CVI protections became effective on June 8, 2007. They are self-implementing, so that facilities possessing information that meets the definition of CVI must comply with those requirements as of that date.

DHS has issued a CVI "Procedural Manual" which can be found at http://www.dhs.gov/xprevprot/programs/gc_1181835547413.shtm. Under the manual, persons entitled by law to have access to CVI must complete DHS training and sign a restrictive non-disclosure agreement before they can be added to DHS’s list of "authorized users." Additionally, companies must maintain detailed tracking logs of who has had access to what CVI. While DHS may give CVI to state or local officials with a need to know, any state "right to know" or "sunshine" laws that might require or allow those officials to release that information are preempted. The Procedural Manual provides instructions to facilities on how to seek DHS approval before giving information to state or local government officials. DHS has said it intends generally to delegate that approval authority to state homeland security officials.

At this time DHS does not intend to provide a means of notifying the public about local chemical facilities. Informally, DHS’s view is that the fact that a facility is regulated under Section 550 is not CVI, but the tier to which it is assigned is.

Aluminum powder.

DHS added a number of new chemicals, including aluminum (powder), to the final Appendix A, and set the STQ for aluminum powder at 100 pounds instead of 400 pounds, because DHS believed that the effect of these particular chemicals at these quantities would have the same effect as the other theft/diversion-EXP/IEDP chemicals at 400 pounds. Unfortunately, aluminum paste, which is widely used in the coatings industry, has the same CAS number as powder, 7429-90-5, although it does not have the same physical properties as the powdered form. Although NPCA is continuing to seek clarification from DHS on that issue at the time of publication, members may also call the CSAT Helpline at 866-323-2957 from 7:00 a.m. – 7:00 p.m., Eastern Time, Monday-Friday and may also pose questions to DHS through that mechanism.

Members: Contact NPCA's Allen Irish for more information.

Source: January 2007 Coatings, posted 12/7/07