Senate Report 115-384 - PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT

[Senate Report 115-384]
[From the U.S. Government Publishing Office]

Calendar No. 670
115th Congress } { Report
SENATE
2d Session } { 115-384
_______________________________________________________________________

PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT

__________

R E P O R T

of the

COMMITTEE ON HOMELAND SECURITY AND

GOVERNMENTAL AFFAIRS

UNITED STATES SENATE

to accompany

S. 3405

TO REAUTHORIZE THE CHEMICAL FACILITY ANTI-TERRORISM
STANDARDS PROGRAM OF THE DEPARTMENT OF HOMELAND SECURITY

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

November 26, 2018.--Ordered to be printed
______

U.S. GOVERNMENT PUBLISHING OFFICE

89-010 WASHINGTON : 2018

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

RON JOHNSON, Wisconsin, Chairman
JOHN McCAIN, Arizona CLAIRE McCASKILL, Missouri
ROB PORTMAN, Ohio THOMAS R. CARPER, Delaware
RAND PAUL, Kentucky HEIDI HEITKAMP, North Dakota
JAMES LANKFORD, Oklahoma GARY C. PETERS, Michigan
MICHAEL B. ENZI, Wyoming MAGGIE HASSAN, New Hampshire
JOHN HOEVEN, North Dakota KAMALA D. HARRIS, California
STEVE DAINES, Montana DOUG JONES, Alabama

Christopher R. Hixon, Staff Director
Gabrielle D'Adamo Singer, Chief Counsel
Colleen E. Berny, Professional Staff Member
Margaret E. Daum, Minority Staff Director
Charles A. Moskowitz, Minority Senior Legislative Counsel
Julie G. Klein, Minority Professional Staff Member
Laura W. Kilbride, Chief Clerk

Calendar No. 670
115th Congress } { Report
SENATE
2d Session } { 115-384

======================================================================

PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT

_______

November 26, 2018.--Ordered to be printed

_______

Mr. Johnson, from the Committee on Homeland Security and Governmental
Affairs, submitted the following

R E P O R T

[To accompany S. 3405]

[Including cost estimate of the Congressional Budget Office]

The Committee on Homeland Security and Governmental
Affairs, to which was referred the bill (S. 3405), to
reauthorize the Chemical Facility Anti-Terrorism Standards
Program of the Department of Homeland Security, having
considered the same, reports favorably thereon with an
amendment (in the nature of a subsitute) and recommends that
the bill, as amended, do pass.

CONTENTS

Page
I. Purpose and Summary..............................................1
II. Background and Need for the Legislation..........................2
III. Legislative History.............................................18
IV. Section-by-Section Analysis.....................................19
V. Evaluation of Regulatory Impact.................................22
VI. Congressional Budget Office Cost Estimate.......................22
VII. Changes in Existing Law Made by the Bill, as Reported...........25

I. Purpose and Summary

The purpose of S. 3405, the Protecting and Securing
Chemical Facilities from Terrorist Attacks Act of 2018, is to
reauthorize and improve the Chemical Facility Anti-Terrorism
Standards (CFATS) program at the Department of Homeland
Security (``DHS'' or the ``Department'') for a period of five
years.
The legislation makes several important reforms to improve
the CFATS program's effectiveness and efficiency. Importantly,
it improves transparency regarding changes to tiers and the
list of covered chemicals; requires improved reporting to
Congress and assessments on how the program improves security;
provides regulatory relief for certain covered facilities
regulated by the Bureau of Alcohol, Tobacco, Firearms, and
Explosives (ATF), and companies that participate in a CFATS
recognition program; and extends authorization for the CFATS
program for an additional five years.

II. Background and the Need for Legislation

Background on the CFATS program

In 2006, Congress authorized the Secretary of Homeland
Security to regulate security at high-risk chemical facilities
through the Department of Homeland Security Appropriations Act
of 2007, thus creating the CFATS program.\1\ The program is
managed by the Infrastructure Security Compliance Division
(ISCD), within DHS's National Protection and Programs
Directorate. DHS regulates 3,369 high-risk chemical facilities,
and covers over 40,000 facilities.\2\ The CFATS program
regulates facilities within multiple industries including
``chemical manufacturing, storage and distribution, energy and
utilities, agriculture and food, explosives, mining,
electronics, plastics, universities and laboratories, paint and
coatings, healthcare and pharmaceuticals.''\3\
---------------------------------------------------------------------------
\1\Department of Homeland Security Appropriations Act, Pub. L. No.
109-295, Sec. 550, 120 Stat. 1355, 1388-1389 (2006); see also Frank
Gottron, Cong. Research Serv., IF10853, Chemical Facility Anti-
Terrorism Standards (2018), available at http://www.crs.gov/Reports/
IF10853.
\2\Dep't of Homeland Sec., Chemical Facility Anti-Terrorism
Standards (CFATS) (2018), available at https://www.dhs.gov/chemical-
facility-anti-terrorism-standards (last visited Nov. 9, 2018); see also
Dep't of Homeland Sec., CFATS Monthly Statistics (2018), available at
https://www.dhs.gov/cfats-monthly-statistics.
\3\Dep't of Homeland Sec., CFATS Covered Facilities and Inspections
(2018), available at https://www.dhs.gov/cfats-covered-chemical-
facilities (last visited Nov. 9, 2018).
---------------------------------------------------------------------------
The CFATS program regulates chemical facilities throughout
the United States determined to be high risk by DHS.\4\ Some
facilities are exempt from the program, including those
regulated by the U.S. Coast Guard under the Maritime
Transportation Security Act\5\; public water systems and
treatment works regulated by the Environmental Protection
Agency\6\; facilities that are owned or operated by the
Department of Defense and Department of Energy; facilities
regulated by the Nuclear Regulatory Commission; and some
agricultural production facilities.\7\
---------------------------------------------------------------------------
\4\Chemical Facility Anti-Terrorism Standards, supra note 2.
\5\Maritime Transportation Security Act of 2002, Pub. L. No. 107-
295, Sec. 116 Stat. 2064 (2002).
\6\42 U.S.C. Sec. 300; 33 U.S.C. Sec. 1292.
\7\CFATS Covered Facilities and Inspections, supra note 3.
---------------------------------------------------------------------------
Under the CFATS program, non-exempt facilities are required
to compare their chemical inventories to the 322 chemicals of
interest and threshold quantities in Appendix A, created by the
Department under the CFATS program.\8\ The chemicals listed on
Appendix A are determined to be a chemical of interest based on
their screening threshold quantities and the security issues
related to each chemical.\9\ If the facilities' amounts of
chemicals on Appendix A are below the threshold, they are not
regulated by CFATS. If the company's amounts of chemicals on
Appendix A are above the stated amount, the company is required
to submit additional information to DHS via an online ``Top-
Screen'' to determine if they are to be regulated.\10\ Since
the program's inception, the Department has received over
90,000 Top-Screens from more than 40,000 chemical facilities
nationwide.\11\
---------------------------------------------------------------------------
\8\Frank Gottron, Cong. Research Serv., IF10853, Chemical Facility
Anti-Terrorism Standards (2018), available at http://www.crs.gov/
Reports/IF10853.
\9\Dep't of Homeland Sec., Appendix A: Chemicals of Interest (COI)
(2018), available at https://www.dhs.gov/appendix-a-chemicals-interest-
list.
\10\Dep't of Homeland Sec., Chemical Security Assessment Tool
(CSAT) Top-Screen (2018), available at https://www.dhs.gov/csat-top-
screen (a Top-Screen is an online survey that helps DHS determine if a
facility meets the level of risk to be regulated under CFATS).
\11\Dep't of Homeland Sec., CFATS Monthly Statistics (2018),
available at https://www.dhs.gov/cfats-monthly-statistics (last visited
Nov. 9, 2018).
---------------------------------------------------------------------------
Facilities subject to CFATS regulations are divided into
four tiers based on the Department's determination of the
relative security risks of the covered facilities, with Tier 1
including the highest risk and Tier 4 covering the lowest
risk.\12\ Most of the facilities regulated under CFATS fall
under Tier 3 and Tier 4.\13\ According to an October 2018
report by the Congressional Research Service (CRS), five
percent of facilities fall under Tier 1; two percent of the
facilities are under Tier 2; 40 percent of facilities are in
Tier 3; and 53 percent of facilities fall under Tier 4.\14\
---------------------------------------------------------------------------
\12\Frank Gottron, supra note 8.
\13\Id.
\14\Id.
---------------------------------------------------------------------------
A covered chemical facility's security plans and
implementation must comply with DHS's Risk-Based Performance
Standards (RBPS).\15\ There are currently 18 RBPS which
include: ``Restrict Area Perimeter''; ``Secure Site Assets'';
``Screen and Control Access''; ``Deter, Detect, and Delay'';
``Shipping, Receipt, and Storage''; ``Theft or Diversion'';
``Sabotage''; ``Cyber''; ``Response''; ``Monitoring'';
``Training''; ``Personnel Surety''; ``Elevated Threats'';
``Specific Threats, Vulnerabilities, or Risks''; ``Reporting of
Significant Security Incidents''; ``Significant Security
Incidents and Suspicious Activities''; ``Officials and
Organization''; and ``Records.''\16\ The highest risk
facilities (Tier 1 and Tier 2) are required to comply with the
most rigorous standards.\17\ According to CRS, ``[t]he statute
does not permit DHS to require any particular security measure.
Facilities may implement any security program or process that
adequately meets the requisite performance level for its risk
level.''\18\
---------------------------------------------------------------------------
\15\Dep't of Homeland Sec., Risk-Based Performance Standards (RBPS)
(2018) available at https://www.dhs.gov/cfats-rbps.
\16\Dep't of Homeland Sec., Risk-Based Performance Standards
Guidance (2009), available at https://www.dhs.gov/sites/default/files/
publications/CFATS-Risk-Based-Performance-Standards-508.pdf.
\17\Frank Gottron, supra note 8.
\18\Id.
---------------------------------------------------------------------------
Between 2007 and 2014, Congress extended the CFATS program
annually via appropriations.\19\ However, the program was
plagued with significant problems. According to the Government
Accountability Office (GAO), the program had a seven to nine
year backlog to review approximately 3,120 site security
plans.\20\ GAO also reported to Congress that DHS's tiering
methodology did not consider key risk elements, including
economic consequences and facility vulnerability.\21\ GAO also
referenced program management issues with executing the CFATS
program.
---------------------------------------------------------------------------
\19\Dana A. Shea, Cong. Research Serv., R41642, Chemical Facility
Security: Issues and Options for the 112th Congress (2012), available
at https://fas.org/sgp/crs/homesec/R41642.pdf.
\20\U.S. Gov't Accountability Office, GAO-13-353, Critical
Infrastructure Protection (2013), available at https://www.gao.gov/
products/gao-13-353.
\21\Id.
---------------------------------------------------------------------------
According to a leaked 2011 DHS memorandum, management
issues within the program included ``an array of challenges
that ISCD had experienced implementing the CFATS program,
including an inability to hire staff with the needed skills, an
overly complicated security plan review process, and a
compliance inspection process that had yet to be
developed.''\22\ The DHS Office of Inspector General (DHS OIG)
also issued a report in 2013 questioning whether the CFATS
program could achieve its mission, documenting 13 major
deficiencies and providing 24 recommendations.\23\ According to
the report, ``[p]rogram progress has been slowed by inadequate
tools, poorly executed processes, and insufficient feedback on
facility submissions.''\24\ The DHS OIG also found that
``[o]verall efforts to implement the program have resulted in
systematic noncompliance with sound Federal Government internal
controls and fiscal stewardship. . . .''\25\
---------------------------------------------------------------------------
\22\U.S. Gov't Accountability Office, GAO-13-801T, Critical
Infrastructure Protection (2013), available at https://www.gao.gov/
assets/660/656482.pdf.
\23\Dep't of Homeland Sec., Office of Inspector Gen., OIG-13-55,
Effectiveness of the Infrastructure Security Compliance Division's
Management Practices to Implement the Chemical Facility Anti-Terrorism
Standards Program (2013), available at https://www.oig.dhs.gov/sites/
default/files/assets/Mgmt/2013/OIG_13-55_Mar13.pdf.
\24\Id.
\25\Id.
---------------------------------------------------------------------------
Congress also questioned whether the program was
successfully reducing risk and enhancing security. In 2014,
Senator Tom Coburn, then the Ranking Member of the Senate
Committee on Homeland Security and Governmental Affairs,
released a minority staff report evaluating CFATS. According to
the report, the Department's own internal review found
``fundamental problems, errors, inconsistencies, and
unsupported assumptions in the methodology underlying the whole
CFATS program as well as a general lack of transparency with
the private sector and outside experts.''\26\ It also found
``fundamental problems in the design, implementation, and
management of the CFATS program,'' including multiple
challenges with DHS risk formulas.\27\
---------------------------------------------------------------------------
\26\Sen. Tom Coburn of Sen. Comm. on Homeland Sec. & Governmental
Affairs, 113th Cong., Chemical Insecurity, (Comm. Print 2014),
available at https://www.hsgac.senate.gov/imo/media/doc/
Chemical_Insecurity.pdf.
\27\Id.
---------------------------------------------------------------------------
Based on his oversight and the available information from
watchdogs in 2014, Senator Coburn wrote:

In its current form, CFATS isn't working. The program
regulates the wrong chemical plants--increasing costs
for companies at lower risk while missing those at
higher risk--and would not make us significantly more
secure even if it worked as designed. Faced with new
evidence of on-going challenges in CFATS, and the
likelihood that the program will not be adequately
fixed for many more years--if ever--Congress must act
decisively. Whether Congress decides to substantially
overhaul CFATS and put it on track, or terminate the
program altogether, one thing is clear: small fixes
here are no fix at all.\28\
---------------------------------------------------------------------------
\28\Id.
---------------------------------------------------------------------------

Protecting and Securing Chemical Facilities from Terrorist Attacks Act
of 2014

In 2014, Congress attempted to fix these problems by
authorizing and reforming the program in the Protecting and
Securing Chemical Facilities from Terrorist Attacks Act of 2014
(2014 Authorization).\29\ The legislation made several changes
to the program. First, the legislation established the
Expedited Approval Program, providing greater flexibility for
Tier 3 and Tier 4 owners and operators to develop their
facility's site security plans.\30\ Second, the 2014
Authorization improved whistleblower protections.\31\ Third,
the 2014 Authorization required DHS to biannually report its
performance metrics to Congress and conduct outreach to
chemical facilities.\32\ The 2014 Authorization included a
four-year sunset of the CFATS program, setting the program to
expire on January 17, 2019.\33\
---------------------------------------------------------------------------
\29\Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014, Pub. L. No. 113-254, Sec. 128 Stat. 2898 (2014);
see also Frank Gottron, supra note 8.
\30\Id.
\31\Id.
\32\Id.
\33\Id.
---------------------------------------------------------------------------

The Committee's oversight in the 115th Congress

Throughout the 115th Congress, the Committee has conducted
oversight of the CFATS program. On March 13, 2017, Chairman Ron
Johnson, Ranking Member Claire McCaskill, and Ranking Member
Bennie Thompson of the House Committee on Homeland Security
requested GAO conduct a review of the CFATS program.\34\ On
April 4, 2018, Chairman Johnson wrote a letter to ISCD
requesting additional information on the CFATS program,
including the status of overdue reports to Congress, and the
number of facilities certified under expedited approval.\35\ On
June 12, 2018, the Committee held a roundtable titled,
Examining the Chemical Facility Anti-Terrorism Standards, that
included DHS, GAO, a CFATS chemical inspector, and a variety of
chemical facilities and industry groups.\36\ On October 23,
2018, Chairman Johnson and Senator Capito wrote a letter to the
House Committee on Homeland Security and the House Committee on
Energy and Commerce regarding the CFATS reauthorization, urging
both Committees to work with the Senate and incorporate the
reforms in S. 3405 into the CFATS reauthorization.\37\
Committee staff has also met with chemical facilities owners,
industry trade associations, and received multiple briefings
from DHS, ATF, CRS, GAO, the Federal Bureau of Investigation
(FBI), and Sandia National Laboratories.\38\
---------------------------------------------------------------------------
\34\Request letter from S. Comm. on Homeland Sec. & Governmental
Affairs and H. Comm. on Homeland Sec. to U.S. Government Accountability
Office (March 13, 2017) (on file with Comm. majority staff). Chairman
Michael McCaul later joined the request.
\35\Request letter from Chairman Ron Johnson to U.S. Dep't of
Homeland Sec., National Protection and Programs Directorate,
Infrastructure Security Compliance Division (April 4, 2018) (on file
with Comm. majority staff).
\36\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, 115th Cong. (2018), available at https://www.hsgac.senate.gov/
hearings/roundtable_-examining-the-chemical-facility-anti-terrorism-
standards-program.
\37\Letter from Chairman Ron Johnson and Senator Shelley Moore
Capito to the House Committee on Homeland Security and the House
Committee on Energy and Commerce (October 23, 2018) (on file with Comm.
majority staff).
\38\See e.g., Comm. staff briefing with FBI (Feb. 8, 2018); Comm.
staff briefing with FBI (Apr. 9, 2018); Comm. staff briefing with
Envtl. Tech. Council (Apr. 12, 1018); Comm. staff briefing with Dep't
of Homeland Sec. (May 14, 2018); Comm. staff briefing with Dep't of
Homeland Sec. (June 1, 2018); Comm. staff briefing with GAO (June 7,
2018).
---------------------------------------------------------------------------
Through congressional oversight and DHS OIG and GAO
reports, the management and performance of the CFATS program
has improved. For example, DHS has completely reduced the
number of facilities awaiting final tiering into the CFATS
program.\39\ GAO previously estimated it could take seven to
nine years for DHS to verify site security plans and clear the
backlog.\40\ Additional improvements include an increase in the
number of compliance inspections, and a reduced timeframe for
facilities to submit an initial Site Security Plan or
Alternative Security Plan.\41\
---------------------------------------------------------------------------
\39\Majority staff analysis of U.S. Dep't of Homeland Sec.,
Chemical Facility Anti-Terrorism Standards Semiannual Performance
Reports (Sept. 26, 2015 to Sept. 12, 2018) (on file with Comm. majority
staff) [hereinafter Majority staff analysis of Chemical Facility Anti-
Terrorism Standards Semiannual Performance Reports].
\40\Critical Infrastructure Protection, supra note 20.
\41\Majority staff analysis of Chemical Facility Anti-Terrorism
Standards Semiannual Performance Reports.
---------------------------------------------------------------------------
As discussed below, additional reforms are still needed
before the program is reauthorized. As discussed below, S. 3405
incorporates the information learned from the Committee's
oversight to make improvements in the CFATS program.

S. 3405 Requires DHS to ensure broader awareness of the Expedited
Approval Program

The Expedited Approval Program allows flexibility for Tier
3 and Tier 4 facilities to develop expedited security plans
versus the standard security plans, effectively encouraging
companies that own covered chemical facilities to proactively
implement security measures in compliance with CFATS without
requiring a DHS authorization inspection.\42\ The Expedited
Approval Program was also intended to reduce the time and costs
required to comply with the CFATS program.\43\
---------------------------------------------------------------------------
\42\U.S. Gov't Accountability Office, GAO-17-502, Critical
Infrastructure Protection (2017), available at https://www.gao.gov/
assets/690/685520.pdf.
\43\Id.
---------------------------------------------------------------------------
However, few companies have participated in expedited
approval since the 2014 Authorization. In 2015, DHS reported
that only one facility was utilizing the program.\44\ According
to GAO, in April 2017, only 2 facilities were using the program
out of 2,496 eligible facilities.\45\ Representatives from
facilities that have used the Expedited Approval Program said
``its prescriptive nature helped them quickly determine what
they needed to do to implement required security measures and
reduced the time and cost to prepare and submit their security
plans to DHS.''\46\
---------------------------------------------------------------------------
\44\Id.
\45\Id.
\46\Id.
---------------------------------------------------------------------------
Low participation in the Expedited Approval Program has
been attributed to how it was implemented by DHS, its stringent
security measures, and the desire for in-person authorization
inspections.\47\ Further, the online assessment tool used to
collect data for facilities not participating in expedited
approval (CSAT 2.0) has become more user friendly and less
burdensome, resulting in facilities to choose the normal CFATS
process.\48\ In addition, majority Committee staff found that
some facility representatives and industry groups are unaware
of the Expedited Approval Program's existence, raising
questions about DHS's efforts to proactively inform companies
of their options to effectively self-certify their security
measures through the Expedited Approval Program.\49\ Today,
participation in the expedited approval option within the CFATS
program remains limited, with only 17 facilities out of 3,130
participating.\50\ To increase participation, S. 3405 requires
DHS to notify all new and currently covered CFATS facilities of
the Expedited Approval Program. The bill also gives facility
owners and operators additional time to certify expedited
approval security plans to potentially allow more businesses to
use the Expedited Approval Program.
---------------------------------------------------------------------------
\47\Id.
\48\Id.
\49\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (For example, on July 20, 2018, Committee staff
attended a CFATS facility tour organized by DHS and asked the facility
if they have heard of the Expedited Approval Program. The facility said
they had not heard of the program.).
\50\Email from Dep't of Homeland Sec. to Comm. majority staff (Oct.
24, 2018) (on file with Committee majority staff).
---------------------------------------------------------------------------

S. 3405 Requires DHS to provide greater regulatory relief for companies
that participate in the CFATS Recognition Program

During the Committee's June 12, 2018, roundtable, six
representatives from the chemical industry expressed their
support for greater regulatory relief for covered chemical
facilities that participate in industry-led best practices or
recognition programs and exceed compliance of CFATS security
standards. Currently, the chemical industry has a variety of
stewardship programs, which assist facilities in complying with
various standards and regulations, including health,
environmental, safety, and security.\51\ At the roundtable,
industry and participating facilities described the potential
benefits of creating a CFATS Recognition Program to provide
covered facilities participating in current and future industry
stewardship programs additional regulatory relief. Randall
Eppli of Columbus Chemical Industries, a chemical facility
headquartered in Columbus, Wisconsin, explained that companies
that participate in verified industry security standard
programs ``have made a strong commitment to operate their
facilities safely and securely,'' and argued that,
``[r]ecognizing these responsible companies through simple
measures like less frequent inspections would allow DHS to
prioritize resources to concentrate on the outliers' or bad
actors who don't participate in these programs that may pose a
greater security risk to themselves or the population at
large.''\52\
---------------------------------------------------------------------------
\51\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (statement of William Erny, Senior Director,
American Chemistry Council), available at https://www.hsgac.senate.gov/
hearings/roundtable_-examining-the-chemical-facility-anti-terrorism-
standards-program; see also Responsible Care, American Chemistry
Council, https://responsiblecare.americanchemistry. &fnl;com/.
\52\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (written testimony of Randall Eppli, President
and CEO, Columbus Chemical Industries, Inc.).
---------------------------------------------------------------------------
Justin Louchheim, Director of Government Affairs at The
Fertilizer Institute (TFI), which represents both large and
small fertilizer companies nationwide, highlighted
ResponsibleAg, the agricultural retailers' industry compliance
program that assists in ensuring its members comply with
various Federal regulations, including CFATS, as an example of
an Industry-led program that should be eligible for a CFATS
Recognition Program.\53\ According to Mr. Louchheim, ``[t]o
date, over 2,500 facilities are registered with the
ResponsibleAg program, over 1,000 of these facilities have been
certified, 185 auditors have been trained, and almost 2,000
audits have been completed.''\54\
---------------------------------------------------------------------------
\53\Id. (written testimony of Justin Louchheim, Director of
Government Affairs, The Fertilizer Institute).
\54\Id.
---------------------------------------------------------------------------
William Erny, Senior Director of the American Chemistry
Council, which represents major chemical producers and
businesses within the chemistry field, also expressed support
for the concept of a recognition program: ``DHS can provide
regulatory recognition for responsible operators that
demonstrate superior performance and who exceed regulatory
compliance. Such a program would incentivize the implementation
of existing industry stewardship programs-and the creation of
new ones where necessary--thus enhancing chemical security
across the sector and beyond the universe of CFATS regulated
facilities.''\55\
---------------------------------------------------------------------------
\55\Id. (written testimony of William Erny, Senior Director,
American Chemistry Council).
---------------------------------------------------------------------------
DHS told the Committee that encouraging industry security
best practices through a recognition program would enhance
security. Specifically, David Wulf, then Acting Deputy
Assistant Secretary for Infrastructure Protection, stated that
industry stewardship programs ``do great work, and they raise
the bar for security . . . not only at the 10 percent or so of
facilities that find themselves covered under CFATS but at
those other 90 percent.''\56\ Mr. Wulf also said they are
``very interested in working with the Committee on prospects
for ways in which we can recognize those programs within CFATS,
whether that is the ability to place facilities that are in
good standing with those programs on a . . . less frequent
inspection cycle, or other ways of recognizing.''\57\
---------------------------------------------------------------------------
\56\Id. (statement of David Wulf, Acting Deputy Assistant Sec'y for
Infrastructure Protect., Nat'l Prot. and Programs Directorate U.S.
Dep't of Homeland Sec.).
\57\Id.
---------------------------------------------------------------------------
S. 3405 requires the establishment of a CFATS Recognition
Program within 270 days of enactment that will leverage
industry stewardship programs to better secure covered chemical
facilities. Specifically, the bill requires the Secretary of
Homeland Security to establish criteria for the CFATS
Recognition Program, minimum eligibility criteria for industry
stewardship programs that would like to participate, and
performance requirements for participating facilities within
nine months of the bill's passage. S. 3405 also requires the
Secretary of Homeland Security to establish program incentives
for participation in the CFATS Recognition Program. This
includes a reduction in the frequency of compliance
inspections; streamlined processes for vulnerability
assessments and site security plans; and any additional
regulatory relief determined appropriate. The Committee expects
that DHS will work with industry to develop the CFATS
Recognition Program and ensure facilities are aware of how they
can use it.

S. 3405 Requires DHS to reduce the frequency of audits and inspections

The purpose of a compliance inspection is to ensure covered
facilities are completely implementing their security
measures.\58\ According to the Department, 3,995 Compliance
Inspections have been conducted since the program's
inception.\59\ On average, the frequency of audits and
inspections take place every 18 months to two years.\60\
---------------------------------------------------------------------------
\58\U.S. Dep't of Homeland Sec., Chemical Facility Anti-Terrorism
Standards: Compliance Inspection (CI) (2017), available at https://
www.dhs.gov/sites/default/files/publications/fs-cfats-compliance-
inspection-508_0.pdf.
\59\Dep't of Homeland Sec., CFATS Monthly Statistics (2018),
available at https://www.dhs.gov/cfats-monthly-statistics.
\60\Comm. majority and minority staff meeting with Dep't of
Homeland Sec. (Sept. 18, 2018).
---------------------------------------------------------------------------
This legislation changes the frequency of CFATS audits and
inspections to be more in line with other Federal regulatory
inspection regimes. Under the Safe Explosives Act, for example,
ATF is required to inspect storage magazines of every licensee
at least once every three years.\61\ Under the Clean Air Act,
the Environmental Protection Agency (EPA) is required to
conduct a full ``compliance evaluation at title V major
facilities once every two federal fiscal years; at mega-sites,
which are the largest title V major facilities, once every
three federal fiscal years; and at SM-80s once every five
federal fiscal years.''\62\ Under the Clean Water Act, the EPA
inspects major facilities at least once every two years and
non-major facilities at least once every five years.\63\ Under
the Resource Conservation and Recovery Act, large quantity
generators are inspected by the EPA every five years.\64\ Under
the Department of Labor's Occupational Safety and Health
Administration process safety management standards, compliance
audits of highly hazardous chemicals are conducted at least
every three years.\65\
---------------------------------------------------------------------------
\61\Safe Explosives Act, Pub. L. No. 107-296, Sec. 116 Stat. 2280
(2002).
\62\U.S. Envtl. Prot. Agency, State Compliance Monitoring
Expectations (2018), available at https://echo.epa.gov/trends/
comparative-maps-dashboards/state-compliance-monitoring-expectations.
\63\Id.
\64\Id.
\65\U.S. Dep't of Labor, Occupational Safety and Health
Administration, OSHA 3132, Process Safety Management (2000), available
at https://www.osha.gov/Publications/osha3132.pdf.
---------------------------------------------------------------------------
Under S. 3405, covered chemical facilities cannot be
inspected more frequently than once every two years. This
codifies the two-year duration of DHS's current practice\66\
and will also help increase efficiency. In addition, under S.
3405, those companies participating in a CFATS recognition
program that meet compliance, audit, and inspection
requirements cannot be inspected more frequently than once
every three years. However, the Secretary may conduct more
frequent audits and inspections for specific reasons, including
when: the facility has identified planned enhancements that
have not been verified; the facility commits a deficiency or
infraction that could result in an enforcement action; the
Department has identified a specific or elevated threat;
suspicious activity or a security incident has occurred at the
facility; or the Secretary determines, due to exigent
circumstances, that an inspection or audit is needed.
---------------------------------------------------------------------------
\66\Comm. majority and minority staff meeting with Dep't of
Homeland Sec. (Sept. 18, 2018).
---------------------------------------------------------------------------

S. 3405 Improves the Personnel Surety Program

Under RBPS-12, covered facilities are required ``to account
for four types of background checks on facility personnel and
unescorted visitors who have or are seeking access to
restricted areas, critical assets, and chemicals of interest at
high-risk facilities.''\67\ The purpose of these background
checks are to confirm a person's identity; check for any
criminal history; certify legal authorization to work at the
facility; and identify individuals with terrorist
connections.\68\
---------------------------------------------------------------------------
\67\U.S. Dep't of Homeland Sec., CFATS Personnel Surety Program
(last updated Aug. 22, 2018), available at https://www.dhs.gov/cfats-
personnel-surety-program.
\68\Id.
---------------------------------------------------------------------------
Currently, only Tier 1 and Tier 2 facilities are required
to screen for individuals with terrorists connections through
the Personnel Surety Program (PSP).\69\ Under RBPS-12, frequent
vetting of individuals' information against the Terrorist
Screening Database is required.\70\ The Terrorist Screening
Database is administered by the FBI and supports Federal
agencies in detecting known or suspected terrorists.\71\
Facilities can submit an individual's information to DHS in
different ways to screen an individual against the Terrorist
Screening Database. This includes via DHS's online portal;
directly verifying an individual's enrollment in an existing
DHS program; utilizing an electronic reader to verify
credentials; or using another Federal screening program that
operates the Terrorist Screening Database.\72\
---------------------------------------------------------------------------
\69\Id.
\70\Comm. majority and minority staff briefing with Dep't of
Homeland Sec. (June 1, 2018) (briefing notes on file with Comm.
majority staff).
\71\Fed. Bureau of Investigations, Leadership and Structure,
Terrorist Screening Center, available at https://www.fbi.gov/about/
leadership-and-structure/national-security-branch/tsc.
\72\CFATS Personnel Surety Program supra note 67.
---------------------------------------------------------------------------
On December 27, 2017, DHS posted a notice in the Federal
Register seeking comment on its proposal to extend the PSP
terror screening requirements to Tier 3 and Tier 4
facilities.\73\ Industry has voiced concerns with this proposed
expansion.\74\ According to written testimony from Mr. Erny of
the American Chemistry Council (ACC),
---------------------------------------------------------------------------
\73\Chemical Facility Anti-Terrorism Standards Personnel Surety
Program, 82 Fed. Reg. 61312 (proposed Dec. 27, 2017) (to be codified in
C.F.R. pt. 6), available at https://www.federalregister.gov/documents/
2017/12/27/2017-27519/chemical-facility-anti-terrorism-standards-
personnel-surety-program.
\74\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36.

such an expansion of the PSP program is unnecessary and
will needlessly put personal employee information at
risk. ACC believes the benefit associated with
[Terrorist Screening Database] vetting is simply not
worth the cost or the risk. While we support [Terrorist
Screening Database] vetting at high risk Tier 1 and 2
facilities, ACC recommends elimination of this
requirement for lower risk Tiers 3 and 4 facilities, or
could be an option for those who choose to
participate.\75\
---------------------------------------------------------------------------
\75\Id. (written testimony of William Erny, Senior Director
American, Chemistry Council).

Additionally, Mr. Louchheim from the The Fertilizer Institute
stated that this is an ``exponential expansion of the program
from the less than 200 facilities presently covered to more
than 3,500. Many of the 1,500 or so agricultural retail
facilities are not equipped to implement this program at this
time.''\76\
---------------------------------------------------------------------------
\76\Id. (written testimony of Justin Louchheim, Director,
Government Affairs The Fertilizer Institute).

All covered CFATS facilities are required to run background
checks to confirm a person's identity; check for any criminal
history; and certify legal authorization to work at the
facility.\77\ Committee majority staff oversight and review of
DHS's data on the use of the terror screening strategy suggests
that it is not effective in achieving DHS's purported personnel
security objectives.\78\ Industry standard background checks
plus the additional background checks required under RBPS-12
for all covered facilities eliminates the need to require
terror screening at lower-risk Tier 3 and Tier 4 facilities.
---------------------------------------------------------------------------
\77\U.S. Dep't of Homeland Sec., CFATS Personnel Surety Program
(last updated Aug. 22, 2018), available at https://www.dhs.gov/cfats-
personnel-surety-program.
\78\Comm. majority staff briefing with Dep't of Homeland Sec. (July
24, 2018) (briefing notes on file with Comm. majority staff).
---------------------------------------------------------------------------
S. 3405 makes clear that terror screening must be conducted
by all Tier 1 and Tier 2 covered facilities, consistent with
the policy that was implemented during the Obama Administration
in 2015,\79\ but is only optional for all Tier 3 and Tier 4
covered facilities.
---------------------------------------------------------------------------
\79\Dep't of Homeland Sec., Chemical Facility Anti-Terrorism
Standards: RBPS 12(iv)--Screening for Terrorist Ties (2017), available
at https://www.dhs.gov/sites/default/files/publications/fs-rbps-12iv-
psp-508.pdf.
---------------------------------------------------------------------------

S. 3405 Requires DHS to be more transparent regarding changes in
facility tiering

In 2013, outside industry and government experts conducted
a review of the CFATS risk-tiering methodology and provided
findings and recommendations to DHS.\80\ The review determined
that DHS needed to develop an enhanced tiering methodology to
more adequately assign risk to chemical facilities.\81\ In
2016, DHS introduced a new tiering methodology and notified all
chemical facilities potentially subject to CFATS regulations to
submit information through a new online tool, the Chemical
Security Assessment Tool (CSAT) 2.0.\82\ In April 2017, DHS,
using its new, enhanced methodology, began notifying facilities
of their CFATS program tier.\83\ The Department continues to
notify facilities of their tiering status on a rolling basis as
new facilities submit Top-Screens or currently regulated
facilities update their chemical holdings.\84\
---------------------------------------------------------------------------
\80\Dep't of Homeland Sec., CFATS Tiering Methodology (2018),
available at https://www.dhs.gov/cfats-tiering-methodology.
\81\Id.
\82\Id.
\83\Id.
\84\Id.
---------------------------------------------------------------------------
According to DHS, ``some facilities have seen a change in
their tier. Some facilities that were previously not covered
under CFATS found themselves covered, and some previously-
covered facilities are no longer considered high-risk.''\85\
---------------------------------------------------------------------------
\85\Id.
---------------------------------------------------------------------------
During the Committee's roundtable in June 2018,
representatives of the chemical industry discussed these
changes in tiering and the need for DHS to be more transparent
regarding methodology changes.\86\ For example, Linda Menendez,
Director of Operations for Austin Powder, an explosives company
headquartered in Cleveland, Ohio, explained the company had a
facility ``that was previously tiered a 2, requiring us to
implement all of these security measures. When CFATS 2.0 came
about we had to re-tier. We dropped to a Tier 3, with no
explanation. We had no change in the facility, no change in the
chemicals, no change in the quantity of the chemicals, and we
dropped down to a Tier 3.''\87\
---------------------------------------------------------------------------
\86\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36.
\87\Id. (statement of Linda Menendez, Dir. of Operations, Austin
Powder Co.).
---------------------------------------------------------------------------
Mr. Erny from the American Chemistry Council called for
greater transparency and information sharing when DHS changes a
facility's tiering level: ``Often times the facility security
director--the very person with the overall responsibility and
authority for making critical security risk management
decisions for the site--is not aware of the determining
factor(s) behind the assigned risk tier level.''\88\ Mr.
Louchheim from The Fertilizer Institute also explained that
``some TFI facilities were reclassified into a higher risk
classification. What was not clear to TFI members, was the
underlying basis for the new categorizations. We believe this
should be a more transparent effort between DHS and individual
facilities, allowing for a more thorough discussion of the
security risks posed by individual facilities. This could
ultimately bolster the quality of site security plans.''\89\ If
facilities receive information as to why their tier changed,
they will have an actual understanding of the current and
changing risks their facilities pose to their employees and
surrounding communities. This can result in facilities taking
additional security measures or reducing their chemical
inventories.
---------------------------------------------------------------------------
\88\Id. (written testimony of William Erny, Senior Dir., Ame.
Chemistry Council).
\89\Id. (written testimony of Justin Louchheim, Dir. of Gov't
Affairs, Fertilizer Institute).
---------------------------------------------------------------------------
S. 3405 includes changes to the CFATS program to increase
transparency between DHS and the regulated chemical facilities.
Specifically, the bill requires the Secretary of Homeland
Security to submit a controlled unclassified\90\ statement to
facilities within 30 days on why their tier changed or they are
no longer regulated under CFATS.
---------------------------------------------------------------------------
\90\This is defined as sensitive, but not classified, information.
---------------------------------------------------------------------------

S. 3405 Requires DHS to improve the metrics it uses to evaluate program
success

Prior to the 2014 reauthorization, the Committee's then-
Ranking Member, Senator Coburn, issued a report about the CFATS
program, and included a finding that ``without better metrics
DHS has no way of knowing [if] CFATS is improving security and
reducing the risk of terrorist attack[s].''\91\ Senator
Coburn's report concluded that DHS must implement metrics ``to
show to the private sector and Congress CFATS is improving
chemical security at high risk chemical facilities, the
facilities being regulated are truly high risk, CFATS reflects
plausible attack scenarios, and the program is not merely
shifting risk elsewhere.''\92\
---------------------------------------------------------------------------
\91\Sen. Tom Coburn of Sen. Comm. on Homeland Sec. & Governmental
Affairs, 113th Cong., Chemical Insecurity, (Comm. Print 2014),
available at https://www.hsgac.senate.gov/imo/media/doc/
Chemical_Insecurity.pdf.
\92\Id.
---------------------------------------------------------------------------
To help Congress more effectively evaluate whether the
CFATS program was improving, the 2014 legislation required DHS
to biannually report to Congress on the program's performance
and include metrics to assist in its oversight of the
program.\93\ However, because the program had implementation
issues, the metrics required under the 2014 legislation did not
address risk reduction and instead looked at basic program
implementation metrics. For example, DHS was required to
provide metrics on how many compliance or authorization
inspections were completed during the reporting period and how
many inspectors attended each inspection on average.\94\
---------------------------------------------------------------------------
\93\Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014, Pub. L. No. 113-254, Sec. 128 Stat. 2898 (2014).
\94\Id.
---------------------------------------------------------------------------
Through its oversight, the Committee has found that these
basic data points were not sufficient to address the degree to
which CFATS was materially reducing terrorism risks. At the
June 12, 2018 Committee roundtable, GAO representative
Christopher Currie stated that ``measuring risk reduction or
the security benefit [of the CFATS program] is really
difficult. It is hard to do that with just outputs. So I think
we need to continue to push DHS to try to measure across the
country how we are reducing risk.''\95\ An August 2018 GAO
report confirmed this statement, finding that DHS does not
evaluate or measure vulnerability reduction.\96\ GAO emphasized
that ``[d]oing so would provide DHS an opportunity to begin
assessing how vulnerability is reduced--and by extension, risk
lowered--not only for individual high-risk facilities but for
the CFATS program as a whole.''\97\
---------------------------------------------------------------------------
\95\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (statement of Christopher Currie, Dir., Homeland
Sec. & Justice Team, U.S. Gov't Accountability Office).
\96\U.S. Gov't Accountability Office, GAO-18-538, Critical
Infrastructure Protection (2018), available at https://www.gao.gov/
assets/700/693817.pdf.
\97\Id.
---------------------------------------------------------------------------
S. 3405 includes language to update the CFATS program
metrics requirements. New metrics include how effective CFATS
is at managing security risks and measuring risk reduction. The
updated requirements push DHS to evolve its very basic program
metrics to more advanced risk-focused metrics to measure
program effectiveness and risk reduction. The Committee is
directing DHS to measure and demonstrate actual risk reduction,
if any, provided by CFATS, and benefits, if any, for the money
spent by U.S. taxpayers on the CFATS program. The metrics
reporting period is also increased from six months to one year
to allow the Department more time to focus on the report.

S. 3405 Modifies the petition process for the exemption of covered
products or mixtures

DHS has voiced concerns to the Committee regarding the
petition process for the exemption of covered chemical products
or mixtures. DHS officials explained that there have been
instances when mixtures of multiple chemicals include one
chemical of interest, but in that mixture do not present the
same hazard as the original form of the chemical of interest
listed under Appendix A.\98\ As a result, the mixture is no
longer a chemical of interest and therefore will not be subject
to CFATS regulation.
---------------------------------------------------------------------------
\98\Comm. majority and minority staff briefing with Dep't of
Homeland Sec. (Sept. 18, 2018) (briefing notes on file with Comm.
majority staff).
---------------------------------------------------------------------------
Based on the Department's feedback, S. 3405 includes
language for an interested party to petition DHS to exempt
certain chemical mixtures that no longer pose the same hazard
as a pure CFATS chemical of interest listed under Appendix A.
If, during processing, the pure CFATS chemical of interest is
converted to a new chemical compound that is no longer a
security risk, the company may petition DHS for an exemption on
the final chemical product.\99\ DHS can then review the
petition and the technical basis for the exemption request.
Following DHS's review, DHS will make a final decision on
whether or not to exempt the final chemical product, and notify
the petitioner of the decision.
---------------------------------------------------------------------------
\99\Comm. majority staff phone briefing with Dep't of Homeland Sec.
(Oct. 29, 2018) (notes on file with Comm. majority staff).
---------------------------------------------------------------------------

S. 3405 Reduces duplicative regulations by exempting regulated
explosive materials from CFATS

A number of facilities are excluded from the CFATS program
to prevent facilities from being subject to duplicative or
contradictory regulatory regimes. The Department of Homeland
Security Appropriations Act of 2007 (and later the 2014
Authorization) exempted facilities from the CFATS regulations
when those facilities are:

regulated pursuant to the Maritime Transportation
Security Act of 2002, Public Law 107-295, as amended;
Public Water Systems, as defined by section 1401 of the
Safe Drinking Water Act, Public Law 93-523, as amended;
Treatment Works as defined in section 212 of the
Federal Water Pollution Control Act, Public Law 92-500,
as amended; any facility owned or operated by the
Department of Defense or the Department of Energy, or
any facility subject to regulation by the Nuclear
Regulatory Commission.\100\

\100\Department of Homeland Security Appropriations Act, 2007 Pub.
L. N. 109-29, Sec. 120 Stat. 138 (2007); Protecting and Securing
Chemical Facilities from Terrorist Attacks Act of 2014, Pub. L. No.
113-254, Sec. 128 Stat. 2898 (2014).

S. 3405 maintains these exemptions. The CFATS program also
overlaps with the ATF's regulation of facilities used to store
certain explosive materials. Explosive materials are regulated
by ATF under the Organized Crime Control Act of 1970 and the
Safe Explosive Act of 2002.\101\ When CFATS regulations were
established in 2007, explosive materials became regulated by
both the ATF and DHS.\102\
---------------------------------------------------------------------------
\101\See generally Organized Crime Control Act of 1970 18 U.S.C.A.
Sec. 842; Safe Explosives Act, Pub. L. No. 107-296, Sec. 116 Stat. 2280
(2002).
\102\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (written statement of Debra Satkowiak,
President, Institute of Makers of Explosives).
---------------------------------------------------------------------------
Under the Organized Crime Control Act of 1970, ATF annually
publishes a list of explosive materials that it is responsible
for regulating.\103\ As of December 28, 2017, there are 238
explosive materials on ATF's annual Notice of List of Explosive
Materials.\104\ CFATS currently regulates 322 chemicals of
interest.\105\ Thirty-four explosive materials are regulated by
both ATF and CFATS.\106\ In practice, this means that companies
with facilities that are covered by both the CFATS and ATF
regulatory regimes must comply with specific aspects of the
program that are duplicative, such as background checks,
inspections, and reviews of physical security measures.
Companies must spend additional time (30.5 hours) to complete
DHS's Top Screens in addition to ATF's permitting applications
and submit duplicative reporting of potential security
incidents to both agencies.\107\
---------------------------------------------------------------------------
\103\See Commerce in Explosives; 2017 Annual List of Explosive
Materials, 56 Fed. Reg. 248 (Proposed Dec. 28, 2017), available at
https://www.gpo.gov/fdsys/pkg/FR-2017-12-28/pdf/2017-28010.pdf.
\104\Id.
\105\Frank Gottron, supra note 8.
\106\Comm. majority staff analysis of ATF's annual Notice of List
of Explosive Materials and CFATS Appendix A chemicals of interest.
\107\Comm. majority staff analysis of DOJ and ATF's explosive
regulations and DHS's CFATS regulations.
---------------------------------------------------------------------------
The duplicative regulations come at a significant and
unnecessary cost to the explosives industry. According to four
case studies conducted by the Institute of Makers of Explosives
(IME), ``for the four sites reviewed, the total expected
compliance cost reached over $2.6 Million; a sum that saw no
proportionate increase in facility security.''\108\ In addition
to increasing costs, the duplicative regulations have also
resulted in potential safety issues. For example, ``[o]ne
facility, also regulated by the Department of Defense (DoD) and
ATF, was asked to run electricity to a mandated no-spark
environment.''\109\ This is a safety hazard as electricity
cannot be within a certain range of explosives. ``The result
was the imposition of massive cost, upwards of $500,000, to run
underground electricity in accordance with DoD regulations or
put in place round-the-clock in-person surveillance over
multiple storage sites, which carried with it an estimated cost
of $3 [million].''\110\
---------------------------------------------------------------------------
\108\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (written statement of Debra Satkowiak,
President, Institute of Makers of Explosives).
\109\Id.
\110\Id.
---------------------------------------------------------------------------
At the Committee's June 12, 2018 roundtable, Ms. Menendez
testified about Austin Powder's experience complying with both
regulatory regimes and the costs imposed to specific explosive
facilities because they are also regulated by CFATS.\111\ For
example, one Austin Powder facility went from not being a
CFATS-covered facility in 2008 to being a Tier 2 after
submitting a Top Screen in 2013.\112\ To comply with Tier 2
RBPS, Austin Powder spent $325,000 on labor and implementation
costs and has an annual expense of $70,000 for contracted
monitoring services.\113\ Another Austin Powder facility not a
CFATS-covered facility in 2008, but after Top Screen
submissions in 2015 and 2017 it became a Tier 3 facility. Costs
to comply with Tier 3 RBPS totaled $837,400 with an additional
annual recurring expense.\114\
---------------------------------------------------------------------------
\111\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36.
\112\Id. (written testimony of Linda Menendez, Dir. of Operations,
Austin Powder Co.).
\113\Id.
\114\Id.
---------------------------------------------------------------------------
Data and information provided to the Committee by the
explosives industry shows that the CFATS program does not
appear to have resulted in any change in the number of thefts
of explosives, which raises questions about whether the
duplicative regulatory regime under CFATS is enhancing
security.\115\ During the Committee's June 12, 2018 roundtable,
Debra Satkowiak, President of IME explained:
---------------------------------------------------------------------------
\115\Id. (written and oral statement of Debra Satkowiak, President,
Institute of Makers of Explosives) (additional data and information on
file with Comm. majority staff).

IME found that while there has been a consistent and
remarkable reduction in thefts of explosives over the
last 30 plus years, there is no marked increase in that
rate of decline following the beginning of the CFATS
program. Clearly, the record shows that ATF regulations
and industry best practices effectively ensure security
of commercial explosives and prevent diversion for
criminal or other illicit use.\116\
---------------------------------------------------------------------------
\116\Id. (written statement of Debra Satkowiak, President,
Institute of Makers of Explosives).

When discussing exempting explosive materials at the
Committee's June 12, 2018 roundtable, Mr. Wulf, Acting Deputy
Assistant Secretary for Infrastructure Protection, stated that
DHS is ``sympathetic to the duplicative regulation situation. .
. .''\117\
---------------------------------------------------------------------------
\117\Id. (statement of David Wulf, Acting Deputy Assistant Sec'y
for Infrastructure Prot., Nat'l Prot. & Programs Directorate U.S. Dep't
of Homeland Sec.).
---------------------------------------------------------------------------
S. 3405 exempts explosive materials regulated by DOJ under
chapter 40 of title 18, United States Code, or by the ATF under
part 555 of title 27, Code of Federal Regulations, as CFATS
chemicals of interest. The bill also requires the Secretary of
Homeland Security to remove any additional explosive material
designated as a CFATS chemical of interest if it becomes
regulated by DOJ or ATF in the future. For example, DHS will
continue to regulate improvised explosive device precursor
chemicals because ATF does not regulate the precursor
chemicals.

S. 3405 Requires notice of proposed rulemaking before changes to
Appendix A

As stated previously, Appendix A is a list of 322 chemicals
of interest that are regulated under the CFATS program.\118\
The list has not been modified since its inclusion in the final
rule on November 30, 2007.\119\ During the Committee's June 12,
2018 roundtable, industry recommended clarifying the process
required to make changes to Appendix A. For example, Jennifer
Gibson, Vice President of Regulatory Affairs from the National
Association of Chemical Distributors, suggested that:
---------------------------------------------------------------------------
\118\Frank Gottron, supra note 8.
\119\See generally Appendix to Chemical Facility Anti-Terrorism
Standards, 6 Fed. Reg. pt. 2 (Nov. 20, 2007) available at https://
www.gpo.gov/fdsys/pkg/FR-2007-11-20/pdf/07-5585.pdf.

any changes to the Appendix A list of chemicals remain
subject to notice and comment rulemaking. Changes to
this [chemicals of interest] list have major impacts on
many companies' businesses and security investments.
While changes may periodically be needed, it is
important to give the regulated community the
opportunity to provide information and explain the
impacts of any proposed changes.\120\
---------------------------------------------------------------------------
\120\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (written statement of Jennifer Gibson, Vice
President, Regulatory Affairs Nat'l Ass'n of Chem. Distrib.).

Mr. Louchheim from The Fertilizer Institute also discussed
the need for increased transparency in regards to Appendix A
and how ``uncertainties could be remedied through a
comprehensive notice and comment rulemaking.''\121\
---------------------------------------------------------------------------
\121\Id. (written testimony of Justin Louchheim, Dir. of Gov't
Affairs, Fertilizer Institute).
---------------------------------------------------------------------------
This legislation requires the Secretary of Homeland
Security to publish a notice of proposed rulemaking before
making any changes to Appendix A, which will give industry the
opportunity to comment. Changes include a chemical being added
as a CFATS chemical of interest; a chemical being removed as a
CFATS chemical of interest; or a modification of a CFATS
chemical of interest's amount, concentration, or threshold
quantity under Appendix A.

S. 3405 Requires DHS to more effectively assess the program's success

The Committee's oversight in the 115th Congress has focused
on whether the CFATS program effectively reduces risk and
enhances national security.\122\ GAO recommended in August 2018
that DHS take further action to measure risk reduction and
national security benefits resulting from the CFATS
implementation.\123\ GAO also found that ``DHS shares some
CFATS information, but first responders and emergency planners
may not have all of the information they need to minimize the
risk of injury or death when responding to incidents at high-
risk facilities.''\124\ The GAO review also reported that DHS
does not evaluate or measure vulnerability reduction.\125\
---------------------------------------------------------------------------
\122\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36.
\123\U.S. Gov't Accountability Office, GAO-18-538, Critical
Infrastructure Protection (2018), available at https://www.gao.gov/
assets/700/693817.pdf.
\124\Id.
\125\Id.
---------------------------------------------------------------------------
This legislation requires a third-party assessment to help
address the issues raised by GAO. The assessment will address
the CFATS program's effectiveness in managing security
requirements and the Department's preparedness and response
planning with first responders and emergency planners. It will
also examine the development of metrics and capabilities to
measure risk reduction.
One area where additional improvement is needed, based on
the Committee's oversight during the 115th Congress, is
inspector training. During the Committee's June 2018
roundtable, a CFATS chemical inspector, Jesse LeGros, Jr.,
provided insight on current issues with inspector
training.\126\ For example, inspector training has been
significantly shortened compared to the first formal inspector
academy class, to the point where most training is now acquired
on the job.\127\ According to Mr. LeGros, the Department has
also ``hired a number of individuals with little to no physical
security training or experience.''\128\ In addition, Mr. LeGros
discussed a particular lack of cybersecurity training, which is
covered under RBPS-8.\129\ The two limited classes provided to
inspectors ``was about hackers and how they could access cyber
systems''\130\ and ``did not get into the various technical
aspects of the Cyber world or Cyber Security.''\131\ As a
result, some inspectors have obtained additional cybersecurity
training outside the inspector program.\132\ Although
cybersecurity experts from DHS are available to assist
inspectors when appropriate, the Department's Compliance Branch
Chief\133\ recommends who should ultimately complete RBPS-
8.\134\ This has resulted in additional confusion for the
chemical inspectors and has the potential to result in
inconsistent compliance inspection results.\135\
---------------------------------------------------------------------------
\126\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President,
Infrastructure Prot., AFGE National Local #918).
\127\Id. (written statement of Jesse LeGros, Jr. Vice President,
Infrastructure Prote., AFGE National Local #918).
\128\Id.
\129\Id.; see also Dep't of Homeland Sec., Risk-Based Performance
Standards (RBPS) (2018) available at https://www.dhs.gov/cfats-rbps.
\130\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President,
Infrastructure Prot., AFGE National Local #918).
\131\Id.
\132\Id.
\133\Individuals responsible for overseeing, reviewing, and
approving compliance inspections.
\134\Roundtable: Examining the Chemical Facility Anti-Terrorism
Standards Program Before the Sen. Comm. on Homeland Sec. & Governmental
Affairs, supra note 36 (statement of Jesse LeGros, Jr. Vice President,
Infrastructure Prot., AFGE National Local #918).
\135\Id.
---------------------------------------------------------------------------
S. 3405 requires GAO to submit a report to Congress on
CFATS inspector training and how it can be improved. This
includes information about how DHS selects inspectors; what
training is completed before inspectors are selected as CFATS
facility inspectors; a review of the qualification standards,
on-the-job training, final qualification, approval standards,
and continuous qualification and training; and issues with
inspector cybersecurity training and how it can be further
improved.
Since the CFATS program was authorized in 2006, America's
threat environment has changed. According to a recent report by
the National Academies, ``[b]etween the 1970s and 2000, a
series of larger vehicle bombs emerged in terrorist attacks
with main charges in the thousands of pounds range, but in the
following decade, bombs with smaller charges like those seen in
the 1970s started to appear again. By the 2010s, the use of
[homemade explosives] in smaller charges was growing.''\136\ In
recent attacks in the U.S. and Europe, such as the Boston,
Paris, and Brussels, terrorists have utilized smaller
improvised explosive devices, such as backpack bombs.\137\
However, ``[p]ast research and regulatory efforts have tended
to focus on the threat posed by [vehicle-borne improvised
explosive devices (IEDs)], but attacks that employ [person-
borne IEDs] can have and have had serious consequences both
domestically and internationally.''\138\
---------------------------------------------------------------------------
\136\Nat'l Academies of Sciences, Engineering, and Medicine,
Reducing the Threat of Improvised Explosive Device Attacks by
Restricting Access to Explosive Precursor Chemicals 23 (2017),
available at https://www.nap.edu/catalog/24862/reducing-the-threat-of-
improvised-explosive-device-attacks-by-restricting-access-to-explosive-
precursor-chemicals.
\137\Id. at vii.
\138\Id. at 2.
---------------------------------------------------------------------------
This legislation requires DHS to provide an annual briefing
to Congress on current threats to chemical facilities; how bad
actors are utilizing CFATS chemicals of interest; how CFATS is
addressing the threat landscape and making the United States
safer; and data, rationale, and metrics on how the CFATS
program is effectively reducing risk and enhancing security.
In 2007, DHS completed an initial estimate that predicted
the CFATS program would regulate 5,000 chemical facilities and
have an economic cost of $8.5 billion over the period of 2006-
2015.\139\ To date, the Department has not completed an updated
estimate. This legislation requires DHS to complete an updated
retrospective estimate on costs to carry out the CFATS program.
---------------------------------------------------------------------------
\139\Chemical Facility Anti-Terrorism Standards, 6 C.F.R. Sec. 27
(2006), available at https://www.dhs.gov/xlibrary/assets/
IP_ChemicalFacilitySecurity.pdf.
---------------------------------------------------------------------------

S. 3405 Ends the program after five years

The Committee continues to believe that putting a sunset on
the program's authorization ensures that Congress can
periodically review its effectiveness and make any necessary
improvements. Accordingly, S. 3405 terminates the CFATS program
five years after the date of enactment.

III. Legislative History

On September 4, 2018, Chairman Johnson (R-WI) introduced S.
3405, Protecting and Securing Chemical Facilities from
Terrorists Attacks Act of 2018, which was referred to the
Committee on Homeland Security and Governmental Affairs.
Senators Shelley Moore Capito (R-WV) and Steve Daines (R-MT)
are cosponsors.
The Committee considered S. 3405 at a business meeting on
September 26, 2018. During the business meeting, a modified
substitute amendment was offered by Chairman Johnson and
accepted by unanimous consent.
Ranking Member McCaskill (D-MO) offered two amendments at
the business meeting. McCaskill Amendment 1 as modified
requires that the Secretary of Homeland Security determine
which industry stewardship programs can participate in the
CFATS Recognition Program. McCaskill Amendment 2 as modified
clarified that only explosive materials regulated by ATF are
exempt from CFATS. It also requires the removal of any
additional explosive material that is designated as a CFATS
chemical of interest if it becomes regulated by DOJ or ATF in
the future. The Committee adopted McCaskill Amendment 1 as
modified and McCaskill Amendment 2 as modified both by voice
vote. Senators present for the votes on the amendments were:
Johnson, Paul, Lankford, Enzi, Daines, McCaskill, Heitkamp,
Peters, Hassan, Harris, and Jones.
The Committee favorably reported the bill, as amended, by
voice vote. Senators present were: Johnson, Portman, Paul,
Lankford, Enzi, Daines, McCaskill, Heitkamp, Peters, Hassan,
Harris, and Jones.
Consistent with Committee Rule 11, the Committee reports
the bill with a technical amendment by mutual agreement of the
Chairman and Ranking Member.

IV. Section-by-Section Analysis of the Bill, as Reported

Section 1. Short title; table of contents

This section provides the bill's short title, the
``Protecting and Securing Chemical Facilities from Terrorists
Attacks Act of 2018'', and a table of contents.

Section 2. Definitions

This section clarifies the definition of the term
``guidance for expedited approval facilities''.

Section. 3. Expedited approval program

This section requires the Secretary of Homeland Security to
maintain guidance for the expedited approval program. This
section also adds language that an owner or operator of a
facility should consider, but is not required, to utilize the
guidance for expedited approval facilities to determine
appropriate security measures for site security plans.
This section also shortens the length of the required
notice period from 30 days to 7 days before a facility owner or
operator may submit their expedited approval site security plan
and certification to the Department.
This section also requires that DHS notify all new and
currently-covered CFATS facilities of the expedited approval
program.

Section. 4. CFATS Recognition Program

This section requires the Secretary of Homeland Security to
establish a CFATS recognition program within 270 days of
enactment that leverages industry stewardship programs to
further secure covered chemical facilities. It also requires
the Secretary to establish criteria for the CFATS recognition
program, including industry stewardship program eligibility,
performance requirements, incentives to encourage
participation, and issue guidance.
This section also requires the Secretary of Homeland
Security to establish minimum eligibility criteria for industry
stewardship programs that would like to participate in the
program. The section mandates certain requirements, including
industry stewardship programs be governed by an industry
association or technical organization; documentation showing
the industry stewardship program's top management is committed
to chemical facility security; criteria for program auditing,
security vulnerability assessment requirements, Risk-Based
Performance Standards incorporated into security measures, and
required reporting.
This section also requires the Secretary of Homeland
Security to establish facility performance requirements. This
includes the facility submitting an acknowledgment by its
sponsor industry stewardship organization that the facility is
a member in good standing and in full compliance with the
industry stewardship program's security requirements. It also
requires a participating facility to notify the Secretary of
Homeland Security if they cease to be in good standing or in
full compliance with the requirements of the participating
industry stewardship program.
This section requires the Secretary of Homeland Security to
establish program incentives for participation in the CFATS
Recognition Program, including lowering the occurrence of
compliance inspections; streamlining processes for
vulnerability assessments and site security plans; and
providing additional regulatory relief as appropriate.

Section. 5. Frequency of audits and inspections

This section limits the frequency of CFATS facility audits
and inspections to once every two years for a covered chemical
facility and once every three years for a covered chemical
facility participating in a CFATS recognition program that
meets compliance, audit, and inspection requirements.
This section stipulates that the Secretary may only conduct
more frequent audits and inspections for the following reasons:
a covered facility has identified planned enhancements that
have not been verified; DHS identifies a deficiency or
infraction that could result in an enforcement action against
the facility; the Department has identified a specific or
elevated threat to a chemical facility; a specific incident or
suspicious activity occurred at the facility; or the Secretary
determines there are exigent circumstances requiring an
inspection or audit.

Section. 6. Personnel Surety Program

This section makes terrorist screening provisions under the
Personnel Surety Program mandatory for Tier 1 and Tier 2
covered facilities and optional for Tier 3 and Tier 4 covered
facilities.

Section. 7. Security risk assessment approach and corresponding tiering
methodology

This section requires the Secretary of Homeland Security to
maintain additional information on why DHS changed a covered
facility's tier or DHS determines the covered facility should
no longer be regulated under CFATS.
Whenever DHS modifies a covered facilities tier or
determines they should no longer be regulated by the CFATS
program, this section also requires the Secretary to submit a
controlled unclassified explanation for the change to
facilities within 30 days.

Section. 8. Annual performance reporting

This section requires the Secretary of Homeland Security to
report annually to Congress on performance metrics, instead of
every six months. It also requires DHS to report on how
effectively the program manages security risks, develops and
utilizes metrics, and its ability to measure risk reduction
over time.

Section. 9. Specific products and mixtures containing chemicals of
interest

This section gives the Secretary of Homeland Security sole
and unreviewable discretion to review petitions from interested
parties to remove a covered product or mixture from CFATS
regulation if the Secretary determines that specific product or
mixture does not present the same hazards for which the
chemical of interest was originally designated under CFATS.
Within one year of enactment, the Secretary must publish
regulations on the petition process for which an interested
party can request for an exclusion of a covered product or
mixture.

Section. 10. CFATS regulations

This section amends and provides technical edits to Section
2107(b) of the Homeland Security Act of 2002 (6 U.S.C. 627(b)).

Section. 11. Explosive materials

This section exempts explosive materials from the CFATS
program if they are regulated by the Department of Justice
under chapter 40 of title 18, United States Code, or by the ATF
under part 555 of title 27, Code of Federal Regulations.
This section also requires the Secretary of Homeland
Security to remove any additional explosive material that is
designated as a CFATS chemical of interest if it becomes
regulated by DOJ or ATF in the future.

Section. 12. Changes to Appendix A to part 27 of title 6, Code of
Federal Regulations

This section requires the Secretary of Homeland Security to
publish a notice of proposed rulemaking before making changes
to Appendix A if the Secretary determines that a chemical
should now be designated as a CFATS chemical of interest; a
chemical of interest under Appendix A should no longer be
designated as a CFATS chemical of interest; or a CFATS chemical
of interest's amount, concentration, or threshold quantity
under Appendix A should be changed.

Section. 13. Assessment, report, briefing, and updated retrospective
estimate on costs

This section requires a third-party assessment, within one
year of enactment, to determine how effective the CFATS program
is at managing security risks, developing and using appropriate
metrics and analysis capabilities to measure risk reduction,
and engaging with first responders and emergency planners.
Within 90 days of the assessment's completion, the Secretary of
Homeland Security must provide a briefing on the assessment to
the Senate Committee on Homeland Security and Governmental
Affairs, House Committee on Homeland Security, and House
Committee on Energy and Commerce.
This section requires a GAO report on CFATS inspector
training and how it can be improved. The report should review
how DHS selects inspectors; the amount of training completed
before inspectors are selected as CFATS facility inspectors;
review of qualification standards, on-the-job training, final
qualification, approval standards, and continuous qualification
and training; and improving inspector cybersecurity training.
This section requires an annual briefing to Congress on
current threats to chemical facilities; how bad actors are
utilizing CFATS chemicals of interest; how CFATS is addressing
the threat landscape and making the United States safer; and
data, rationale, and metrics on how the CFATS program is
effectively reducing risk and enhancing security.
This section requires the Secretary of Homeland Security to
complete an updated retrospective estimate on costs to carry
out the CFATS program within one year of enactment. This
includes costs to the Government, regulated entities, and the
public.

Section. 14. Effective date

This section states that the legislation, any amendments
made by it, will take effect 30 days after the date of
enactment.

Section. 15. Termination

This section terminates the CFATS program five years after
the date of enactment.

Section. 16. Technical and conforming amendment

This section provides a technical and conforming amendment.

V. Evaluation of Regulatory Impact

Pursuant to the requirements of paragraph 11(b) of rule
XXVI of the Standing Rules of the Senate, the Committee has
considered the regulatory impact of this bill and determined
that the bill will have no regulatory impact within the meaning
of the rules. The Committee agrees with the Congressional
Budget Office's statement that the bill contains no
intergovernmental or private-sector mandates as defined in the
Unfunded Mandates Reform Act (UMRA) and would impose no costs
on state, local, or tribal governments.

VI. Congressional Budget Office Cost Estimate

U.S. Congress,
Congressional Budget Office,
Washington, DC, November 13, 2018.
Hon. Ron Johnson,
Chairman, Committee on Homeland Security and Governmental Affairs, U.S.
Senate, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for S. 3405, the Protecting
and Securing Chemical Facilities from Terrorist Attacks Act of
2018.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contact is William Ma.
Sincerely,
Keith Hall,
Director.
Enclosure.

S. 3405--Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2018

Summary: S. 3405 would extend for five years the Chemical
Facility Anti-Terrorism Standards (CFATS) program. CBO
estimates that implementing the bill would cost $348 million
over the 2019-2023 period, assuming appropriation of the
estimated amounts.
CBO also estimates that enacting S. 3405 would increase
direct spending by $2 million and would increase revenues by an
insignificant amount over the 2019-2028 period; therefore, pay-
as-you-go procedures apply.
CBO estimates that enacting S. 3405 would not increase net
direct spending or on-budget deficits in any of the four
consecutive 10-year periods beginning in 2029.
S. 3405 would impose intergovernmental and private-sector
mandates as defined in the Unfunded Mandates Reform Act (UMRA)
on operators of chemical facilities by reauthorizing existing
security standards and duties under the CFATS program. CBO
estimates the cost of the mandates would fall below the annual
intergovernmental and private-sector thresholds established in
UMRA ($80 million and $160 million in 2018, respectively,
adjusted annually for inflation).
Estimated cost to the Federal Government: The estimated
budgetary effects of S. 3405 are shown in the following table.
The costs of the legislation fall within budget functions 050
(national defense) and 800 (general government).

----------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
-----------------------------------------------------------------------------------------------------------------
2019 2020 2021 2022 2023 2019-2023
----------------------------------------------------------------------------------------------------------------
INCREASES IN SPENDING SUBJECT TO APPROPRIATIONa

Estimated Authorization Level...................... 60 74 76 79 81 370
Estimated Outlays.................................. 46 69 75 78 80 348

INCREASES IN DIRECT SPENDINGb

Estimated Budget Authority......................... 0 0 0 0 0 0
Estimated Outlays.................................. 1 1 0 0 0 2
----------------------------------------------------------------------------------------------------------------
Enacting S. 3405 also would increase revenues by an insignificant amount over the 2019-2028 period.
a. Implementing S. 3405 would require an additional appropriation of $25 million in 2024, CBO estimates. Another
$45 million in estimated outlays would occur over the 2024-2028 period, assuming appropriation of the
estimated amounts.
b. Enacting S. 3405 would increase direct spending by $2 million over the 2019-2028 period.

Basis of estimate: For this estimate, CBO assumes that S.
3405 will be enacted near the beginning of calendar year 2019.
Outlays are based on historical spending patterns for similar
programs.

Spending subject to appropriation

S. 3405 would extend the CFATS program for five years after
the date of enactment; the authority to carry out the current
program will expire in January 2019. Under CFATS, the
Department of Homeland Security (DHS) regulates security at
facilities that manufacture, store, or distribute any of more
than 300 chemicals that could be used by terrorists to cause
mass injury or death. The regulations set minimum standards for
perimeter security, access control, personnel security, and
cybersecurity to reduce the risk that those chemicals could be
stolen, released, or sabotaged. DHS provides technical
assistance and inspects regulated facilities to ensure that
they meet those standards.
For 2018, the Congress appropriated $72 million for the
CFATS program. CBO estimates that the reauthorization in the
bill would cover the last three quarters of fiscal year 2019
through the end of the first quarter of fiscal year 2024; thus,
the estimated amounts for CFATS in fiscal years 2019 and 2024
cover only nine months and three months, respectively. On the
basis of information from DHS, CBO estimates that implementing
the program extension would cost $346 million over the 2019-
2023 period, assuming appropriation of the estimated amounts.
Another $45 million would be spent after 2023.
S. 3045 would require the Government Accountability Office
and DHS to report to the Congress on the CFATS program. CBO
estimates that in addition to the costs mentioned above,
preparing those reports would cost $2 million over the 2019-
2023 period, CBO estimates.
Actual costs could differ if the Congress appropriates more
or less than the amounts estimated here; such decisions could
be based on information from federal agencies or other sources
that differs from the information CBO used for this estimate.

Direct spending

Section 13 would require DHS to use appropriations that are
available to the department under current law to obtain a
third-party assessment of the effectiveness of the CFATS
program. CBO expects that DHS would spend previously
appropriated funds that would otherwise not be spent. Changes
in outlays from enacted appropriations are classified as direct
spending. On the basis of information from DHS, CBO estimates
that the study would increase direct spending by $2 million
over the 2019-2028 period.

Revenues

Reauthorizing the CFATS program also would extend DHS's
authority to levy civil penalties against owners or operators
of facilities that fail to comply with orders to correct
deficiencies in their security plans. Funds collected under
that authority are deposited in the Treasury and recorded as
revenues. CBO estimates that DHS would collect less than
$500,000 over the 2019-2028 period.
Pay-As-You-Go considerations: The Statutory Pay-As-You-Go
Act of 2010 establishes budget-reporting and enforcement
procedures for legislation affecting direct spending or
revenues. The net changes in outlays and revenues that are
subject to those pay-as-you-go procedures are shown in the
following table.

CBO ESTIMATE OF PAY-AS-YOU-GO EFFECTS FOR S. 3405, THE PROTECTING AND SECURING CHEMICAL FACILITIES FROM TERRORIST ATTACKS ACT OF 2018, AS ORDERED
REPORTED BY THE SENATE COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS ON SEPTEMBER 26, 2018
--------------------------------------------------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
-------------------------------------------------------------------------------------------
2019- 2019-
2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2023 2028
--------------------------------------------------------------------------------------------------------------------------------------------------------
NET INCREASE IN THE DEFICIT

Statutory Pay-As-You-Go Effect.............................. 1 1 0 0 0 0 0 0 0 0 2 2
--------------------------------------------------------------------------------------------------------------------------------------------------------

Increase in long-term direct spending and deficits: CBO
estimates that enacting S. 3405 would not increase net direct
spending or on-budget deficits in any of the four consecutive
10-year periods beginning in 2029.
Mandates: S. 3405 would impose intergovernmental and
private-sector mandates as defined in UMRA on operators of
chemical facilities. The bill would reauthorize existing
security requirements, including vulnerability assessments and
site security plans, under the CFATS program. Because chemical
facilities are already subject to these mandates, the cost to
comply with the reauthorization would be small. The bill also
would introduce alternative processes for meeting some
requirements and would ease the stringency of requirements on
lower-risk facilities. These changes would further reduce the
costliness of the mandates. In total, CBO estimates that the
cost of the mandates would fall below the annual
intergovernmental and private-sector thresholds established in
UMRA ($80 million and $160 million in 2018, respectively,
adjusted annually for inflation).
Estimate prepared by: Federal Costs: William Ma; Mandates:
Andrew Laughlin.
Estimate reviewed by: David Newman, Chief, Defense,
International Affairs, and Veterans' Affairs Cost Estimates
Unit; Susan Willie, Chief, Public and Private Mandates Unit;
Leo Lex, Deputy Assistant Director for Budget Analysis.

VII. Changes in Existing Law Made by the Bill, as Reported

In compliance with paragraph 12 of rule XXVI of the
Standing Rules of the Senate, changes in existing law made by
the bill, as reported, are shown as follows: (existing law
proposed to be omitted is enclosed in brackets, new matter is
printed in italic, and existing law in which no change is
proposed is shown in roman):

HOMELAND SECURITY ACT OF 2002

* * * * * * *

SEC. 1. SHORT TITLE; TABLE OF CONTENTS.

(a) Short Title.--This Act may be cited as the ``Homeland
Security Act of 2002.''
(b) Table of Contents.--The table of contents for this Act
is as follows:
Sec. 1. * * *
* * * * * * *

TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS

* * * * * * *
Sec. 2103. Protection and sharing of information.[--]
* * * * * * *
[Sec. 2109. Outreach to chemical facilities of interest.]
Sec. 2109. Explosive materials.
Sec. 2110. Changes to Appendix A to part 27 of title 6, Code of Federal
Regulations.

* * * * * * *

TITLE XXI--CHEMICAL FACILITY ANTI-TERRORISM STANDARDS

SEC. 2101. DEFINITIONS.

In this title--
(1) * * *

* * * * * * *

(8) the term ``guidance for expedited approval
facilities'' means the guidance issued under [section
2102(c)(4)(B)(i)] section 2102(c)(4) by the Secretary
that identifies specific security measures that are
sufficient to meet the risk-based performance standards
for facilities in tiers 3 and 4 that elect to utilize
the expedited approval program;

* * * * * * *

SEC. 2102. CHEMICAL FACILITY ANTI-TERRORISM STANDARDS PROGRAM.

(a) * * *
(b) * * *
(c) Approval or Disapproval of Site Security Plans.--
(1) * * *

* * * * * * *

(4) Expedited approval program.--
(A) In general.--A covered chemical facility
assigned to tier 3 or 4 may meet the
requirement to develop and submit a site
security plan under subsection (a)(2)(D) by
developing and submitting to the Secretary--
(i) a site security plan and the
certification described in
[subparagraph (C)] subparagraph (C)(i);
or
(ii) * * *
(B) Guidance for expedited approval
facilities.--
(i) In general.--[Not later than 180
days after the date of enactment of the
Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall issue] The
secretary shall maintain guidance for
expedited approval facilities that
identifies specific security measures
that are sufficient to meet the risk-
based performance standards.
(ii) * * *
[(iii) Applicability of other laws to
development and issuance of initial
guidance.--During the period before the
Secretary has met the deadline under
clause (i), in developing and issuing,
or amending, the guidance for expedited
approval facilities under this
subparagraph and in collecting
information from expedited approval
facilities, the Secretary shall not be
subject to--
[(I) section 553 of title 5,
United States Code;
[(II) subchapter I of chapter
35 of title 44, United States
Code; or
[(III) section 2107(b) of
this title.]
(C) Certification.--[The owner]
(i) In general._The owner or operator
of an expedited approval facility shall
submit to the Secretary a
certification, signed under penalty of
perjury, that--
[(i)] (I) the owner or
operator is familiar with the
requirements of this title and
part 27 of title 6, Code of
Federal Regulations, or any
successor thereto, and the site
security plan being submitted;
[(ii)] (II) the site security
plan includes the security
measures required by subsection
(b);
[(iii)] (III)
[(I)] (aa) the security
measures in the site security
plan do not materially deviate
from the guidance for expedited
approval facilities except
where indicated in the site
security plan;
[(II)] (bb) any deviations
from the guidance for expedited
approval facilities in the site
security plan meet the risk-
based performance standards for
the tier to which the facility
is assigned; and
[(III)] (cc) the owner or
operator has provided an
explanation of how the site
security plan meets the risk-
based performance standards for
any material deviation;
[(iv)] (IV) the owner or
operator has visited, examined,
documented, and verified that
the expedited approval facility
meets the criteria set forth in
the site security plan;
[(v)] (V) the expedited
approval facility has
implemented all of the required
performance measures outlined
in the site security plan or
set out planned measures that
will be implemented within a
reasonable time period stated
in the site security plan;
[(vi)] (VI) each individual
responsible for implementing
the site security plan has been
made aware of the requirements
relevant to the individual's
responsibility contained in the
site security plan and has
demonstrated competency to
carry out those requirements;
[(vii)] (VII) the owner or
operator has committed, or, in
the case of planned measures
will commit, the necessary
resources to fully implement
the site security plan; and
[(viii)] (VIII) the planned
measures include an adequate
procedure for addressing events
beyond the control of the owner
or operator in implementing any
planned measures.
(ii) Risk-based performance
standards.--In submitting a site
security plan and certification under
subparagraph (A)(i), an owner or
operator of an expedited approval
facility should consider using the
guidance for expedited approval
facilities to determine appropriate
measures for the site security plan of
the expedited approval facility.
(D) Deadline.--
(i) In general.--Not later than 120
days after the date described in clause
(ii), the owner or operator of an
expedited approval facility shall
submit to the Secretary the site
security plan and the certification
described in [subparagraph (C)]
subparagraph (C)(i).
(ii) * * *
(iii) Notice.--An owner or operator
of an expedited approval facility shall
notify the Secretary of the intent of
the owner or operator to certify the
site security plan for the expedited
approval facility not later than [30] 7
days before the date on which the owner
or operator submits the site security
plan and certification described in
[subparagraph (C)] subparagraph (C)(i).
(E) * * *
(F) Amendments to site security plan.--
(i) Requirement.--
(I) In general.--If the owner
or operator of an expedited
approval facility amends a site
security plan submitted under
subparagraph (A), the owner or
operator shall submit the
amended site security plan and
a certification relating to the
amended site security plan that
contains the information
described in [subparagraph (C)]
subparagraph (C)(i).
(II) * * *
(G) * * *
(H) * * *
[(I) Evaluation.--
[(i) In general.--Not later than 18
months after the date of enactment of
the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall take any
appropriate action necessary for a full
evaluation of the expedited approval
program authorized under this
paragraph, including conducting an
appropriate number of inspections, as
authorized under subsection (d), of
expedited approval facilities.
[(ii) Report.--Not later than 18
months after the date of enactment of
the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act
of 2014, the Secretary shall submit to
the Committee on Homeland Security and
Governmental Affairs of the Senate and
the Committee on Homeland Security and
the Committee on Energy and Commerce of
the House of Representatives a report
that contains--
[(I)(aa) the number of
eligible facilities using the
expedited approval program
authorized under this
paragraph; and
[(bb) the number of
facilities that are eligible
for the expedited approval
program but are using the
standard process for developing
and submitting a site security
plan under subsection
(a)(2)(D);
[(II) any costs and
efficiencies associated with
the expedited approval program;
[(III) the impact of the
expedited approval program on
the backlog for site security
plan approval and authorization
inspections;
[(IV) an assessment of the
ability of expedited approval
facilities to submit facially
sufficient site security plans;
[(V) an assessment of any
impact of the expedited
approval program on the
security of chemical
facilities; and
[(VI) a recommendation by the
Secretary on the frequency of
compliance inspections that may
be required for expedited
approval facilities.]
(I) Notice by the Secretary.--The Secretary
shall provide notice to each covered chemical
facility of the expedited approval program
under this paragraph.
(5) CFATS recognition program.--
(A) Definitions.--In this paragraph--
(i) the term ``CFATS Recognition
Program'' means the program established
under subparagraph (B);
(ii) the term ``participating
facility'' means a covered chemical
facility that is a member of a
participating industry stewardship
program;
(iii) the term ``participating
industry stewardship program'' means an
industry stewardship program that--
(I) meets the eligibility
requirements under subparagraph
(C)(i); and
(II) is accepted by the
Secretary to participate in the
CFATS Recognition Program; and
(iv) the term ``sponsor
organization'' means the governing body
of a participating industry stewardship
program.
(B) Establishment.--
(i) In general.--Not later than 270
days after the date of enactment of
this paragraph, the Secretary shall
establish a program that shall be known
as the CFATS Recognition Program--
(I) with the goal of
leveraging CFATS regulations
and industry stewardship
programs to further enhance
security relating to hazardous
chemicals; and
(II) under which the
Secretary shall--
(aa) establish--
(AA)
eligibility
criteria under
subparagraph
(C)(i) for
industry
stewardship
programs
seeking to
Participate in
the CFATS
Recognition
Program; and
(BB)
performance
requirements
under
subparagraph(C)(
ii) for
participating
facilities;
(bb) provide
incentives under
subparagraph(C)(iii) to
Encourage participation
in the CFATS
Recognition Program;
and
(cc) issue such
guidance as the
Secretary deems
necessary or
appropriate for the
implementation of the
CFATS Recognition
Program.
(ii) Applicability of other laws.--
During the period before the Secretary
has met the deadline under clause (i),
in developing and issuing, or amending,
the guidance relating to carrying out
the CFATS Recognition Program and
collecting information from industry
stewardship programs, sponsor
organizations, and participating
facilities, the Secretary shall not be
subject to--
(I) section 553 of title 5,
United States Code;
(II) subchapter I of chapter
35 of title 44, United States
Code; or
(III) section 2107(b) of this
Act.
(C) Eligibility criteria; facility
performance requirements; incentives.--
(i) Eligibility criteria for industry
stewardship programs.--Not later than
270 days after the date of enactment of
this paragraph, the Secretary shall
establish minimum eligibility criteria
for industry stewardship programs
desiring to be considered by the
Secretary for participation in the
CFATS Recognition Program that shall
include--
(I) a requirement that any
industry stewardship program
desiring to participate in the
CFATS Recognition Program be
governed by an industry
association or technical
organization that is an entity
described in paragraph (3) or
(6) of section 501(c) of the
Internal Revenue Code of 1986;
(II) a documented top
management commitment to
chemical facility security;
(III) criteria relating to--
(aa) program auditing
requirements and
frequency;
(bb) security
vulnerability
assessment requirements
and frequency; and
(cc) security
measures that align
with the risk-based
performance standards
established under
subsection (a)(2)(C),
including--
(AA)
detection
measures;
(BB) delay
measures;
(CC)
cybersecurity
measures;
(DD) response
measures; and
(EE) security
management; and
(dd) reporting
required to be done by
any industry
stewardship program
desiring to participate
in the CFATS
Recognition Program.
(ii) Performance requirements for
participating facilities.--The
Secretary shall require that each
participating facility--
(I) submit an acknowledgment
by the sponsor organization of
the participating industry
steward program, of which the
participating facility is a
member, that the participating
facility is--
(aa) a member in good
standing of the
participating industry
stewardship program;
and
(bb) in full
compliance with the
requirements of the
participating industry
stewardship program;
and
(II) promptly notify the
Secretary if the participating
facility ceases to be--
(aa) a member in good
standing of the
participating industry
stewardship program; or
(bb) in full
compliance with the
requirements of the
participating industry
stewardship program.
(iii) Program incentives.--Not later
than 270 days after the date of
enactment of this paragraph, the
Secretary shall--
(I) establish incentives for
participation in the CFATS
Recognition Program, which
shall include--
(aa) a reduction in
the frequency of
compliance inspections,
except--
(AA) in the
case of any
inspection
relating to any
planned measure
in the site
security plan
of a
participating
facility that
has not been
fully
implemented; or
(BB) in a
case in which a
participating
facility is not
in full
compliance with
the
requirements
under the
Chemical
Facility Anti-
Terrorism
Standards
Program;
(bb) streamlined
vulnerability
assessment and site
security plan
processes; and
(cc) any other
regulatory relief as
determined appropriate
by the Secretary; and
(II) provide written guidance
on any incentive established
under subclause (I).
(D) Evaluation.--Not later than 1 year after
the date on which the CFATS Recognition Program
is established under subparagraph (B)(i), the
Secretary shall provide a briefing to the
Committee on Homeland Security and Governmental
Affairs of the Senate and the Committees on
Homeland Security and Energy and Commerce of
the House of Representatives on the progress in
carrying out the CFATS Recognition Program.
(d) Compliance.--
(1) Audits and inspections.--
(A) * * *
(B) Authority to conduct audits and
inspections.--[The Secretary] Subject to
subparagraph (G), the Secretary shall conduct
audits or inspections under this subchapter
using--
(i) * * *
(ii) * * *
(iii) * * *

* * * * * * *

(G) Frequency of audits and inspections.--
(i) In general.--Except as provided
in clauses (ii) and (iii), the
Secretary may not conduct any audit or
inspection under this paragraph of a
covered chemical facility more
frequently than once every 2 years.
(ii) CFATS recognition program.--
Except as provided in clause (iii), in
the case of a covered chemical facility
that participates in the CFATS
Recognition Program under subsection
(c)(5) and meets compliance, audit, and
inspection requirements under that
program, the Secretary may not conduct
any audit or inspection under this
paragraph of that covered chemical
facility more frequently than once
every 3 years.
(iii) Increased frequency of audits
and inspections.--The Secretary may
conduct audits and inspections more
frequently than provided in clauses (i)
and (ii) when--
(I) the covered chemical
facility has identified planned
enhancements that have not yet
been validated by an audit or
inspection;
(II) a deficiency or
infraction at the covered
chemical facility has been
identified that may result in
an enforcement action against
the covered chemical facility;
(III) an elevated or specific
threat has been identified;
(IV) a security incident or
suspicious activity has
occurred at the covered
chemical facility; or
(V) the Secretary determines
that an inspection or audit is
warranted by exigent
circumstances.
(2) Personnel surety.--
(A) Personnel surety program.--For purposes
of this title, the Secretary shall establish
and carry out a Personnel Surety Program that
is mandatory for each owner or operator of a
covered chemical facility assigned to tier 1 or
2 and optional for each owner or operator of a
covered chemical facility assigned to tier 3 or
4 that--
(i) * * *
(ii) provides a participating owner
or operator of a covered chemical
facility with relevant information
about an individual who will have
access to any chemical of interest
designated under Appendix A to part 27
of title 6, Code of Federal
Regulations, or any successor thereto,
based on vetting the individual against
the terrorist screening database, to
the extent that such feedback is
necessary for the facility to be in
compliance with regulations promulgated
under this title; and

* * * * * * *

(e) Responsibilities of the Secretary.--
(1) * * *
(2) Risk assessment.--
(A) In general.--For purposes of this title,
the Secretary shall [develop] maintain a
security risk assessment approach and
corresponding tiering methodology for covered
chemical facilities that incorporates the
relevant elements of risk, including threat,
vulnerability, and consequence.
(B) * * *
(3) Changes in tiering.--
(A) * * *
(B) Required information.--The records
maintained under subparagraph (A) shall include
information on whether and how the Secretary
confirmed the information that was the basis
for the change or determination described in
subparagraph (A)[.], including--
(i) each input and assumption under
the tiering methodology;
(ii) the rationale for each input;
and
(iii) the output of the tiering
methodology.
(C) Reports.--Not later than 30 days after
the Secretary makes a determination that
tiering for a covered chemical facility is
changed, or that a covered chemical facility is
no longer subject to the requirements under
this title, the Secretary shall submit to the
owner or operator of the covered chemical
facility a written report that contains--
(i) the information described in
subparagraphs (A) and (B); and
(ii) a controlled unclassified
statement--
(I) of the criteria under
paragraph (2)(B) and how the
security risk of terrorism
associated with the covered
chemical facility was evaluated
under those criteria; and
(II) that includes any
chemical terrorism
vulnerability information (as
defined in section 27.105 of
title 6, Code of Federal
Regulations, or any successor
thereto) relating to the
determination.
(D) Public disclosure.--Reports submitted to
the owner or operator of the covered chemical
facility to which the report pertains under
subparagraph (C) shall be protected from public
disclosure under section 2103.
(4) [Semiannual] Annual performance reporting--Not
later than [6 months after the date] 1 year after the
date of enactment of the Protecting and Securing
Chemical Facilities from Terrorist Attacks Act of
[2014] 2018, and not less frequently than [once every 6
months] once each year thereafter, the Secretary shall
submit to the Committee on Homeland Security and
Governmental Affairs of the Senate and the Committee on
Homeland Security and the Committee on Energy and
Commerce of the House of Representatives a report that
includes, for the period covered by the report--
(A) * * *
(B) * * *
[(C) the average number of days spent
reviewing site security or an alternative
security program for a covered chemical
facility prior to approval;]
[(D)] (C) the number of covered chemical
facilities inspected;
(D) the effectiveness of the Chemical
Facility Anti-Terrorism Standards Program at--
(i) managing security risks; and
(ii) developing and using appropriate
metrics and analysis capabilities to
measure risk reduction, including--
(I) vulnerability and
consequence mitigation
indicators; and
(II) outcome metrics that
measure cumulative risk
reduction over time; and
[(E) the average number of covered chemical
facilities inspected per inspector; and]
[(F)] (E) any other information that the
Secretary determines will be helpful to
Congress in evaluating the performance of the
Chemical Facility Anti-Terrorism Standards
Program.
(5) Specific products and mixtures containing
chemicals of interest.--
(A) Definitions.--In this paragraph--
(i) the term ``chemical of interest''
means a chemical designated as a
chemical of interest under Appendix A
to part 27 of title 6, Code of Federal
Regulations, or any successor thereto;
and
(ii) the term ``covered product or
mixture'' means a specific product or
mixture that contains a chemical of
interest at or above the minimum
concentration listed under Appendix A
to part 27 of title 6, Code of Federal
Regulations, or any successor thereto.
(B) In general.--The Secretary may exclude a
covered product or mixture from the designation
as a chemical of interest for the purposes of
the definition of the term ``chemical facility
of interest'' if, in the sole and unreviewable
discretion of the Secretary, the Secretary
determines that the covered product or mixture
does not present the same hazards for which the
chemical of interest contained in the covered
product or mixture was designated as a chemical
of interest.
(C) Regulations.--
(i) Promulgation.--Not later than 1
year after the date of enactment of
this paragraph, the Secretary shall
promulgate regulations to prescribe a
process under which an interested party
may petition the Secretary for
exclusion of a covered product or
mixture under subparagraph (B).
(ii) Federal information policy.--In
collecting information from petitioners
pursuant to this subparagraph, the
Secretary shall not be subject to
subchapter I of chapter 35 of title 44,
United States Code.

* * * * * * *

SEC. 2107. CFATS REGULATIONS.

(a) * * *
(b) Existing CFATS Regulations.--
(1) In general.--Notwithstanding section 4(b) of the
Protecting and Securing Chemical Facilities from
Terrorist Attacks Act of 2014 (Public Law 113-254; 128
Stat. 2919), each existing CFATS regulation shall
remain in effect unless the Secretary amends,
consolidates, or repeals the regulation.
(2) Repeal.--Not later than 30 days after the date of
enactment of the Protecting and Securing Chemical
Facilities from Terrorist Attacks Act of [2014] 2018,
the Secretary shall repeal any existing CFATS
regulation that the Secretary determines is duplicative
of, or conflicts with, this title.
(c) * * *

* * * * * * *

[SEC. 2109. OUTREACH TO CHEMICAL FACILITIES OF INTEREST.

[Not later than 90 days after the date of enactment of the
Protecting and Securing Chemical Facilities from Terrorist
Attacks Act of 2014, the Secretary shall establish an outreach
implementation plan, in coordination with the heads of other
appropriate Federal and State agencies, relevant business
associations, and public and private labor organizations, to--
[(1) identify chemical facilities of interest; and
[(2) make available compliance assistance materials
and information on education and training.]

SEC. 2109. EXPLOSIVE MATERIALS.

(a) In General.--The Secretary may not designate any
explosive material regulated by the Department of Justice under
chapter 40 of title 18, United States Code, or by the Bureau of
Alcohol, Tobacco, Firearms, and Explosives under part 555 of
title 27, Code of Federal Regulations, as a chemical of
interest under Appendix A to part 27 of title 6, Code of
Federal Regulations, or any successor thereto.
(b) Explosive Material Regulated After Designation.--If any
explosive material that is designated as a chemical of interest
under Appendix A to part 27 of title 6, Code of Federal
Regulations, or any successor thereto, becomes regulated by the
Department of Justice under chapter 40 of title 18, United
States Code, or by the Bureau of Alcohol, Tobacco, Firearms,
and Explosives under part 555 of title 27, Code of Federal
Regulations, or any successor thereto, the Secretary shall
remove the designation of such explosive material as a chemical
of interest.

SEC. 2110. CHANGES TO APPENDIX A TO PART 27 OF TITLE 6, CODE OF FEDERAL
REGULATIONS.

(a) Definition.--In this section, the term ``Appendix A''
means Appendix A to part 27 of title 6, Code of Federal
Regulations, or any successor thereto.
(b) Notice of Proposed Rulemaking.--The Secretary shall
publish a notice of proposed rulemaking in the Federal Register
relating to any proposed change to Appendix A if the Secretary
determines that--
(1) a chemical should be designated as a chemical of
interest under Appendix A;
(2) a chemical designated as a chemical of interest
under Appendix A should not be so designated; or
(3) a chemical amount, concentration, or threshold
quantity described in Appendix A should be modified.

[all]